@iowarp/clio-coder 0.3.6 → 0.3.7

package/dist/chunk-KZ2H5X4G.js

@@ -0,0 +1,1026 @@
+import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
+import {
+  describeWriteBoundary,
+  normalizeWriteBoundary,
+  writeBoundaryCovers
+} from "./chunk-KCMKRQX4.js";
+import {
+  atomicWrite
+} from "./chunk-FO5ZOVUY.js";
+import {
+  clioStateDir
+} from "./chunk-BNAZZHFG.js";
+import {
+  init_esm_shims
+} from "./chunk-3R73A4XB.js";
+
+// src/tools/compete-worktrees.ts
+init_esm_shims();
+import { execFileSync as execFileSync2 } from "node:child_process";
+import { randomBytes as randomBytes2 } from "node:crypto";
+import {
+  existsSync as existsSync2,
+  lstatSync,
+  mkdirSync as mkdirSync2,
+  readdirSync,
+  readFileSync,
+  realpathSync as realpathSync2,
+  renameSync,
+  rmdirSync,
+  rmSync as rmSync2,
+  unlinkSync,
+  writeFileSync as writeFileSync2
+} from "node:fs";
+import { hostname } from "node:os";
+import { join as join2, relative as relative2, resolve as resolve2 } from "node:path";
+
+// src/tools/task-worktree.ts
+init_esm_shims();
+import { execFileSync } from "node:child_process";
+import { createHash, randomBytes } from "node:crypto";
+import { existsSync, mkdirSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import { isAbsolute, join, relative, resolve, sep } from "node:path";
+var SAFE_RUN_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u;
+var OWNER_FILE_SUFFIX = ".task-owner.json";
+var COMMIT_IDENTITY = "clio-task";
+function gitBytes(root, args) {
+  return execFileSync("git", ["-C", root, ...args], {
+    stdio: ["ignore", "pipe", "pipe"],
+    timeout: 3e4
+  });
+}
+function git(root, args) {
+  return gitBytes(root, args).toString("utf8").trim();
+}
+function isCanonicalWorktreePathInside(parent, candidate) {
+  let canonicalParent;
+  let canonicalCandidate;
+  try {
+    canonicalParent = realpathSync(parent);
+  } catch {
+    canonicalParent = resolve(parent);
+  }
+  try {
+    canonicalCandidate = realpathSync(candidate);
+  } catch {
+    canonicalCandidate = resolve(candidate);
+  }
+  const rel = relative(canonicalParent, canonicalCandidate);
+  return rel.length > 0 && rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel);
+}
+function commitWorktreePath(path, identity, message) {
+  git(path, ["add", "-A"]);
+  if (git(path, ["status", "--porcelain"]).length === 0) return false;
+  git(path, [
+    "-c",
+    `user.name=${identity}`,
+    "-c",
+    `user.email=${identity}@local`,
+    "commit",
+    "-m",
+    message,
+    "--no-verify"
+  ]);
+  return true;
+}
+function worktreeBranchDiffStat(root, branch) {
+  try {
+    return git(root, ["diff", "--shortstat", `HEAD...${branch}`]) || "no changes";
+  } catch {
+    return "diff unavailable";
+  }
+}
+function protectedPathsChangedByWorktreeBranch(root, branch, protectedPaths) {
+  const canonical = realpathSync(root);
+  const protectedInside = protectedPaths.map((path) => resolve(path)).filter((path) => {
+    const rel = relative(canonical, path);
+    return rel.length > 0 && rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel);
+  });
+  if (protectedInside.length === 0) return [];
+  const changed = git(canonical, ["diff", "--name-only", "-z", "--no-renames", `HEAD...${branch}`]).split("\0").filter((path) => path.length > 0).map((path) => resolve(canonical, path));
+  const blocked = /* @__PURE__ */ new Set();
+  for (const candidate of changed) {
+    for (const protectedPath of protectedInside) {
+      const rel = relative(protectedPath, candidate);
+      if (candidate === protectedPath || rel.length > 0 && rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel)) {
+        blocked.add(protectedPath);
+      }
+    }
+  }
+  return [...blocked].sort();
+}
+function mergeWorktreeBranch(root, branch, identity) {
+  try {
+    git(root, [
+      "-c",
+      `user.name=${identity}`,
+      "-c",
+      `user.email=${identity}@local`,
+      "merge",
+      "--no-edit",
+      "--no-verify",
+      branch
+    ]);
+    return { ok: true };
+  } catch (error) {
+    try {
+      git(root, ["merge", "--abort"]);
+    } catch {
+    }
+    return {
+      ok: false,
+      reason: error instanceof Error ? error.message.split("\n")[0] ?? "merge failed" : String(error)
+    };
+  }
+}
+function validateRunId(runId) {
+  if (!SAFE_RUN_ID.test(runId) || runId === "." || runId === "..")
+    throw new Error(`invalid task worktree run id '${runId}'`);
+}
+function gitCheckoutRoot(cwd) {
+  try {
+    return realpathSync(git(cwd, ["rev-parse", "--show-toplevel"]));
+  } catch {
+    return null;
+  }
+}
+function createTaskWorktree(root, runId, base) {
+  validateRunId(runId);
+  const canonical = realpathSync(root);
+  const resolvedBase = base ?? git(canonical, ["rev-parse", "HEAD"]);
+  const parent = join(canonical, ".clio-coder", "worktrees");
+  const path = join(parent, runId);
+  const branch = `clio/task/${runId}`;
+  mkdirSync(parent, { recursive: true });
+  if (!isCanonicalWorktreePathInside(parent, path))
+    throw new Error(`task worktree path escapes its parent for run ${runId}`);
+  git(canonical, ["worktree", "add", "-b", branch, path, resolvedBase]);
+  const ownerToken = randomBytes(16).toString("hex");
+  writeFileSync(
+    `${path}${OWNER_FILE_SUFFIX}`,
+    `${JSON.stringify({ version: 1, kind: "clio-task-worktree", root: canonical, runId, branch, base: resolvedBase, ownerToken }, null, 2)}
+`,
+    { encoding: "utf8", flag: "wx" }
+  );
+  return { root: canonical, runId, path, branch, base: resolvedBase, ownerToken };
+}
+function assertOwnership(worktree) {
+  const expected = join(worktree.root, ".clio-coder", "worktrees", worktree.runId);
+  if (resolve(worktree.path) !== resolve(expected) || !isCanonicalWorktreePathInside(join(worktree.root, ".clio-coder", "worktrees"), worktree.path)) {
+    throw new Error(`task worktree ${worktree.runId} has an invalid ownership path`);
+  }
+  if (!existsSync(`${worktree.path}${OWNER_FILE_SUFFIX}`))
+    throw new Error(`task worktree ${worktree.runId} has no ownership file`);
+}
+function commitTaskWorktree(worktree, message = `Clio task ${worktree.runId}`) {
+  assertOwnership(worktree);
+  return commitWorktreePath(worktree.path, COMMIT_IDENTITY, message);
+}
+function taskWorktreeDiffHash(worktree) {
+  const bytes = gitBytes(worktree.root, ["diff", `${worktree.base}..${worktree.branch}`]);
+  return createHash("sha256").update(bytes).digest("hex");
+}
+function protectedPathsChangedByTaskBranch(worktree, protectedPaths) {
+  return protectedPathsChangedByWorktreeBranch(worktree.root, worktree.branch, protectedPaths);
+}
+function applyTaskWorktree(input) {
+  assertOwnership(input.worktree);
+  commitTaskWorktree(input.worktree);
+  const receipt = {
+    path: input.worktree.path,
+    branch: input.worktree.branch,
+    diffHash: taskWorktreeDiffHash(input.worktree),
+    apply: input.apply,
+    applied: false
+  };
+  if (input.apply === "preserve") return receipt;
+  const protectedChanges = protectedPathsChangedByTaskBranch(input.worktree, input.protectedPaths ?? []);
+  if (protectedChanges.length > 0) return { ...receipt, reason: "protected_artifact_changed" };
+  const merged = mergeWorktreeBranch(input.worktree.root, input.worktree.branch, COMMIT_IDENTITY);
+  if (!merged.ok) return { ...receipt, reason: "worktree_merge_conflict" };
+  return { ...receipt, applied: true };
+}
+function cleanupTaskWorktree(worktree, deleteBranch) {
+  assertOwnership(worktree);
+  try {
+    git(worktree.root, ["worktree", "remove", "--force", worktree.path]);
+  } catch {
+    if (existsSync(worktree.path)) rmSync(worktree.path, { recursive: true, force: true });
+    git(worktree.root, ["worktree", "prune"]);
+  }
+  if (deleteBranch) git(worktree.root, ["branch", "-D", worktree.branch]);
+  rmSync(`${worktree.path}${OWNER_FILE_SUFFIX}`, { force: true });
+}
+
+// src/tools/compete-worktrees.ts
+var COMPETE_PARENT_SEGMENTS = [".clio-coder", "worktrees"];
+var COMPETE_MANIFEST_FILE = ".clio-coder-compete-owner.json";
+var COMPETE_MANIFEST_KIND = "clio-compete-group";
+var COMPETE_COMMIT_IDENTITY = "clio-compete";
+var SAFE_GROUP = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+var PROCESS_EXIT_GRACE_MS = 750;
+var PROCESS_POLL_MS = 25;
+function git2(root, args) {
+  return execFileSync2("git", ["-C", root, ...args], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+    timeout: 3e4
+  }).trim();
+}
+function errorMessage(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+function processSnapshot(pid) {
+  if (!Number.isSafeInteger(pid) || pid <= 0) return { alive: false, birthToken: null };
+  try {
+    process.kill(pid, 0);
+  } catch (err) {
+    if (err.code !== "EPERM") return { alive: false, birthToken: null };
+  }
+  try {
+    const stat = readFileSync(`/proc/${pid}/stat`, "utf8").trim();
+    const close = stat.lastIndexOf(")");
+    if (close > 0) {
+      const fields = stat.slice(close + 1).trim().split(/\s+/u);
+      if (fields[0] === "Z") return { alive: false, birthToken: fields[19] ?? null };
+      const startTicks = fields[19];
+      if (startTicks !== void 0 && /^\d+$/u.test(startTicks)) {
+        return { alive: true, birthToken: `linux:${startTicks}` };
+      }
+    }
+  } catch {
+  }
+  try {
+    const started = execFileSync2("ps", ["-o", "lstart=", "-p", String(pid)], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 2e3
+    }).trim();
+    if (started.length > 0) return { alive: true, birthToken: `ps:${started}` };
+  } catch {
+  }
+  return { alive: true, birthToken: null };
+}
+function currentProcessLease() {
+  return {
+    host: hostname(),
+    pid: process.pid,
+    birthToken: processSnapshot(process.pid).birthToken
+  };
+}
+function validProcessLease(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+  const lease = value;
+  return typeof lease.host === "string" && lease.host.length > 0 && typeof lease.pid === "number" && Number.isSafeInteger(lease.pid) && lease.pid > 0 && (lease.birthToken === null || typeof lease.birthToken === "string");
+}
+function validRunLease(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+  const lease = value;
+  return typeof lease.runId === "string" && lease.runId.length > 0 && (lease.pid === null || typeof lease.pid === "number" && Number.isSafeInteger(lease.pid) && lease.pid > 0) && (lease.birthToken === null || typeof lease.birthToken === "string") && typeof lease.processGroup === "boolean";
+}
+function ownerIsAlive(owner) {
+  if (owner.host !== hostname()) return true;
+  const snapshot = processSnapshot(owner.pid);
+  if (!snapshot.alive) return false;
+  if (owner.birthToken === null || snapshot.birthToken === null) return true;
+  return owner.birthToken === snapshot.birthToken;
+}
+function waitForProcessExit(pid, birthToken) {
+  const deadline = Date.now() + PROCESS_EXIT_GRACE_MS;
+  const sleeper = new Int32Array(new SharedArrayBuffer(4));
+  while (Date.now() < deadline) {
+    const snapshot = processSnapshot(pid);
+    if (!snapshot.alive || snapshot.birthToken !== birthToken) return true;
+    Atomics.wait(sleeper, 0, 0, PROCESS_POLL_MS);
+  }
+  const finalSnapshot = processSnapshot(pid);
+  return !finalSnapshot.alive || finalSnapshot.birthToken !== birthToken;
+}
+function terminateRunLease(lease) {
+  if (lease.pid === null) return true;
+  const snapshot = processSnapshot(lease.pid);
+  if (!snapshot.alive) return true;
+  if (lease.birthToken === null || snapshot.birthToken === null) return false;
+  if (lease.birthToken !== snapshot.birthToken) return true;
+  const target = lease.processGroup && process.platform !== "win32" ? -lease.pid : lease.pid;
+  try {
+    process.kill(target, "SIGTERM");
+  } catch (err) {
+    if (err.code === "ESRCH") return true;
+    return false;
+  }
+  if (waitForProcessExit(lease.pid, lease.birthToken)) return true;
+  try {
+    process.kill(target, "SIGKILL");
+  } catch (err) {
+    if (err.code === "ESRCH") return true;
+    return false;
+  }
+  return waitForProcessExit(lease.pid, lease.birthToken);
+}
+function validateGroup(group) {
+  if (!SAFE_GROUP.test(group) || group === "." || group === "..") {
+    throw new Error(`invalid compete group '${group}'`);
+  }
+}
+function canonicalRoot(root) {
+  return realpathSync2(root);
+}
+function competeParent(root) {
+  return join2(root, ...COMPETE_PARENT_SEGMENTS);
+}
+function groupDirectory(root, group) {
+  validateGroup(group);
+  return join2(competeParent(root), group);
+}
+function manifestPath(directory) {
+  return join2(directory, COMPETE_MANIFEST_FILE);
+}
+function isPlainDirectory(path) {
+  try {
+    const stat = lstatSync(path);
+    return stat.isDirectory() && !stat.isSymbolicLink();
+  } catch {
+    return false;
+  }
+}
+function isCanonicalDirectoryAt(path) {
+  if (!isPlainDirectory(path)) return false;
+  try {
+    return relative2(realpathSync2(path), resolve2(path)) === "";
+  } catch {
+    return false;
+  }
+}
+function isCanonicalPathInside(parent, candidate) {
+  return isCanonicalWorktreePathInside(parent, candidate);
+}
+function manifestFromUnknown(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
+  const manifest = value;
+  if (manifest.version !== 2 || manifest.kind !== COMPETE_MANIFEST_KIND || typeof manifest.root !== "string" || typeof manifest.group !== "string" || typeof manifest.token !== "string" || manifest.token.length === 0 || manifest.state !== "active" && manifest.state !== "cleanup-ready" && manifest.state !== "winner-preserved" || typeof manifest.createdAt !== "string" || typeof manifest.updatedAt !== "string") {
+    return null;
+  }
+  if (!validProcessLease(manifest.owner) || !Array.isArray(manifest.runs) || !manifest.runs.every(validRunLease) || new Set(manifest.runs.map((run) => run.runId)).size !== manifest.runs.length) {
+    return null;
+  }
+  if (manifest.winnerIndex !== void 0 && (typeof manifest.winnerIndex !== "number" || !Number.isInteger(manifest.winnerIndex) || manifest.winnerIndex < 1)) {
+    return null;
+  }
+  return manifest;
+}
+function readManifest(root, group) {
+  const canonical = canonicalRoot(root);
+  const directory = groupDirectory(canonical, group);
+  if (!isCanonicalDirectoryAt(directory)) return null;
+  try {
+    const parsed = JSON.parse(readFileSync(manifestPath(directory), "utf8"));
+    const manifest = manifestFromUnknown(parsed);
+    if (manifest === null || manifest.root !== canonical || manifest.group !== group) return null;
+    return manifest;
+  } catch {
+    return null;
+  }
+}
+function ownershipFromManifest(manifest) {
+  return {
+    root: manifest.root,
+    group: manifest.group,
+    directory: groupDirectory(manifest.root, manifest.group),
+    token: manifest.token,
+    state: manifest.state,
+    ...manifest.winnerIndex !== void 0 ? { winnerIndex: manifest.winnerIndex } : {}
+  };
+}
+function assertOwnership2(ownership) {
+  const manifest = readManifest(ownership.root, ownership.group);
+  if (manifest === null || manifest.token !== ownership.token) {
+    throw new Error(`compete group ${ownership.group} has no matching ownership manifest; refusing cleanup`);
+  }
+  if (resolve2(ownership.directory) !== resolve2(groupDirectory(manifest.root, manifest.group))) {
+    throw new Error(`compete group ${ownership.group} ownership path changed; refusing cleanup`);
+  }
+  return manifest;
+}
+function replaceManifest(ownership, manifest) {
+  assertOwnership2(ownership);
+  const destination = manifestPath(ownership.directory);
+  const temporary = `${destination}.${randomBytes2(6).toString("hex")}.tmp`;
+  try {
+    writeFileSync2(temporary, `${JSON.stringify(manifest, null, 2)}
+`, { encoding: "utf8", flag: "wx" });
+    renameSync(temporary, destination);
+  } finally {
+    if (existsSync2(temporary)) rmSync2(temporary, { force: true });
+  }
+}
+function isGitRepository(root) {
+  try {
+    return git2(root, ["rev-parse", "--is-inside-work-tree"]) === "true";
+  } catch {
+    return false;
+  }
+}
+function competeBranch(group, index) {
+  validateGroup(group);
+  if (!Number.isInteger(index) || index < 1) throw new Error(`invalid compete candidate index ${index}`);
+  return `clio/compete/${group}/${index}`;
+}
+function claimCompeteGroup(root, group) {
+  const canonical = canonicalRoot(root);
+  const directory = groupDirectory(canonical, group);
+  const parent = competeParent(canonical);
+  mkdirSync2(parent, { recursive: true });
+  if (!isCanonicalDirectoryAt(parent)) {
+    throw new Error(`compete parent ${parent} is not a canonical local directory`);
+  }
+  mkdirSync2(directory);
+  if (!isCanonicalDirectoryAt(directory)) {
+    throw new Error(`compete group directory ${directory} is not canonical`);
+  }
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const manifest = {
+    version: 2,
+    kind: COMPETE_MANIFEST_KIND,
+    root: canonical,
+    group,
+    token: randomBytes2(16).toString("hex"),
+    state: "active",
+    createdAt: now,
+    updatedAt: now,
+    owner: currentProcessLease(),
+    runs: []
+  };
+  try {
+    writeFileSync2(manifestPath(directory), `${JSON.stringify(manifest, null, 2)}
+`, {
+      encoding: "utf8",
+      flag: "wx"
+    });
+  } catch (err) {
+    try {
+      rmdirSync(directory);
+    } catch {
+    }
+    throw err;
+  }
+  return ownershipFromManifest(manifest);
+}
+function loadCompeteGroup(root, group) {
+  validateGroup(group);
+  const manifest = readManifest(root, group);
+  return manifest === null ? null : ownershipFromManifest(manifest);
+}
+function registerCompeteGroupRun(ownership, admission) {
+  const current = assertOwnership2(ownership);
+  if (current.state !== "active") {
+    throw new Error(`compete group ${ownership.group} is ${current.state}; refusing new run ${admission.runId}`);
+  }
+  if (admission.runId.length === 0) throw new Error("worktree transaction run id cannot be empty");
+  if (admission.pid !== null && (!Number.isSafeInteger(admission.pid) || admission.pid <= 0)) {
+    throw new Error(`worktree transaction run ${admission.runId} has invalid pid ${admission.pid}`);
+  }
+  const lease = {
+    runId: admission.runId,
+    pid: admission.pid,
+    birthToken: admission.pid === null ? null : processSnapshot(admission.pid).birthToken,
+    processGroup: admission.runtimeKind === "acp-delegation" && process.platform !== "win32"
+  };
+  const next = {
+    ...current,
+    runs: [...current.runs.filter((run) => run.runId !== admission.runId), lease],
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  replaceManifest(ownership, next);
+}
+function settleCompeteGroupRun(ownership, runId) {
+  const current = assertOwnership2(ownership);
+  if (current.state !== "active") return;
+  if (!current.runs.some((run) => run.runId === runId)) return;
+  const next = {
+    ...current,
+    runs: current.runs.filter((run) => run.runId !== runId),
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  replaceManifest(ownership, next);
+}
+function markCompeteGroupCleanupReady(ownership) {
+  const current = assertOwnership2(ownership);
+  const next = {
+    ...current,
+    state: "cleanup-ready",
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  Reflect.deleteProperty(next, "winnerIndex");
+  replaceManifest(ownership, next);
+  return ownershipFromManifest(next);
+}
+function markCompeteGroupWinnerPreserved(ownership, winnerIndex) {
+  competeBranch(ownership.group, winnerIndex);
+  const current = assertOwnership2(ownership);
+  const next = {
+    ...current,
+    state: "winner-preserved",
+    winnerIndex,
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  replaceManifest(ownership, next);
+  return ownershipFromManifest(next);
+}
+function createCandidateWorktree(ownership, index, baseline) {
+  assertOwnership2(ownership);
+  const branch = competeBranch(ownership.group, index);
+  const path = join2(ownership.directory, `candidate-${index}`);
+  if (!isCanonicalPathInside(ownership.directory, path)) {
+    throw new Error(`candidate ${index} path escapes compete group ${ownership.group}`);
+  }
+  git2(ownership.root, ["worktree", "add", "-b", branch, path, baseline]);
+  return { index, branch, path };
+}
+function commitCandidateWork(worktree, message) {
+  return commitWorktreePath(worktree.path, COMPETE_COMMIT_IDENTITY, message);
+}
+function candidateDiffStat(root, branch) {
+  return worktreeBranchDiffStat(root, branch);
+}
+function protectedPathsChangedByCompeteBranch(root, branch, protectedPaths) {
+  return protectedPathsChangedByWorktreeBranch(root, branch, protectedPaths);
+}
+function registeredWorktreePaths(root) {
+  const listing = git2(root, ["worktree", "list", "--porcelain", "-z"]);
+  return listing.split("\0").filter((entry) => entry.startsWith("worktree ")).map((entry) => entry.slice("worktree ".length)).filter((path) => path !== void 0 && path.length > 0);
+}
+function exactGroupBranches(root, group) {
+  return git2(root, ["branch", "--list", "--format=%(refname:short)"]).split("\n").filter((branch) => {
+    const parts = branch.split("/");
+    return parts.length === 4 && parts[0] === "clio" && parts[1] === "compete" && parts[2] === group && /^\d+$/.test(parts[3] ?? "");
+  });
+}
+function removeRegisteredWorktree(root, path) {
+  try {
+    git2(root, ["worktree", "remove", "--force", path]);
+  } catch {
+    if (existsSync2(path)) rmSync2(path, { recursive: true, force: true });
+    git2(root, ["worktree", "prune"]);
+  }
+}
+function removeCandidateWorktree(ownership, worktree, deleteBranch) {
+  assertOwnership2(ownership);
+  const expectedPath = join2(ownership.directory, `candidate-${worktree.index}`);
+  const expectedBranch = competeBranch(ownership.group, worktree.index);
+  if (resolve2(worktree.path) !== resolve2(expectedPath) || worktree.branch !== expectedBranch || !isCanonicalPathInside(ownership.directory, worktree.path)) {
+    throw new Error(`candidate ${worktree.index} does not belong to compete group ${ownership.group}`);
+  }
+  removeRegisteredWorktree(ownership.root, worktree.path);
+  if (deleteBranch && exactGroupBranches(ownership.root, ownership.group).includes(worktree.branch)) {
+    git2(ownership.root, ["branch", "-D", worktree.branch]);
+  }
+  const stillRegistered = registeredWorktreePaths(ownership.root).some(
+    (path) => resolve2(path) === resolve2(worktree.path)
+  );
+  const branchRemains = deleteBranch && exactGroupBranches(ownership.root, ownership.group).includes(worktree.branch);
+  if (stillRegistered || existsSync2(worktree.path) || branchRemains) {
+    throw new Error(`failed to remove candidate ${worktree.index} from compete group ${ownership.group}`);
+  }
+}
+function mergeWinnerBranch(root, branch) {
+  return mergeWorktreeBranch(root, branch, COMPETE_COMMIT_IDENTITY);
+}
+function cleanupWorktreeGroup(ownership) {
+  assertOwnership2(ownership);
+  for (const path of registeredWorktreePaths(ownership.root)) {
+    if (!isCanonicalPathInside(ownership.directory, path)) continue;
+    removeRegisteredWorktree(ownership.root, path);
+  }
+  git2(ownership.root, ["worktree", "prune"]);
+  const registeredRemain = registeredWorktreePaths(ownership.root).filter(
+    (path) => isCanonicalPathInside(ownership.directory, path)
+  );
+  if (registeredRemain.length > 0) {
+    throw new Error(
+      `failed to remove ${registeredRemain.length} registered worktree(s) for compete group ${ownership.group}`
+    );
+  }
+  for (const branch of exactGroupBranches(ownership.root, ownership.group)) {
+    git2(ownership.root, ["branch", "-D", branch]);
+  }
+  const branchesRemain = exactGroupBranches(ownership.root, ownership.group);
+  if (branchesRemain.length > 0) {
+    throw new Error(`failed to remove ${branchesRemain.length} branch(es) for compete group ${ownership.group}`);
+  }
+  assertOwnership2(ownership);
+  for (const entry of readdirSync(ownership.directory)) {
+    if (entry === COMPETE_MANIFEST_FILE) continue;
+    rmSync2(join2(ownership.directory, entry), { recursive: true, force: true });
+  }
+  assertOwnership2(ownership);
+  const unexpected = readdirSync(ownership.directory).filter((entry) => entry !== COMPETE_MANIFEST_FILE);
+  if (unexpected.length > 0) {
+    throw new Error(`compete group ${ownership.group} changed during cleanup; ownership is preserved`);
+  }
+  unlinkSync(manifestPath(ownership.directory));
+  rmdirSync(ownership.directory);
+  try {
+    rmdirSync(competeParent(ownership.root));
+  } catch {
+  }
+}
+function cleanupCompeteGroup(ownership) {
+  cleanupWorktreeGroup(ownership);
+}
+function settleRecoveredCompeteDecision(root, group, winnerIndex) {
+  let ownership = loadCompeteGroup(root, group);
+  if (ownership === null) return null;
+  if (ownership.state === "cleanup-ready") {
+    cleanupWorktreeGroup(ownership);
+    return null;
+  }
+  if (ownership.state === "winner-preserved") {
+    if (winnerIndex !== null && ownership.winnerIndex === winnerIndex) return ownership;
+    throw new Error(`compete group ${group} was already preserved with a different winner`);
+  }
+  const manifest = assertOwnership2(ownership);
+  if (ownerIsAlive(manifest.owner)) {
+    throw new Error(`compete group ${group} still has a live coordinator; refusing restart settlement`);
+  }
+  const unterminated = manifest.runs.filter((run) => !terminateRunLease(run));
+  if (unterminated.length > 0) {
+    throw new Error(`could not safely terminate ${unterminated.length} leased compete worker(s) for ${group}`);
+  }
+  if (winnerIndex === null) {
+    ownership = markCompeteGroupCleanupReady(ownership);
+    cleanupWorktreeGroup(ownership);
+    return null;
+  }
+  const winnerBranch = competeBranch(group, winnerIndex);
+  const branches = exactGroupBranches(ownership.root, group);
+  const winnerPath = join2(ownership.directory, `candidate-${winnerIndex}`);
+  if (!branches.includes(winnerBranch) || !registeredWorktreePaths(ownership.root).some((path) => resolve2(path) === resolve2(winnerPath))) {
+    throw new Error(`recovered winner ${winnerBranch} has no intact candidate worktree`);
+  }
+  ownership = markCompeteGroupWinnerPreserved(ownership, winnerIndex);
+  for (const branch of branches) {
+    const index = Number.parseInt(branch.split("/").at(-1) ?? "", 10);
+    if (index === winnerIndex) continue;
+    removeCandidateWorktree(ownership, { index, branch, path: join2(ownership.directory, `candidate-${index}`) }, true);
+  }
+  return ownership;
+}
+function recoverCleanupReadyCompeteGroups(root, options = {}) {
+  const canonical = canonicalRoot(root);
+  const parent = competeParent(canonical);
+  const result = { cleaned: [], preserved: [], failed: [] };
+  if (!isPlainDirectory(parent)) return result;
+  for (const entry of readdirSync(parent, { withFileTypes: true })) {
+    if (!entry.isDirectory() || entry.isSymbolicLink()) {
+      result.preserved.push(entry.name);
+      continue;
+    }
+    let ownership = null;
+    let manifest = null;
+    try {
+      manifest = readManifest(canonical, entry.name);
+      ownership = manifest === null ? null : ownershipFromManifest(manifest);
+    } catch {
+    }
+    if (ownership === null || manifest === null) {
+      result.preserved.push(entry.name);
+      continue;
+    }
+    if (ownership.state === "winner-preserved") {
+      result.preserved.push(entry.name);
+      continue;
+    }
+    if (ownership.state === "active") {
+      if (ownerIsAlive(manifest.owner)) {
+        result.preserved.push(entry.name);
+        continue;
+      }
+      const unterminated = manifest.runs.filter((run) => !terminateRunLease(run));
+      if (unterminated.length > 0) {
+        result.failed.push({
+          group: entry.name,
+          message: `could not safely terminate ${unterminated.length} leased compete worker(s)`
+        });
+        continue;
+      }
+      if (options.preserveAllActive === true || options.preserveActiveGroups?.has(entry.name) === true) {
+        result.preserved.push(entry.name);
+        continue;
+      }
+      try {
+        ownership = markCompeteGroupCleanupReady(ownership);
+      } catch (err) {
+        result.failed.push({ group: entry.name, message: errorMessage(err) });
+        continue;
+      }
+    }
+    try {
+      cleanupWorktreeGroup(ownership);
+      result.cleaned.push(entry.name);
+    } catch (err) {
+      result.failed.push({ group: entry.name, message: errorMessage(err) });
+    }
+  }
+  return result;
+}
+
+// src/domains/dispatch/write-boundary.ts
+init_esm_shims();
+import { execFileSync as execFileSync3 } from "node:child_process";
+import { createHash as createHash2 } from "node:crypto";
+import { existsSync as existsSync3, lstatSync as lstatSync2, mkdirSync as mkdirSync3, readlinkSync, realpathSync as realpathSync3, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname, join as join3, relative as relative3, resolve as resolve3, sep as sep2 } from "node:path";
+var WRITE_BOUNDARY_VIOLATION_REASON = "writes_boundary_violation";
+var ABSENT = "absent";
+var GIT_TIMEOUT_MS = 3e4;
+function git3(root, args, input) {
+  return execFileSync3("git", ["-C", root, ...args], {
+    encoding: "utf8",
+    stdio: ["pipe", "pipe", "pipe"],
+    timeout: GIT_TIMEOUT_MS,
+    maxBuffer: 64 * 1024 * 1024,
+    ...input === void 0 ? {} : { input }
+  });
+}
+function gitBytes2(root, args) {
+  return execFileSync3("git", ["-C", root, ...args], {
+    stdio: ["ignore", "pipe", "pipe"],
+    timeout: GIT_TIMEOUT_MS,
+    maxBuffer: 256 * 1024 * 1024
+  });
+}
+function dirtyPaths(root) {
+  const raw = git3(root, ["status", "--porcelain=v1", "-z", "-uall", "--no-renames"]);
+  const journal = repoRelative(root, clioStateDir());
+  return raw.split("\0").filter((entry) => entry.length > 3).map((entry) => entry.slice(3)).filter((path) => journal === null || !(path === journal || path.startsWith(`${journal}/`)));
+}
+function contentTokens(root, paths) {
+  const tokens = /* @__PURE__ */ new Map();
+  const hashable = [];
+  for (const path of paths) {
+    const full = join3(root, path);
+    let stat;
+    try {
+      stat = lstatSync2(full);
+    } catch {
+      tokens.set(path, ABSENT);
+      continue;
+    }
+    if (stat.isSymbolicLink()) {
+      tokens.set(path, `link:${readlinkSync(full)}`);
+      continue;
+    }
+    if (stat.isDirectory()) {
+      tokens.set(path, "dir");
+      continue;
+    }
+    if (!stat.isFile()) {
+      tokens.set(path, `special:${stat.mode}`);
+      continue;
+    }
+    if (path.includes("\n")) {
+      tokens.set(path, `blob:${git3(root, ["hash-object", "--", full]).trim()}`);
+      continue;
+    }
+    hashable.push(path);
+  }
+  if (hashable.length > 0) {
+    const hashes = git3(root, ["hash-object", "--stdin-paths"], `${hashable.map((path) => join3(root, path)).join("\n")}
+`).split("\n").filter((line) => line.length > 0);
+    hashable.forEach((path, index) => {
+      tokens.set(path, `blob:${hashes[index] ?? "unknown"}`);
+    });
+  }
+  return tokens;
+}
+function baselineTokens(root, head, paths) {
+  const tokens = /* @__PURE__ */ new Map();
+  if (paths.length === 0) return tokens;
+  const query = paths.map((path) => `${head}:${path}`).join("\n");
+  const answered = git3(root, ["cat-file", "--batch-check=%(objectname) %(objecttype)"], `${query}
+`).split("\n").filter((line) => line.length > 0);
+  paths.forEach((path, index) => {
+    const line = answered[index] ?? "";
+    const [objectName, objectType] = line.split(" ");
+    if (objectType === "blob" && objectName !== void 0) tokens.set(path, `blob:${objectName}`);
+    else if (objectType === "tree") tokens.set(path, "dir");
+    else tokens.set(path, ABSENT);
+  });
+  return tokens;
+}
+function captureWorkspaceSnapshot(root) {
+  const absolute = resolve3(root);
+  if (!isGitRepository(absolute)) {
+    throw new Error(
+      `write boundary: ${absolute} is not a git repository, so a declared boundary cannot be verified (enforcement fails closed)`
+    );
+  }
+  const head = git3(absolute, ["rev-parse", "HEAD"]).trim();
+  const paths = dirtyPaths(absolute);
+  return { root: absolute, head, entries: contentTokens(absolute, paths), capturedAt: (/* @__PURE__ */ new Date()).toISOString() };
+}
+function diffWorkspace(snapshot) {
+  const candidates = [.../* @__PURE__ */ new Set([...snapshot.entries.keys(), ...dirtyPaths(snapshot.root)])].sort();
+  if (candidates.length === 0) return [];
+  const unknownBefore = candidates.filter((path) => !snapshot.entries.has(path));
+  const baseline = baselineTokens(snapshot.root, snapshot.head, unknownBefore);
+  const now = contentTokens(snapshot.root, candidates);
+  const changes = [];
+  for (const path of candidates) {
+    const before = snapshot.entries.get(path) ?? baseline.get(path) ?? ABSENT;
+    const after = now.get(path) ?? ABSENT;
+    if (before !== after) changes.push({ path, before, after });
+  }
+  return changes;
+}
+function canonicalVerdict(verdict) {
+  return JSON.stringify(verdict);
+}
+function rollbackPath(snapshot, change) {
+  const full = join3(snapshot.root, change.path);
+  if (snapshot.entries.has(change.path)) {
+    return {
+      unrecoverable: {
+        path: change.path,
+        reason: `path was already modified or untracked before the step, so its prior content is not recorded anywhere`
+      }
+    };
+  }
+  if (change.before === ABSENT) {
+    try {
+      rmSync3(full, { force: true, recursive: false });
+    } catch (error) {
+      return {
+        unrecoverable: { path: change.path, reason: `could not remove: ${error.message}` }
+      };
+    }
+    return { rolledBack: { path: change.path, action: "removed", restoredFrom: "did not exist at baseline" } };
+  }
+  if (!change.before.startsWith("blob:")) {
+    return {
+      unrecoverable: {
+        path: change.path,
+        reason: `baseline state '${change.before}' is not a regular file and is not restorable in place`
+      }
+    };
+  }
+  try {
+    const content = gitBytes2(snapshot.root, ["cat-file", "blob", `${snapshot.head}:${change.path}`]);
+    mkdirSync3(dirname(full), { recursive: true });
+    writeFileSync3(full, content);
+  } catch (error) {
+    return {
+      unrecoverable: { path: change.path, reason: `could not restore from baseline: ${error.message}` }
+    };
+  }
+  return { rolledBack: { path: change.path, action: "restored", restoredFrom: `${snapshot.head}:${change.path}` } };
+}
+function enforceWriteBoundary(input) {
+  const allow = normalizeWriteBoundary(input.allow);
+  const changes = diffWorkspace(input.snapshot);
+  const violations = changes.filter((change) => !writeBoundaryCovers(allow, change.path));
+  const rolledBack = [];
+  const unrecoverable = [];
+  for (const change of violations) {
+    const outcome = rollbackPath(input.snapshot, change);
+    if (outcome.rolledBack !== void 0) rolledBack.push(outcome.rolledBack);
+    if (outcome.unrecoverable !== void 0) unrecoverable.push(outcome.unrecoverable);
+  }
+  const status = violations.length === 0 ? "clean" : unrecoverable.length === 0 ? "rolled-back" : "rollback-incomplete";
+  const attribution = input.stepIds.length === 1 ? `step '${input.stepIds[0]}'` : `steps ${input.stepIds.map((id) => `'${id}'`).join(", ")} ran concurrently in one checkout, so the write cannot be attributed to one of them`;
+  const detail = violations.length === 0 ? null : [
+    `${attribution} wrote outside its declared boundary.`,
+    `Unauthorized paths: ${violations.map((change) => change.path).join(", ")}.`,
+    `Declared writes: ${describeWriteBoundary(allow)}.`,
+    status === "rolled-back" ? "Those paths were rolled back to the baseline commit." : `Rollback is incomplete; the working tree is left as the step made it. Unrestorable: ${unrecoverable.map((entry) => `${entry.path} (${entry.reason})`).join("; ")}.`,
+    "If the change was legitimate, widen the step's `writes:` declaration to cover it."
+  ].join(" ");
+  const body = {
+    version: 1,
+    window: input.window,
+    stepIds: [...input.stepIds],
+    allow,
+    baselineHead: input.snapshot.head,
+    capturedAt: input.snapshot.capturedAt,
+    checkedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    changedPaths: changes.map((change) => change.path),
+    violations: violations.map((change) => change.path),
+    rolledBack,
+    unrecoverable,
+    status,
+    reason: violations.length === 0 ? null : WRITE_BOUNDARY_VIOLATION_REASON,
+    detail
+  };
+  return { ...body, digest: createHash2("sha256").update(canonicalVerdict(body), "utf8").digest("hex") };
+}
+function assertWriteBoundaryInsideRoot(root, allow) {
+  const realRoot = realpathSync3(resolve3(root));
+  for (const entry of allow) {
+    const relativeEntry = entry.endsWith("/") ? entry.slice(0, -1) : entry;
+    let probe = join3(realRoot, relativeEntry);
+    while (probe !== realRoot && !existsSync3(probe)) probe = dirname(probe);
+    const resolved = realpathSync3(probe);
+    if (resolved !== realRoot && !resolved.startsWith(realRoot + sep2)) {
+      throw new Error(`write boundary: entry '${entry}' resolves to ${resolved}, outside the workspace at ${realRoot}`);
+    }
+  }
+}
+function repoRelative(root, path) {
+  const rel = relative3(resolve3(root), resolve3(path));
+  if (rel.length === 0 || rel.startsWith("..") || rel.startsWith(`..${sep2}`)) return null;
+  return rel.split(sep2).join("/");
+}
+function writeBoundaryDir(rootId) {
+  return join3(clioStateDir(), "write-boundaries", rootId);
+}
+function writeBoundaryVerdictPath(rootId, window) {
+  return join3(writeBoundaryDir(rootId), `${window.replace(/[^A-Za-z0-9._-]/gu, "_")}.json`);
+}
+function writeWriteBoundaryVerdict(rootId, verdict) {
+  const path = writeBoundaryVerdictPath(rootId, verdict.window);
+  atomicWrite(path, `${JSON.stringify(verdict, null, 2)}
+`);
+  return path;
+}
+
+// src/domains/dispatch/write-boundary-enforcer.ts
+init_esm_shims();
+import { existsSync as existsSync4 } from "node:fs";
+function preflightWriteBoundaries(plan, root) {
+  const declared = plan.steps.filter((step) => step.writes !== void 0);
+  if (declared.length === 0) return;
+  if (!existsSync4(root) || !isGitRepository(root)) {
+    throw new Error(
+      `write boundaries are declared but ${root} is not a git repository; boundary enforcement compares the checkout before and after each step and fails closed without one`
+    );
+  }
+  for (const step of declared) assertWriteBoundaryInsideRoot(root, step.writes ?? []);
+}
+function createWriteBoundaryEnforcer(input) {
+  const open = /* @__PURE__ */ new Map();
+  const allowFor = (stepIds) => {
+    const allow = /* @__PURE__ */ new Set();
+    for (const stepId of stepIds) for (const entry of input.boundaryFor(stepId) ?? []) allow.add(entry);
+    return [...allow].sort();
+  };
+  return {
+    begin(window, stepIds) {
+      const allow = allowFor(stepIds);
+      assertWriteBoundaryInsideRoot(input.root, allow);
+      open.set(window, { snapshot: captureWorkspaceSnapshot(input.root), allow });
+    },
+    async verify(window, stepIds) {
+      const pending = open.get(window);
+      if (pending === void 0) {
+        throw new Error(`write boundary: window '${window}' was verified without a snapshot`);
+      }
+      open.delete(window);
+      const verdict = enforceWriteBoundary({
+        snapshot: pending.snapshot,
+        window,
+        stepIds,
+        allow: pending.allow
+      });
+      const path = writeWriteBoundaryVerdict(input.rootId, verdict);
+      input.onVerdict?.(verdict, path);
+      return {
+        window,
+        violated: verdict.reason !== null,
+        // Every step in the window is named. With one step that is exact;
+        // with several it is the honest answer, because one checkout cannot
+        // tell the scheduler which of them wrote the path.
+        failedStepIds: verdict.reason === null ? [] : [...stepIds],
+        detail: verdict.detail
+      };
+    }
+  };
+}
+
+export {
+  gitCheckoutRoot,
+  createTaskWorktree,
+  applyTaskWorktree,
+  cleanupTaskWorktree,
+  isGitRepository,
+  claimCompeteGroup,
+  loadCompeteGroup,
+  registerCompeteGroupRun,
+  settleCompeteGroupRun,
+  markCompeteGroupCleanupReady,
+  markCompeteGroupWinnerPreserved,
+  createCandidateWorktree,
+  commitCandidateWork,
+  candidateDiffStat,
+  protectedPathsChangedByCompeteBranch,
+  removeCandidateWorktree,
+  mergeWinnerBranch,
+  cleanupCompeteGroup,
+  settleRecoveredCompeteDecision,
+  recoverCleanupReadyCompeteGroups,
+  WRITE_BOUNDARY_VIOLATION_REASON,
+  captureWorkspaceSnapshot,
+  preflightWriteBoundaries,
+  createWriteBoundaryEnforcer
+};
+//# sourceMappingURL=chunk-KZ2H5X4G.js.map