@bridge_gpt/mcp-server 0.2.36 → 0.2.37

package/build/executor/worker-config-isolation.js

@@ -0,0 +1,287 @@
+/** Restrictive mode for the isolation directory itself (owner-only). */
+export const ISOLATION_DIR_MODE = 0o700;
+/** Owner-only mode for the seeded Bridge credential file. */
+export const ISOLATION_FILE_MODE = 0o600;
+/**
+ * Fixed name prefix for every directory this module creates. The startup sweep
+ * recognizes ONLY this prefix, which is what keeps it from deleting unrelated
+ * temporary directories that happen to share the parent.
+ */
+export const ISOLATION_DIR_PREFIX = "bapi-conductor-claude-cfg-";
+/**
+ * Age past which the startup sweep may remove an orphan, deliberately far above
+ * any supported worker lifetime (the longest executor job timeout is measured in
+ * hours, not days). A directory younger than this may still belong to a LIVE
+ * worker owned by a concurrent executor process, so the threshold is the only
+ * thing preventing the sweep from deleting an in-use configuration.
+ */
+export const ISOLATION_ORPHAN_MAX_AGE_MS = 24 * 60 * 60 * 1000;
+/** Platforms whose POSIX mode model supports the `0700` containment above. */
+const SUPPORTED_PLATFORMS = ["darwin", "linux"];
+/** Fixed remediation text per reason. Never includes a path or a value. */
+const REASON_MESSAGES = {
+    "unsupported-platform": "worker config isolation is not supported on this platform (POSIX 0700/0600 containment is required)",
+    "unsupported-auth-layout": "no ANTHROPIC_API_KEY is available to the executor; an OAuth/subscription-only login does not " +
+        "follow an isolated CLAUDE_CONFIG_DIR, and copying operator credentials is not permitted",
+    "missing-filesystem-dependency": "the executor was constructed without the filesystem boundaries worker config isolation requires",
+    "unsafe-isolation-parent": "the isolation parent directory is a symbolic link or not a directory; refusing to create an " +
+        "isolated config directory beneath it",
+    "directory-creation-failed": "the isolated config directory could not be created or permissioned",
+};
+/**
+ * Render a capability failure as a bounded, secret-free sentence naming only the
+ * platform and the fixed reason — the exact text posted as an `error_message`.
+ */
+export function formatWorkerConfigIsolationReason(platform, reason) {
+    return `worker config isolation unavailable on ${platform}: ${REASON_MESSAGES[reason]}`;
+}
+/**
+ * Decide whether isolation CAN be established here, without creating anything.
+ *
+ * Read-only by construction — this is what lets `doctor` reuse it (BAPI-731
+ * requirement 4) while keeping doctor's no-writes contract. It never reads the
+ * operator's `.claude.json`, never touches the credential store, and never
+ * returns a credential value: the auth check is presence-only.
+ */
+export function evaluateWorkerConfigIsolationCapability(deps) {
+    const platform = String(deps.platform);
+    if (!SUPPORTED_PLATFORMS.includes(deps.platform)) {
+        return { supported: false, platform, reason: "unsupported-platform" };
+    }
+    // Presence-only. The VALUE is never read into any result, log, or diagnostic.
+    const apiKey = deps.env?.ANTHROPIC_API_KEY;
+    if (typeof apiKey !== "string" || apiKey.trim().length === 0) {
+        return { supported: false, platform, reason: "unsupported-auth-layout" };
+    }
+    return { supported: true, platform, strategy: "api-key-env" };
+}
+function failure(platform, reason) {
+    return {
+        ok: false,
+        platform,
+        reason,
+        message: formatWorkerConfigIsolationReason(platform, reason),
+    };
+}
+/**
+ * Create a private, owner-only configuration directory for ONE job attempt.
+ *
+ * The directory lives under the executor's temporary root — never inside the
+ * worktree, which would put executor-owned state into the diff the worker is
+ * about to commit and would be destroyed by the worktree's own reset/clean paths.
+ *
+ * Seeds NOTHING of the operator's Claude configuration. Inventory finding 3
+ * established that no trust entry is needed to keep a headless worker from
+ * prompting, and finding 4 established that the ANTHROPIC credential travels in
+ * the environment. No projected fragment of the operator's configuration is
+ * written, so none can get stale or over-grant.
+ *
+ * The single exception is {@link SeededBridgeCredential} — see that type for why
+ * an empty directory is NOT sufficient for the Bridge credential specifically:
+ * finding 4 does not extend to `BAPI_API_KEY`, which is denied from the worker
+ * environment on purpose, leaving the redirected store as its only route in.
+ */
+export async function establishWorkerConfigIsolation(deps, options = {}) {
+    const capability = evaluateWorkerConfigIsolationCapability(deps);
+    if (!capability.supported) {
+        return failure(capability.platform, capability.reason);
+    }
+    const platform = capability.platform;
+    let parent;
+    try {
+        parent = deps.tmpdir();
+    }
+    catch {
+        return failure(platform, "unsafe-isolation-parent");
+    }
+    if (typeof parent !== "string" || parent.length === 0) {
+        return failure(platform, "unsafe-isolation-parent");
+    }
+    // Reject a symlinked or non-directory parent BEFORE creating anything beneath
+    // it: `mkdtemp` under a symlink would silently place a credential-adjacent
+    // directory wherever the link points.
+    try {
+        const parentMeta = await deps.lstatPath(parent);
+        if (!parentMeta || parentMeta.isSymbolicLink || !parentMeta.isDirectory) {
+            return failure(platform, "unsafe-isolation-parent");
+        }
+    }
+    catch {
+        return failure(platform, "unsafe-isolation-parent");
+    }
+    // `mkdtemp` is atomic and collision-free, so two concurrent jobs on the same
+    // executor can never be handed the same directory.
+    let created;
+    try {
+        created = await deps.mkdtemp(deps.join(parent, ISOLATION_DIR_PREFIX));
+        if (typeof created !== "string" || created.length === 0) {
+            return failure(platform, "directory-creation-failed");
+        }
+    }
+    catch {
+        // The raw error may carry a host path; only the fixed reason escapes.
+        return failure(platform, "directory-creation-failed");
+    }
+    // Verify what we actually got is a real directory and not a link, then narrow
+    // it to owner-only. `mkdtemp` already creates at 0700 on POSIX; the explicit
+    // chmod makes the guarantee independent of the platform's umask behavior.
+    try {
+        const meta = await deps.lstatPath(created);
+        if (!meta || meta.isSymbolicLink || !meta.isDirectory) {
+            await safeDispose(deps, created);
+            return failure(platform, "unsafe-isolation-parent");
+        }
+        await deps.chmod(created, ISOLATION_DIR_MODE);
+    }
+    catch {
+        await safeDispose(deps, created);
+        return failure(platform, "directory-creation-failed");
+    }
+    // The isolated XDG root lives INSIDE the disposable directory, so a single
+    // recursive removal reclaims both and no second lifetime needs tracking.
+    const xdgConfigHome = deps.join(created, "xdg");
+    try {
+        await deps.mkdir(xdgConfigHome, { recursive: true });
+        await deps.chmod(xdgConfigHome, ISOLATION_DIR_MODE);
+    }
+    catch {
+        await safeDispose(deps, created);
+        return failure(platform, "directory-creation-failed");
+    }
+    // Seed the one credential the redirect would otherwise strip. Fail-CLOSED,
+    // matching this module's posture: a worker that cannot reach its Bridge MCP
+    // tools cannot do the job it was dispatched for, and the failure mode is a
+    // clean exit that looks like success. Refusing to spawn is strictly better
+    // than spawning a worker guaranteed to accomplish nothing.
+    const credential = options.bridgeCredential;
+    if (credential) {
+        if (!deps.writeFile) {
+            await safeDispose(deps, created);
+            return failure(platform, "missing-filesystem-dependency");
+        }
+        try {
+            const bridgeDir = deps.join(xdgConfigHome, "bridge");
+            await deps.mkdir(bridgeDir, { recursive: true });
+            await deps.chmod(bridgeDir, ISOLATION_DIR_MODE);
+            const storePath = deps.join(bridgeDir, "credentials.json");
+            await deps.writeFile(storePath, 
+            // Exactly the shape resolveCredentialBundle reads: a logical target
+            // mapping to its named secret values.
+            `${JSON.stringify({ [`bapi:${credential.repoName}`]: { BAPI_API_KEY: credential.apiKey } }, null, 2)}\n`);
+            // Narrow AFTER writing: the content is secret, and a permissive window
+            // between create and chmod is the whole risk being closed here.
+            await deps.chmod(storePath, ISOLATION_FILE_MODE);
+        }
+        catch {
+            // The raw error may carry a host path or the secret; only the fixed
+            // reason escapes.
+            await safeDispose(deps, created);
+            return failure(platform, "directory-creation-failed");
+        }
+    }
+    let disposed = false;
+    return {
+        ok: true,
+        isolation: {
+            claudeConfigDir: created,
+            xdgConfigHome,
+            async dispose() {
+                if (disposed)
+                    return null;
+                disposed = true;
+                try {
+                    await deps.rmRecursive(created);
+                    return null;
+                }
+                catch {
+                    // Best-effort by contract: cleanup failure must never replace an
+                    // already-determined job outcome, and the raw error never escapes.
+                    return "worker config isolation directory could not be removed";
+                }
+            },
+        },
+    };
+}
+/** Remove a partially-created directory, swallowing every failure. */
+async function safeDispose(deps, path) {
+    try {
+        await deps.rmRecursive(path);
+    }
+    catch {
+        /* best-effort */
+    }
+}
+/**
+ * Remove stale isolation directories left behind by an ungraceful executor exit
+ * (SIGKILL, OOM, host reboot) where per-job disposal never ran.
+ *
+ * Deliberately conservative, because this function deletes directories: it looks
+ * only inside the executor's own temporary root, recognizes only entries
+ * carrying {@link ISOLATION_DIR_PREFIX}, requires NON-following metadata to say
+ * the entry is a real directory (so a symlink is skipped rather than followed),
+ * and requires an age beyond {@link ISOLATION_ORPHAN_MAX_AGE_MS} so a live
+ * concurrent executor's active job directory is never removed.
+ *
+ * Never throws: startup must proceed even if the sweep cannot run at all.
+ */
+export async function sweepOrphanedWorkerConfigDirectories(deps) {
+    const result = { removed: 0, skipped: 0, diagnostics: [] };
+    const maxAgeMs = typeof deps.maxAgeMs === "number" ? deps.maxAgeMs : ISOLATION_ORPHAN_MAX_AGE_MS;
+    let parent;
+    try {
+        parent = deps.tmpdir();
+        if (typeof parent !== "string" || parent.length === 0) {
+            result.diagnostics.push("worker config isolation sweep skipped: no temporary root");
+            return result;
+        }
+    }
+    catch {
+        result.diagnostics.push("worker config isolation sweep skipped: no temporary root");
+        return result;
+    }
+    let entries;
+    try {
+        entries = await deps.readdir(parent);
+    }
+    catch {
+        result.diagnostics.push("worker config isolation sweep skipped: temporary root unreadable");
+        return result;
+    }
+    const cutoff = deps.now() - maxAgeMs;
+    for (const entry of entries) {
+        // Prefix match FIRST: anything the module did not create is not ours to
+        // delete, whatever its age.
+        if (typeof entry !== "string" || !entry.startsWith(ISOLATION_DIR_PREFIX)) {
+            result.skipped += 1;
+            continue;
+        }
+        const candidate = deps.join(parent, entry);
+        let meta;
+        try {
+            meta = await deps.lstatPath(candidate);
+        }
+        catch {
+            result.skipped += 1;
+            continue;
+        }
+        // A symlink is skipped, never followed — removing it recursively could
+        // delete whatever it points at.
+        if (!meta || meta.isSymbolicLink || !meta.isDirectory) {
+            result.skipped += 1;
+            continue;
+        }
+        if (!(meta.mtimeMs < cutoff)) {
+            result.skipped += 1;
+            continue;
+        }
+        try {
+            await deps.rmRecursive(candidate);
+            result.removed += 1;
+        }
+        catch {
+            result.skipped += 1;
+            result.diagnostics.push("worker config isolation sweep could not remove a stale directory");
+        }
+    }
+    return result;
+}

package/build/executor/worker-finalization.js

@@ -22,8 +22,20 @@
  * an existence-only check. The check instead compares the authoritative origin
  * branch tip SHA against the worker's own HEAD commit (`headSha`, from git
  * telemetry) whenever that comparison is available.
+ *
+ * BAPI-762: the authoritative origin-tip-vs-HEAD comparison runs regardless of
+ * whether the completion result carries a `pr_url`. The pipeline guarantees a PR
+ * URL for essentially every implement job, so a PR-presence short-circuit ABOVE
+ * this comparison could never catch an unpushed correction commit — a run could
+ * report `clean_exit`/`succeeded` with a PR open and a commit that never reached
+ * origin. When the origin tip exists but does not match the worker's own HEAD,
+ * that is positive proof of a DIFFERENT failure shape than "no evidence any work
+ * reached origin": `WorkerFinalizationSavedButUnfinalized` names it distinctly so
+ * the terminal-disposition classifier (`terminal_disposition.py`) can route it as
+ * a resumable, deterministic cause instead of laundering it into a generic crash
+ * that gets retried as a transient upstream failure.
  */
-import { secretFreeErrorMessage, WorkerFinalizationMissingRemoteBranchAndPr, WorkerFinalizationPrBaseMismatch, } from "./job-errors.js";
+import { secretFreeErrorMessage, WorkerFinalizationMissingRemoteBranchAndPr, WorkerFinalizationPrBaseMismatch, WorkerFinalizationSavedButUnfinalized, } from "./job-errors.js";
 import { isImplementationStyleJobType } from "./job-types.js";
 /** Bounded settling re-check defaults for the authoritative origin-tip lookup. */
 const DEFAULT_ORIGIN_FINALIZATION_ATTEMPTS = 3;
@@ -171,18 +183,51 @@ function prBaseMismatchFailure(job, prNumber, expectedBase, actualBase) {
         classification: "crashed",
     };
 }
-function missingBranchAndPrFailure(job, detail) {
+/**
+ * `detail` describes a state with NO evidence any work reached origin (branch
+ * unresolved, branch absent from origin, or the origin lookup itself failed).
+ * `hasPrUrl` only changes the wording — a PR existing is never treated as
+ * evidence of a push, so the message must not claim "no PR URL" when one was
+ * actually present (that would be false and would mislead the operator reading
+ * it toward the wrong recovery step).
+ */
+function missingBranchAndPrFailure(job, detail, hasPrUrl) {
     const label = job.ticket_key ? `${job.ticket_key} (job ${job.id})` : `job ${job.id}`;
+    const prefix = hasPrUrl ? "opened a PR, but" : "produced no PR URL and";
     return {
         error_kind: WorkerFinalizationMissingRemoteBranchAndPr,
-        error_message: `${label} exited cleanly but ${detail}`,
+        error_message: `${label} exited cleanly but ${prefix} ${detail}`,
+        classification: "crashed",
+    };
+}
+/**
+ * BAPI-762: the origin branch exists at an authoritative tip that does not match
+ * the worker's own HEAD — durable work exists on origin, but not this worker's
+ * latest commit. Unlike {@link missingBranchAndPrFailure}, this state has positive
+ * evidence of something recoverable, so the message names the branch and the
+ * origin SHA an operator can resume/finalize from rather than re-running. The
+ * human-facing text truncates SHAs to 12 characters (matching the codebase's
+ * existing convention); the full 40-character origin SHA is carried in the
+ * structured `last_commit_sha` field so nothing has to re-derive it from prose.
+ */
+function savedButUnfinalizedFailure(job, branch, originSha, workerHeadSha) {
+    const label = job.ticket_key ? `${job.ticket_key} (job ${job.id})` : `job ${job.id}`;
+    return {
+        error_kind: WorkerFinalizationSavedButUnfinalized,
+        error_message: `${label} exited cleanly, but origin branch '${branch}' is at ${originSha.slice(0, 12)}, ` +
+            `which does not match this worker's HEAD ${workerHeadSha.slice(0, 12)} — the worker's latest ` +
+            `commit was not pushed. Work already on origin at this SHA is recoverable: resume/finalize ` +
+            `from '${branch}' instead of re-running from scratch.`,
         classification: "crashed",
+        last_commit_sha: originSha,
     };
 }
 /**
- * Validate that an implementation-style job's clean exit actually produced a PR
- * or a pushed origin branch. Non-implementation-style jobs (verdict jobs) and
- * any result carrying a non-empty `pr_url` bypass the git check entirely.
+ * Validate that an implementation-style job's clean exit actually published its
+ * work to origin. Non-implementation-style jobs (verdict jobs) bypass the git
+ * check entirely. A `pr_url` on the completion result is NOT proof of a push
+ * (BAPI-762) — the authoritative origin-tip-vs-HEAD comparison below always runs,
+ * so an unpushed local commit is detected whether or not a pull request exists.
  */
 export async function validateWorkerFinalization(input) {
     const { job, branch, worktreePath, result, runCommand, headSha } = input;
@@ -216,14 +261,15 @@ export async function validateWorkerFinalization(input) {
             }
         }
     }
-    if (extractPrUrl(result)) {
-        return { ok: true };
-    }
+    const hasPrUrl = Boolean(extractPrUrl(result));
+    // BAPI-762: `branch`/`headSha` are normalized once here and reused through the
+    // rest of the check — including by the diagnostics below — instead of being
+    // re-derived at each failure site.
     const trimmedBranch = typeof branch === "string" ? branch.trim() : "";
     if (!trimmedBranch) {
         return {
             ok: false,
-            failure: missingBranchAndPrFailure(job, "produced no PR URL and no expected branch to verify on origin"),
+            failure: missingBranchAndPrFailure(job, "no expected branch to verify on origin", hasPrUrl),
         };
     }
     // Recovery/resume jobs fetch `origin/<branch>` before the worker even starts,
@@ -233,7 +279,9 @@ export async function validateWorkerFinalization(input) {
     // fails loud instead of passing. When HEAD is unresolved (degraded telemetry),
     // fall back to the existence-only check rather than inventing a new failure
     // mode. The authoritative lookup is retried a few times so a push that settles
-    // just after the worker exits still finalizes (BAPI-566 Bug A).
+    // just after the worker exits still finalizes (BAPI-566 Bug A). This lookup
+    // runs unconditionally — including when `hasPrUrl` is true (BAPI-762, AC-5): a
+    // PR being open is never accepted as proof this worker's own commit landed.
     const trimmedHeadSha = typeof headSha === "string" ? headSha.trim().toLowerCase() : "";
     const attempts = normalizeAttempts(input.originResolveAttempts);
     const retryDelayMs = normalizeRetryDelay(input.originResolveRetryDelayMs);
@@ -245,19 +293,25 @@ export async function validateWorkerFinalization(input) {
     catch (err) {
         return {
             ok: false,
-            failure: missingBranchAndPrFailure(job, `produced no PR URL and branch '${trimmedBranch}' could not be verified on origin: ${secretFreeErrorMessage(err)}`),
+            failure: missingBranchAndPrFailure(job, `branch '${trimmedBranch}' could not be verified on origin: ${secretFreeErrorMessage(err)}`, hasPrUrl),
         };
     }
     if (remoteSha === null) {
         return {
             ok: false,
-            failure: missingBranchAndPrFailure(job, `produced no PR URL and branch '${trimmedBranch}' is not on origin`),
+            failure: missingBranchAndPrFailure(job, `branch '${trimmedBranch}' is not on origin`, hasPrUrl),
         };
     }
+    // BAPI-762: an authoritative origin tip that does not match the worker's HEAD
+    // is positive evidence of RECOVERABLE work — distinct from the sub-cases above,
+    // which have no evidence any work reached origin at all. This is the only
+    // sub-case that produces `WorkerFinalizationSavedButUnfinalized`, and it fires
+    // identically whether or not a PR is open (AC-5) — the PR shortcut this ticket
+    // removes could otherwise conceal exactly this state.
     if (trimmedHeadSha && remoteSha !== trimmedHeadSha) {
         return {
             ok: false,
-            failure: missingBranchAndPrFailure(job, `produced no PR URL and origin branch '${trimmedBranch}' is at ${remoteSha.slice(0, 12)}, which does not match this worker's HEAD ${trimmedHeadSha.slice(0, 12)} — the worker's commit was not pushed`),
+            failure: savedButUnfinalizedFailure(job, trimmedBranch, remoteSha, trimmedHeadSha),
         };
     }
     return { ok: true };

package/build/executor/worktree.js

@@ -34,6 +34,10 @@ function toWorktreeCoreDeps(deps) {
         platform: deps.platform,
         env: deps.env,
         cwd: deps.cwd,
+        // BAPI-727: route path-only untracked-cleanup diagnostics to the executor's
+        // stderr logger. Shared `start-tickets` callers may keep omitting this — the
+        // primitive treats an absent callback as "do not report".
+        onCleanupDiagnostic: deps.errorLog,
     };
 }
 /** Build the command-provisioning boundary from the executor deps (BAPI-664). */
@@ -57,12 +61,35 @@ function toCommandProvisioningDeps(deps) {
  * preserved unchanged. Errors stay secret-free (no raw filesystem exception, Git
  * output, or command contents).
  */
-async function finalizeExecutorWorktree(worktreePath, branch, deps) {
+async function finalizeExecutorWorktree(worktreePath, branch, expectedHeadSha, deps) {
     const provisioned = await provisionCommandsForWorktree(worktreePath, toCommandProvisioningDeps(deps));
     if (!provisioned.ok) {
         return { ok: false, error: provisioned.error };
     }
-    return { ok: true, worktreePath, branch };
+    return { ok: true, worktreePath, branch, expectedHeadSha };
+}
+/** A full 40-character hex object name. */
+const FULL_SHA_PATTERN = /^[0-9a-f]{40}$/i;
+/**
+ * Resolve a ref to its immutable commit via `rev-parse <ref>^{commit}`.
+ *
+ * Returns `null` on any failure or malformed output. The caller turns that into
+ * a bounded worktree failure rather than inventing an expected SHA — a made-up
+ * expectation would make the pre-spawn assertion either vacuous or wrong.
+ */
+async function resolveCommitSha(deps, worktreeCwd, ref) {
+    try {
+        const result = await deps.runCommand("git", ["rev-parse", `${ref}^{commit}`], {
+            cwd: worktreeCwd,
+        });
+        if (!commandSucceeded(result))
+            return null;
+        const sha = result.stdout.trim();
+        return FULL_SHA_PATTERN.test(sha) ? sha : null;
+    }
+    catch {
+        return null;
+    }
 }
 /**
  * Ensure the worktree for a job exists, delegating to the shared Worktrunk
@@ -115,13 +142,25 @@ export async function ensureExecutorWorktree(job, options, deps, policy = {}) {
                 error: `git fetch origin ${branch} failed${reason ? `: ${reason}` : ""}`,
             };
         }
+        // BAPI-731: resolve the freshly fetched remote head to an immutable commit
+        // BEFORE creating the worktree, so the pre-spawn assertion has an
+        // authoritative expectation. Resolved here (right after the fetch) rather
+        // than after creation, so the expectation is independent of the worktree the
+        // assertion will later inspect.
+        const expectedHeadSha = await resolveCommitSha(deps, deps.cwd, originRef);
+        if (expectedHeadSha === null) {
+            return {
+                ok: false,
+                error: `failed to resolve '${originRef}' to a commit after fetching branch '${branch}'`,
+            };
+        }
         const row = await createWorktreeForTicket(toWorktreeCoreDeps(deps), key, { [key]: branch }, options.worktrunkBinary, baseStartPoint, guardStaleWorktree, 
         // Hard-reset a reused existing local branch onto the freshly fetched
         // pushed head; a missing local branch is instead cut from `baseStartPoint`
         // (= `origin/<branch>`) inside the primitive, so both land at origin.
         { freshenFromOrigin: originRef });
         if (row.status === "created" && typeof row.path === "string") {
-            return finalizeExecutorWorktree(row.path, branch, deps);
+            return finalizeExecutorWorktree(row.path, branch, expectedHeadSha, deps);
         }
         return { ok: false, error: row.error ?? `worktree creation failed for branch '${branch}'` };
     }
@@ -146,7 +185,10 @@ export async function ensureExecutorWorktree(job, options, deps, policy = {}) {
     const baseSha = resolvedBase.base_sha;
     const row = await createWorktreeForTicket(toWorktreeCoreDeps(deps), key, { [key]: branch }, options.worktrunkBinary, baseSha, guardStaleWorktree, { alignExistingBranchTo: baseSha, verifyHeadMatches: baseSha });
     if (row.status === "created" && typeof row.path === "string") {
-        return finalizeExecutorWorktree(row.path, branch, deps);
+        // BAPI-731: `baseSha` is already the pinned immutable commit this fresh
+        // worktree was cut from and verified against (`verifyHeadMatches`), so it is
+        // the expectation — no extra resolution needed.
+        return finalizeExecutorWorktree(row.path, branch, baseSha, deps);
     }
     return { ok: false, error: row.error ?? `worktree creation failed for branch '${branch}'` };
 }