@codebend3r/che 1.2.1 → 1.2.3

package/bin/branchsync.py

@@ -1,20 +1,38 @@
-"""Non-destructive branch/worktree synchronization for sync-all-branches.
+"""Branch/worktree synchronization for sync-all-branches.
 
-Unlike the old delegated cleanup, sync preserves every checkout and local branch.
-Only disposable worktrees created here may be removed. Git locks need no special
-handling: they prevent removal/pruning, not a rebase inside the locked checkout.
+Sync rebases every branch onto its upstream inside its own checkout, locked or
+not, and keeps every local change. A branch is only moved past its own commits
+(reset to an upstream that already holds them) or deleted when a content check
+proves its changes are already upstream or in a main or dev branch. The only
+things it deletes are disposable worktrees it created itself and, with a merged
+branch whose upstream is gone, that branch's clean worktree.
 """
 
 from __future__ import annotations
 
+import json
+import shutil
 import subprocess
 import tempfile
 from dataclasses import dataclass, field
+from datetime import datetime
 from pathlib import Path
 
 from gitutils import Worktree, local_branches, worktrees
 from utils import info, run, run_output, success, warning
 
+# A branch is "merged" when it reached one of these on origin. They are also
+# never pruned themselves, whatever state their upstream is in.
+BASE_BRANCHES = ("main", "master", "dev", "develop")
+PROTECTED_BRANCHES = (*BASE_BRANCHES, "staging")
+
+_PROBE_IDENTITY = {
+    "GIT_AUTHOR_NAME": "che",
+    "GIT_AUTHOR_EMAIL": "che@localhost",
+    "GIT_COMMITTER_NAME": "che",
+    "GIT_COMMITTER_EMAIL": "che@localhost",
+}
+
 _OPERATION_FILES = (
     "rebase-merge",
     "rebase-apply",
@@ -50,7 +68,11 @@ class BranchSync:
     updated: list[str] = field(default_factory=list)
     current: list[str] = field(default_factory=list)
     local_only: list[str] = field(default_factory=list)
+    gone: list[str] = field(default_factory=list)
     restored: list[str] = field(default_factory=list)
+    reset: list[str] = field(default_factory=list)
+    deleted: list[str] = field(default_factory=list)
+    merged_kept: list[str] = field(default_factory=list)
     blocked: list[str] = field(default_factory=list)
     trees: list[Worktree] = field(init=False)
 
@@ -116,8 +138,11 @@ class BranchSync:
         )
 
     def includes(self, branch: str, upstream: str) -> bool:
+        return self.is_ancestor(upstream, f"refs/heads/{branch}")
+
+    def is_ancestor(self, older: str, newer: str) -> bool:
         result = run(
-            ["git", "merge-base", "--is-ancestor", upstream, f"refs/heads/{branch}"],
+            ["git", "merge-base", "--is-ancestor", older, newer],
             cwd=self.root,
             check=False,
             capture=True,
@@ -128,6 +153,33 @@ class BranchSync:
             )
         return result.returncode == 0
 
+    def adds_nothing(self, branch: str, target: str) -> bool:
+        """True when merging ``branch`` into ``target`` would leave its tree unchanged.
+
+        Decided by content, not ancestry: a squash-merged branch, or a stale copy
+        of an upstream that was rebased and force-pushed elsewhere, shares no
+        commits with ``target`` even though every change it carries is already
+        there. A conflict, unrelated histories, or a git older than 2.38 (no
+        ``--write-tree``) all answer False, so doubt never discards anything.
+        """
+        merged = run(
+            ["git", "merge-tree", "--write-tree", target, f"refs/heads/{branch}"],
+            cwd=self.root,
+            check=False,
+            capture=True,
+        )
+        if merged.returncode or not merged.stdout:
+            return False
+        tree = merged.stdout.splitlines()[0]
+        return tree == run_output(["git", "rev-parse", f"{target}^{{tree}}"], cwd=self.root)
+
+    def keep_gone(self, branch: str, upstream: str) -> None:
+        # Usually a merged PR whose remote branch was deleted, or one closed
+        # unmerged. Nothing is left to pull, so it is not a failure; keep it
+        # for the user to review.
+        info(f"  🪦 Upstream gone: {branch} ({upstream}); branch and worktree retained")
+        self.gone.append(branch)
+
     def save_wip(self, branch: str, path: Path) -> str:
         if not self.dirty(path):
             return ""
@@ -206,10 +258,21 @@ class BranchSync:
             info(f"  = Up to date: {branch} (local commits kept){f' in {path}' if path else ''}")
             self.current.append(branch)
             return
+        # Replaying commits whose content the upstream already holds conflicts
+        # for nothing: the usual cause is a parent branch squash-merged into main
+        # and this branch rebased and force-pushed from another machine. When a
+        # diverged branch adds nothing to its upstream, moving it there discards
+        # no change. A branch merely behind fast-forwards through the rebase.
+        stale = not self.is_ancestor(f"refs/heads/{branch}", upstream) and self.adds_nothing(
+            branch, upstream
+        )
         if self.dry_run:
-            info(
-                f"  🌵 Would update {branch} from {upstream}{f' in {path}' if path else ''}; stash/restore WIP if needed"
+            action = (
+                f"reset {branch} to {upstream} (its changes are already there)"
+                if stale
+                else f"update {branch} from {upstream}"
             )
+            info(f"  🌵 Would {action}{f' in {path}' if path else ''}; stash/restore WIP if needed")
             return
 
         temporary: Path | None = None
@@ -220,6 +283,29 @@ class BranchSync:
                 path = temporary / "checkout"
                 run(["git", "worktree", "add", "--quiet", str(path), branch], cwd=self.root)
             oid = self.save_wip(branch, path)
+            if stale:
+                info(
+                    f"⏩ Resetting {branch} to {upstream} in {path}; its changes are already there"
+                )
+                # --keep, not --hard: WIP is already stashed, and --keep refuses
+                # rather than overwrite anything that slipped past the stash.
+                moved = (
+                    run(
+                        ["git", "reset", "--quiet", "--keep", upstream], cwd=path, check=False
+                    ).returncode
+                    == 0
+                )
+                if not moved:
+                    warning(f"  ❌ Reset failed for {branch} in {path}")
+                    self.block(branch, f"reset failed in {path}; original commits retained")
+                restored = self.restore_wip(branch, path, oid)
+                if moved and restored:
+                    if self.includes(branch, upstream):
+                        self.reset.append(branch)
+                        success(f"  ✅ Reset to upstream: {branch}")
+                    else:
+                        self.block(branch, "verification failed: fetched upstream not included")
+                return
             info(f"⬇️ Rebasing {branch} in {path} (lock preserved)")
             # DELIBERATE DIVERGENCE: one fetched snapshot instead of pull's
             # per-branch fetch. Disable autostash/updateRefs so Git cannot
@@ -289,6 +375,159 @@ class BranchSync:
                         f"temporary worktree retained for inspection: {temporary / 'checkout'}",
                     )
 
+    def bases(self) -> list[str]:
+        return [ref for name in BASE_BRANCHES if self.has_ref(ref := f"refs/remotes/origin/{name}")]
+
+    def merged_reason(self, branch: str) -> str:
+        """How ``branch`` reached a main or dev branch on origin, or "" if unproven.
+
+        Four proofs, cheapest first: the tip is contained in the base; merging it
+        would leave the base's tree unchanged (``adds_nothing``, a squash merge
+        or a stale copy of rebased work); a one-commit probe of the branch's net
+        change is already in the base by patch ID (a squash merge whose lines
+        the base has since changed again, which ``adds_nothing`` sees as a
+        conflict); or GitHub reports a merged PR whose head is the tip, with no
+        local commit newer than the merge (covers stacked PRs rebased and
+        force-pushed before a squash).
+        """
+        tip = run_output(["git", "rev-parse", "--verify", f"refs/heads/{branch}"], cwd=self.root)
+        for base in self.bases():
+            label = base.removeprefix("refs/remotes/")
+            if (
+                run(
+                    ["git", "merge-base", "--is-ancestor", tip, base],
+                    cwd=self.root,
+                    check=False,
+                    capture=True,
+                ).returncode
+                == 0
+            ):
+                return f"contained in {label}"
+            if self.adds_nothing(branch, base):
+                return f"its content is already in {label}"
+            fork = run_output(["git", "merge-base", base, tip], cwd=self.root, check=False)
+            if not fork:
+                continue
+            probe = run_output(
+                ["git", "commit-tree", f"{tip}^{{tree}}", "-p", fork, "-m", "che squash probe"],
+                cwd=self.root,
+                check=False,
+            )
+            if probe:
+                cherry = run_output(["git", "cherry", base, probe], cwd=self.root, check=False)
+                if cherry.startswith("-"):
+                    return f"squash-merged into {label}"
+        return self.merged_pull_request(branch, tip)
+
+    def merged_pull_request(self, branch: str, tip: str) -> str:
+        origin = run_output(["git", "remote", "get-url", "origin"], cwd=self.root, check=False)
+        # The patch-ID proofs work from cached refs; this one is a network call.
+        if self.dry_run or "github.com" not in origin or shutil.which("gh") is None:
+            return ""
+        listing = run(
+            [
+                "gh",
+                "pr",
+                "list",
+                "--state",
+                "merged",
+                "--head",
+                branch,
+                "--json",
+                "number,headRefOid,mergedAt",
+            ],
+            cwd=self.root,
+            check=False,
+            capture=True,
+        )
+        if listing.returncode:
+            return ""
+        try:
+            pulls = json.loads(listing.stdout or "[]")
+        except json.JSONDecodeError:
+            return ""
+        tip_time = int(run_output(["git", "log", "-1", "--format=%ct", tip], cwd=self.root))
+        for pull in pulls:
+            contains = (
+                run(
+                    ["git", "merge-base", "--is-ancestor", tip, pull["headRefOid"]],
+                    cwd=self.root,
+                    check=False,
+                    capture=True,
+                ).returncode
+                == 0
+            )
+            merged_at = datetime.fromisoformat(pull["mergedAt"]).timestamp()
+            if contains or tip_time <= merged_at:
+                return f"PR #{pull['number']} merged"
+        return ""
+
+    def keep_worktree(self, tree: Worktree) -> str:
+        """Why a merged branch's worktree must stay, or "" when it can go."""
+        path = Path(tree.path)
+        if path.resolve() in (self.root.resolve(), Path(self.trees[0].path).resolve()):
+            return "checked out here"
+        if not path.is_dir():
+            return ""
+        if in_progress(path):
+            return f"operation in progress in {path}"
+        if self.dirty(path):
+            return f"uncommitted work in {path}"
+        return ""
+
+    def drop_gone(self, branch: str, upstream: str, occupied: dict[str, Path]) -> None:
+        """Delete ``branch`` and its clean worktree when merged; otherwise keep it.
+
+        DELIBERATE DIVERGENCE: a gone upstream used to be "not proof of a
+        merge" and was only reported. It is still not proof (a PR can be closed
+        unmerged), but it is the trigger, and the merge is proven separately by
+        :meth:`merged_reason`; an unproven branch is kept and reported as
+        `Upstream gone`, not as a failure. A merged branch's worktree is removed
+        with it when clean, and a lock is dropped first, since the branch is
+        finished; a dirty, in-progress or caller checkout is kept.
+        """
+        if branch in PROTECTED_BRANCHES:
+            info(f"  🛡️ Protected: {branch} (upstream gone)")
+            return
+        reason = self.merged_reason(branch)
+        if not reason:
+            self.keep_gone(branch, upstream)
+            return
+        tip = run_output(["git", "rev-parse", "--short", f"refs/heads/{branch}"], cwd=self.root)
+        path = occupied.get(branch)
+        tree = next((t for t in self.trees if path and Path(t.path) == path), None)
+        if tree is not None and (why := self.keep_worktree(tree)):
+            info(f"  ⏭️ Merged, kept: {branch} ({reason}; {why})")
+            self.merged_kept.append(f"{branch}: {why}")
+            return
+        if self.dry_run:
+            info(f"  🌵 Would delete merged: {branch} at {tip} ({reason})")
+            return
+        if tree is not None:
+            if tree.locked:
+                run(["git", "worktree", "unlock", tree.path], cwd=self.root, check=False)
+            removed = run(
+                [
+                    "git",
+                    "worktree",
+                    "remove",
+                    *(["--force"] if not Path(tree.path).is_dir() else []),
+                    tree.path,
+                ],
+                cwd=self.root,
+                check=False,
+            )
+            if removed.returncode:
+                self.block(branch, f"merged ({reason}) but worktree removal refused: {tree.path}")
+                return
+        if run(["git", "branch", "-D", branch], cwd=self.root, check=False).returncode:
+            self.block(branch, f"merged ({reason}) but branch deletion failed")
+            return
+        self.deleted.append(branch)
+        success(
+            f"  🗑️ Deleted merged: {branch} at {tip} ({reason}) - restore with: git branch {branch} {tip}"
+        )
+
     def update(self) -> None:
         occupied = self.occupied()
         for branch, upstream in local_branches("upstream", cwd=self.root):
@@ -298,10 +537,10 @@ class BranchSync:
                 info(f"  ℹ️ Local only: {branch} (no remote counterpart)")  # noqa: RUF001
                 self.local_only.append(branch)
                 continue
-            if not self.has_ref(upstream):
-                self.block(branch, f"upstream gone: {upstream}; branch and worktree retained")
-                continue
             try:
+                if not self.has_ref(upstream):
+                    self.drop_gone(branch, upstream, occupied)
+                    continue
                 self.sync_branch(branch, upstream, occupied)
             except (subprocess.CalledProcessError, OSError) as exc:
                 self.block(branch, f"preflight failed: {exc}")
@@ -310,15 +549,23 @@ class BranchSync:
         success("═══ summary ═══")
         for label, names in (
             ("Updated", self.updated),
+            ("Reset to upstream", self.reset),
             ("Up to date", self.current),
+            ("Deleted (merged)", self.deleted),
             ("Tracked new", tracked),
             ("Local only", self.local_only),
+            ("Upstream gone", self.gone),
             ("WIP restored", self.restored),
         ):
             info(f"{label}: {len(names)} ({', '.join(names)})")
+        if self.gone:
+            info("  Review them; clean-stale-branches removes them once you are sure.")
+        info(f"Merged, kept: {len(self.merged_kept)}")
+        for reason in self.merged_kept:
+            info(f"  • {reason}")
         info(f"Blocked: {len(self.blocked)}")
         for reason in self.blocked:
             warning(f"  • {reason}")
         info(
-            "Caller checkout, existing worktree paths, locks and local commits preserved. Nothing pushed."
+            "Caller checkout, unmerged branches, dirty worktrees and every local change preserved. Nothing pushed."
         )

package/bin/commands.py

@@ -250,6 +250,20 @@ COMMANDS: tuple[Command, ...] = (
         tags=("branch", "delete", "prune"),
         prompts=(Prompt("--protect", "Extra branches to protect", help="Comma separated"),),
     ),
+    Command(
+        name="hard-reset-all-branches",
+        flags=("--dry-run", "--force"),
+        category="git",
+        icon="💣",
+        summary="Check out every local branch and hard reset it to origin/<branch>",
+        script="git/hard-reset-all-branches.py",
+        sound=4,
+        dry_run="env",
+        destructive=True,
+        needs=("git",),
+        tags=("branch", "reset", "origin", "worktree"),
+        prompts=(Prompt("--force", "Also discard uncommitted changes", kind="bool"),),
+    ),
     Command(
         name="prune-worktrees",
         flags=("--dry-run", "--force"),
@@ -268,7 +282,7 @@ COMMANDS: tuple[Command, ...] = (
         flags=("--dry-run", "--author=", "--limit="),
         category="git",
         icon="🔄",
-        summary="Update every branch and worktree, preserving locks and local work",
+        summary="Update every branch and worktree, pruning what has been merged",
         script="git/sync-all-branches.py",
         sound=7,
         dry_run="env",

package/bin/git/hard-reset-all-branches.py

@@ -0,0 +1,250 @@
+#!/usr/bin/env python3
+"""💣 Check out every local branch and hard reset it to origin/<branch>.
+
+Fetch once, then for each local branch that has an origin/<branch> and differs
+from it: check it out and ``git reset --hard`` to the origin state. A branch
+checked out in another worktree is reset inside that worktree instead. Local
+commits are dropped (they stay in the reflog); untracked files are left alone.
+Returns to the starting branch at the end.
+
+Uncommitted changes to tracked files are never discarded without --force:
+the current worktree refuses to start, another dirty worktree is skipped.
+
+Usage:
+  hard-reset-all-branches.py [--dry-run] [--force]
+
+Options:
+  --dry-run    Show what would be reset and what it would drop, change nothing
+  --force      Also discard uncommitted changes to tracked files
+  --help       Show help
+
+Env:
+  DRY_RUN=true Same as --dry-run (used by the shell -dr wrapper)
+"""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
+
+from branchsync import in_progress
+from gitutils import (
+    current_branch,
+    fetch_remotes,
+    for_each_ref,
+    has_tracked_changes,
+    local_branches,
+    skip_git_hooks,
+    worktree_branch_map,
+)
+from utils import (
+    add_bool_flag,
+    build_parser,
+    dry_run_complete,
+    env_bool,
+    heading,
+    info,
+    log,
+    require_binary,
+    run,
+    run_cli,
+    run_output,
+    success,
+    warning,
+)
+
+__version__ = "1.0.0"
+
+
+def origin_names(cwd: Path) -> set[str]:
+    """Branch names under ``refs/remotes/origin/``, minus the ``HEAD`` symref."""
+    return {
+        branch
+        for branch, symref in for_each_ref(
+            "refs/remotes/origin/", "refname:lstrip=3", "symref", cwd=cwd
+        )
+        if not symref
+    }
+
+
+def divergence(branch: str, cwd: Path) -> tuple[int, int]:
+    """``(local-only commits, origin-only commits)`` between ``branch`` and origin.
+
+    Full refs throughout, so a tag named like the branch cannot be picked instead.
+    """
+    counts = run_output(
+        [
+            "git",
+            "rev-list",
+            "--left-right",
+            "--count",
+            f"refs/heads/{branch}...refs/remotes/origin/{branch}",
+        ],
+        cwd=cwd,
+    ).split()
+    return int(counts[0]), int(counts[1])
+
+
+def describe(ahead: int, behind: int) -> str:
+    parts = []
+    if ahead:
+        parts.append(f"drops {ahead} local commit(s)")
+    if behind:
+        parts.append(f"picks up {behind} from origin")
+    return ", ".join(parts)
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = build_parser(
+        prog="hard-reset-all-branches",
+        description="💣 Check out every local branch and hard reset it to origin/<branch>.",
+    )
+    add_bool_flag(
+        parser,
+        "--dry-run",
+        default=env_bool("DRY_RUN", True),
+        help="Show what would be reset and what it would drop, change nothing",
+    )
+    add_bool_flag(
+        parser,
+        "--force",
+        help="Also discard uncommitted changes to tracked files",
+    )
+    args = parser.parse_args(argv)
+
+    require_binary("git")
+    skip_git_hooks()
+
+    heading("💣  hard-reset-all-branches", dry_run=args.dry_run)
+
+    if run_output(["git", "rev-parse", "--is-inside-work-tree"], check=False) != "true":
+        warning("❌ Not inside a git working tree.")
+        return 1
+    root = Path(run_output(["git", "rev-parse", "--show-toplevel"]))
+
+    original = current_branch(root)
+    if not original:
+        warning("❌ Detached HEAD — check out a branch first.")
+        return 1
+
+    if in_progress(root):
+        warning("❌ A rebase, merge or similar is in progress here — finish or abort it first.")
+        return 1
+
+    if has_tracked_changes(root) and not args.force:
+        if not args.dry_run:
+            warning("❌ Working tree is dirty. Commit, stash or pass --force to discard. 🧺")
+            return 1
+        warning("⚠️  Working tree is dirty: a real run refuses without --force.")
+
+    # Fetched in a dry run too: the preview is only worth reading if it
+    # compares against what origin holds now. A fetch touches no local branch.
+    fetch_remotes()
+
+    remote = origin_names(root)
+    no_origin: list[str] = []
+    in_sync: list[str] = []
+    targets: list[tuple[str, int, int]] = []
+    for (branch,) in local_branches(cwd=root):
+        if branch not in remote:
+            no_origin.append(branch)
+            continue
+        ahead, behind = divergence(branch, root)
+        if ahead or behind:
+            targets.append((branch, ahead, behind))
+        else:
+            in_sync.append(branch)
+
+    if no_origin:
+        info(f"⏭️  {len(no_origin)} branch(es) have no origin/<branch>, left alone:")
+        for branch in no_origin:
+            info(f"  • 🌿 {branch}")
+
+    if not targets:
+        success(f"✨ All {len(in_sync)} branch(es) with an origin already match it. 🎉")
+        return 0
+
+    # Branches checked out in ANOTHER worktree cannot be checked out here, so
+    # they are reset where they are. The current branch is not among them: it
+    # is checked out (a no-op) and reset like the rest.
+    elsewhere = worktree_branch_map(root)
+    elsewhere.pop(original, None)
+
+    if args.dry_run:
+        warning(f"🌵 {len(targets)} branch(es) would be hard reset to origin:")
+        for branch, ahead, behind in targets:
+            where = f" (in {elsewhere[branch]})" if branch in elsewhere else ""
+            warning(f"  • 💣 {branch}{where} — {describe(ahead, behind)}")
+        dry_run_complete("reset")
+        return 0
+
+    reset: list[str] = []
+    skipped: list[tuple[str, str]] = []
+    failed: list[str] = []
+    checkout = ["git", "checkout", "--quiet", *(["--force"] if args.force else [])]
+
+    for branch, ahead, behind in targets:
+        if pinned := elsewhere.get(branch):
+            path = Path(pinned)
+            if in_progress(path):
+                warning(f"  ⏭️  {branch} — operation in progress in {pinned}, skipping")
+                skipped.append((branch, "operation in progress"))
+                continue
+            # Uncommitted work in another worktree is the user's; only --force
+            # may throw it away.
+            if has_tracked_changes(path) and not args.force:
+                warning(f"  ⏭️  {branch} — worktree is dirty ({pinned}), skipping")
+                skipped.append((branch, "dirty worktree"))
+                continue
+            log(f"💣 Resetting {branch} in its worktree ({pinned})")
+            git, where = ["git", "-C", pinned], f" (in {pinned})"
+        else:
+            info(f"📂 Switching to 🌿 {branch}")
+            if run([*checkout, branch], check=False, capture=True, cwd=root).returncode != 0:
+                warning("  ✗ checkout failed, skipping")
+                failed.append(branch)
+                continue
+            log(f"💣 Resetting {branch} to origin/{branch}")
+            git, where = ["git", "-C", str(root)], ""
+
+        before = run_output([*git, "rev-parse", "--short", "HEAD"])
+        completed = run(
+            [*git, "reset", "--hard", "--quiet", f"refs/remotes/origin/{branch}"],
+            check=False,
+            capture=True,
+        )
+        if completed.returncode != 0:
+            warning(f"  ❌ reset failed: {(completed.stderr or '').strip()}")
+            failed.append(branch)
+            continue
+        success(f"  ✅ {branch} matches origin{where} (was {before}; {describe(ahead, behind)})")
+        reset.append(branch)
+
+    info(f"🔁 Returning to 🌿 {original}")
+    run(["git", "checkout", "--quiet", original], cwd=root)
+
+    print()
+    success("═══ summary ═══")
+    success(f"✅ Reset:    {len(reset)}")
+    if in_sync:
+        success(f"✨ In sync:  {len(in_sync)}")
+    if reset:
+        info("💡 Dropped commits stay reachable for a while: git reflog show <branch>")
+    if skipped:
+        warning(f"⏭️  Skipped:  {len(skipped)}")
+        for branch, reason in skipped:
+            warning(f"  • 🌿 {branch} ({reason})")
+    if failed:
+        warning(f"❌ Failed:   {len(failed)}")
+        for branch in failed:
+            warning(f"  • 💥 {branch}")
+        return 1
+
+    success("🎉 All clean!")
+    return 0
+
+
+if __name__ == "__main__":
+    run_cli(main)