@gethmy/harness 1.1.1 → 1.2.1

package/src/worktree.ts

@@ -1,5 +1,5 @@
 import { execFileSync, execSync } from "node:child_process";
-import { existsSync, rmSync } from "node:fs";
+import { existsSync, readdirSync, rmSync } from "node:fs";
 import { resolve } from "node:path";
 import { log } from "./log.js";
 import { installCommand } from "./pm.js";
@@ -65,15 +65,21 @@ export function fetchBaseBranch(
       );
     }
   }
-  // Prefer git's stderr (captured by `stdio: "pipe"`) over the generic
-  // "Command failed: …" message so connectivity failures are legible (#444).
-  const e = lastErr as { stderr?: unknown } | null;
-  const detail =
-    e?.stderr?.toString?.().trim() ||
-    (lastErr instanceof Error ? lastErr.message : String(lastErr));
   throw new WorktreeBaseError(
     `Could not fetch origin/${baseBranch} after ${attempts} attempts — ` +
-      `refusing to build on a stale base. ${detail}`,
+      `refusing to build on a stale base. ${gitErrorDetail(lastErr)}`,
+  );
+}
+
+/**
+ * Prefer git's stderr (captured by `stdio: "pipe"`) over the generic
+ * "Command failed: …" message so connectivity failures are legible (#444).
+ */
+function gitErrorDetail(err: unknown): string {
+  const e = err as { stderr?: unknown } | null;
+  return (
+    e?.stderr?.toString?.().trim() ||
+    (err instanceof Error ? err.message : String(err))
   );
 }
 
@@ -110,21 +116,89 @@ export function resolveWorktreeStartRef(
 
 /**
  * Fetch a branch from origin so `origin/<branchName>` resolves locally, and
- * report whether the branch exists on the remote. Connectivity has already been
- * proven by the preceding `fetchBaseBranch()`, so a failure here means the ref
- * simply isn't on origin yet (a fresh first-stage run) rather than a network
- * fault — hence we return false instead of throwing.
+ * report whether the branch exists on the remote.
+ *
+ * This decides whether a continuation run keeps its branch or rebuilds from
+ * `origin/<baseBranch>`, and a rebuild ends in a force-push over the branch —
+ * so a wrong "false" here costs the user's pushed work. It therefore fails
+ * CLOSED. It used to swallow every error and return false on the reasoning
+ * that `fetchBaseBranch()` had just proven connectivity; that holds for the
+ * base ref a moment earlier, not for this ref now, so a transient per-ref
+ * failure (rate limit, packfile error, auth blip) read as "branch absent" and
+ * destroyed the branch.
+ *
+ * `ls-remote --exit-code` separates the two cases that must not be conflated:
+ * exit 2 means the ref genuinely is not on origin (a fresh first run — return
+ * false and start a fresh branch), any other failure means the probe itself
+ * failed and we must NOT conclude the branch is absent — throw
+ * `WorktreeBaseError`, which the worker already treats as an infrastructure
+ * failure and requeues without burning the give-up budget.
+ *
+ * The fetch then uses an explicit refspec: on a single-branch clone a bare
+ * `git fetch origin <branch>` succeeds without creating
+ * `refs/remotes/origin/<branch>`, so the start ref would not resolve.
  */
-function fetchExistingBranch(repoRoot: string, branchName: string): boolean {
-  try {
-    execFileSync("git", ["fetch", "origin", branchName], {
-      cwd: repoRoot,
-      stdio: "pipe",
-    });
-    return true;
-  } catch {
-    return false;
+export function fetchExistingBranch(
+  repoRoot: string,
+  branchName: string,
+  attempts = 3,
+  lsRemoteImpl: (root: string, branch: string) => void = (root, branch) =>
+    execFileSync(
+      "git",
+      ["ls-remote", "--exit-code", "origin", `refs/heads/${branch}`],
+      { cwd: root, stdio: "pipe" },
+    ),
+  fetchImpl: (root: string, branch: string) => void = (root, branch) =>
+    execFileSync(
+      "git",
+      [
+        "fetch",
+        "origin",
+        `+refs/heads/${branch}:refs/remotes/origin/${branch}`,
+      ],
+      { cwd: root, stdio: "pipe" },
+    ),
+): boolean {
+  // Probe with the same retry cushion as fetchBaseBranch — a single-shot
+  // probe turned every transient per-ref failure into a WorktreeBaseError,
+  // and because that error burns no budget and arms no cooldown, a
+  // persistent remote fault hot-looped the requeue (#637 follow-up). Exit
+  // code 2 ("no matching refs") is a definitive answer, never retried.
+  let probed = false;
+  let lastErr: unknown;
+  for (let attempt = 1; attempt <= attempts && !probed; attempt++) {
+    try {
+      lsRemoteImpl(repoRoot, branchName);
+      probed = true;
+    } catch (err) {
+      if ((err as { status?: number }).status === 2) return false;
+      lastErr = err;
+      log.warn(
+        TAG,
+        `ls-remote ${branchName} failed (attempt ${attempt}/${attempts})`,
+      );
+    }
   }
+  if (!probed) {
+    throw new WorktreeBaseError(
+      `Could not determine whether ${branchName} exists on origin after ${attempts} attempts: ${gitErrorDetail(lastErr)}. Refusing to rebuild the branch — that would force-push over any pushed work.`,
+    );
+  }
+  for (let attempt = 1; attempt <= attempts; attempt++) {
+    try {
+      fetchImpl(repoRoot, branchName);
+      return true;
+    } catch (err) {
+      lastErr = err;
+      log.warn(
+        TAG,
+        `fetch ${branchName} failed (attempt ${attempt}/${attempts})`,
+      );
+    }
+  }
+  throw new WorktreeBaseError(
+    `${branchName} exists on origin but could not be fetched after ${attempts} attempts: ${gitErrorDetail(lastErr)}. Refusing to rebuild the branch.`,
+  );
 }
 
 export interface CreateWorktreeOptions {
@@ -141,6 +215,29 @@ export interface CreateWorktreeOptions {
  * Create a git worktree for the agent to work in.
  * Returns the absolute path to the new worktree.
  */
+/**
+ * The worktree's current HEAD sha, or null if it cannot be read.
+ *
+ * Recorded right after `createWorktree` so a run can later count only the
+ * commits IT made. On a continued branch (`continueExisting`) the checkout
+ * starts on the branch's own tip, so a range measured from origin/<base>
+ * would be satisfied by the previous attempt's commits and a run that
+ * committed nothing would be scored a success (#915).
+ *
+ * Best-effort by design: a null baseline makes the caller fall back to the
+ * origin/<base> range, which is the behaviour that predates this helper.
+ */
+export function readWorktreeHead(worktreePath: string): string | null {
+  try {
+    return execFileSync("git", ["rev-parse", "HEAD"], {
+      cwd: worktreePath,
+      encoding: "utf-8",
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+
 export function createWorktree(
   basePath: string,
   baseBranch: string,
@@ -259,6 +356,25 @@ export function createWorktree(
   return worktreeDir;
 }
 
+/**
+ * True when `dir` is not itself a git worktree or repository (no `.git`
+ * entry) while a direct child directory carries one — i.e. `dir` is a
+ * CONTAINER of worktrees, like `.harmony-worktrees/agent-attempts/`.
+ * Force-removing such a directory destroys every worktree beneath it, live
+ * runs included (#928), so `cleanupWorktree` refuses it outright instead of
+ * escalating to `rmSync`.
+ */
+function containsForeignWorktrees(dir: string): boolean {
+  if (existsSync(resolve(dir, ".git"))) return false;
+  let children: string[];
+  try {
+    children = readdirSync(dir);
+  } catch {
+    return false;
+  }
+  return children.some((child) => existsSync(resolve(dir, child, ".git")));
+}
+
 /**
  * Remove a git worktree and its branch.
  */
@@ -271,6 +387,16 @@ export function cleanupWorktree(
   }).trim();
 
   if (existsSync(worktreePath)) {
+    // Never escalate on a container: `git worktree remove` would fail on it
+    // (it is not a worktree), and the old rmSync fallback then deleted every
+    // worktree underneath — including live ones with uncommitted work (#928).
+    if (containsForeignWorktrees(worktreePath)) {
+      throw new Error(
+        `Refusing to remove ${worktreePath}: it is not a git worktree itself, ` +
+          `but git worktrees live directly beneath it. Removing it would ` +
+          `destroy them — pass the individual worktree paths instead (#928).`,
+      );
+    }
     try {
       execFileSync("git", ["worktree", "remove", worktreePath, "--force"], {
         cwd: repoRoot,