@gethmy/harness 1.3.0 → 1.5.0

package/src/worktree.ts

@@ -3,6 +3,7 @@ import { existsSync, readdirSync, rmSync } from "node:fs";
 import { resolve } from "node:path";
 import { log } from "./log.js";
 import { installCommand } from "./pm.js";
+import { containedEnv, GIT_NO_HOOKS } from "./run-containment.js";
 
 const TAG = "worktree";
 
@@ -47,7 +48,7 @@ export function fetchBaseBranch(
   baseBranch: string,
   attempts = 3,
   fetchImpl: (root: string, branch: string) => void = (root, branch) =>
-    execFileSync("git", ["fetch", "origin", branch], {
+    execFileSync("git", [...GIT_NO_HOOKS, "fetch", "origin", branch], {
       cwd: root,
       stdio: "pipe",
     }),
@@ -114,6 +115,102 @@ export function resolveWorktreeStartRef(
   return `origin/${baseBranch}`;
 }
 
+/** The branch a run should actually build on, decided against origin (#930). */
+export interface ContinuationTarget {
+  /** The branch the run must use — possibly the approved-rename sibling. */
+  branchName: string;
+  /** Whether `createWorktree` should continue the branch's own pushed tip. */
+  continueExisting: boolean;
+  /**
+   * The probe's answer for `branchName`: does it exist on origin? Hand it to
+   * `createWorktree` (`opts.branchExistsOnOrigin`) so the same ref is not
+   * ls-remote'd + fetched a second time inside `resolveWorktreeStartRef` on
+   * every continued run. When true, the probe (`fetchExistingBranch`) has
+   * already fetched the ref, so `refs/remotes/origin/<branchName>` resolves
+   * locally — the promise `createWorktree` needs to skip its own probe.
+   */
+  existsOnOrigin: boolean;
+  /** Why — one legible word for the worker's log line. */
+  reason: "requested" | "exists_on_origin" | "approved_rename" | "fresh";
+}
+
+/**
+ * Final continuation decision for an implement run, consulted against origin
+ * right before `createWorktree` (#930).
+ *
+ * The description-based guard (`recordedBranchForCard` in @harmony/shared)
+ * answers from what the card RECORDS — and the record has two known failure
+ * modes, both in the data-loss class: a verify-failed run pushes its branch
+ * but dies before `postSummary` writes the record (or a human deletes the
+ * auto-appended block as routine cleanup), and a review approval renames the
+ * ref on origin while the record write can fail or predate the rewrite. So
+ * this helper asks origin itself:
+ *
+ * - The branch EXISTS on origin → continue it, whatever the description says.
+ *   `git worktree add -B` would reset it and completion would force-push over
+ *   it; the guard's contract is "failing safe costs a redundant continuation;
+ *   failing open costs the user's work" — this makes that hold even when the
+ *   record is gone.
+ * - The branch is GONE but its approved-rename sibling
+ *   (`<approvedPrefix><rest>` for a `<failedPrefix><rest>` name) exists →
+ *   continue the sibling. That is the ref the approval moved the work to;
+ *   rebuilding `<failedPrefix><rest>` from origin/<base> would reimplement
+ *   from scratch and the next approval would force-rename over the reviewed
+ *   branch behind its open PR.
+ * - Neither exists → nothing on origin to lose; pass `continueRequested`
+ *   through unchanged, and `createWorktree` falls back to a fresh branch
+ *   exactly as before.
+ *
+ * The probe's answer travels with the target (`existsOnOrigin`) so the caller
+ * can hand it to `createWorktree` and origin is asked exactly ONCE per run —
+ * without it, a continued run ls-remote'd + fetched the same ref a second time
+ * inside `resolveWorktreeStartRef` (#930 review).
+ *
+ * `branchExistsOnOrigin` is a thunk for the same reason as
+ * `resolveWorktreeStartRef`'s — the decision is unit-testable without git.
+ * Callers pass `fetchExistingBranch`, which fails CLOSED (throws
+ * `WorktreeBaseError` on an unprobeable remote) — a transient network error
+ * must requeue the run, never read as "branch absent" (#637 follow-up).
+ */
+export function resolveContinuationTarget(
+  branchName: string,
+  continueRequested: boolean,
+  failedBranchPrefix: string,
+  approvedBranchPrefix: string,
+  branchExistsOnOrigin: (ref: string) => boolean,
+): ContinuationTarget {
+  if (branchExistsOnOrigin(branchName)) {
+    return {
+      branchName,
+      continueExisting: true,
+      existsOnOrigin: true,
+      reason: continueRequested ? "requested" : "exists_on_origin",
+    };
+  }
+  if (
+    failedBranchPrefix &&
+    approvedBranchPrefix &&
+    branchName.startsWith(failedBranchPrefix)
+  ) {
+    const sibling =
+      approvedBranchPrefix + branchName.slice(failedBranchPrefix.length);
+    if (branchExistsOnOrigin(sibling)) {
+      return {
+        branchName: sibling,
+        continueExisting: true,
+        existsOnOrigin: true,
+        reason: "approved_rename",
+      };
+    }
+  }
+  return {
+    branchName,
+    continueExisting: continueRequested,
+    existsOnOrigin: false,
+    reason: "fresh",
+  };
+}
+
 /**
  * Fetch a branch from origin so `origin/<branchName>` resolves locally, and
  * report whether the branch exists on the remote.
@@ -145,13 +242,20 @@ export function fetchExistingBranch(
   lsRemoteImpl: (root: string, branch: string) => void = (root, branch) =>
     execFileSync(
       "git",
-      ["ls-remote", "--exit-code", "origin", `refs/heads/${branch}`],
+      [
+        ...GIT_NO_HOOKS,
+        "ls-remote",
+        "--exit-code",
+        "origin",
+        `refs/heads/${branch}`,
+      ],
       { cwd: root, stdio: "pipe" },
     ),
   fetchImpl: (root: string, branch: string) => void = (root, branch) =>
     execFileSync(
       "git",
       [
+        ...GIT_NO_HOOKS,
         "fetch",
         "origin",
         `+refs/heads/${branch}:refs/remotes/origin/${branch}`,
@@ -209,6 +313,17 @@ export interface CreateWorktreeOptions {
    * when the branch isn't on origin yet.
    */
   continueExisting?: boolean;
+  /**
+   * Pre-answered origin probe for `branchName`, set when the caller already
+   * ran the probe (`resolveContinuationTarget` → `fetchExistingBranch`, #930):
+   * `createWorktree` then skips its own ls-remote + fetch of the same ref.
+   * `true` carries a promise, not just an answer — the ref must have been
+   * FETCHED so `refs/remotes/origin/<branchName>` resolves locally.
+   * `fetchExistingBranch` does both; a bare ls-remote does not, so never pass
+   * its answer here. Leave undefined and `createWorktree` probes itself
+   * (unchanged behaviour).
+   */
+  branchExistsOnOrigin?: boolean;
 }
 
 /**
@@ -229,7 +344,7 @@ export interface CreateWorktreeOptions {
  */
 export function readWorktreeHead(worktreePath: string): string | null {
   try {
-    return execFileSync("git", ["rev-parse", "HEAD"], {
+    return execFileSync("git", [...GIT_NO_HOOKS, "rev-parse", "HEAD"], {
       cwd: worktreePath,
       encoding: "utf-8",
     }).trim();
@@ -244,9 +359,13 @@ export function createWorktree(
   branchName: string,
   opts: CreateWorktreeOptions = {},
 ): string {
-  const repoRoot = execFileSync("git", ["rev-parse", "--show-toplevel"], {
-    encoding: "utf-8",
-  }).trim();
+  const repoRoot = execFileSync(
+    "git",
+    [...GIT_NO_HOOKS, "rev-parse", "--show-toplevel"],
+    {
+      encoding: "utf-8",
+    },
+  ).trim();
 
   const worktreeDir = resolve(repoRoot, basePath, branchName);
 
@@ -261,10 +380,14 @@ export function createWorktree(
   // `--expire=now` overrides `gc.worktreePruneExpire` (default 3 months) so
   // freshly-orphaned entries are removed immediately.
   try {
-    execFileSync("git", ["worktree", "prune", "--expire=now"], {
-      cwd: repoRoot,
-      stdio: "pipe",
-    });
+    execFileSync(
+      "git",
+      [...GIT_NO_HOOKS, "worktree", "prune", "--expire=now"],
+      {
+        cwd: repoRoot,
+        stdio: "pipe",
+      },
+    );
   } catch {
     // non-fatal
   }
@@ -278,12 +401,17 @@ export function createWorktree(
   // Pick the base ref. Normally a fresh per-attempt branch from
   // origin/<baseBranch>; for a stage continuation, the branch's own pushed tip
   // so a prior stage's commits survive into this run (#561). `-B` resets the
-  // local branch to whichever ref we chose.
+  // local branch to whichever ref we chose. A caller that already probed
+  // origin (resolveContinuationTarget, #930) passes the answer in
+  // `opts.branchExistsOnOrigin` — its probe also fetched the ref, so
+  // `origin/<branchName>` resolves locally and asking origin again would be a
+  // redundant second ls-remote + fetch of the same ref.
   const startRef = resolveWorktreeStartRef(
     baseBranch,
     branchName,
     opts.continueExisting ?? false,
-    () => fetchExistingBranch(repoRoot, branchName),
+    () =>
+      opts.branchExistsOnOrigin ?? fetchExistingBranch(repoRoot, branchName),
   );
 
   log.info(
@@ -293,7 +421,15 @@ export function createWorktree(
   try {
     execFileSync(
       "git",
-      ["worktree", "add", "-B", branchName, worktreeDir, startRef],
+      [
+        ...GIT_NO_HOOKS,
+        "worktree",
+        "add",
+        "-B",
+        branchName,
+        worktreeDir,
+        startRef,
+      ],
       { cwd: repoRoot, stdio: "pipe" },
     );
   } catch (err) {
@@ -310,24 +446,32 @@ export function createWorktree(
     removeWorktreeHoldingBranch(repoRoot, branchName, worktreeDir);
     // Remove any registered worktree at this path (phantom or otherwise).
     try {
-      execFileSync("git", ["worktree", "remove", worktreeDir, "--force"], {
-        cwd: repoRoot,
-        stdio: "pipe",
-      });
+      execFileSync(
+        "git",
+        [...GIT_NO_HOOKS, "worktree", "remove", worktreeDir, "--force"],
+        {
+          cwd: repoRoot,
+          stdio: "pipe",
+        },
+      );
     } catch {
       // best-effort
     }
     // Force-prune any stale worktree admin entries referencing this branch.
     try {
-      execFileSync("git", ["worktree", "prune", "--expire=now"], {
-        cwd: repoRoot,
-        stdio: "pipe",
-      });
+      execFileSync(
+        "git",
+        [...GIT_NO_HOOKS, "worktree", "prune", "--expire=now"],
+        {
+          cwd: repoRoot,
+          stdio: "pipe",
+        },
+      );
     } catch {
       // best-effort
     }
     try {
-      execFileSync("git", ["branch", "-D", branchName], {
+      execFileSync("git", [...GIT_NO_HOOKS, "branch", "-D", branchName], {
         cwd: repoRoot,
         stdio: "pipe",
       });
@@ -336,18 +480,40 @@ export function createWorktree(
     }
     execFileSync(
       "git",
-      ["worktree", "add", "-B", branchName, worktreeDir, startRef],
+      [
+        ...GIT_NO_HOOKS,
+        "worktree",
+        "add",
+        "-B",
+        branchName,
+        worktreeDir,
+        startRef,
+      ],
       { cwd: repoRoot, stdio: "pipe" },
     );
   }
 
-  // Install dependencies in the worktree
+  // Install dependencies in the worktree.
+  //
+  // `ignoreScripts: true` and `containedEnv()` (#988). This runs in the DAEMON
+  // process with no sandbox, and on a retry, resume or steering re-spawn the
+  // worktree is cut from the run's OWN branch tip — so the `package.json` being
+  // installed is one a previous contained run committed. With lifecycle scripts
+  // enabled that is a `postinstall` executing as the operator with the full
+  // environment, which is the same reason `ci-patch.ts` passes `ignoreScripts`
+  // on the repair checkout.
+  //
+  // The cost is real and accepted: a repo whose install genuinely needs a
+  // `postinstall` gets an incomplete `node_modules` here. The catch below
+  // already treats a failed install as survivable, and the verification step
+  // reports what actually breaks.
   log.info(TAG, "Installing dependencies in worktree...");
   try {
-    execSync(installCommand(), {
+    execSync(installCommand(true), {
       cwd: worktreeDir,
       stdio: "pipe",
       timeout: 60_000,
+      env: containedEnv(),
     });
   } catch {
     log.warn(TAG, "Install failed (may be fine if deps are hoisted)");
@@ -382,9 +548,13 @@ export function cleanupWorktree(
   worktreePath: string,
   branchName?: string,
 ): void {
-  const repoRoot = execFileSync("git", ["rev-parse", "--show-toplevel"], {
-    encoding: "utf-8",
-  }).trim();
+  const repoRoot = execFileSync(
+    "git",
+    [...GIT_NO_HOOKS, "rev-parse", "--show-toplevel"],
+    {
+      encoding: "utf-8",
+    },
+  ).trim();
 
   if (existsSync(worktreePath)) {
     // Never escalate on a container: `git worktree remove` would fail on it
@@ -398,10 +568,14 @@ export function cleanupWorktree(
       );
     }
     try {
-      execFileSync("git", ["worktree", "remove", worktreePath, "--force"], {
-        cwd: repoRoot,
-        stdio: "pipe",
-      });
+      execFileSync(
+        "git",
+        [...GIT_NO_HOOKS, "worktree", "remove", worktreePath, "--force"],
+        {
+          cwd: repoRoot,
+          stdio: "pipe",
+        },
+      );
       log.info(TAG, `Removed worktree: ${worktreePath}`);
     } catch (err) {
       log.warn(
@@ -414,10 +588,14 @@ export function cleanupWorktree(
       }
       // Prune stale worktree entries
       try {
-        execFileSync("git", ["worktree", "prune", "--expire=now"], {
-          cwd: repoRoot,
-          stdio: "pipe",
-        });
+        execFileSync(
+          "git",
+          [...GIT_NO_HOOKS, "worktree", "prune", "--expire=now"],
+          {
+            cwd: repoRoot,
+            stdio: "pipe",
+          },
+        );
       } catch {
         // best-effort
       }
@@ -429,10 +607,14 @@ export function cleanupWorktree(
     // "Failed to remove worktree cleanly" warning. Quietly prune any stale
     // registration instead; the branch delete below still runs.
     try {
-      execFileSync("git", ["worktree", "prune", "--expire=now"], {
-        cwd: repoRoot,
-        stdio: "pipe",
-      });
+      execFileSync(
+        "git",
+        [...GIT_NO_HOOKS, "worktree", "prune", "--expire=now"],
+        {
+          cwd: repoRoot,
+          stdio: "pipe",
+        },
+      );
     } catch {
       // best-effort
     }
@@ -441,7 +623,7 @@ export function cleanupWorktree(
   // Delete the branch so it doesn't block future runs
   if (branchName) {
     try {
-      execFileSync("git", ["branch", "-D", branchName], {
+      execFileSync("git", [...GIT_NO_HOOKS, "branch", "-D", branchName], {
         cwd: repoRoot,
         stdio: "pipe",
       });
@@ -478,11 +660,15 @@ export function removeWorktreeHoldingBranch(
 ): string | null {
   let listing: string;
   try {
-    listing = execFileSync("git", ["worktree", "list", "--porcelain"], {
-      cwd: repoRoot,
-      encoding: "utf-8",
-      stdio: ["ignore", "pipe", "pipe"],
-    });
+    listing = execFileSync(
+      "git",
+      [...GIT_NO_HOOKS, "worktree", "list", "--porcelain"],
+      {
+        cwd: repoRoot,
+        encoding: "utf-8",
+        stdio: ["ignore", "pipe", "pipe"],
+      },
+    );
   } catch {
     return null;
   }
@@ -510,10 +696,14 @@ export function removeWorktreeHoldingBranch(
   if (exceptDir && resolve(holderPath) === resolve(exceptDir)) return null;
 
   try {
-    execFileSync("git", ["worktree", "remove", holderPath, "--force"], {
-      cwd: repoRoot,
-      stdio: "pipe",
-    });
+    execFileSync(
+      "git",
+      [...GIT_NO_HOOKS, "worktree", "remove", holderPath, "--force"],
+      {
+        cwd: repoRoot,
+        stdio: "pipe",
+      },
+    );
     log.warn(
       TAG,
       `Evicted worktree ${holderPath} holding branch ${branchName} so it can be reused (#732)`,
@@ -530,10 +720,14 @@ export function removeWorktreeHoldingBranch(
   // Clear the now-orphaned admin entry so `git branch -D` / `worktree add` see a
   // free branch.
   try {
-    execFileSync("git", ["worktree", "prune", "--expire=now"], {
-      cwd: repoRoot,
-      stdio: "pipe",
-    });
+    execFileSync(
+      "git",
+      [...GIT_NO_HOOKS, "worktree", "prune", "--expire=now"],
+      {
+        cwd: repoRoot,
+        stdio: "pipe",
+      },
+    );
   } catch {
     // best-effort
   }
@@ -542,9 +736,13 @@ export function removeWorktreeHoldingBranch(
 
 /** Resolve the main repo root, independent of any worktree cwd. */
 function resolveRepoRoot(): string {
-  return execFileSync("git", ["rev-parse", "--show-toplevel"], {
-    encoding: "utf-8",
-  }).trim();
+  return execFileSync(
+    "git",
+    [...GIT_NO_HOOKS, "rev-parse", "--show-toplevel"],
+    {
+      encoding: "utf-8",
+    },
+  ).trim();
 }
 
 /**
@@ -557,7 +755,13 @@ function localBranchExists(branchName: string, repoRoot: string): boolean {
   try {
     execFileSync(
       "git",
-      ["show-ref", "--verify", "--quiet", `refs/heads/${branchName}`],
+      [
+        ...GIT_NO_HOOKS,
+        "show-ref",
+        "--verify",
+        "--quiet",
+        `refs/heads/${branchName}`,
+      ],
       { cwd: repoRoot, stdio: "ignore" },
     );
     return true;
@@ -596,7 +800,7 @@ export function branchAheadOfItsRemote(
   try {
     const out = execFileSync(
       "git",
-      ["rev-list", branchName, "--not", "--remotes=origin"],
+      [...GIT_NO_HOOKS, "rev-list", branchName, "--not", "--remotes=origin"],
       // stdio pipes stderr (rather than inheriting it) so any git diagnostic is
       // captured with the throw, never leaked to the daemon's own stderr.
       { cwd: repoRoot, encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"] },