@gethmy/harness 1.4.0 → 1.6.0

package/src/worktree.ts

@@ -3,6 +3,7 @@ import { existsSync, readdirSync, rmSync } from "node:fs";
 import { resolve } from "node:path";
 import { log } from "./log.js";
 import { installCommand } from "./pm.js";
+import { containedEnv, GIT_NO_HOOKS } from "./run-containment.js";
 
 const TAG = "worktree";
 
@@ -47,7 +48,7 @@ export function fetchBaseBranch(
   baseBranch: string,
   attempts = 3,
   fetchImpl: (root: string, branch: string) => void = (root, branch) =>
-    execFileSync("git", ["fetch", "origin", branch], {
+    execFileSync("git", [...GIT_NO_HOOKS, "fetch", "origin", branch], {
       cwd: root,
       stdio: "pipe",
     }),
@@ -241,13 +242,20 @@ export function fetchExistingBranch(
   lsRemoteImpl: (root: string, branch: string) => void = (root, branch) =>
     execFileSync(
       "git",
-      ["ls-remote", "--exit-code", "origin", `refs/heads/${branch}`],
+      [
+        ...GIT_NO_HOOKS,
+        "ls-remote",
+        "--exit-code",
+        "origin",
+        `refs/heads/${branch}`,
+      ],
       { cwd: root, stdio: "pipe" },
     ),
   fetchImpl: (root: string, branch: string) => void = (root, branch) =>
     execFileSync(
       "git",
       [
+        ...GIT_NO_HOOKS,
         "fetch",
         "origin",
         `+refs/heads/${branch}:refs/remotes/origin/${branch}`,
@@ -336,7 +344,7 @@ export interface CreateWorktreeOptions {
  */
 export function readWorktreeHead(worktreePath: string): string | null {
   try {
-    return execFileSync("git", ["rev-parse", "HEAD"], {
+    return execFileSync("git", [...GIT_NO_HOOKS, "rev-parse", "HEAD"], {
       cwd: worktreePath,
       encoding: "utf-8",
     }).trim();
@@ -351,9 +359,13 @@ export function createWorktree(
   branchName: string,
   opts: CreateWorktreeOptions = {},
 ): string {
-  const repoRoot = execFileSync("git", ["rev-parse", "--show-toplevel"], {
-    encoding: "utf-8",
-  }).trim();
+  const repoRoot = execFileSync(
+    "git",
+    [...GIT_NO_HOOKS, "rev-parse", "--show-toplevel"],
+    {
+      encoding: "utf-8",
+    },
+  ).trim();
 
   const worktreeDir = resolve(repoRoot, basePath, branchName);
 
@@ -368,10 +380,14 @@ export function createWorktree(
   // `--expire=now` overrides `gc.worktreePruneExpire` (default 3 months) so
   // freshly-orphaned entries are removed immediately.
   try {
-    execFileSync("git", ["worktree", "prune", "--expire=now"], {
-      cwd: repoRoot,
-      stdio: "pipe",
-    });
+    execFileSync(
+      "git",
+      [...GIT_NO_HOOKS, "worktree", "prune", "--expire=now"],
+      {
+        cwd: repoRoot,
+        stdio: "pipe",
+      },
+    );
   } catch {
     // non-fatal
   }
@@ -405,7 +421,15 @@ export function createWorktree(
   try {
     execFileSync(
       "git",
-      ["worktree", "add", "-B", branchName, worktreeDir, startRef],
+      [
+        ...GIT_NO_HOOKS,
+        "worktree",
+        "add",
+        "-B",
+        branchName,
+        worktreeDir,
+        startRef,
+      ],
       { cwd: repoRoot, stdio: "pipe" },
     );
   } catch (err) {
@@ -422,24 +446,32 @@ export function createWorktree(
     removeWorktreeHoldingBranch(repoRoot, branchName, worktreeDir);
     // Remove any registered worktree at this path (phantom or otherwise).
     try {
-      execFileSync("git", ["worktree", "remove", worktreeDir, "--force"], {
-        cwd: repoRoot,
-        stdio: "pipe",
-      });
+      execFileSync(
+        "git",
+        [...GIT_NO_HOOKS, "worktree", "remove", worktreeDir, "--force"],
+        {
+          cwd: repoRoot,
+          stdio: "pipe",
+        },
+      );
     } catch {
       // best-effort
     }
     // Force-prune any stale worktree admin entries referencing this branch.
     try {
-      execFileSync("git", ["worktree", "prune", "--expire=now"], {
-        cwd: repoRoot,
-        stdio: "pipe",
-      });
+      execFileSync(
+        "git",
+        [...GIT_NO_HOOKS, "worktree", "prune", "--expire=now"],
+        {
+          cwd: repoRoot,
+          stdio: "pipe",
+        },
+      );
     } catch {
       // best-effort
     }
     try {
-      execFileSync("git", ["branch", "-D", branchName], {
+      execFileSync("git", [...GIT_NO_HOOKS, "branch", "-D", branchName], {
         cwd: repoRoot,
         stdio: "pipe",
       });
@@ -448,18 +480,40 @@ export function createWorktree(
     }
     execFileSync(
       "git",
-      ["worktree", "add", "-B", branchName, worktreeDir, startRef],
+      [
+        ...GIT_NO_HOOKS,
+        "worktree",
+        "add",
+        "-B",
+        branchName,
+        worktreeDir,
+        startRef,
+      ],
       { cwd: repoRoot, stdio: "pipe" },
     );
   }
 
-  // Install dependencies in the worktree
+  // Install dependencies in the worktree.
+  //
+  // `ignoreScripts: true` and `containedEnv()` (#988). This runs in the DAEMON
+  // process with no sandbox, and on a retry, resume or steering re-spawn the
+  // worktree is cut from the run's OWN branch tip — so the `package.json` being
+  // installed is one a previous contained run committed. With lifecycle scripts
+  // enabled that is a `postinstall` executing as the operator with the full
+  // environment, which is the same reason `ci-patch.ts` passes `ignoreScripts`
+  // on the repair checkout.
+  //
+  // The cost is real and accepted: a repo whose install genuinely needs a
+  // `postinstall` gets an incomplete `node_modules` here. The catch below
+  // already treats a failed install as survivable, and the verification step
+  // reports what actually breaks.
   log.info(TAG, "Installing dependencies in worktree...");
   try {
-    execSync(installCommand(), {
+    execSync(installCommand(true), {
       cwd: worktreeDir,
       stdio: "pipe",
       timeout: 60_000,
+      env: containedEnv(),
     });
   } catch {
     log.warn(TAG, "Install failed (may be fine if deps are hoisted)");
@@ -494,9 +548,13 @@ export function cleanupWorktree(
   worktreePath: string,
   branchName?: string,
 ): void {
-  const repoRoot = execFileSync("git", ["rev-parse", "--show-toplevel"], {
-    encoding: "utf-8",
-  }).trim();
+  const repoRoot = execFileSync(
+    "git",
+    [...GIT_NO_HOOKS, "rev-parse", "--show-toplevel"],
+    {
+      encoding: "utf-8",
+    },
+  ).trim();
 
   if (existsSync(worktreePath)) {
     // Never escalate on a container: `git worktree remove` would fail on it
@@ -510,10 +568,14 @@ export function cleanupWorktree(
       );
     }
     try {
-      execFileSync("git", ["worktree", "remove", worktreePath, "--force"], {
-        cwd: repoRoot,
-        stdio: "pipe",
-      });
+      execFileSync(
+        "git",
+        [...GIT_NO_HOOKS, "worktree", "remove", worktreePath, "--force"],
+        {
+          cwd: repoRoot,
+          stdio: "pipe",
+        },
+      );
       log.info(TAG, `Removed worktree: ${worktreePath}`);
     } catch (err) {
       log.warn(
@@ -526,10 +588,14 @@ export function cleanupWorktree(
       }
       // Prune stale worktree entries
       try {
-        execFileSync("git", ["worktree", "prune", "--expire=now"], {
-          cwd: repoRoot,
-          stdio: "pipe",
-        });
+        execFileSync(
+          "git",
+          [...GIT_NO_HOOKS, "worktree", "prune", "--expire=now"],
+          {
+            cwd: repoRoot,
+            stdio: "pipe",
+          },
+        );
       } catch {
         // best-effort
       }
@@ -541,10 +607,14 @@ export function cleanupWorktree(
     // "Failed to remove worktree cleanly" warning. Quietly prune any stale
     // registration instead; the branch delete below still runs.
     try {
-      execFileSync("git", ["worktree", "prune", "--expire=now"], {
-        cwd: repoRoot,
-        stdio: "pipe",
-      });
+      execFileSync(
+        "git",
+        [...GIT_NO_HOOKS, "worktree", "prune", "--expire=now"],
+        {
+          cwd: repoRoot,
+          stdio: "pipe",
+        },
+      );
     } catch {
       // best-effort
     }
@@ -553,7 +623,7 @@ export function cleanupWorktree(
   // Delete the branch so it doesn't block future runs
   if (branchName) {
     try {
-      execFileSync("git", ["branch", "-D", branchName], {
+      execFileSync("git", [...GIT_NO_HOOKS, "branch", "-D", branchName], {
         cwd: repoRoot,
         stdio: "pipe",
       });
@@ -590,11 +660,15 @@ export function removeWorktreeHoldingBranch(
 ): string | null {
   let listing: string;
   try {
-    listing = execFileSync("git", ["worktree", "list", "--porcelain"], {
-      cwd: repoRoot,
-      encoding: "utf-8",
-      stdio: ["ignore", "pipe", "pipe"],
-    });
+    listing = execFileSync(
+      "git",
+      [...GIT_NO_HOOKS, "worktree", "list", "--porcelain"],
+      {
+        cwd: repoRoot,
+        encoding: "utf-8",
+        stdio: ["ignore", "pipe", "pipe"],
+      },
+    );
   } catch {
     return null;
   }
@@ -622,10 +696,14 @@ export function removeWorktreeHoldingBranch(
   if (exceptDir && resolve(holderPath) === resolve(exceptDir)) return null;
 
   try {
-    execFileSync("git", ["worktree", "remove", holderPath, "--force"], {
-      cwd: repoRoot,
-      stdio: "pipe",
-    });
+    execFileSync(
+      "git",
+      [...GIT_NO_HOOKS, "worktree", "remove", holderPath, "--force"],
+      {
+        cwd: repoRoot,
+        stdio: "pipe",
+      },
+    );
     log.warn(
       TAG,
       `Evicted worktree ${holderPath} holding branch ${branchName} so it can be reused (#732)`,
@@ -642,10 +720,14 @@ export function removeWorktreeHoldingBranch(
   // Clear the now-orphaned admin entry so `git branch -D` / `worktree add` see a
   // free branch.
   try {
-    execFileSync("git", ["worktree", "prune", "--expire=now"], {
-      cwd: repoRoot,
-      stdio: "pipe",
-    });
+    execFileSync(
+      "git",
+      [...GIT_NO_HOOKS, "worktree", "prune", "--expire=now"],
+      {
+        cwd: repoRoot,
+        stdio: "pipe",
+      },
+    );
   } catch {
     // best-effort
   }
@@ -654,9 +736,13 @@ export function removeWorktreeHoldingBranch(
 
 /** Resolve the main repo root, independent of any worktree cwd. */
 function resolveRepoRoot(): string {
-  return execFileSync("git", ["rev-parse", "--show-toplevel"], {
-    encoding: "utf-8",
-  }).trim();
+  return execFileSync(
+    "git",
+    [...GIT_NO_HOOKS, "rev-parse", "--show-toplevel"],
+    {
+      encoding: "utf-8",
+    },
+  ).trim();
 }
 
 /**
@@ -669,7 +755,13 @@ function localBranchExists(branchName: string, repoRoot: string): boolean {
   try {
     execFileSync(
       "git",
-      ["show-ref", "--verify", "--quiet", `refs/heads/${branchName}`],
+      [
+        ...GIT_NO_HOOKS,
+        "show-ref",
+        "--verify",
+        "--quiet",
+        `refs/heads/${branchName}`,
+      ],
       { cwd: repoRoot, stdio: "ignore" },
     );
     return true;
@@ -708,7 +800,7 @@ export function branchAheadOfItsRemote(
   try {
     const out = execFileSync(
       "git",
-      ["rev-list", branchName, "--not", "--remotes=origin"],
+      [...GIT_NO_HOOKS, "rev-list", branchName, "--not", "--remotes=origin"],
       // stdio pipes stderr (rather than inheriting it) so any git diagnostic is
       // captured with the throw, never leaked to the daemon's own stderr.
       { cwd: repoRoot, encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"] },