@north-light/crouter 0.3.318 → 0.3.320

package/dist/core/worktree.js

@@ -1,899 +1,18 @@
-import { existsSync, mkdirSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
-import { createHash } from 'node:crypto';
-import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
-import { gitAsync, gitSync } from './git.js';
-import { crtrHome } from './canvas/paths.js';
-import { closeWorktreeAndRepoint, getNode, recordLandIntent } from './canvas/index.js';
-import { CONFIG_FILE, CRTR_DIR_NAME, STATE_FILE } from '../types.js';
-import { withExclusiveDirectoryLock } from './exclusive-lock.js';
-import { parseStatusPorcelain, planLandIntoCheckout, refDeleteTransactionStdin } from './worktree-landing.js';
-import { shellQuote } from '../shared/shell-quote.js';
-export class WorktreeError extends Error {
-    code;
-    next;
-    detail;
-    constructor(code, message, next, detail) {
-        super(message);
-        this.name = 'WorktreeError';
-        this.code = code;
-        this.next = next;
-        this.detail = detail;
-    }
-}
-function runGit(cwd, args, code, next) {
-    const res = gitSync(args, cwd);
-    if (res.status !== 0) {
-        const detail = (res.stderr.trim() || res.stdout.trim()).trim();
-        throw new WorktreeError(code, `git ${args.join(' ')} failed`, next, detail);
-    }
-    return res.stdout.trim();
-}
-export function managedWorktreesRoot() {
-    return `${crtrHome()}/worktrees`;
-}
-export function managedWorktreePath(nodeId) {
-    return `${managedWorktreesRoot()}/${nodeId}`;
-}
-export function hasOpenManagedWorktree(node) {
-    return node?.managed_worktree?.state === 'open';
-}
-export function openManagedWorktreeForNode(nodeId) {
-    const node = getNode(nodeId);
-    const wt = node?.managed_worktree;
-    return wt?.state === 'open' ? wt : null;
-}
-function repoRootFor(cwd) {
-    const result = gitSync(['rev-parse', '--show-toplevel'], cwd);
-    if (result.status !== 0) {
-        const detail = (result.stderr.trim() || result.stdout.trim()).trim();
-        throw new WorktreeError('not_git_repo', `cwd ${cwd} is not a git repository`, 'Pass --cwd <real repo> pointing inside a git repository.', detail);
-    }
-    return result.stdout.trim();
-}
-export function isManagedWorktreeBase(repoRoot) {
-    const path = relative(canonicalPath(managedWorktreesRoot()), canonicalPath(repoRoot));
-    return path !== '' && path !== '..' && !path.startsWith(`..${sep}`) && !isAbsolute(path);
-}
-function recordedBranchExists(cwd, branch) {
-    const ref = `refs/heads/${branch}`;
-    const exists = gitSync(['show-ref', '--verify', '--quiet', ref], cwd);
-    if (exists.status === 0)
-        return true;
-    if (exists.status === 1 && exists.executionFailed !== true)
-        return false;
-    const stderr = exists.stderr.trim() || '<empty>';
-    const execution = exists.processError === undefined ? '' : `\nprocess error: ${exists.processError}`;
-    throw new WorktreeError('recorded_branch_inspection_failed', `could not inspect recorded branch '${branch}' (git show-ref exited with status ${exists.status})`, 'Inspect the repository and its Git metadata, then retry.', `status: ${exists.status}\nstderr: ${stderr}${execution}`);
-}
-function resolveLandableBase(repoRoot, baseRef) {
-    const ref = `refs/heads/${baseRef}`;
-    // Verify the exact refs/heads name first: rev-parse alone accepts revision
-    // syntax, which could turn a SHA or a `^{commit}` suffix into a non-landable
-    // base even though no local branch by that exact name exists.
-    const exists = gitSync(['show-ref', '--verify', '--quiet', ref], repoRoot);
-    // `show-ref --verify --quiet` reserves exit 1 for an absent ref. gitSync
-    // preserves that numeric status for compatibility, but marks spawn failures,
-    // timeouts, and signal exits so they cannot masquerade as an absent branch.
-    if (exists.status === 1 && exists.executionFailed !== true) {
-        throw new WorktreeError('missing_base_branch', `managed worktree base '${baseRef}' does not name an existing local branch`, 'The base must be a local branch that landing can fast-forward — freshen your local branch from origin first (rebase-not-merge), then base on it.');
-    }
-    if (exists.status !== 0) {
-        const stderr = exists.stderr.trim() || '<empty>';
-        const execution = exists.processError === undefined ? '' : `\nprocess error: ${exists.processError}`;
-        throw new WorktreeError('base_branch_inspection_failed', `could not inspect local base branch '${baseRef}' (git show-ref exited with status ${exists.status})`, 'Inspect the repository and its Git metadata, then retry.', `status: ${exists.status}\nstderr: ${stderr}${execution}`);
-    }
-    return runGit(repoRoot, ['rev-parse', '--verify', ref], 'base_branch_resolve_failed', 'Inspect the local base branch, then retry.');
-}
-/** Path of the worktree where a local branch is currently checked out, or null
- *  if it is not checked out in any worktree. */
-function checkoutPathForBranch(repoRoot, branch) {
-    const out = runGit(repoRoot, ['worktree', 'list', '--porcelain'], 'worktree_list_failed', 'Inspect the repository worktrees manually, then retry.');
-    return checkoutPathForBranchInList(out, branch);
-}
-/** Shared parse for a `git worktree list --porcelain` blob already in hand —
- *  callers that must not throw on a read failure (an absent-path proof that
- *  needs to fail closed rather than error) call `gitSync` themselves and pass
- *  the output here instead of going through `checkoutPathForBranch`. */
-export function checkoutPathForBranchInList(porcelain, branch) {
-    let current = null;
-    for (const line of porcelain.split('\n')) {
-        if (line.startsWith('worktree '))
-            current = line.slice('worktree '.length).trim();
-        else if (line === `branch refs/heads/${branch}`)
-            return current;
-    }
-    return null;
-}
-/** Are these two spellings the same directory?
- *
- *  Git canonicalizes every path it prints in `worktree list --porcelain`, while
- *  a recorded managed-worktree path preserves the spelling of `CRTR_HOME`. When
- *  the canvas home is reached through a symlink (macOS's `/var` → `/private/var`
- *  is the everyday case) the two forms name one directory but differ as
- *  strings, so a raw `===` reads a checkout crtr created as unowned. Resolution
- *  failures fall back to `resolve`, which is the pre-canonical comparison — no
- *  worse than the string compare it replaces. */
-export function samePath(a, b) {
-    return a === b || canonicalPath(a) === canonicalPath(b);
-}
-function canonicalPath(path) {
-    try {
-        return realpathSync.native(path);
-    }
-    catch {
-        return resolve(path);
-    }
-}
-export const WORKTREE_LOCK_WAIT_MS = 30_000;
-/** The lock directory naming one repository's common Git dir. Every process
- *  that mutates a managed worktree — the synchronous commands here and the
- *  daemon's asynchronous sweep — derives its lock path through this function,
- *  so the two locking styles contend for the SAME name. */
-export function worktreeLockPathForCommonDir(commonDir) {
-    const lockRoot = `${crtrHome()}/worktree-locks`;
-    mkdirSync(lockRoot, { recursive: true });
-    return `${lockRoot}/${createHash('sha256').update(commonDir).digest('hex')}`;
-}
-function commonGitDir(repoRoot) {
-    const commonDir = runGit(repoRoot, ['rev-parse', '--git-common-dir'], 'git_common_dir_failed', 'Inspect the repository git metadata, then retry.');
-    return realpathSync(resolve(repoRoot, commonDir));
-}
-/** Serialize worktree mutation for one repository across crtr processes. Git's
- * own worktree metadata lock is intentionally short-lived and rejects a second
- * add instead of waiting, so callers take this transaction lock first. */
-function withRepositoryWorktreeLock(repoRoot, action) {
-    const commonDir = commonGitDir(repoRoot);
-    return withExclusiveDirectoryLock(worktreeLockPathForCommonDir(commonDir), action, {
-        timeoutMs: WORKTREE_LOCK_WAIT_MS,
-        timeoutError: () => new WorktreeError('worktree_lock_timeout', `timed out waiting to create a managed worktree in ${commonDir}`, 'Wait for the other managed-worktree operation to finish, then retry.'),
-    });
-}
-function registeredWorktree(repoRoot, path, branch) {
-    const list = gitSync(['worktree', 'list', '--porcelain'], repoRoot);
-    if (list.status !== 0)
-        return null;
-    let current = null;
-    for (const line of list.stdout.split('\n')) {
-        if (line.startsWith('worktree '))
-            current = line.slice('worktree '.length).trim();
-        else if (current !== null && samePath(current, path) && line === `branch refs/heads/${branch}`)
-            return true;
-    }
-    return false;
-}
-function proveBranchContained(cwd, baseRef, branchSha) {
-    const candidates = [];
-    const localBaseRef = `refs/heads/${baseRef}`;
-    const localBase = gitSync(['rev-parse', '--verify', '--quiet', localBaseRef], cwd);
-    if (localBase.status === 0)
-        candidates.push({ ref: localBaseRef, sha: localBase.stdout.trim() });
-    const upstream = gitSync(['rev-parse', '--symbolic-full-name', '--verify', `${baseRef}@{upstream}`], cwd);
-    const upstreamRef = upstream.status === 0 && upstream.stdout.trim().startsWith('refs/') ? upstream.stdout.trim() : `refs/remotes/origin/${baseRef}`;
-    const upstreamSha = gitSync(['rev-parse', '--verify', '--quiet', upstreamRef], cwd);
-    if (upstreamSha.status === 0)
-        candidates.push({ ref: upstreamRef, sha: upstreamSha.stdout.trim() });
-    if (candidates.length === 0)
-        return null;
-    for (const c of candidates) {
-        if (gitSync(['merge-base', '--is-ancestor', branchSha, c.sha], cwd).status === 0)
-            return { containingRef: c.ref, containingSha: c.sha };
-    }
-    for (const c of candidates) {
-        const cherry = gitSync(['cherry', c.sha, branchSha], cwd);
-        if (cherry.status !== 0)
-            continue;
-        const lines = cherry.stdout.split('\n').map((l) => l.trim()).filter((l) => l !== '');
-        if (lines.every((l) => l.startsWith('-')))
-            return { containingRef: c.ref, containingSha: c.sha };
-    }
-    for (const c of candidates) {
-        const candidateTree = gitSync(['rev-parse', '--verify', `${c.sha}^{tree}`], cwd);
-        if (candidateTree.status !== 0)
-            continue;
-        const merged = gitSync(['merge-tree', '--write-tree', c.sha, branchSha], cwd);
-        if (merged.status !== 0)
-            continue;
-        if (merged.stdout.split('\n')[0]?.trim() === candidateTree.stdout.trim())
-            return { containingRef: c.ref, containingSha: c.sha };
-    }
-    return null;
-}
-/** Undo a creation attempt, but only resources whose recorded path, branch,
- * and original base still prove they belong to that attempt. */
-function rollbackManagedWorktreeLocked(wt, pathWasAbsent) {
-    const branch = gitSync(['rev-parse', '--verify', `refs/heads/${wt.branch}`], wt.repo_root);
-    // A branch at the original base is the ownership proof for every destructive
-    // rollback step. If it was advanced or repurposed, preserve all resources.
-    if (branch.status !== 0 || branch.stdout.trim() !== wt.base_sha)
-        return;
-    const registration = registeredWorktree(wt.repo_root, wt.path, wt.branch);
-    // A failed registry read proves nothing. Preserve every resource rather than
-    // guessing that an uninspected checkout belongs to this failed attempt.
-    if (registration === null)
-        return;
-    if (registration) {
-        if (gitSync(['worktree', 'remove', '--force', wt.path], wt.repo_root).status !== 0)
-            return;
-        if (registeredWorktree(wt.repo_root, wt.path, wt.branch) !== false)
-            return;
-    }
-    else if (pathWasAbsent && existsSync(wt.path)) {
-        // The caller observed this path absent while holding the repository lock;
-        // only its failed `worktree add` can have created it.
-        try {
-            rmSync(wt.path, { recursive: true, force: true });
-        }
-        catch {
-            return;
-        }
-    }
-    // Compare-and-delete retains the ownership guard through the final mutation.
-    try {
-        gitSync(['update-ref', '-d', `refs/heads/${wt.branch}`, wt.base_sha], wt.repo_root);
-    }
-    catch { /* best-effort */ }
-}
-export function rollbackManagedWorktree(wt) {
-    withRepositoryWorktreeLock(wt.repo_root, () => rollbackManagedWorktreeLocked(wt, false));
-}
-// Every crtr process auto-initializes a project scope's
-// `.crouter/config.json` (`ensureProjectScope` → `ensureScopeInitialized`)
-// the first time it runs against a project root that has no ancestor
-// `.crouter/` yet — which every fresh managed worktree checkout is, unless
-// the repo itself already tracks `.crouter/memory/` (crouter's own repo does).
-// That write is untracked crtr bookkeeping, not node work, so `git status`
-// inside the worktree always shows `?? .crouter/config.json` and `close`'s
-// dirty check refuses to land. `state.json` is the same category (written at
-// project scope by explicit `pkg`/`canvas config` commands) — excluded
-// defensively even though no automatic path writes it today.
-//
-// These two filenames, NOT the whole `.crouter/` directory, are the only
-// patterns seeded below. `.git/info/exclude` only ever suppresses UNTRACKED
-// paths from `git status` — it can never hide a modification to an
-// already-tracked file — but crouter's own repo tracks `.crouter/memory/`,
-// and a node can legitimately add a brand-new (untracked until committed)
-// memory doc there. A blanket `.crouter/` exclude would silently hide that
-// new doc from `git status` too, letting close/push-final land or auto-drop
-// while it is quietly lost. Naming exactly `config.json`/`state.json` avoids
-// that: nothing crtr writes automatically ever lands under `.crouter/memory/`.
-const MANAGED_WORKTREE_EXCLUDE_MARKER = '# crtr: exclude crtr\'s own untracked project-scope bookkeeping (auto-added at managed-worktree creation)';
-const MANAGED_WORKTREE_EXCLUDE_PATTERNS = [
-    `/${CRTR_DIR_NAME}/${CONFIG_FILE}`,
-    `/${CRTR_DIR_NAME}/${STATE_FILE}`,
-];
-/** Seed the repository's SHARED `.git/info/exclude` (one file per common git
- *  dir, not per worktree — `git rev-parse --git-path info/exclude` resolves
- *  there from every linked worktree, including the primary checkout) with
- *  crtr's own runtime bookkeeping patterns, idempotently. Leading `/` anchors
- *  each pattern to the toplevel of WHICHEVER worktree `git status` runs in,
- *  which is exactly where `ensureScopeInitialized` writes `.crouter/config.json`
- *  — the managed worktree's own root. Called once per managed-worktree
- *  creation, already inside `withRepositoryWorktreeLock`, so concurrent
- *  creators cannot race the append. */
-function seedManagedWorktreeExclude(repoRoot) {
-    try {
-        const excludePath = join(commonGitDir(repoRoot), 'info', 'exclude');
-        mkdirSync(dirname(excludePath), { recursive: true });
-        let existing = '';
-        try {
-            existing = readFileSync(excludePath, 'utf8');
-        }
-        catch { /* first worktree this repo has ever had */ }
-        const present = new Set(existing.split('\n').map((l) => l.trim()));
-        const missing = MANAGED_WORKTREE_EXCLUDE_PATTERNS.filter((p) => !present.has(p));
-        if (missing.length === 0)
-            return;
-        const needsLeadingNewline = existing.length > 0 && !existing.endsWith('\n');
-        const block = (needsLeadingNewline ? '\n' : '') + MANAGED_WORKTREE_EXCLUDE_MARKER + '\n' + missing.join('\n') + '\n';
-        writeFileSync(excludePath, existing + block);
-    }
-    catch { /* best-effort; a failure here is cosmetic (one extra untracked bookkeeping line in git status) and must never fail worktree creation */ }
-}
-export function createManagedWorktree(cwd, nodeId, baseRef = 'main') {
-    const repoRoot = repoRootFor(cwd);
-    if (isManagedWorktreeBase(repoRoot)) {
-        throw new WorktreeError('managed_worktree_base', `cwd ${repoRoot} is a managed worktree and cannot be used as a managed worktree base`, 'Pass --cwd <real repo> pointing at the repository’s primary checkout.');
-    }
-    return withRepositoryWorktreeLock(repoRoot, () => {
-        const baseSha = resolveLandableBase(repoRoot, baseRef);
-        const path = managedWorktreePath(nodeId);
-        const branch = `crtr/${nodeId}`;
-        if (existsSync(path)) {
-            throw new WorktreeError('worktree_path_exists', `managed worktree path already exists: ${path}`, 'Remove the stale path or choose a fresh node id.');
-        }
-        if (gitSync(['show-ref', '--verify', '--quiet', `refs/heads/${branch}`], repoRoot).status === 0) {
-            throw new WorktreeError('worktree_branch_exists', `managed worktree branch already exists: ${branch}`, 'Remove the stale branch or choose a fresh node id.');
-        }
-        const wt = {
-            state: 'open', path, branch, repo_root: repoRoot, base_ref: baseRef, base_sha: baseSha, created: new Date().toISOString(),
-        };
-        runGit(repoRoot, ['branch', branch, baseSha], 'worktree_branch_create_failed', 'Inspect the git error, fix the repository/worktree state, then retry spawning with --worktree.');
-        try {
-            runGit(repoRoot, ['worktree', 'add', path, branch], 'worktree_add_failed', 'Inspect the git error, fix the repository/worktree state, then retry spawning with --worktree.');
-            seedManagedWorktreeExclude(repoRoot);
-            return wt;
-        }
-        catch (err) {
-            rollbackManagedWorktreeLocked(wt, true);
-            throw err;
-        }
-    });
-}
-function statusPorcelain(cwd) {
-    return runGit(cwd, ['status', '--porcelain'], 'status_failed', 'Inspect the worktree manually, then retry.');
-}
-function currentBranch(cwd) {
-    return runGit(cwd, ['rev-parse', '--abbrev-ref', 'HEAD'], 'branch_check_failed', 'Inspect the worktree manually, then retry.');
-}
-function gitPath(cwd, logicalPath) {
-    return runGit(cwd, ['rev-parse', '--git-path', logicalPath], 'git_path_failed', 'Inspect the worktree manually, then retry.');
-}
-export function isRebaseInProgress(cwd) {
-    return existsSync(gitPath(cwd, 'rebase-merge')) || existsSync(gitPath(cwd, 'rebase-apply'));
-}
-/** The ONE authoritative closed-worktree state transition, shared by every
- * closing path (explicit `closeManagedWorktreeLocked` land, the clean
- * `autoDropCleanManagedWorktreeLocked` push-final drop, and the daemon sweep's
- * `reconcileManagedWorktree`): persist
- * `managed_worktree.state: 'closed'`, name its cleanup state, and repoint the
- * node's launch `cwd` to the durable base checkout. The caller broker stays
- * alive and is Pi's sole transcript writer, so its session header cannot be
- * safely rewritten here; clear the session coordinates and let the later
- * revive launch fresh instead. Both closing paths MUST go through this helper
- * instead of hand-rolling the `updateNode` call, so neither can drift out of
- * sync. */
-export function persistClosedWorktreeState(nodeId, wt, cleanup = 'pending') {
-    const node = getNode(nodeId);
-    closeWorktreeAndRepoint(nodeId, {
-        cwd: wt.repo_root,
-        cleanup,
-        closedAt: new Date().toISOString(),
-        unbindSession: node?.pi_session_id != null || node?.pi_session_file != null,
-    });
-}
-/** Record that this node ASKED to land and was blocked, so the daemon sweep may
- *  later retry exactly that land once the base checkout stops blocking it. The
- *  sweep never lands commits for a node that did not get this far: a node that
- *  crashed mid-work and never called close has its worktree preserved for a
- *  human instead. Recording a fresh intent also clears any prior refusal state,
- *  so the sweep re-examines promptly rather than honoring an old backoff. */
-function recordBlockedLandIntent(nodeId, blocked) {
-    const current = getNode(nodeId)?.managed_worktree;
-    if (current == null || current.state !== 'open')
-        return;
-    recordLandIntent(nodeId, { at: new Date().toISOString(), blocked });
-}
-/** Fast-forward a base branch that is CHECKED OUT somewhere, landing underneath
- *  whatever local changes that checkout holds.
- *
- *  The base checkout is shared by every other node using this repository, and
- *  its local changes usually have nothing to do with the child that is closing.
- *  Disjoint changes ride along untouched; overlapping ones are stashed, the
- *  fast-forward runs underneath them, and they are re-applied. The re-apply is
- *  `stash apply`, never `stash pop`, so a conflict cannot consume the stash and
- *  lose the work: on conflict the checkout is reset to the landed commit and the
- *  stash is deliberately KEPT for a person to apply. Either way this never
- *  leaves conflict markers behind in a checkout other nodes are using. */
-function landIntoBaseCheckout(baseCheckout, branch, baseSha, landedSha) {
-    const status = gitSync(['status', '--porcelain'], baseCheckout);
-    if (status.status !== 0)
-        return { ok: false, detail: (status.stderr.trim() || status.stdout.trim()).trim() };
-    const diff = gitSync(['diff', '--name-only', baseSha, landedSha], baseCheckout);
-    if (diff.status !== 0)
-        return { ok: false, detail: (diff.stderr.trim() || diff.stdout.trim()).trim() };
-    const incoming = diff.stdout.split('\n').map((l) => l.trim()).filter((l) => l !== '');
-    const plan = planLandIntoCheckout(parseStatusPorcelain(status.stdout), incoming);
-    if (plan.kind === 'refuse') {
-        return { ok: false, detail: `untracked files in ${baseCheckout} would be overwritten by the incoming commits: ${plan.collisions.join(', ')}` };
-    }
-    const merge = () => {
-        const res = gitSync(['merge', '--ff-only', landedSha], baseCheckout);
-        return res.status === 0 ? { ok: true } : { ok: false, detail: (res.stderr.trim() || res.stdout.trim()).trim() };
-    };
-    if (plan.kind === 'direct')
-        return merge();
-    // Identify the stash by the exact commit this push created. `refs/stash` can
-    // already name an UNRELATED stash the user made earlier, and a push that
-    // saved nothing leaves it untouched — applying or dropping that one would
-    // destroy work this code never owned.
-    const before = gitSync(['rev-parse', '--verify', '--quiet', 'refs/stash'], baseCheckout);
-    const beforeSha = before.status === 0 ? before.stdout.trim() : null;
-    const push = gitSync(['stash', 'push', '--message', `crtr landing ${branch}`], baseCheckout);
-    if (push.status !== 0)
-        return { ok: false, detail: (push.stderr.trim() || push.stdout.trim()).trim() };
-    const after = gitSync(['rev-parse', '--verify', '--quiet', 'refs/stash'], baseCheckout);
-    const stashSha = after.status === 0 ? after.stdout.trim() : null;
-    if (stashSha === null || stashSha === beforeSha)
-        return merge(); // nothing was saved
-    const recovery = `local changes from ${baseCheckout} are retained in stash ${stashSha}; recover them with \`git -C ${shellQuote(baseCheckout)} stash apply ${stashSha}\` and resolve any conflict.`;
-    const landed = merge();
-    if (!landed.ok) {
-        // The failed merge left the tree exactly as the stash found it, so this
-        // re-apply is clean; restore before surfacing the refusal.
-        if (gitSync(['stash', 'apply', stashSha], baseCheckout).status === 0) {
-            dropStashIfStillTip(baseCheckout, stashSha);
-            return landed;
-        }
-        return { ok: false, detail: `${landed.detail}\n${recovery}` };
-    }
-    if (gitSync(['stash', 'apply', stashSha], baseCheckout).status === 0) {
-        dropStashIfStillTip(baseCheckout, stashSha);
-        return { ok: true };
-    }
-    gitSync(['reset', '--hard', landedSha], baseCheckout);
-    return {
-        ok: true,
-        stash: `the shared base checkout was reset to landed commit ${landedSha} because local changes conflicted with it. ${recovery}`,
-    };
-}
-/** Drop a stash entry only while it is still the tip `stash@{0}` names, so a
- *  stash someone else pushed in between is never dropped instead. */
-function dropStashIfStillTip(cwd, stashSha) {
-    const tip = gitSync(['rev-parse', '--verify', '--quiet', 'refs/stash'], cwd);
-    if (tip.status === 0 && tip.stdout.trim() === stashSha)
-        gitSync(['stash', 'drop'], cwd);
-}
-function deferredCleanupResult(wt) {
-    const remove = `git -C ${shellQuote(wt.repo_root)} worktree remove ${shellQuote(wt.path)}`;
-    return {
-        worktree_removed: false,
-        worktree_remove_error: `cleanup pending: the caller checkout at ${wt.path} remains intact. After its node exits, run \`${remove}\` after confirming it is safe to delete.`,
-        branch_deleted: false,
-        branch_delete_error: `cleanup pending: local branch ${wt.branch} remains checked out at ${wt.path}; delete it only after that checkout is removed and its landed commit is still contained in ${wt.base_ref}.`,
-    };
-}
-/** The disposal path for `close` when the recorded `crtr/*` branch is gone:
- *  ordinary PR work moved this checkout onto a real branch. This never lands
- *  or rebases that branch — it belongs to a workflow crouter does not own —
- *  and never deletes it. It only AUTHORIZES the daemon sweep to remove the
- *  checkout later, once this node's own broker has exited, and only after
- *  proving the branch's content is already delivered. Runs after the caller
- *  already proved the checkout clean and not mid-rebase. */
-function closeBranchMovedWorktree(nodeId, wt, actualBranch) {
-    if (registeredWorktree(wt.repo_root, wt.path, actualBranch) !== true) {
-        throw new WorktreeError('wrong_branch', `managed worktree's recorded branch ${wt.branch} no longer exists, and its checkout at ${wt.path} is not registered to ${actualBranch} either`, `Inspect ${wt.path} and its git worktree registration, then ask the user with \`crtr human send\` if you are unsure how to proceed.`);
-    }
-    const actualSha = runGit(wt.path, ['rev-parse', 'HEAD'], 'branch_check_failed', 'Inspect the worktree manually, then retry.');
-    const proof = proveBranchContained(wt.path, wt.base_ref, actualSha);
-    if (proof === null) {
-        throw new WorktreeError('branch_moved_unlanded', `managed worktree's recorded branch ${wt.branch} no longer exists; its checkout is now on ${actualBranch} at ${actualSha}, which carries content local base branch '${wt.base_ref}' does not yet contain`, `Land or push ${actualBranch} through its own workflow (merge its PR, or fast-forward '${wt.base_ref}' to include it) before closing, or ask the user with \`crtr human send\` if you are unsure how ${actualBranch} should be delivered.`);
-    }
-    const commonDir = commonGitDir(wt.repo_root);
-    // Recheck identity immediately before writing the authorization: nothing
-    // about the checkout may have moved between the proof above and this write.
-    const stillRegistered = registeredWorktree(wt.repo_root, wt.path, actualBranch) === true;
-    const stillOnBranch = currentBranch(wt.path) === actualBranch;
-    const stillAtSha = runGit(wt.path, ['rev-parse', 'HEAD'], 'branch_check_failed', 'Inspect the worktree manually, then retry.') === actualSha;
-    if (!stillRegistered || !stillOnBranch || !stillAtSha) {
-        throw new WorktreeError('wrong_branch', `managed worktree at ${wt.path} changed while closing`, `Inspect ${wt.path}, then rerun \`crtr node worktree close\`.`);
-    }
-    const disposal = { observed_branch: actualBranch, observed_sha: actualSha, common_dir: commonDir, authorized: new Date().toISOString() };
-    persistClosedWorktreeState(nodeId, { ...wt, disposal }, 'pending');
-    const remove = `git -C ${shellQuote(wt.repo_root)} worktree remove ${shellQuote(wt.path)}`;
-    return {
-        node_id: nodeId,
-        branch: actualBranch,
-        worktree_path: wt.path,
-        // Nothing was rebased or fast-forwarded here: `${actualBranch}`'s content
-        // was already proven contained in `${proof.containingRef}` at `${proof.containingSha}`.
-        landed_sha: actualSha,
-        worktree_removed: false,
-        worktree_remove_error: `cleanup pending: the caller checkout at ${wt.path} remains intact. After its node exits, run \`${remove}\` after confirming it is safe to delete.`,
-        branch_deleted: false,
-        branch_delete_error: `${actualBranch} is not a crtr-managed branch and will never be deleted automatically; it is preserved once the checkout above is removed.`,
-    };
-}
-/** Word the `no_managed_worktree` refusal from the record's ACTUAL state
- *  rather than a blanket "no worktree". A `closed`/`cleanup: pending` record
- *  still has its checkout on disk, scheduled for the daemon sweep to finish —
- *  that is not lost ownership, and three separate reports (#849, #862, #872)
- *  were misdiagnosed because the old wording read as if it were. */
-function noManagedWorktreeMessage(nodeId, verb) {
-    const wt = getNode(nodeId)?.managed_worktree;
-    if (wt == null)
-        return { message: `node ${nodeId} has no managed worktree`, next: `Nothing to ${verb} for this node.` };
-    if (wt.state === 'abandoned') {
-        const branch = wt.abandoned?.branch ?? wt.branch;
-        return { message: `node ${nodeId}'s managed worktree was already abandoned`, next: `Nothing to ${verb} for this node; its work was retained on branch ${branch}.` };
-    }
-    if (wt.state === 'closed') {
-        return wt.cleanup === 'complete'
-            ? { message: `node ${nodeId}'s managed worktree is already closed and its cleanup is complete`, next: `Nothing to ${verb} for this node.` }
-            : { message: `node ${nodeId}'s managed worktree is already closed; this is not lost ownership — its checkout at ${wt.path} is scheduled for automatic cleanup once that is safe`, next: `Nothing to ${verb} for this node. The daemon sweep finishes removing ${wt.path} on its own; inspect it directly only if it still needs manual attention.` };
-    }
-    return { message: `node ${nodeId} has no open managed worktree`, next: `Nothing to ${verb} for this node.` };
-}
-function closeManagedWorktreeLocked(nodeId) {
-    const node = getNode(nodeId);
-    if (node === null) {
-        throw new WorktreeError('unknown_node', `unknown node: ${nodeId}`, 'Run this from a live node, or pass a real node id once that command supports it.');
-    }
-    const wt = openManagedWorktreeForNode(nodeId);
-    if (wt === null) {
-        const { message, next } = noManagedWorktreeMessage(nodeId, 'close');
-        throw new WorktreeError('no_managed_worktree', message, next);
-    }
-    if (!existsSync(wt.path)) {
-        const proof = proveAbsentPathManagedWorktree(wt);
-        if (proof === null) {
-            throw new WorktreeError('worktree_missing', `managed worktree path is missing: ${wt.path}`, missingWorktreeRecoveryHint(wt));
-        }
-        const dropped = autoDropAbsentPathManagedWorktreeLocked(nodeId, wt, proof);
-        if (dropped === null) {
-            throw new WorktreeError('worktree_missing', `managed worktree path is missing: ${wt.path}`, missingWorktreeRecoveryHint(wt));
-        }
-        return {
-            node_id: nodeId,
-            branch: wt.branch,
-            worktree_path: wt.path,
-            // No local fast-forward happened in this recovery path. When the branch
-            // still exists, this is its remotely/local-base-delivered tip; when it
-            // was already deleted, the recorded creation base is the only durable
-            // SHA left to report through the established close result contract.
-            landed_sha: proof.branchSha ?? wt.base_sha,
-            worktree_removed: true,
-            branch_deleted: true,
-        };
-    }
-    if (isRebaseInProgress(wt.path)) {
-        throw new WorktreeError('rebase_in_progress', 'this managed worktree is mid-rebase', `Resolve conflicts in ${wt.path}, run \`git rebase --continue\` there, then rerun \`crtr node worktree close\`.`);
-    }
-    const dirty = statusPorcelain(wt.path);
-    if (dirty !== '') {
-        throw new WorktreeError('dirty_worktree', 'managed worktree has uncommitted changes', `Commit the work in ${wt.path} (or ask the user with \`crtr human send\` if you do not know whether to keep it), then rerun \`crtr node worktree close\`.`);
-    }
-    const branch = currentBranch(wt.path);
-    if (branch !== wt.branch) {
-        const found = branch === 'HEAD' ? 'detached HEAD' : branch;
-        const recordedRefExists = recordedBranchExists(wt.path, wt.branch);
-        if (recordedRefExists || branch === 'HEAD') {
-            throw new WorktreeError('wrong_branch', `managed worktree is not on its recorded branch (expected ${wt.branch}, found ${found})`, recordedRefExists
-                ? `Check out ${wt.branch} in ${wt.path} before closing, or ask the user with \`crtr human send\` if you are unsure why it changed, then rerun \`crtr node worktree close\`.`
-                : `The recorded branch ${wt.branch} no longer exists, and ${wt.path} is in detached HEAD, so there is no branch to preserve. Check out or create a branch there before closing, or ask the user with \`crtr human send\` if you are unsure how to proceed.`);
-        }
-        // The recorded crtr/* branch is gone: ordinary PR work moved this checkout
-        // onto a real branch. The checkout is already proven clean and not
-        // mid-rebase (both checked above), so disposal may proceed.
-        return closeBranchMovedWorktree(nodeId, wt, branch);
-    }
-    let baseSha;
-    try {
-        // `repo_root` is the checkout that created this child, and it can vanish
-        // when that parent finishes first. The live managed checkout still names
-        // the shared repository and is the authority for every close operation.
-        baseSha = resolveLandableBase(wt.path, wt.base_ref);
-    }
-    catch (error) {
-        // A deleted parent base cannot receive a fast-forward. A clean child at
-        // its recorded creation SHA has nothing to land, however, so conclude its
-        // deferred cleanup without guessing where work should go.
-        const head = runGit(wt.path, ['rev-parse', 'HEAD'], 'landed_sha_failed', 'Inspect the worktree checkout manually, then rerun `crtr node worktree close`.');
-        if (!(error instanceof WorktreeError) || error.code !== 'missing_base_branch' || head !== wt.base_sha)
-            throw error;
-        persistClosedWorktreeState(nodeId, wt, 'pending');
-        return {
-            node_id: nodeId,
-            branch: wt.branch,
-            worktree_path: wt.path,
-            landed_sha: wt.base_sha,
-            ...deferredCleanupResult(wt),
-        };
-    }
-    const rebase = gitSync(['rebase', baseSha], wt.path);
-    if (rebase.status !== 0) {
-        const detail = (rebase.stderr.trim() || rebase.stdout.trim()).trim();
-        throw new WorktreeError('rebase_failed', `rebase onto local base branch '${wt.base_ref}' did not complete`, `Resolve conflicts in ${wt.path}, run \`git rebase --continue\` there, then rerun \`crtr node worktree close\`. If the blocker is not mechanical, ask the user with \`crtr human send\`.`, detail);
-    }
-    const landedSha = runGit(wt.path, ['rev-parse', 'HEAD'], 'landed_sha_failed', 'Inspect the worktree checkout manually, then rerun `crtr node worktree close`.');
-    // Fast-forward the local base branch to the worktree tip rebased onto the
-    // captured baseSha — landing is purely local, nothing is ever pushed to
-    // origin. Both landing paths require the base to still be exactly at that
-    // captured tip, so neither can overwrite a concurrent base change.
-    // Every refusal below leaves a rebased, landable branch that this node ASKED
-    // to land. Recording that blocked intent is what later authorizes the daemon
-    // sweep to finish exactly this land once the blocker clears.
-    const blocked = (message, next, detail) => {
-        recordBlockedLandIntent(nodeId, message);
-        return new WorktreeError('land_base_failed', message, next, detail);
-    };
-    const fastForward = gitSync(['merge-base', '--is-ancestor', baseSha, landedSha], wt.path);
-    if (fastForward.status !== 0) {
-        throw blocked(`rebased worktree is not a fast-forward of local base branch '${wt.base_ref}'`, 'Ask the user with `crtr human send` how to land this managed worktree.', (fastForward.stderr.trim() || fastForward.stdout.trim()).trim());
-    }
-    const baseCheckout = checkoutPathForBranch(wt.path, wt.base_ref);
-    if (baseCheckout !== null) {
-        const checkoutHead = gitSync(['rev-parse', 'HEAD'], baseCheckout);
-        const actualHead = checkoutHead.stdout.trim();
-        if (checkoutHead.status !== 0 || actualHead !== baseSha) {
-            const detail = checkoutHead.status !== 0
-                ? (checkoutHead.stderr.trim() || actualHead).trim()
-                : `expected ${baseSha}, found ${actualHead}`;
-            throw blocked(`local base branch '${wt.base_ref}' changed while this worktree was closing`, `Reconcile the base checkout at ${baseCheckout}, then rerun \`crtr node worktree close\`. If you are unsure, ask the user with \`crtr human send\`.`, detail);
-        }
-    }
-    let stashNote;
-    if (baseCheckout !== null) {
-        const landed = landIntoBaseCheckout(baseCheckout, wt.branch, baseSha, landedSha);
-        if (!landed.ok) {
-            throw blocked(`could not fast-forward local base branch '${wt.base_ref}' to this worktree`, `Local base branch '${wt.base_ref}' is checked out at ${baseCheckout} in a state that blocks a fast-forward. Reconcile it there, then rerun \`crtr node worktree close\`. If you are unsure, ask the user with \`crtr human send\`.`, landed.detail);
-        }
-        stashNote = landed.stash;
-    }
-    else {
-        const land = gitSync(['update-ref', `refs/heads/${wt.base_ref}`, landedSha, baseSha], wt.path);
-        if (land.status !== 0) {
-            throw blocked(`could not fast-forward local base branch '${wt.base_ref}' to this worktree`, 'Ask the user with `crtr human send` how to land this managed worktree.', (land.stderr.trim() || land.stdout.trim()).trim());
-        }
-    }
-    // The caller broker still runs from wt.path after this API response. Do not
-    // invoke `git worktree remove`: it recursively deletes the caller's cwd and
-    // a timeout can kill Git between individual unlink operations. Keep the
-    // checkout and its checked-out branch intact in the named pending-cleanup
-    // state; the successful land is still the point of no return for this node.
-    persistClosedWorktreeState(nodeId, wt, 'pending');
-    return {
-        node_id: nodeId,
-        branch: wt.branch,
-        worktree_path: wt.path,
-        landed_sha: landedSha,
-        ...deferredCleanupResult(wt),
-        ...(stashNote === undefined ? {} : { base_checkout_stash: stashNote }),
-    };
-}
-export function closeManagedWorktree(nodeId) {
-    const wt = openManagedWorktreeForNode(nodeId);
-    // Preserve the existing precise unknown/no-open-worktree errors without a
-    // repository to lock; every state-mutating close path runs under the lock.
-    if (wt === null)
-        return closeManagedWorktreeLocked(nodeId);
-    // An absent checkout has no live Git directory; its separate recovery proof
-    // still relies on the recorded repository path. Every live close locks from
-    // the child checkout instead of the parent that created it.
-    return withRepositoryWorktreeLock(existsSync(wt.path) ? wt.path : wt.repo_root, () => closeManagedWorktreeLocked(nodeId));
-}
-// Push-final auto-drop of a clean, zero-commit managed worktree
-/** Delete a source branch only while the ref that proved it already delivered
- *  is still at the exact inspected SHA. `containingRef` can be the recorded
- *  local base or that base's remote-tracking upstream. */
-function bestEffortDeleteBranchWithContainmentProof(wt, branchSha, containingRef, containingSha) {
-    const stdin = refDeleteTransactionStdin(wt.branch, branchSha, containingRef, containingSha);
-    const transaction = gitSync(['update-ref', '--stdin'], wt.repo_root, stdin);
-    const branchDeleted = transaction.status === 0;
-    if (branchDeleted)
-        return { branchDeleted };
-    const detail = (transaction.stderr.trim() || transaction.stdout.trim()).trim();
-    return {
-        branchDeleted,
-        branchDeleteError: `local branch ${wt.branch} could not be deleted automatically (${detail}); run \`git -C ${shellQuote(wt.repo_root)} branch -D ${shellQuote(wt.branch)}\` after confirming it is merged.`,
-    };
-}
-/** A missing checkout can still be concluded, but only from refs: either the
- * recorded local branch is already gone, or its tip is contained in the
- * recorded base or that base's upstream. Filesystem absence alone proves
- * nothing about commits. */
-function proveAbsentPathManagedWorktree(wt) {
-    if (wt.state !== 'open' || existsSync(wt.path))
-        return null;
-    const branchRef = `refs/heads/${wt.branch}`;
-    const branchExists = gitSync(['show-ref', '--verify', '--quiet', branchRef], wt.repo_root);
-    if (branchExists.status === 1)
-        return { branchSha: null };
-    if (branchExists.status !== 0)
-        return null;
-    const branch = gitSync(['rev-parse', '--verify', branchRef], wt.repo_root);
-    if (branch.status !== 0)
-        return null;
-    const branchSha = branch.stdout.trim();
-    // The recorded path being absent does NOT mean the branch has no live
-    // checkout: `git worktree move` (or a remove-then-re-add elsewhere) can
-    // relocate it to a different path while leaving `wt.path` gone. Deleting a
-    // branch that is still checked out somewhere else would bypass Git's own
-    // checked-out-branch protection and can abandon uncommitted work at that
-    // other path. Fail closed on any ambiguity from the inspection itself.
-    const worktreeList = gitSync(['worktree', 'list', '--porcelain'], wt.repo_root);
-    if (worktreeList.status !== 0)
-        return null;
-    if (checkoutPathForBranchInList(worktreeList.stdout, wt.branch) !== null)
-        return null;
-    const candidates = [];
-    const localBaseRef = `refs/heads/${wt.base_ref}`;
-    const localBaseExists = gitSync(['show-ref', '--verify', '--quiet', localBaseRef], wt.repo_root);
-    if (localBaseExists.status === 0) {
-        const localBase = gitSync(['rev-parse', '--verify', localBaseRef], wt.repo_root);
-        if (localBase.status !== 0)
-            return null;
-        candidates.push({ ref: localBaseRef, sha: localBase.stdout.trim() });
-    }
-    else if (localBaseExists.status !== 1) {
-        return null;
-    }
-    const upstream = gitSync(['rev-parse', '--symbolic-full-name', '--verify', `${wt.base_ref}@{upstream}`], wt.repo_root);
-    if (upstream.status === 0) {
-        const ref = upstream.stdout.trim();
-        const sha = gitSync(['rev-parse', '--verify', ref], wt.repo_root);
-        if (ref.startsWith('refs/') && sha.status === 0)
-            candidates.push({ ref, sha: sha.stdout.trim() });
-    }
-    else {
-        // Managed bases normally track origin. Retained records from before that
-        // configuration existed can still prove delivery through origin/<base>.
-        const ref = `refs/remotes/origin/${wt.base_ref}`;
-        const exists = gitSync(['show-ref', '--verify', '--quiet', ref], wt.repo_root);
-        if (exists.status === 0) {
-            const sha = gitSync(['rev-parse', '--verify', ref], wt.repo_root);
-            if (sha.status === 0)
-                candidates.push({ ref, sha: sha.stdout.trim() });
-        }
-        else if (exists.status !== 1) {
-            return null;
-        }
-    }
-    for (const candidate of candidates) {
-        if (gitSync(['merge-base', '--is-ancestor', branchSha, candidate.sha], wt.repo_root).status === 0) {
-            return { branchSha, containingRef: candidate.ref, containingSha: candidate.sha };
-        }
-    }
-    return null;
-}
-/** Recovery guidance for a vanished checkout whose refs do not prove that its
- * work is delivered. This deliberately never recommends `worktree close`:
- * that command cannot operate on the absent checkout. */
-export function missingWorktreeRecoveryHint(wt) {
-    return `The recorded checkout path is gone, but crtr cannot prove ${wt.branch} is already delivered. Push or land ${wt.branch}, then rerun \`crtr push final\`; if you cannot establish what happened to the branch, ask the user with \`crtr human send\`.`;
-}
-/** Fix B's shared "nothing to land" test — the SAME clean-worktree definition
- *  `close`'s own dirty check now naturally satisfies once `.git/info/exclude`
- *  hides crtr's own `.crouter/config.json`/`state.json` bookkeeping (Fix A),
- *  plus one more requirement close doesn't need: the branch tip must already
- *  be a git-ancestor of (or equal to) the CURRENT tip of its recorded base
- *  branch — i.e. landing it would be a pure no-op. Any ambiguity (missing
- *  path, mid-rebase, wrong branch, an unresolvable base, or a real ancestry
- *  divergence) returns null. A missing base is the one exception: equality
- *  between the live HEAD and recorded creation SHA proves no work was added.
- *  This function only ever proves a no-op land from live Git state, never on
- *  a heuristic guess, so real unlanded work always falls through to the explicit-close guard. The locked
- *  path re-checks this predicate before recording deferred cleanup; production
- *  code must always go through `autoDropCleanManagedWorktree`. */
-export function proveCleanEmptyManagedWorktree(wt) {
-    if (wt.state !== 'open')
-        return null;
-    if (!existsSync(wt.path))
-        return null;
-    if (isRebaseInProgress(wt.path))
-        return null;
-    const branch = gitSync(['rev-parse', '--abbrev-ref', 'HEAD'], wt.path);
-    if (branch.status !== 0 || branch.stdout.trim() !== wt.branch)
-        return null;
-    const status = gitSync(['status', '--porcelain'], wt.path);
-    if (status.status !== 0 || status.stdout.trim() !== '')
-        return null;
-    const head = gitSync(['rev-parse', 'HEAD'], wt.path);
-    if (head.status !== 0)
-        return null;
-    const branchSha = head.stdout.trim();
-    let baseSha;
-    try {
-        baseSha = resolveLandableBase(wt.path, wt.base_ref);
-    }
-    catch (error) {
-        // A parent-first close can remove the recorded base branch. Equality with
-        // the durable creation SHA proves this clean child never added work.
-        if (error instanceof WorktreeError && error.code === 'missing_base_branch' && branchSha === wt.base_sha) {
-            return { branchSha, baseSha: wt.base_sha };
-        }
-        throw error;
-    }
-    const ancestor = gitSync(['merge-base', '--is-ancestor', branchSha, baseSha], wt.path);
-    if (ancestor.status !== 0)
-        return null;
-    return { branchSha, baseSha };
-}
-/** Conclude an absent-path record only after `proveAbsentPathManagedWorktree`
- * has established the same no-unlanded-work property required by auto-drop.
- * There is no checkout left to remove; persistClosedWorktreeState records the
- * completed cleanup and repoints cwd to the durable base checkout. */
-function autoDropAbsentPathManagedWorktreeLocked(nodeId, wt, proof) {
-    if (existsSync(wt.path))
-        return null;
-    if (proof.branchSha === null) {
-        persistClosedWorktreeState(nodeId, wt, 'complete');
-        return { node_id: nodeId, branch: wt.branch, worktree_path: wt.path, worktree_removed: true, branch_deleted: true };
-    }
-    if (proof.containingRef === undefined || proof.containingSha === undefined)
-        return null;
-    const { branchDeleted } = bestEffortDeleteBranchWithContainmentProof(wt, proof.branchSha, proof.containingRef, proof.containingSha);
-    if (!branchDeleted)
-        return null;
-    persistClosedWorktreeState(nodeId, wt, 'complete');
-    return { node_id: nodeId, branch: wt.branch, worktree_path: wt.path, worktree_removed: true, branch_deleted: true };
-}
-/** Re-check a clean auto-drop before closing its record. `push final` runs
- * inside the owner broker, so it has the same destructive-cwd boundary as
- * explicit close: removal and branch deletion are deferred until that owner
- * has exited. */
-export function autoDropCleanManagedWorktreeLocked(nodeId, wt, proof) {
-    const current = proveCleanEmptyManagedWorktree(wt);
-    if (current === null || current.branchSha !== proof.branchSha)
-        return null;
-    // The owner is still running in this checkout while it publishes final.
-    // Preserve its files and checked-out branch; physical cleanup is explicitly
-    // recorded as pending rather than racing Git's recursive removal.
-    persistClosedWorktreeState(nodeId, wt, 'pending');
-    return {
-        node_id: nodeId,
-        branch: wt.branch,
-        worktree_path: wt.path,
-        ...deferredCleanupResult(wt),
-    };
-}
-/** `push final`'s escape hatch: a managed worktree that has
- *  nothing to land is auto-dropped instead of blocking on an explicit
- *  `node worktree close` — one the caller may have been told NOT to run
- *  because a manager already landed the same change another way, or
- *  that never had anything to close in the first place (a read-only
- *  review node). Returns null and changes nothing when the worktree is not
- *  PROVABLY empty-and-clean by `proveCleanEmptyManagedWorktree`, OR when a
- *  concurrent mutation invalidates that proof before the record is closed
- *  (see `autoDropCleanManagedWorktreeLocked`); the caller's existing
- *  `open_managed_worktree` guard then still applies unchanged — real
- *  commits, real uncommitted changes, and a lost race all require the
- *  explicit path. */
-function cleanCurrentCheckoutTip(wt) {
-    if (wt.state !== 'open' || !existsSync(wt.path) || isRebaseInProgress(wt.path))
-        return null;
-    const status = gitSync(['status', '--porcelain'], wt.path);
-    if (status.status !== 0 || status.stdout.trim() !== '')
-        return null;
-    const head = gitSync(['rev-parse', 'HEAD'], wt.path);
-    return head.status === 0 ? head.stdout.trim() : null;
-}
-export async function branchIsPushedAtCurrentTip(wt) {
-    const initialTip = cleanCurrentCheckoutTip(wt);
-    if (initialTip === null)
-        return false;
-    // A cached origin branch can be stale in either direction. Query origin's
-    // heads directly and require exact-tip equality: a remote that has an older
-    // commit would still leave newer local work stranded at finalization. The
-    // branch name is deliberately irrelevant because PR workflows publish this
-    // managed checkout's tip under a human-readable branch name.
-    // This runs asynchronously with a bounded, non-interactive Git invocation so
-    // an unreachable remote never stalls crtrd's event loop.
-    const ssh = process.env['GIT_SSH_COMMAND'] ?? process.env['GIT_SSH'] ?? 'ssh';
-    const remote = await gitAsync(['ls-remote', '--exit-code', '--heads', 'origin'], wt.path, undefined, { timeoutMs: 10_000, env: { ...process.env, GIT_TERMINAL_PROMPT: '0', GIT_SSH_COMMAND: `${ssh} -o BatchMode=yes` } });
-    if (remote.status !== 0)
-        return false;
-    const remotelyPushed = remote.stdout.split('\n').some((line) => {
-        const [sha, ref] = line.split('\t', 2);
-        return sha === initialTip && ref?.startsWith('refs/heads/') === true;
-    });
-    if (!remotelyPushed)
-        return false;
-    // The remote proof is useful only if the local checkout is still the exact
-    // clean tip it inspected when finalization begins.
-    return cleanCurrentCheckoutTip(wt) === initialTip;
-}
-export function autoDropCleanManagedWorktree(nodeId) {
-    const wt = openManagedWorktreeForNode(nodeId);
-    if (wt === null)
-        return null;
-    // A negative read-only preflight must fail before waiting on the repository
-    // mutation lock: real unlanded work should reach push-final's guard promptly.
-    const pathAbsent = !existsSync(wt.path);
-    if (pathAbsent ? proveAbsentPathManagedWorktree(wt) === null : proveCleanEmptyManagedWorktree(wt) === null)
-        return null;
-    return withRepositoryWorktreeLock(pathAbsent ? wt.repo_root : wt.path, () => {
-        // Re-fetch inside the lock: state may have changed since the caller's
-        // hasOpenManagedWorktree check ran outside it.
-        const locked = openManagedWorktreeForNode(nodeId);
-        if (locked === null)
-            return null;
-        // Re-prove the matching predicate under the lock before changing state.
-        // A path that reappeared follows the ordinary checkout path.
-        if (!existsSync(locked.path)) {
-            const proof = proveAbsentPathManagedWorktree(locked);
-            return proof === null ? null : autoDropAbsentPathManagedWorktreeLocked(nodeId, locked, proof);
-        }
-        const proof = proveCleanEmptyManagedWorktree(locked);
-        return proof === null ? null : autoDropCleanManagedWorktreeLocked(nodeId, locked, proof);
-    });
-}
+var J=Object.defineProperty;var a=(e,r)=>J(e,"name",{value:r,configurable:!0});import{existsSync as _,mkdirSync as H,readFileSync as V,realpathSync as N,rmSync as Y,writeFileSync as Z}from"node:fs";import{createHash as ee}from"node:crypto";import{dirname as te,isAbsolute as re,join as ne,relative as oe,resolve as C,sep as se}from"node:path";import{gitAsync as ae,gitSync as i}from"./git.js";import{crtrHome as O}from"./canvas/paths.js";import{closeWorktreeAndRepoint as ie,getNode as v,recordLandIntent as ce}from"./canvas/index.js";import{CONFIG_FILE as he,CRTR_DIR_NAME as F,STATE_FILE as ue}from"../types.js";import{withExclusiveDirectoryLock as le}from"./exclusive-lock.js";import{parseStatusPorcelain as de,planLandIntoCheckout as fe,refDeleteTransactionStdin as pe}from"./worktree-landing.js";import{shellQuote as w}from"../shared/shell-quote.js";class f extends Error{static{a(this,"WorktreeError")}code;next;detail;constructor(r,t,n,o){super(t),this.name="WorktreeError",this.code=r,this.next=n,this.detail=o}}function k(e,r,t,n){const o=i(r,e);if(o.status!==0){const s=(o.stderr.trim()||o.stdout.trim()).trim();throw new f(t,`git ${r.join(" ")} failed`,n,s)}return o.stdout.trim()}a(k,"runGit");function I(){return`${O()}/worktrees`}a(I,"managedWorktreesRoot");function me(e){return`${I()}/${e}`}a(me,"managedWorktreePath");function Ke(e){return e?.managed_worktree?.state==="open"}a(Ke,"hasOpenManagedWorktree");function x(e){const t=v(e)?.managed_worktree;return t?.state==="open"?t:null}a(x,"openManagedWorktreeForNode");function be(e){const r=i(["rev-parse","--show-toplevel"],e);if(r.status!==0){const t=(r.stderr.trim()||r.stdout.trim()).trim();throw new f("not_git_repo",`cwd ${e} is not a git repository`,"Pass --cwd <real repo> pointing inside a git repository.",t)}return r.stdout.trim()}a(be,"repoRootFor");function _e(e){const r=oe(S(I()),S(e));return r!==""&&r!==".."&&!r.startsWith(`..${se}`)&&!re(r)}a(_e,"isManagedWorktreeBase");function ke(e,r){const t=`refs/heads/${r}`,n=i(["show-ref","--verify","--quiet",t],e);if(n.status===0)return!0;if(n.status===1&&n.executionFailed!==!0)return!1;const o=n.stderr.trim()||"<empty>",s=n.processError===void 0?"":`
+process error: ${n.processError}`;throw new f("recorded_branch_inspection_failed",`could not inspect recorded branch '${r}' (git show-ref exited with status ${n.status})`,"Inspect the repository and its Git metadata, then retry.",`status: ${n.status}
+stderr: ${o}${s}`)}a(ke,"recordedBranchExists");function A(e,r){const t=`refs/heads/${r}`,n=i(["show-ref","--verify","--quiet",t],e);if(n.status===1&&n.executionFailed!==!0)throw new f("missing_base_branch",`managed worktree base '${r}' does not name an existing local branch`,"The base must be a local branch that landing can fast-forward \u2014 freshen your local branch from origin first (rebase-not-merge), then base on it.");if(n.status!==0){const o=n.stderr.trim()||"<empty>",s=n.processError===void 0?"":`
+process error: ${n.processError}`;throw new f("base_branch_inspection_failed",`could not inspect local base branch '${r}' (git show-ref exited with status ${n.status})`,"Inspect the repository and its Git metadata, then retry.",`status: ${n.status}
+stderr: ${o}${s}`)}return k(e,["rev-parse","--verify",t],"base_branch_resolve_failed","Inspect the local base branch, then retry.")}a(A,"resolveLandableBase");function ge(e,r){const t=k(e,["worktree","list","--porcelain"],"worktree_list_failed","Inspect the repository worktrees manually, then retry.");return q(t,r)}a(ge,"checkoutPathForBranch");function q(e,r){let t=null;for(const n of e.split(`
+`))if(n.startsWith("worktree "))t=n.slice(9).trim();else if(n===`branch refs/heads/${r}`)return t;return null}a(q,"checkoutPathForBranchInList");function we(e,r){return e===r||S(e)===S(r)}a(we,"samePath");function S(e){try{return N.native(e)}catch{return C(e)}}a(S,"canonicalPath");const $e=3e4;function ye(e){const r=`${O()}/worktree-locks`;return H(r,{recursive:!0}),`${r}/${ee("sha256").update(e).digest("hex")}`}a(ye,"worktreeLockPathForCommonDir");function R(e){const r=k(e,["rev-parse","--git-common-dir"],"git_common_dir_failed","Inspect the repository git metadata, then retry.");return N(C(e,r))}a(R,"commonGitDir");function E(e,r){const t=R(e);return le(ye(t),r,{timeoutMs:$e,timeoutError:a(()=>new f("worktree_lock_timeout",`timed out waiting to create a managed worktree in ${t}`,"Wait for the other managed-worktree operation to finish, then retry."),"timeoutError")})}a(E,"withRepositoryWorktreeLock");function D(e,r,t){const n=i(["worktree","list","--porcelain"],e);if(n.status!==0)return null;let o=null;for(const s of n.stdout.split(`
+`))if(s.startsWith("worktree "))o=s.slice(9).trim();else if(o!==null&&we(o,r)&&s===`branch refs/heads/${t}`)return!0;return!1}a(D,"registeredWorktree");function ve(e,r,t){const n=[],o=`refs/heads/${r}`,s=i(["rev-parse","--verify","--quiet",o],e);s.status===0&&n.push({ref:o,sha:s.stdout.trim()});const u=i(["rev-parse","--symbolic-full-name","--verify",`${r}@{upstream}`],e),h=u.status===0&&u.stdout.trim().startsWith("refs/")?u.stdout.trim():`refs/remotes/origin/${r}`,m=i(["rev-parse","--verify","--quiet",h],e);if(m.status===0&&n.push({ref:h,sha:m.stdout.trim()}),n.length===0)return null;for(const d of n)if(i(["merge-base","--is-ancestor",t,d.sha],e).status===0)return{containingRef:d.ref,containingSha:d.sha};for(const d of n){const l=i(["cherry",d.sha,t],e);if(l.status!==0)continue;if(l.stdout.split(`
+`).map(c=>c.trim()).filter(c=>c!=="").every(c=>c.startsWith("-")))return{containingRef:d.ref,containingSha:d.sha}}for(const d of n){const l=i(["rev-parse","--verify",`${d.sha}^{tree}`],e);if(l.status!==0)continue;const b=i(["merge-tree","--write-tree",d.sha,t],e);if(b.status===0&&b.stdout.split(`
+`)[0]?.trim()===l.stdout.trim())return{containingRef:d.ref,containingSha:d.sha}}return null}a(ve,"proveBranchContained");function G(e,r){const t=i(["rev-parse","--verify",`refs/heads/${e.branch}`],e.repo_root);if(t.status!==0||t.stdout.trim()!==e.base_sha)return;const n=D(e.repo_root,e.path,e.branch);if(n!==null){if(n){if(i(["worktree","remove","--force",e.path],e.repo_root).status!==0||D(e.repo_root,e.path,e.branch)!==!1)return}else if(r&&_(e.path))try{Y(e.path,{recursive:!0,force:!0})}catch{return}try{i(["update-ref","-d",`refs/heads/${e.branch}`,e.base_sha],e.repo_root)}catch{}}}a(G,"rollbackManagedWorktreeLocked");function Ue(e){E(e.repo_root,()=>G(e,!1))}a(Ue,"rollbackManagedWorktree");const xe="# crtr: exclude crtr's own untracked project-scope bookkeeping (auto-added at managed-worktree creation)",Se=[`/${F}/${he}`,`/${F}/${ue}`];function Ee(e){try{const r=ne(R(e),"info","exclude");H(te(r),{recursive:!0});let t="";try{t=V(r,"utf8")}catch{}const n=new Set(t.split(`
+`).map(h=>h.trim())),o=Se.filter(h=>!n.has(h));if(o.length===0)return;const u=(t.length>0&&!t.endsWith(`
+`)?`
+`:"")+xe+`
+`+o.join(`
+`)+`
+`;Z(r,t+u)}catch{}}a(Ee,"seedManagedWorktreeExclude");function Xe(e,r,t="main"){const n=be(e);if(_e(n))throw new f("managed_worktree_base",`cwd ${n} is a managed worktree and cannot be used as a managed worktree base`,"Pass --cwd <real repo> pointing at the repository\u2019s primary checkout.");return E(n,()=>{const o=A(n,t),s=me(r),u=`crtr/${r}`;if(_(s))throw new f("worktree_path_exists",`managed worktree path already exists: ${s}`,"Remove the stale path or choose a fresh node id.");if(i(["show-ref","--verify","--quiet",`refs/heads/${u}`],n).status===0)throw new f("worktree_branch_exists",`managed worktree branch already exists: ${u}`,"Remove the stale branch or choose a fresh node id.");const h={state:"open",path:s,branch:u,repo_root:n,base_ref:t,base_sha:o,created:new Date().toISOString()};k(n,["branch",u,o],"worktree_branch_create_failed","Inspect the git error, fix the repository/worktree state, then retry spawning with --worktree.");try{return k(n,["worktree","add",s,u],"worktree_add_failed","Inspect the git error, fix the repository/worktree state, then retry spawning with --worktree."),Ee(n),h}catch(m){throw G(h,!0),m}})}a(Xe,"createManagedWorktree");function De(e){return k(e,["status","--porcelain"],"status_failed","Inspect the worktree manually, then retry.")}a(De,"statusPorcelain");function B(e){return k(e,["rev-parse","--abbrev-ref","HEAD"],"branch_check_failed","Inspect the worktree manually, then retry.")}a(B,"currentBranch");function j(e,r){return k(e,["rev-parse","--git-path",r],"git_path_failed","Inspect the worktree manually, then retry.")}a(j,"gitPath");function M(e){return _(j(e,"rebase-merge"))||_(j(e,"rebase-apply"))}a(M,"isRebaseInProgress");function y(e,r,t="pending"){const n=v(e);ie(e,{cwd:r.repo_root,cleanup:t,closedAt:new Date().toISOString(),unbindSession:n?.pi_session_id!=null||n?.pi_session_file!=null})}a(y,"persistClosedWorktreeState");function We(e,r){const t=v(e)?.managed_worktree;t==null||t.state!=="open"||ce(e,{at:new Date().toISOString(),blocked:r})}a(We,"recordBlockedLandIntent");function Ae(e,r,t,n){const o=i(["status","--porcelain"],e);if(o.status!==0)return{ok:!1,detail:(o.stderr.trim()||o.stdout.trim()).trim()};const s=i(["diff","--name-only",t,n],e);if(s.status!==0)return{ok:!1,detail:(s.stderr.trim()||s.stdout.trim()).trim()};const u=s.stdout.split(`
+`).map(g=>g.trim()).filter(g=>g!==""),h=fe(de(o.stdout),u);if(h.kind==="refuse")return{ok:!1,detail:`untracked files in ${e} would be overwritten by the incoming commits: ${h.collisions.join(", ")}`};const m=a(()=>{const g=i(["merge","--ff-only",n],e);return g.status===0?{ok:!0}:{ok:!1,detail:(g.stderr.trim()||g.stdout.trim()).trim()}},"merge");if(h.kind==="direct")return m();const d=i(["rev-parse","--verify","--quiet","refs/stash"],e),l=d.status===0?d.stdout.trim():null,b=i(["stash","push","--message",`crtr landing ${r}`],e);if(b.status!==0)return{ok:!1,detail:(b.stderr.trim()||b.stdout.trim()).trim()};const c=i(["rev-parse","--verify","--quiet","refs/stash"],e),p=c.status===0?c.stdout.trim():null;if(p===null||p===l)return m();const $=`local changes from ${e} are retained in stash ${p}; recover them with \`git -C ${w(e)} stash apply ${p}\` and resolve any conflict.`,W=m();return W.ok?i(["stash","apply",p],e).status===0?(K(e,p),{ok:!0}):(i(["reset","--hard",n],e),{ok:!0,stash:`the shared base checkout was reset to landed commit ${n} because local changes conflicted with it. ${$}`}):i(["stash","apply",p],e).status===0?(K(e,p),W):{ok:!1,detail:`${W.detail}
+${$}`}}a(Ae,"landIntoBaseCheckout");function K(e,r){const t=i(["rev-parse","--verify","--quiet","refs/stash"],e);t.status===0&&t.stdout.trim()===r&&i(["stash","drop"],e)}a(K,"dropStashIfStillTip");function T(e){const r=`git -C ${w(e.repo_root)} worktree remove ${w(e.path)}`;return{worktree_removed:!1,worktree_remove_error:`cleanup pending: the caller checkout at ${e.path} remains intact. After its node exits, run \`${r}\` after confirming it is safe to delete.`,branch_deleted:!1,branch_delete_error:`cleanup pending: local branch ${e.branch} remains checked out at ${e.path}; delete it only after that checkout is removed and its landed commit is still contained in ${e.base_ref}.`}}a(T,"deferredCleanupResult");function Re(e,r,t){if(D(r.repo_root,r.path,t)!==!0)throw new f("wrong_branch",`managed worktree's recorded branch ${r.branch} no longer exists, and its checkout at ${r.path} is not registered to ${t} either`,`Inspect ${r.path} and its git worktree registration, then ask the user with \`crtr human send\` if you are unsure how to proceed.`);const n=k(r.path,["rev-parse","HEAD"],"branch_check_failed","Inspect the worktree manually, then retry.");if(ve(r.path,r.base_ref,n)===null)throw new f("branch_moved_unlanded",`managed worktree's recorded branch ${r.branch} no longer exists; its checkout is now on ${t} at ${n}, which carries content local base branch '${r.base_ref}' does not yet contain`,`Land or push ${t} through its own workflow (merge its PR, or fast-forward '${r.base_ref}' to include it) before closing, or ask the user with \`crtr human send\` if you are unsure how ${t} should be delivered.`);const s=R(r.repo_root),u=D(r.repo_root,r.path,t)===!0,h=B(r.path)===t,m=k(r.path,["rev-parse","HEAD"],"branch_check_failed","Inspect the worktree manually, then retry.")===n;if(!u||!h||!m)throw new f("wrong_branch",`managed worktree at ${r.path} changed while closing`,`Inspect ${r.path}, then rerun \`crtr node worktree close\`.`);const d={observed_branch:t,observed_sha:n,common_dir:s,authorized:new Date().toISOString()};y(e,{...r,disposal:d},"pending");const l=`git -C ${w(r.repo_root)} worktree remove ${w(r.path)}`;return{node_id:e,branch:t,worktree_path:r.path,landed_sha:n,worktree_removed:!1,worktree_remove_error:`cleanup pending: the caller checkout at ${r.path} remains intact. After its node exits, run \`${l}\` after confirming it is safe to delete.`,branch_deleted:!1,branch_delete_error:`${t} is not a crtr-managed branch and will never be deleted automatically; it is preserved once the checkout above is removed.`}}a(Re,"closeBranchMovedWorktree");function Me(e,r){const t=v(e)?.managed_worktree;if(t==null)return{message:`node ${e} has no managed worktree`,next:`Nothing to ${r} for this node.`};if(t.state==="abandoned"){const n=t.abandoned?.branch??t.branch;return{message:`node ${e}'s managed worktree was already abandoned`,next:`Nothing to ${r} for this node; its work was retained on branch ${n}.`}}return t.state==="closed"?t.cleanup==="complete"?{message:`node ${e}'s managed worktree is already closed and its cleanup is complete`,next:`Nothing to ${r} for this node.`}:{message:`node ${e}'s managed worktree is already closed; this is not lost ownership \u2014 its checkout at ${t.path} is scheduled for automatic cleanup once that is safe`,next:`Nothing to ${r} for this node. The daemon sweep finishes removing ${t.path} on its own; inspect it directly only if it still needs manual attention.`}:{message:`node ${e} has no open managed worktree`,next:`Nothing to ${r} for this node.`}}a(Me,"noManagedWorktreeMessage");function U(e){if(v(e)===null)throw new f("unknown_node",`unknown node: ${e}`,"Run this from a live node, or pass a real node id once that command supports it.");const t=x(e);if(t===null){const{message:c,next:p}=Me(e,"close");throw new f("no_managed_worktree",c,p)}if(!_(t.path)){const c=P(t);if(c===null)throw new f("worktree_missing",`managed worktree path is missing: ${t.path}`,X(t));if(z(e,t,c)===null)throw new f("worktree_missing",`managed worktree path is missing: ${t.path}`,X(t));return{node_id:e,branch:t.branch,worktree_path:t.path,landed_sha:c.branchSha??t.base_sha,worktree_removed:!0,branch_deleted:!0}}if(M(t.path))throw new f("rebase_in_progress","this managed worktree is mid-rebase",`Resolve conflicts in ${t.path}, run \`git rebase --continue\` there, then rerun \`crtr node worktree close\`.`);if(De(t.path)!=="")throw new f("dirty_worktree","managed worktree has uncommitted changes",`Commit the work in ${t.path} (or ask the user with \`crtr human send\` if you do not know whether to keep it), then rerun \`crtr node worktree close\`.`);const o=B(t.path);if(o!==t.branch){const c=o==="HEAD"?"detached HEAD":o,p=ke(t.path,t.branch);if(p||o==="HEAD")throw new f("wrong_branch",`managed worktree is not on its recorded branch (expected ${t.branch}, found ${c})`,p?`Check out ${t.branch} in ${t.path} before closing, or ask the user with \`crtr human send\` if you are unsure why it changed, then rerun \`crtr node worktree close\`.`:`The recorded branch ${t.branch} no longer exists, and ${t.path} is in detached HEAD, so there is no branch to preserve. Check out or create a branch there before closing, or ask the user with \`crtr human send\` if you are unsure how to proceed.`);return Re(e,t,o)}let s;try{s=A(t.path,t.base_ref)}catch(c){const p=k(t.path,["rev-parse","HEAD"],"landed_sha_failed","Inspect the worktree checkout manually, then rerun `crtr node worktree close`.");if(!(c instanceof f)||c.code!=="missing_base_branch"||p!==t.base_sha)throw c;return y(e,t,"pending"),{node_id:e,branch:t.branch,worktree_path:t.path,landed_sha:t.base_sha,...T(t)}}const u=i(["rebase",s],t.path);if(u.status!==0){const c=(u.stderr.trim()||u.stdout.trim()).trim();throw new f("rebase_failed",`rebase onto local base branch '${t.base_ref}' did not complete`,`Resolve conflicts in ${t.path}, run \`git rebase --continue\` there, then rerun \`crtr node worktree close\`. If the blocker is not mechanical, ask the user with \`crtr human send\`.`,c)}const h=k(t.path,["rev-parse","HEAD"],"landed_sha_failed","Inspect the worktree checkout manually, then rerun `crtr node worktree close`."),m=a((c,p,$)=>(We(e,c),new f("land_base_failed",c,p,$)),"blocked"),d=i(["merge-base","--is-ancestor",s,h],t.path);if(d.status!==0)throw m(`rebased worktree is not a fast-forward of local base branch '${t.base_ref}'`,"Ask the user with `crtr human send` how to land this managed worktree.",(d.stderr.trim()||d.stdout.trim()).trim());const l=ge(t.path,t.base_ref);if(l!==null){const c=i(["rev-parse","HEAD"],l),p=c.stdout.trim();if(c.status!==0||p!==s){const $=c.status!==0?(c.stderr.trim()||p).trim():`expected ${s}, found ${p}`;throw m(`local base branch '${t.base_ref}' changed while this worktree was closing`,`Reconcile the base checkout at ${l}, then rerun \`crtr node worktree close\`. If you are unsure, ask the user with \`crtr human send\`.`,$)}}let b;if(l!==null){const c=Ae(l,t.branch,s,h);if(!c.ok)throw m(`could not fast-forward local base branch '${t.base_ref}' to this worktree`,`Local base branch '${t.base_ref}' is checked out at ${l} in a state that blocks a fast-forward. Reconcile it there, then rerun \`crtr node worktree close\`. If you are unsure, ask the user with \`crtr human send\`.`,c.detail);b=c.stash}else{const c=i(["update-ref",`refs/heads/${t.base_ref}`,h,s],t.path);if(c.status!==0)throw m(`could not fast-forward local base branch '${t.base_ref}' to this worktree`,"Ask the user with `crtr human send` how to land this managed worktree.",(c.stderr.trim()||c.stdout.trim()).trim())}return y(e,t,"pending"),{node_id:e,branch:t.branch,worktree_path:t.path,landed_sha:h,...T(t),...b===void 0?{}:{base_checkout_stash:b}}}a(U,"closeManagedWorktreeLocked");function ze(e){const r=x(e);return r===null?U(e):E(_(r.path)?r.path:r.repo_root,()=>U(e))}a(ze,"closeManagedWorktree");function Te(e,r,t,n){const o=pe(e.branch,r,t,n),s=i(["update-ref","--stdin"],e.repo_root,o),u=s.status===0;if(u)return{branchDeleted:u};const h=(s.stderr.trim()||s.stdout.trim()).trim();return{branchDeleted:u,branchDeleteError:`local branch ${e.branch} could not be deleted automatically (${h}); run \`git -C ${w(e.repo_root)} branch -D ${w(e.branch)}\` after confirming it is merged.`}}a(Te,"bestEffortDeleteBranchWithContainmentProof");function P(e){if(e.state!=="open"||_(e.path))return null;const r=`refs/heads/${e.branch}`,t=i(["show-ref","--verify","--quiet",r],e.repo_root);if(t.status===1)return{branchSha:null};if(t.status!==0)return null;const n=i(["rev-parse","--verify",r],e.repo_root);if(n.status!==0)return null;const o=n.stdout.trim(),s=i(["worktree","list","--porcelain"],e.repo_root);if(s.status!==0||q(s.stdout,e.branch)!==null)return null;const u=[],h=`refs/heads/${e.base_ref}`,m=i(["show-ref","--verify","--quiet",h],e.repo_root);if(m.status===0){const l=i(["rev-parse","--verify",h],e.repo_root);if(l.status!==0)return null;u.push({ref:h,sha:l.stdout.trim()})}else if(m.status!==1)return null;const d=i(["rev-parse","--symbolic-full-name","--verify",`${e.base_ref}@{upstream}`],e.repo_root);if(d.status===0){const l=d.stdout.trim(),b=i(["rev-parse","--verify",l],e.repo_root);l.startsWith("refs/")&&b.status===0&&u.push({ref:l,sha:b.stdout.trim()})}else{const l=`refs/remotes/origin/${e.base_ref}`,b=i(["show-ref","--verify","--quiet",l],e.repo_root);if(b.status===0){const c=i(["rev-parse","--verify",l],e.repo_root);c.status===0&&u.push({ref:l,sha:c.stdout.trim()})}else if(b.status!==1)return null}for(const l of u)if(i(["merge-base","--is-ancestor",o,l.sha],e.repo_root).status===0)return{branchSha:o,containingRef:l.ref,containingSha:l.sha};return null}a(P,"proveAbsentPathManagedWorktree");function X(e){return`The recorded checkout path is gone, but crtr cannot prove ${e.branch} is already delivered. Push or land ${e.branch}, then rerun \`crtr push final\`; if you cannot establish what happened to the branch, ask the user with \`crtr human send\`.`}a(X,"missingWorktreeRecoveryHint");function L(e){if(e.state!=="open"||!_(e.path)||M(e.path))return null;const r=i(["rev-parse","--abbrev-ref","HEAD"],e.path);if(r.status!==0||r.stdout.trim()!==e.branch)return null;const t=i(["status","--porcelain"],e.path);if(t.status!==0||t.stdout.trim()!=="")return null;const n=i(["rev-parse","HEAD"],e.path);if(n.status!==0)return null;const o=n.stdout.trim();let s;try{s=A(e.path,e.base_ref)}catch(h){if(h instanceof f&&h.code==="missing_base_branch"&&o===e.base_sha)return{branchSha:o,baseSha:e.base_sha};throw h}return i(["merge-base","--is-ancestor",o,s],e.path).status!==0?null:{branchSha:o,baseSha:s}}a(L,"proveCleanEmptyManagedWorktree");function z(e,r,t){if(_(r.path))return null;if(t.branchSha===null)return y(e,r,"complete"),{node_id:e,branch:r.branch,worktree_path:r.path,worktree_removed:!0,branch_deleted:!0};if(t.containingRef===void 0||t.containingSha===void 0)return null;const{branchDeleted:n}=Te(r,t.branchSha,t.containingRef,t.containingSha);return n?(y(e,r,"complete"),{node_id:e,branch:r.branch,worktree_path:r.path,worktree_removed:!0,branch_deleted:!0}):null}a(z,"autoDropAbsentPathManagedWorktreeLocked");function Pe(e,r,t){const n=L(r);return n===null||n.branchSha!==t.branchSha?null:(y(e,r,"pending"),{node_id:e,branch:r.branch,worktree_path:r.path,...T(r)})}a(Pe,"autoDropCleanManagedWorktreeLocked");function Q(e){if(e.state!=="open"||!_(e.path)||M(e.path))return null;const r=i(["status","--porcelain"],e.path);if(r.status!==0||r.stdout.trim()!=="")return null;const t=i(["rev-parse","HEAD"],e.path);return t.status===0?t.stdout.trim():null}a(Q,"cleanCurrentCheckoutTip");async function Qe(e){const r=Q(e);if(r===null)return!1;const t=process.env.GIT_SSH_COMMAND??process.env.GIT_SSH??"ssh",n=await ae(["ls-remote","--exit-code","--heads","origin"],e.path,void 0,{timeoutMs:1e4,env:{...process.env,GIT_TERMINAL_PROMPT:"0",GIT_SSH_COMMAND:`${t} -o BatchMode=yes`}});return n.status!==0||!n.stdout.split(`
+`).some(s=>{const[u,h]=s.split("	",2);return u===r&&h?.startsWith("refs/heads/")===!0})?!1:Q(e)===r}a(Qe,"branchIsPushedAtCurrentTip");function Je(e){const r=x(e);if(r===null)return null;const t=!_(r.path);return(t?P(r)===null:L(r)===null)?null:E(t?r.repo_root:r.path,()=>{const n=x(e);if(n===null)return null;if(!_(n.path)){const s=P(n);return s===null?null:z(e,n,s)}const o=L(n);return o===null?null:Pe(e,n,o)})}a(Je,"autoDropCleanManagedWorktree");export{$e as WORKTREE_LOCK_WAIT_MS,f as WorktreeError,Je as autoDropCleanManagedWorktree,Pe as autoDropCleanManagedWorktreeLocked,Qe as branchIsPushedAtCurrentTip,q as checkoutPathForBranchInList,ze as closeManagedWorktree,Xe as createManagedWorktree,Ke as hasOpenManagedWorktree,_e as isManagedWorktreeBase,M as isRebaseInProgress,me as managedWorktreePath,I as managedWorktreesRoot,X as missingWorktreeRecoveryHint,x as openManagedWorktreeForNode,y as persistClosedWorktreeState,L as proveCleanEmptyManagedWorktree,Ue as rollbackManagedWorktree,we as samePath,ye as worktreeLockPathForCommonDir};