@gitgov/core 2.3.0 → 2.4.0

package/dist/src/fs.js

@@ -382,10 +382,10 @@ var SessionManager = class {
 // src/session_store/fs/fs_session_store.ts
 var FsSessionStore = class {
   sessionPath;
-  actorsPath;
+  keysPath;
   constructor(projectRootPath) {
     this.sessionPath = path9.join(projectRootPath, ".gitgov", ".session.json");
-    this.actorsPath = path9.join(projectRootPath, ".gitgov", "actors");
+    this.keysPath = path9.join(projectRootPath, ".gitgov", "keys");
   }
   /**
    * Load local session from .gitgov/.session.json
@@ -414,12 +414,12 @@ var FsSessionStore = class {
     await promises.writeFile(this.sessionPath, JSON.stringify(session, null, 2), "utf-8");
   }
   /**
-   * Detect actor from .key files in .gitgov/actors/
+   * Detect actor from .key files in .gitgov/keys/
    *
    * [EARS-C1] Returns actor ID from first .key file
    * [EARS-C2] Returns first .key file alphabetically if multiple exist
    * [EARS-C3] Returns null if no .key files exist
-   * [EARS-C4] Returns null if actors directory doesn't exist
+   * [EARS-C4] Returns null if keys directory doesn't exist
    * [EARS-C5] Ignores non-.key files
    * [EARS-C6] Returns null for empty directory
    *
@@ -427,7 +427,7 @@ var FsSessionStore = class {
    */
   async detectActorFromKeyFiles() {
     try {
-      const files = await promises.readdir(this.actorsPath);
+      const files = await promises.readdir(this.keysPath);
       const keyFiles = files.filter((f) => f.endsWith(".key"));
       const firstKeyFile = keyFiles[0];
       if (!firstKeyFile) {
@@ -457,11 +457,11 @@ var KeyProviderError = class extends Error {
 
 // src/key_provider/fs/fs_key_provider.ts
 var FsKeyProvider = class {
-  actorsDir;
+  keysDir;
   extension;
   fileMode;
   constructor(options) {
-    this.actorsDir = options.actorsDir;
+    this.keysDir = options.keysDir;
     this.extension = options.extension ?? ".key";
     this.fileMode = options.fileMode ?? 384;
   }
@@ -492,14 +492,14 @@ var FsKeyProvider = class {
   }
   /**
    * [EARS-KP03] Stores a private key for an actor.
-   * [EARS-FKP01] Creates actorsDir if not exists.
-   * [EARS-FKP02] Writes key to {actorsDir}/{actorId}.key.
+   * [EARS-FKP01] Creates keysDir if not exists.
+   * [EARS-FKP02] Writes key to {keysDir}/{actorId}.key.
    * [EARS-FKP03] Sets secure file permissions (0600).
    */
   async setPrivateKey(actorId, privateKey) {
     const keyPath = this.getKeyPath(actorId);
     try {
-      await fs.mkdir(this.actorsDir, { recursive: true });
+      await fs.mkdir(this.keysDir, { recursive: true });
       await fs.writeFile(keyPath, privateKey, "utf-8");
       await fs.chmod(keyPath, this.fileMode);
     } catch (error) {
@@ -547,7 +547,7 @@ var FsKeyProvider = class {
    */
   getKeyPath(actorId) {
     const sanitized = this.sanitizeActorId(actorId);
-    return path9.join(this.actorsDir, `${sanitized}${this.extension}`);
+    return path9.join(this.keysDir, `${sanitized}${this.extension}`);
   }
   /**
    * [EARS-FKP04] Sanitizes actorId to prevent directory traversal.
@@ -3519,25 +3519,25 @@ var FsLintModule = class {
     this.projectRoot = dependencies.projectRoot;
     this.lintModule = dependencies.lintModule;
     this.fileSystem = dependencies.fileSystem ?? {
-      readFile: async (path13, encoding) => {
-        return promises.readFile(path13, encoding);
+      readFile: async (path14, encoding) => {
+        return promises.readFile(path14, encoding);
       },
-      writeFile: async (path13, content) => {
-        await promises.writeFile(path13, content, "utf-8");
+      writeFile: async (path14, content) => {
+        await promises.writeFile(path14, content, "utf-8");
       },
-      exists: async (path13) => {
+      exists: async (path14) => {
         try {
-          await promises.access(path13);
+          await promises.access(path14);
           return true;
         } catch {
           return false;
         }
       },
-      unlink: async (path13) => {
-        await promises.unlink(path13);
+      unlink: async (path14) => {
+        await promises.unlink(path14);
       },
-      readdir: async (path13) => {
-        return readdir(path13);
+      readdir: async (path14) => {
+        return readdir(path14);
       }
     };
   }
@@ -4141,6 +4141,7 @@ function getImportMetaUrl() {
 var logger4 = createLogger("[FsProjectInitializer] ");
 var GITGOV_DIRECTORIES = [
   "actors",
+  "keys",
   "cycles",
   "tasks",
   "executions",
@@ -4149,8 +4150,10 @@ var GITGOV_DIRECTORIES = [
 ];
 var FsProjectInitializer = class {
   projectRoot;
-  constructor(projectRoot) {
+  repoRoot;
+  constructor(projectRoot, repoRoot) {
     this.projectRoot = projectRoot;
+    this.repoRoot = repoRoot ?? projectRoot;
   }
   // ==================== IProjectInitializer Interface Methods ====================
   /**
@@ -4309,7 +4312,7 @@ var FsProjectInitializer = class {
    * Copies the @gitgov agent prompt to project root for IDE access.
    */
   async copyAgentPrompt() {
-    const targetPrompt = path9.join(this.projectRoot, "gitgov");
+    const targetPrompt = path9.join(this.repoRoot, "gitgov");
     const potentialSources = [];
     potentialSources.push(
       path9.join(process.cwd(), "src/docs/generated/gitgov_agent.md")
@@ -4352,7 +4355,7 @@ var FsProjectInitializer = class {
    * Sets up .gitignore for GitGovernance files.
    */
   async setupGitIntegration() {
-    const gitignorePath = path9.join(this.projectRoot, ".gitignore");
+    const gitignorePath = path9.join(this.repoRoot, ".gitignore");
     const gitignoreContent = `
 # GitGovernance
 # Ignore entire .gitgov/ directory (state lives in gitgov-state branch)
@@ -5633,6 +5636,25 @@ var ActorIdentityMismatchError = class _ActorIdentityMismatchError extends SyncS
     Object.setPrototypeOf(this, _ActorIdentityMismatchError.prototype);
   }
 };
+var WorktreeSetupError = class _WorktreeSetupError extends SyncStateError {
+  constructor(reason, worktreePath, underlyingError) {
+    super(`Failed to setup worktree at ${worktreePath}: ${reason}`);
+    this.reason = reason;
+    this.worktreePath = worktreePath;
+    this.underlyingError = underlyingError;
+    this.name = "WorktreeSetupError";
+    Object.setPrototypeOf(this, _WorktreeSetupError.prototype);
+  }
+};
+var RebaseAlreadyInProgressError = class _RebaseAlreadyInProgressError extends SyncStateError {
+  constructor() {
+    super(
+      `A rebase is already in progress. Resolve the conflict with 'gitgov sync resolve --reason "..."' before pulling or pushing.`
+    );
+    this.name = "RebaseAlreadyInProgressError";
+    Object.setPrototypeOf(this, _RebaseAlreadyInProgressError.prototype);
+  }
+};
 var UncommittedChangesError = class _UncommittedChangesError extends SyncStateError {
   branch;
   constructor(branchName) {
@@ -5662,7 +5684,7 @@ var SYNC_ROOT_FILES = [
 var SYNC_ALLOWED_EXTENSIONS = [".json"];
 var SYNC_EXCLUDED_PATTERNS = [
   /\.key$/,
-  // Private keys (e.g., actors/*.key)
+  // Private keys (e.g., keys/*.key)
   /\.backup$/,
   // Backup files from lint
   /\.backup-\d+$/,
@@ -6055,6 +6077,14 @@ gitgov
       throw error;
     }
   }
+  /** Returns pending local changes not yet synced (delegates to calculateStateDelta) */
+  async getPendingChanges() {
+    try {
+      return await this.calculateStateDelta("HEAD");
+    } catch {
+      return [];
+    }
+  }
   /**
    * Calculates the file delta in .gitgov/ between the current branch and gitgov-state.
    *
@@ -7571,6 +7601,790 @@ Signed-off-by: ${actorId}`;
   }
 };
 
+// src/sync_state/fs_worktree/fs_worktree_sync_state.types.ts
+var WORKTREE_DIR_NAME = ".gitgov-worktree";
+var DEFAULT_STATE_BRANCH = "gitgov-state";
+var logger7 = createLogger("[WorktreeSyncState] ");
+function shouldSyncFile2(filePath) {
+  const fileName = path9__default.basename(filePath);
+  const ext = path9__default.extname(filePath);
+  if (!SYNC_ALLOWED_EXTENSIONS.includes(ext)) {
+    return false;
+  }
+  for (const pattern of SYNC_EXCLUDED_PATTERNS) {
+    if (pattern.test(fileName)) {
+      return false;
+    }
+  }
+  if (LOCAL_ONLY_FILES.includes(fileName)) {
+    return false;
+  }
+  const normalizedPath = filePath.replace(/\\/g, "/");
+  const parts = normalizedPath.split("/");
+  const gitgovIndex = parts.findIndex((p) => p === ".gitgov");
+  let relativeParts;
+  if (gitgovIndex !== -1) {
+    relativeParts = parts.slice(gitgovIndex + 1);
+  } else {
+    const syncDirIndex = parts.findIndex(
+      (p) => SYNC_DIRECTORIES.includes(p)
+    );
+    if (syncDirIndex !== -1) {
+      relativeParts = parts.slice(syncDirIndex);
+    } else if (SYNC_ROOT_FILES.includes(fileName)) {
+      return true;
+    } else {
+      return false;
+    }
+  }
+  if (relativeParts.length === 1) {
+    return SYNC_ROOT_FILES.includes(relativeParts[0]);
+  } else if (relativeParts.length >= 2) {
+    const dirName = relativeParts[0];
+    return SYNC_DIRECTORIES.includes(dirName);
+  }
+  return false;
+}
+var FsWorktreeSyncStateModule = class {
+  deps;
+  repoRoot;
+  stateBranchName;
+  worktreePath;
+  gitgovPath;
+  constructor(deps, config) {
+    if (!deps.git) throw new Error("GitModule is required for FsWorktreeSyncStateModule");
+    if (!deps.config) throw new Error("ConfigManager is required for FsWorktreeSyncStateModule");
+    if (!deps.identity) throw new Error("IdentityAdapter is required for FsWorktreeSyncStateModule");
+    if (!deps.lint) throw new Error("LintModule is required for FsWorktreeSyncStateModule");
+    if (!deps.indexer) throw new Error("IndexerAdapter is required for FsWorktreeSyncStateModule");
+    if (!config.repoRoot) throw new Error("repoRoot is required");
+    this.deps = deps;
+    this.repoRoot = config.repoRoot;
+    this.stateBranchName = config.stateBranchName ?? DEFAULT_STATE_BRANCH;
+    this.worktreePath = config.worktreePath ?? path9__default.join(this.repoRoot, WORKTREE_DIR_NAME);
+    this.gitgovPath = path9__default.join(this.worktreePath, ".gitgov");
+  }
+  // ═══════════════════════════════════════════════
+  // Section A: Worktree Management (WTSYNC-A1..A6)
+  // ═══════════════════════════════════════════════
+  /** [WTSYNC-A4] Returns the worktree path */
+  getWorktreePath() {
+    return this.worktreePath;
+  }
+  /** [WTSYNC-A1..A6] Ensures worktree exists and is healthy */
+  async ensureWorktree() {
+    const health = await this.checkWorktreeHealth();
+    if (health.healthy) {
+      logger7.debug("Worktree is healthy");
+      return;
+    }
+    if (health.exists && !health.healthy) {
+      logger7.warn(`Worktree corrupted: ${health.error}. Recreating...`);
+      await this.removeWorktree();
+    }
+    await this.ensureStateBranch();
+    try {
+      logger7.info(`Creating worktree at ${this.worktreePath}`);
+      await this.execGit(["worktree", "add", this.worktreePath, this.stateBranchName]);
+    } catch (error) {
+      throw new WorktreeSetupError(
+        "Failed to create worktree",
+        this.worktreePath,
+        error instanceof Error ? error : void 0
+      );
+    }
+  }
+  /** Check worktree health */
+  async checkWorktreeHealth() {
+    if (!existsSync(this.worktreePath)) {
+      return { exists: false, healthy: false, path: this.worktreePath };
+    }
+    const gitFile = path9__default.join(this.worktreePath, ".git");
+    if (!existsSync(gitFile)) {
+      return {
+        exists: true,
+        healthy: false,
+        path: this.worktreePath,
+        error: ".git file missing in worktree"
+      };
+    }
+    try {
+      const branch = (await this.execGit(["-C", this.worktreePath, "rev-parse", "--abbrev-ref", "HEAD"])).trim();
+      if (branch !== this.stateBranchName) {
+        return {
+          exists: true,
+          healthy: false,
+          path: this.worktreePath,
+          error: `Wrong branch: ${branch}, expected ${this.stateBranchName}`
+        };
+      }
+    } catch {
+      return {
+        exists: true,
+        healthy: false,
+        path: this.worktreePath,
+        error: "Cannot determine branch"
+      };
+    }
+    return { exists: true, healthy: true, path: this.worktreePath };
+  }
+  /** Remove worktree cleanly */
+  async removeWorktree() {
+    try {
+      await this.execGit(["worktree", "remove", this.worktreePath, "--force"]);
+    } catch {
+      await promises.rm(this.worktreePath, { recursive: true, force: true });
+      await this.execGit(["worktree", "prune"]);
+    }
+  }
+  // ═══════════════════════════════════════════════
+  // Section B: Push Operations (WTSYNC-B1..B14)
+  // ═══════════════════════════════════════════════
+  /** [WTSYNC-B1..B14] Push local state to remote */
+  async pushState(options) {
+    const { actorId, dryRun = false, force = false } = options;
+    const log = (msg) => logger7.debug(`[pushState] ${msg}`);
+    if (await this.isRebaseInProgress()) {
+      throw new RebaseAlreadyInProgressError();
+    }
+    const currentActor = await this.deps.identity.getCurrentActor();
+    if (currentActor.id !== actorId) {
+      throw new ActorIdentityMismatchError(actorId, currentActor.id);
+    }
+    await this.ensureWorktree();
+    const lintReport = await this.deps.lint.lint();
+    if (lintReport.summary.errors > 0) {
+      return {
+        success: false,
+        filesSynced: 0,
+        sourceBranch: options.sourceBranch ?? "current",
+        commitHash: null,
+        commitMessage: null,
+        conflictDetected: false,
+        error: `Lint validation failed: ${lintReport.summary.errors} error(s)`
+      };
+    }
+    const rawDelta = await this.calculateFileDelta();
+    const delta = rawDelta.filter((f) => shouldSyncFile2(f.file));
+    log(`Delta: ${delta.length} syncable files (${rawDelta.length} total)`);
+    if (delta.length === 0) {
+      return {
+        success: true,
+        filesSynced: 0,
+        sourceBranch: options.sourceBranch ?? "current",
+        commitHash: null,
+        commitMessage: null,
+        conflictDetected: false
+      };
+    }
+    if (dryRun) {
+      return {
+        success: true,
+        filesSynced: delta.length,
+        sourceBranch: options.sourceBranch ?? "current",
+        commitHash: null,
+        commitMessage: "[dry-run] Would commit changes",
+        conflictDetected: false
+      };
+    }
+    const stagedCount = await this.stageSyncableFiles(delta, log);
+    const commitMessage = `gitgov: sync state [actor:${actorId}]`;
+    await this.execInWorktree(["commit", "-m", commitMessage]);
+    const commitHash = (await this.execInWorktree(["rev-parse", "HEAD"])).trim();
+    log(`Committed: ${commitHash}`);
+    let implicitPull;
+    let remoteBranchExists = false;
+    if (!force) {
+      try {
+        await this.execGit(["ls-remote", "--exit-code", "origin", this.stateBranchName]);
+        remoteBranchExists = true;
+      } catch {
+      }
+    }
+    if (!force && remoteBranchExists) {
+      try {
+        const beforeHash = commitHash;
+        await this.execInWorktree(["pull", "--rebase", "origin", this.stateBranchName]);
+        const afterHash = (await this.execInWorktree(["rev-parse", "HEAD"])).trim();
+        if (beforeHash !== afterHash) {
+          let filesUpdated = 0;
+          try {
+            const diffOutput = await this.execInWorktree([
+              "diff",
+              "--name-only",
+              beforeHash,
+              afterHash,
+              "--",
+              ".gitgov/"
+            ]);
+            filesUpdated = diffOutput.trim().split("\n").filter(Boolean).length;
+          } catch {
+          }
+          implicitPull = {
+            hasChanges: true,
+            filesUpdated,
+            reindexed: true
+          };
+          await this.reindex();
+          log(`Implicit pull: ${filesUpdated} files updated`);
+        }
+      } catch {
+        const affectedFiles = await this.getConflictedFiles();
+        return {
+          success: false,
+          filesSynced: stagedCount,
+          sourceBranch: options.sourceBranch ?? "current",
+          commitHash,
+          commitMessage,
+          conflictDetected: true,
+          conflictInfo: {
+            type: "rebase_conflict",
+            affectedFiles,
+            message: "Rebase conflict detected during push reconciliation",
+            resolutionSteps: [
+              `Edit conflicted files in ${this.worktreePath}/.gitgov/`,
+              'Run `gitgov sync resolve --reason "..."` to finalize'
+            ]
+          },
+          error: "Rebase conflict during push"
+        };
+      }
+    }
+    await this.execInWorktree(["push", "origin", this.stateBranchName]);
+    log("Pushed to remote");
+    const finalHash = (await this.execInWorktree(["rev-parse", "HEAD"])).trim();
+    const result = {
+      success: true,
+      filesSynced: stagedCount,
+      sourceBranch: options.sourceBranch ?? "current",
+      commitHash: finalHash,
+      commitMessage,
+      conflictDetected: false
+    };
+    if (implicitPull) {
+      result.implicitPull = implicitPull;
+    }
+    return result;
+  }
+  // ═══════════════════════════════════════════════
+  // Section C: Pull Operations (WTSYNC-C1..C8)
+  // ═══════════════════════════════════════════════
+  /** [WTSYNC-C1..C8] Pull remote state */
+  async pullState(options) {
+    const { forceReindex = false, force = false } = options ?? {};
+    const log = (msg) => logger7.debug(`[pullState] ${msg}`);
+    if (await this.isRebaseInProgress()) {
+      throw new RebaseAlreadyInProgressError();
+    }
+    await this.ensureWorktree();
+    if (!force) {
+      const statusRaw = await this.execInWorktree(["status", "--porcelain", "-uall", ".gitgov/"]);
+      const statusLines = statusRaw.split("\n").filter((line) => line.length >= 4);
+      const syncableChanges = statusLines.filter((l) => shouldSyncFile2(l.slice(3)));
+      if (syncableChanges.length > 0) {
+        log(`Auto-committing ${syncableChanges.length} local changes before pull`);
+        for (const line of syncableChanges) {
+          const filePath = line.slice(3);
+          await this.execInWorktree(["add", "-f", "--", filePath]);
+        }
+        await this.execInWorktree(["commit", "-m", "state: Auto-commit local changes before pull"]);
+      }
+    }
+    if (force) {
+      try {
+        await this.execInWorktree(["checkout", ".gitgov/"]);
+        await this.execInWorktree([
+          "clean",
+          "-fd",
+          ...LOCAL_ONLY_FILES.flatMap((f) => ["-e", f]),
+          "-e",
+          "*.key",
+          "-e",
+          "*.backup",
+          "-e",
+          "*.backup-*",
+          "-e",
+          "*.tmp",
+          "-e",
+          "*.bak",
+          ".gitgov/"
+        ]);
+        log("Force: discarded local changes");
+      } catch {
+      }
+    }
+    try {
+      await this.execInWorktree(["fetch", "origin", this.stateBranchName]);
+    } catch {
+      log("Fetch failed (possibly no remote configured)");
+    }
+    const localHash = (await this.execInWorktree(["rev-parse", "HEAD"])).trim();
+    let remoteHash;
+    try {
+      remoteHash = (await this.execInWorktree(["rev-parse", `origin/${this.stateBranchName}`])).trim();
+    } catch {
+      if (forceReindex) {
+        await this.reindex();
+        return { success: true, hasChanges: false, filesUpdated: 0, reindexed: true, conflictDetected: false };
+      }
+      return { success: true, hasChanges: false, filesUpdated: 0, reindexed: false, conflictDetected: false };
+    }
+    if (localHash === remoteHash && !forceReindex) {
+      log("No remote changes");
+      return { success: true, hasChanges: false, filesUpdated: 0, reindexed: false, conflictDetected: false };
+    }
+    if (localHash !== remoteHash) {
+      try {
+        await this.execInWorktree(["pull", "--rebase", "origin", this.stateBranchName]);
+      } catch {
+        const affectedFiles = await this.getConflictedFiles();
+        return {
+          success: false,
+          hasChanges: true,
+          filesUpdated: 0,
+          reindexed: false,
+          conflictDetected: true,
+          conflictInfo: {
+            type: "rebase_conflict",
+            affectedFiles,
+            message: "Rebase conflict detected during pull",
+            resolutionSteps: [
+              `Edit conflicted files in ${this.worktreePath}/.gitgov/`,
+              'Run `gitgov sync resolve --reason "..."` to finalize'
+            ]
+          },
+          error: "Rebase conflict during pull"
+        };
+      }
+    }
+    let filesUpdated = 0;
+    try {
+      const diffOutput = await this.execInWorktree([
+        "diff",
+        "--name-only",
+        localHash,
+        "HEAD",
+        "--",
+        ".gitgov/"
+      ]);
+      filesUpdated = diffOutput.trim().split("\n").filter(Boolean).length;
+    } catch {
+    }
+    await this.reindex();
+    log(`Pulled: ${filesUpdated} files updated`);
+    return {
+      success: true,
+      hasChanges: true,
+      filesUpdated,
+      reindexed: true,
+      conflictDetected: false
+    };
+  }
+  // ═══════════════════════════════════════════════
+  // Section D: Resolve Operations (WTSYNC-D1..D7)
+  // ═══════════════════════════════════════════════
+  /** [WTSYNC-D1..D7] Resolve rebase conflict */
+  async resolveConflict(options) {
+    const { reason, actorId } = options;
+    if (!await this.isRebaseInProgress()) {
+      throw new NoRebaseInProgressError();
+    }
+    const currentActor = await this.deps.identity.getCurrentActor();
+    if (currentActor.id !== actorId) {
+      throw new ActorIdentityMismatchError(actorId, currentActor.id);
+    }
+    const conflictedFiles = await this.getConflictedFiles();
+    const gitgovConflictFiles = conflictedFiles.filter((f) => f.startsWith(".gitgov/")).map((f) => f.replace(/^\.gitgov\//, ""));
+    const markers = await this.checkConflictMarkers(
+      gitgovConflictFiles.length > 0 ? gitgovConflictFiles : conflictedFiles
+    );
+    if (markers.length > 0) {
+      throw new ConflictMarkersPresentError(markers);
+    }
+    await this.resignResolvedRecords(gitgovConflictFiles, actorId, reason);
+    await this.execInWorktree(["add", ".gitgov/"]);
+    await this.execInWorktree(["rebase", "--continue"], { env: { GIT_EDITOR: "true" } });
+    const rebaseCommitHash = (await this.execInWorktree(["rev-parse", "HEAD"])).trim();
+    const resolutionMessage = `gitgov: resolve conflict [actor:${actorId}] reason: ${reason}`;
+    await this.execInWorktree(["commit", "--allow-empty", "-m", resolutionMessage]);
+    const resolutionCommitHash = (await this.execInWorktree(["rev-parse", "HEAD"])).trim();
+    await this.execInWorktree(["push", "origin", this.stateBranchName]);
+    await this.reindex();
+    return {
+      success: true,
+      rebaseCommitHash,
+      resolutionCommitHash,
+      conflictsResolved: conflictedFiles.length,
+      resolvedBy: actorId,
+      reason
+    };
+  }
+  // ═══════════════════════════════════════════════
+  // Section E: Integrity and Audit (WTSYNC-E1..E8)
+  // ═══════════════════════════════════════════════
+  /** [WTSYNC-E8] Get configured state branch name */
+  async getStateBranchName() {
+    return this.stateBranchName;
+  }
+  /** [WTSYNC-A5/A6] Ensure state branch exists */
+  async ensureStateBranch() {
+    try {
+      await this.execGit(["rev-parse", "--verify", this.stateBranchName]);
+      return;
+    } catch {
+    }
+    try {
+      await this.execGit(["rev-parse", "--verify", `origin/${this.stateBranchName}`]);
+      await this.execGit(["branch", this.stateBranchName, `origin/${this.stateBranchName}`]);
+      return;
+    } catch {
+    }
+    try {
+      const emptyTree = (await this.execGit(["hash-object", "-t", "tree", "/dev/null"])).trim();
+      const commitHash = (await this.execGit([
+        "commit-tree",
+        emptyTree,
+        "-m",
+        "gitgov: initialize state branch"
+      ])).trim();
+      await this.execGit(["update-ref", `refs/heads/${this.stateBranchName}`, commitHash]);
+    } catch (error) {
+      throw new StateBranchSetupError(
+        "Failed to create orphan state branch",
+        error instanceof Error ? error : void 0
+      );
+    }
+  }
+  /** Returns pending syncable changes not yet pushed (filters by shouldSyncFile) */
+  async getPendingChanges() {
+    await this.ensureWorktree();
+    const allChanges = await this.calculateFileDelta();
+    return allChanges.filter((f) => shouldSyncFile2(f.file));
+  }
+  /** Calculate delta between source and worktree state branch */
+  async calculateStateDelta(_sourceBranch) {
+    await this.ensureWorktree();
+    try {
+      const diff = await this.execInWorktree([
+        "diff",
+        "--name-status",
+        `origin/${this.stateBranchName}`,
+        "HEAD",
+        "--",
+        ".gitgov/"
+      ]);
+      return this.parseDiffOutput(diff);
+    } catch {
+      return [];
+    }
+  }
+  /** [WTSYNC-E6] Check if rebase is in progress in worktree */
+  async isRebaseInProgress() {
+    try {
+      const gitContent = await promises.readFile(path9__default.join(this.worktreePath, ".git"), "utf8");
+      const gitDir = gitContent.replace("gitdir: ", "").trim();
+      const resolvedGitDir = path9__default.resolve(this.worktreePath, gitDir);
+      return existsSync(path9__default.join(resolvedGitDir, "rebase-merge")) || existsSync(path9__default.join(resolvedGitDir, "rebase-apply"));
+    } catch {
+      return false;
+    }
+  }
+  /** Check for conflict markers in files */
+  async checkConflictMarkers(filePaths) {
+    const filesWithMarkers = [];
+    for (const filePath of filePaths) {
+      const fullPath = path9__default.join(this.gitgovPath, filePath);
+      try {
+        const content = await promises.readFile(fullPath, "utf8");
+        if (content.includes("<<<<<<<") || content.includes(">>>>>>>")) {
+          filesWithMarkers.push(filePath);
+        }
+      } catch {
+      }
+    }
+    return filesWithMarkers;
+  }
+  /** [WTSYNC-E7] Get structured conflict diff */
+  async getConflictDiff(filePaths) {
+    const files = filePaths ?? await this.getConflictedFiles();
+    const diffFiles = [];
+    for (const file of files) {
+      const fullPath = path9__default.join(this.worktreePath, file);
+      try {
+        const content = await promises.readFile(fullPath, "utf8");
+        let localContent = "";
+        let remoteContent = "";
+        let baseContent = null;
+        const lines = content.split("\n");
+        let section = "none";
+        for (const line of lines) {
+          if (line.startsWith("<<<<<<<")) {
+            section = "local";
+          } else if (line.startsWith("|||||||")) {
+            section = "base";
+            baseContent = "";
+          } else if (line.startsWith("=======")) {
+            section = "remote";
+          } else if (line.startsWith(">>>>>>>")) {
+            section = "none";
+          } else {
+            switch (section) {
+              case "local":
+                localContent += line + "\n";
+                break;
+              case "base":
+                baseContent = (baseContent ?? "") + line + "\n";
+                break;
+              case "remote":
+                remoteContent += line + "\n";
+                break;
+            }
+          }
+        }
+        diffFiles.push({
+          filePath: file,
+          localContent,
+          remoteContent,
+          baseContent
+        });
+      } catch {
+      }
+    }
+    return {
+      files: diffFiles,
+      message: `${files.length} file(s) in conflict`,
+      resolutionSteps: [
+        "Edit files to resolve conflicts",
+        'Run `gitgov sync resolve --reason "..."` to finalize'
+      ]
+    };
+  }
+  /** [WTSYNC-E1] Verify resolution integrity */
+  async verifyResolutionIntegrity() {
+    await this.ensureWorktree();
+    const violations = [];
+    try {
+      const logOutput = await this.execInWorktree([
+        "log",
+        "--format=%H|%s|%ai|%an",
+        this.stateBranchName
+      ]);
+      const commits = logOutput.trim().split("\n").filter(Boolean).map((line) => {
+        const parts = line.split("|");
+        return {
+          hash: parts[0] ?? "",
+          subject: parts[1] ?? "",
+          date: parts[2] ?? "",
+          author: parts[3] ?? ""
+        };
+      });
+      for (let i = 0; i < commits.length; i++) {
+        const commit = commits[i];
+        if (commit.subject.includes("rebase") && !commit.subject.includes("resolve")) {
+          const nextCommit = commits[i - 1];
+          if (!nextCommit || !nextCommit.subject.includes("resolve")) {
+            violations.push({
+              rebaseCommitHash: commit.hash,
+              commitMessage: commit.subject,
+              timestamp: commit.date,
+              author: commit.author
+            });
+          }
+        }
+      }
+    } catch {
+    }
+    return violations;
+  }
+  /** [WTSYNC-E1..E5] Audit state */
+  async auditState(options) {
+    const {
+      scope = "all",
+      verifySignatures: verifySignatures2 = true,
+      verifyChecksums = true,
+      verifyExpectedFiles = true,
+      expectedFilesScope,
+      filePaths
+    } = options ?? {};
+    if (expectedFilesScope === "all-commits") {
+      logger7.debug('expectedFilesScope "all-commits" treated as "head" in worktree module');
+    }
+    await this.ensureWorktree();
+    const integrityViolations = await this.verifyResolutionIntegrity();
+    let lintReport;
+    if (verifySignatures2 || verifyChecksums) {
+      lintReport = await this.deps.lint.lint({
+        validateChecksums: verifyChecksums,
+        validateSignatures: verifySignatures2,
+        validateReferences: false,
+        concurrent: true
+      });
+    }
+    if (verifyExpectedFiles) {
+      if (filePaths && filePaths.length > 0) {
+        for (const fp of filePaths) {
+          if (!existsSync(path9__default.join(this.gitgovPath, fp))) {
+            integrityViolations.push({
+              rebaseCommitHash: "",
+              commitMessage: `Missing expected file: ${fp}`,
+              timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+              author: ""
+            });
+          }
+        }
+      } else {
+        const expectedDirs = ["tasks", "cycles", "actors"];
+        for (const dir of expectedDirs) {
+          if (!existsSync(path9__default.join(this.gitgovPath, dir))) {
+            integrityViolations.push({
+              rebaseCommitHash: "",
+              commitMessage: `Missing expected directory: ${dir}`,
+              timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+              author: ""
+            });
+          }
+        }
+        if (!existsSync(path9__default.join(this.gitgovPath, "config.json"))) {
+          integrityViolations.push({
+            rebaseCommitHash: "",
+            commitMessage: "Missing expected file: config.json",
+            timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+            author: ""
+          });
+        }
+      }
+    }
+    let totalCommits = 0;
+    let rebaseCommits = 0;
+    let resolutionCommits = 0;
+    try {
+      const logOutput = await this.execInWorktree(["log", "--oneline", this.stateBranchName]);
+      const lines = logOutput.trim().split("\n").filter(Boolean);
+      totalCommits = lines.length;
+      rebaseCommits = lines.filter((l) => l.includes("rebase")).length;
+      resolutionCommits = lines.filter((l) => l.includes("resolve")).length;
+    } catch {
+    }
+    const passed = integrityViolations.length === 0 && (lintReport ? lintReport.summary.errors === 0 : true);
+    const report = {
+      passed,
+      scope,
+      totalCommits,
+      rebaseCommits,
+      resolutionCommits,
+      integrityViolations,
+      summary: passed ? `Audit passed: ${totalCommits} commits, no violations` : `Audit failed: ${integrityViolations.length} integrity violations`
+    };
+    if (lintReport) {
+      report.lintReport = lintReport;
+    }
+    return report;
+  }
+  // ═══════════════════════════════════════════════
+  // Private Helpers
+  // ═══════════════════════════════════════════════
+  /** Execute git command in repo root (throws on non-zero exit) */
+  async execGit(args, options) {
+    const result = await this.deps.git.exec("git", args, options);
+    if (result.exitCode !== 0) {
+      throw new Error(`Git command failed (exit ${result.exitCode}): git ${args.join(" ")} => ${result.stderr}`);
+    }
+    return result.stdout;
+  }
+  /** Execute git command in worktree context (throws on non-zero exit) */
+  async execInWorktree(args, options) {
+    return this.execGit(["-C", this.worktreePath, ...args], options);
+  }
+  /** Calculate file delta (uncommitted changes in worktree) */
+  async calculateFileDelta() {
+    try {
+      const status = await this.execInWorktree([
+        "status",
+        "--porcelain",
+        "-uall",
+        "--ignored=traditional",
+        ".gitgov/"
+      ]);
+      return this.parseStatusOutput(status);
+    } catch {
+      return [];
+    }
+  }
+  /** [WTSYNC-B4/B9/B10/B11] Stage only syncable files from delta (adds, mods, and deletions) */
+  async stageSyncableFiles(delta, log) {
+    let stagedCount = 0;
+    for (const file of delta) {
+      if (!shouldSyncFile2(file.file)) {
+        log(`Skipped (not syncable): ${file.file}`);
+        continue;
+      }
+      if (file.status === "D") {
+        await this.execInWorktree(["rm", "--", file.file]);
+      } else {
+        await this.execInWorktree(["add", "-f", "--", file.file]);
+      }
+      log(`Staged (${file.status}): ${file.file}`);
+      stagedCount++;
+    }
+    return stagedCount;
+  }
+  /** Get list of conflicted files during rebase */
+  async getConflictedFiles() {
+    try {
+      const status = await this.execInWorktree(["diff", "--name-only", "--diff-filter=U"]);
+      return status.trim().split("\n").filter(Boolean);
+    } catch {
+      return [];
+    }
+  }
+  /** Re-sign records after conflict resolution */
+  async resignResolvedRecords(filePaths, actorId, reason) {
+    for (const filePath of filePaths) {
+      const fullPath = path9__default.join(this.gitgovPath, filePath);
+      try {
+        const content = await promises.readFile(fullPath, "utf8");
+        const record = JSON.parse(content);
+        const signedRecord = await this.deps.identity.signRecord(record, actorId, "resolver", reason);
+        await promises.writeFile(fullPath, JSON.stringify(signedRecord, null, 2));
+      } catch {
+      }
+    }
+  }
+  /** Re-index records from worktree */
+  async reindex() {
+    try {
+      await this.deps.indexer.generateIndex();
+    } catch {
+      logger7.warn("Re-index failed");
+    }
+  }
+  /** Parse git diff --name-status output */
+  parseDiffOutput(diff) {
+    return diff.trim().split("\n").filter(Boolean).map((line) => {
+      const parts = line.split("	");
+      const status = parts[0];
+      const file = parts[1] || parts[0].slice(2);
+      return { status, file };
+    });
+  }
+  /** Parse git status --porcelain output */
+  parseStatusOutput(status) {
+    return status.split("\n").filter((line) => line.length >= 4).map((line) => {
+      const xy = line.slice(0, 2);
+      const file = line.slice(3);
+      let statusChar;
+      if (xy.includes("?") || xy.includes("!")) {
+        statusChar = "A";
+      } else if (xy.includes("D")) {
+        statusChar = "D";
+      } else {
+        statusChar = "M";
+      }
+      return { status: statusChar, file };
+    });
+  }
+};
+
 // src/watcher_state/watcher_state.errors.ts
 var WatcherStateError = class _WatcherStateError extends Error {
   constructor(message) {
@@ -8497,6 +9311,6 @@ var FsRecordProjection = class {
   }
 };
 
-export { DEFAULT_ID_ENCODER, FsAgentRunner, FsConfigStore, FsFileLister, FsKeyProvider, FsLintModule, FsProjectInitializer, FsRecordProjection, FsRecordStore, FsSessionStore, FsSyncStateModule, FsWatcherStateModule, LocalGitModule as GitModule, LocalGitModule, createAgentRunner, createConfigManager, createSessionManager, findGitgovRoot, findProjectRoot, getGitgovPath, isGitgovProject, resetDiscoveryCache };
+export { DEFAULT_ID_ENCODER, FsAgentRunner, FsConfigStore, FsFileLister, FsKeyProvider, FsLintModule, FsProjectInitializer, FsRecordProjection, FsRecordStore, FsSessionStore, FsSyncStateModule, FsWatcherStateModule, FsWorktreeSyncStateModule, LocalGitModule as GitModule, LocalGitModule, createAgentRunner, createConfigManager, createSessionManager, findGitgovRoot, findProjectRoot, getGitgovPath, isGitgovProject, resetDiscoveryCache };
 //# sourceMappingURL=fs.js.map
 //# sourceMappingURL=fs.js.map