@telora/daemon 0.20.95 → 0.20.103

package/dist/worktree/reap.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Atomic worktree reaping.
+ *
+ * "The daemon owns the boundary of every path it creates." A worktree checkout
+ * on disk and its `.git/worktrees/<id>` registration must live and die together
+ * -- a directory left behind WITHOUT its registration is invisible to
+ * `git worktree list`/`prune` and accumulates as unbounded residue (the 4.9 GB
+ * BELL leak). This module wraps daemon-core's base removal with an explicit
+ * post-condition check so a reap can never silently leave that residue.
+ */
+/**
+ * Cap on the number of files we blob-verify for an UNREGISTERED, .git-less
+ * residue checkout. Above this we cannot cheaply prove reachability, so we
+ * preserve (safe) rather than stall crash recovery hashing a huge tree.
+ */
+export declare const MAX_RESIDUE_FILES_TO_VERIFY = 2000;
+/**
+ * True iff `worktreePath` is still listed in `repoPath`'s
+ * `git worktree list --porcelain` (i.e. git still has a registration for it).
+ */
+export declare function worktreeIsRegistered(repoPath: string, worktreePath: string): boolean;
+/**
+ * Remove a worktree ATOMICALLY: after this returns `true`, the directory is
+ * gone AND no `git worktree` registration for it remains.
+ *
+ * Delegates the removal to daemon-core's `removeWorktreeBase` (which runs
+ * `git worktree remove --force`, or an `rmSync` fallback + `git worktree
+ * prune`), then VERIFIES the post-condition. If a stale registration lingers
+ * (the fallback path can leave one until prune), it prunes and re-checks. Any
+ * remaining inconsistency -- a surviving directory or registration -- is logged
+ * loudly and returns `false`, so an unregistered leftover can never pass
+ * silently as a clean reap.
+ *
+ * Signature matches daemon-core `removeWorktreeBase` so it is a drop-in.
+ */
+export declare function reapWorktreeAtomically(repoPath: string, worktreePath: string): boolean;
+/** Verdict on whether an unregistered residue checkout is safe to reap. */
+export interface ResidueClassification {
+    /** True iff the residue's content is already reachable from integration. */
+    reapSafe: boolean;
+    /** Human-readable justification (for the crash-recovery log). */
+    reason: string;
+}
+/**
+ * Classify whether an UNREGISTERED residue checkout (a directory under the
+ * worktree dir with no `git worktree list` entry) is safe to reap. Because
+ * there is no branch ref to diff, safety is judged by content reachability from
+ * integration:
+ *
+ *  - Functional checkout (its HEAD still resolves): reap-safe iff it has no
+ *    uncommitted changes AND its HEAD commit is an ancestor of integration.
+ *  - Broken/.git-less checkout: reap-safe iff every file matches the same
+ *    path's blob in integration ({@link classifyResidueByContent}).
+ *
+ * Every uncertain case resolves to `reapSafe: false` (preserve) so unmerged
+ * work is never destroyed -- the atomic-reap half of this focus ensures no NEW
+ * residue accumulates while preserved residue awaits manual review.
+ */
+export declare function classifyUnregisteredResidue(residuePath: string, repoPath: string, integrationBranch: string): ResidueClassification;
+//# sourceMappingURL=reap.d.ts.map

package/dist/worktree/reap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reap.d.ts","sourceRoot":"","sources":["../../src/worktree/reap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAUH;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,OAAO,CAAC;AAEhD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAUpF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAuBtF;AAED,2EAA2E;AAC3E,MAAM,WAAW,qBAAqB;IACpC,4EAA4E;IAC5E,QAAQ,EAAE,OAAO,CAAC;IAClB,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC;CAChB;AAwED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,2BAA2B,CACzC,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,iBAAiB,EAAE,MAAM,GACxB,qBAAqB,CAsBvB"}

package/dist/worktree/reap.js

@@ -0,0 +1,175 @@
+/**
+ * Atomic worktree reaping.
+ *
+ * "The daemon owns the boundary of every path it creates." A worktree checkout
+ * on disk and its `.git/worktrees/<id>` registration must live and die together
+ * -- a directory left behind WITHOUT its registration is invisible to
+ * `git worktree list`/`prune` and accumulates as unbounded residue (the 4.9 GB
+ * BELL leak). This module wraps daemon-core's base removal with an explicit
+ * post-condition check so a reap can never silently leave that residue.
+ */
+import { existsSync, readdirSync } from 'node:fs';
+import { resolve, join } from 'node:path';
+import { runGitSync } from '../git/index.js';
+import { removeWorktreeBase } from '@telora/daemon-core';
+import { createLogger } from '../log.js';
+const log = createLogger({ module: 'worktree' });
+/**
+ * Cap on the number of files we blob-verify for an UNREGISTERED, .git-less
+ * residue checkout. Above this we cannot cheaply prove reachability, so we
+ * preserve (safe) rather than stall crash recovery hashing a huge tree.
+ */
+export const MAX_RESIDUE_FILES_TO_VERIFY = 2000;
+/**
+ * True iff `worktreePath` is still listed in `repoPath`'s
+ * `git worktree list --porcelain` (i.e. git still has a registration for it).
+ */
+export function worktreeIsRegistered(repoPath, worktreePath) {
+    const result = runGitSync(['worktree', 'list', '--porcelain'], repoPath);
+    if (!result.success)
+        return false;
+    const target = resolve(worktreePath);
+    for (const line of result.output.split('\n')) {
+        if (line.startsWith('worktree ')) {
+            if (resolve(line.slice('worktree '.length).trim()) === target)
+                return true;
+        }
+    }
+    return false;
+}
+/**
+ * Remove a worktree ATOMICALLY: after this returns `true`, the directory is
+ * gone AND no `git worktree` registration for it remains.
+ *
+ * Delegates the removal to daemon-core's `removeWorktreeBase` (which runs
+ * `git worktree remove --force`, or an `rmSync` fallback + `git worktree
+ * prune`), then VERIFIES the post-condition. If a stale registration lingers
+ * (the fallback path can leave one until prune), it prunes and re-checks. Any
+ * remaining inconsistency -- a surviving directory or registration -- is logged
+ * loudly and returns `false`, so an unregistered leftover can never pass
+ * silently as a clean reap.
+ *
+ * Signature matches daemon-core `removeWorktreeBase` so it is a drop-in.
+ */
+export function reapWorktreeAtomically(repoPath, worktreePath) {
+    const removed = removeWorktreeBase(repoPath, worktreePath);
+    if (!removed)
+        return false;
+    let dirGone = !existsSync(worktreePath);
+    let registered = worktreeIsRegistered(repoPath, worktreePath);
+    if (registered) {
+        // The rmSync-fallback path drops the directory but leaves the registration
+        // until a prune; converge it here so the two never diverge.
+        runGitSync(['worktree', 'prune'], repoPath);
+        registered = worktreeIsRegistered(repoPath, worktreePath);
+        dirGone = !existsSync(worktreePath);
+    }
+    if (!dirGone || registered) {
+        log.error(`Worktree reap left an inconsistent state at ${worktreePath}: ` +
+            `dirGone=${dirGone}, stillRegistered=${registered}. Manual cleanup may be required.`);
+        return false;
+    }
+    return true;
+}
+/**
+ * Recursively list repo-relative file paths under `dir`, EXCLUDING any `.git`
+ * entry (the residue's dangling gitdir pointer). Returns null on a read error,
+ * or once the count exceeds {@link MAX_RESIDUE_FILES_TO_VERIFY} (caller then
+ * preserves rather than verify an unbounded tree).
+ */
+function listResidueFiles(dir) {
+    const out = [];
+    const walk = (abs, rel) => {
+        let entries;
+        try {
+            entries = readdirSync(abs, { withFileTypes: true });
+        }
+        catch {
+            return false;
+        }
+        for (const e of entries) {
+            if (e.name === '.git')
+                continue;
+            const childRel = rel ? `${rel}/${e.name}` : e.name;
+            if (e.isDirectory()) {
+                if (!walk(join(abs, e.name), childRel))
+                    return false;
+            }
+            else {
+                out.push(childRel);
+                if (out.length > MAX_RESIDUE_FILES_TO_VERIFY)
+                    return false;
+            }
+        }
+        return true;
+    };
+    return walk(dir, '') ? out : null;
+}
+/**
+ * Blob-level reachability check for a broken (.git-less) residue checkout: it is
+ * reap-safe ONLY when EVERY file it holds matches the same path's blob in the
+ * integration branch (content already reachable). Any new or modified file --
+ * i.e. potential unmerged work -- makes it unsafe (preserve). An unreadable or
+ * over-large tree is likewise preserved. Errs strictly toward preserve so a
+ * reap never loses work.
+ */
+function classifyResidueByContent(residuePath, repoPath, integrationBranch) {
+    const files = listResidueFiles(residuePath);
+    if (files === null) {
+        return { reapSafe: false, reason: 'residue too large or unreadable to verify; preserved for manual review' };
+    }
+    if (files.length === 0) {
+        return { reapSafe: true, reason: 'residue holds no files' };
+    }
+    for (const rel of files) {
+        const abs = join(residuePath, rel);
+        const blob = runGitSync(['hash-object', abs], repoPath);
+        if (!blob.success || blob.output.trim().length === 0) {
+            return { reapSafe: false, reason: `could not hash residue file ${rel}; preserved` };
+        }
+        const intBlob = runGitSync(['rev-parse', '--verify', '--quiet', `${integrationBranch}:${rel}`], repoPath);
+        if (!intBlob.success || intBlob.output.trim().length === 0) {
+            return { reapSafe: false, reason: `${rel} is absent from ${integrationBranch} (potential unmerged work)` };
+        }
+        if (blob.output.trim() !== intBlob.output.trim()) {
+            return { reapSafe: false, reason: `${rel} differs from ${integrationBranch} (potential unmerged work)` };
+        }
+    }
+    return { reapSafe: true, reason: `all ${files.length} residue file(s) match ${integrationBranch}` };
+}
+/**
+ * Classify whether an UNREGISTERED residue checkout (a directory under the
+ * worktree dir with no `git worktree list` entry) is safe to reap. Because
+ * there is no branch ref to diff, safety is judged by content reachability from
+ * integration:
+ *
+ *  - Functional checkout (its HEAD still resolves): reap-safe iff it has no
+ *    uncommitted changes AND its HEAD commit is an ancestor of integration.
+ *  - Broken/.git-less checkout: reap-safe iff every file matches the same
+ *    path's blob in integration ({@link classifyResidueByContent}).
+ *
+ * Every uncertain case resolves to `reapSafe: false` (preserve) so unmerged
+ * work is never destroyed -- the atomic-reap half of this focus ensures no NEW
+ * residue accumulates while preserved residue awaits manual review.
+ */
+export function classifyUnregisteredResidue(residuePath, repoPath, integrationBranch) {
+    const head = runGitSync(['rev-parse', '--verify', 'HEAD'], residuePath);
+    if (head.success && head.output.trim().length > 0) {
+        const sha = head.output.trim();
+        const status = runGitSync(['status', '--porcelain'], residuePath);
+        if (status.success && status.output.trim().length > 0) {
+            return { reapSafe: false, reason: 'functional checkout has uncommitted changes (potential unmerged work)' };
+        }
+        const ancestor = runGitSync(['merge-base', '--is-ancestor', sha, integrationBranch], repoPath);
+        if (ancestor.success) {
+            return { reapSafe: true, reason: `HEAD ${sha.slice(0, 8)} is reachable from ${integrationBranch}` };
+        }
+        return {
+            reapSafe: false,
+            reason: `HEAD ${sha.slice(0, 8)} holds commit(s) not reachable from ${integrationBranch}`,
+        };
+    }
+    // No resolvable HEAD -- the classic .git-less residue. Fall back to blobs.
+    return classifyResidueByContent(residuePath, repoPath, integrationBranch);
+}
+//# sourceMappingURL=reap.js.map

package/dist/worktree/reap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reap.js","sourceRoot":"","sources":["../../src/worktree/reap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;AAEjD;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,CAAC;AAEhD;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB,EAAE,YAAoB;IACzE,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,QAAQ,CAAC,CAAC;IACzE,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAClC,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7C,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YACjC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,MAAM;gBAAE,OAAO,IAAI,CAAC;QAC7E,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAgB,EAAE,YAAoB;IAC3E,MAAM,OAAO,GAAG,kBAAkB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC3D,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAE3B,IAAI,OAAO,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IACxC,IAAI,UAAU,GAAG,oBAAoB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAE9D,IAAI,UAAU,EAAE,CAAC;QACf,2EAA2E;QAC3E,4DAA4D;QAC5D,UAAU,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC5C,UAAU,GAAG,oBAAoB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAC1D,OAAO,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IACtC,CAAC;IAED,IAAI,CAAC,OAAO,IAAI,UAAU,EAAE,CAAC;QAC3B,GAAG,CAAC,KAAK,CACP,+CAA+C,YAAY,IAAI;YAC/D,WAAW,OAAO,qBAAqB,UAAU,mCAAmC,CACrF,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAUD;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,GAAW;IACnC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,GAAW,EAAW,EAAE;QACjD,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;gBAAE,SAAS;YAChC,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACnD,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;gBACpB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC;oBAAE,OAAO,KAAK,CAAC;YACvD,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACnB,IAAI,GAAG,CAAC,MAAM,GAAG,2BAA2B;oBAAE,OAAO,KAAK,CAAC;YAC7D,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACpC,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,wBAAwB,CAC/B,WAAmB,EACnB,QAAgB,EAChB,iBAAyB;IAEzB,MAAM,KAAK,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC5C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,wEAAwE,EAAE,CAAC;IAC/G,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IAC9D,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,aAAa,EAAE,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;QACxD,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,GAAG,aAAa,EAAE,CAAC;QACtF,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,CACxB,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,iBAAiB,IAAI,GAAG,EAAE,CAAC,EACnE,QAAQ,CACT,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3D,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,mBAAmB,iBAAiB,4BAA4B,EAAE,CAAC;QAC7G,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YACjD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,iBAAiB,iBAAiB,4BAA4B,EAAE,CAAC;QAC3G,CAAC;IACH,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,KAAK,CAAC,MAAM,0BAA0B,iBAAiB,EAAE,EAAE,CAAC;AACtG,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,2BAA2B,CACzC,WAAmB,EACnB,QAAgB,EAChB,iBAAyB;IAEzB,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,WAAW,CAAC,CAAC;IACxE,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,WAAW,CAAC,CAAC;QAClE,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,uEAAuE,EAAE,CAAC;QAC9G,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,CACzB,CAAC,YAAY,EAAE,eAAe,EAAE,GAAG,EAAE,iBAAiB,CAAC,EACvD,QAAQ,CACT,CAAC;QACF,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,sBAAsB,iBAAiB,EAAE,EAAE,CAAC;QACtG,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,QAAQ,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,uCAAuC,iBAAiB,EAAE;SAC1F,CAAC;IACJ,CAAC;IACD,2EAA2E;IAC3E,OAAO,wBAAwB,CAAC,WAAW,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAC;AAC5E,CAAC"}

package/dist/worktree/safety.d.ts

@@ -4,8 +4,16 @@
  * Uncommitted change detection, unmerged commit checks, safety commits,
  * guarded worktree removal, and WIP commit after agent exit.
  */
+import { type SweepRefusalReporter } from './scratch-guard.js';
+import { type WorktreeIdentityViolationReporter } from './identity.js';
 /**
  * Check if a worktree has uncommitted changes (dirty working tree).
+ *
+ * Identity-guarded: if the directory is not the worktree it names (a `.git`-less
+ * checkout whose `git status` would report the ENCLOSING repo's tree), the
+ * enclosing repo's state is never attributed to this worktree -- the mismatch is
+ * logged loudly and the function returns false. The write paths (guardedCommit,
+ * removeWorktree) are the hard gate; this keeps the read from lying.
  */
 export declare function worktreeHasUncommittedChanges(worktreePath: string): boolean;
 /**
@@ -16,7 +24,7 @@ export declare function branchHasUnmergedCommits(branchName: string, targetBranc
  * Commit all uncommitted changes in a worktree as a safety net.
  * Returns the commit hash if successful, null otherwise.
  */
-export declare function safetyCommitWorktree(worktreePath: string, deliveryName: string): string | null;
+export declare function safetyCommitWorktree(worktreePath: string, deliveryName: string, reporter?: SweepRefusalReporter): string | null;
 /**
  * Generated lockfile basenames the daemon may safely auto-commit. These are
  * machine-regenerated (never hand-authored), so a worktree whose ONLY dirt is
@@ -52,7 +60,7 @@ export declare function dirtyChangesAreGeneratedLockfilesOnly(worktreePath: stri
  * agent work is never silently committed here. Returns the commit hash, or
  * null if staging/committing failed (e.g. nothing staged).
  */
-export declare function commitGeneratedLockfiles(worktreePath: string): string | null;
+export declare function commitGeneratedLockfiles(worktreePath: string, reporter?: SweepRefusalReporter): string | null;
 /**
  * Remove a worktree when an agent session ends.
  * The branch is preserved for PR creation.
@@ -68,6 +76,7 @@ export declare function removeWorktree(repoPath: string, worktreePath: string, o
     integrationBranch?: string;
     deliveryName?: string;
     mergeSucceeded?: boolean;
+    identityReporter?: WorktreeIdentityViolationReporter;
 }): boolean;
 /**
  * Commit any uncommitted changes in a worktree as a WIP commit.
@@ -76,9 +85,11 @@ export declare function removeWorktree(repoPath: string, worktreePath: string, o
  * removal. Captures in-flight work that the agent didn't commit before
  * being terminated.
  *
- * Delegates to daemon-core's commitWip for the actual git operations.
+ * Stages via the scoped-staging guard (scratch-excluded, sweep-refused) and
+ * commits in the daemon package -- it no longer delegates to daemon-core's
+ * blind-`git add -A` commitWip, so the WIP path is guarded like every other.
  *
  * @returns The commit hash if a WIP commit was created, null if no changes or failure.
  */
-export declare function commitWipChanges(worktreePath: string, contextName: string): string | null;
+export declare function commitWipChanges(worktreePath: string, contextName: string, reporter?: SweepRefusalReporter): string | null;
 //# sourceMappingURL=safety.d.ts.map

package/dist/worktree/safety.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"safety.d.ts","sourceRoot":"","sources":["../../src/worktree/safety.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAaH;;GAEG;AACH,wBAAgB,6BAA6B,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAI3E;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GACf,OAAO,CAMT;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAqB9F;AAED;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,EAAE,SAAS,MAAM,EAMzD,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qCAAqC,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAWnF;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgB5E;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE;IACP,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,OAAO,CAAC;CACrB,GACL,OAAO,CAgDT;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGzF"}
+{"version":3,"file":"safety.d.ts","sourceRoot":"","sources":["../../src/worktree/safety.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAGL,KAAK,iCAAiC,EACvC,MAAM,eAAe,CAAC;AAMvB;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAa3E;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GACf,OAAO,CAMT;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,oBAAoB,GAC9B,MAAM,GAAG,IAAI,CAUf;AAED;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,EAAE,SAAS,MAAM,EAMzD,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qCAAqC,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAWnF;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,oBAAoB,GAC9B,MAAM,GAAG,IAAI,CAUf;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE;IACP,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,gBAAgB,CAAC,EAAE,iCAAiC,CAAC;CACjD,GACL,OAAO,CAsET;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAC9B,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,oBAAoB,GAC9B,MAAM,GAAG,IAAI,CAQf"}

package/dist/worktree/safety.js

@@ -6,15 +6,30 @@
  */
 import { existsSync } from 'node:fs';
 import { runGitSync } from '../git/index.js';
-import { commitWip, removeWorktreeBase, } from '@telora/daemon-core';
+import { guardedCommit, worktreeHasNonScratchChanges, } from './scratch-guard.js';
+import { reapWorktreeAtomically } from './reap.js';
+import { assertWorktreeIdentity, defaultWorktreeIdentityViolationReporter, } from './identity.js';
 import { createLogger } from '../log.js';
 const log = createLogger({ module: 'worktree' });
 /**
  * Check if a worktree has uncommitted changes (dirty working tree).
+ *
+ * Identity-guarded: if the directory is not the worktree it names (a `.git`-less
+ * checkout whose `git status` would report the ENCLOSING repo's tree), the
+ * enclosing repo's state is never attributed to this worktree -- the mismatch is
+ * logged loudly and the function returns false. The write paths (guardedCommit,
+ * removeWorktree) are the hard gate; this keeps the read from lying.
  */
 export function worktreeHasUncommittedChanges(worktreePath) {
     if (!existsSync(worktreePath))
         return false;
+    const identity = assertWorktreeIdentity(worktreePath);
+    if (!identity.ok) {
+        log.error(`worktreeHasUncommittedChanges: ${worktreePath} is not its own worktree ` +
+            `(git resolves it to ${identity.resolvedRepo ?? 'no repository'}); refusing ` +
+            `to attribute the enclosing repo's status to it.`);
+        return false;
+    }
     const result = runGitSync(['status', '--porcelain'], worktreePath);
     return result.success && result.output.trim().length > 0;
 }
@@ -29,22 +44,16 @@ export function branchHasUnmergedCommits(branchName, targetBranch, repoPath) {
  * Commit all uncommitted changes in a worktree as a safety net.
  * Returns the commit hash if successful, null otherwise.
  */
-export function safetyCommitWorktree(worktreePath, deliveryName) {
-    // Stage everything
-    const addResult = runGitSync(['add', '-A'], worktreePath);
-    if (!addResult.success) {
-        log.error(`Safety commit: failed to stage changes: ${addResult.error}`);
-        return null;
-    }
-    // Commit
-    const commitResult = runGitSync(['commit', '-m', `wip: uncommitted agent work for "${deliveryName}" (safety commit)`], worktreePath);
-    if (!commitResult.success) {
-        log.warn(`Safety commit: commit failed (may be empty): ${commitResult.error}`);
-        return null;
-    }
-    // Return the new commit hash
-    const hashResult = runGitSync(['rev-parse', 'HEAD'], worktreePath);
-    return hashResult.success ? hashResult.output : null;
+export function safetyCommitWorktree(worktreePath, deliveryName, reporter) {
+    // Routes through the scoped-staging guard: daemon scratch (`.telora/`) is
+    // never staged, and a mass sweep is refused (working tree left untouched,
+    // reporter invoked) rather than committed.
+    return guardedCommit({
+        worktreePath,
+        message: `wip: uncommitted agent work for "${deliveryName}" (safety commit)`,
+        context: deliveryName,
+        reporter,
+    });
 }
 /**
  * Generated lockfile basenames the daemon may safely auto-commit. These are
@@ -101,19 +110,16 @@ export function dirtyChangesAreGeneratedLockfilesOnly(worktreePath) {
  * agent work is never silently committed here. Returns the commit hash, or
  * null if staging/committing failed (e.g. nothing staged).
  */
-export function commitGeneratedLockfiles(worktreePath) {
-    const addResult = runGitSync(['add', '-A'], worktreePath);
-    if (!addResult.success) {
-        log.error(`lockfile auto-commit: failed to stage changes: ${addResult.error}`);
-        return null;
-    }
-    const commitResult = runGitSync(['commit', '-m', 'chore: auto-commit generated lockfile churn (daemon remediation)'], worktreePath);
-    if (!commitResult.success) {
-        log.warn(`lockfile auto-commit: commit failed (may be empty): ${commitResult.error}`);
-        return null;
-    }
-    const hashResult = runGitSync(['rev-parse', 'HEAD'], worktreePath);
-    return hashResult.success ? hashResult.output : null;
+export function commitGeneratedLockfiles(worktreePath, reporter) {
+    // Callers gate this behind dirtyChangesAreGeneratedLockfilesOnly, so the
+    // staged set is a handful of lockfiles; the guard is pure defense-in-depth
+    // (scratch exclusion + sweep refusal) shared with every other commit path.
+    return guardedCommit({
+        worktreePath,
+        message: 'chore: auto-commit generated lockfile churn (daemon remediation)',
+        context: 'generated-lockfile churn',
+        reporter,
+    });
 }
 /**
  * Remove a worktree when an agent session ends.
@@ -133,8 +139,27 @@ export function removeWorktree(repoPath, worktreePath, options = {}) {
             runGitSync(['worktree', 'prune'], repoPath);
             return true;
         }
-        // Guard 1: Check for uncommitted changes and safety-commit them
-        if (worktreeHasUncommittedChanges(worktreePath)) {
+        // Guard 0: Identity. If the directory is not the worktree it names (a
+        // `.git`-less checkout whose git commands redirect at the enclosing repo),
+        // refuse before the dirty-check/safety-commit guards run -- otherwise the
+        // dirty-check would read the parent's tree and the safety commit would stage
+        // it. Unregistered residue is reaped via the crash-recovery residue path,
+        // not here.
+        const identity = assertWorktreeIdentity(worktreePath);
+        if (!identity.ok) {
+            const identityReporter = options.identityReporter ?? defaultWorktreeIdentityViolationReporter;
+            identityReporter({
+                worktreePath,
+                resolvedRepo: identity.resolvedRepo,
+                operation: 'remove',
+            });
+            return false;
+        }
+        // Guard 1: Safety-commit real (non-scratch) uncommitted work. Daemon
+        // scratch (`.telora/`) is disposable, so a worktree dirty only with scratch
+        // is treated as clean here -- it is discarded with the worktree, never
+        // committed and never a reason to refuse removal.
+        if (worktreeHasNonScratchChanges(worktreePath)) {
             log.warn(`Worktree has uncommitted changes: ${worktreePath}. ` +
                 `Creating safety commit to preserve work...`);
             const hash = safetyCommitWorktree(worktreePath, deliveryName ?? 'unknown');
@@ -142,9 +167,10 @@ export function removeWorktree(repoPath, worktreePath, options = {}) {
                 log.info(`Safety commit created: ${hash.slice(0, 8)}`);
             }
             else {
-                // Could not commit -- refuse to delete
+                // Could not commit (guard refused a mass sweep, or the commit failed) --
+                // refuse to delete so the work stays recoverable.
                 log.error(`REFUSING to remove worktree ${worktreePath}: ` +
-                    `has uncommitted changes and safety commit failed. ` +
+                    `has uncommitted changes and safety commit failed or was refused. ` +
                     `Manual cleanup required.`);
                 return false;
             }
@@ -158,8 +184,8 @@ export function removeWorktree(repoPath, worktreePath, options = {}) {
                 return false;
             }
         }
-        // Safe to remove -- delegate to daemon-core's base removal
-        return removeWorktreeBase(repoPath, worktreePath);
+        // Safe to remove -- atomic reap (dir + registration gone together, verified)
+        return reapWorktreeAtomically(repoPath, worktreePath);
     }
     catch (err) {
         log.error('Error removing worktree:', err instanceof Error ? err.message : String(err));
@@ -173,12 +199,19 @@ export function removeWorktree(repoPath, worktreePath, options = {}) {
  * removal. Captures in-flight work that the agent didn't commit before
  * being terminated.
  *
- * Delegates to daemon-core's commitWip for the actual git operations.
+ * Stages via the scoped-staging guard (scratch-excluded, sweep-refused) and
+ * commits in the daemon package -- it no longer delegates to daemon-core's
+ * blind-`git add -A` commitWip, so the WIP path is guarded like every other.
  *
  * @returns The commit hash if a WIP commit was created, null if no changes or failure.
  */
-export function commitWipChanges(worktreePath, contextName) {
+export function commitWipChanges(worktreePath, contextName, reporter) {
     log.info(`Committing WIP changes in ${worktreePath} for "${contextName}"`);
-    return commitWip(worktreePath, `Uncommitted work captured by daemon on agent exit (${contextName})`);
+    return guardedCommit({
+        worktreePath,
+        message: `WIP: Uncommitted work captured by daemon on agent exit (${contextName})`,
+        context: contextName,
+        reporter,
+    });
 }
 //# sourceMappingURL=safety.js.map

package/dist/worktree/safety.js.map

@@ -1 +1 @@
-{"version":3,"file":"safety.js","sourceRoot":"","sources":["../../src/worktree/safety.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EACL,SAAS,EACT,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;AAGjD;;GAEG;AACH,MAAM,UAAU,6BAA6B,CAAC,YAAoB;IAChE,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,YAAY,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAC3D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CACtC,UAAkB,EAClB,YAAoB,EACpB,QAAgB;IAEhB,MAAM,MAAM,GAAG,UAAU,CACvB,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,YAAY,KAAK,UAAU,EAAE,EAAE,IAAI,CAAC,EAC5D,QAAQ,CACT,CAAC;IACF,OAAO,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAC3D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,YAAoB,EAAE,YAAoB;IAC7E,mBAAmB;IACnB,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,YAAY,CAAC,CAAC;IAC1D,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QACvB,GAAG,CAAC,KAAK,CAAC,2CAA2C,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,SAAS;IACT,MAAM,YAAY,GAAG,UAAU,CAC7B,CAAC,QAAQ,EAAE,IAAI,EAAE,oCAAoC,YAAY,mBAAmB,CAAC,EACrF,YAAY,CACb,CAAC;IACF,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;QAC1B,GAAG,CAAC,IAAI,CAAC,gDAAgD,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC;QAC/E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,6BAA6B;IAC7B,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC;IACnE,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACvD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAsB;IAC7D,mBAAmB;IACnB,qBAAqB;IACrB,WAAW;IACX,gBAAgB;IAChB,WAAW;CACZ,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,qCAAqC,CAAC,YAAoB;IACxE,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC;IAC1E,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,oBAAoB,CAAC,EAAE,YAAY,CAAC,CAAC;IAC3F,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IACzD,MAAM,KAAK,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;SAC3E,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,uCAAuC;IAC7E,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,4BAA4B,CAAC,CAAC;IACxD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,YAAoB;IAC3D,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,YAAY,CAAC,CAAC;IAC1D,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QACvB,GAAG,CAAC,KAAK,CAAC,kDAAkD,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC;QAC/E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,YAAY,GAAG,UAAU,CAC7B,CAAC,QAAQ,EAAE,IAAI,EAAE,kEAAkE,CAAC,EACpF,YAAY,CACb,CAAC;IACF,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;QAC1B,GAAG,CAAC,IAAI,CAAC,uDAAuD,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC;QACtF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC;IACnE,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACvD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAgB,EAChB,YAAoB,EACpB,UAKI,EAAE;IAEN,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,YAAY,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;IAEhF,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC9B,GAAG,CAAC,IAAI,CAAC,6BAA6B,YAAY,EAAE,CAAC,CAAC;YACtD,UAAU,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,gEAAgE;QAChE,IAAI,6BAA6B,CAAC,YAAY,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,IAAI,CACN,qCAAqC,YAAY,IAAI;gBACrD,4CAA4C,CAC7C,CAAC;YACF,MAAM,IAAI,GAAG,oBAAoB,CAAC,YAAY,EAAE,YAAY,IAAI,SAAS,CAAC,CAAC;YAC3E,IAAI,IAAI,EAAE,CAAC;gBACT,GAAG,CAAC,IAAI,CAAC,0BAA0B,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;YACzD,CAAC;iBAAM,CAAC;gBACN,uCAAuC;gBACvC,GAAG,CAAC,KAAK,CACP,+BAA+B,YAAY,IAAI;oBAC/C,oDAAoD;oBACpD,0BAA0B,CAC3B,CAAC;gBACF,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,8EAA8E;QAC9E,IAAI,UAAU,IAAI,iBAAiB,IAAI,CAAC,cAAc,EAAE,CAAC;YACvD,IAAI,wBAAwB,CAAC,UAAU,EAAE,iBAAiB,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACtE,GAAG,CAAC,KAAK,CACP,+BAA+B,YAAY,IAAI;oBAC/C,UAAU,UAAU,8BAA8B,iBAAiB,IAAI;oBACvE,2CAA2C,CAC5C,CAAC;gBACF,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,2DAA2D;QAC3D,OAAO,kBAAkB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACxF,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,YAAoB,EAAE,WAAmB;IACxE,GAAG,CAAC,IAAI,CAAC,6BAA6B,YAAY,SAAS,WAAW,GAAG,CAAC,CAAC;IAC3E,OAAO,SAAS,CAAC,YAAY,EAAE,sDAAsD,WAAW,GAAG,CAAC,CAAC;AACvG,CAAC"}
+{"version":3,"file":"safety.js","sourceRoot":"","sources":["../../src/worktree/safety.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EACL,aAAa,EACb,4BAA4B,GAE7B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EACL,sBAAsB,EACtB,wCAAwC,GAEzC,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;AAGjD;;;;;;;;GAQG;AACH,MAAM,UAAU,6BAA6B,CAAC,YAAoB;IAChE,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,QAAQ,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAC;IACtD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,GAAG,CAAC,KAAK,CACP,kCAAkC,YAAY,2BAA2B;YACzE,uBAAuB,QAAQ,CAAC,YAAY,IAAI,eAAe,cAAc;YAC7E,iDAAiD,CAClD,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,YAAY,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAC3D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CACtC,UAAkB,EAClB,YAAoB,EACpB,QAAgB;IAEhB,MAAM,MAAM,GAAG,UAAU,CACvB,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,YAAY,KAAK,UAAU,EAAE,EAAE,IAAI,CAAC,EAC5D,QAAQ,CACT,CAAC;IACF,OAAO,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAC3D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,YAAoB,EACpB,YAAoB,EACpB,QAA+B;IAE/B,0EAA0E;IAC1E,0EAA0E;IAC1E,2CAA2C;IAC3C,OAAO,aAAa,CAAC;QACnB,YAAY;QACZ,OAAO,EAAE,oCAAoC,YAAY,mBAAmB;QAC5E,OAAO,EAAE,YAAY;QACrB,QAAQ;KACT,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAsB;IAC7D,mBAAmB;IACnB,qBAAqB;IACrB,WAAW;IACX,gBAAgB;IAChB,WAAW;CACZ,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,qCAAqC,CAAC,YAAoB;IACxE,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC;IAC1E,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,oBAAoB,CAAC,EAAE,YAAY,CAAC,CAAC;IAC3F,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IACzD,MAAM,KAAK,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;SAC3E,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,uCAAuC;IAC7E,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,4BAA4B,CAAC,CAAC;IACxD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CACtC,YAAoB,EACpB,QAA+B;IAE/B,yEAAyE;IACzE,2EAA2E;IAC3E,2EAA2E;IAC3E,OAAO,aAAa,CAAC;QACnB,YAAY;QACZ,OAAO,EAAE,kEAAkE;QAC3E,OAAO,EAAE,0BAA0B;QACnC,QAAQ;KACT,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAgB,EAChB,YAAoB,EACpB,UAMI,EAAE;IAEN,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,YAAY,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;IAEhF,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC9B,GAAG,CAAC,IAAI,CAAC,6BAA6B,YAAY,EAAE,CAAC,CAAC;YACtD,UAAU,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,sEAAsE;QACtE,2EAA2E;QAC3E,0EAA0E;QAC1E,6EAA6E;QAC7E,0EAA0E;QAC1E,YAAY;QACZ,MAAM,QAAQ,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAC;QACtD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,gBAAgB,GACpB,OAAO,CAAC,gBAAgB,IAAI,wCAAwC,CAAC;YACvE,gBAAgB,CAAC;gBACf,YAAY;gBACZ,YAAY,EAAE,QAAQ,CAAC,YAAY;gBACnC,SAAS,EAAE,QAAQ;aACpB,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;QAED,qEAAqE;QACrE,4EAA4E;QAC5E,uEAAuE;QACvE,kDAAkD;QAClD,IAAI,4BAA4B,CAAC,YAAY,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,IAAI,CACN,qCAAqC,YAAY,IAAI;gBACrD,4CAA4C,CAC7C,CAAC;YACF,MAAM,IAAI,GAAG,oBAAoB,CAAC,YAAY,EAAE,YAAY,IAAI,SAAS,CAAC,CAAC;YAC3E,IAAI,IAAI,EAAE,CAAC;gBACT,GAAG,CAAC,IAAI,CAAC,0BAA0B,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;YACzD,CAAC;iBAAM,CAAC;gBACN,yEAAyE;gBACzE,kDAAkD;gBAClD,GAAG,CAAC,KAAK,CACP,+BAA+B,YAAY,IAAI;oBAC/C,mEAAmE;oBACnE,0BAA0B,CAC3B,CAAC;gBACF,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,8EAA8E;QAC9E,IAAI,UAAU,IAAI,iBAAiB,IAAI,CAAC,cAAc,EAAE,CAAC;YACvD,IAAI,wBAAwB,CAAC,UAAU,EAAE,iBAAiB,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACtE,GAAG,CAAC,KAAK,CACP,+BAA+B,YAAY,IAAI;oBAC/C,UAAU,UAAU,8BAA8B,iBAAiB,IAAI;oBACvE,2CAA2C,CAC5C,CAAC;gBACF,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,6EAA6E;QAC7E,OAAO,sBAAsB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACxF,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gBAAgB,CAC9B,YAAoB,EACpB,WAAmB,EACnB,QAA+B;IAE/B,GAAG,CAAC,IAAI,CAAC,6BAA6B,YAAY,SAAS,WAAW,GAAG,CAAC,CAAC;IAC3E,OAAO,aAAa,CAAC;QACnB,YAAY;QACZ,OAAO,EAAE,2DAA2D,WAAW,GAAG;QAClF,OAAO,EAAE,WAAW;QACpB,QAAQ;KACT,CAAC,CAAC;AACL,CAAC"}

package/dist/worktree/scratch-guard.d.ts

@@ -0,0 +1,126 @@
+/**
+ * Scoped-staging guard for daemon-authored safety / WIP / lockfile commits.
+ *
+ * "The daemon owns the boundary of every path it creates." A blind `git add -A`
+ * in a repo whose `.gitignore` is missing or broken can sweep the entire
+ * worktree tree (nested agent checkouts under `.telora/`) into history -- the
+ * 15,684-file BELL-CSNv5 incident. Every daemon-authored commit MUST route its
+ * staging through this guard so that:
+ *
+ *  1. Daemon scratch (`.telora/` and, optionally, the configured worktree dir)
+ *     is NEVER staged, regardless of the repo's ignore state -- enforced by a
+ *     git `:(exclude)` pathspec, not by trusting `.gitignore`.
+ *  2. A commit whose (post-exclusion) staged file count exceeds a sane
+ *     threshold is REFUSED -- the guard stages nothing and leaves the working
+ *     tree untouched so the caller can escalate and the real work stays
+ *     recoverable.
+ *
+ * This is defense-in-depth BEHIND the boot-time `.gitignore` convergence: even
+ * with a correct ignore, the sweep must be structurally impossible here.
+ */
+import { type WorktreeIdentityViolationReporter } from './identity.js';
+/** Conservative default sweep ceiling for a single automated commit. */
+export declare const DEFAULT_SAFETY_COMMIT_MAX_FILES = 200;
+/**
+ * Daemon scratch path prefixes that must never be staged by an automated
+ * commit. `.telora/` is the root of everything the daemon writes into a repo
+ * (config, worktrees, session logs); the daemon's worktree dir is nested under
+ * it, so this single prefix covers the sweep vector. Extra prefixes (e.g. a
+ * worktree dir configured OUTSIDE `.telora`) can be supplied per call.
+ */
+export declare const DEFAULT_SCRATCH_PREFIXES: readonly string[];
+/**
+ * Resolve the max-file sweep threshold via the canonical env-config index
+ * (`TELORA_SAFETY_COMMIT_MAX_FILES` in `@telora/daemon-core` `env-config.ts`).
+ * An invalid value fails loudly at parse time, per the env-config contract --
+ * there is no silent fallback. The daemon-core default must match
+ * {@link DEFAULT_SAFETY_COMMIT_MAX_FILES}; the scratch-guard test pins the two
+ * together.
+ */
+export declare function resolveSafetyCommitMaxFiles(env?: NodeJS.ProcessEnv): number;
+export interface ScopedStageOptions {
+    /** Scratch prefixes to hard-exclude (defaults to {@link DEFAULT_SCRATCH_PREFIXES}). */
+    scratchPrefixes?: readonly string[];
+    /** Max post-exclusion staged files before refusal (defaults to env / {@link DEFAULT_SAFETY_COMMIT_MAX_FILES}). */
+    maxFiles?: number;
+}
+/** Outcome of a scoped staging attempt. */
+export type ScopedStageResult = {
+    kind: 'staged';
+    staged: string[];
+    denied: string[];
+} | {
+    kind: 'refused_threshold';
+    /** Post-exclusion count that tripped the guard. */
+    count: number;
+    /** Bounded sample of the tripping paths for the escalation. */
+    sample: string[];
+    denied: string[];
+    maxFiles: number;
+} | {
+    kind: 'error';
+    message: string;
+};
+/**
+ * Stage the worktree's changes for a daemon-authored commit, HARD-excluding
+ * daemon scratch and REFUSING a mass sweep.
+ *
+ * On success stages everything except the scratch prefixes (via a git
+ * `:(exclude)` pathspec, so exclusion holds even when scratch is not
+ * gitignored). On threshold refusal stages NOTHING and returns the tripping
+ * count + a bounded sample so the caller can preserve the tree and escalate.
+ *
+ * Does not commit -- callers commit after a `staged` result.
+ */
+export declare function stageExcludingDaemonScratch(worktreePath: string, opts?: ScopedStageOptions): ScopedStageResult;
+/**
+ * True iff the worktree has uncommitted changes OUTSIDE daemon scratch. Daemon
+ * scratch (`.telora/`) is disposable, so a worktree dirty only with scratch has
+ * no agent work to preserve -- callers use this to decide whether a safety
+ * commit is even needed before removal.
+ */
+export declare function worktreeHasNonScratchChanges(worktreePath: string, scratchPrefixes?: readonly string[]): boolean;
+/** Details of a refused mass-sweep, handed to a {@link SweepRefusalReporter}. */
+export interface SweepRefusalReport {
+    worktreePath: string;
+    /** Human label for the commit context (delivery/focus name). */
+    context: string;
+    /** Post-exclusion staged count that tripped the guard. */
+    count: number;
+    /** Bounded sample of the tripping paths. */
+    sample: string[];
+    maxFiles: number;
+}
+/**
+ * Callback invoked when the guard refuses a mass sweep. Injected by a
+ * context-holding caller to file an escalation; defaults to a loud log so every
+ * refusal is at least named in the daemon log.
+ */
+export type SweepRefusalReporter = (report: SweepRefusalReport) => void;
+/** Default reporter: loudly name the worktree, count, and a path sample. */
+export declare const defaultSweepRefusalReporter: SweepRefusalReporter;
+/**
+ * Stage (scratch-excluded, sweep-guarded) and commit a daemon-authored commit.
+ * The ONE implementation every daemon safety/WIP/lockfile commit routes
+ * through, so none can stage `.telora/` scratch or sweep the tree.
+ *
+ * Returns the commit sha on success, or null when there was nothing to commit
+ * (clean or scratch-only tree), the worktree failed the identity check, the
+ * sweep was refused, or a git op failed. On a threshold refusal the working
+ * tree is left untouched and the reporter is invoked exactly once.
+ *
+ * Identity is asserted BEFORE any staging: if the directory is not the worktree
+ * it names (e.g. a `.git`-less checkout whose git commands resolve at the
+ * enclosing repo), nothing is staged or committed and the identity reporter is
+ * invoked once -- so a daemon safety/WIP/lockfile commit can never land in the
+ * parent repository's tree.
+ */
+export declare function guardedCommit(params: {
+    worktreePath: string;
+    message: string;
+    context: string;
+    reporter?: SweepRefusalReporter;
+    identityReporter?: WorktreeIdentityViolationReporter;
+    options?: ScopedStageOptions;
+}): string | null;
+//# sourceMappingURL=scratch-guard.d.ts.map