@kabmo-labs/kabmo 0.7.0 → 0.8.0

package/src/server/lib/fs/worktree/location.test.ts

@@ -0,0 +1,206 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * Repository identity, and the settings-driven location rule.
+ *
+ * Identity has one property that is easy to get wrong and expensive when it is:
+ * the derivation (`rev-list --max-parents=0 --all`, sorted, first) is NOT stable.
+ * Measured: a repository that gains a branch with unrelated history inserts a
+ * second root and the sorted-first value MOVES, so a repository would start
+ * looking for its worktrees in a different folder. That is why a stored value
+ * always wins — the behavior this file pins.
+ */
+
+import { afterAll, describe, expect, test } from 'bun:test';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { canonicalPath } from '@/server/lib/fs/canonical';
+import { deriveProjectId, resolveProjectId } from '@/server/lib/fs/worktree/project-id';
+import {
+  defaultWorktreeRoot,
+  generateAvailableName,
+  resolveConfiguredWorktreeRoot,
+  resolveTargetDirectory,
+  worktreeNameCandidates,
+} from '@/server/lib/fs/worktree/location';
+import { removeDir } from '@/test-support/remove-dir';
+
+const FIXTURE_ROOT = fs.mkdtempSync(path.join(os.tmpdir(), 'kabmo-worktree-location-'));
+
+const GIT_ENV_FOR_TESTS = {
+  ...Bun.env,
+  GIT_EDITOR: 'true',
+  GIT_TERMINAL_PROMPT: '0',
+  GIT_AUTHOR_NAME: 'Test',
+  GIT_AUTHOR_EMAIL: 'test@example.invalid',
+  GIT_COMMITTER_NAME: 'Test',
+  GIT_COMMITTER_EMAIL: 'test@example.invalid',
+};
+
+function git(cwd: string, ...args: string[]): string {
+  return Bun.spawnSync({ cmd: ['git', ...args], cwd, env: GIT_ENV_FOR_TESTS }).stdout.toString();
+}
+
+function makeRepo(name: string): string {
+  const dir = path.join(FIXTURE_ROOT, name);
+  fs.mkdirSync(dir, { recursive: true });
+  git(dir, 'init', '-q', '-b', 'main', '.');
+  fs.writeFileSync(path.join(dir, 'f.txt'), 'a\n');
+  git(dir, 'add', '-A');
+  git(dir, 'commit', '-q', '-m', 'base');
+  return dir;
+}
+
+afterAll(() => {
+  removeDir(FIXTURE_ROOT);
+});
+
+describe('deriveProjectId', () => {
+  test('two clones of one repository share the identity', async () => {
+    const bare = path.join(FIXTURE_ROOT, 'origin.git');
+    fs.mkdirSync(bare, { recursive: true });
+    git(bare, 'init', '-q', '--bare');
+
+    const first = makeRepo('clone-a');
+    git(first, 'remote', 'add', 'origin', bare);
+    const head = git(first, 'rev-parse', 'HEAD').trim();
+    git(first, 'push', '-q', 'origin', `${head}:refs/heads/main`);
+
+    const second = path.join(FIXTURE_ROOT, 'clone-b');
+    git(FIXTURE_ROOT, 'clone', '-q', bare, second);
+
+    const a = await deriveProjectId(first);
+    const b = await deriveProjectId(second);
+    expect(a).not.toBeNull();
+    expect(a).toBe(b);
+  });
+
+  test('an unborn repository has no identity — the `no_commits` refusal', async () => {
+    const empty = path.join(FIXTURE_ROOT, 'unborn');
+    fs.mkdirSync(empty, { recursive: true });
+    git(empty, 'init', '-q', '-b', 'main', '.');
+    expect(await deriveProjectId(empty)).toBeNull();
+  });
+
+  test('a stored identity wins over a re-derivation', async () => {
+    const repo = makeRepo('identity-stored');
+    const stored = 'stored-project-id';
+    const identityFor = async () => stored;
+    expect(await resolveProjectId(await canonicalPath(repo), identityFor)).toBe(stored);
+  });
+
+  test('an added orphan branch changes the derivation — hence the cache', async () => {
+    const repo = makeRepo('identity-orphan');
+    const derived = await deriveProjectId(repo);
+    expect(derived).not.toBeNull();
+
+    git(repo, 'checkout', '-q', '--orphan', 'other');
+    git(repo, 'rm', '-rq', '--cached', '.');
+    git(repo, 'add', '-A');
+    git(repo, 'commit', '-q', '-m', 'other root');
+
+    // Two roots now exist, so the sorted-first value is a different question
+    // than it was — which is exactly why the stored value is consulted first.
+    const roots = git(repo, 'rev-list', '--max-parents=0', '--all')
+      .split('\n')
+      .map((line) => line.trim())
+      .filter(Boolean);
+    expect(roots.length).toBe(2);
+
+    // The stored value is consulted first, whatever the derivation now answers.
+    const stored = derived as string;
+    const later = await resolveProjectId(await canonicalPath(repo), async () => stored);
+    expect(later).toBe(stored);
+  });
+});
+
+describe('worktree location', () => {
+  // A literal POSIX spelling is not portable: `path.resolve('/repo', '.worktrees')`
+  // answers `D:\repo\.worktrees` on a Windows runner, which is the CORRECT
+  // answer for that platform and not a product bug. Every expectation is
+  // therefore built through `path`, so the rule is asserted rather than the
+  // separator.
+  const checkout = path.resolve('/repo');
+  const home = path.resolve('/home/u');
+
+  test('three spellings, and the resolved value is always the parent', () => {
+    expect(resolveConfiguredWorktreeRoot('', checkout)).toBeNull();
+    expect(resolveConfiguredWorktreeRoot(null, checkout)).toBeNull();
+    expect(resolveConfiguredWorktreeRoot('   ', checkout)).toBeNull();
+    expect(resolveConfiguredWorktreeRoot('../wt', checkout)).toBe(path.resolve(checkout, '..', 'wt'));
+    expect(resolveConfiguredWorktreeRoot('.worktrees', checkout)).toBe(path.join(checkout, '.worktrees'));
+    expect(resolveConfiguredWorktreeRoot('/abs/wt', checkout)).toBe(path.resolve(checkout, '/abs/wt'));
+    expect(resolveConfiguredWorktreeRoot('~/wt', checkout, home)).toBe(path.join(home, 'wt'));
+    expect(resolveConfiguredWorktreeRoot('~', checkout, home)).toBe(home);
+  });
+
+  test('the default root is keyed per repository, outside every checkout', () => {
+    expect(defaultWorktreeRoot('/data', 'abc123')).toBe(path.join('/data', 'worktrees', 'abc123'));
+  });
+
+  test('the slug is tried first, then slug-word-word', () => {
+    const candidates = worktreeNameCandidates('quick-otter');
+    expect(candidates[0]).toBe('quick-otter');
+    expect(candidates[1]).toMatch(/^quick-otter-[a-z]+-[a-z]+$/);
+    expect(candidates.length).toBe(26);
+  });
+
+  test('a taken folder moves to the next candidate rather than refusing', async () => {
+    const root = path.join(FIXTURE_ROOT, 'collide');
+    fs.mkdirSync(path.join(root, 'quick-otter'), { recursive: true });
+
+    const target = await resolveTargetDirectory({
+      root,
+      preferredName: 'quick-otter',
+      generatedBranch: (name) => `wt/${name}`,
+      branchExists: async () => false,
+    });
+    expect(target.directory).not.toBe(path.join(root, 'quick-otter'));
+    expect(target.name.startsWith('quick-otter-')).toBe(true);
+  });
+
+  test('a taken BRANCH is skipped too, so folder and branch never disagree', async () => {
+    const root = path.join(FIXTURE_ROOT, 'branch-collide');
+    fs.mkdirSync(root, { recursive: true });
+
+    const target = await resolveTargetDirectory({
+      root,
+      preferredName: 'quick-otter',
+      generatedBranch: (name) => `wt/${name}`,
+      branchExists: async (branch) => branch === 'wt/quick-otter',
+    });
+    expect(target.branch).not.toBe('wt/quick-otter');
+    expect(target.branch).toBe(`wt/${target.name}`);
+  });
+
+  test('a typed branch is used verbatim in both modes', async () => {
+    const root = path.join(FIXTURE_ROOT, 'verbatim');
+    fs.mkdirSync(root, { recursive: true });
+    const target = await resolveTargetDirectory({
+      root,
+      preferredName: 'payments',
+      explicitBranch: 'feat/payments',
+      generatedBranch: (name) => `wt/${name}`,
+      // Even when every generated name is taken, the typed branch is used.
+      branchExists: async () => true,
+    });
+    expect(target.branch).toBe('feat/payments');
+    expect(target.name).toBe('payments');
+  });
+
+  test('a generated name avoids both a folder and a branch', async () => {
+    const root = path.join(FIXTURE_ROOT, 'generated');
+    fs.mkdirSync(root, { recursive: true });
+    const name = await generateAvailableName({
+      root,
+      branchExists: async (branch) => branch === 'wt/blocked',
+      attempts: 4,
+    });
+    expect(name).not.toBe('blocked');
+    expect(name).toMatch(/^[a-z]+-[a-z]+$/);
+  });
+});

package/src/server/lib/fs/worktree/location.ts

@@ -0,0 +1,114 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * Where a worktree lands — OpenChamber's rule, adopted as-is:
+ *
+ *   root = configured directory (resolved) || <data dir>/worktrees/<projectID>
+ *   path = <root>/<name>
+ *
+ * Three spellings for the setting, unchanged from theirs: a relative path
+ * resolves against the CANONICAL checkout (so a linked worktree still reads the
+ * project's own setting), an absolute path is used as-is, and `~` means the home
+ * directory. The resolved value is always the PARENT — the name is appended.
+ *
+ * A name is never refused because it is taken: candidates are tried in order, so
+ * "quick otter" in a repository that already has one becomes
+ * `quick-otter-cosmic-dolphin` rather than an error the user has to read.
+ */
+
+import path from 'path';
+import { homedir } from 'os';
+import { pathExists } from '@/server/lib/omp/core/paths';
+import {
+  generateBranchSlug,
+  slugWorktreeName,
+  WORKTREE_BRANCH_PREFIX,
+} from '@/shared/lib/workspace/worktree/branch-name';
+
+/** How many names to try before giving up. OpenChamber's 26, kept. */
+export const WORKTREE_NAME_ATTEMPTS = 26;
+
+/**
+ * Resolve the setting into a parent directory. `null` when unset, so the caller
+ * keeps its own default rather than resolving an empty string to the checkout.
+ */
+export function resolveConfiguredWorktreeRoot(
+  configured: unknown,
+  primaryCheckout: string,
+  home: string = homedir(),
+): string | null {
+  const trimmed = String(configured ?? '').trim();
+  if (!trimmed) return null;
+  if (trimmed === '~') return path.resolve(home);
+  if (/^~[\\/]/.test(trimmed)) return path.resolve(home, trimmed.slice(2));
+  return path.resolve(primaryCheckout, trimmed);
+}
+
+/** `<data dir>/worktrees/<projectID>` — outside every checkout, keyed per repository. */
+export function defaultWorktreeRoot(dataDir: string, projectId: string): string {
+  return path.join(dataDir, 'worktrees', projectId);
+}
+
+/** `<slug>`, then `<slug>-<adjective>-<noun>` × attempts-1. */
+export function worktreeNameCandidates(preferredName: string, attempts = WORKTREE_NAME_ATTEMPTS): string[] {
+  const base = slugWorktreeName(preferredName);
+  if (!base) {
+    return Array.from({ length: attempts }, () => generateBranchSlug());
+  }
+  return Array.from({ length: attempts }, (_, index) =>
+    index === 0 ? base : `${base}-${generateBranchSlug()}`,
+  );
+}
+
+export interface ResolvedWorktreeTarget {
+  name: string;
+  directory: string;
+  branch: string;
+}
+
+export interface ResolveTargetInput {
+  root: string;
+  preferredName: string;
+  /** The dialog's branch, used verbatim and only the directory is checked. */
+  explicitBranch?: string | null;
+  /** The branch a generated candidate would get. */
+  generatedBranch: (name: string) => string;
+  branchExists: (branch: string) => Promise<boolean>;
+}
+
+/**
+ * Pick a free name. A candidate is rejected when its directory exists OR — for a
+ * generated branch — when the branch it would get already exists, so the folder
+ * and the branch can never disagree about which one is "the name".
+ */
+export async function resolveTargetDirectory(input: ResolveTargetInput): Promise<ResolvedWorktreeTarget> {
+  const explicit = input.explicitBranch?.trim() || null;
+  for (const name of worktreeNameCandidates(input.preferredName)) {
+    const directory = path.join(input.root, name);
+    if (await pathExists(directory)) continue;
+    if (explicit) return { name, directory, branch: explicit };
+    const branch = input.generatedBranch(name);
+    if (await input.branchExists(branch)) continue;
+    return { name, directory, branch };
+  }
+  throw new Error('Failed to generate a unique worktree name');
+}
+
+/** A generated slug that collides with neither a folder nor a branch. */
+export async function generateAvailableName(input: {
+  root: string;
+  branchExists: (branch: string) => Promise<boolean>;
+  attempts?: number;
+}): Promise<string> {
+  const attempts = input.attempts ?? WORKTREE_NAME_ATTEMPTS;
+  for (let index = 0; index < attempts; index += 1) {
+    const slug = generateBranchSlug();
+    if (await pathExists(path.join(input.root, slug))) continue;
+    if (await input.branchExists(`${WORKTREE_BRANCH_PREFIX}/${slug}`)) continue;
+    return slug;
+  }
+  throw new Error('Failed to generate a unique worktree name');
+}

package/src/server/lib/fs/worktree/project-id.ts

@@ -0,0 +1,53 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * Repository identity — the key a repository's worktrees live under.
+ *
+ * The derivation is OpenChamber's (`git rev-list --max-parents=0 --all`, sorted,
+ * first line: the root commit), and two clones of one repository share it.
+ *
+ * It is NOT stable on its own, which is why they cache it in
+ * `<primary>/.git/opencode`. Measured: adding a branch with unrelated history
+ * (`git checkout --orphan`) inserts a second root and MOVES the sorted-first
+ * value, so a repository that gained one would look for its worktrees in a
+ * different folder. Kabmo does not write into a user's `.git`, so the stored row
+ * is the cache and it always wins.
+ */
+
+import { runGit } from '@/server/lib/fs/git-run';
+
+/** `rev-list --max-parents=0 --all`, sorted, first. `null` for an unborn branch. */
+export async function deriveProjectId(primaryRoot: string): Promise<string | null> {
+  const listed = await runGit(['rev-list', '--max-parents=0', '--all'], {
+    cwd: primaryRoot,
+    maxBuffer: 1024 * 1024,
+  });
+  if (listed.exitCode !== 0) return null;
+  const roots = listed.stdout
+    .split('\n')
+    .map((line) => line.trim())
+    .filter(Boolean)
+    .sort((a, b) => a.localeCompare(b));
+  return roots[0] ?? null;
+}
+
+/**
+ * The identity to key this repository's worktrees under.
+ *
+ * A stored value beats the derivation — that is the whole point of keeping one.
+ * Only a repository with no record derives, which is the moment it has no
+ * worktree folder to protect.
+ */
+export async function resolveProjectId(
+  primaryRoot: string,
+  identityFor: (primaryRoot: string) => Promise<string | null>,
+): Promise<string> {
+  const stored = await identityFor(primaryRoot);
+  if (stored) return stored;
+  const derived = await deriveProjectId(primaryRoot);
+  if (!derived) throw new Error('This repository has no commits yet.');
+  return derived;
+}

package/src/server/lib/fs/worktree/remove.test.ts

@@ -0,0 +1,242 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * Removing a worktree, against real repositories.
+ *
+ * Three rules, each measured, each a way work is lost if it is wrong:
+ *
+ *  - **Sessions are stopped BEFORE the directory goes.** The omp child holds the
+ *    worktree as its cwd; a child in a deleted directory makes
+ *    `resolveSpawnCwd` quietly run that session in the server's own folder.
+ *  - **A dirty worktree refuses.** git exits 128 with "contains modified or
+ *    untracked files" and `--force` is never passed, so the refusal is
+ *    recoverable and the count is reported.
+ *  - **The branch is deleted with `-d` only.** Its refusal (an unmerged branch)
+ *    IS the safety net, so a branch with commits of its own survives and the
+ *    answer says so rather than pretending the delete worked.
+ */
+
+import { afterAll, describe, expect, test } from 'bun:test';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { canonicalPath } from '@/server/lib/fs/canonical';
+import { createWorktree } from '@/server/lib/fs/worktree/create';
+import type { CreateWorktreeDeps } from '@/server/lib/fs/worktree/create';
+import { listWorktrees } from '@/server/lib/fs/worktree/list';
+import { commitsAheadOf, dirtyCount, removeWorktree, type RemoveWorktreeDeps } from '@/server/lib/fs/worktree/remove';
+import { invalidateWorktreeTopology } from '@/server/lib/fs/worktree/topology';
+import { removeDir } from '@/test-support/remove-dir';
+
+const FIXTURE_ROOT = fs.mkdtempSync(path.join(os.tmpdir(), 'kabmo-worktree-remove-'));
+const DATA_DIR = path.join(FIXTURE_ROOT, 'data');
+const MANAGED_ROOT = path.join(DATA_DIR, 'worktrees');
+
+const GIT_ENV_FOR_TESTS = {
+  ...Bun.env,
+  GIT_EDITOR: 'true',
+  GIT_TERMINAL_PROMPT: '0',
+  GIT_AUTHOR_NAME: 'Test',
+  GIT_AUTHOR_EMAIL: 'test@example.invalid',
+  GIT_COMMITTER_NAME: 'Test',
+  GIT_COMMITTER_EMAIL: 'test@example.invalid',
+};
+
+function git(cwd: string, ...args: string[]): string {
+  return Bun.spawnSync({ cmd: ['git', ...args], cwd, env: GIT_ENV_FOR_TESTS }).stdout.toString();
+}
+
+function makeRepo(name: string): string {
+  const dir = path.join(FIXTURE_ROOT, name);
+  fs.mkdirSync(dir, { recursive: true });
+  git(dir, 'init', '-q', '-b', 'main', '.');
+  fs.writeFileSync(path.join(dir, 'readme.md'), 'hello\n');
+  git(dir, 'add', '-A');
+  git(dir, 'commit', '-q', '-m', 'base');
+  return dir;
+}
+
+/** The registry stub: the production one is two SQLite statements. */
+function registry(rows = new Map<string, { start_ref: string }>()): RemoveWorktreeDeps & {
+  rows: Map<string, { start_ref: string }>;
+} {
+  return {
+    rows,
+    rowFor: async (candidate) => rows.get(candidate),
+    removeRow: async (candidate) => {
+      rows.delete(candidate);
+    },
+  };
+}
+
+const createDeps = (rows = new Map<string, { startRef: string; projectId: string }>()): CreateWorktreeDeps => ({
+  identityFor: async () => null,
+  carryIgnored: false,
+  dataDir: DATA_DIR,
+  configuredDirectory: null,
+  record: async (row) => {
+    rows.set(await canonicalPath(row.path), { startRef: row.startRef, projectId: row.projectId });
+  },
+});
+
+afterAll(async () => {
+  await invalidateWorktreeTopology();
+  removeDir(FIXTURE_ROOT);
+});
+
+describe('removeWorktree', () => {
+  test('a dirty worktree refuses with the count and keeps everything', async () => {
+    const repo = makeRepo('remove-dirty');
+    const created = await createWorktree({ projectPath: repo, mode: 'new', branch: 'wt/dirty' }, createDeps());
+    fs.writeFileSync(path.join(created.path, 'readme.md'), 'changed\n');
+    fs.writeFileSync(path.join(created.path, 'untracked.txt'), 'new\n');
+
+    const failure = removeWorktree(
+      { projectPath: repo, worktreePath: created.path, managedRoot: MANAGED_ROOT },
+      registry(),
+    );
+    await failure.catch((error) => expect(error).toMatchObject({ code: 'dirty', count: 2 }));
+
+    expect(fs.existsSync(created.path)).toBe(true);
+    expect((await listWorktrees(repo)).some((entry) => entry.path === created.path)).toBe(true);
+    // The refusal names what it found, so the dialog can show it.
+    expect(await dirtyCount(created.path)).toBe(2);
+  });
+
+  test('a clean worktree goes, and a branch with commits of its own is kept', async () => {
+    const repo = makeRepo('remove-keep-branch');
+    const records = new Map<string, { startRef: string; projectId: string }>();
+    const created = await createWorktree(
+      { projectPath: repo, mode: 'new', branch: 'wt/keepme' },
+      createDeps(records),
+    );
+    fs.writeFileSync(path.join(created.path, 'work.txt'), 'done\n');
+    git(created.path, 'add', '-A');
+    git(created.path, 'commit', '-q', '-m', 'work');
+
+    const rows = new Map([[await canonicalPath(created.path), { start_ref: 'HEAD' }]]);
+    const deps = registry(rows);
+    // The dialog gates on this number: anything above zero must disable the
+    // branch checkbox, because `git branch -d` would refuse anyway.
+    expect(await commitsAheadOf(await canonicalPath(repo), 'HEAD', 'wt/keepme')).toBe(1);
+
+    const result = await removeWorktree(
+      { projectPath: repo, worktreePath: created.path, deleteBranch: true, managedRoot: MANAGED_ROOT },
+      deps,
+    );
+
+    expect(result.removed).toBe(true);
+    expect(result.branchDeleted).toBe(false);
+    expect(result.branchKept).toBe(true);
+    expect(fs.existsSync(created.path)).toBe(false);
+    expect(git(repo, 'branch', '--list', 'wt/keepme').trim()).toContain('wt/keepme');
+    expect(rows.size).toBe(0);
+  });
+
+  test('a branch with nothing of its own is deleted with -d', async () => {
+    const repo = makeRepo('remove-delete-branch');
+    const created = await createWorktree({ projectPath: repo, mode: 'new', branch: 'wt/disposable' }, createDeps());
+    const rows = new Map([[await canonicalPath(created.path), { start_ref: 'HEAD' }]]);
+
+    const result = await removeWorktree(
+      { projectPath: repo, worktreePath: created.path, deleteBranch: true, managedRoot: MANAGED_ROOT },
+      registry(rows),
+    );
+
+    expect(result.branchDeleted).toBe(true);
+    expect(git(repo, 'branch', '--list', 'wt/disposable').trim()).toBe('');
+    expect(rows.size).toBe(0);
+  });
+
+  test('the main checkout cannot be removed', async () => {
+    const repo = makeRepo('remove-primary');
+    const primary = (await listWorktrees(repo)).find((entry) => entry.isPrimary)?.path as string;
+    const failure = removeWorktree({ projectPath: repo, worktreePath: primary }, registry());
+    await failure.catch((error) => expect(error).toMatchObject({ code: 'primary_checkout' }));
+  });
+
+  test('a path that is not a worktree of this repository is refused', async () => {
+    const repo = makeRepo('remove-stranger');
+    const stranger = path.join(FIXTURE_ROOT, 'stranger');
+    fs.mkdirSync(stranger, { recursive: true });
+    const failure = removeWorktree({ projectPath: repo, worktreePath: stranger }, registry());
+    await failure.catch((error) => expect(error).toMatchObject({ code: 'not_a_worktree' }));
+  });
+
+  test('a worktree whose folder was deleted outside Kabmo still removes, and prunes', async () => {
+    const repo = makeRepo('remove-vanished');
+    const created = await createWorktree({ projectPath: repo, mode: 'new', branch: 'wt/vanish' }, createDeps());
+    fs.rmSync(created.path, { recursive: true, force: true });
+
+    // It is still listed — that is what keeps its sessions on screen.
+    expect((await listWorktrees(repo)).some((entry) => entry.path === created.path)).toBe(true);
+
+    const result = await removeWorktree(
+      { projectPath: repo, worktreePath: created.path, deleteBranch: true, managedRoot: MANAGED_ROOT },
+      registry(),
+    );
+    expect(result.removed).toBe(true);
+    expect((await listWorktrees(repo)).some((entry) => entry.path === created.path)).toBe(false);
+  });
+
+  test('children are stopped BEFORE the directory disappears', async () => {
+    const repo = makeRepo('remove-order');
+    const created = await createWorktree({ projectPath: repo, mode: 'new', branch: 'wt/order' }, createDeps());
+
+    // A child that simply waits: `await new Promise(() => {})` never settles, so
+    // the process stays alive without a timer a test would have to wait on.
+    const child = Bun.spawn({
+      cmd: ['bun', '-e', 'await new Promise(() => {});'],
+      cwd: created.path,
+      stdin: 'ignore',
+      stdout: 'ignore',
+      stderr: 'ignore',
+    });
+
+    const order: string[] = [];
+    const result = await removeWorktree(
+      {
+        projectPath: repo,
+        worktreePath: created.path,
+        managedRoot: MANAGED_ROOT,
+        stopSessions: async (worktreePath) => {
+          order.push(`stop:${path.basename(worktreePath)}`);
+          child.kill();
+          await child.exited;
+          return ['session-1'];
+        },
+      },
+      registry(),
+    );
+    order.push('removed');
+
+    expect(order).toEqual(['stop:order', 'removed']);
+    expect(result.archived).toEqual(['session-1']);
+    expect(fs.existsSync(created.path)).toBe(false);
+    // A SIGTERM'd process reports `signalCode`, not an exit code.
+    expect(child.signalCode).toBe('SIGTERM');
+  });
+
+  test('a refusal after the sessions are stopped leaves a worktree that can be retried', async () => {
+    const repo = makeRepo('remove-retry');
+    const created = await createWorktree({ projectPath: repo, mode: 'new', branch: 'wt/retry' }, createDeps());
+    fs.writeFileSync(path.join(created.path, 'dirty.txt'), 'x');
+
+    const failure = removeWorktree(
+      {
+        projectPath: repo,
+        worktreePath: created.path,
+        managedRoot: MANAGED_ROOT,
+        stopSessions: async () => ['session-1'],
+      },
+      registry(),
+    );
+    await failure.catch((error) => expect(error).toMatchObject({ code: 'dirty' }));
+
+    expect(fs.existsSync(created.path)).toBe(true);
+    expect((await listWorktrees(repo)).some((entry) => entry.path === created.path)).toBe(true);
+  });
+});