@agimon-ai/doompi-git 0.0.1-alpha.4 → 0.0.1-alpha.41

package/dist/worktreeOperations-BrWG2muV.mjs

@@ -0,0 +1,1194 @@
+import { execFile } from "node:child_process";
+import fs from "node:fs";
+import { createHash, randomUUID } from "node:crypto";
+import { removeSyncLocation, resolveWorktreeSyncLocation } from "@agimon-ai/doompi-core/syncLocation";
+import path from "node:path";
+import os from "node:os";
+import { isDeepStrictEqual } from "node:util";
+import { setTimeout } from "node:timers/promises";
+//#region src/services/gitCli/index.ts
+/**
+* Git, as this package needs it.
+*
+* The timeouts are not uniform because the operations are not comparable. A
+* read answers in milliseconds; `worktree add` copies an entire checkout and
+* `worktree remove` deletes one, both bounded by the filesystem rather than by
+* git, and both minutes rather than seconds on a large repository or on
+* Windows. A single timeout would either fail honest work or hang on a wedged
+* one.
+*/
+const READ_TIMEOUT_MS = 3e4;
+const ADD_TIMEOUT_MS = 3e5;
+const REMOVE_TIMEOUT_MS = 3e5;
+const PRUNE_TIMEOUT_MS = 15e3;
+/** fetch and push: bounded by the network, so long enough for a slow link, short enough to notice a dead one. */
+const NETWORK_TIMEOUT_MS = 12e4;
+/** A rebase replays commits locally; a large branch on a slow disk takes minutes, never hours. */
+const REBASE_TIMEOUT_MS = 3e5;
+const MAX_OUTPUT_BYTES = 1e6;
+/** Enough for any branch picker; a repository with more refs lists its most recent ones. */
+const MAX_LISTED_REFS = 2e3;
+const LOCAL_PREFIX = "refs/heads/";
+const REMOTE_PREFIX = "refs/remotes/";
+const HEAD_SUFFIX = "/HEAD";
+/**
+* Runs git and reports the outcome without ever throwing on a non-zero exit.
+*
+* LC_ALL is pinned because callers decide what to do by matching git's own
+* wording, and a translated message would silently turn a recognised
+* condition into an unrecognised failure.
+*
+* `env` replaces the environment for this child only. That is how remote auth
+* reaches fetch and push without ever touching the hub's own process.env,
+* which every session started afterwards would inherit.
+*/
+function runGit(cwd, args, options) {
+	return new Promise((resolve) => {
+		execFile("git", [...args], {
+			cwd,
+			timeout: options.timeout,
+			maxBuffer: options.maxBuffer ?? MAX_OUTPUT_BYTES,
+			env: {
+				...options.env ?? process.env,
+				LC_ALL: "C"
+			}
+		}, (error, stdout, stderr) => {
+			const failure = error;
+			resolve({
+				code: failure && typeof failure.code === "number" ? failure.code : failure ? 1 : 0,
+				stdout: String(stdout),
+				stderr: String(stderr),
+				timedOut: failure?.killed === true && failure.code !== "ERR_CHILD_PROCESS_STDIO_MAXBUFFER",
+				overflow: failure?.code === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER"
+			});
+		});
+	});
+}
+function git(cwd, args, timeout) {
+	return runGit(cwd, args, { timeout });
+}
+/**
+* The message a failed git call is allowed to surface.
+*
+* Raw stderr never travels: it can carry a remote URL with a token in it, and
+* this text ends up in a tool result the model reads and may repeat.
+*/
+function failure(operation, result) {
+	return /* @__PURE__ */ new Error(`git ${operation} failed (exit ${String(result.code)}, ${String(result.stderr.length)} bytes of stderr)`);
+}
+/** Git's own words for "that worktree is not there any more". */
+function missingWorktree(stderr) {
+	const normalized = stderr.toLowerCase();
+	return normalized.includes("is not a working tree") || normalized.includes("cannot remove working tree");
+}
+function createWorktreeGit() {
+	const prune = async (repositoryRoot) => {
+		await git(repositoryRoot, ["worktree", "prune"], PRUNE_TIMEOUT_MS);
+	};
+	return {
+		async addWorktree({ repositoryRoot, path, branch, baseRef }) {
+			const result = await git(repositoryRoot, [
+				"worktree",
+				"add",
+				"-b",
+				branch,
+				path,
+				baseRef
+			], ADD_TIMEOUT_MS);
+			if (result.code !== 0) throw failure("worktree add", result);
+		},
+		async addExistingWorktree({ repositoryRoot, path, branch, remote }) {
+			const result = await git(repositoryRoot, remote === void 0 ? [
+				"worktree",
+				"add",
+				path,
+				branch
+			] : [
+				"worktree",
+				"add",
+				"--track",
+				"-b",
+				branch,
+				path,
+				`${remote}/${branch}`
+			], ADD_TIMEOUT_MS);
+			if (result.code !== 0) throw failure("worktree add", result);
+		},
+		async listBranches(repositoryRoot) {
+			const refs = await git(repositoryRoot, [
+				"for-each-ref",
+				"--sort=-committerdate",
+				`--count=${String(MAX_LISTED_REFS)}`,
+				"--format=%(refname)%09%(worktreepath)%09%(symref)",
+				"refs/heads",
+				"refs/remotes"
+			], READ_TIMEOUT_MS);
+			if (refs.code !== 0) throw failure("for-each-ref", refs);
+			const local = [];
+			const remotes = [];
+			for (const line of refs.stdout.split("\n")) {
+				const [ref = "", worktreePath = "", symref = ""] = line.split("	");
+				if (ref === "" || symref !== "") continue;
+				if (ref.startsWith(LOCAL_PREFIX)) {
+					const name = ref.slice(11);
+					local.push(worktreePath === "" ? { name } : {
+						name,
+						checkedOutAt: worktreePath
+					});
+				} else if (ref.startsWith(REMOTE_PREFIX) && !ref.endsWith(HEAD_SUFFIX)) {
+					const rest = ref.slice(13);
+					const separator = rest.indexOf("/");
+					if (separator > 0) remotes.push({
+						remote: rest.slice(0, separator),
+						name: rest.slice(separator + 1)
+					});
+				}
+			}
+			const localNames = new Set(local.map((branch) => branch.name));
+			const head = await git(repositoryRoot, [
+				"symbolic-ref",
+				"--quiet",
+				"--short",
+				"HEAD"
+			], READ_TIMEOUT_MS);
+			const current = head.code === 0 && head.stdout.trim() !== "" ? head.stdout.trim() : void 0;
+			const origin = await git(repositoryRoot, [
+				"symbolic-ref",
+				"--quiet",
+				"--short",
+				"refs/remotes/origin/HEAD"
+			], READ_TIMEOUT_MS);
+			const defaultBase = origin.code === 0 && origin.stdout.trim() !== "" ? origin.stdout.trim() : current;
+			return {
+				...current === void 0 ? {} : { current },
+				...defaultBase === void 0 ? {} : { defaultBase },
+				local,
+				remote: remotes.filter((branch) => !localNames.has(branch.name))
+			};
+		},
+		async removeWorktree({ repositoryRoot, path, force }) {
+			const result = await git(repositoryRoot, [
+				"worktree",
+				"remove",
+				...force ? ["--force"] : [],
+				path
+			], REMOVE_TIMEOUT_MS);
+			if (result.code === 0) return;
+			if (missingWorktree(result.stderr) && !fs.existsSync(path)) {
+				await prune(repositoryRoot);
+				return;
+			}
+			throw failure("worktree remove", result);
+		},
+		async deleteBranch({ repositoryRoot, branch }) {
+			return (await git(repositoryRoot, [
+				"branch",
+				"-d",
+				branch
+			], READ_TIMEOUT_MS)).code === 0;
+		},
+		pruneWorktrees: prune,
+		async listWorktreePaths(repositoryRoot) {
+			const result = await git(repositoryRoot, [
+				"worktree",
+				"list",
+				"--porcelain"
+			], READ_TIMEOUT_MS);
+			if (result.code !== 0) return [];
+			return result.stdout.split("\n").filter((line) => line.startsWith("worktree ")).map((line) => line.slice(9).trim()).filter((line) => line !== "");
+		},
+		async dirtyFiles(path) {
+			const result = await git(path, ["status", "--porcelain"], READ_TIMEOUT_MS);
+			if (result.code !== 0) return [];
+			return result.stdout.split("\n").map((line) => line.slice(3).trim()).filter((line) => line !== "");
+		},
+		async repositoryRoot(cwd) {
+			const result = await git(cwd, ["rev-parse", "--show-toplevel"], READ_TIMEOUT_MS);
+			if (result.code !== 0) return void 0;
+			const root = result.stdout.trim();
+			return root === "" ? void 0 : root;
+		},
+		async currentBranch(cwd) {
+			const result = await git(cwd, [
+				"rev-parse",
+				"--abbrev-ref",
+				"HEAD"
+			], READ_TIMEOUT_MS);
+			if (result.code !== 0) return void 0;
+			const branch = result.stdout.trim();
+			return branch === "" ? void 0 : branch;
+		},
+		async remoteBaseRef(cwd) {
+			const upstream = await git(cwd, [
+				"rev-parse",
+				"--abbrev-ref",
+				"--symbolic-full-name",
+				"@{upstream}"
+			], READ_TIMEOUT_MS);
+			if (upstream.code === 0) {
+				const branch = upstream.stdout.trim();
+				if (branch !== "") return branch;
+			}
+			const origin = await git(cwd, [
+				"symbolic-ref",
+				"--quiet",
+				"--short",
+				"refs/remotes/origin/HEAD"
+			], READ_TIMEOUT_MS);
+			if (origin.code === 0) {
+				const branch = origin.stdout.trim();
+				if (branch !== "") return branch;
+			}
+			const defaults = await git(cwd, [
+				"for-each-ref",
+				"--format=%(symref:short)",
+				"refs/remotes"
+			], READ_TIMEOUT_MS);
+			if (defaults.code !== 0) return void 0;
+			return defaults.stdout.split("\n").map((line) => line.trim()).find((line) => line !== "");
+		},
+		async mergeBranch({ repositoryRoot, branch, message }) {
+			const result = await git(repositoryRoot, [
+				"merge",
+				"--no-ff",
+				...message === void 0 ? [] : ["-m", message],
+				branch
+			], READ_TIMEOUT_MS);
+			if (result.code === 0) return;
+			throw failure("merge", result);
+		}
+	};
+}
+//#endregion
+//#region src/services/compositionMirror/index.ts
+/**
+* Giving a new worktree the build output its parent checkout already has.
+*
+* DESIGN PATTERNS:
+* - Mirrors, never builds. Everything here is a copy or a symlink of something
+*   the parent checkout already produced, so it costs seconds and cannot fail
+*   the way a package manager or a compiler can.
+* - `node_modules` is linked, `dist` is copied. The module tree is gigabytes
+*   and read-only in practice, so a link is right; build output is small and a
+*   link would send a build run inside the worktree straight into the parent's
+*   directory.
+* - Absent parent output means nothing to do. A repository with no
+*   `node_modules` at its root is either not a JS project or not installed, and
+*   either way this has no opinion about it, so a Rust, Go or Python worktree
+*   pays nothing.
+*
+* WHY THIS EXISTS:
+* A DoomPi session composes the extensions its repository's config names, and
+* this repository names its own workspace packages by relative path. Those
+* packages declare `pi.extensions` under `dist/`, which git does not track, so
+* a fresh worktree resolves none of them and the session dies on start. The
+* parent checkout has already built exactly what the child needs.
+*
+* AVOID:
+* - Recursing into `node_modules`. The scan is bounded and skips it; without
+*   that this walks a gigabyte to find nothing.
+* - Treating a mirror failure as fatal. The worktree is good either way; only
+*   the session's composition is poorer for it.
+*/
+/** Directories that are build output worth copying into a new worktree. */
+const OUTPUT_DIRECTORY = "dist";
+const MODULES_DIRECTORY = "node_modules";
+const GIT_DIRECTORY = ".git";
+/**
+* How deep the scan goes.
+*
+* Four levels reaches `layers/<group>/<package>/dist` in this repository's
+* layout, and a workspace that buries a package deeper than that gets a
+* partial mirror rather than a slow one.
+*/
+const MAX_DEPTH = 4;
+function scan(root) {
+	const found = {
+		outputs: [],
+		modules: []
+	};
+	const walk = (relative, depth) => {
+		let entries;
+		try {
+			entries = fs.readdirSync(path.join(root, relative), { withFileTypes: true });
+		} catch {
+			return;
+		}
+		for (const entry of entries) {
+			const child = relative === "" ? entry.name : `${relative}/${entry.name}`;
+			if (entry.name === GIT_DIRECTORY) continue;
+			if (entry.name === MODULES_DIRECTORY) {
+				try {
+					if (entry.isDirectory() || entry.isSymbolicLink() && fs.statSync(path.join(root, child)).isDirectory()) found.modules.push(child);
+				} catch {}
+				continue;
+			}
+			if (!entry.isDirectory()) continue;
+			if (entry.name === OUTPUT_DIRECTORY) {
+				found.outputs.push(child);
+				continue;
+			}
+			if (depth < MAX_DEPTH) walk(child, depth + 1);
+		}
+	};
+	walk("", 1);
+	return found;
+}
+/**
+* Copies the parent's build output into a worktree and links its modules.
+*
+* Individual failures are counted out rather than thrown: a mirror that lands
+* partly is still better than none, and the caller has a worktree either way.
+*/
+function mirrorComposition(source, target) {
+	if (!fs.existsSync(path.join(source, MODULES_DIRECTORY))) return {
+		kind: "skipped",
+		reason: "no-modules"
+	};
+	const found = scan(source);
+	let copied = 0;
+	let linked = 0;
+	for (const relative of found.modules) {
+		const destination = path.join(target, relative);
+		if (fs.existsSync(destination)) continue;
+		try {
+			fs.mkdirSync(path.dirname(destination), { recursive: true });
+			fs.symlinkSync(fs.realpathSync(path.join(source, relative)), destination, "dir");
+			linked += 1;
+		} catch {}
+	}
+	for (const relative of found.outputs) {
+		const destination = path.join(target, relative);
+		if (fs.existsSync(destination)) continue;
+		try {
+			fs.mkdirSync(path.dirname(destination), { recursive: true });
+			fs.cpSync(path.join(source, relative), destination, { recursive: true });
+			copied += 1;
+		} catch {}
+	}
+	return {
+		kind: "mirrored",
+		copied,
+		linked
+	};
+}
+//#endregion
+//#region src/services/errors/index.ts
+var DoomGitExpectedError = class extends Error {
+	code;
+	retryable;
+	recovery;
+	constructor(code, message, retryable, recovery) {
+		super(`[${code}] ${message}\nRecovery: ${recovery}`);
+		this.code = code;
+		this.retryable = retryable;
+		this.recovery = recovery;
+		this.name = "DoomGitExpectedError";
+	}
+};
+/** Raised when a worktree action needs the canonical hub but it is not injected. */
+var HubUnavailableError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "HubUnavailableError";
+	}
+};
+function invalidRequest(message, recovery) {
+	return new DoomGitExpectedError("invalid_request", message, false, recovery);
+}
+//#endregion
+//#region src/services/atomicJson/index.ts
+const OWNER_ONLY_FILE = 384;
+/**
+* Writes JSON so a reader never sees a half-written file.
+*
+* The registry is read by the same process that writes it, and by a later
+* process after a crash. A plain write can be interrupted between the truncate
+* and the last byte, which leaves a file that parses as nothing and loses every
+* record in it. Writing beside the target and renaming makes the swap atomic on
+* the same filesystem, so a reader sees either the old file or the new one.
+*/
+function writeJsonAtomic(file, value) {
+	const directory = path.dirname(file);
+	fs.mkdirSync(directory, { recursive: true });
+	const temporary = path.join(directory, `.${path.basename(file)}.${String(process.pid)}.tmp`);
+	fs.writeFileSync(temporary, `${JSON.stringify(value, null, 2)}\n`, { mode: OWNER_ONLY_FILE });
+	fs.renameSync(temporary, file);
+}
+/**
+* Reads JSON, treating every failure as absent.
+*
+* A missing file and an unparseable one mean the same thing to every caller
+* here: there is nothing to act on. Distinguishing them would only offer a
+* choice no caller wants to make.
+*/
+function readJson(file) {
+	try {
+		return JSON.parse(fs.readFileSync(file, "utf8"));
+	} catch {
+		return;
+	}
+}
+//#endregion
+//#region src/services/repositoryIdentity/index.ts
+const ID_LENGTH = 12;
+const MAX_LABEL_LENGTH = 32;
+/**
+* The git directory shared by a repository and all of its worktrees.
+*
+* A normal checkout has a `.git` directory. A linked worktree has a `.git`
+* FILE pointing at `<common>/worktrees/<name>`, whose `commondir` points back
+* at the shared directory. Following that chain is what makes every worktree of
+* one repository agree on the repository's identity, which matters here because
+* the registry is per repository and must be found from inside a worktree too.
+* A session may run in a subdirectory, so the nearest enclosing checkout is used.
+*/
+function gitCommonDirectory(directory) {
+	let root = path.resolve(directory);
+	let marker = path.join(root, ".git");
+	let stat;
+	for (;;) try {
+		stat = fs.statSync(marker);
+		break;
+	} catch {
+		const parent = path.dirname(root);
+		if (parent === root) return void 0;
+		root = parent;
+		marker = path.join(root, ".git");
+	}
+	if (stat.isDirectory()) return marker;
+	let pointer;
+	try {
+		pointer = fs.readFileSync(marker, "utf8").trim();
+	} catch {
+		return;
+	}
+	if (!pointer.startsWith("gitdir:")) return void 0;
+	const gitDir = path.resolve(root, pointer.slice(7).trim());
+	try {
+		const common = fs.readFileSync(path.join(gitDir, "commondir"), "utf8").trim();
+		return path.resolve(gitDir, common);
+	} catch {
+		return gitDir;
+	}
+}
+/** A directory name that is recognisable to a person and safe on a filesystem. */
+function repositoryLabel(root) {
+	const label = path.basename(root).toLowerCase().replace(/[^a-z0-9]+/gu, "-").replace(/^-+|-+$/gu, "").slice(0, MAX_LABEL_LENGTH);
+	return label === "" ? "repository" : label;
+}
+/**
+* A stable id for the repository a directory belongs to.
+*
+* Keyed on the common git directory rather than the given path, so the main
+* checkout and every worktree of it resolve to one id and therefore to one
+* registry. Falling back to the path keeps a non-repository directory usable
+* instead of failing, though nothing here should reach that case.
+*/
+function repositoryId(root) {
+	const common = gitCommonDirectory(root);
+	const token = common === void 0 ? `root:${path.resolve(root)}` : `git:${common}`;
+	return createHash("sha256").update(token).digest("hex").slice(0, ID_LENGTH);
+}
+/** A short, collision-resistant suffix for one worktree directory. */
+function shortId(seed) {
+	return createHash("sha256").update(seed).digest("hex").slice(0, 8);
+}
+//#endregion
+//#region src/services/paths/index.ts
+/**
+* Where this package keeps its own state.
+*
+* Outside the repository on purpose. A worktree directory inside the checkout
+* would be found by every glob the repository's own tooling runs, and would
+* resolve workspace imports against the parent checkout rather than the
+* worktree, so a session there would build the wrong source while appearing to
+* work.
+*/
+function doomGitRoot(homeDir = os.homedir()) {
+	return path.join(homeDir, ".pi", ".doom", "git");
+}
+/** The directory every worktree for every repository is created under. */
+function worktreesRoot(homeDir = os.homedir()) {
+	return path.join(doomGitRoot(homeDir), "worktrees");
+}
+/**
+* Remote auth for every workspace, one entry per workspace root.
+*
+* Outside every repository, so a token can never be committed, and readable
+* only by the owner. It holds secrets, which no other file here does.
+*/
+function credentialsFile(homeDir = os.homedir()) {
+	return path.join(doomGitRoot(homeDir), "credentials.json");
+}
+/** One registry file per repository, keyed by the shared git directory. */
+function registryFile(repositoryRoot, homeDir = os.homedir()) {
+	const id = repositoryId(repositoryRoot);
+	const root = path.join(doomGitRoot(homeDir), "registry");
+	const canonical = path.join(root, id, "worktrees.json");
+	if (fs.existsSync(canonical)) return canonical;
+	let names;
+	try {
+		names = fs.readdirSync(root);
+	} catch {
+		return canonical;
+	}
+	const legacyFiles = names.filter((entry) => entry.endsWith(`--${id}`)).sort().map((entry) => path.join(root, entry, "worktrees.json")).filter((file) => fs.existsSync(file));
+	if (legacyFiles.length === 0) return canonical;
+	const entries = /* @__PURE__ */ new Map();
+	for (const file of legacyFiles) {
+		const legacy = readJson(file);
+		if (legacy?.version !== 1 || !Array.isArray(legacy.entries)) continue;
+		for (const value of legacy.entries) {
+			if (typeof value !== "object" || value === null || !("id" in value) || typeof value.id !== "string" || value.id === "") continue;
+			const entry = value;
+			const existing = entries.get(entry.id);
+			if (existing !== void 0 && !isDeepStrictEqual(existing, entry)) throw new Error(`Conflicting legacy worktree registry entries for '${entry.id}'.`);
+			entries.set(entry.id, entry);
+		}
+	}
+	const temporary = `${canonical}.${randomUUID()}.migration`;
+	writeJsonAtomic(temporary, {
+		version: 1,
+		entries: [...entries.values()]
+	});
+	try {
+		fs.linkSync(temporary, canonical);
+	} catch (error) {
+		if (error.code !== "EEXIST") throw error;
+	} finally {
+		fs.rmSync(temporary);
+	}
+	return canonical;
+}
+//#endregion
+//#region src/services/worktreeEvents/index.ts
+const GIT_WORKTREE_LIFECYCLE_EVENT = "git_worktree_lifecycle";
+const GIT_WORKTREE_MESSAGE_EVENT = "git_worktree_message";
+/**
+* A session's checkout may have changed: a tool call ended, or the agent
+* settled. Carries nothing but its version; the '# diff' channel recomputes.
+*/
+const GIT_SESSION_CHANGED_EVENT = "git_session_changed";
+const MAX_WORKTREE_MESSAGE_BYTES = 65536;
+function isMessageParty(value) {
+	return value === "parent" || value === "child";
+}
+function parseMessage(value) {
+	if (typeof value !== "object" || value === null) return void 0;
+	const record = value;
+	if (record.version !== 1) return void 0;
+	if (typeof record.worktreeId !== "string" || record.worktreeId === "") return void 0;
+	if (typeof record.fromSessionId !== "string" || record.fromSessionId === "") return void 0;
+	if (!isMessageParty(record.from)) return void 0;
+	if (typeof record.text !== "string" || record.text === "") return void 0;
+	if (Buffer.byteLength(record.text, "utf8") > 65536) return void 0;
+	if (typeof record.sentAt !== "string" || record.sentAt === "") return void 0;
+	return record;
+}
+function createWorktreeMessageInbox(directEvents, sessionId) {
+	if (sessionId === "") throw new Error("The Git message service requires a session identity.");
+	const messages = /* @__PURE__ */ new Map();
+	const unsubscribe = directEvents.subscribe(GIT_WORKTREE_MESSAGE_EVENT, sessionId, (payload) => {
+		const message = parseMessage(payload);
+		if (message === void 0) return;
+		const inbox = messages.get(message.worktreeId) ?? [];
+		if (inbox.length >= 100) inbox.shift();
+		inbox.push(message);
+		messages.set(message.worktreeId, inbox);
+	});
+	let closed = false;
+	return {
+		send(targetSessionId, message) {
+			if (closed) throw new Error("The Git message service is closed.");
+			directEvents.publish(GIT_WORKTREE_MESSAGE_EVENT, targetSessionId, message);
+		},
+		receive(worktreeId) {
+			if (closed) return [];
+			const inbox = messages.get(worktreeId);
+			if (inbox === void 0) return [];
+			messages.delete(worktreeId);
+			return inbox;
+		},
+		close() {
+			if (closed) return;
+			closed = true;
+			unsubscribe();
+			messages.clear();
+		}
+	};
+}
+function isWorktreeLifecycleEvent(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const record = value;
+	return record.version === 1 && typeof record.repositoryRoot === "string" && record.repositoryRoot !== "";
+}
+function isSessionChangedEvent(value) {
+	return typeof value === "object" && value !== null && value.version === 1;
+}
+//#endregion
+//#region src/services/worktreeNaming/index.ts
+const MAX_SLUG_LENGTH = 64;
+/** Anything git forbids in a ref, plus a leading `-` that `worktree add` would read as an option. */
+const INVALID_REF = /(^[-/.])|[\s~^:?*[\\]|\.\.|@\{|\/\/|\/\.|\.lock$|\/$|\.$/u;
+const MAX_REF_LENGTH = 255;
+const FIRST_PRINTABLE = 32;
+const DELETE = 127;
+/**
+* A branch name reduced to one safe path segment.
+*
+* Slashes are the point: `wt/fix-auth` is a perfectly good branch and a
+* terrible directory name, because the nested directory it implies is not the
+* one the worktree lives in.
+*/
+function branchSlug(branch) {
+	const slug = branch.toLowerCase().replace(/[^a-z0-9]+/gu, "-").replace(/^-+|-+$/gu, "").slice(0, MAX_SLUG_LENGTH).replace(/-+$/gu, "");
+	return slug === "" ? "worktree" : slug;
+}
+/**
+* The directory for one worktree.
+*
+* The short id disambiguates two branches whose slugs collide, such as
+* `feature/x` and `feature_x`, which would otherwise want the same directory.
+*/
+function worktreeDirectory(input) {
+	const repository = `${input.repositoryLabel}--${input.repositoryId}`;
+	return `${input.worktreesRoot}/${repository}/${branchSlug(input.branch)}--${input.shortId}`;
+}
+/** Why a worktree cannot be created, or undefined when it can. */
+function refuseSpawn(input) {
+	if (input.branch.trim() === "") return "A branch name is required.";
+	const live = input.existing.find((record) => record.branch === input.branch && record.status !== "orphaned");
+	if (live) return `Branch ${input.branch} already has a worktree (${live.id}).`;
+}
+/** Why a worktree cannot be closed, or undefined when it can. */
+function refuseClose(input) {
+	if (!input.record) return "No worktree with that id. Call list to see the current ids.";
+	if (input.dirtyFiles.length === 0 || input.force) return void 0;
+	const names = input.dirtyFiles.slice(0, 10).join(", ");
+	const more = input.dirtyFiles.length > 10 ? `, and ${String(input.dirtyFiles.length - 10)} more` : "";
+	return `${String(input.dirtyFiles.length)} uncommitted file(s): ${names}${more}. Pass force: true to discard them.`;
+}
+/**
+* Marks records whose process or directory is gone as orphaned.
+*
+* Nothing is deleted here. A doompi-git orphan owns a directory that may hold
+* uncommitted work, so losing the record would lose the only pointer to it.
+* Deletion is always a separate, named decision.
+*/
+function reconcile(records, probe) {
+	const changed = [];
+	return {
+		records: records.map((record) => {
+			if (record.status === "orphaned") return record;
+			if (!(!probe.exists(record.path) || !probe.alive(record))) return record;
+			changed.push(record.id);
+			return {
+				...record,
+				status: "orphaned"
+			};
+		}),
+		changed
+	};
+}
+/**
+* What a prune would do, decided before anything is destroyed.
+*
+* Separating the plan from the execution is what makes dryRun honest and lets
+* the destructive half be reviewed on its own.
+*/
+function planPrune(input) {
+	const plan = {
+		remove: [],
+		forget: [],
+		untracked: [],
+		keptDirty: [],
+		keptBranches: []
+	};
+	const known = new Set(input.records.map((record) => record.path));
+	const listed = new Set(input.gitPaths);
+	for (const record of input.records) {
+		if (record.status !== "orphaned") continue;
+		if (!listed.has(record.path)) {
+			plan.forget.push(record);
+			continue;
+		}
+		if ((input.dirtyByPath.get(record.path) ?? []).length > 0) {
+			plan.keptDirty.push(record);
+			continue;
+		}
+		plan.remove.push(record);
+	}
+	for (const path of input.gitPaths) if (path.startsWith(`${input.worktreesRoot}/`) && !known.has(path)) plan.untracked.push(path);
+	return plan;
+}
+/** Whether a user-supplied branch or base ref is safe to hand to git as a positional argument. */
+function validRefName(name) {
+	if (name === "" || name === "@" || name.length > MAX_REF_LENGTH || INVALID_REF.test(name)) return false;
+	for (const character of name) {
+		const code = character.charCodeAt(0);
+		if (code < FIRST_PRINTABLE || code === DELETE) return false;
+	}
+	return true;
+}
+//#endregion
+//#region src/services/worktreeRegistry/index.ts
+const LOCK_WAIT_MS = 5e3;
+const LOCK_RETRY_MS = 25;
+function isRecord(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const record = value;
+	return record.version === 1 && typeof record.id === "string" && record.id !== "" && typeof record.path === "string" && typeof record.branch === "string" && typeof record.sessionId === "string";
+}
+/**
+* Repository mutations hold an exclusive directory lock from the read through
+* the final commit. This works across independently loaded packages and hosts.
+* A crashed owner leaves a visible lock, never a lease another writer may steal.
+*/
+function createWorktreeRegistry(file) {
+	return {
+		list() {
+			const parsed = readJson(file);
+			if (!parsed || parsed.version !== 1 || !Array.isArray(parsed.entries)) return [];
+			return parsed.entries.filter(isRecord);
+		},
+		replace(entries) {
+			writeJsonAtomic(file, {
+				version: 1,
+				entries
+			});
+		},
+		async transaction(operation, signal) {
+			const lock = `${file}.lock`;
+			fs.mkdirSync(path.dirname(file), { recursive: true });
+			const deadline = Date.now() + LOCK_WAIT_MS;
+			for (;;) {
+				signal?.throwIfAborted();
+				try {
+					fs.mkdirSync(lock, { mode: 448 });
+					break;
+				} catch (error) {
+					if (error.code !== "EEXIST") throw error;
+					if (Date.now() >= deadline) throw new DoomGitExpectedError("registry_busy", "Another worktree operation holds the repository registry.", true, "Retry after it finishes. After a host crash, inspect and remove the abandoned worktrees.json.lock directory.");
+					await setTimeout(LOCK_RETRY_MS, void 0, { signal });
+				}
+			}
+			try {
+				fs.writeFileSync(path.join(lock, "owner.json"), JSON.stringify({
+					pid: process.pid,
+					createdAt: (/* @__PURE__ */ new Date()).toISOString()
+				}), { mode: 384 });
+				signal?.throwIfAborted();
+				return await operation();
+			} finally {
+				fs.rmSync(lock, { recursive: true });
+			}
+		}
+	};
+}
+//#endregion
+//#region src/services/worktreeOperations/index.ts
+const GIT_WORKTREE_DELEGATION_KIND = "git.worktree.delegation";
+const GIT_WORKTREE_MESSAGE_KIND = "git.worktree.message";
+const GIT_WORKTREE_REPORT_KIND = "git.worktree.report";
+function createWorktreeOperations(deps) {
+	const { git } = deps;
+	const sessionService = deps.sessionService;
+	const mirror = deps.mirror ?? mirrorComposition;
+	const removeStorage = deps.cleanupStorage ?? ((repositoryRoot, worktreeRoot) => {
+		removeSyncLocation(resolveWorktreeSyncLocation(repositoryRoot, worktreeRoot, deps.homeDir));
+	});
+	const cleanupStorage = (repositoryRoot, worktreeRoot) => {
+		try {
+			removeStorage(repositoryRoot, worktreeRoot);
+		} catch (error) {
+			throw new DoomGitExpectedError("worktree_cleanup_failed", `The worktree checkout was removed, but its generated storage could not be deleted (${error instanceof Error ? error.message : String(error)}).`, true, "Retry close or prune after fixing the storage permissions.");
+		}
+	};
+	const now = deps.now ?? (() => /* @__PURE__ */ new Date());
+	const requireSessionService = () => {
+		if (sessionService === void 0) throw new HubUnavailableError("The cockpit session service is unavailable. Start the cockpit and try again.");
+		return sessionService;
+	};
+	const requireMessageInbox = () => {
+		if (deps.messageInbox === void 0) throw new HubUnavailableError("The Git message service is unavailable. Start the cockpit and try again.");
+		return deps.messageInbox;
+	};
+	const readSessionDelivery = () => deps.sessionDelivery?.();
+	const requireSessionDelivery = () => {
+		const delivery = readSessionDelivery();
+		if (delivery === void 0) throw new HubUnavailableError("The Session delivery service is unavailable. Start the cockpit and try again.");
+		return delivery;
+	};
+	const probe = {
+		alive: (record) => requireSessionService().isLive(record.sessionId),
+		exists: (path) => fs.existsSync(path)
+	};
+	/**
+	* Everything an action needs about the repository it is acting on.
+	*
+	* Resolved per call rather than cached: a session's cwd is stable, but the
+	* worktree registry is shared and another process may have written it since
+	* the last call.
+	*/
+	const resolve = async (context) => {
+		const root = await git.repositoryRoot(context.cwd);
+		if (root === void 0) throw new DoomGitExpectedError("not_a_repository", `${context.cwd} is not inside a git repository.`, false, "Run this from a repository checkout.");
+		const store = createWorktreeRegistry(registryFile(root, deps.homeDir));
+		return {
+			root,
+			store,
+			records: store.list()
+		};
+	};
+	const require = (records, id) => {
+		const record = records.find((entry) => entry.id === id);
+		if (record === void 0) throw new DoomGitExpectedError("worktree_not_found", `No worktree with id ${id}.`, false, "Call list to see the current ids.");
+		return record;
+	};
+	/**
+	* Refuses to destroy or merge a worktree another live session is using.
+	*
+	* `parentSessionId` records who asked for the worktree. Two sessions in one
+	* checkout share this registry, so without the check either could close the
+	* other's work in progress by id.
+	*
+	* Once that session is gone there is no owner left to protect, and refusing
+	* would strand the worktree: nothing else could ever close it.
+	*/
+	const requireOwner = (context, record, action) => {
+		if (record.parentSessionId === context.sessionId) return;
+		if (record.parentSessionId === void 0 || !requireSessionService().isLive(record.parentSessionId)) return;
+		throw new DoomGitExpectedError("worktree_not_owned", `Worktree ${record.id} belongs to another session.`, false, `Ask the session that created it to ${action} it, or close that session first.`);
+	};
+	const peerFor = (context, record) => {
+		if (record.parentSessionId === void 0) throw new DoomGitExpectedError("worktree_peer_unavailable", `Worktree ${record.id} was opened on its own and has no parent session to message.`, false, "Message a worktree this session created.");
+		if (context.sessionId === record.parentSessionId) return {
+			sessionId: record.sessionId,
+			party: "parent"
+		};
+		if (context.sessionId === record.sessionId) return {
+			sessionId: record.parentSessionId,
+			party: "child"
+		};
+		throw new DoomGitExpectedError("worktree_not_owned", `Worktree ${record.id} belongs to another session.`, false, "Use a worktree owned by this session.");
+	};
+	const requirePeerLive = (peerSessionId) => {
+		if (!requireSessionService().isLive(peerSessionId)) throw new DoomGitExpectedError("worktree_peer_unavailable", "The other worktree session is no longer live.", false, "Start a new worktree session before sending a message.");
+	};
+	const operations = {
+		async spawn(context, request, options) {
+			const parentSessionId = context.sessionId;
+			const parented = parentSessionId === void 0 ? {} : { parentSessionId };
+			const { root, store, records } = await resolve(context);
+			const reservations = request.reservationId === void 0 ? void 0 : requireSessionService().reservations;
+			if (request.reservationId !== void 0 && (!reservations || request.task !== void 0)) throw new DoomGitExpectedError("invalid_request", "Reserved worktree sessions require host setup and cannot start a task.", false, "Create the session from its pending setup card.");
+			const reserved = request.reservationId === void 0 ? void 0 : reservations.read(request.reservationId, parentSessionId);
+			const existing = reserved === void 0 ? void 0 : records.find((record) => record.sessionId === reserved.sessionId);
+			if (existing) {
+				const expectedPath = worktreeDirectory({
+					worktreesRoot: worktreesRoot(deps.homeDir),
+					repositoryLabel: repositoryLabel(root),
+					repositoryId: repositoryId(root),
+					branch: request.branch,
+					shortId: shortId(reserved.sessionId)
+				});
+				if (existing.parentSessionId !== parentSessionId || existing.repositoryRoot !== root || existing.branch !== request.branch || existing.path !== expectedPath || existing.path !== reserved?.cwd || request.baseRef !== void 0 && existing.baseRef !== request.baseRef || !fs.existsSync(existing.path) || !(await git.listWorktreePaths(root)).includes(existing.path) || await git.repositoryRoot(existing.path) !== existing.path || await git.currentBranch(existing.path) !== request.branch) throw new DoomGitExpectedError("invalid_request", "The reserved checkout no longer matches this setup.", false, "Inspect the existing branch and checkout; they will not be replaced.");
+				if (!requireSessionService().isLive(existing.sessionId)) {
+					if ((await requireSessionService().create({
+						cwd: existing.path,
+						name: request.name ?? request.branch,
+						parentSessionId,
+						sessionProvenance: "worktree",
+						reservationId: request.reservationId,
+						...options?.signal === void 0 ? {} : { signal: options.signal }
+					})).sessionId !== existing.sessionId) throw new Error("The host did not use the reserved session identity.");
+				}
+				await reservations.complete(request.reservationId, parentSessionId);
+				return existing;
+			}
+			const refusal = refuseSpawn({
+				branch: request.branch,
+				existing: records
+			});
+			if (refusal !== void 0) throw new DoomGitExpectedError("worktree_exists", refusal, false, "Pick another branch name, or close it.");
+			const taskDelivery = request.task === void 0 ? void 0 : requireSessionDelivery();
+			const existingBranch = request.checkout === "existing";
+			if (existingBranch) {
+				const branches = await git.listBranches(root);
+				const local = branches.local.find((branch) => branch.name === request.branch);
+				if (!(request.remote === void 0 ? local !== void 0 && local.checkedOutAt === void 0 : local === void 0 && branches.remote.some((branch) => branch.remote === request.remote && branch.name === request.branch))) throw new DoomGitExpectedError("invalid_request", local?.checkedOutAt === void 0 ? `The branch ${request.branch} is not available to check out.` : `The branch ${request.branch} is already checked out at ${local.checkedOutAt}.`, false, "Pick another branch, or create a new one.");
+			} else if ((await git.listBranches(root)).local.some((branch) => branch.name === request.branch)) throw new DoomGitExpectedError("invalid_request", `The branch ${request.branch} already exists.`, false, "Pick another name, or open it as an existing branch.");
+			const baseRef = existingBranch ? request.remote === void 0 ? request.branch : `${request.remote}/${request.branch}` : request.baseRef ?? await git.remoteBaseRef(root);
+			if (baseRef === void 0) throw new DoomGitExpectedError("git_failed", "No remote base branch is available for this repository.", false, "Fetch a remote branch or pass an explicit baseRef.");
+			const id = shortId(reserved?.sessionId ?? randomUUID());
+			let path = worktreeDirectory({
+				worktreesRoot: worktreesRoot(deps.homeDir),
+				repositoryLabel: repositoryLabel(root),
+				repositoryId: repositoryId(root),
+				branch: request.branch,
+				shortId: id
+			});
+			if (request.reservationId !== void 0) path = (await reservations.prepare(request.reservationId, parentSessionId, path)).cwd;
+			const recovering = reserved?.cwd !== void 0 && fs.existsSync(path);
+			if (recovering && (!(await git.listWorktreePaths(root)).includes(path) || await git.currentBranch(path) !== request.branch)) throw new DoomGitExpectedError("invalid_request", "The reserved checkout no longer matches this setup.", false, "Inspect the existing directory; it will not be replaced.");
+			const cancelled = () => options?.signal?.aborted === true;
+			const rollback = async () => {
+				if (reserved) return ` The reserved checkout at ${path} was retained for recovery.`;
+				await git.removeWorktree({
+					repositoryRoot: root,
+					path,
+					force: true
+				}).catch(() => void 0);
+				if (existingBranch && request.remote === void 0) return "";
+				return await git.deleteBranch({
+					repositoryRoot: root,
+					branch: request.branch
+				}).catch(() => false) ? "" : ` The branch ${request.branch} has work on it and was kept.`;
+			};
+			options?.onProgress?.(`creating branch ${request.branch}\u2026`);
+			if (!recovering) {
+				if (existingBranch) await git.addExistingWorktree({
+					repositoryRoot: root,
+					path,
+					branch: request.branch,
+					...request.remote === void 0 ? {} : { remote: request.remote }
+				});
+				else await git.addWorktree({
+					repositoryRoot: root,
+					path,
+					branch: request.branch,
+					baseRef
+				});
+			}
+			if (cancelled()) throw new DoomGitExpectedError("spawn_cancelled", `Cancelled before the session started.${await rollback()}`, false, reserved ? "Retry setup with the same branch to recover the reserved checkout." : "The worktree was removed; run it again when you are ready.");
+			options?.onProgress?.("mirroring build output…");
+			if (!recovering) mirror(root, path);
+			options?.onProgress?.("starting session…");
+			let sessionId;
+			try {
+				sessionId = (await requireSessionService().create({
+					cwd: path,
+					name: request.name ?? request.branch,
+					...parented,
+					sessionProvenance: "worktree",
+					...options?.signal === void 0 ? {} : { signal: options.signal },
+					...request.reservationId === void 0 ? {} : { reservationId: request.reservationId }
+				})).sessionId;
+				if (reserved && sessionId !== reserved.sessionId) throw new Error("The host did not use the reserved session identity.");
+			} catch (error) {
+				const kept = await rollback();
+				if (cancelled()) throw new DoomGitExpectedError("spawn_cancelled", `Cancelled while the session was starting.${kept}`, false, reserved ? "Retry setup with the same branch to recover the reserved checkout." : "The worktree was removed; run it again when you are ready.");
+				if (error instanceof HubUnavailableError) throw new DoomGitExpectedError("hub_unavailable", `${error.message}${kept}`, true, "Start the cockpit and try again.");
+				throw error;
+			}
+			const record = {
+				version: 1,
+				id,
+				branch: request.branch,
+				baseRef,
+				path,
+				repositoryRoot: root,
+				sessionId,
+				...parented,
+				status: "running",
+				createdAt: now().toISOString()
+			};
+			try {
+				store.replace([...records, record]);
+			} catch (error) {
+				await requireSessionService().close(sessionId).catch(() => void 0);
+				const kept = await rollback();
+				throw new DoomGitExpectedError("registry_write_failed", `The worktree was created but the registry could not be written (${error.message}).${kept}`, true, "Check the registry file for permissions or free space, then try again.");
+			}
+			if (request.task !== void 0 && taskDelivery !== void 0) try {
+				const receipt = await taskDelivery.deliver({
+					recipientKey: sessionId,
+					kind: GIT_WORKTREE_DELEGATION_KIND,
+					prompt: request.task,
+					metadata: {
+						worktreeId: record.id,
+						fromRole: "parent",
+						text: request.task,
+						sentAt: record.createdAt
+					}
+				});
+				const admission = await taskDelivery.waitForAdmission(receipt.deliveryId);
+				if (admission !== "admitted") throw new DoomGitExpectedError("task_delivery_failed", `Worktree ${record.id} was created and task delivery ${receipt.deliveryId} was persisted, but admission ${admission === "recovery_required" ? "requires recovery" : "was not confirmed before the timeout"}.`, true, admission === "recovery_required" ? `Call messages from worktree ${record.id} to recover the task in the recipient session. Do not resend it automatically.` : `Check delivery ${receipt.deliveryId} in the sender outbox or call messages from worktree ${record.id} in the recipient session before deciding whether to resend.`);
+			} catch (error) {
+				if (error instanceof DoomGitExpectedError) throw error;
+				throw new DoomGitExpectedError("task_delivery_failed", `Worktree ${record.id} was created, but task delivery failed (${String(error)}).`, true, `Inspect worktree ${record.id} and the sender outbox before using send to deliver the task. Do not recreate the worktree.`);
+			}
+			if (request.reservationId !== void 0) await reservations.complete(request.reservationId, parentSessionId);
+			return record;
+		},
+		async close(context, id, force) {
+			const { root, store, records } = await resolve(context);
+			const record = require(records, id);
+			requireOwner(context, record, "close");
+			const refusal = refuseClose({
+				record,
+				dirtyFiles: fs.existsSync(record.path) ? await git.dirtyFiles(record.path) : [],
+				force
+			});
+			if (refusal !== void 0) throw new DoomGitExpectedError("worktree_dirty", refusal, false, "Commit the work, or pass force: true.");
+			await requireSessionService().close(record.sessionId);
+			await git.removeWorktree({
+				repositoryRoot: root,
+				path: record.path,
+				force
+			});
+			cleanupStorage(root, record.path);
+			store.replace(records.filter((entry) => entry.id !== id));
+			return record;
+		},
+		async list(context) {
+			const { store, records } = await resolve(context);
+			const outcome = reconcile(records, probe);
+			if (outcome.changed.length > 0) store.replace(outcome.records);
+			return outcome.records;
+		},
+		async status(context, id) {
+			const { records } = await resolve(context);
+			const record = require(records, id);
+			return {
+				record,
+				dirtyFiles: fs.existsSync(record.path) ? await git.dirtyFiles(record.path) : []
+			};
+		},
+		async merge(context, id, message) {
+			const { root, records } = await resolve(context);
+			const record = require(records, id);
+			requireOwner(context, record, "merge");
+			const parentDirty = await git.dirtyFiles(root);
+			if (parentDirty.length > 0) throw new DoomGitExpectedError("worktree_dirty", `The parent checkout has ${String(parentDirty.length)} uncommitted file(s): ${parentDirty.slice(0, 10).join(", ")}.`, false, "Commit or stash the parent checkout first.");
+			await git.mergeBranch({
+				repositoryRoot: root,
+				branch: record.branch,
+				...message === void 0 ? {} : { message }
+			});
+			return record;
+		},
+		/** Sends only between the parent session and its own worktree session. */
+		async send(context, id, message) {
+			if (Buffer.byteLength(message, "utf8") > 65536) throw new DoomGitExpectedError("message_too_large", `A message may not exceed ${String(MAX_WORKTREE_MESSAGE_BYTES)} bytes.`, false, "Send a shorter message.");
+			const { records } = await resolve(context);
+			const record = require(records, id);
+			const peer = peerFor(context, record);
+			requirePeerLive(peer.sessionId);
+			const sentAt = (/* @__PURE__ */ new Date()).toISOString();
+			const delivery = readSessionDelivery();
+			if (delivery !== void 0) {
+				const kind = peer.party === "parent" ? GIT_WORKTREE_MESSAGE_KIND : GIT_WORKTREE_REPORT_KIND;
+				const receipt = await delivery.deliver({
+					recipientKey: peer.sessionId,
+					kind,
+					prompt: peer.party === "parent" ? `Parent message for worktree ${record.id}:\n\n${message}` : `Report from worktree ${record.id}:\n\n${message}`,
+					metadata: {
+						worktreeId: record.id,
+						fromRole: peer.party,
+						text: message,
+						sentAt
+					}
+				});
+				const admission = await delivery.waitForAdmission(receipt.deliveryId);
+				if (admission !== "admitted") throw new DoomGitExpectedError("message_delivery_failed", `Worktree ${record.id} persisted message delivery ${receipt.deliveryId}, but admission ${admission === "recovery_required" ? "requires recovery" : "was not confirmed before the timeout"}.`, true, admission === "recovery_required" ? `Call messages from the recipient session to recover delivery ${receipt.deliveryId}. Do not resend it automatically.` : `Check delivery ${receipt.deliveryId} in the sender outbox or call messages from the recipient session before deciding whether to resend.`);
+				return;
+			}
+			requireMessageInbox().send(peer.sessionId, {
+				version: 1,
+				worktreeId: record.id,
+				fromSessionId: context.sessionId,
+				from: peer.party,
+				text: message,
+				sentAt
+			});
+		},
+		async messages(context, id) {
+			const { records } = await resolve(context);
+			const record = require(records, id);
+			const peer = peerFor(context, record);
+			const delivery = readSessionDelivery();
+			if (delivery === void 0) return requireMessageInbox().receive(record.id);
+			return delivery.inbox({
+				consumed: false,
+				metadata: { worktreeId: record.id }
+			}).filter((entry) => entry.senderKey === peer.sessionId && (entry.state === "admitted" || entry.state === "recovery_required") && (peer.party === "parent" ? entry.kind === GIT_WORKTREE_REPORT_KIND : entry.kind === GIT_WORKTREE_MESSAGE_KIND || entry.kind === GIT_WORKTREE_DELEGATION_KIND)).map((entry) => {
+				delivery.consume(entry.deliveryId);
+				return {
+					version: 1,
+					worktreeId: record.id,
+					fromSessionId: entry.senderKey,
+					from: peer.party === "parent" ? "child" : "parent",
+					text: entry.state === "recovery_required" ? `[Recovery required: prompt admission was not confirmed] ${entry.metadata.text ?? entry.prompt}` : entry.metadata.text ?? entry.prompt,
+					sentAt: entry.metadata.sentAt ?? ""
+				};
+			});
+		},
+		async prune(context, dryRun) {
+			const { root, store, records } = await resolve(context);
+			const reconciled = reconcile(records, probe);
+			const gitPaths = await git.listWorktreePaths(root);
+			const dirtyByPath = /* @__PURE__ */ new Map();
+			for (const record of reconciled.records) if (record.status === "orphaned" && fs.existsSync(record.path)) dirtyByPath.set(record.path, await git.dirtyFiles(record.path));
+			const plan = planPrune({
+				records: reconciled.records,
+				gitPaths,
+				worktreesRoot: worktreesRoot(deps.homeDir),
+				dirtyByPath
+			});
+			if (dryRun) {
+				store.replace(reconciled.records);
+				return plan;
+			}
+			for (const record of plan.remove) {
+				await git.removeWorktree({
+					repositoryRoot: root,
+					path: record.path,
+					force: false
+				});
+				cleanupStorage(root, record.path);
+			}
+			for (const record of plan.forget) cleanupStorage(root, record.path);
+			for (const record of [...plan.remove, ...plan.forget]) if (!await git.deleteBranch({
+				repositoryRoot: root,
+				branch: record.branch
+			}).catch(() => false)) plan.keptBranches.push(record.branch);
+			const dropped = new Set([...plan.remove, ...plan.forget].map((record) => record.id));
+			store.replace(reconciled.records.filter((record) => !dropped.has(record.id)));
+			return plan;
+		}
+	};
+	const locked = async (context, operation, signal) => {
+		try {
+			const { store } = await resolve(context);
+			return await store.transaction(operation, signal);
+		} catch (error) {
+			if (signal?.aborted && !(error instanceof DoomGitExpectedError)) throw new DoomGitExpectedError("spawn_cancelled", "The worktree operation was cancelled.", false, "Inspect its recorded state before retrying.");
+			if ([
+				"ENOTDIR",
+				"EACCES",
+				"EROFS",
+				"ENOSPC"
+			].includes(String(error.code))) throw new DoomGitExpectedError("registry_write_failed", "The worktree registry is not writable.", true, "Check permissions and free space before retrying.");
+			throw error;
+		}
+	};
+	return {
+		...operations,
+		spawn: (context, request, options) => {
+			if (sessionService === void 0) return Promise.reject(new DoomGitExpectedError("hub_unavailable", "The cockpit session service is unavailable.", true, "Use the cockpit worktree tool after its Git server facet is available."));
+			if (!validRefName(request.branch) || request.baseRef !== void 0 && !validRefName(request.baseRef)) return Promise.reject(new DoomGitExpectedError("invalid_request", "That is not a valid branch name.", false, "Pick another name."));
+			if (request.reservationId !== void 0 && context.sessionId === void 0) return Promise.reject(new DoomGitExpectedError("invalid_request", "A reserved worktree session requires its owning parent.", false, "Create the session from its pending setup card."));
+			return locked(context, () => operations.spawn(context, request, options), options?.signal);
+		},
+		close: (context, id, force) => locked(context, () => operations.close(context, id, force)),
+		list: (context) => locked(context, () => operations.list(context)),
+		merge: (context, id, message) => locked(context, () => operations.merge(context, id, message)),
+		prune: (context, dryRun) => locked(context, () => operations.prune(context, dryRun))
+	};
+}
+//#endregion
+export { NETWORK_TIMEOUT_MS as _, GIT_WORKTREE_LIFECYCLE_EVENT as a, createWorktreeGit as b, isWorktreeLifecycleEvent as c, registryFile as d, readJson as f, invalidRequest as g, HubUnavailableError as h, GIT_SESSION_CHANGED_EVENT as i, credentialsFile as l, DoomGitExpectedError as m, createWorktreeRegistry as n, createWorktreeMessageInbox as o, writeJsonAtomic as p, validRefName as r, isSessionChangedEvent as s, createWorktreeOperations as t, doomGitRoot as u, READ_TIMEOUT_MS as v, runGit as x, REBASE_TIMEOUT_MS as y };
+
+//# sourceMappingURL=worktreeOperations-BrWG2muV.mjs.map