@henryqw/pi-pr 6.0.8 → 6.2.0

package/extensions/pr-update-branch.ts

@@ -1,3 +1,7 @@
+import { readFile } from "node:fs/promises";
+import { createHash } from "node:crypto";
+import { join, resolve } from "node:path";
+import { extensionConfigDir, readTextFileBounded, writePrivateTextFileAtomically } from "@henryqw/pi-config-store";
 import { spawnBounded, type Exec, type ExecOptions } from "@henryqw/pi-process";
 import {
 	cloneCurrentPullRequest,
@@ -13,6 +17,8 @@ import {
 	isAncestor,
 	parseNulPaths,
 	parseSingleOutputLine,
+	inspectGitOperation,
+	isRecord,
 	readHead,
 	readRemoteOid,
 	requiredOid,
@@ -27,7 +33,7 @@ type UpdateBranchPhase = "ready" | "conflict-awaiting-user" | "verified" | "publ
 type UpdateBranchState = {
 	phase: UpdateBranchPhase;
 	verifiedHead?: string;
-	conflict?: { paths: string[]; statusBaseline: string };
+	conflict?: { paths: string[]; statusBaseline: string; head: string };
 };
 
 type UpdateBranchResult =
@@ -48,7 +54,59 @@ export type UpdateBranchOptions = {
 
 function sameAuthority(frozen: CurrentPullRequest, fresh: CurrentPullRequest): boolean {
 	return samePullRequestSnapshot(frozen, fresh) && frozen.base.oid === fresh.base.oid &&
-		fresh.lifecycle === "open" && (fresh.conditions.baseUpdateRequired || fresh.conditions.conflict);
+		fresh.lifecycle === "open" && fresh.conditions.conflict;
+}
+
+type RebaseRecovery = { version: 1; phase: "pending" | "verified" | "published"; identity: string;
+	original: string; remote: string; verified: string | null };
+
+function recoveryIdentity(pr: CurrentPullRequest): string {
+	return JSON.stringify([pr.id, pr.number, pr.url.href, pr.host, pr.base.repository, pr.base.ref, pr.base.oid,
+		pr.head.repository, pr.head.ref, pr.target.provenance, pr.target.branch, pr.target.remote,
+		pr.target.ref, pr.target.repository, pr.target.host, pr.target.fetchSource]);
+}
+
+function recoveryPath(cwd: string, pr: CurrentPullRequest, agentDir?: string): string {
+	const key = createHash("sha256").update(`${resolve(cwd)}\n${pr.url.href}`).digest("hex");
+	return join(extensionConfigDir("pi-pr", agentDir), "update-branch", `${key}.json`);
+}
+
+async function readRecovery(path: string, signal?: AbortSignal): Promise<RebaseRecovery | null> {
+	let raw: string;
+	try { raw = await readTextFileBounded(path, 4096, { signal }); }
+	catch (error) {
+		if ((error as NodeJS.ErrnoException).code === "ENOENT") return null;
+		throw error;
+	}
+	let record: unknown;
+	try { record = JSON.parse(raw); } catch { throw new Error(`Invalid branch update recovery is preserved at ${path}`); }
+	if (!isRecord(record) || Object.keys(record).sort().join(",") !== "identity,original,phase,remote,verified,version" ||
+		record.version !== 1 || !["pending", "verified", "published"].includes(record.phase as string) ||
+		typeof record.identity !== "string" || record.identity.length > 2048 ||
+		typeof record.original !== "string" || !/^[0-9a-f]{40}$|^[0-9a-f]{64}$/.test(record.original) ||
+		typeof record.remote !== "string" || !/^[0-9a-f]{40}$|^[0-9a-f]{64}$/.test(record.remote) ||
+		(record.verified !== null && (typeof record.verified !== "string" || !/^[0-9a-f]{40}$|^[0-9a-f]{64}$/.test(record.verified))) ||
+		(record.phase === "pending" && record.verified !== null) ||
+		(record.phase !== "pending" && record.verified === null)) {
+		throw new Error(`Invalid branch update recovery is preserved at ${path}`);
+	}
+	return record as RebaseRecovery;
+}
+
+function assertVerifiedRecovery(record: RebaseRecovery, pr: CurrentPullRequest, path: string): void {
+	if (record.identity !== recoveryIdentity(pr) || record.remote !== record.original ||
+		![record.remote, record.verified].includes(pr.head.oid) || pr.target.remoteOid !== pr.head.oid) {
+		throw new Error(`Branch update recovery authority changed; record preserved at ${path}`);
+	}
+	if (record.phase === "pending") throw new Error(`Branch rebase outcome is unverified; recover manually from ${path}; do not replay it`);
+}
+
+export async function inspectVerifiedRebaseRecovery(pr: CurrentPullRequest, options: { cwd: string; agentDir?: string; signal?: AbortSignal }): Promise<boolean> {
+	const path = recoveryPath(options.cwd, pr, options.agentDir);
+	const record = await readRecovery(path, options.signal);
+	if (!record || record.phase === "published") return false;
+	assertVerifiedRecovery(record, pr, path);
+	return true;
 }
 
 export class PullRequestBranchUpdater {
@@ -60,6 +118,8 @@ export class PullRequestBranchUpdater {
 	private readonly agentDir?: string;
 	private readonly exec: Exec;
 	private readonly load: Load;
+	private recovered = false;
+	private recoveredRecord?: RebaseRecovery;
 
 	constructor(options: UpdateBranchOptions) {
 		if (!options.authority || options.authority.target.provenance !== "configured") {
@@ -85,9 +145,17 @@ export class PullRequestBranchUpdater {
 		return { cwd: this.cwd, signal: this.signal ?? new AbortController().signal };
 	}
 
-	private async freshAuthority(expectedHead: string, requireClean: boolean): Promise<CurrentPullRequest> {
+	private async freshAuthority(expectedHead: string, requireClean: boolean, published = false): Promise<CurrentPullRequest> {
 		const discovery = await this.load(this.pi(), this.context());
-		if (discovery.kind !== "current" || !sameAuthority(this.authority, discovery.pullRequest)) {
+		const comparison = published ? {
+			...this.authority,
+			head: { ...this.authority.head, oid: expectedHead },
+			target: { ...this.authority.target, remoteOid: expectedHead },
+		} : this.authority;
+		if (discovery.kind !== "current" || (published
+			? !samePullRequestSnapshot(comparison, discovery.pullRequest) ||
+				this.authority.base.oid !== discovery.pullRequest.base.oid || discovery.pullRequest.lifecycle !== "open"
+			: !sameAuthority(this.authority, discovery.pullRequest))) {
 			throw new Error("Branch update cancelled: frozen pull request authority changed");
 		}
 		const branch = parseSingleOutputLine((await runChecked(this.exec, "git", ["branch", "--show-current"], this.execOptions())).stdout, "current branch");
@@ -100,39 +168,71 @@ export class PullRequestBranchUpdater {
 		return discovery.pullRequest;
 	}
 
-	private async verifyMerge(originalHead: string): Promise<{ head: string; fastForward: boolean }> {
-		const head = await readHead(this.exec, this.execOptions());
-		const parentsOutput = parseSingleOutputLine((await runChecked(this.exec, "git", ["rev-list", "--parents", "-n", "1", "HEAD"], this.execOptions())).stdout, "merge parents");
-		const commits = parentsOutput.split(" ").map((value, index) => requiredOid(value, index === 0 ? "merged HEAD" : "merge parent"));
-		if (commits[0] !== head) throw new Error("Branch update merge verification returned a different HEAD");
-		let fastForward = false;
-		if (head === this.authority.base.oid && commits.length >= 2 && await isAncestor(this.exec, this.execOptions(), originalHead, head)) {
-			fastForward = true;
-		} else if (commits.length !== 3 || commits[1] !== originalHead || commits[2] !== this.authority.base.oid) {
-			throw new Error("Branch update did not produce the exact configured fast-forward or two-parent merge");
+	private async writeRecovery(phase: RebaseRecovery["phase"], verified: string | null): Promise<void> {
+		const path = recoveryPath(this.cwd, this.authority, this.agentDir);
+		const existing = await readRecovery(path, this.signal);
+		const identity = recoveryIdentity(this.authority);
+		const original = this.recoveredRecord?.original ?? this.authority.head.oid;
+		const remote = this.recoveredRecord?.remote ?? this.authority.target.remoteOid;
+		if (!remote) throw new Error("Branch update remote ref is absent");
+		if (existing && existing.phase !== "published" &&
+			(existing.identity !== identity || existing.original !== original || existing.remote !== remote || phase === "pending")) {
+			throw new Error(`Branch update recovery must be inspected before replacement: ${path}`);
 		}
-		if (await inspectWorktree(this.exec, this.execOptions()) !== "clean") {
-			throw new Error("Branch update merge left a dirty worktree or Git operation in progress");
+		await writePrivateTextFileAtomically(path, `${JSON.stringify({ version: 1, phase, identity,
+			original, remote, verified })}\n`, { signal: this.signal });
+	}
+
+	async recoveryLaunchAction(): Promise<"rebase"> {
+		const path = recoveryPath(this.cwd, this.authority, this.agentDir);
+		const recovery = await readRecovery(path, this.signal);
+		if (!recovery || recovery.phase === "published") return "rebase";
+		assertVerifiedRecovery(recovery, this.authority, path);
+		const head = recovery.verified!;
+		const branch = parseSingleOutputLine((await runChecked(this.exec, "git", ["branch", "--show-current"], this.execOptions())).stdout, "current branch");
+		if (branch !== this.authority.target.branch || await inspectWorktree(this.exec, this.execOptions()) !== "clean" ||
+			await readHead(this.exec, this.execOptions()) !== head ||
+			!(await isAncestor(this.exec, this.execOptions(), this.authority.base.oid, head))) {
+			throw new Error("Branch update recovery does not match a clean verified branch; do not replay the rebase");
+		}
+		this.state.phase = "verified";
+		this.state.verifiedHead = head;
+		this.recoveredRecord = recovery;
+		this.recovered = true;
+		return "rebase"; // The prompted action returns the verified result without replaying Git.
+	}
+
+	private async verifyRebase(): Promise<UpdateBranchResult> {
+		const head = await readHead(this.exec, this.execOptions());
+		if (await inspectWorktree(this.exec, this.execOptions()) !== "clean" ||
+			!(await isAncestor(this.exec, this.execOptions(), this.authority.base.oid, head))) {
+			throw new Error("Rebase did not leave a clean branch based on the frozen base");
 		}
+		await this.writeRecovery("verified", head);
 		this.state.phase = "verified";
 		this.state.verifiedHead = head;
 		delete this.state.conflict;
-		return { head, fastForward };
+		return { kind: "verified", head, fastForward: false };
 	}
 
-	private async captureConflict(): Promise<string[]> {
-		const mergeHead = requiredOid(parseSingleOutputLine((await runChecked(this.exec, "git", ["rev-parse", "--verify", "MERGE_HEAD^{commit}"], this.execOptions())).stdout, "MERGE_HEAD"), "MERGE_HEAD");
-		if (mergeHead !== this.authority.base.oid) throw new Error("Failed merge did not retain the frozen base");
+	private async captureConflict(): Promise<UpdateBranchResult> {
+		if (await inspectGitOperation(this.exec, this.execOptions()) === null) {
+			throw new Error("Failed rebase did not retain an in-progress Git operation");
+		}
 		const paths = parseNulPaths((await runChecked(this.exec, "git", ["diff", "--name-only", "-z", "--diff-filter=U"], this.execOptions())).stdout, "Unmerged paths");
-		if (!paths.length) throw new Error("git merge failed without bounded unmerged paths");
+		if (!paths.length) throw new Error("git rebase failed without bounded unmerged paths");
 		const status = await runChecked(this.exec, "git", ["status", "--porcelain=v2", "-z", "--untracked-files=all"], this.execOptions());
 		this.state.phase = "conflict-awaiting-user";
-		this.state.conflict = { paths, statusBaseline: status.stdout };
-		return paths;
+		this.state.conflict = { paths, statusBaseline: status.stdout, head: await readHead(this.exec, this.execOptions()) };
+		return { kind: "conflict", paths };
 	}
 
-	async merge(): Promise<UpdateBranchResult> {
-		if (this.state.phase !== "ready") throw new Error("Branch update merge action was already consumed");
+	async rebase(): Promise<UpdateBranchResult> {
+		if (this.recovered && this.state.phase === "verified" && this.state.verifiedHead) {
+			this.recovered = false;
+			return { kind: "verified", head: this.state.verifiedHead, fastForward: false };
+		}
+		if (this.state.phase !== "ready") throw new Error("Branch conflict rebase action was already consumed");
 		return await withWorktreeLock(this.cwd, async () => {
 			await this.freshAuthority(this.authority.head.oid, true);
 			const source = await resolveRepositoryFetchSource(this.exec, this.execOptions(), {
@@ -146,47 +246,53 @@ export class PullRequestBranchUpdater {
 			await runChecked(this.exec, "git", ["cat-file", "-e", `${this.authority.base.oid}^{commit}`], this.execOptions());
 			await this.freshAuthority(this.authority.head.oid, true);
 			if (await isAncestor(this.exec, this.execOptions(), this.authority.base.oid, this.authority.head.oid)) {
-				this.state.phase = "verified";
-				this.state.verifiedHead = this.authority.head.oid;
-				return { kind: "verified", head: this.authority.head.oid, fastForward: false };
-			}
-
-			const result = await this.exec("git", ["merge", "--no-edit", this.authority.base.oid], this.execOptions());
-			if (result.killed) throw new Error("git merge was killed; its outcome is unknown");
-			if (result.code === 0) {
-				const verified = await this.verifyMerge(this.authority.head.oid);
-				return { kind: "verified", ...verified };
+				return await this.verifyRebase();
 			}
+			const mergeBase = requiredOid(parseSingleOutputLine((await runChecked(this.exec, "git", [
+				"merge-base", this.authority.base.oid, this.authority.head.oid,
+			], this.execOptions())).stdout, "rebase fork point"), "rebase fork point");
+			const mergeCommits = (await runChecked(this.exec, "git", [
+				"rev-list", "--max-count=1", "--min-parents=2", `${mergeBase}..${this.authority.head.oid}`,
+			], this.execOptions())).stdout.trim();
+			if (mergeCommits) throw new Error("Branch update cannot rebase a branch with merge commits; preserve its resolutions manually");
+			await this.freshAuthority(this.authority.head.oid, true);
+			await this.writeRecovery("pending", null);
+			const result = await this.exec("git", ["-c", "core.editor=true", "-c", "rebase.backend=merge", "rebase", "--no-autostash", "--onto", this.authority.base.oid, mergeBase], this.execOptions());
+			if (result.killed) throw new Error("git rebase was killed; its outcome is unknown");
+			if (result.code === 0) return await this.verifyRebase();
 			try {
-				const paths = await this.captureConflict();
-				return { kind: "conflict", paths: [...paths] };
+				return await this.captureConflict();
 			} catch (error) {
-				const detail = result.stderr.trim() || result.stdout.trim() || `exit code ${result.code}`;
-				throw new Error(`git merge failed: ${detail}; ${error instanceof Error ? error.message : String(error)}`);
+				throw new Error(`git rebase failed: ${result.stderr.trim() || result.stdout.trim() || `exit code ${result.code}`}; ${error instanceof Error ? error.message : String(error)}`);
 			}
 		}, { agentDir: this.agentDir, signal: this.signal });
 	}
 
 	async continue(resolvedPaths: readonly string[]): Promise<UpdateBranchResult> {
 		if (this.state.phase !== "conflict-awaiting-user" || !this.state.conflict) {
-			throw new Error("Branch update has no conflict awaiting continuation");
+			throw new Error("Branch rebase has no conflict awaiting continuation");
 		}
 		const paths = validateResolvedConflictPaths(resolvedPaths, this.state.conflict.paths);
 		return await withWorktreeLock(this.cwd, async () => {
-			await this.freshAuthority(this.authority.head.oid, false);
-			const mergeHead = requiredOid(parseSingleOutputLine((await runChecked(this.exec, "git", ["rev-parse", "--verify", "MERGE_HEAD^{commit}"], this.execOptions())).stdout, "MERGE_HEAD"), "MERGE_HEAD");
-			if (mergeHead !== this.authority.base.oid) throw new Error("Branch update merge context changed");
+			const discovery = await this.load(this.pi(), this.context());
+			if (discovery.kind !== "current" || !sameAuthority(this.authority, discovery.pullRequest)) {
+				throw new Error("Branch rebase authority changed");
+			}
+			const path = parseSingleOutputLine((await runChecked(this.exec, "git", ["rev-parse", "--git-path", "rebase-merge/head-name"], this.execOptions())).stdout, "rebase branch marker");
+			if ((await readFile(resolve(this.cwd, path), "utf8")).trim() !== `refs/heads/${this.authority.target.branch}` ||
+				await readHead(this.exec, this.execOptions()) !== this.state.conflict!.head) {
+				throw new Error("Branch rebase context changed");
+			}
 			const status = await runChecked(this.exec, "git", ["status", "--porcelain=v2", "-z", "--untracked-files=all"], this.execOptions());
 			assertOnlyDeclaredStatusChanged(this.state.conflict!.statusBaseline, status.stdout, paths);
-
 			this.state.phase = "blocked";
-			await runChecked(this.exec, "git", ["add", "--", ...paths], this.execOptions());
+			await runChecked(this.exec, "git", ["--literal-pathspecs", "add", "--", ...paths], this.execOptions());
 			const unmerged = parseNulPaths((await runChecked(this.exec, "git", ["diff", "--name-only", "-z", "--diff-filter=U"], this.execOptions())).stdout, "Unmerged paths");
 			if (unmerged.length) throw new Error(`Conflict paths remain unresolved: ${unmerged.join(", ")}`);
-
-			await runChecked(this.exec, "git", ["-c", "core.editor=true", "merge", "--continue"], this.execOptions());
-			const verified = await this.verifyMerge(this.authority.head.oid);
-			return { kind: "verified", ...verified };
+			const result = await this.exec("git", ["-c", "core.editor=true", "rebase", "--continue"], this.execOptions());
+			if (result.killed) throw new Error("git rebase continuation was killed; its outcome is unknown");
+			if (result.code === 0) return await this.verifyRebase();
+			return await this.captureConflict();
 		}, { agentDir: this.agentDir, signal: this.signal });
 	}
 
@@ -196,26 +302,44 @@ export class PullRequestBranchUpdater {
 		}
 		const head = this.state.verifiedHead;
 		return await withWorktreeLock(this.cwd, async () => {
-			await this.freshAuthority(head, true);
+			const original = this.recoveredRecord?.remote ?? this.authority.target.remoteOid;
+			if (original === null) throw new Error("Current pull request remote ref is absent");
+			const remoteBefore = await readRemoteOid(this.exec, this.execOptions(), this.authority.target.fetchSource, this.authority.target.ref);
+			if (remoteBefore !== original && remoteBefore !== head) throw new Error("Rebase push outcome is unknown; remote ref has an unexpected OID; do not retry");
+			await this.freshAuthority(head, true, remoteBefore === head && head !== original);
 			if (!(await isAncestor(this.exec, this.execOptions(), this.authority.base.oid, head))) {
 				throw new Error("Verified branch no longer contains the frozen base");
 			}
-			const original = this.authority.target.remoteOid;
-			if (original === null) throw new Error("Current pull request remote ref is absent");
-			if (!(await isAncestor(this.exec, this.execOptions(), original, head))) {
-				throw new Error("Published branch would not be a fast-forward of the frozen remote OID");
+			if (remoteBefore === head) {
+				await this.writeRecovery("published", head);
+				this.state.phase = "published";
+				return { kind: "published", head };
 			}
 			await this.freshAuthority(head, true);
 			this.state.phase = "blocked";
-			await runChecked(this.exec, "git", [
-				"push", "--porcelain", `--force-with-lease=refs/heads/${this.authority.target.ref}:${original}`,
-				"--recurse-submodules=no", "--", this.authority.target.fetchSource,
-				`${head}:refs/heads/${this.authority.target.ref}`,
-			], this.execOptions());
-			const remote = await readRemoteOid(this.exec, this.execOptions(), this.authority.target.fetchSource, this.authority.target.ref);
-			if (remote !== head) throw new Error("Published remote ref did not match verified HEAD");
-			this.state.phase = "published";
-			return { kind: "published", head };
+			let pushError: unknown;
+			try {
+				await runChecked(this.exec, "git", [
+					"push", "--porcelain", `--force-with-lease=refs/heads/${this.authority.target.ref}:${original}`,
+					"--recurse-submodules=no", "--", this.authority.target.fetchSource,
+					`${head}:refs/heads/${this.authority.target.ref}`,
+				], this.execOptions());
+			} catch (error) {
+				pushError = error;
+			}
+			let remote: string | null;
+			try {
+				remote = await readRemoteOid(this.exec, this.execOptions(), this.authority.target.fetchSource, this.authority.target.ref);
+			} catch {
+				throw new Error("Rebase push outcome is unknown; do not retry");
+			}
+			if (remote === head) {
+				await this.writeRecovery("published", head);
+				this.state.phase = "published";
+				return { kind: "published", head };
+			}
+			if (remote === original) throw new Error(`Rebase push was not applied${pushError ? ": " + String(pushError) : ""}`);
+			throw new Error("Rebase push outcome is unknown; remote ref has an unexpected OID; do not retry");
 		}, { agentDir: this.agentDir, signal: this.signal });
 	}
 }