@teamvibe/poller 0.8.6 → 0.8.7

package/dist/worktree-manager.js

@@ -1,4 +1,7 @@
 import { existsSync } from 'fs';
+import { isGitCredentialInstanceRetained, isGitCredentialInstanceKnownDead, registeredWorktreeOwner } from './git-credential-session.js';
+import { logger } from './logger.js';
+import { createSessionInstance, readSessionOwner, writeSessionOwner, sameSessionInstance, reportSessionOwnerMismatch } from './session-instance.js';
 import { mkdir, readdir, stat, appendFile, readFile } from 'fs/promises';
 import { join } from 'path';
 import { execFile } from 'child_process';
@@ -6,8 +9,24 @@ import { promisify } from 'util';
 import { validateBrainId, resolveBrainDir } from './brain-path.js';
 import { readInboxRuntime } from './inbox-manager.js';
 const execFileAsync = promisify(execFile);
+// Serialize creation and deletion at a reusable thread path: ownership must
+// stay stable between the marker check and completion of git worktree remove.
+const worktreeOperations = new Map();
+async function withWorktreeLock(path, operation) {
+    const previous = worktreeOperations.get(path) ?? Promise.resolve();
+    const current = previous.catch(() => { }).then(operation);
+    worktreeOperations.set(path, current);
+    try {
+        return await current;
+    }
+    finally {
+        if (worktreeOperations.get(path) === current)
+            worktreeOperations.delete(path);
+    }
+}
 const WORKTREES_SUBDIR = '.worktrees';
-const EXCLUDE_ENTRY = `${WORKTREES_SUBDIR}/\n`;
+const OWNER_FILE = '.teamvibe-session-owner.json';
+const EXCLUDE_ENTRY = `${WORKTREES_SUBDIR}/\n${OWNER_FILE}\n`;
 /**
  * Spawned (non-foreground) Claude sessions run in isolated git worktrees off
  * the brain repo to avoid the sync-watchdog race in teamvibe.ai#120.
@@ -32,7 +51,7 @@ async function ensureExclude(brainPath) {
     catch {
         // .git/info/exclude may not exist (rare); fall back to creating it
     }
-    if (!current.split('\n').includes(WORKTREES_SUBDIR + '/')) {
+    if (!current.split('\n').includes(OWNER_FILE)) {
         await appendFile(excludePath, EXCLUDE_ENTRY);
     }
 }
@@ -43,46 +62,76 @@ async function ensureExclude(brainPath) {
  * Idempotent against existing worktrees at the same path: if one is found,
  * it's removed and recreated to guarantee a clean start.
  */
-export async function createWorktree(brainPath, sessionId, branch = 'main') {
-    await mkdir(join(brainPath, WORKTREES_SUBDIR), { recursive: true });
-    await ensureExclude(brainPath);
-    const worktreePath = join(brainPath, WORKTREES_SUBDIR, sessionId);
-    // Defensive cleanup in case a previous attempt left an orphan
-    try {
-        await execFileAsync('git', ['worktree', 'remove', '--force', worktreePath], { cwd: brainPath });
-    }
-    catch {
-        // Not registered as a worktree — fine
-    }
-    await execFileAsync('git', ['fetch', 'origin', branch, '--quiet'], { cwd: brainPath });
-    await execFileAsync('git', ['worktree', 'add', '--detach', worktreePath, `origin/${branch}`], { cwd: brainPath });
-    return worktreePath;
+export async function createWorktree(brainPath, sessionId, branch = 'main', instance = createSessionInstance()) {
+    return withWorktreeLock(join(brainPath, WORKTREES_SUBDIR, sessionId), async () => {
+        await mkdir(join(brainPath, WORKTREES_SUBDIR), { recursive: true });
+        await ensureExclude(brainPath);
+        const worktreePath = join(brainPath, WORKTREES_SUBDIR, sessionId);
+        // Defensive cleanup in case a previous attempt left an orphan
+        try {
+            await execFileAsync('git', ['worktree', 'remove', '--force', worktreePath], { cwd: brainPath });
+        }
+        catch {
+            // Not registered as a worktree — fine
+        }
+        await execFileAsync('git', ['fetch', 'origin', branch, '--quiet'], { cwd: brainPath });
+        await execFileAsync('git', ['worktree', 'add', '--no-checkout', '--detach', worktreePath, `origin/${branch}`], { cwd: brainPath });
+        // Register without checkout first: no usable checkout exists until its
+        // atomic 0600 ownership marker is installed. A crash before that leaves
+        // an incomplete, age-gated orphan rather than an unmarked live worktree.
+        writeSessionOwner(join(worktreePath, OWNER_FILE), instance);
+        await execFileAsync('git', ['reset', '--hard', `origin/${branch}`], { cwd: worktreePath });
+        return worktreePath;
+    });
 }
 /**
  * Remove a worktree by session ID. Force-removes so dirty state from a crashed
  * session doesn't block cleanup — the contract is that any session work the
  * caller wanted to preserve has already been pushed to `origin/<branch>`.
  */
-export async function removeWorktree(brainPath, sessionId) {
+export async function removeWorktree(brainPath, sessionId, instance) {
+    return removeOwnedWorktree(brainPath, sessionId, instance);
+}
+async function removeOwnedWorktree(brainPath, sessionId, instance, orphanCutoff) {
     const worktreePath = join(brainPath, WORKTREES_SUBDIR, sessionId);
-    try {
-        await execFileAsync('git', ['worktree', 'remove', '--force', worktreePath], { cwd: brainPath });
-    }
-    catch {
-        // Already gone, or never registered — fine
-    }
-    // Prune any stale administrative bookkeeping in .git/worktrees/
-    try {
-        await execFileAsync('git', ['worktree', 'prune'], { cwd: brainPath });
-    }
-    catch {
-        // best-effort
-    }
+    const expected = instance === undefined ? readSessionOwner(join(worktreePath, OWNER_FILE)) : instance;
+    return withWorktreeLock(worktreePath, async () => {
+        const current = readSessionOwner(join(worktreePath, OWNER_FILE));
+        if (orphanCutoff !== undefined) {
+            // Recheck under the same lock as creation, including retention before age.
+            if (isGitCredentialInstanceRetained(current, undefined, sessionId))
+                return;
+            if (!(current && isGitCredentialInstanceKnownDead(current)) && (await stat(worktreePath)).mtimeMs >= orphanCutoff)
+                return;
+            if (expected ? !sameSessionInstance(current, expected) : current !== undefined)
+                return;
+        }
+        else if (!expected || !sameSessionInstance(current, expected)) {
+            if (expected)
+                reportSessionOwnerMismatch(expected, current);
+            return;
+        }
+        try {
+            await execFileAsync('git', ['worktree', 'remove', '--force', worktreePath], { cwd: brainPath });
+        }
+        catch {
+            // Already gone, or never registered — fine
+        }
+        // Prune any stale administrative bookkeeping in .git/worktrees/
+        try {
+            await execFileAsync('git', ['worktree', 'prune'], { cwd: brainPath });
+        }
+        catch {
+            // best-effort
+        }
+    });
 }
 /**
  * Sweep orphan worktrees left behind by crashed sessions. Removes every
- * worktree under `<brainPath>/.worktrees/` whose directory mtime is older
- * than `maxAgeMs`. Intended to run once at poller startup.
+ * known-dead instance immediately, or an unregistered/legacy orphan older
+ * than `maxAgeMs`. Live sessions and registered tasks always retain their
+ * worktrees, including those with missing, malformed or changed markers.
+ * Intended to run once at poller startup.
  */
 export async function cleanupOrphanWorktrees(brainPath, maxAgeMs = 24 * 60 * 60 * 1000) {
     const worktreesDir = join(brainPath, WORKTREES_SUBDIR);
@@ -97,15 +146,24 @@ export async function cleanupOrphanWorktrees(brainPath, maxAgeMs = 24 * 60 * 60
     const cutoffMs = Date.now() - maxAgeMs;
     for (const entry of entries) {
         const path = join(worktreesDir, entry);
+        const instance = readSessionOwner(join(path, OWNER_FILE));
         const pending = readInboxRuntime(brainPath, entry);
         if (pending?.pin.resumePending && pending.pin.effectiveCwd === path)
             continue;
         try {
-            const s = await stat(path);
-            if (s.mtimeMs < cutoffMs) {
-                await removeWorktree(brainPath, entry);
-                removed.push(entry);
+            // Retain by thread metadata as well as marker: a corrupt marker cannot
+            // hide a live session or registered task from the shared predicate.
+            if (isGitCredentialInstanceRetained(instance, undefined, entry)) {
+                // Report damaged ownership with both IDs without reading credentials.
+                const expected = registeredWorktreeOwner(entry);
+                if (expected && !sameSessionInstance(instance, expected))
+                    reportSessionOwnerMismatch(expected, instance);
+                logger.info(`[Worktree] Retained ${path}: live session or registered task`);
+                continue;
             }
+            await removeOwnedWorktree(brainPath, entry, instance ?? null, cutoffMs);
+            if (!existsSync(path))
+                removed.push(entry);
         }
         catch {
             // skip entries we can't stat

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@teamvibe/poller",
-  "version": "0.8.6",
+  "version": "0.8.7",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@teamvibe/poller",
-      "version": "0.8.6",
+      "version": "0.8.7",
       "dependencies": {
         "@aws-sdk/client-dynamodb": "3.1108.0",
         "@aws-sdk/client-sqs": "3.1108.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@teamvibe/poller",
-  "version": "0.8.6",
+  "version": "0.8.7",
   "type": "module",
   "main": "./dist/index.js",
   "bin": {
@@ -8,6 +8,7 @@
   },
   "files": [
     "dist",
+    "bin",
     "npm-shrinkwrap.json"
   ],
   "scripts": {