@ctrl-spc/cs 0.7.13 → 0.7.15

package/dist/panel3/checkout.js

@@ -14,7 +14,7 @@
  * two owners of it is how two answers are born.
  */
 import { execFileSync } from 'node:child_process';
-import { existsSync, mkdirSync, readdirSync, statSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, readdirSync, statSync } from 'node:fs';
 import { join } from 'node:path';
 import { configDir, readCodebasePaths } from '../config.js';
 function isDirectory(path) {
@@ -413,6 +413,8 @@ export function commitCardWork(folder,
 // Name the codebase and branch in failures, without exposing a local path.
 describe) {
     try {
+        if (gitOperationInProgress(folder))
+            throw pathFree('A Git operation is still in progress on this card. Use recover_landing to finish the approved recovery before landing.');
         git(folder, ['add', '-A']);
         if (git(folder, ['status', '--porcelain']).length > 0) {
             git(folder, ['commit', '--no-verify', '-m', 'Work from this card']);
@@ -447,28 +449,118 @@ export function mergeIntoBase(source, branch, base, codebaseName) {
        The worktree holding the base may be the person's own checkout, and the
        step below would abort on failure. So a conflicted merge already sitting
        there stops this before anything is attempted. */
-    if (existsSync(join(holder, '.git', 'MERGE_HEAD')) || existsSync(join(holder, 'MERGE_HEAD'))) {
-        throw pathFree(`A merge is already in progress in the copy of ${codebaseName} holding ${base} on this `
+    let inProgress;
+    try {
+        inProgress = gitOperationInProgress(holder);
+    }
+    catch {
+        throw pathFree(`Could not inspect ${codebaseName}'s ${base} on this machine. Nothing was merged; check that working copy before retrying.`);
+    }
+    if (inProgress) {
+        throw pathFree(`A Git operation is already in progress in the copy of ${codebaseName} holding ${base} on this `
             + `machine. Nothing was done, and this card's work is still on ${branch}.`);
     }
     try {
         git(holder, ['merge', '--no-edit', branch]);
     }
     catch {
+        const conflicts = git(holder, ['diff', '--name-only', '--diff-filter=U']).length > 0;
         /* ITS OWN TRY, SO A FAILED ABORT CANNOT REPLACE THE COMPOSED FAILURE with
            git's own text, which names a folder. */
+        if (gitOk(holder, ['rev-parse', '--verify', 'MERGE_HEAD'])) {
+            try {
+                git(holder, ['merge', '--abort']);
+            }
+            catch {
+                throw pathFree(`The merge in ${codebaseName} could not be rolled back. ${base} needs recovery before retrying; this card's branch is preserved.`);
+            }
+        }
+        throw Object.assign(pathFree(`This card's work will not go back onto ${base} in ${codebaseName} cleanly. Nothing was `
+            + `merged, ${base} is where it was, and the work is still on ${branch}.`), { mergeConflicts: conflicts });
+    }
+}
+function gitOperationInProgress(folder) {
+    return ['MERGE_HEAD', 'CHERRY_PICK_HEAD', 'REVERT_HEAD', 'rebase-merge', 'rebase-apply', 'sequencer']
+        .some(name => existsSync(git(folder, ['rev-parse', '--path-format=absolute', '--git-path', name])));
+}
+const reconciliationMessage = (card) => `CTRL+SPC: reconcile ${card.branch} with ${card.base}`;
+/** Git owns the durable recovery state. Its merge message identifies our merge;
+ * a user's in-progress operation is never continued or aborted by recovery. */
+export function ownsReconciliation(card) {
+    if (!gitOk(card.folder, ['rev-parse', '--verify', 'MERGE_HEAD']))
+        return false;
+    try {
+        const message = git(card.folder, ['rev-parse', '--path-format=absolute', '--git-path', 'MERGE_MSG']);
+        return readFileSync(message, 'utf8').split('\n')[0] === reconciliationMessage(card);
+    }
+    catch {
+        throw pathFree('Could not read this card’s merge recovery state. Its working copy needs recovery on this machine.');
+    }
+}
+function checkCardBranch(card) {
+    if (git(card.folder, ['branch', '--show-current']) !== card.branch || card.branch === card.base) {
+        throw pathFree('The card is no longer on its assigned branch. Restore its working copy before retrying the approved merge.');
+    }
+}
+/** Prepare only the card's working copy. The sandboxed agent resolves ordinary
+ * files; the product keeps ownership of the index, merge state, and base branch. */
+export function prepareCardReconciliation(card) {
+    try {
+        checkCardBranch(card);
+        if (gitOperationInProgress(card.folder)) {
+            if (!ownsReconciliation(card))
+                throw pathFree('Another Git operation is already in progress on this card. It was left untouched.');
+        }
+        else {
+            if (git(card.folder, ['status', '--porcelain']).length > 0) {
+                throw pathFree('The card has uncommitted changes. Preserve and verify them before retrying the approved merge with recover_landing(action="finish").');
+            }
+            try {
+                git(card.folder, ['merge', '--no-commit', '--no-ff', '-m', reconciliationMessage(card), `refs/heads/${card.base}`]);
+            }
+            catch (error) {
+                if (!ownsReconciliation(card))
+                    throw error;
+            }
+        }
+        const conflicts = git(card.folder, ['diff', '--name-only', '--diff-filter=U']);
+        return { conflicts: conflicts ? conflicts.split('\n').length : 0 };
+    }
+    catch (error) {
+        if (error?.pathFree)
+            throw error;
+        throw pathFree(`Could not prepare merge recovery on ${card.branch}. The work remains on its branch; retry recovery on this machine.`);
+    }
+}
+/** Called only after the owner reports verification under the active token. */
+export function finishCardReconciliation(card) {
+    try {
+        checkCardBranch(card);
+        if (!gitOperationInProgress(card.folder))
+            return;
+        if (!ownsReconciliation(card))
+            throw pathFree('Another Git operation is already in progress on this card. It was left untouched.');
+        // Stage resolved edits, including deletions. Refuse remaining conflict
+        // markers before committing, even though staging clears Git's U entries.
+        git(card.folder, ['add', '-A']);
         try {
-            git(holder, ['merge', '--abort']);
+            git(card.folder, ['diff', '--cached', '--check']);
+        }
+        catch {
+            throw pathFree('The resolution still contains conflict markers or whitespace errors. Fix the files, verify the result, and retry recover_landing(action="finish"). Nothing was merged onto the base.');
         }
-        catch { /* nothing to abort */ }
-        throw pathFree(`This card's work will not go back onto ${base} in ${codebaseName} cleanly. Nothing was `
-            + `merged, ${base} is where it was, and the work is still on ${branch}.`);
+        git(card.folder, ['commit', '--no-edit']);
+    }
+    catch (error) {
+        if (error?.pathFree)
+            throw error;
+        throw pathFree(`Could not finish merge recovery on ${card.branch}. The resolution is preserved; retry recovery on this machine.`);
     }
 }
 export function settleCardWorktree(folder) {
     // Completion is not permission to commit. Preserve unfinished Git work,
     // including staged and untracked files, for the person to review or resume.
-    if (git(folder, ['status', '--porcelain']).length > 0)
+    if (gitOperationInProgress(folder) || git(folder, ['status', '--porcelain']).length > 0)
         return false;
     // Only ignored build/dependency files can remain in a clean copy.
     removeWorktree(folder);

package/dist/panel3/prompt.js

@@ -380,6 +380,9 @@ const LANDING_LINES = {
         'The product writes the question and both answers, and it performs the merge itself if they',
         'choose to put the work back. Landing is the product\'s job and never yours: never merge and',
         'never push.',
+        'If that approved merge needs recovery, call recover_landing(action="prepare"). Resolve and verify',
+        'the files, write_report(work_complete=true), then recover_landing(action="finish"). Approval persists;',
+        'do not ask again or request broader Git permissions. The product handles the Git updates.',
     ],
     branch: [
         'Finished work in this codebase stays on its branch. Nothing is pushed and nothing is merged.',
@@ -862,7 +865,18 @@ export const landingOutcomeContext = (landing) => {
             ...head,
             `They chose to put this work back, and the product has merged ${landing.branch} onto `
                 + `${landing.base} on this machine. It is done and it is not yours to do.`,
-            'Say so plainly in your reply, name the branch it went onto, and finish the card.',
+            'Record completion with write_report(work_complete=true), then say so plainly in your reply, name the branch it went onto, and finish the card.',
+        ];
+    }
+    if (landing.outcome === 'reconciling') {
+        return [
+            ...head,
+            `The merge is already approved. Nothing has landed onto ${landing.base} yet.`,
+            `The product brought ${landing.base} into this card's branch ${landing.branch} for recovery; ${landing.conflicts} files are marked as conflicted.`,
+            'Resolve the files in your current working copy, preserve both the assignment and current base changes, and verify the combined result.',
+            'Use read-only Git commands to inspect it. The product owns Git metadata: do not stage, commit, merge or rebase yourself, and do not ask for wider filesystem access.',
+            'After verification, call write_report(work_complete=true), then recover_landing(action="finish"). If the base advances and new conflicts appear, resolve and verify again.',
+            'After a restart, recover_landing(action="prepare") resumes the same recovery without discarding your edits. Do not ask for the same merge approval again.',
         ];
     }
     if (landing.outcome === 'leave') {
@@ -883,13 +897,7 @@ export const landingOutcomeContext = (landing) => {
             'offer leaves it with them.',
         ];
     }
-    /* ═══ IT DOES NOT SAY "DO NOT FINISH THE CARD", BECAUSE THE AGENT CANNOT
-       OBEY THAT. ═══ The card reads done the moment the owner replies, by
-       `panel3_answer`, and nothing an agent writes changes it. Telling it
-       otherwise would be a rule that can only be broken. What it can do is say
-       plainly that the work did not go back and where it still is, which is what
-       the person needs; C3 replaces this relay with a question, and a question is
-       what keeps the card open. */
+    // A non-conflict refusal still needs a truthful outcome and a concrete next action.
     return [
         ...head,
         'They chose to put this work back and the product could not do it:',