@agimon-ai/doompi-git 0.0.1-alpha.3 → 0.0.1-alpha.30

package/dist/worktreeOperations-DAbs0ZTX.mjs

@@ -0,0 +1,1054 @@
+import { execFile } from "node:child_process";
+import fs from "node:fs";
+import { createHash, randomUUID } from "node:crypto";
+import { removeSyncLocation, resolveWorktreeSyncLocation } from "@agimon-ai/doompi-core/syncLocation";
+import path from "node:path";
+import os from "node:os";
+import { isDeepStrictEqual } from "node:util";
+import { setTimeout } from "node:timers/promises";
+//#region src/services/gitCli/index.ts
+/**
+* Git, as this package needs it.
+*
+* The timeouts are not uniform because the operations are not comparable. A
+* read answers in milliseconds; `worktree add` copies an entire checkout and
+* `worktree remove` deletes one, both bounded by the filesystem rather than by
+* git, and both minutes rather than seconds on a large repository or on
+* Windows. A single timeout would either fail honest work or hang on a wedged
+* one.
+*/
+const READ_TIMEOUT_MS = 3e4;
+const ADD_TIMEOUT_MS = 3e5;
+const REMOVE_TIMEOUT_MS = 3e5;
+const PRUNE_TIMEOUT_MS = 15e3;
+const MAX_OUTPUT_BYTES = 1e6;
+/**
+* Runs git and reports the outcome without ever throwing on a non-zero exit.
+*
+* LC_ALL is pinned because two callers below decide what to do by matching
+* git's own wording, and a translated message would silently turn a recognised
+* condition into an unrecognised failure.
+*/
+function git(cwd, args, timeout) {
+	return new Promise((resolve) => {
+		execFile("git", [...args], {
+			cwd,
+			timeout,
+			maxBuffer: MAX_OUTPUT_BYTES,
+			env: {
+				...process.env,
+				LC_ALL: "C"
+			}
+		}, (error, stdout, stderr) => {
+			resolve({
+				code: error && typeof error.code === "number" ? error.code : error ? 1 : 0,
+				stdout: String(stdout),
+				stderr: String(stderr)
+			});
+		});
+	});
+}
+/**
+* The message a failed git call is allowed to surface.
+*
+* Raw stderr never travels: it can carry a remote URL with a token in it, and
+* this text ends up in a tool result the model reads and may repeat.
+*/
+function failure(operation, result) {
+	return /* @__PURE__ */ new Error(`git ${operation} failed (exit ${String(result.code)}, ${String(result.stderr.length)} bytes of stderr)`);
+}
+/** Git's own words for "that worktree is not there any more". */
+function missingWorktree(stderr) {
+	const normalized = stderr.toLowerCase();
+	return normalized.includes("is not a working tree") || normalized.includes("cannot remove working tree");
+}
+function createWorktreeGit() {
+	const prune = async (repositoryRoot) => {
+		await git(repositoryRoot, ["worktree", "prune"], PRUNE_TIMEOUT_MS);
+	};
+	return {
+		async addWorktree({ repositoryRoot, path, branch, baseRef }) {
+			const result = await git(repositoryRoot, [
+				"worktree",
+				"add",
+				"-b",
+				branch,
+				path,
+				baseRef
+			], ADD_TIMEOUT_MS);
+			if (result.code !== 0) throw failure("worktree add", result);
+		},
+		async removeWorktree({ repositoryRoot, path, force }) {
+			const result = await git(repositoryRoot, [
+				"worktree",
+				"remove",
+				...force ? ["--force"] : [],
+				path
+			], REMOVE_TIMEOUT_MS);
+			if (result.code === 0) return;
+			if (missingWorktree(result.stderr) && !fs.existsSync(path)) {
+				await prune(repositoryRoot);
+				return;
+			}
+			throw failure("worktree remove", result);
+		},
+		async deleteBranch({ repositoryRoot, branch }) {
+			return (await git(repositoryRoot, [
+				"branch",
+				"-d",
+				branch
+			], READ_TIMEOUT_MS)).code === 0;
+		},
+		pruneWorktrees: prune,
+		async listWorktreePaths(repositoryRoot) {
+			const result = await git(repositoryRoot, [
+				"worktree",
+				"list",
+				"--porcelain"
+			], READ_TIMEOUT_MS);
+			if (result.code !== 0) return [];
+			return result.stdout.split("\n").filter((line) => line.startsWith("worktree ")).map((line) => line.slice(9).trim()).filter((line) => line !== "");
+		},
+		async dirtyFiles(path) {
+			const result = await git(path, ["status", "--porcelain"], READ_TIMEOUT_MS);
+			if (result.code !== 0) return [];
+			return result.stdout.split("\n").map((line) => line.slice(3).trim()).filter((line) => line !== "");
+		},
+		async repositoryRoot(cwd) {
+			const result = await git(cwd, ["rev-parse", "--show-toplevel"], READ_TIMEOUT_MS);
+			if (result.code !== 0) return void 0;
+			const root = result.stdout.trim();
+			return root === "" ? void 0 : root;
+		},
+		async currentBranch(cwd) {
+			const result = await git(cwd, [
+				"rev-parse",
+				"--abbrev-ref",
+				"HEAD"
+			], READ_TIMEOUT_MS);
+			if (result.code !== 0) return void 0;
+			const branch = result.stdout.trim();
+			return branch === "" ? void 0 : branch;
+		},
+		async remoteBaseRef(cwd) {
+			const upstream = await git(cwd, [
+				"rev-parse",
+				"--abbrev-ref",
+				"--symbolic-full-name",
+				"@{upstream}"
+			], READ_TIMEOUT_MS);
+			if (upstream.code === 0) {
+				const branch = upstream.stdout.trim();
+				if (branch !== "") return branch;
+			}
+			const origin = await git(cwd, [
+				"symbolic-ref",
+				"--quiet",
+				"--short",
+				"refs/remotes/origin/HEAD"
+			], READ_TIMEOUT_MS);
+			if (origin.code === 0) {
+				const branch = origin.stdout.trim();
+				if (branch !== "") return branch;
+			}
+			const defaults = await git(cwd, [
+				"for-each-ref",
+				"--format=%(symref:short)",
+				"refs/remotes"
+			], READ_TIMEOUT_MS);
+			if (defaults.code !== 0) return void 0;
+			return defaults.stdout.split("\n").map((line) => line.trim()).find((line) => line !== "");
+		},
+		async mergeBranch({ repositoryRoot, branch, message }) {
+			const result = await git(repositoryRoot, [
+				"merge",
+				"--no-ff",
+				...message === void 0 ? [] : ["-m", message],
+				branch
+			], READ_TIMEOUT_MS);
+			if (result.code === 0) return;
+			throw failure("merge", result);
+		}
+	};
+}
+//#endregion
+//#region src/services/compositionMirror/index.ts
+/**
+* Giving a new worktree the build output its parent checkout already has.
+*
+* DESIGN PATTERNS:
+* - Mirrors, never builds. Everything here is a copy or a symlink of something
+*   the parent checkout already produced, so it costs seconds and cannot fail
+*   the way a package manager or a compiler can.
+* - `node_modules` is linked, `dist` is copied. The module tree is gigabytes
+*   and read-only in practice, so a link is right; build output is small and a
+*   link would send a build run inside the worktree straight into the parent's
+*   directory.
+* - Absent parent output means nothing to do. A repository with no
+*   `node_modules` at its root is either not a JS project or not installed, and
+*   either way this has no opinion about it, so a Rust, Go or Python worktree
+*   pays nothing.
+*
+* WHY THIS EXISTS:
+* A DoomPi session composes the extensions its repository's config names, and
+* this repository names its own workspace packages by relative path. Those
+* packages declare `pi.extensions` under `dist/`, which git does not track, so
+* a fresh worktree resolves none of them and the session dies on start. The
+* parent checkout has already built exactly what the child needs.
+*
+* AVOID:
+* - Recursing into `node_modules`. The scan is bounded and skips it; without
+*   that this walks a gigabyte to find nothing.
+* - Treating a mirror failure as fatal. The worktree is good either way; only
+*   the session's composition is poorer for it.
+*/
+/** Directories that are build output worth copying into a new worktree. */
+const OUTPUT_DIRECTORY = "dist";
+const MODULES_DIRECTORY = "node_modules";
+const GIT_DIRECTORY = ".git";
+/**
+* How deep the scan goes.
+*
+* Four levels reaches `layers/<group>/<package>/dist` in this repository's
+* layout, and a workspace that buries a package deeper than that gets a
+* partial mirror rather than a slow one.
+*/
+const MAX_DEPTH = 4;
+function scan(root) {
+	const found = {
+		outputs: [],
+		modules: []
+	};
+	const walk = (relative, depth) => {
+		let entries;
+		try {
+			entries = fs.readdirSync(path.join(root, relative), { withFileTypes: true });
+		} catch {
+			return;
+		}
+		for (const entry of entries) {
+			const child = relative === "" ? entry.name : `${relative}/${entry.name}`;
+			if (entry.name === GIT_DIRECTORY) continue;
+			if (entry.name === MODULES_DIRECTORY) {
+				try {
+					if (entry.isDirectory() || entry.isSymbolicLink() && fs.statSync(path.join(root, child)).isDirectory()) found.modules.push(child);
+				} catch {}
+				continue;
+			}
+			if (!entry.isDirectory()) continue;
+			if (entry.name === OUTPUT_DIRECTORY) {
+				found.outputs.push(child);
+				continue;
+			}
+			if (depth < MAX_DEPTH) walk(child, depth + 1);
+		}
+	};
+	walk("", 1);
+	return found;
+}
+/**
+* Copies the parent's build output into a worktree and links its modules.
+*
+* Individual failures are counted out rather than thrown: a mirror that lands
+* partly is still better than none, and the caller has a worktree either way.
+*/
+function mirrorComposition(source, target) {
+	if (!fs.existsSync(path.join(source, MODULES_DIRECTORY))) return {
+		kind: "skipped",
+		reason: "no-modules"
+	};
+	const found = scan(source);
+	let copied = 0;
+	let linked = 0;
+	for (const relative of found.modules) {
+		const destination = path.join(target, relative);
+		if (fs.existsSync(destination)) continue;
+		try {
+			fs.mkdirSync(path.dirname(destination), { recursive: true });
+			fs.symlinkSync(fs.realpathSync(path.join(source, relative)), destination, "dir");
+			linked += 1;
+		} catch {}
+	}
+	for (const relative of found.outputs) {
+		const destination = path.join(target, relative);
+		if (fs.existsSync(destination)) continue;
+		try {
+			fs.mkdirSync(path.dirname(destination), { recursive: true });
+			fs.cpSync(path.join(source, relative), destination, { recursive: true });
+			copied += 1;
+		} catch {}
+	}
+	return {
+		kind: "mirrored",
+		copied,
+		linked
+	};
+}
+//#endregion
+//#region src/services/errors/index.ts
+var DoomGitExpectedError = class extends Error {
+	code;
+	retryable;
+	recovery;
+	constructor(code, message, retryable, recovery) {
+		super(`[${code}] ${message}\nRecovery: ${recovery}`);
+		this.code = code;
+		this.retryable = retryable;
+		this.recovery = recovery;
+		this.name = "DoomGitExpectedError";
+	}
+};
+/** Raised when a worktree action needs the canonical hub but it is not injected. */
+var HubUnavailableError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "HubUnavailableError";
+	}
+};
+function invalidRequest(message, recovery) {
+	return new DoomGitExpectedError("invalid_request", message, false, recovery);
+}
+//#endregion
+//#region src/services/atomicJson/index.ts
+const OWNER_ONLY_FILE = 384;
+/**
+* Writes JSON so a reader never sees a half-written file.
+*
+* The registry is read by the same process that writes it, and by a later
+* process after a crash. A plain write can be interrupted between the truncate
+* and the last byte, which leaves a file that parses as nothing and loses every
+* record in it. Writing beside the target and renaming makes the swap atomic on
+* the same filesystem, so a reader sees either the old file or the new one.
+*/
+function writeJsonAtomic(file, value) {
+	const directory = path.dirname(file);
+	fs.mkdirSync(directory, { recursive: true });
+	const temporary = path.join(directory, `.${path.basename(file)}.${String(process.pid)}.tmp`);
+	fs.writeFileSync(temporary, `${JSON.stringify(value, null, 2)}\n`, { mode: OWNER_ONLY_FILE });
+	fs.renameSync(temporary, file);
+}
+/**
+* Reads JSON, treating every failure as absent.
+*
+* A missing file and an unparseable one mean the same thing to every caller
+* here: there is nothing to act on. Distinguishing them would only offer a
+* choice no caller wants to make.
+*/
+function readJson(file) {
+	try {
+		return JSON.parse(fs.readFileSync(file, "utf8"));
+	} catch {
+		return;
+	}
+}
+//#endregion
+//#region src/services/repositoryIdentity/index.ts
+const ID_LENGTH = 12;
+const MAX_LABEL_LENGTH = 32;
+/**
+* The git directory shared by a repository and all of its worktrees.
+*
+* A normal checkout has a `.git` directory. A linked worktree has a `.git`
+* FILE pointing at `<common>/worktrees/<name>`, whose `commondir` points back
+* at the shared directory. Following that chain is what makes every worktree of
+* one repository agree on the repository's identity, which matters here because
+* the registry is per repository and must be found from inside a worktree too.
+* A session may run in a subdirectory, so the nearest enclosing checkout is used.
+*/
+function gitCommonDirectory(directory) {
+	let root = path.resolve(directory);
+	let marker = path.join(root, ".git");
+	let stat;
+	for (;;) try {
+		stat = fs.statSync(marker);
+		break;
+	} catch {
+		const parent = path.dirname(root);
+		if (parent === root) return void 0;
+		root = parent;
+		marker = path.join(root, ".git");
+	}
+	if (stat.isDirectory()) return marker;
+	let pointer;
+	try {
+		pointer = fs.readFileSync(marker, "utf8").trim();
+	} catch {
+		return;
+	}
+	if (!pointer.startsWith("gitdir:")) return void 0;
+	const gitDir = path.resolve(root, pointer.slice(7).trim());
+	try {
+		const common = fs.readFileSync(path.join(gitDir, "commondir"), "utf8").trim();
+		return path.resolve(gitDir, common);
+	} catch {
+		return gitDir;
+	}
+}
+/** A directory name that is recognisable to a person and safe on a filesystem. */
+function repositoryLabel(root) {
+	const label = path.basename(root).toLowerCase().replace(/[^a-z0-9]+/gu, "-").replace(/^-+|-+$/gu, "").slice(0, MAX_LABEL_LENGTH);
+	return label === "" ? "repository" : label;
+}
+/**
+* A stable id for the repository a directory belongs to.
+*
+* Keyed on the common git directory rather than the given path, so the main
+* checkout and every worktree of it resolve to one id and therefore to one
+* registry. Falling back to the path keeps a non-repository directory usable
+* instead of failing, though nothing here should reach that case.
+*/
+function repositoryId(root) {
+	const common = gitCommonDirectory(root);
+	const token = common === void 0 ? `root:${path.resolve(root)}` : `git:${common}`;
+	return createHash("sha256").update(token).digest("hex").slice(0, ID_LENGTH);
+}
+/** A short, collision-resistant suffix for one worktree directory. */
+function shortId(seed) {
+	return createHash("sha256").update(seed).digest("hex").slice(0, 8);
+}
+//#endregion
+//#region src/services/paths/index.ts
+/**
+* Where this package keeps its own state.
+*
+* Outside the repository on purpose. A worktree directory inside the checkout
+* would be found by every glob the repository's own tooling runs, and would
+* resolve workspace imports against the parent checkout rather than the
+* worktree, so a session there would build the wrong source while appearing to
+* work.
+*/
+function doomGitRoot(homeDir = os.homedir()) {
+	return path.join(homeDir, ".pi", ".doom", "git");
+}
+/** The directory every worktree for every repository is created under. */
+function worktreesRoot(homeDir = os.homedir()) {
+	return path.join(doomGitRoot(homeDir), "worktrees");
+}
+/** One registry file per repository, keyed by the shared git directory. */
+function registryFile(repositoryRoot, homeDir = os.homedir()) {
+	const id = repositoryId(repositoryRoot);
+	const root = path.join(doomGitRoot(homeDir), "registry");
+	const canonical = path.join(root, id, "worktrees.json");
+	if (fs.existsSync(canonical)) return canonical;
+	let names;
+	try {
+		names = fs.readdirSync(root);
+	} catch {
+		return canonical;
+	}
+	const legacyFiles = names.filter((entry) => entry.endsWith(`--${id}`)).sort().map((entry) => path.join(root, entry, "worktrees.json")).filter((file) => fs.existsSync(file));
+	if (legacyFiles.length === 0) return canonical;
+	const entries = /* @__PURE__ */ new Map();
+	for (const file of legacyFiles) {
+		const legacy = readJson(file);
+		if (legacy?.version !== 1 || !Array.isArray(legacy.entries)) continue;
+		for (const value of legacy.entries) {
+			if (typeof value !== "object" || value === null || !("id" in value) || typeof value.id !== "string" || value.id === "") continue;
+			const entry = value;
+			const existing = entries.get(entry.id);
+			if (existing !== void 0 && !isDeepStrictEqual(existing, entry)) throw new Error(`Conflicting legacy worktree registry entries for '${entry.id}'.`);
+			entries.set(entry.id, entry);
+		}
+	}
+	const temporary = `${canonical}.${randomUUID()}.migration`;
+	writeJsonAtomic(temporary, {
+		version: 1,
+		entries: [...entries.values()]
+	});
+	try {
+		fs.linkSync(temporary, canonical);
+	} catch (error) {
+		if (error.code !== "EEXIST") throw error;
+	} finally {
+		fs.rmSync(temporary);
+	}
+	return canonical;
+}
+//#endregion
+//#region src/services/worktreeEvents/index.ts
+const GIT_WORKTREE_LIFECYCLE_EVENT = "git_worktree_lifecycle";
+const GIT_WORKTREE_MESSAGE_EVENT = "git_worktree_message";
+const MAX_WORKTREE_MESSAGE_BYTES = 65536;
+function isMessageParty(value) {
+	return value === "parent" || value === "child";
+}
+function parseMessage(value) {
+	if (typeof value !== "object" || value === null) return void 0;
+	const record = value;
+	if (record.version !== 1) return void 0;
+	if (typeof record.worktreeId !== "string" || record.worktreeId === "") return void 0;
+	if (typeof record.fromSessionId !== "string" || record.fromSessionId === "") return void 0;
+	if (!isMessageParty(record.from)) return void 0;
+	if (typeof record.text !== "string" || record.text === "") return void 0;
+	if (Buffer.byteLength(record.text, "utf8") > 65536) return void 0;
+	if (typeof record.sentAt !== "string" || record.sentAt === "") return void 0;
+	return record;
+}
+function createWorktreeMessageInbox(directEvents, sessionId) {
+	if (sessionId === "") throw new Error("The Git message service requires a session identity.");
+	const messages = /* @__PURE__ */ new Map();
+	const unsubscribe = directEvents.subscribe(GIT_WORKTREE_MESSAGE_EVENT, sessionId, (payload) => {
+		const message = parseMessage(payload);
+		if (message === void 0) return;
+		const inbox = messages.get(message.worktreeId) ?? [];
+		if (inbox.length >= 100) inbox.shift();
+		inbox.push(message);
+		messages.set(message.worktreeId, inbox);
+	});
+	let closed = false;
+	return {
+		send(targetSessionId, message) {
+			if (closed) throw new Error("The Git message service is closed.");
+			directEvents.publish(GIT_WORKTREE_MESSAGE_EVENT, targetSessionId, message);
+		},
+		receive(worktreeId) {
+			if (closed) return [];
+			const inbox = messages.get(worktreeId);
+			if (inbox === void 0) return [];
+			messages.delete(worktreeId);
+			return inbox;
+		},
+		close() {
+			if (closed) return;
+			closed = true;
+			unsubscribe();
+			messages.clear();
+		}
+	};
+}
+function isWorktreeLifecycleEvent(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const record = value;
+	return record.version === 1 && typeof record.repositoryRoot === "string" && record.repositoryRoot !== "";
+}
+//#endregion
+//#region src/services/worktreeNaming/index.ts
+const MAX_SLUG_LENGTH = 64;
+/**
+* A branch name reduced to one safe path segment.
+*
+* Slashes are the point: `wt/fix-auth` is a perfectly good branch and a
+* terrible directory name, because the nested directory it implies is not the
+* one the worktree lives in.
+*/
+function branchSlug(branch) {
+	const slug = branch.toLowerCase().replace(/[^a-z0-9]+/gu, "-").replace(/^-+|-+$/gu, "").slice(0, MAX_SLUG_LENGTH).replace(/-+$/gu, "");
+	return slug === "" ? "worktree" : slug;
+}
+/**
+* The directory for one worktree.
+*
+* The short id disambiguates two branches whose slugs collide, such as
+* `feature/x` and `feature_x`, which would otherwise want the same directory.
+*/
+function worktreeDirectory(input) {
+	const repository = `${input.repositoryLabel}--${input.repositoryId}`;
+	return `${input.worktreesRoot}/${repository}/${branchSlug(input.branch)}--${input.shortId}`;
+}
+/** Why a worktree cannot be created, or undefined when it can. */
+function refuseSpawn(input) {
+	if (input.branch.trim() === "") return "A branch name is required.";
+	const live = input.existing.find((record) => record.branch === input.branch && record.status !== "orphaned");
+	if (live) return `Branch ${input.branch} already has a worktree (${live.id}).`;
+}
+/** Why a worktree cannot be closed, or undefined when it can. */
+function refuseClose(input) {
+	if (!input.record) return "No worktree with that id. Call list to see the current ids.";
+	if (input.dirtyFiles.length === 0 || input.force) return void 0;
+	const names = input.dirtyFiles.slice(0, 10).join(", ");
+	const more = input.dirtyFiles.length > 10 ? `, and ${String(input.dirtyFiles.length - 10)} more` : "";
+	return `${String(input.dirtyFiles.length)} uncommitted file(s): ${names}${more}. Pass force: true to discard them.`;
+}
+/**
+* Marks records whose process or directory is gone as orphaned.
+*
+* Nothing is deleted here. A doompi-git orphan owns a directory that may hold
+* uncommitted work, so losing the record would lose the only pointer to it.
+* Deletion is always a separate, named decision.
+*/
+function reconcile(records, probe) {
+	const changed = [];
+	return {
+		records: records.map((record) => {
+			if (record.status === "orphaned") return record;
+			if (!(!probe.exists(record.path) || !probe.alive(record))) return record;
+			changed.push(record.id);
+			return {
+				...record,
+				status: "orphaned"
+			};
+		}),
+		changed
+	};
+}
+/**
+* What a prune would do, decided before anything is destroyed.
+*
+* Separating the plan from the execution is what makes dryRun honest and lets
+* the destructive half be reviewed on its own.
+*/
+function planPrune(input) {
+	const plan = {
+		remove: [],
+		forget: [],
+		untracked: [],
+		keptDirty: [],
+		keptBranches: []
+	};
+	const known = new Set(input.records.map((record) => record.path));
+	const listed = new Set(input.gitPaths);
+	for (const record of input.records) {
+		if (record.status !== "orphaned") continue;
+		if (!listed.has(record.path)) {
+			plan.forget.push(record);
+			continue;
+		}
+		if ((input.dirtyByPath.get(record.path) ?? []).length > 0) {
+			plan.keptDirty.push(record);
+			continue;
+		}
+		plan.remove.push(record);
+	}
+	for (const path of input.gitPaths) if (path.startsWith(`${input.worktreesRoot}/`) && !known.has(path)) plan.untracked.push(path);
+	return plan;
+}
+//#endregion
+//#region src/services/worktreeRegistry/index.ts
+const LOCK_WAIT_MS = 5e3;
+const LOCK_RETRY_MS = 25;
+function isRecord(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const record = value;
+	return record.version === 1 && typeof record.id === "string" && record.id !== "" && typeof record.path === "string" && typeof record.branch === "string" && typeof record.sessionId === "string";
+}
+/**
+* Repository mutations hold an exclusive directory lock from the read through
+* the final commit. This works across independently loaded packages and hosts.
+* A crashed owner leaves a visible lock, never a lease another writer may steal.
+*/
+function createWorktreeRegistry(file) {
+	return {
+		list() {
+			const parsed = readJson(file);
+			if (!parsed || parsed.version !== 1 || !Array.isArray(parsed.entries)) return [];
+			return parsed.entries.filter(isRecord);
+		},
+		replace(entries) {
+			writeJsonAtomic(file, {
+				version: 1,
+				entries
+			});
+		},
+		async transaction(operation, signal) {
+			const lock = `${file}.lock`;
+			fs.mkdirSync(path.dirname(file), { recursive: true });
+			const deadline = Date.now() + LOCK_WAIT_MS;
+			for (;;) {
+				signal?.throwIfAborted();
+				try {
+					fs.mkdirSync(lock, { mode: 448 });
+					break;
+				} catch (error) {
+					if (error.code !== "EEXIST") throw error;
+					if (Date.now() >= deadline) throw new DoomGitExpectedError("registry_busy", "Another worktree operation holds the repository registry.", true, "Retry after it finishes. After a host crash, inspect and remove the abandoned worktrees.json.lock directory.");
+					await setTimeout(LOCK_RETRY_MS, void 0, { signal });
+				}
+			}
+			try {
+				fs.writeFileSync(path.join(lock, "owner.json"), JSON.stringify({
+					pid: process.pid,
+					createdAt: (/* @__PURE__ */ new Date()).toISOString()
+				}), { mode: 384 });
+				signal?.throwIfAborted();
+				return await operation();
+			} finally {
+				fs.rmSync(lock, { recursive: true });
+			}
+		}
+	};
+}
+//#endregion
+//#region src/services/worktreeOperations/index.ts
+const GIT_WORKTREE_DELEGATION_KIND = "git.worktree.delegation";
+const GIT_WORKTREE_MESSAGE_KIND = "git.worktree.message";
+const GIT_WORKTREE_REPORT_KIND = "git.worktree.report";
+function createWorktreeOperations(deps) {
+	const { git } = deps;
+	const sessionService = deps.sessionService;
+	const mirror = deps.mirror ?? mirrorComposition;
+	const removeStorage = deps.cleanupStorage ?? ((repositoryRoot, worktreeRoot) => {
+		removeSyncLocation(resolveWorktreeSyncLocation(repositoryRoot, worktreeRoot, deps.homeDir));
+	});
+	const cleanupStorage = (repositoryRoot, worktreeRoot) => {
+		try {
+			removeStorage(repositoryRoot, worktreeRoot);
+		} catch (error) {
+			throw new DoomGitExpectedError("worktree_cleanup_failed", `The worktree checkout was removed, but its generated storage could not be deleted (${error instanceof Error ? error.message : String(error)}).`, true, "Retry close or prune after fixing the storage permissions.");
+		}
+	};
+	const now = deps.now ?? (() => /* @__PURE__ */ new Date());
+	const requireSessionService = () => {
+		if (sessionService === void 0) throw new HubUnavailableError("The cockpit session service is unavailable. Start the cockpit and try again.");
+		return sessionService;
+	};
+	const requireMessageInbox = () => {
+		if (deps.messageInbox === void 0) throw new HubUnavailableError("The Git message service is unavailable. Start the cockpit and try again.");
+		return deps.messageInbox;
+	};
+	const readSessionDelivery = () => deps.sessionDelivery?.();
+	const requireSessionDelivery = () => {
+		const delivery = readSessionDelivery();
+		if (delivery === void 0) throw new HubUnavailableError("The Session delivery service is unavailable. Start the cockpit and try again.");
+		return delivery;
+	};
+	const probe = {
+		alive: (record) => requireSessionService().isLive(record.sessionId),
+		exists: (path) => fs.existsSync(path)
+	};
+	/**
+	* Everything an action needs about the repository it is acting on.
+	*
+	* Resolved per call rather than cached: a session's cwd is stable, but the
+	* worktree registry is shared and another process may have written it since
+	* the last call.
+	*/
+	const resolve = async (context) => {
+		const root = await git.repositoryRoot(context.cwd);
+		if (root === void 0) throw new DoomGitExpectedError("not_a_repository", `${context.cwd} is not inside a git repository.`, false, "Run this from a repository checkout.");
+		const store = createWorktreeRegistry(registryFile(root, deps.homeDir));
+		return {
+			root,
+			store,
+			records: store.list()
+		};
+	};
+	const require = (records, id) => {
+		const record = records.find((entry) => entry.id === id);
+		if (record === void 0) throw new DoomGitExpectedError("worktree_not_found", `No worktree with id ${id}.`, false, "Call list to see the current ids.");
+		return record;
+	};
+	/**
+	* Refuses to destroy or merge a worktree another live session is using.
+	*
+	* `parentSessionId` records who asked for the worktree. Two sessions in one
+	* checkout share this registry, so without the check either could close the
+	* other's work in progress by id.
+	*
+	* Once that session is gone there is no owner left to protect, and refusing
+	* would strand the worktree: nothing else could ever close it.
+	*/
+	const requireOwner = (context, record, action) => {
+		if (record.parentSessionId === context.sessionId) return;
+		if (!requireSessionService().isLive(record.parentSessionId)) return;
+		throw new DoomGitExpectedError("worktree_not_owned", `Worktree ${record.id} belongs to another session.`, false, `Ask the session that created it to ${action} it, or close that session first.`);
+	};
+	const peerFor = (context, record) => {
+		if (context.sessionId === record.parentSessionId) return {
+			sessionId: record.sessionId,
+			party: "parent"
+		};
+		if (context.sessionId === record.sessionId) return {
+			sessionId: record.parentSessionId,
+			party: "child"
+		};
+		throw new DoomGitExpectedError("worktree_not_owned", `Worktree ${record.id} belongs to another session.`, false, "Use a worktree owned by this session.");
+	};
+	const requirePeerLive = (peerSessionId) => {
+		if (!requireSessionService().isLive(peerSessionId)) throw new DoomGitExpectedError("worktree_peer_unavailable", "The other worktree session is no longer live.", false, "Start a new worktree session before sending a message.");
+	};
+	const operations = {
+		async spawn(context, request, options) {
+			const { root, store, records } = await resolve(context);
+			const reservations = request.reservationId === void 0 ? void 0 : requireSessionService().reservations;
+			if (request.reservationId !== void 0 && (!reservations || request.task !== void 0)) throw new DoomGitExpectedError("invalid_request", "Reserved worktree sessions require host setup and cannot start a task.", false, "Create the session from its pending setup card.");
+			const reserved = request.reservationId === void 0 ? void 0 : reservations.read(request.reservationId, context.sessionId);
+			const existing = reserved === void 0 ? void 0 : records.find((record) => record.sessionId === reserved.sessionId);
+			if (existing) {
+				const expectedPath = worktreeDirectory({
+					worktreesRoot: worktreesRoot(deps.homeDir),
+					repositoryLabel: repositoryLabel(root),
+					repositoryId: repositoryId(root),
+					branch: request.branch,
+					shortId: shortId(reserved.sessionId)
+				});
+				if (existing.parentSessionId !== context.sessionId || existing.repositoryRoot !== root || existing.branch !== request.branch || existing.path !== expectedPath || existing.path !== reserved?.cwd || request.baseRef !== void 0 && existing.baseRef !== request.baseRef || !fs.existsSync(existing.path) || !(await git.listWorktreePaths(root)).includes(existing.path) || await git.repositoryRoot(existing.path) !== existing.path || await git.currentBranch(existing.path) !== request.branch) throw new DoomGitExpectedError("invalid_request", "The reserved checkout no longer matches this setup.", false, "Inspect the existing branch and checkout; they will not be replaced.");
+				if (!requireSessionService().isLive(existing.sessionId)) {
+					if ((await requireSessionService().create({
+						cwd: existing.path,
+						name: request.name ?? request.branch,
+						parentSessionId: context.sessionId,
+						sessionProvenance: "worktree",
+						reservationId: request.reservationId,
+						...options?.signal === void 0 ? {} : { signal: options.signal }
+					})).sessionId !== existing.sessionId) throw new Error("The host did not use the reserved session identity.");
+				}
+				await reservations.complete(request.reservationId, context.sessionId);
+				return existing;
+			}
+			const refusal = refuseSpawn({
+				branch: request.branch,
+				existing: records
+			});
+			if (refusal !== void 0) throw new DoomGitExpectedError("worktree_exists", refusal, false, "Pick another branch name, or close it.");
+			const taskDelivery = request.task === void 0 ? void 0 : requireSessionDelivery();
+			const baseRef = request.baseRef ?? await git.remoteBaseRef(root);
+			if (baseRef === void 0) throw new DoomGitExpectedError("git_failed", "No remote base branch is available for this repository.", false, "Fetch a remote branch or pass an explicit baseRef.");
+			const id = shortId(reserved?.sessionId ?? randomUUID());
+			let path = worktreeDirectory({
+				worktreesRoot: worktreesRoot(deps.homeDir),
+				repositoryLabel: repositoryLabel(root),
+				repositoryId: repositoryId(root),
+				branch: request.branch,
+				shortId: id
+			});
+			if (request.reservationId !== void 0) path = (await reservations.prepare(request.reservationId, context.sessionId, path)).cwd;
+			const recovering = reserved?.cwd !== void 0 && fs.existsSync(path);
+			if (recovering && (!(await git.listWorktreePaths(root)).includes(path) || await git.currentBranch(path) !== request.branch)) throw new DoomGitExpectedError("invalid_request", "The reserved checkout no longer matches this setup.", false, "Inspect the existing directory; it will not be replaced.");
+			const cancelled = () => options?.signal?.aborted === true;
+			const rollback = async () => {
+				if (reserved) return ` The reserved checkout at ${path} was retained for recovery.`;
+				await git.removeWorktree({
+					repositoryRoot: root,
+					path,
+					force: true
+				}).catch(() => void 0);
+				return await git.deleteBranch({
+					repositoryRoot: root,
+					branch: request.branch
+				}).catch(() => false) ? "" : ` The branch ${request.branch} has work on it and was kept.`;
+			};
+			options?.onProgress?.(`creating branch ${request.branch}\u2026`);
+			if (!recovering) await git.addWorktree({
+				repositoryRoot: root,
+				path,
+				branch: request.branch,
+				baseRef
+			});
+			if (cancelled()) throw new DoomGitExpectedError("spawn_cancelled", `Cancelled before the session started.${await rollback()}`, false, reserved ? "Retry setup with the same branch to recover the reserved checkout." : "The worktree was removed; run it again when you are ready.");
+			options?.onProgress?.("mirroring build output…");
+			if (!recovering) mirror(root, path);
+			options?.onProgress?.("starting session…");
+			let sessionId;
+			try {
+				sessionId = (await requireSessionService().create({
+					cwd: path,
+					name: request.name ?? request.branch,
+					parentSessionId: context.sessionId,
+					sessionProvenance: "worktree",
+					...options?.signal === void 0 ? {} : { signal: options.signal },
+					...request.reservationId === void 0 ? {} : { reservationId: request.reservationId }
+				})).sessionId;
+				if (reserved && sessionId !== reserved.sessionId) throw new Error("The host did not use the reserved session identity.");
+			} catch (error) {
+				const kept = await rollback();
+				if (cancelled()) throw new DoomGitExpectedError("spawn_cancelled", `Cancelled while the session was starting.${kept}`, false, reserved ? "Retry setup with the same branch to recover the reserved checkout." : "The worktree was removed; run it again when you are ready.");
+				if (error instanceof HubUnavailableError) throw new DoomGitExpectedError("hub_unavailable", `${error.message}${kept}`, true, "Start the cockpit and try again.");
+				throw error;
+			}
+			const record = {
+				version: 1,
+				id,
+				branch: request.branch,
+				baseRef,
+				path,
+				repositoryRoot: root,
+				sessionId,
+				parentSessionId: context.sessionId,
+				status: "running",
+				createdAt: now().toISOString()
+			};
+			try {
+				store.replace([...records, record]);
+			} catch (error) {
+				await requireSessionService().close(sessionId).catch(() => void 0);
+				const kept = await rollback();
+				throw new DoomGitExpectedError("registry_write_failed", `The worktree was created but the registry could not be written (${error.message}).${kept}`, true, "Check the registry file for permissions or free space, then try again.");
+			}
+			if (request.task !== void 0 && taskDelivery !== void 0) try {
+				const receipt = await taskDelivery.deliver({
+					recipientKey: sessionId,
+					kind: GIT_WORKTREE_DELEGATION_KIND,
+					prompt: request.task,
+					metadata: {
+						worktreeId: record.id,
+						fromRole: "parent",
+						text: request.task,
+						sentAt: record.createdAt
+					}
+				});
+				const admission = await taskDelivery.waitForAdmission(receipt.deliveryId);
+				if (admission !== "admitted") throw new Error(admission === "recovery_required" ? "The recipient could not admit the task." : "The recipient did not confirm task admission before the timeout.");
+			} catch (error) {
+				throw new DoomGitExpectedError("task_delivery_failed", `Worktree ${record.id} was created, but its task admission was not confirmed (${error.message}).`, true, `Use send with worktree ${record.id} to deliver the task without recreating the worktree.`);
+			}
+			if (request.reservationId !== void 0) await reservations.complete(request.reservationId, context.sessionId);
+			return record;
+		},
+		async close(context, id, force) {
+			const { root, store, records } = await resolve(context);
+			const record = require(records, id);
+			requireOwner(context, record, "close");
+			const refusal = refuseClose({
+				record,
+				dirtyFiles: fs.existsSync(record.path) ? await git.dirtyFiles(record.path) : [],
+				force
+			});
+			if (refusal !== void 0) throw new DoomGitExpectedError("worktree_dirty", refusal, false, "Commit the work, or pass force: true.");
+			await requireSessionService().close(record.sessionId);
+			await git.removeWorktree({
+				repositoryRoot: root,
+				path: record.path,
+				force
+			});
+			cleanupStorage(root, record.path);
+			store.replace(records.filter((entry) => entry.id !== id));
+			return record;
+		},
+		async list(context) {
+			const { store, records } = await resolve(context);
+			const outcome = reconcile(records, probe);
+			if (outcome.changed.length > 0) store.replace(outcome.records);
+			return outcome.records;
+		},
+		async status(context, id) {
+			const { records } = await resolve(context);
+			const record = require(records, id);
+			return {
+				record,
+				dirtyFiles: fs.existsSync(record.path) ? await git.dirtyFiles(record.path) : []
+			};
+		},
+		async merge(context, id, message) {
+			const { root, records } = await resolve(context);
+			const record = require(records, id);
+			requireOwner(context, record, "merge");
+			const parentDirty = await git.dirtyFiles(root);
+			if (parentDirty.length > 0) throw new DoomGitExpectedError("worktree_dirty", `The parent checkout has ${String(parentDirty.length)} uncommitted file(s): ${parentDirty.slice(0, 10).join(", ")}.`, false, "Commit or stash the parent checkout first.");
+			await git.mergeBranch({
+				repositoryRoot: root,
+				branch: record.branch,
+				...message === void 0 ? {} : { message }
+			});
+			return record;
+		},
+		/** Sends only between the parent session and its own worktree session. */
+		async send(context, id, message) {
+			if (Buffer.byteLength(message, "utf8") > 65536) throw new DoomGitExpectedError("message_too_large", `A message may not exceed ${String(MAX_WORKTREE_MESSAGE_BYTES)} bytes.`, false, "Send a shorter message.");
+			const { records } = await resolve(context);
+			const record = require(records, id);
+			const peer = peerFor(context, record);
+			requirePeerLive(peer.sessionId);
+			const sentAt = (/* @__PURE__ */ new Date()).toISOString();
+			const delivery = readSessionDelivery();
+			if (delivery !== void 0) {
+				const kind = peer.party === "parent" ? GIT_WORKTREE_MESSAGE_KIND : GIT_WORKTREE_REPORT_KIND;
+				const receipt = await delivery.deliver({
+					recipientKey: peer.sessionId,
+					kind,
+					prompt: peer.party === "parent" ? `Parent message for worktree ${record.id}:\n\n${message}` : `Report from worktree ${record.id}:\n\n${message}`,
+					metadata: {
+						worktreeId: record.id,
+						fromRole: peer.party,
+						text: message,
+						sentAt
+					}
+				});
+				const admission = await delivery.waitForAdmission(receipt.deliveryId);
+				if (admission !== "admitted") throw new DoomGitExpectedError("message_delivery_failed", `Worktree ${record.id} persisted the message, but its session did not confirm admission.`, true, admission === "recovery_required" ? "Call messages from the recipient session to recover the persisted text." : "The message remains durable; retry after the recipient is ready.");
+				return;
+			}
+			requireMessageInbox().send(peer.sessionId, {
+				version: 1,
+				worktreeId: record.id,
+				fromSessionId: context.sessionId,
+				from: peer.party,
+				text: message,
+				sentAt
+			});
+		},
+		async messages(context, id) {
+			const { records } = await resolve(context);
+			const record = require(records, id);
+			const peer = peerFor(context, record);
+			const delivery = readSessionDelivery();
+			if (delivery === void 0) return requireMessageInbox().receive(record.id);
+			return delivery.inbox({
+				consumed: false,
+				metadata: { worktreeId: record.id }
+			}).filter((entry) => entry.senderKey === peer.sessionId && (entry.state === "admitted" || entry.state === "recovery_required") && (peer.party === "parent" ? entry.kind === GIT_WORKTREE_REPORT_KIND : entry.kind === GIT_WORKTREE_MESSAGE_KIND || entry.kind === GIT_WORKTREE_DELEGATION_KIND)).map((entry) => {
+				delivery.consume(entry.deliveryId);
+				return {
+					version: 1,
+					worktreeId: record.id,
+					fromSessionId: entry.senderKey,
+					from: peer.party === "parent" ? "child" : "parent",
+					text: entry.state === "recovery_required" ? `[Recovery required: prompt admission was not confirmed] ${entry.metadata.text ?? entry.prompt}` : entry.metadata.text ?? entry.prompt,
+					sentAt: entry.metadata.sentAt ?? ""
+				};
+			});
+		},
+		async prune(context, dryRun) {
+			const { root, store, records } = await resolve(context);
+			const reconciled = reconcile(records, probe);
+			const gitPaths = await git.listWorktreePaths(root);
+			const dirtyByPath = /* @__PURE__ */ new Map();
+			for (const record of reconciled.records) if (record.status === "orphaned" && fs.existsSync(record.path)) dirtyByPath.set(record.path, await git.dirtyFiles(record.path));
+			const plan = planPrune({
+				records: reconciled.records,
+				gitPaths,
+				worktreesRoot: worktreesRoot(deps.homeDir),
+				dirtyByPath
+			});
+			if (dryRun) {
+				store.replace(reconciled.records);
+				return plan;
+			}
+			for (const record of plan.remove) {
+				await git.removeWorktree({
+					repositoryRoot: root,
+					path: record.path,
+					force: false
+				});
+				cleanupStorage(root, record.path);
+			}
+			for (const record of plan.forget) cleanupStorage(root, record.path);
+			for (const record of [...plan.remove, ...plan.forget]) if (!await git.deleteBranch({
+				repositoryRoot: root,
+				branch: record.branch
+			}).catch(() => false)) plan.keptBranches.push(record.branch);
+			const dropped = new Set([...plan.remove, ...plan.forget].map((record) => record.id));
+			store.replace(reconciled.records.filter((record) => !dropped.has(record.id)));
+			return plan;
+		}
+	};
+	const locked = async (context, operation, signal) => {
+		try {
+			const { store } = await resolve(context);
+			return await store.transaction(operation, signal);
+		} catch (error) {
+			if (signal?.aborted && !(error instanceof DoomGitExpectedError)) throw new DoomGitExpectedError("spawn_cancelled", "The worktree operation was cancelled.", false, "Inspect its recorded state before retrying.");
+			if ([
+				"ENOTDIR",
+				"EACCES",
+				"EROFS",
+				"ENOSPC"
+			].includes(String(error.code))) throw new DoomGitExpectedError("registry_write_failed", "The worktree registry is not writable.", true, "Check permissions and free space before retrying.");
+			throw error;
+		}
+	};
+	return {
+		...operations,
+		spawn: (context, request, options) => {
+			if (sessionService === void 0) return Promise.reject(new DoomGitExpectedError("hub_unavailable", "The cockpit session service is unavailable.", true, "Use the cockpit worktree tool after its Git server facet is available."));
+			return locked(context, () => operations.spawn(context, request, options), options?.signal);
+		},
+		close: (context, id, force) => locked(context, () => operations.close(context, id, force)),
+		list: (context) => locked(context, () => operations.list(context)),
+		merge: (context, id, message) => locked(context, () => operations.merge(context, id, message)),
+		prune: (context, dryRun) => locked(context, () => operations.prune(context, dryRun))
+	};
+}
+//#endregion
+export { isWorktreeLifecycleEvent as a, HubUnavailableError as c, createWorktreeMessageInbox as i, invalidRequest as l, createWorktreeRegistry as n, registryFile as o, GIT_WORKTREE_LIFECYCLE_EVENT as r, DoomGitExpectedError as s, createWorktreeOperations as t, createWorktreeGit as u };
+
+//# sourceMappingURL=worktreeOperations-DAbs0ZTX.mjs.map