@kylecheng3146/agent-ops 0.2.8 → 0.3.1

package/dist/runtime/src/parallel/finish.js

@@ -0,0 +1,303 @@
+import { mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { sha256 } from "../fs/hash.js";
+import { AgentOpsError, resolveContainedPath } from "../fs/paths.js";
+import { currentGateFingerprint } from "../hooks/completion-gate.js";
+import { collectChangeSurface } from "../verify/change-surface.js";
+import { aggregateVerificationStatus, executeConfiguredCommand } from "../verify/command-executor.js";
+import { assertWorktreeName, readWorktreeRecord, removeCheckout, resolveCheckouts, worktreePath } from "./service.js";
+export const NOTES_REF = "agent-ops";
+const LOCK_NAME = "agent-ops-finish.lock";
+const LOCK_POLL_MS = 2_000;
+const LOCK_WAIT_MS = 30 * 60 * 1000;
+// A holder that has not finished in this long has died without its pid being
+// reused by something we can see; the lock is reclaimed.
+const LOCK_STALE_MS = 2 * 60 * 60 * 1000;
+const MAX_INTENTS = 20;
+/**
+ * The work and the moved target touch the same lines. The rebase was undone;
+ * this carries what the agent needs to redo it deliberately: the files, and
+ * what the tasks already merged into the target meant to achieve.
+ */
+export class WorktreeConflictError extends AgentOpsError {
+    files;
+    intents;
+    target;
+    constructor(record, target, head, files, intents) {
+        super("WORKTREE_REBASE_CONFLICT", [
+            `Rebasing ${record.branch} onto ${record.targetBranch} (${target}) conflicts in: ${files.join(", ")}.`,
+            "The rebase was aborted and the branch is unchanged.",
+            intents.length === 0
+                ? "No agent-ops notes describe the target-side commits."
+                : ["What the target-side work intended:", ...intents.map(({ commit, note }) => `--- ${commit}\n${note}`)].join("\n"),
+            `Resolve it in ${record.path}: git rebase ${target}, satisfy both intents, git rebase --continue;`,
+            "then create a new task whose criteria cover both intents, attach it to this session,",
+            `run verify, review and task complete with --base ${target}, and finish again.`,
+            `One attempt only: if that verification or review fails, git reset --hard ${head}`,
+            "and stop to report instead of retrying."
+        ].join("\n"));
+        this.files = files;
+        this.intents = intents;
+        this.target = target;
+    }
+}
+function finishError(code, message) {
+    return new AgentOpsError(code, message);
+}
+async function git(deps, cwd, args, code, message) {
+    const result = await deps.git(cwd, args);
+    if (result.exitCode !== 0) {
+        const detail = result.stderr.trim().split("\n")[0];
+        throw finishError(code, detail === undefined || detail === "" ? message : `${message} ${detail}`);
+    }
+    return result.stdout.trim();
+}
+function runner(deps, cwd) {
+    return {
+        run: async (args) => {
+            const result = await deps.git(cwd, args);
+            return { exitCode: result.exitCode, stdout: Buffer.from(result.stdout, "utf8") };
+        }
+    };
+}
+function alive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code === "EPERM";
+    }
+}
+async function staleLock(path) {
+    try {
+        const owner = JSON.parse(await readFile(join(path, "owner.json"), "utf8"));
+        if (typeof owner.pid !== "number" || typeof owner.at !== "number")
+            return true;
+        return !alive(owner.pid) || Date.now() - owner.at > LOCK_STALE_MS;
+    }
+    catch {
+        // A holder between mkdir and writing its owner file looks like this too;
+        // only an old ownerless lock is abandoned.
+        try {
+            return Date.now() - (await stat(path)).mtimeMs > 60_000;
+        }
+        catch {
+            return true;
+        }
+    }
+}
+/**
+ * One finish at a time per repository: each one moves the target, and every
+ * later one must rebase onto that. The lock lives in the Git common directory
+ * so every worktree of the repository sees the same one.
+ */
+export async function withFinishLock(deps, commonDir, action) {
+    const path = join(commonDir, LOCK_NAME);
+    const deadline = Date.now() + (deps.lockWaitMs ?? LOCK_WAIT_MS);
+    const sleep = deps.sleep ?? (async (ms) => await new Promise((resolve) => setTimeout(resolve, ms)));
+    for (;;) {
+        try {
+            await mkdir(path);
+            await writeFile(join(path, "owner.json"), JSON.stringify({ pid: process.pid, at: Date.now() }));
+            break;
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw error;
+            if (await staleLock(path)) {
+                await rm(path, { recursive: true, force: true });
+                continue;
+            }
+            if (Date.now() >= deadline) {
+                throw finishError("WORKTREE_FINISH_BUSY", "Another worktree finish is still running; try again later.");
+            }
+            await sleep(LOCK_POLL_MS);
+        }
+    }
+    try {
+        return await action();
+    }
+    finally {
+        await rm(path, { recursive: true, force: true });
+    }
+}
+/**
+ * The branch's own change, independent of where it is based: hunk positions
+ * and blob ids move with a rebase, the change itself does not.
+ */
+async function patchHash(deps, cwd, target) {
+    const diff = await git(deps, cwd, ["diff", "--no-color", "--no-ext-diff", "--no-textconv", `${target}...HEAD`], "WORKTREE_DIFF_FAILED", "Git could not diff the branch.");
+    return sha256(diff.split("\n")
+        .filter((line) => !line.startsWith("index "))
+        .map((line) => line.startsWith("@@") ? "@@" : line)
+        .join("\n"));
+}
+async function reverify(deps, root, config) {
+    const results = [];
+    for (const command of config.verification.commands) {
+        results.push(await executeConfiguredCommand(command, {
+            cwd: command.cwd === "." ? root : await resolveContainedPath(root, command.cwd),
+            trusted: true,
+            ...(deps.processRunner === undefined ? {} : { runner: deps.processRunner })
+        }));
+    }
+    return aggregateVerificationStatus(results) === "PASS"
+        ? []
+        : results.filter((result) => result.required && result.status !== "PASS").map(({ commandId }) => commandId);
+}
+async function targetIntents(deps, cwd, target) {
+    const commits = (await git(deps, cwd, ["log", "--format=%H", `HEAD..${target}`], "WORKTREE_LOG_FAILED", "Git could not list the target-side commits.")).split("\n").filter(Boolean);
+    const intents = [];
+    for (const commit of commits) {
+        const note = await deps.git(cwd, ["notes", `--ref=${NOTES_REF}`, "show", commit]);
+        if (note.exitCode === 0 && note.stdout.trim() !== "") {
+            intents.push({ commit, note: note.stdout.trim() });
+            if (intents.length >= MAX_INTENTS)
+                break;
+        }
+    }
+    return intents;
+}
+/** Each tree top first, its subtasks after it; `depth` counts parents. */
+function taskTree(tasks) {
+    const ids = new Set(tasks.map(({ task }) => task.id));
+    const ordered = [];
+    const visit = (parent, depth) => {
+        for (const task of tasks) {
+            const own = task.task.parentTaskId !== undefined && ids.has(task.task.parentTaskId)
+                ? task.task.parentTaskId
+                : undefined;
+            if (own === parent) {
+                ordered.push({ task, depth });
+                visit(task.task.id, depth + 1);
+            }
+        }
+    };
+    visit(undefined, 0);
+    return ordered;
+}
+function noteText(record, tasks) {
+    return [
+        `worktree: ${record.name} (${record.branch})`,
+        ...tasks.flatMap(({ task, depth }) => {
+            const indent = "  ".repeat(depth);
+            return [
+                `${indent}agent-ops task ${task.task.id}: ${task.task.title}`,
+                `${indent}criteria:`,
+                ...task.task.criteria.map(({ id, description }) => `${indent}- ${id}: ${description}`)
+            ];
+        })
+    ].join("\n");
+}
+/**
+ * Brings a worktree's reviewed work into the branch the main checkout is on,
+ * by fast-forward only, then retires the worktree. Run from the main checkout.
+ */
+export async function finishWorktree(deps, options) {
+    const name = assertWorktreeName(options.name);
+    const { mainRoot, currentRoot, commonDir } = await resolveCheckouts(deps, options.cwd);
+    if (currentRoot !== mainRoot) {
+        throw finishError("WORKTREE_NESTED", `Run worktree finish from the main checkout (${mainRoot}); Claude Code: ExitWorktree with action keep first.`);
+    }
+    const record = await readWorktreeRecord(worktreePath(mainRoot, name));
+    if (record === null) {
+        throw finishError("WORKTREE_NOT_FOUND", `No agent-ops worktree named ${name}; see agent-ops worktree list.`);
+    }
+    return await withFinishLock(deps, commonDir, async () => {
+        const mainRunner = runner(deps, mainRoot);
+        const worktreeRunner = runner(deps, record.path);
+        if ((await collectChangeSurface(mainRunner)).paths.length > 0) {
+            throw finishError("WORKTREE_MAIN_DIRTY", "The main checkout has uncommitted changes; a fast-forward would mix them in.");
+        }
+        const onBranch = (await deps.git(mainRoot, ["symbolic-ref", "--short", "-q", "HEAD"])).stdout.trim();
+        if (onBranch !== record.targetBranch) {
+            throw finishError("WORKTREE_TARGET_MOVED", `The main checkout is on ${onBranch || "a detached HEAD"}; switch it back to ${record.targetBranch} to finish.`);
+        }
+        if ((await collectChangeSurface(worktreeRunner)).paths.length > 0) {
+            throw finishError("WORKTREE_DIRTY", `Commit or discard the uncommitted changes in ${record.path} first.`);
+        }
+        const target = await git(deps, mainRoot, ["rev-parse", "--verify", `${record.targetBranch}^{commit}`], "WORKTREE_TARGET_MISSING", `${record.targetBranch} does not resolve to a commit.`);
+        const ahead = Number(await git(deps, record.path, ["rev-list", "--count", `${target}..HEAD`], "WORKTREE_LOG_FAILED", "Git could not compare the branch with its target."));
+        if (ahead === 0) {
+            throw finishError("WORKTREE_NOTHING_TO_MERGE", `${record.branch} has no commits beyond ${record.targetBranch}; remove the worktree instead.`);
+        }
+        const worktreeConfig = await deps.loadConfig(record.path);
+        // The whole branch merges, so every task in the worktree completes first,
+        // subtasks before their parents, each over the range its review covered.
+        // Before any rebase: rebasing rewrites the commits those fingerprints name.
+        const tree = taskTree((await deps.tasks(record.path).list()).filter(({ status }) => status !== "archived"));
+        if (tree.length === 0) {
+            throw finishError("WORKTREE_TASK_INCOMPLETE", "The worktree has no task; create one, verify and review it before finishing.");
+        }
+        for (const { task } of [...tree].sort((left, right) => right.depth - left.depth)) {
+            if (task.status === "complete")
+                continue;
+            const base = task.reviewBase ?? record.base;
+            try {
+                await deps.tasks(record.path, base).complete(task.task.id, {});
+            }
+            catch (error) {
+                throw finishError("WORKTREE_TASK_INCOMPLETE", `Task ${task.task.id} (${task.task.title}) could not be completed against ${base}: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
+        const worktreeGate = await deps.gate(record.path, worktreeConfig);
+        const problem = await worktreeGate.validate(record.sessionId);
+        if (problem !== null) {
+            throw finishError("WORKTREE_TASK_INCOMPLETE", `The worktree's task is not ready to merge (${problem.code}). ${problem.remedy ?? ""}`.trim());
+        }
+        const head = await git(deps, record.path, ["rev-parse", "HEAD"], "WORKTREE_LOG_FAILED", "Git could not read HEAD.");
+        const fastForward = (await deps.git(record.path, ["merge-base", "--is-ancestor", target, "HEAD"])).exitCode === 0;
+        if (!fastForward) {
+            const before = await patchHash(deps, record.path, target);
+            const rebase = await deps.git(record.path, ["rebase", "--no-autostash", target]);
+            if (rebase.exitCode !== 0) {
+                const files = (await deps.git(record.path, ["diff", "--name-only", "--diff-filter=U"])).stdout
+                    .split("\n").map((line) => line.trim()).filter(Boolean);
+                await deps.git(record.path, ["rebase", "--abort"]);
+                await deps.git(record.path, ["reset", "--hard", head]);
+                throw new WorktreeConflictError(record, target, head, files, await targetIntents(deps, record.path, target));
+            }
+            const reset = async () => { await deps.git(record.path, ["reset", "--hard", head]); };
+            if (await patchHash(deps, record.path, target) !== before) {
+                await reset();
+                throw finishError("WORKTREE_REBASE_CHANGED", `Rebasing onto ${target} changed the branch's own diff, so the review no longer covers it. The branch was reset; rebase it yourself and review the result as a new task.`);
+            }
+            if (await deps.trust.status(record.path, worktreeConfig) !== "TRUSTED") {
+                await reset();
+                throw finishError("WORKTREE_UNTRUSTED", "Re-verifying the rebased branch runs repository commands; run agent-ops trust grant in the worktree.");
+            }
+            const failed = await reverify(deps, record.path, worktreeConfig);
+            if (failed.length > 0) {
+                await reset();
+                throw finishError("WORKTREE_REVERIFY_FAILED", `After rebasing onto ${target}, verification failed: ${failed.join(", ")}. The branch was reset; fix it as a new task and finish again.`);
+            }
+        }
+        const mainConfig = await deps.loadConfig(mainRoot);
+        const gateEnabled = mainConfig.features.completionGate.enabled;
+        const before = gateEnabled ? await currentGateFingerprint(mainRoot, mainRunner) : "";
+        await git(deps, mainRoot, ["merge", "--ff-only", record.branch], "WORKTREE_MERGE_FAILED", `Git could not fast-forward ${record.targetBranch}.`);
+        const mergedHead = await git(deps, mainRoot, ["rev-parse", "HEAD"], "WORKTREE_LOG_FAILED", "Git could not read HEAD.");
+        // The merge happened; everything below is cleanup, reported, never undone.
+        const warnings = [];
+        const attempt = async (label, step) => {
+            try {
+                await step();
+            }
+            catch (error) {
+                warnings.push(`${label}: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        };
+        await attempt("note", async () => await git(deps, mainRoot, ["notes", `--ref=${NOTES_REF}`, "add", "-f", "-m", noteText(record, tree), mergedHead], "WORKTREE_NOTE_FAILED", "Git could not write the agent-ops note."));
+        if (gateEnabled) {
+            await attempt("gate", async () => {
+                const mainGate = await deps.gate(mainRoot, mainConfig);
+                await mainGate.redirect(record.sessionId, null);
+                await mainGate.rebase(before, await currentGateFingerprint(mainRoot, mainRunner));
+            });
+        }
+        await attempt("trust", async () => await deps.trust.revoke(record.path, worktreeConfig));
+        await attempt("remove", async () => await removeCheckout(deps, record, true));
+        return { record, mergedHead, rebased: !fastForward, taskIds: tree.map(({ task }) => task.task.id), warnings };
+    });
+}

package/dist/runtime/src/parallel/guard.js

@@ -0,0 +1,76 @@
+import { realpath } from "node:fs/promises";
+import { basename, dirname, join, relative, sep } from "node:path";
+import { insideWorktreeDirectory } from "./service.js";
+/** The main checkout of the repository `runner` runs in, or null. */
+export async function resolveMainRoot(runner) {
+    const result = await runner.run(["rev-parse", "--path-format=absolute", "--git-common-dir"]);
+    if (result.exitCode !== 0)
+        return null;
+    try {
+        const commonDir = await realpath(new TextDecoder().decode(result.stdout).trim());
+        return basename(commonDir) === ".git" ? dirname(commonDir) : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The real path of `path`, resolved through its deepest existing ancestor: a
+ * Write creates files that do not exist yet, and a symlinked spelling of the
+ * repository must not decide whether an edit lands in the main checkout.
+ */
+export async function canonicalPath(path) {
+    const pending = [];
+    let current = path;
+    for (;;) {
+        try {
+            return join(await realpath(current), ...pending.reverse());
+        }
+        catch {
+            const parent = dirname(current);
+            if (parent === current)
+                return path;
+            pending.push(basename(current));
+            current = parent;
+        }
+    }
+}
+/**
+ * In worktree auto mode the main checkout is shared by every session, so no
+ * session writes it directly: each edit belongs in that session's own
+ * `.worktrees/<name>`. Paths outside the repository are not this guard's
+ * business.
+ */
+export async function evaluateWorktreeWrite(mainRoot, paths, sessionId, 
+/** Creates or reuses this session's worktree and returns its path. */
+ensureWorktree) {
+    for (const path of paths) {
+        const target = await canonicalPath(path);
+        const inMain = target === mainRoot || target.startsWith(`${mainRoot}${sep}`);
+        if (inMain && !insideWorktreeDirectory(mainRoot, target)) {
+            let failure = "";
+            if (sessionId !== undefined && ensureWorktree !== undefined) {
+                try {
+                    const worktree = await ensureWorktree(sessionId);
+                    return {
+                        action: "block",
+                        status: "FAIL",
+                        code: "WORKTREE_CREATED",
+                        remedy: `worktree.mode is auto, so this session now has its own worktree at ${worktree}. Enter it (Claude Code: EnterWorktree with path ${worktree}) and redo this edit there, at ${join(worktree, relative(mainRoot, target))}.`
+                    };
+                }
+                catch (error) {
+                    failure = ` Creating this session's worktree failed: ${error instanceof Error ? error.message : String(error)}`;
+                }
+            }
+            const session = sessionId ?? "<session-id>";
+            return {
+                action: "block",
+                status: "FAIL",
+                code: "WORKTREE_REQUIRED",
+                remedy: `worktree.mode is auto, so the main checkout is shared and not edited directly.${failure} Run \`agent-ops worktree add <name> --session ${session}\` in ${mainRoot}, enter the printed path (Claude Code: EnterWorktree with that path), and edit there.`
+            };
+        }
+    }
+    return { action: "continue", status: "PASS", code: "WORKTREE_WRITE_ALLOWED" };
+}

package/dist/runtime/src/parallel/manage.js

@@ -0,0 +1,147 @@
+import { readdir, realpath, stat } from "node:fs/promises";
+import { join, resolve } from "node:path";
+import { sha256 } from "../fs/hash.js";
+import { AgentOpsError } from "../fs/paths.js";
+import { collectChangeSurface } from "../verify/change-surface.js";
+import { assertSessionId, assertWorktreeName, bindSession, insideWorktreeDirectory, readWorktreeRecord, removeCheckout, resolveCheckouts, worktreePath, writeWorktreeRecord } from "./service.js";
+/**
+ * A baseline no source state hashes to. A resumed session inherits whatever
+ * the last one left in the worktree, so none of it counts as "unchanged".
+ */
+export const RESUMED_BASELINE = sha256("agent-ops-worktree-resumed");
+export const IDLE_DAYS = 7;
+function manageError(code, message) {
+    return new AgentOpsError(code, message);
+}
+async function mainCheckout(deps, cwd) {
+    const { mainRoot, currentRoot } = await resolveCheckouts(deps, cwd);
+    if (currentRoot !== mainRoot) {
+        throw manageError("WORKTREE_NESTED", `Run this from the main checkout (${mainRoot}).`);
+    }
+    return mainRoot;
+}
+async function mtime(path) {
+    try {
+        return (await stat(path)).mtimeMs;
+    }
+    catch {
+        return 0;
+    }
+}
+/** The last time anything agent-ops tracks moved in the worktree. */
+async function lastActivity(record) {
+    const gate = join(record.path, ".agent-ops", "tasks", "completion-gate");
+    const times = [
+        Date.parse(record.createdAt) || 0,
+        await mtime(join(record.path, ".agent-ops", "tasks", "state.json")),
+        ...await Promise.all((await readdir(gate).catch(() => []))
+            .map(async (name) => await mtime(join(gate, name))))
+    ];
+    return new Date(Math.max(...times)).toISOString();
+}
+async function describe(deps, record) {
+    const runner = {
+        run: async (args) => {
+            const result = await deps.git(record.path, args);
+            return { exitCode: result.exitCode, stdout: Buffer.from(result.stdout, "utf8") };
+        }
+    };
+    const dirty = (await collectChangeSurface(runner).catch(() => ({ paths: ["?"] }))).paths.length > 0;
+    const count = await deps.git(record.path, ["rev-list", "--count", `${record.targetBranch}..HEAD`]);
+    const taskStatus = await deps.tasks(record.path).status({ sessionId: record.sessionId })
+        .then((task) => `${task.task.id} ${task.status}`)
+        .catch(() => "none");
+    return {
+        record,
+        dirty,
+        ahead: count.exitCode === 0 ? Number(count.stdout.trim()) : 0,
+        taskStatus,
+        lastActivity: await lastActivity(record)
+    };
+}
+/** Every agent-ops worktree of this repository, from any of its checkouts. */
+export async function listWorktrees(deps, cwd) {
+    const { mainRoot } = await resolveCheckouts(deps, cwd);
+    const listing = await deps.git(mainRoot, ["worktree", "list", "--porcelain"]);
+    if (listing.exitCode !== 0) {
+        throw manageError("WORKTREE_LIST_FAILED", "Git could not list worktrees.");
+    }
+    const statuses = [];
+    for (const line of listing.stdout.split("\n")) {
+        if (!line.startsWith("worktree "))
+            continue;
+        // Git prints forward slashes on Windows; mainRoot is a native real path.
+        const listed = resolve(line.slice("worktree ".length));
+        const path = await realpath(listed).catch(() => listed);
+        if (!insideWorktreeDirectory(mainRoot, path))
+            continue;
+        const record = await readWorktreeRecord(path);
+        if (record !== null)
+            statuses.push(await describe(deps, record));
+    }
+    return statuses.sort((left, right) => left.record.name.localeCompare(right.record.name));
+}
+export function idleWorktrees(statuses, now) {
+    return statuses.filter(({ lastActivity: at }) => now - Date.parse(at) > IDLE_DAYS * 24 * 60 * 60 * 1000);
+}
+/** Doctor's reading of the worktrees: idle ones are worth a look, not a failure. */
+export function worktreeDoctorResult(statuses, now) {
+    const idle = idleWorktrees(statuses, now);
+    return idle.length === 0
+        ? { status: "PASS", message: `${statuses.length} agent-ops worktree(s), none idle.` }
+        : {
+            status: "DEGRADED",
+            message: `Idle for more than ${IDLE_DAYS} days: ${idle.map(({ record }) => record.name).join(", ")}.`,
+            remediation: "Resume, finish or remove them; see agent-ops worktree list."
+        };
+}
+async function requireRecord(mainRoot, name) {
+    const record = await readWorktreeRecord(worktreePath(mainRoot, name));
+    if (record === null) {
+        throw manageError("WORKTREE_NOT_FOUND", `No agent-ops worktree named ${name}; see agent-ops worktree list.`);
+    }
+    return record;
+}
+/**
+ * Hands a worktree whose session ended to a new one: the task, the gate and
+ * the record follow the new id, and the new session's first Stop has to
+ * account for everything already in the worktree.
+ */
+export async function resumeWorktree(deps, options) {
+    const name = assertWorktreeName(options.name);
+    const sessionId = assertSessionId(options.sessionId);
+    const mainRoot = await mainCheckout(deps, options.cwd);
+    const previous = await requireRecord(mainRoot, name);
+    const tasks = deps.tasks(previous.path);
+    const attached = await tasks.status({ sessionId: previous.sessionId }).catch(() => null);
+    if (attached !== null)
+        await tasks.attach(sessionId, attached.task.id);
+    const record = { ...previous, sessionId };
+    await writeWorktreeRecord(record);
+    const mainConfig = await deps.loadConfig(mainRoot);
+    if (mainConfig.features.completionGate.enabled && previous.sessionId !== sessionId) {
+        await (await deps.gate(mainRoot, mainConfig)).redirect(previous.sessionId, null);
+    }
+    await bindSession(deps, record, mainConfig, RESUMED_BASELINE);
+    return record;
+}
+/**
+ * Deletes a worktree and its branch. Work that exists nowhere else — an
+ * uncommitted change or a commit the target lacks — needs `force`.
+ */
+export async function removeWorktree(deps, options) {
+    const name = assertWorktreeName(options.name);
+    const mainRoot = await mainCheckout(deps, options.cwd);
+    const status = await describe(deps, await requireRecord(mainRoot, name));
+    if ((status.dirty || status.ahead > 0) && !options.force) {
+        throw manageError("WORKTREE_UNMERGED", `${name} has ${status.dirty ? "uncommitted changes" : ""}${status.dirty && status.ahead > 0 ? " and " : ""}${status.ahead > 0 ? `${status.ahead} commit(s) not in ${status.record.targetBranch}` : ""}. Finish it, or remove it with --force to discard that work (the user is asked).`);
+    }
+    const { record } = status;
+    const mainConfig = await deps.loadConfig(mainRoot);
+    if (mainConfig.features.completionGate.enabled) {
+        await (await deps.gate(mainRoot, mainConfig)).redirect(record.sessionId, null);
+    }
+    await deps.trust.revoke(record.path, await deps.loadConfig(record.path)).catch(() => undefined);
+    await removeCheckout(deps, record, true);
+    return status;
+}