@north-light/crouter 0.3.318 → 0.3.320

package/dist/core/worktree-sweep.js

@@ -1,453 +1,6 @@
-// The ONE authority that physically disposes of a managed worktree after its
-// owning node is gone.
-//
-// Close, cancel, crash, and prune do not each grow a cleanup hook: they only
-// change durable state, and this primitive derives everything it does from that
-// state. It is idempotent and restartable, because Git effects and canvas
-// metadata are not one transaction — a crash between any two steps is resumed
-// by the next pass rather than repaired by hand.
-//
-// EVERY Git call here is `gitAsync`. This runs inside crtrd, whose event loop
-// also drives broker supervision and the API socket; a `spawnSync` in this path
-// would stall the whole daemon for the duration of every Git call, and a Git
-// call on a large repository is not short.
-//
-// The synchronous twin of the landing sequence lives in `worktree.ts` (`close`,
-// which runs in an API handler). The judgment both forms share — what is safe
-// to stash, what must be refused — lives once in `worktree-landing.ts`.
-import { createHash } from 'node:crypto';
-import { existsSync, realpathSync } from 'node:fs';
-import { resolve } from 'node:path';
-import { completeCleanup, getNode, recordSweepAttempt } from './canvas/index.js';
-import { withExclusiveDirectoryLockAsync } from './exclusive-lock.js';
-import { gitAsync } from './git.js';
-import { proveBranchContained, upstreamTip } from './worktree-containment.js';
-import { parseStatusPorcelain, planLandIntoCheckout, refDeleteTransactionStdin } from './worktree-landing.js';
-import { shellQuote } from '../shared/shell-quote.js';
-import { WORKTREE_LOCK_WAIT_MS, checkoutPathForBranchInList, samePath, worktreeLockPathForCommonDir } from './worktree.js';
-/** Escalating recheck interval, in minutes, indexed by consecutive refusal. The
- *  last tier is the cap AND the quarantine threshold: at that point the record
- *  needs a human, so it is listed by `crtr sys worktrees` and costs one cheap
- *  fingerprint read an hour until something about it actually changes. */
-const BACKOFF_MINUTES = [2, 5, 15, 30, 60];
-const QUARANTINE_ATTEMPTS = BACKOFF_MINUTES.length;
-/** A record this sweep still owns: open, or closed without proven cleanup. An
- *  abandoned record is deliberately out of scope — abandon already removed the
- *  checkout and retains its branch for a person on purpose. */
-export function isReconcilable(wt) {
-    if (wt == null || wt.state === 'abandoned')
-        return false;
-    return wt.state === 'open' || wt.cleanup !== 'complete';
-}
-/** Whether the sweep should examine this record on a pass starting at `now`. A
- *  record with no recorded refusal is always due. */
-export function isDueForSweep(wt, now) {
-    const next = wt.sweep?.next_attempt;
-    if (next === undefined)
-        return true;
-    const at = Date.parse(next);
-    return Number.isNaN(at) || at <= now;
-}
-// Git plumbing, all async
-async function revParseRef(cwd, ref) {
-    const res = await gitAsync(['rev-parse', '--verify', '--quiet', ref], cwd);
-    return res.status === 0 ? res.stdout.trim() : null;
-}
-function detailOf(res) {
-    return (res.stderr.trim() || res.stdout.trim()).trim();
-}
-async function commonGitDirAsync(cwd) {
-    const res = await gitAsync(['rev-parse', '--git-common-dir'], cwd);
-    if (res.status !== 0)
-        return null;
-    try {
-        return realpathSync(resolve(cwd, res.stdout.trim()));
-    }
-    catch {
-        return null;
-    }
-}
-async function isRebaseInProgressAsync(cwd) {
-    for (const logical of ['rebase-merge', 'rebase-apply']) {
-        const res = await gitAsync(['rev-parse', '--git-path', logical], cwd);
-        if (res.status !== 0)
-            return null;
-        if (existsSync(resolve(cwd, res.stdout.trim())))
-            return true;
-    }
-    return false;
-}
-/** The repository's main checkout, from a `git worktree list --porcelain` blob:
- *  Git always lists it first. Every administrative command runs from there, so
- *  removing a linked checkout never runs Git from inside the directory it is
- *  deleting. */
-function mainWorktreePath(porcelain) {
-    for (const line of porcelain.split('\n')) {
-        if (line.startsWith('worktree '))
-            return line.slice('worktree '.length).trim();
-    }
-    return null;
-}
-/** Git's own spelling of the recorded checkout when it is registered to the
- *  recorded branch, else null. Ownership is a path IDENTITY question, not a
- *  string question — `samePath` resolves both spellings — and the answer is
- *  Git's canonical path so every later Git call names the checkout the way the
- *  repository's administrative metadata does. */
-function registeredCheckoutPath(porcelain, path, branch) {
-    let current = null;
-    for (const line of porcelain.split('\n')) {
-        if (line.startsWith('worktree '))
-            current = line.slice('worktree '.length).trim();
-        else if (current !== null && line === `branch refs/heads/${branch}` && samePath(current, path))
-            return current;
-    }
-    return null;
-}
-// Content containment is shared with explicit close. A delivered branch is
-// never rebased onto a local base merely because that base later diverged.
-// Change detection
-/** Base, upstream, and branch tips plus checkout state as they are right now.
- *  A pass that reads the same values as the refusal that preceded it can stop
- *  there: nothing that decided the refusal has moved. An unreadable checkout
- *  records `null`, which never compares equal, so uncertainty always re-proves. */
-async function observe(wt) {
-    const present = existsSync(wt.path);
-    const cwd = present ? wt.path : wt.repo_root;
-    const base = await revParseRef(cwd, `refs/heads/${wt.base_ref}`);
-    const upstream = await upstreamTip(cwd, wt.base_ref);
-    const branch = await revParseRef(cwd, `refs/heads/${wt.branch}`);
-    if (!present)
-        return { base, upstream: upstream?.sha ?? null, branch, checkout: 'absent' };
-    const head = await gitAsync(['rev-parse', 'HEAD'], wt.path);
-    const status = await gitAsync(['status', '--porcelain'], wt.path);
-    const checkout = head.status !== 0 || status.status !== 0
-        ? null
-        : createHash('sha256').update(`${head.stdout.trim()}\n${status.stdout}`).digest('hex');
-    return { base, upstream: upstream?.sha ?? null, branch, checkout };
-}
-function sameObservation(a, b) {
-    if (a.checkout === null || b.checkout === null)
-        return false;
-    return a.base === b.base && a.upstream === b.upstream && a.branch === b.branch && a.checkout === b.checkout;
-}
-// Recording an unfinished pass
-/** Persist why this pass did not finish, with the fingerprint it decided
- *  against and an escalated recheck time. This NEVER writes completion and
- *  never drops the authoritative record: the checkout, the branch, and the node
- *  metadata that proves who owns them all survive a refusal. */
-function recordUnfinished(nodeId, wt, outcome, observed, now, guard) {
-    if (outcome.status !== 'refused' && outcome.status !== 'failed')
-        return;
-    // A node that came back to life owns its own record again: backoff written
-    // from a pass it invalidated would sit on the revived node's metadata.
-    if (!guard.stillEligible())
-        return;
-    const attempts = (wt.sweep?.attempts ?? 0) + 1;
-    const minutes = BACKOFF_MINUTES[Math.min(attempts, BACKOFF_MINUTES.length) - 1] ?? BACKOFF_MINUTES[0];
-    const current = getNode(nodeId)?.managed_worktree;
-    if (current == null || !isReconcilable(current))
-        return;
-    recordSweepAttempt(nodeId, {
-        reason: outcome.reason,
-        ...(outcome.detail === undefined ? {} : { detail: outcome.detail }),
-        observed,
-        attempts,
-        lastAttemptAt: new Date(now).toISOString(),
-        nextAttemptAt: new Date(now + minutes * 60_000).toISOString(),
-        quarantined: attempts >= QUARANTINE_ATTEMPTS,
-    });
-}
-// Landing a blocked close the sweep is allowed to finish
-/** The asynchronous twin of `worktree.ts`'s `landIntoBaseCheckout`. Same
- *  sequence, same guarantees: stash only what overlaps, `apply` rather than
- *  `pop` so a conflict cannot consume the stash, and never leave a checkout
- *  other nodes share in a conflicted state. */
-async function landIntoBaseCheckoutAsync(baseCheckout, branch, baseSha, landedSha, guard) {
-    const status = await gitAsync(['status', '--porcelain'], baseCheckout);
-    if (status.status !== 0)
-        return { ok: false, detail: detailOf(status) };
-    const diff = await gitAsync(['diff', '--name-only', baseSha, landedSha], baseCheckout);
-    if (diff.status !== 0)
-        return { ok: false, detail: detailOf(diff) };
-    const incoming = diff.stdout.split('\n').map((l) => l.trim()).filter((l) => l !== '');
-    const plan = planLandIntoCheckout(parseStatusPorcelain(status.stdout), incoming);
-    if (plan.kind === 'refuse') {
-        return { ok: false, detail: `untracked files in ${baseCheckout} would be overwritten by the incoming commits: ${plan.collisions.join(', ')}` };
-    }
-    // The last recheck before this sequence starts. Once a stash exists the
-    // remaining steps MUST run to completion — abandoning a stashed checkout
-    // halfway is worse than finishing a land the node no longer needs.
-    if (!guard.stillEligible())
-        return { ok: false, detail: 'node is no longer terminal', ineligible: true };
-    const merge = async () => {
-        const res = await gitAsync(['merge', '--ff-only', landedSha], baseCheckout);
-        return res.status === 0 ? { ok: true } : { ok: false, detail: detailOf(res) };
-    };
-    if (plan.kind === 'direct')
-        return merge();
-    const beforeSha = await revParseRef(baseCheckout, 'refs/stash');
-    const push = await gitAsync(['stash', 'push', '--message', `crtr landing ${branch}`], baseCheckout);
-    if (push.status !== 0)
-        return { ok: false, detail: detailOf(push) };
-    const stashSha = await revParseRef(baseCheckout, 'refs/stash');
-    if (stashSha === null || stashSha === beforeSha)
-        return merge(); // nothing was saved
-    const recovery = `local changes from ${baseCheckout} are retained in stash ${stashSha}; recover them with \`git -C ${shellQuote(baseCheckout)} stash apply ${stashSha}\` and resolve any conflict.`;
-    const landed = await merge();
-    if (!landed.ok) {
-        if ((await gitAsync(['stash', 'apply', stashSha], baseCheckout)).status === 0) {
-            await dropStashIfStillTip(baseCheckout, stashSha);
-            return landed;
-        }
-        return { ok: false, detail: `${landed.detail}\n${recovery}` };
-    }
-    if ((await gitAsync(['stash', 'apply', stashSha], baseCheckout)).status === 0) {
-        await dropStashIfStillTip(baseCheckout, stashSha);
-        return { ok: true };
-    }
-    await gitAsync(['reset', '--hard', landedSha], baseCheckout);
-    return { ok: true, stash: `the shared base checkout was reset to landed commit ${landedSha} because local changes conflicted with it. ${recovery}` };
-}
-async function dropStashIfStillTip(cwd, stashSha) {
-    if ((await revParseRef(cwd, 'refs/stash')) === stashSha)
-        await gitAsync(['stash', 'drop'], cwd);
-}
-/** Finish the land this node already asked for and was blocked on. The sweep
- *  reaches here ONLY for a record carrying `land_intent`: a node that crashed
- *  mid-work and never called close does not get its half-finished commits
- *  fast-forwarded onto a shared base branch. */
-async function finishBlockedLand(wt, porcelain, guard) {
-    const baseSha = await revParseRef(wt.path, `refs/heads/${wt.base_ref}`);
-    if (baseSha === null)
-        return { ok: false, detail: `local base branch '${wt.base_ref}' does not resolve` };
-    if (!guard.stillEligible())
-        return { ok: false, detail: 'node is no longer terminal', ineligible: true };
-    const rebase = await gitAsync(['rebase', baseSha], wt.path);
-    if (rebase.status !== 0) {
-        // A conflicted rebase must never be left in progress: the next pass would
-        // read a mid-operation checkout and refuse forever.
-        await gitAsync(['rebase', '--abort'], wt.path);
-        return { ok: false, detail: detailOf(rebase) };
-    }
-    const landedSha = await revParseRef(wt.path, 'HEAD');
-    if (landedSha === null)
-        return { ok: false, detail: 'could not read the rebased worktree tip' };
-    if ((await gitAsync(['merge-base', '--is-ancestor', baseSha, landedSha], wt.path)).status !== 0) {
-        return { ok: false, detail: `the rebased branch is not a fast-forward of '${wt.base_ref}'` };
-    }
-    const baseCheckout = checkoutPathForBranchInList(porcelain, wt.base_ref);
-    if (baseCheckout === null) {
-        if (!guard.stillEligible())
-            return { ok: false, detail: 'node is no longer terminal', ineligible: true };
-        const update = await gitAsync(['update-ref', `refs/heads/${wt.base_ref}`, landedSha, baseSha], wt.path);
-        return update.status === 0 ? { ok: true, landedSha } : { ok: false, detail: detailOf(update) };
-    }
-    const head = await gitAsync(['rev-parse', 'HEAD'], baseCheckout);
-    if (head.status !== 0 || head.stdout.trim() !== baseSha) {
-        return { ok: false, detail: `base checkout ${baseCheckout} is not at ${baseSha}` };
-    }
-    const landed = await landIntoBaseCheckoutAsync(baseCheckout, wt.branch, baseSha, landedSha, guard);
-    return landed.ok ? { ok: true, landedSha, ...(landed.stash === undefined ? {} : { stash: landed.stash }) } : landed;
-}
-/** The one outcome for "the node came back" — never a failure, never recorded as
- *  a refusal, because nothing about the worktree is wrong. */
-const NODE_REVIVED = { status: 'skipped', reason: 'node_no_longer_terminal' };
-/** Dispose of one node's managed worktree, or explain why it must survive.
- *
- *  Ownership is proved from crouter's own node record, never from
- *  `git worktree list`: a checkout the user or another tool created has no node
- *  record and is never reachable from here. Under the repository lock the
- *  recorded path is confirmed REGISTERED to the recorded branch — a path match
- *  alone is not ownership — and removal is `git worktree remove <recorded
- *  path>` without `--force`. `git worktree prune` is never run: it is
- *  repo-wide and would touch administrative entries for worktrees crouter does
- *  not own.
- *
- *  Effects are ordered checkout → branch → metadata so every interruption is
- *  resumable: a crash before removal retries from pending; after removal but
- *  before the branch delete, the branch is still an intact ref the next pass
- *  finds; after both, the next pass observes both absent and marks complete. */
-export async function reconcileManagedWorktree(nodeId, guard, now = Date.now()) {
-    const wt = getNode(nodeId)?.managed_worktree;
-    if (!isReconcilable(wt) || wt == null)
-        return { status: 'skipped', reason: 'already_reconciled' };
-    const cwd = existsSync(wt.path) ? wt.path : wt.repo_root;
-    if (!existsSync(cwd)) {
-        return finish(nodeId, wt, { status: 'refused', reason: 'repo_unavailable', detail: `neither the recorded checkout nor repository root exists, so ${wt.branch} cannot be proved absent` }, { base: null, upstream: null, branch: null, checkout: null }, now, guard);
-    }
-    const commonDir = await commonGitDirAsync(cwd);
-    if (commonDir === null) {
-        return finish(nodeId, wt, { status: 'failed', reason: 'git_dir_unreadable', detail: `could not resolve the git common dir from ${cwd}` }, { base: null, upstream: null, branch: null, checkout: null }, now, guard);
-    }
-    let observed = { base: null, upstream: null, branch: null, checkout: null };
-    let outcome;
-    try {
-        outcome = await withExclusiveDirectoryLockAsync(worktreeLockPathForCommonDir(commonDir), async () => {
-            if (!guard.stillEligible())
-                return NODE_REVIVED;
-            const locked = getNode(nodeId)?.managed_worktree;
-            if (!isReconcilable(locked) || locked == null)
-                return { status: 'skipped', reason: 'already_reconciled' };
-            observed = await observe(locked);
-            if (locked.sweep !== undefined && sameObservation(locked.sweep.observed, observed)) {
-                return { status: 'refused', reason: locked.sweep.reason, ...(locked.sweep.detail === undefined ? {} : { detail: locked.sweep.detail }), unchanged: true };
-            }
-            return existsSync(locked.path)
-                ? await reconcilePresentCheckout(nodeId, locked, guard)
-                : await concludeAbsentCheckout(nodeId, locked, observed, guard);
-        }, {
-            timeoutMs: WORKTREE_LOCK_WAIT_MS,
-            timeoutError: () => new Error(`timed out waiting for the managed-worktree lock on ${commonDir}`),
-        });
-    }
-    catch (err) {
-        outcome = { status: 'failed', reason: 'lock_unavailable', detail: err instanceof Error ? err.message : String(err) };
-    }
-    return finish(nodeId, wt, outcome, observed, now, guard);
-}
-function finish(nodeId, wt, outcome, observed, now, guard) {
-    recordUnfinished(nodeId, wt, outcome, observed, now, guard);
-    return outcome;
-}
-/** Record completion against the record as it stands NOW, never the copy this
- *  pass began with: the fresh read is what keeps a concurrently-rewritten record
- *  (a revived node's, or one a human edited) from being overwritten with this
- *  pass's stale fields. A record that moved out from under the pass is left
- *  alone — its checkout and branch are already gone, so the next pass observes
- *  both absent and concludes it cleanly. */
-function persistComplete(nodeId, wt, guard) {
-    if (!guard.stillEligible())
-        return NODE_REVIVED;
-    const current = getNode(nodeId)?.managed_worktree;
-    if (current == null || current.path !== wt.path || current.branch !== wt.branch) {
-        return { status: 'skipped', reason: 'record_changed' };
-    }
-    completeCleanup(nodeId);
-    return { status: 'complete' };
-}
-/** Resume a record whose checkout is already gone — the crash-after-removal
- *  case, and the case where the checkout was removed by hand. Filesystem
- *  absence proves nothing about commits, so the branch is still proved before
- *  it is deleted. */
-async function concludeAbsentCheckout(nodeId, wt, observed, guard) {
-    const admin = wt.repo_root;
-    if (observed.branch === null) {
-        // Distinguish "the ref is gone" from "the read failed"; only the first
-        // authorizes concluding this record.
-        const exists = await gitAsync(['show-ref', '--verify', '--quiet', `refs/heads/${wt.branch}`], admin);
-        if (exists.status !== 1)
-            return { status: 'failed', reason: 'branch_inspection_failed', detail: detailOf(exists) };
-        return persistComplete(nodeId, wt, guard);
-    }
-    const list = await gitAsync(['worktree', 'list', '--porcelain'], admin);
-    if (list.status !== 0)
-        return { status: 'failed', reason: 'worktree_list_failed', detail: detailOf(list) };
-    // The recorded path being absent does NOT mean the branch has no checkout:
-    // `git worktree move` relocates one. Deleting a branch checked out elsewhere
-    // would bypass Git's own protection and could abandon uncommitted work there.
-    const elsewhere = checkoutPathForBranchInList(list.stdout, wt.branch);
-    if (elsewhere !== null) {
-        return { status: 'refused', reason: 'branch_checked_out_elsewhere', detail: `${wt.branch} is checked out at ${elsewhere}` };
-    }
-    const proof = await proveBranchContained(admin, wt, observed.branch);
-    if (proof === null) {
-        return { status: 'refused', reason: 'unlanded_work', detail: `${wt.branch} carries content no base or upstream ref contains; its checkout is already gone, so the branch is the only copy` };
-    }
-    return deleteBranchAndComplete(nodeId, wt, admin, observed.branch, proof, guard);
-}
-/** The ordinary case: a checkout that still exists and whose owner is gone. */
-async function reconcilePresentCheckout(nodeId, wt, guard) {
-    const list = await gitAsync(['worktree', 'list', '--porcelain'], wt.path);
-    if (list.status !== 0)
-        return { status: 'failed', reason: 'worktree_list_failed', detail: detailOf(list) };
-    // An explicit `close` already proved a branch-moved checkout's identity and
-    // authorized its later disposal for THIS exact branch — never adopted here.
-    // Only the recorded authorization changes which branch this pass expects;
-    // everything else below is re-verified exactly as for an ordinary record.
-    const disposal = wt.disposal;
-    const expectedBranch = disposal?.observed_branch ?? wt.branch;
-    const registeredPath = registeredCheckoutPath(list.stdout, wt.path, expectedBranch);
-    if (registeredPath === null) {
-        return { status: 'refused', reason: 'not_registered', detail: `${wt.path} is not registered to refs/heads/${expectedBranch}; crtr will not act on a path it cannot prove it owns` };
-    }
-    const main = mainWorktreePath(list.stdout);
-    if (main === null || samePath(main, registeredPath) || !existsSync(main)) {
-        return { status: 'refused', reason: 'repo_unavailable', detail: `the repository's main checkout is unavailable, so ${wt.path} cannot be removed from outside itself` };
-    }
-    const midOperation = await isRebaseInProgressAsync(wt.path);
-    if (midOperation === null)
-        return { status: 'failed', reason: 'git_path_failed', detail: `could not inspect in-progress operations in ${wt.path}` };
-    if (midOperation)
-        return { status: 'refused', reason: 'rebase_in_progress', detail: `${wt.path} is mid-rebase` };
-    const head = await gitAsync(['rev-parse', '--abbrev-ref', 'HEAD'], wt.path);
-    if (head.status !== 0)
-        return { status: 'failed', reason: 'branch_check_failed', detail: detailOf(head) };
-    if (head.stdout.trim() !== expectedBranch) {
-        return { status: 'refused', reason: 'wrong_branch', detail: `expected ${expectedBranch}, found ${head.stdout.trim() === 'HEAD' ? 'detached HEAD' : head.stdout.trim()}` };
-    }
-    // Uncommitted work blocks removal unconditionally. No containment proof
-    // overrides this: those reason about committed content, and nothing here has
-    // any claim on changes a person or a dead node never committed.
-    const status = await gitAsync(['status', '--porcelain'], wt.path);
-    if (status.status !== 0)
-        return { status: 'failed', reason: 'status_failed', detail: detailOf(status) };
-    if (status.stdout.trim() !== '') {
-        return { status: 'refused', reason: 'dirty_worktree', detail: `${wt.path} has uncommitted changes` };
-    }
-    let branchSha = await revParseRef(wt.path, 'HEAD');
-    if (branchSha === null)
-        return { status: 'failed', reason: 'head_unreadable', detail: `could not read HEAD in ${wt.path}` };
-    if (disposal !== undefined) {
-        // Re-verify the exact identity `close` authorized before mutating anything.
-        // A mismatch invalidates the authorization instead of adopting whatever is
-        // observed now — only the explicit command that wrote it may refresh it.
-        const commonDir = await commonGitDirAsync(wt.path);
-        if (commonDir !== disposal.common_dir || branchSha !== disposal.observed_sha) {
-            return { status: 'refused', reason: 'disposal_authorization_stale', detail: `${wt.path} changed since \`close\` authorized its disposal; rerun \`crtr node worktree close\` from that node to re-authorize, or ask the user with \`crtr human send\`` };
-        }
-        if (!guard.stillEligible())
-            return NODE_REVIVED;
-        const removed = await gitAsync(['worktree', 'remove', registeredPath], main);
-        if (removed.status !== 0)
-            return { status: 'refused', reason: 'worktree_remove_failed', detail: detailOf(removed) };
-        // `disposal.observed_branch` is not a `crtr/*` branch crouter created — it
-        // is preserved, never deleted, unlike the ordinary path below.
-        return persistComplete(nodeId, wt, guard);
-    }
-    let proof = await proveBranchContained(wt.path, wt, branchSha);
-    let stash;
-    if (proof === null && wt.land_intent !== undefined) {
-        const landed = await finishBlockedLand(wt, list.stdout, guard);
-        if (!landed.ok)
-            return landed.ineligible === true ? NODE_REVIVED : { status: 'refused', reason: 'land_blocked', detail: landed.detail };
-        branchSha = landed.landedSha;
-        stash = landed.stash;
-        proof = await proveBranchContained(wt.path, wt, branchSha);
-    }
-    if (proof === null) {
-        return { status: 'refused', reason: 'unlanded_work', detail: `${wt.branch} carries commits its base does not contain, and this node never asked to land them` };
-    }
-    // The last read-only moment. Everything past here destroys something, so the
-    // guard answers immediately before each step rather than once at the top.
-    if (!guard.stillEligible())
-        return NODE_REVIVED;
-    const removed = await gitAsync(['worktree', 'remove', registeredPath], main);
-    if (removed.status !== 0)
-        return { status: 'refused', reason: 'worktree_remove_failed', detail: detailOf(removed) };
-    const completed = await deleteBranchAndComplete(nodeId, wt, main, branchSha, proof, guard);
-    return completed.status === 'complete' && stash !== undefined ? { status: 'complete', stash } : completed;
-}
-/** Compare-and-delete the branch against the EXACT SHAs the proof inspected,
- *  then record completion. A lost race leaves the branch intact, so the work
- *  stays reachable — and leaves the record incomplete, so its node metadata is
- *  still protected from prune and the next pass retries. */
-async function deleteBranchAndComplete(nodeId, wt, admin, branchSha, proof, guard) {
-    if (!guard.stillEligible())
-        return NODE_REVIVED;
-    const stdin = refDeleteTransactionStdin(wt.branch, branchSha, proof.containingRef, proof.containingSha);
-    const transaction = await gitAsync(['update-ref', '--stdin'], admin, stdin);
-    if (transaction.status !== 0) {
-        return { status: 'refused', reason: 'branch_delete_failed', detail: detailOf(transaction) };
-    }
-    return persistComplete(nodeId, wt, guard);
-}
+var L=Object.defineProperty;var c=(e,t)=>L(e,"name",{value:t,configurable:!0});import{createHash as M}from"node:crypto";import{existsSync as w,realpathSync as W}from"node:fs";import{resolve as T}from"node:path";import{completeCleanup as F,getNode as v,recordSweepAttempt as q}from"./canvas/index.js";import{withExclusiveDirectoryLockAsync as z}from"./exclusive-lock.js";import{gitAsync as u}from"./git.js";import{proveBranchContained as A,upstreamTip as K}from"./worktree-containment.js";import{parseStatusPorcelain as U,planLandIntoCheckout as Q,refDeleteTransactionStdin as V}from"./worktree-landing.js";import{shellQuote as j}from"../shared/shell-quote.js";import{WORKTREE_LOCK_WAIT_MS as C,checkoutPathForBranchInList as H,samePath as O,worktreeLockPathForCommonDir as G}from"./worktree.js";const E=[2,5,15,30,60],I=E.length;function D(e){return e==null||e.state==="abandoned"?!1:e.state==="open"||e.cleanup!=="complete"}c(D,"isReconcilable");function ke(e,t){const r=e.sweep?.next_attempt;if(r===void 0)return!0;const a=Date.parse(r);return Number.isNaN(a)||a<=t}c(ke,"isDueForSweep");async function b(e,t){const r=await u(["rev-parse","--verify","--quiet",t],e);return r.status===0?r.stdout.trim():null}c(b,"revParseRef");function d(e){return(e.stderr.trim()||e.stdout.trim()).trim()}c(d,"detailOf");async function N(e){const t=await u(["rev-parse","--git-common-dir"],e);if(t.status!==0)return null;try{return W(T(e,t.stdout.trim()))}catch{return null}}c(N,"commonGitDirAsync");async function J(e){for(const t of["rebase-merge","rebase-apply"]){const r=await u(["rev-parse","--git-path",t],e);if(r.status!==0)return null;if(w(T(e,r.stdout.trim())))return!0}return!1}c(J,"isRebaseInProgressAsync");function X(e){for(const t of e.split(`
+`))if(t.startsWith("worktree "))return t.slice(9).trim();return null}c(X,"mainWorktreePath");function Y(e,t,r){let a=null;for(const n of e.split(`
+`))if(n.startsWith("worktree "))a=n.slice(9).trim();else if(a!==null&&n===`branch refs/heads/${r}`&&O(a,t))return a;return null}c(Y,"registeredCheckoutPath");async function Z(e){const t=w(e.path),r=t?e.path:e.repo_root,a=await b(r,`refs/heads/${e.base_ref}`),n=await K(r,e.base_ref),i=await b(r,`refs/heads/${e.branch}`);if(!t)return{base:a,upstream:n?.sha??null,branch:i,checkout:"absent"};const o=await u(["rev-parse","HEAD"],e.path),l=await u(["status","--porcelain"],e.path),s=o.status!==0||l.status!==0?null:M("sha256").update(`${o.stdout.trim()}
+${l.stdout}`).digest("hex");return{base:a,upstream:n?.sha??null,branch:i,checkout:s}}c(Z,"observe");function ee(e,t){return e.checkout===null||t.checkout===null?!1:e.base===t.base&&e.upstream===t.upstream&&e.branch===t.branch&&e.checkout===t.checkout}c(ee,"sameObservation");function te(e,t,r,a,n,i){if(r.status!=="refused"&&r.status!=="failed"||!i.stillEligible())return;const o=(t.sweep?.attempts??0)+1,l=E[Math.min(o,E.length)-1]??E[0],s=v(e)?.managed_worktree;s==null||!D(s)||q(e,{reason:r.reason,...r.detail===void 0?{}:{detail:r.detail},observed:a,attempts:o,lastAttemptAt:new Date(n).toISOString(),nextAttemptAt:new Date(n+l*6e4).toISOString(),quarantined:o>=I})}c(te,"recordUnfinished");async function ae(e,t,r,a,n){const i=await u(["status","--porcelain"],e);if(i.status!==0)return{ok:!1,detail:d(i)};const o=await u(["diff","--name-only",r,a],e);if(o.status!==0)return{ok:!1,detail:d(o)};const l=o.stdout.split(`
+`).map(m=>m.trim()).filter(m=>m!==""),s=Q(U(i.stdout),l);if(s.kind==="refuse")return{ok:!1,detail:`untracked files in ${e} would be overwritten by the incoming commits: ${s.collisions.join(", ")}`};if(!n.stillEligible())return{ok:!1,detail:"node is no longer terminal",ineligible:!0};const h=c(async()=>{const m=await u(["merge","--ff-only",a],e);return m.status===0?{ok:!0}:{ok:!1,detail:d(m)}},"merge");if(s.kind==="direct")return h();const $=await b(e,"refs/stash"),p=await u(["stash","push","--message",`crtr landing ${t}`],e);if(p.status!==0)return{ok:!1,detail:d(p)};const f=await b(e,"refs/stash");if(f===null||f===$)return h();const k=`local changes from ${e} are retained in stash ${f}; recover them with \`git -C ${j(e)} stash apply ${f}\` and resolve any conflict.`,_=await h();return _.ok?(await u(["stash","apply",f],e)).status===0?(await R(e,f),{ok:!0}):(await u(["reset","--hard",a],e),{ok:!0,stash:`the shared base checkout was reset to landed commit ${a} because local changes conflicted with it. ${k}`}):(await u(["stash","apply",f],e)).status===0?(await R(e,f),_):{ok:!1,detail:`${_.detail}
+${k}`}}c(ae,"landIntoBaseCheckoutAsync");async function R(e,t){await b(e,"refs/stash")===t&&await u(["stash","drop"],e)}c(R,"dropStashIfStillTip");async function re(e,t,r){const a=await b(e.path,`refs/heads/${e.base_ref}`);if(a===null)return{ok:!1,detail:`local base branch '${e.base_ref}' does not resolve`};if(!r.stillEligible())return{ok:!1,detail:"node is no longer terminal",ineligible:!0};const n=await u(["rebase",a],e.path);if(n.status!==0)return await u(["rebase","--abort"],e.path),{ok:!1,detail:d(n)};const i=await b(e.path,"HEAD");if(i===null)return{ok:!1,detail:"could not read the rebased worktree tip"};if((await u(["merge-base","--is-ancestor",a,i],e.path)).status!==0)return{ok:!1,detail:`the rebased branch is not a fast-forward of '${e.base_ref}'`};const o=H(t,e.base_ref);if(o===null){if(!r.stillEligible())return{ok:!1,detail:"node is no longer terminal",ineligible:!0};const h=await u(["update-ref",`refs/heads/${e.base_ref}`,i,a],e.path);return h.status===0?{ok:!0,landedSha:i}:{ok:!1,detail:d(h)}}const l=await u(["rev-parse","HEAD"],o);if(l.status!==0||l.stdout.trim()!==a)return{ok:!1,detail:`base checkout ${o} is not at ${a}`};const s=await ae(o,e.branch,a,i,r);return s.ok?{ok:!0,landedSha:i,...s.stash===void 0?{}:{stash:s.stash}}:s}c(re,"finishBlockedLand");const y={status:"skipped",reason:"node_no_longer_terminal"};async function _e(e,t,r=Date.now()){const a=v(e)?.managed_worktree;if(!D(a)||a==null)return{status:"skipped",reason:"already_reconciled"};const n=w(a.path)?a.path:a.repo_root;if(!w(n))return S(e,a,{status:"refused",reason:"repo_unavailable",detail:`neither the recorded checkout nor repository root exists, so ${a.branch} cannot be proved absent`},{base:null,upstream:null,branch:null,checkout:null},r,t);const i=await N(n);if(i===null)return S(e,a,{status:"failed",reason:"git_dir_unreadable",detail:`could not resolve the git common dir from ${n}`},{base:null,upstream:null,branch:null,checkout:null},r,t);let o={base:null,upstream:null,branch:null,checkout:null},l;try{l=await z(G(i),async()=>{if(!t.stillEligible())return y;const s=v(e)?.managed_worktree;return!D(s)||s==null?{status:"skipped",reason:"already_reconciled"}:(o=await Z(s),s.sweep!==void 0&&ee(s.sweep.observed,o)?{status:"refused",reason:s.sweep.reason,...s.sweep.detail===void 0?{}:{detail:s.sweep.detail},unchanged:!0}:w(s.path)?await ne(e,s,t):await se(e,s,o,t))},{timeoutMs:C,timeoutError:c(()=>new Error(`timed out waiting for the managed-worktree lock on ${i}`),"timeoutError")})}catch(s){l={status:"failed",reason:"lock_unavailable",detail:s instanceof Error?s.message:String(s)}}return S(e,a,l,o,r,t)}c(_e,"reconcileManagedWorktree");function S(e,t,r,a,n,i){return te(e,t,r,a,n,i),r}c(S,"finish");function x(e,t,r){if(!r.stillEligible())return y;const a=v(e)?.managed_worktree;return a==null||a.path!==t.path||a.branch!==t.branch?{status:"skipped",reason:"record_changed"}:(F(e),{status:"complete"})}c(x,"persistComplete");async function se(e,t,r,a){const n=t.repo_root;if(r.branch===null){const s=await u(["show-ref","--verify","--quiet",`refs/heads/${t.branch}`],n);return s.status!==1?{status:"failed",reason:"branch_inspection_failed",detail:d(s)}:x(e,t,a)}const i=await u(["worktree","list","--porcelain"],n);if(i.status!==0)return{status:"failed",reason:"worktree_list_failed",detail:d(i)};const o=H(i.stdout,t.branch);if(o!==null)return{status:"refused",reason:"branch_checked_out_elsewhere",detail:`${t.branch} is checked out at ${o}`};const l=await A(n,t,r.branch);return l===null?{status:"refused",reason:"unlanded_work",detail:`${t.branch} carries content no base or upstream ref contains; its checkout is already gone, so the branch is the only copy`}:B(e,t,n,r.branch,l,a)}c(se,"concludeAbsentCheckout");async function ne(e,t,r){const a=await u(["worktree","list","--porcelain"],t.path);if(a.status!==0)return{status:"failed",reason:"worktree_list_failed",detail:d(a)};const n=t.disposal,i=n?.observed_branch??t.branch,o=Y(a.stdout,t.path,i);if(o===null)return{status:"refused",reason:"not_registered",detail:`${t.path} is not registered to refs/heads/${i}; crtr will not act on a path it cannot prove it owns`};const l=X(a.stdout);if(l===null||O(l,o)||!w(l))return{status:"refused",reason:"repo_unavailable",detail:`the repository's main checkout is unavailable, so ${t.path} cannot be removed from outside itself`};const s=await J(t.path);if(s===null)return{status:"failed",reason:"git_path_failed",detail:`could not inspect in-progress operations in ${t.path}`};if(s)return{status:"refused",reason:"rebase_in_progress",detail:`${t.path} is mid-rebase`};const h=await u(["rev-parse","--abbrev-ref","HEAD"],t.path);if(h.status!==0)return{status:"failed",reason:"branch_check_failed",detail:d(h)};if(h.stdout.trim()!==i)return{status:"refused",reason:"wrong_branch",detail:`expected ${i}, found ${h.stdout.trim()==="HEAD"?"detached HEAD":h.stdout.trim()}`};const $=await u(["status","--porcelain"],t.path);if($.status!==0)return{status:"failed",reason:"status_failed",detail:d($)};if($.stdout.trim()!=="")return{status:"refused",reason:"dirty_worktree",detail:`${t.path} has uncommitted changes`};let p=await b(t.path,"HEAD");if(p===null)return{status:"failed",reason:"head_unreadable",detail:`could not read HEAD in ${t.path}`};if(n!==void 0){if(await N(t.path)!==n.common_dir||p!==n.observed_sha)return{status:"refused",reason:"disposal_authorization_stale",detail:`${t.path} changed since \`close\` authorized its disposal; rerun \`crtr node worktree close\` from that node to re-authorize, or ask the user with \`crtr human send\``};if(!r.stillEligible())return y;const P=await u(["worktree","remove",o],l);return P.status!==0?{status:"refused",reason:"worktree_remove_failed",detail:d(P)}:x(e,t,r)}let f=await A(t.path,t,p),k;if(f===null&&t.land_intent!==void 0){const g=await re(t,a.stdout,r);if(!g.ok)return g.ineligible===!0?y:{status:"refused",reason:"land_blocked",detail:g.detail};p=g.landedSha,k=g.stash,f=await A(t.path,t,p)}if(f===null)return{status:"refused",reason:"unlanded_work",detail:`${t.branch} carries commits its base does not contain, and this node never asked to land them`};if(!r.stillEligible())return y;const _=await u(["worktree","remove",o],l);if(_.status!==0)return{status:"refused",reason:"worktree_remove_failed",detail:d(_)};const m=await B(e,t,l,p,f,r);return m.status==="complete"&&k!==void 0?{status:"complete",stash:k}:m}c(ne,"reconcilePresentCheckout");async function B(e,t,r,a,n,i){if(!i.stillEligible())return y;const o=V(t.branch,a,n.containingRef,n.containingSha),l=await u(["update-ref","--stdin"],r,o);return l.status!==0?{status:"refused",reason:"branch_delete_failed",detail:d(l)}:x(e,t,i)}c(B,"deleteBranchAndComplete");export{ke as isDueForSweep,D as isReconcilable,_e as reconcileManagedWorktree};