@telora/daemon 0.21.7 → 0.21.26

package/dist/worktree/scratch-guard.js

@@ -21,6 +21,7 @@
 import { loadEnvConfig } from '@telora/daemon-core';
 import { runGitSync } from '../git/index.js';
 import { assertWorktreeIdentity, defaultWorktreeIdentityViolationReporter, } from './identity.js';
+import { isWorktreeUnderVerify } from './verify-interlock.js';
 import { createLogger } from '../log.js';
 const log = createLogger({ module: 'worktree' });
 /** Conservative default sweep ceiling for a single automated commit. */
@@ -48,21 +49,83 @@ export function resolveSafetyCommitMaxFiles(env) {
 function underPrefix(path, prefixes) {
     return prefixes.some((p) => path === p || path.startsWith(p + '/'));
 }
+function splitLines(out) {
+    return out
+        .split('\n')
+        .map((p) => p.trim())
+        .filter((p) => p.length > 0);
+}
 /**
- * Enumerate the repo-relative paths a `git add -A` WOULD stage: tracked
- * changes (incl. deletions) plus untracked, non-ignored files. Uses name-only
- * commands rather than parsing `git status --porcelain` (whose fixed-width
- * status prefix is corrupted by output trimming) -- the same technique
- * `dirtyChangesAreGeneratedLockfilesOnly` uses.
+ * Enumerate paths whose WORKTREE content differs from HEAD: tracked worktree
+ * changes (incl. deletions) plus untracked, non-ignored files. This is the set
+ * with real content behind it -- the agent work a safety commit must preserve.
+ * A staged-only change (a torn write) is deliberately NOT here: it has no
+ * worktree content, so it is not work to preserve.
+ *
+ * Uses name-only commands rather than parsing `git status --porcelain` (whose
+ * fixed-width status prefix is corrupted by output trimming).
  */
-function enumerateWouldStage(worktreePath) {
+export function enumerateWorktreeDelta(worktreePath) {
     const tracked = runGitSync(['diff', '--name-only', 'HEAD'], worktreePath);
     const untracked = runGitSync(['ls-files', '--others', '--exclude-standard'], worktreePath);
     if (!tracked.success || !untracked.success)
         return null;
-    return [...tracked.output.split('\n'), ...untracked.output.split('\n')]
-        .map((p) => p.trim())
-        .filter((p) => p.length > 0);
+    return [...new Set([...splitLines(tracked.output), ...splitLines(untracked.output)])];
+}
+/**
+ * Enumerate paths STAGED differently from HEAD (index vs HEAD). A staged path
+ * whose worktree copy matches HEAD is a TORN WRITE -- an index entry with no
+ * worktree content behind it. This is the index the detector
+ * (`git status --porcelain`, which consults the index) sees but the
+ * worktree-only enumeration above is blind to.
+ */
+export function enumerateIndexDelta(worktreePath) {
+    const staged = runGitSync(['diff', '--cached', '--name-only', 'HEAD'], worktreePath);
+    if (!staged.success)
+        return null;
+    return splitLines(staged.output);
+}
+/**
+ * INDEX-AWARE enumeration of every path dirty vs HEAD -- in the worktree OR the
+ * index. This is what `git status --porcelain` shows the DETECTOR
+ * (worktreeHasUncommittedChanges), so the REMEDIATOR agrees with the detector
+ * on what "dirty" means. `worktreeHasNonScratchChanges` deliberately does NOT
+ * use this (it asks the narrower "is there worktree content to preserve?" --
+ * see its doc).
+ */
+export function enumerateDirtyVsHead(worktreePath) {
+    const worktree = enumerateWorktreeDelta(worktreePath);
+    const index = enumerateIndexDelta(worktreePath);
+    if (worktree === null || index === null)
+        return null;
+    return [...new Set([...worktree, ...index])];
+}
+/** Enumerate + scratch-partition the worktree and index deltas. Null on git error. */
+function classifyDirt(worktreePath, scratchPrefixes) {
+    const worktreeDelta = enumerateWorktreeDelta(worktreePath);
+    const indexDelta = enumerateIndexDelta(worktreePath);
+    if (worktreeDelta === null || indexDelta === null)
+        return null;
+    const keptWorktree = worktreeDelta.filter((p) => !underPrefix(p, scratchPrefixes));
+    const keptIndex = indexDelta.filter((p) => !underPrefix(p, scratchPrefixes));
+    const denied = [
+        ...new Set([
+            ...worktreeDelta.filter((p) => underPrefix(p, scratchPrefixes)),
+            ...indexDelta.filter((p) => underPrefix(p, scratchPrefixes)),
+        ]),
+    ];
+    return { keptWorktree, keptIndex, denied };
+}
+/**
+ * Reconcile the index to the worktree by resetting all non-scratch staged paths
+ * to HEAD. Index-only: writes NO history and never touches a worktree file, so
+ * the sweep threshold (a commit-history guard) does not apply. The scratch
+ * exclusion is preserved for symmetry with the commit path.
+ */
+function reconcileIndexToWorktree(worktreePath, scratchPrefixes) {
+    const excludeSpecs = scratchPrefixes.map((p) => `:(exclude)${p}`);
+    const reset = runGitSync(['reset', '-q', 'HEAD', '--', '.', ...excludeSpecs], worktreePath);
+    return { success: reset.success, error: reset.success ? '' : reset.error };
 }
 /**
  * Stage the worktree's changes for a daemon-authored commit, HARD-excluding
@@ -78,34 +141,87 @@ function enumerateWouldStage(worktreePath) {
 export function stageExcludingDaemonScratch(worktreePath, opts = {}) {
     const scratchPrefixes = opts.scratchPrefixes ?? DEFAULT_SCRATCH_PREFIXES;
     const maxFiles = opts.maxFiles ?? resolveSafetyCommitMaxFiles();
-    const wouldStage = enumerateWouldStage(worktreePath);
-    if (wouldStage === null) {
+    const dirt = classifyDirt(worktreePath, scratchPrefixes);
+    if (dirt === null) {
         return { kind: 'error', message: 'could not enumerate worktree changes' };
     }
-    const denied = wouldStage.filter((p) => underPrefix(p, scratchPrefixes));
-    const kept = wouldStage.filter((p) => !underPrefix(p, scratchPrefixes));
-    if (kept.length > maxFiles) {
+    const { keptWorktree, keptIndex, denied } = dirt;
+    // TORN WRITE disposition: staged content with NO worktree content behind it
+    // (the worktree matches HEAD). A safety commit exists to PRESERVE agent work;
+    // an index entry with nothing behind it is not agent work, so committing it is
+    // both impossible (git finds nothing to commit) and wrong to escalate on.
+    // Reconcile the index to the worktree instead -- nothing is preserved because
+    // nothing was ever there.
+    if (keptWorktree.length === 0 && keptIndex.length > 0) {
+        const reset = reconcileIndexToWorktree(worktreePath, scratchPrefixes);
+        if (!reset.success) {
+            return { kind: 'error', message: reset.error };
+        }
+        return { kind: 'reconciled_torn_write', reconciled: keptIndex, denied };
+    }
+    // REAL WORK disposition: the committed set is the worktree delta (what
+    // `git add -A` then `git commit` records). The threshold guards that set.
+    if (keptWorktree.length > maxFiles) {
         // Refuse: stage nothing, leave the working tree untouched.
         return {
             kind: 'refused_threshold',
-            count: kept.length,
-            sample: kept.slice(0, 20),
+            count: keptWorktree.length,
+            sample: keptWorktree.slice(0, 20),
             denied,
             maxFiles,
         };
     }
-    if (kept.length === 0) {
+    if (keptWorktree.length === 0) {
         // Nothing to stage once scratch is excluded (a clean or scratch-only tree).
         return { kind: 'staged', staged: [], denied };
     }
     // Stage everything EXCEPT the scratch prefixes. `.` selects the full tree;
     // each `:(exclude)<prefix>` removes that dir and its contents from the set.
+    // `git add -A` snapshots the worktree into the index, which also reconciles
+    // any co-present torn-write index entry (its worktree == HEAD, so it drops out
+    // of the commit) -- so the MIXED case (real work + a torn write) ends clean
+    // with the real work committed and nothing lost.
     const excludeSpecs = scratchPrefixes.map((p) => `:(exclude)${p}`);
     const addResult = runGitSync(['add', '-A', '--', '.', ...excludeSpecs], worktreePath);
     if (!addResult.success) {
         return { kind: 'error', message: addResult.error };
     }
-    return { kind: 'staged', staged: kept, denied };
+    return { kind: 'staged', staged: keptWorktree, denied };
+}
+/**
+ * If the worktree's ONLY non-scratch dirt is a TORN WRITE -- staged index
+ * entries with no worktree content behind them (index != HEAD, worktree ==
+ * HEAD) -- reconcile the index to the worktree (reset to HEAD) and return the
+ * reconciled paths. Returns null when there is real worktree work to preserve
+ * (that is guardedCommit's job, not this one) or when the tree is clean/
+ * scratch-only. Writes NO history and never touches a worktree file.
+ *
+ * This is the dedicated reconcile handler the advance-block path calls BEFORE it
+ * considers re-waking a team: a torn write has no content for a team to commit,
+ * so nudging the team (and eventually escalating) would be a pointless loop --
+ * the daemon self-clears it here. Identity-guarded exactly like guardedCommit,
+ * so a `.git`-less checkout is never reset against the enclosing repo.
+ */
+export function reconcileTornWrite(worktreePath, opts = {}) {
+    const identity = assertWorktreeIdentity(worktreePath);
+    if (!identity.ok) {
+        // Not this directory's worktree -- leave it to the commit path's identity
+        // reporter; never reset against the enclosing repo.
+        return null;
+    }
+    const scratchPrefixes = opts.scratchPrefixes ?? DEFAULT_SCRATCH_PREFIXES;
+    const dirt = classifyDirt(worktreePath, scratchPrefixes);
+    if (dirt === null)
+        return null;
+    const { keptWorktree, keptIndex } = dirt;
+    if (keptWorktree.length > 0 || keptIndex.length === 0)
+        return null; // not a pure torn write
+    const reset = reconcileIndexToWorktree(worktreePath, scratchPrefixes);
+    if (!reset.success)
+        return null;
+    log.info(`reconcileTornWrite: reconciled ${keptIndex.length} torn-write path(s) at ${worktreePath} ` +
+        `(index reset to HEAD; no worktree content to preserve): ${keptIndex.slice(0, 5).join(', ')}`);
+    return { reconciled: keptIndex };
 }
 /**
  * True iff the worktree has uncommitted changes OUTSIDE daemon scratch. Daemon
@@ -125,10 +241,17 @@ export function worktreeHasNonScratchChanges(worktreePath, scratchPrefixes = DEF
             `to attribute the enclosing repo's changes to it.`);
         return false;
     }
-    const wouldStage = enumerateWouldStage(worktreePath);
-    if (wouldStage === null)
+    // Worktree-delta ONLY (not index-aware): this asks "is there worktree content
+    // to PRESERVE before we discard this worktree?", which a torn write (staged,
+    // no worktree content) is not -- so removeWorktree does not block on a torn
+    // write, it discards it with the worktree. The advance-gate detector
+    // (worktreeHasUncommittedChanges, via `git status --porcelain`) IS index-aware
+    // and drives the torn-write reconcile; these are deliberately different
+    // questions.
+    const worktreeDelta = enumerateWorktreeDelta(worktreePath);
+    if (worktreeDelta === null)
         return false;
-    return wouldStage.some((p) => !underPrefix(p, scratchPrefixes));
+    return worktreeDelta.some((p) => !underPrefix(p, scratchPrefixes));
 }
 /**
  * Paths the daemon itself authors into a READ-ONLY audit worktree, on top of
@@ -193,6 +316,19 @@ export const defaultSweepRefusalReporter = (r) => {
 export function guardedCommit(params) {
     const { worktreePath, message, context } = params;
     const reporter = params.reporter ?? defaultSweepRefusalReporter;
+    // Verify interlock: while a verify command is running in this worktree, defer
+    // -- stage and commit NOTHING. A `git add -A` inside a verify's mutation window
+    // would snapshot a transient tree the verify then restores, producing a torn
+    // write. This is a deliberate DEFERRAL, not a failure or a no-op: the next poll
+    // retries once the verify completes (the skip leaves no state behind). Checked
+    // FIRST, before the identity gate, so no daemon-authored commit path (safety /
+    // WIP / lockfile) touches a worktree mid-verify.
+    if (isWorktreeUnderVerify(worktreePath)) {
+        log.info(`guardedCommit: DEFERRING commit for "${context}" at ${worktreePath} -- a verify ` +
+            `command is running in this worktree; staging/committing a transient mid-verify tree ` +
+            `would tear a write. Deferred; the next poll retries once verify completes.`);
+        return null;
+    }
     // Identity gate: refuse before staging if git would act on a different repo.
     const identity = assertWorktreeIdentity(worktreePath);
     if (!identity.ok) {
@@ -219,6 +355,17 @@ export function guardedCommit(params) {
         });
         return null;
     }
+    if (stage.kind === 'reconciled_torn_write') {
+        // A torn write: staged index entries with no worktree content behind them.
+        // The index was reset to HEAD (the tree is now clean). No commit was made --
+        // there was nothing to preserve -- so this returns null like the clean case,
+        // but is logged DISTINCTLY so reading the log tells you a torn write was
+        // reconciled rather than a commit silently doing nothing.
+        log.info(`guardedCommit: reconciled torn write for "${context}" at ${worktreePath} -- ` +
+            `${stage.reconciled.length} staged path(s) had no worktree content behind them ` +
+            `(index reset to HEAD, nothing to preserve, no commit): ${stage.reconciled.slice(0, 5).join(', ')}`);
+        return null;
+    }
     if (stage.staged.length === 0) {
         // Clean or scratch-only tree -- nothing non-scratch to commit.
         return null;

package/dist/worktree/scratch-guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"scratch-guard.js","sourceRoot":"","sources":["../../src/worktree/scratch-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EACL,sBAAsB,EACtB,wCAAwC,GAEzC,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;AAEjD,wEAAwE;AACxE,MAAM,CAAC,MAAM,+BAA+B,GAAG,GAAG,CAAC;AAEnD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAsB,CAAC,SAAS,CAAC,CAAC;AAEvE;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CAAC,GAAuB;IACjE,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC,8BAA8B,CAAC;AAC3D,CAAC;AAuBD,mEAAmE;AACnE,SAAS,WAAW,CAAC,IAAY,EAAE,QAA2B;IAC5D,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,YAAoB;IAC/C,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC;IAC1E,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,oBAAoB,CAAC,EAAE,YAAY,CAAC,CAAC;IAC3F,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IACxD,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;SACpE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,2BAA2B,CACzC,YAAoB,EACpB,OAA2B,EAAE;IAE7B,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,wBAAwB,CAAC;IACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,2BAA2B,EAAE,CAAC;IAEhE,MAAM,UAAU,GAAG,mBAAmB,CAAC,YAAY,CAAC,CAAC;IACrD,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC;IAC5E,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC;IAExE,IAAI,IAAI,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;QAC3B,2DAA2D;QAC3D,OAAO;YACL,IAAI,EAAE,mBAAmB;YACzB,KAAK,EAAE,IAAI,CAAC,MAAM;YAClB,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YACzB,MAAM;YACN,QAAQ;SACT,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,4EAA4E;QAC5E,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;IAChD,CAAC;IAED,2EAA2E;IAC3E,4EAA4E;IAC5E,MAAM,YAAY,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAClE,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,YAAY,CAAC,EAAE,YAAY,CAAC,CAAC;IACtF,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QACvB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;IACrD,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAClD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAC1C,YAAoB,EACpB,kBAAqC,wBAAwB;IAE7D,yEAAyE;IACzE,6EAA6E;IAC7E,0EAA0E;IAC1E,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAC;IACtD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,GAAG,CAAC,KAAK,CACP,iCAAiC,YAAY,2BAA2B;YACxE,uBAAuB,QAAQ,CAAC,YAAY,IAAI,eAAe,cAAc;YAC7E,kDAAkD,CACnD,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,UAAU,GAAG,mBAAmB,CAAC,YAAY,CAAC,CAAC;IACrD,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAsB;IAClE,GAAG,wBAAwB;IAC3B,eAAe;IACf,uBAAuB;IACvB,oBAAoB;CACrB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mCAAmC,CAAC,YAAoB;IACtE,OAAO,4BAA4B,CAAC,YAAY,EAAE,iCAAiC,CAAC,CAAC;AACvF,CAAC;AAqBD,4EAA4E;AAC5E,MAAM,CAAC,MAAM,2BAA2B,GAAyB,CAAC,CAAC,EAAE,EAAE;IACrE,GAAG,CAAC,KAAK,CACP,+BAA+B,CAAC,CAAC,OAAO,QAAQ,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,KAAK,SAAS;QACnF,eAAe,CAAC,CAAC,QAAQ,sDAAsD;QAC/E,WAAW,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACjC,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,aAAa,CAAC,MAO7B;IACC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;IAClD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,2BAA2B,CAAC;IAEhE,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAC;IACtD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,gBAAgB,GACpB,MAAM,CAAC,gBAAgB,IAAI,wCAAwC,CAAC;QACtE,gBAAgB,CAAC;YACf,YAAY;YACZ,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,SAAS,EAAE,qBAAqB,OAAO,GAAG;SAC3C,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,KAAK,GAAG,2BAA2B,CAAC,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAExE,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC3B,GAAG,CAAC,IAAI,CAAC,sCAAsC,OAAO,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAAK,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACvC,QAAQ,CAAC;YACP,YAAY;YACZ,OAAO;YACP,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,+DAA+D;QAC/D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,YAAY,GAAG,UAAU,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,YAAY,CAAC,CAAC;IACzE,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;QAC1B,GAAG,CAAC,IAAI,CAAC,qCAAqC,OAAO,qBAAqB,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC;QAChG,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC;IACnE,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACvD,CAAC"}
+{"version":3,"file":"scratch-guard.js","sourceRoot":"","sources":["../../src/worktree/scratch-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EACL,sBAAsB,EACtB,wCAAwC,GAEzC,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;AAEjD,wEAAwE;AACxE,MAAM,CAAC,MAAM,+BAA+B,GAAG,GAAG,CAAC;AAEnD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAsB,CAAC,SAAS,CAAC,CAAC;AAEvE;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CAAC,GAAuB;IACjE,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC,8BAA8B,CAAC;AAC3D,CAAC;AAoCD,mEAAmE;AACnE,SAAS,WAAW,CAAC,IAAY,EAAE,QAA2B;IAC5D,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO,GAAG;SACP,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,YAAoB;IACzD,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC;IAC1E,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,oBAAoB,CAAC,EAAE,YAAY,CAAC,CAAC;IAC3F,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IACxD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AACxF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,YAAoB;IACtD,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC;IACrF,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IACjC,OAAO,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,YAAoB;IACvD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,mBAAmB,CAAC,YAAY,CAAC,CAAC;IAChD,IAAI,QAAQ,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACrD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC;AAYD,sFAAsF;AACtF,SAAS,YAAY,CACnB,YAAoB,EACpB,eAAkC;IAElC,MAAM,aAAa,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,mBAAmB,CAAC,YAAY,CAAC,CAAC;IACrD,IAAI,aAAa,KAAK,IAAI,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/D,MAAM,YAAY,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC;IACnF,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG;QACb,GAAG,IAAI,GAAG,CAAC;YACT,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;YAC/D,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;SAC7D,CAAC;KACH,CAAC;IACF,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACH,SAAS,wBAAwB,CAC/B,YAAoB,EACpB,eAAkC;IAElC,MAAM,YAAY,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,YAAY,CAAC,EAAE,YAAY,CAAC,CAAC;IAC5F,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,2BAA2B,CACzC,YAAoB,EACpB,OAA2B,EAAE;IAE7B,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,wBAAwB,CAAC;IACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,2BAA2B,EAAE,CAAC;IAEhE,MAAM,IAAI,GAAG,YAAY,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IACzD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC;IAC5E,CAAC;IACD,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAEjD,4EAA4E;IAC5E,8EAA8E;IAC9E,+EAA+E;IAC/E,0EAA0E;IAC1E,8EAA8E;IAC9E,0BAA0B;IAC1B,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtD,MAAM,KAAK,GAAG,wBAAwB,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;QACtE,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QACjD,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IAC1E,CAAC;IAED,uEAAuE;IACvE,0EAA0E;IAC1E,IAAI,YAAY,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;QACnC,2DAA2D;QAC3D,OAAO;YACL,IAAI,EAAE,mBAAmB;YACzB,KAAK,EAAE,YAAY,CAAC,MAAM;YAC1B,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YACjC,MAAM;YACN,QAAQ;SACT,CAAC;IACJ,CAAC;IAED,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,4EAA4E;QAC5E,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;IAChD,CAAC;IAED,2EAA2E;IAC3E,4EAA4E;IAC5E,4EAA4E;IAC5E,+EAA+E;IAC/E,4EAA4E;IAC5E,iDAAiD;IACjD,MAAM,YAAY,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAClE,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,YAAY,CAAC,EAAE,YAAY,CAAC,CAAC;IACtF,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QACvB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;IACrD,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,kBAAkB,CAChC,YAAoB,EACpB,OAA2B,EAAE;IAE7B,MAAM,QAAQ,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAC;IACtD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,0EAA0E;QAC1E,oDAAoD;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,wBAAwB,CAAC;IACzE,MAAM,IAAI,GAAG,YAAY,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IACzD,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IACzC,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,wBAAwB;IAC5F,MAAM,KAAK,GAAG,wBAAwB,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IACtE,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAChC,GAAG,CAAC,IAAI,CACN,kCAAkC,SAAS,CAAC,MAAM,0BAA0B,YAAY,GAAG;QAC3F,2DAA2D,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC9F,CAAC;IACF,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;AACnC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAC1C,YAAoB,EACpB,kBAAqC,wBAAwB;IAE7D,yEAAyE;IACzE,6EAA6E;IAC7E,0EAA0E;IAC1E,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAC;IACtD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,GAAG,CAAC,KAAK,CACP,iCAAiC,YAAY,2BAA2B;YACxE,uBAAuB,QAAQ,CAAC,YAAY,IAAI,eAAe,cAAc;YAC7E,kDAAkD,CACnD,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,8EAA8E;IAC9E,6EAA6E;IAC7E,4EAA4E;IAC5E,qEAAqE;IACrE,+EAA+E;IAC/E,wEAAwE;IACxE,aAAa;IACb,MAAM,aAAa,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAC;IAC3D,IAAI,aAAa,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACzC,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAsB;IAClE,GAAG,wBAAwB;IAC3B,eAAe;IACf,uBAAuB;IACvB,oBAAoB;CACrB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mCAAmC,CAAC,YAAoB;IACtE,OAAO,4BAA4B,CAAC,YAAY,EAAE,iCAAiC,CAAC,CAAC;AACvF,CAAC;AAqBD,4EAA4E;AAC5E,MAAM,CAAC,MAAM,2BAA2B,GAAyB,CAAC,CAAC,EAAE,EAAE;IACrE,GAAG,CAAC,KAAK,CACP,+BAA+B,CAAC,CAAC,OAAO,QAAQ,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,KAAK,SAAS;QACnF,eAAe,CAAC,CAAC,QAAQ,sDAAsD;QAC/E,WAAW,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACjC,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,aAAa,CAAC,MAO7B;IACC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;IAClD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,2BAA2B,CAAC;IAEhE,8EAA8E;IAC9E,gFAAgF;IAChF,6EAA6E;IAC7E,gFAAgF;IAChF,+EAA+E;IAC/E,+EAA+E;IAC/E,iDAAiD;IACjD,IAAI,qBAAqB,CAAC,YAAY,CAAC,EAAE,CAAC;QACxC,GAAG,CAAC,IAAI,CACN,wCAAwC,OAAO,QAAQ,YAAY,eAAe;YAClF,sFAAsF;YACtF,4EAA4E,CAC7E,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAC;IACtD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,gBAAgB,GACpB,MAAM,CAAC,gBAAgB,IAAI,wCAAwC,CAAC;QACtE,gBAAgB,CAAC;YACf,YAAY;YACZ,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,SAAS,EAAE,qBAAqB,OAAO,GAAG;SAC3C,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,KAAK,GAAG,2BAA2B,CAAC,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAExE,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC3B,GAAG,CAAC,IAAI,CAAC,sCAAsC,OAAO,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAAK,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACvC,QAAQ,CAAC;YACP,YAAY;YACZ,OAAO;YACP,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAAK,CAAC,IAAI,KAAK,uBAAuB,EAAE,CAAC;QAC3C,2EAA2E;QAC3E,6EAA6E;QAC7E,6EAA6E;QAC7E,yEAAyE;QACzE,0DAA0D;QAC1D,GAAG,CAAC,IAAI,CACN,6CAA6C,OAAO,QAAQ,YAAY,MAAM;YAC9E,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,sDAAsD;YAChF,0DAA0D,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACpG,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,+DAA+D;QAC/D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,YAAY,GAAG,UAAU,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,YAAY,CAAC,CAAC;IACzE,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;QAC1B,GAAG,CAAC,IAAI,CAAC,qCAAqC,OAAO,qBAAqB,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC;QAChG,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC;IACnE,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACvD,CAAC"}

package/dist/worktree/verify-interlock.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Per-worktree verify interlock.
+ *
+ * The daemon runs a product's configured deterministic verify command INSIDE the
+ * focus worktree, and it also commits from that same worktree (safety / WIP /
+ * lockfile commits, all via `guardedCommit`). A verify command that mutates a
+ * tracked file and restores it (the general case -- e.g. this repo's
+ * verify-gate.test.mjs writes a drift marker into ACTIONS.md, then restores it in
+ * a `finally`) has a mutation WINDOW. If a 30s-poll safety-commit's `git add -A`
+ * lands inside that window it snapshots the transient drift into the index; the
+ * verify's restore then reverts the working tree; the commit never lands --
+ * leaving a staged entry with no worktree content behind it (a TORN WRITE, which
+ * wedged a focus permanently: escalation 2170fdde, 2026-08-16).
+ *
+ * The fix belongs at the daemon, not any one product's verify script: a daemon
+ * that runs arbitrary configured commands in a worktree it also commits from must
+ * serialise the two itself. This module is that serialisation -- an in-memory,
+ * per-worktree hold acquired around the verify spawn and consulted by every
+ * daemon-authored commit path. While a worktree is held, no commit path stages or
+ * commits in it; the commit is DEFERRED (retried on the next poll), never lost.
+ *
+ * In-memory by design: the hold protects a LIVE process's mutation window, so it
+ * is only meaningful while this daemon process is running. A daemon restart kills
+ * any in-flight verify AND resets the map -- so a restart can never leave a stale
+ * hold that wedges a worktree forever (which would reproduce the very stall this
+ * focus removes). The map is keyed by the CANONICAL worktree path (realpath, with
+ * a `path.resolve` fallback) so the verify's cwd and a commit path's worktreePath
+ * key identically even across symlinks or a trailing slash.
+ *
+ * @module worktree/verify-interlock
+ */
+/**
+ * Acquire the verify interlock for `worktreePath` and return a release token.
+ *
+ * Call the returned token exactly once when the verify process has exited (any
+ * exit -- clean, killed, or abnormal). The token is IDEMPOTENT: calling it more
+ * than once is a no-op, so a spawn that fires both `'error'` and `'close'` cannot
+ * under-count the hold. Acquire BEFORE the spawn and release in a path that runs
+ * on every exit (a `finish`/`finally`), so the hold can never outlive the process.
+ */
+export declare function acquireVerifyHold(worktreePath: string): () => void;
+/**
+ * True iff a verify command is currently running in `worktreePath` (the hold is
+ * held). Consulted by every daemon-authored commit path before it stages/commits,
+ * and by the advance-block gate before it decides to remediate -- so a commit that
+ * would snapshot a mid-verify tree is deferred, not performed. Per-worktree: a
+ * verify in one focus's worktree never blocks a commit in another's.
+ */
+export declare function isWorktreeUnderVerify(worktreePath: string): boolean;
+/** Test seam: clear all holds between cases. */
+export declare function __resetVerifyHolds(): void;
+//# sourceMappingURL=verify-interlock.d.ts.map

package/dist/worktree/verify-interlock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-interlock.d.ts","sourceRoot":"","sources":["../../src/worktree/verify-interlock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAyBH;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,IAAI,CAgBlE;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAEnE;AAED,gDAAgD;AAChD,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC"}

package/dist/worktree/verify-interlock.js

@@ -0,0 +1,94 @@
+/**
+ * Per-worktree verify interlock.
+ *
+ * The daemon runs a product's configured deterministic verify command INSIDE the
+ * focus worktree, and it also commits from that same worktree (safety / WIP /
+ * lockfile commits, all via `guardedCommit`). A verify command that mutates a
+ * tracked file and restores it (the general case -- e.g. this repo's
+ * verify-gate.test.mjs writes a drift marker into ACTIONS.md, then restores it in
+ * a `finally`) has a mutation WINDOW. If a 30s-poll safety-commit's `git add -A`
+ * lands inside that window it snapshots the transient drift into the index; the
+ * verify's restore then reverts the working tree; the commit never lands --
+ * leaving a staged entry with no worktree content behind it (a TORN WRITE, which
+ * wedged a focus permanently: escalation 2170fdde, 2026-08-16).
+ *
+ * The fix belongs at the daemon, not any one product's verify script: a daemon
+ * that runs arbitrary configured commands in a worktree it also commits from must
+ * serialise the two itself. This module is that serialisation -- an in-memory,
+ * per-worktree hold acquired around the verify spawn and consulted by every
+ * daemon-authored commit path. While a worktree is held, no commit path stages or
+ * commits in it; the commit is DEFERRED (retried on the next poll), never lost.
+ *
+ * In-memory by design: the hold protects a LIVE process's mutation window, so it
+ * is only meaningful while this daemon process is running. A daemon restart kills
+ * any in-flight verify AND resets the map -- so a restart can never leave a stale
+ * hold that wedges a worktree forever (which would reproduce the very stall this
+ * focus removes). The map is keyed by the CANONICAL worktree path (realpath, with
+ * a `path.resolve` fallback) so the verify's cwd and a commit path's worktreePath
+ * key identically even across symlinks or a trailing slash.
+ *
+ * @module worktree/verify-interlock
+ */
+import { realpathSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { createLogger } from '../log.js';
+const log = createLogger({ module: 'worktree' });
+/**
+ * Active verify holds: canonical worktree path -> count of in-flight verifies.
+ * A COUNT (not a boolean) so overlapping verifies on the same worktree -- should
+ * they ever occur -- release correctly: the hold clears only when the LAST one
+ * releases.
+ */
+const holds = new Map();
+/** Canonicalize a worktree path so verify cwd and commit worktreePath match. */
+function keyFor(worktreePath) {
+    try {
+        return realpathSync(worktreePath);
+    }
+    catch {
+        return resolve(worktreePath);
+    }
+}
+/**
+ * Acquire the verify interlock for `worktreePath` and return a release token.
+ *
+ * Call the returned token exactly once when the verify process has exited (any
+ * exit -- clean, killed, or abnormal). The token is IDEMPOTENT: calling it more
+ * than once is a no-op, so a spawn that fires both `'error'` and `'close'` cannot
+ * under-count the hold. Acquire BEFORE the spawn and release in a path that runs
+ * on every exit (a `finish`/`finally`), so the hold can never outlive the process.
+ */
+export function acquireVerifyHold(worktreePath) {
+    const key = keyFor(worktreePath);
+    holds.set(key, (holds.get(key) ?? 0) + 1);
+    log.debug(`verify-interlock: hold acquired for ${key} (depth ${holds.get(key)})`);
+    let released = false;
+    return () => {
+        if (released)
+            return;
+        released = true;
+        const next = (holds.get(key) ?? 1) - 1;
+        if (next <= 0) {
+            holds.delete(key);
+        }
+        else {
+            holds.set(key, next);
+        }
+        log.debug(`verify-interlock: hold released for ${key} (depth ${next <= 0 ? 0 : next})`);
+    };
+}
+/**
+ * True iff a verify command is currently running in `worktreePath` (the hold is
+ * held). Consulted by every daemon-authored commit path before it stages/commits,
+ * and by the advance-block gate before it decides to remediate -- so a commit that
+ * would snapshot a mid-verify tree is deferred, not performed. Per-worktree: a
+ * verify in one focus's worktree never blocks a commit in another's.
+ */
+export function isWorktreeUnderVerify(worktreePath) {
+    return (holds.get(keyFor(worktreePath)) ?? 0) > 0;
+}
+/** Test seam: clear all holds between cases. */
+export function __resetVerifyHolds() {
+    holds.clear();
+}
+//# sourceMappingURL=verify-interlock.js.map

package/dist/worktree/verify-interlock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-interlock.js","sourceRoot":"","sources":["../../src/worktree/verify-interlock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;AAExC,gFAAgF;AAChF,SAAS,MAAM,CAAC,YAAoB;IAClC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,YAAY,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,YAAoB;IACpD,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;IACjC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,GAAG,CAAC,KAAK,CAAC,uCAAuC,GAAG,WAAW,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClF,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,OAAO,GAAG,EAAE;QACV,IAAI,QAAQ;YAAE,OAAO;QACrB,QAAQ,GAAG,IAAI,CAAC;QAChB,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;YACd,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACvB,CAAC;QACD,GAAG,CAAC,KAAK,CAAC,uCAAuC,GAAG,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;IAC1F,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,YAAoB;IACxD,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AACpD,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,kBAAkB;IAChC,KAAK,CAAC,KAAK,EAAE,CAAC;AAChB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telora/daemon",
-  "version": "0.21.7",
+  "version": "0.21.26",
   "description": "Agent orchestration daemon for Telora - spawns and manages Claude Code instances",
   "type": "module",
   "bin": {
@@ -37,8 +37,8 @@
   },
   "//testRunner": "Uses Node.js built-in test runner (node:test) via tsx for TypeScript support. The root package uses Vitest; this is a deliberate choice for the daemon package to avoid framework dependencies. See src/__tests__/ for test files.",
   "dependencies": {
-    "@telora/daemon-core": "^0.2.75",
-    "@telora/mcp-products": "^0.22.114",
+    "@telora/daemon-core": "^0.2.76",
+    "@telora/mcp-products": "^0.22.115",
     "commander": "^14.0.3",
     "yaml": "^2.4.0",
     "zod": "^4.3.6"