@gleapai/kai-bridge 0.11.0 → 0.12.1

package/src/workspace.mjs

@@ -12,19 +12,65 @@
 // another a worktree). Git ops ported from the retired desktop runtime's
 // git-checkout-ops.mjs in spirit: plain `git` CLI, no libraries.
 
-import { execFileSync } from "node:child_process";
+import { execFile, execFileSync } from "node:child_process";
 import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
+import { promisify } from "node:util";
 
 import { seedNodeModules } from "./deps.mjs";
+import { stripRemoteCredentials } from "./repos.mjs";
+
+const execFileAsync = promisify(execFile);
 
 function git(cwd, args, opts = {}) {
   return execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], ...opts }).trim();
 }
 
+/**
+ * `git` that leaves the daemon's event loop alone. Preparing a fresh
+ * worktree takes minutes on a big repo (fetch, checkout, the node_modules
+ * clone); run with execFileSync it froze the whole daemon for that long —
+ * no heartbeat (the device could read "away" after 90 s), no realtime pongs, and
+ * the next turn's start and the user's Stop sat in the queue until it was
+ * done (bridge.log 2026-09-11 and 09-18: a start logged the millisecond a
+ * 60-second node_modules clone for another turn finished). stdin is closed
+ * right away, like execFileSync's "ignore": nothing may wait on a prompt.
+ */
+async function gitAsync(cwd, args, opts = {}) {
+  const pending = execFileAsync("git", args, { cwd, encoding: "utf8", maxBuffer: 64 * 1024 * 1024, ...opts });
+  pending.child.stdin?.end();
+  const { stdout } = await pending;
+  return String(stdout).trim();
+}
+
 /** Network ops only: `gitEnv` is the git-auth.mjs fallback, applied to that one command. */
 const withGitEnv = (gitEnv, opts = {}) => (gitEnv ? { ...opts, env: { ...process.env, ...gitEnv } } : opts);
 
+/**
+ * Nobody can answer a prompt from a background daemon: a credential or
+ * passphrase prompt fails fast instead of hanging the fetch (git-auth.mjs
+ * then offers the Server's credentials) — the same hardening the clone path
+ * has. A user's own GIT_SSH_COMMAND wins.
+ */
+const nonInteractiveGitEnv = (gitEnv) => ({
+  ...process.env,
+  GIT_TERMINAL_PROMPT: "0",
+  GIT_ASKPASS: "echo",
+  SSH_ASKPASS: "echo",
+  GIT_SSH_COMMAND: process.env.GIT_SSH_COMMAND || "ssh -o BatchMode=yes",
+  ...(gitEnv || {}),
+});
+
+/**
+ * The prep fetch had no limit: a black-holed network (captive portal,
+ * dropped VPN) left the session "running" with nothing running. A single
+ * branch of even a large repo arrives well within this.
+ */
+export const FETCH_TIMEOUT_MS = 120_000;
+
+/** The child was killed because it ran past its `timeout` (async and sync forms). */
+const isTimeout = (err) => err?.code === "ETIMEDOUT" || (err?.killed === true && err?.signal === "SIGTERM");
+
 /**
  * A workspace could not be prepared for a reason that has nothing to do
  * with the task — the Server surfaces `code` as a one-click retry instead
@@ -64,38 +110,43 @@ export function isRefLockContention(message) {
   );
 }
 
-const sleepSync = (ms) => {
-  if (ms > 0) Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
-};
+const pause = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 
 /**
  * `git fetch origin <base>` in `primaryPath`, tolerant of ref-lock
- * contention. Returns `{ attempts, stale }` — `stale: true` means every
+ * contention. Resolves `{ attempts, stale }` — `stale: true` means every
  * attempt lost the race and the existing `origin/<base>` (which the
- * competitor just updated) is used instead. Any other fetch failure, or
- * contention with no usable `origin/<base>`, throws a WorkspaceError
- * whose `code` the Server turns into a retry offer.
+ * competitor just updated) is used instead. Any other fetch failure, a
+ * fetch that runs past `timeoutMs`, or contention with no usable
+ * `origin/<base>` rejects with a WorkspaceError whose `code` the Server
+ * turns into a retry offer.
  */
-export function fetchBase(primaryPath, base, { exec = git, attempts = 4, backoffMs = 400, sleep = sleepSync, repo = primaryPath, gitEnv = null } = {}) {
+export async function fetchBase(primaryPath, base, { exec = gitAsync, attempts = 4, backoffMs = 400, sleep = pause, repo = primaryPath, gitEnv = null, timeoutMs = FETCH_TIMEOUT_MS } = {}) {
   let lastError = null;
   for (let attempt = 1; attempt <= attempts; attempt += 1) {
     try {
-      exec(primaryPath, ["fetch", "origin", base, "--quiet"], withGitEnv(gitEnv));
+      await exec(primaryPath, ["fetch", "origin", base, "--quiet"], { timeout: timeoutMs, env: nonInteractiveGitEnv(gitEnv) });
       return { attempts: attempt, stale: false };
     } catch (err) {
+      if (isTimeout(err)) {
+        throw new WorkspaceError(
+          `git fetch origin ${base} in ${repo} did not finish within ${Math.round(timeoutMs / 1000)} s — check this machine's network and Git access, then retry the task.`,
+          { code: "workspace_fetch_failed", repo, cause: err },
+        );
+      }
       const text = `${err?.stderr || ""}\n${err?.message || ""}`;
       if (!isRefLockContention(text)) {
         throw new WorkspaceError(err?.message || String(err), { code: "workspace_fetch_failed", repo, cause: err });
       }
       lastError = err;
-      if (attempt < attempts) sleep(backoffMs * attempt);
+      if (attempt < attempts) await sleep(backoffMs * attempt);
     }
   }
   // Every attempt lost: whoever kept winning has already moved
   // origin/<base> forward, so it is at least as fresh as our fetch
   // would have made it.
   try {
-    exec(primaryPath, ["rev-parse", "--verify", "--quiet", `origin/${base}^{commit}`]);
+    await exec(primaryPath, ["rev-parse", "--verify", "--quiet", `origin/${base}^{commit}`]);
     return { attempts, stale: true };
   } catch {
     throw new WorkspaceError(
@@ -115,6 +166,33 @@ export function worktreePath(kaiHome, repoName, slug) {
   return join(kaiHome, "worktrees", repoName, slug);
 }
 
+/**
+ * The branch a restarted session worktree moves to (see materializeBinding).
+ * It never reuses the merged branch's name: after a squash merge that
+ * branch is still on the remote and rejects the new history as a
+ * non-fast-forward push (or it was deleted), and a second pull request on
+ * a merged PR's branch name is ambiguous. The cloud names its follow-up
+ * branches the same way (`kai-code/<taskId>-<stamp>`).
+ */
+export const restartedBranchName = (sessionBranch, stamp = Date.now().toString(36)) => `${sessionBranch}-${stamp}`;
+
+/**
+ * The branch a resumed session worktree is on: `sessionBranch` or a
+ * restart of it (`<sessionBranch>-<stamp>`). Anything else (a detached
+ * HEAD, a branch the agent switched to, the base branch itself) reads as
+ * `sessionBranch`: the turn pushes `HEAD:<branch>`, and pushing to
+ * whatever happens to be checked out could publish onto the base branch.
+ */
+async function sessionBranchOf(cwd, sessionBranch) {
+  try {
+    const head = await gitAsync(cwd, ["rev-parse", "--abbrev-ref", "HEAD"]);
+    if (head === sessionBranch || head.startsWith(`${sessionBranch}-`)) return head;
+  } catch {
+    /* unreadable: the name the worktree was created with */
+  }
+  return sessionBranch;
+}
+
 /**
  * Copy the primary checkout's local env files (.env, .env.local, …) into a
  * worktree when the worktree doesn't have its own. They're gitignored, so a
@@ -147,13 +225,28 @@ export function copyPrimaryEnvFiles(primaryPath, cwd) {
 }
 
 /**
- * Materialise one repo binding. Returns `{ cwd, mode, branch, base }`.
- * `repo` = `{ name, primaryPath, defaultBranch }`, `binding` = `{ mode, base?, carryUncommitted? }`.
+ * Materialise one repo binding. Resolves `{ cwd, mode, branch, base }`.
+ * `repo` = `{ name, primaryPath, defaultBranch }`, `binding` = `{ mode, base?, carryUncommitted?, mergedBranches? }`.
+ * `onPrepare({ repo, base })` is awaited once a fresh worktree has to be
+ * built, or a merged one restarted — the slow path (fetch, checkout,
+ * node_modules) — before any of it starts; other resumed worktrees and
+ * local checkouts never call it.
+ *
+ * `mergedBranches` (from the Server): this repo's session branches whose
+ * pull request merged with no open one left on them. A resumed worktree
+ * still on one of them restarts in place from a freshly fetched
+ * `origin/<base>` on a new branch (restartedBranchName) and resolves
+ * `restarted: { from }`. Kept going, a follow-up pushed the merged commits
+ * again, and the Server opened a new pull request carrying them (the
+ * merged one no longer counts as open). Uncommitted changes come along
+ * when they fit the new base; when git refuses the switch (they conflict)
+ * the worktree stays as it is and resolves `restartSkipped` with git's
+ * reason: never lose work.
  */
-export function materializeBinding({ kaiHome, repo, binding, sessionId, title, branchPrefix = "kai", fetch = fetchBase, gitEnv = null }) {
+export async function materializeBinding({ kaiHome, repo, binding, sessionId, title, branchPrefix = "kai", fetch = fetchBase, gitEnv = null, onPrepare = null, stamp = undefined }) {
   const mode = binding?.mode === "local" ? "local" : "worktree";
   if (mode === "local") {
-    const branch = git(repo.primaryPath, ["rev-parse", "--abbrev-ref", "HEAD"]);
+    const branch = await gitAsync(repo.primaryPath, ["rev-parse", "--abbrev-ref", "HEAD"]);
     return { cwd: repo.primaryPath, mode, branch, base: branch };
   }
   const base = binding?.base || repo.defaultBranch || "main";
@@ -162,28 +255,40 @@ export function materializeBinding({ kaiHome, repo, binding, sessionId, title, b
   const branch = `${branchPrefix}/${slug}`;
   if (existsSync(dir)) {
     // Resume: the worktree from the previous turn is the session state.
-    return { cwd: dir, mode, branch, base, resumed: true };
+    const current = await sessionBranchOf(dir, branch);
+    if (!binding?.mergedBranches?.includes(current)) return { cwd: dir, mode, branch: current, base, resumed: true };
+    await onPrepare?.({ repo: repo.name, base });
+    const fetched = await fetch(repo.primaryPath, base, { repo: repo.name, gitEnv });
+    const next = restartedBranchName(branch, stamp);
+    try {
+      await gitAsync(dir, ["checkout", "-q", "-b", next, `origin/${base}`]);
+    } catch (err) {
+      const reason = String(err?.stderr || err?.message || err).trim().slice(0, 500);
+      return { cwd: dir, mode, branch: current, base, resumed: true, fetch: fetched, restartSkipped: reason };
+    }
+    return { cwd: dir, mode, branch: next, base, resumed: true, restarted: { from: current }, fetch: fetched };
   }
+  await onPrepare?.({ repo: repo.name, base });
   mkdirSync(dirname(dir), { recursive: true });
-  const fetched = fetch(repo.primaryPath, base, { repo: repo.name, gitEnv });
-  git(repo.primaryPath, ["worktree", "add", "-b", branch, dir, `origin/${base}`]);
+  const fetched = await fetch(repo.primaryPath, base, { repo: repo.name, gitEnv });
+  await gitAsync(repo.primaryPath, ["worktree", "add", "-b", branch, dir, `origin/${base}`]);
   // A fresh worktree has no node_modules; clone the primary checkout's
   // when the lockfiles match so the agent's tests and the preview boot
   // don't each start with a 2-minute install (see deps.mjs).
-  const deps = seedNodeModules({ primaryPath: repo.primaryPath, cwd: dir });
+  const deps = await seedNodeModules({ primaryPath: repo.primaryPath, cwd: dir });
   if (binding?.carryUncommitted) {
     // Tracked changes as a patch; untracked (non-ignored) files copied.
-    const patch = git(repo.primaryPath, ["diff", "HEAD"], { maxBuffer: 64 * 1024 * 1024 });
+    const patch = await gitAsync(repo.primaryPath, ["diff", "HEAD"]);
     if (patch) {
       const patchPath = join(dir, ".kai-carry.patch");
       writeFileSync(patchPath, patch + "\n");
       try {
-        git(dir, ["apply", "--3way", patchPath]);
+        await gitAsync(dir, ["apply", "--3way", patchPath]);
       } finally {
         rmSync(patchPath, { force: true });
       }
     }
-    const untracked = git(repo.primaryPath, ["ls-files", "--others", "--exclude-standard"]).split("\n").filter(Boolean);
+    const untracked = (await gitAsync(repo.primaryPath, ["ls-files", "--others", "--exclude-standard"])).split("\n").filter(Boolean);
     for (const rel of untracked) {
       try {
         mkdirSync(dirname(join(dir, rel)), { recursive: true });
@@ -249,6 +354,26 @@ export function discardChanges(cwd) {
   return { discarded: before };
 }
 
+/**
+ * Does a resumed session worktree already carry an earlier turn's work?
+ * Commits on the session branch beyond `base` (tried as `origin/<base>`
+ * first), or changes a turn left uncommitted (a stopped or failed build).
+ * A plan turn leaves neither. A rehydrated follow-up is told to review
+ * that work before it continues (rehydration.mjs). Never throws.
+ */
+export async function hasPriorWork(cwd, base) {
+  try {
+    if (await gitAsync(cwd, ["status", "--porcelain"])) return true;
+    for (const ref of [base && `origin/${base}`, base].filter(Boolean)) {
+      const commit = await gitAsync(cwd, ["rev-parse", "--verify", "--quiet", `${ref}^{commit}`]).catch(() => "");
+      if (commit) return Number(await gitAsync(cwd, ["rev-list", "--count", `${commit}..HEAD`])) > 0;
+    }
+  } catch {
+    /* not a checkout — nothing to review */
+  }
+  return false;
+}
+
 /** Drop a session's worktrees (after merge/close). */
 export function removeWorktree({ kaiHome, repo, sessionId, title }) {
   const dir = worktreePath(kaiHome, repo.name, sessionSlug(sessionId, title));
@@ -361,7 +486,8 @@ export function commitAndPush(cwd, { branch, message, allowEmpty = false, allowD
       out.committed = true;
     }
     out.commitSha = git(cwd, ["rev-parse", "HEAD"]);
-    out.remote = git(cwd, ["remote", "get-url", "origin"]);
+    // Reported to the Server with the turn result: never with a token in it.
+    out.remote = stripRemoteCredentials(git(cwd, ["remote", "get-url", "origin"]));
     git(cwd, ["push", "-u", "origin", `HEAD:${branch}`], withGitEnv(gitEnv, { timeout: 120_000 }));
     out.pushed = true;
   } catch (err) {