@telora/daemon 0.22.239 → 0.22.289

package/dist/shell/crash-recovery.js

@@ -1,632 +0,0 @@
-// PINNED-BY-BEGIN (generated by gen:pinned-by -- do not hand-edit; checked by lint:pinned-by)
-// Pinned by: packages/daemon/src/shell/crash-recovery-session-scope.test.ts,
-//   packages/daemon/src/shell/crash-recovery.test.ts,
-//   packages/daemon/src/shell/safety-capture-entry-points.test.ts
-// PINNED-BY-END
-/**
- * Crash recovery: orphaned worktree cleanup and stale branch pruning.
- *
- * When the daemon crashes (SIGKILL, OOM, power loss), worktrees and branches
- * persist on disk with no in-memory tracking. On restart this module scans
- * the filesystem, reconciles against DB session state, and cleans up.
- *
- * Runs after initGit() and before startListeners() so the daemon starts clean.
- */
-import { existsSync, readdirSync, statSync } from 'node:fs';
-import { join, resolve } from 'node:path';
-import { runGitSync } from '../git/exec.js';
-import { branchHasUnmergedCommits, removeWorktree } from '../worktree/safety.js';
-import { captureOrphanWork } from './orphan-capture.js';
-import { reapWorktreeAtomically, classifyUnregisteredResidue } from '../worktree/reap.js';
-import { getActiveSessions, updateSession, ownedSessionScope } from '../queries/sessions.js';
-import { reconcileOwnedSessions } from './daemon-instance.js';
-import { createEscalation } from '../queries/escalations.js';
-import { NO_HUMAN_ACT } from '../queries/filing-observation.js';
-import { getActiveFocuses } from '../queries/focus-discovery.js';
-import { scanAllFocuses } from '../queries/focuses.js';
-import { ESCALATION_REASONS, ESCALATION_DISPOSITIONS } from '@telora/daemon-core';
-import { createLogger } from './log.js';
-const log = createLogger({ module: 'crash-recovery' });
-/**
- * Default focus-key resolver: scan the product's focuses and match the 8-char
- * prefix to a full focus id. Orphans are inactive by construction, so this
- * scans ALL focuses for the product, not just active ones. Best-effort: any
- * failure degrades to null (caller falls back to productId + focus_key).
- */
-async function defaultResolveFocusByKeyPrefix(keyPrefix, productId) {
-    if (!productId)
-        return null;
-    try {
-        const { focuses } = await scanAllFocuses({ productId });
-        const match = focuses.find((f) => typeof f.id === 'string' && f.id.startsWith(keyPrefix));
-        return match?.id ? { focusId: match.id, productId } : null;
-    }
-    catch (err) {
-        log.warn(`[crash-recovery] Failed to resolve focus from key ${keyPrefix}: ${err instanceof Error ? err.message : String(err)}`);
-        return null;
-    }
-}
-const defaultDeps = {
-    getActiveSessions,
-    getActiveFocuses,
-    updateSession: (id, updates) => updateSession(id, updates),
-    createEscalation,
-    resolveFocusByKeyPrefix: defaultResolveFocusByKeyPrefix,
-    removeWorktreeDir: reapWorktreeAtomically,
-};
-// ── Helpers ──────────────────────────────────────────────────────
-/**
- * Extract the focus ID prefix (last 8 hex chars) from a worktree directory name.
- * Focus worktree directories follow: agent-{role}-{name}-{8-char-id}
- */
-function extractFocusIdPrefix(dirName) {
-    const match = dirName.match(/-([0-9a-f]{8})$/);
-    return match ? match[1] : null;
-}
-/**
- * Extract the 8-char focus-key suffix from an agent BRANCH name.
- * Branch format: agent/<role>/<slug>-<8hexfocuskey>. The final path segment
- * carries the same -<8hex> suffix that extractFocusIdPrefix parses off the
- * worktree DIRECTORY name, so this is the branch-name analogue used to anchor a
- * residual signal back to the owning focus.
- */
-function extractFocusKeyFromBranch(branchName) {
-    const lastSegment = branchName.split('/').pop() ?? branchName;
-    return extractFocusIdPrefix(lastSegment);
-}
-// ── Worktree scanning ────────────────────────────────────────────
-/**
- * Parse `git worktree list --porcelain` to build a map of
- * worktree path -> branch name for all registered worktrees.
- */
-export function parseWorktreeList(repoPath) {
-    const result = runGitSync(['worktree', 'list', '--porcelain'], repoPath);
-    const map = new Map();
-    if (!result.success)
-        return map;
-    let currentPath = null;
-    for (const line of result.output.split('\n')) {
-        if (line.startsWith('worktree ')) {
-            currentPath = line.slice('worktree '.length);
-        }
-        else if (line.startsWith('branch refs/heads/') && currentPath) {
-            map.set(currentPath, line.slice('branch refs/heads/'.length));
-            currentPath = null;
-        }
-        else if (line === '') {
-            currentPath = null;
-        }
-    }
-    return map;
-}
-/**
- * Scan the worktree directory and reconcile against active DB sessions
- * to classify each worktree as active or orphaned.
- */
-export async function detectOrphanedWorktrees(config, deps = defaultDeps) {
-    const { worktreeDir, repoPath } = config;
-    // 1. Read all subdirectories in worktreeDir
-    if (!existsSync(worktreeDir))
-        return [];
-    const entries = readdirSync(worktreeDir);
-    const subdirs = entries.filter((entry) => {
-        const fullPath = join(worktreeDir, entry);
-        try {
-            return statSync(fullPath).isDirectory();
-        }
-        catch (e) {
-            log.debug(`Failed to stat ${fullPath} (may have been deleted):`, e.message);
-            return false;
-        }
-    });
-    if (subdirs.length === 0)
-        return [];
-    // 2. Parse git worktree list to map paths -> branch names
-    const worktreeMap = parseWorktreeList(repoPath);
-    // Build a reverse lookup: resolve worktree paths so we can match
-    const pathToBranch = new Map();
-    for (const [wtPath, branch] of worktreeMap) {
-        pathToBranch.set(resolve(wtPath), branch);
-    }
-    // 3. Active sessions, product-scoped: this answer only PRESERVES worktrees.
-    let activeSessions = [];
-    try {
-        activeSessions = await deps.getActiveSessions({ productId: config.productId });
-    }
-    catch (err) {
-        log.warn(`[crash-recovery] Failed to query active sessions from DB: ${err instanceof Error ? err.message : String(err)}. ` +
-            `Treating all worktrees as orphaned.`);
-    }
-    // Build set of branch names with active sessions
-    const activeBranches = new Set(activeSessions.map((s) => s.branch_name));
-    // Build map of branch -> session for linking
-    const branchToSession = new Map();
-    for (const session of activeSessions) {
-        branchToSession.set(session.branch_name, session);
-    }
-    // 3b. Query active focuses to preserve persistent worktrees
-    const activeFocusIdPrefixes = new Set();
-    try {
-        const activeFocuses = await deps.getActiveFocuses(config.organizationId, config.productId);
-        for (const s of activeFocuses) {
-            activeFocusIdPrefixes.add(s.focus_id.slice(0, 8));
-        }
-    }
-    catch (err) {
-        log.warn(`[crash-recovery] Failed to query active focuses: ${err instanceof Error ? err.message : String(err)}. ` +
-            `Persistent focus worktrees may be incorrectly classified as orphaned.`);
-    }
-    // 4. Classify each worktree subdirectory
-    const orphans = [];
-    for (const subdir of subdirs) {
-        const fullPath = resolve(join(worktreeDir, subdir));
-        const branchName = pathToBranch.get(fullPath);
-        if (!branchName) {
-            // Directory exists but no git worktree entry — likely a stale directory.
-            // Check if it belongs to an active focus before classifying as orphan.
-            const idPrefix = extractFocusIdPrefix(subdir);
-            if (idPrefix && activeFocusIdPrefixes.has(idPrefix)) {
-                log.info(`Worktree belongs to active focus (persistent, no git entry): ${fullPath}`);
-                continue;
-            }
-            // Try to infer branch from directory name (agent-role-delivery pattern).
-            log.info(`Worktree directory has no git entry (unregistered residue): ${fullPath}`);
-            orphans.push({
-                worktreePath: fullPath,
-                branchName: subdir.replace(/-/g, '/').replace(/^agent\//, 'agent/'),
-                session: null,
-                unregistered: true,
-            });
-            continue;
-        }
-        if (activeBranches.has(branchName)) {
-            // Active session exists — leave alone
-            log.info(`Worktree is active (has DB session): ${fullPath} [${branchName}]`);
-            continue;
-        }
-        // Check if this worktree belongs to an active focus (persistent worktree)
-        const idPrefix = extractFocusIdPrefix(subdir);
-        if (idPrefix && activeFocusIdPrefixes.has(idPrefix)) {
-            log.info(`Worktree belongs to active focus (persistent): ${fullPath} [${branchName}]`);
-            continue;
-        }
-        // No active session and no active focus — orphaned
-        const session = branchToSession.get(branchName) ?? null;
-        orphans.push({
-            worktreePath: fullPath,
-            branchName,
-            session,
-        });
-    }
-    return orphans;
-}
-// ── Orphan cleanup ───────────────────────────────────────────────
-/**
- * Count unmerged commits on a branch relative to integration.
- */
-function countUnmergedCommits(branchName, integrationBranch, repoPath) {
-    const result = runGitSync(['log', '--oneline', `${integrationBranch}..${branchName}`, '--'], repoPath);
-    if (!result.success)
-        return 0;
-    const lines = result.output.trim();
-    if (lines.length === 0)
-        return 0;
-    return lines.split('\n').length;
-}
-/**
- * Process a single orphaned worktree: safety-commit if dirty,
- * then remove if merged or preserve if unmerged.
- *
- * Returns the action taken.
- */
-function cleanupSingleOrphan(orphan, config, deps, capture) {
-    const { worktreePath, branchName } = orphan;
-    const { repoPath, integrationBranch } = config;
-    const { commitHash } = capture;
-    const focusKey = extractFocusKeyFromBranch(branchName) ?? undefined;
-    // Step 0: UNREGISTERED residue -- a directory with no git worktree entry and
-    // no branch ref to diff. There is nothing to safety-commit onto (the .git
-    // pointer is usually dangling), so judge reap safety by CONTENT reachability
-    // from integration: reap only what is provably already there, preserve the
-    // rest for manual review (never destroy potential unmerged work). This closes
-    // the leak where residue was treated as "merged" (no ref => no unmerged
-    // commits) and deleted regardless of content.
-    if (orphan.unregistered) {
-        const classification = classifyUnregisteredResidue(worktreePath, repoPath, integrationBranch);
-        if (!classification.reapSafe) {
-            log.warn(`[crash-recovery] Preserving unregistered residue (${classification.reason}): ${worktreePath}`);
-            return {
-                worktreePath,
-                branchName,
-                action: 'preserved',
-                focusKey,
-                worktreeRemoved: false,
-                branchPreserved: false,
-                // Content not provably reachable: treat as uncaptured work so the
-                // consolidated operator escalation surfaces it for recovery.
-                workUncaptured: true,
-            };
-        }
-        log.info(`[crash-recovery] Reaping unregistered residue (${classification.reason}): ${worktreePath}`);
-        const residueRemoved = deps.removeWorktreeDir(repoPath, worktreePath);
-        if (!residueRemoved) {
-            log.warn(`[crash-recovery] Failed to remove reap-safe residue dir: ${worktreePath}`);
-        }
-        return {
-            worktreePath,
-            branchName,
-            action: residueRemoved ? 'removed' : 'preserved',
-            focusKey,
-            worktreeRemoved: residueRemoved,
-            branchPreserved: false,
-        };
-    }
-    // Step 1 (captureOrphanWork, before this) safety-committed any dirt. A failed
-    // capture -- a refused conflict included -- leaves the work on no ref.
-    const safetyCommitFailed = capture.failed;
-    // Step 2: Check if branch is already merged to integration
-    const hasUnmerged = branchHasUnmergedCommits(branchName, integrationBranch, repoPath);
-    if (!hasUnmerged && !safetyCommitFailed) {
-        // Fully merged and nothing left uncaptured — safe to remove (UNCHANGED behavior: worktree + branch both go)
-        log.info(`Removing merged orphan: ${worktreePath} [${branchName}]`);
-        removeWorktree(repoPath, worktreePath, {
-            branchName,
-            integrationBranch,
-            mergeSucceeded: true,
-        });
-        // Also delete the branch since it's merged
-        const deleteResult = runGitSync(['branch', '-d', branchName], repoPath);
-        if (deleteResult.success) {
-            log.info(`Deleted merged branch: ${branchName}`);
-        }
-        return {
-            worktreePath,
-            branchName,
-            action: commitHash ? 'safety-committed-and-removed' : 'removed',
-            commitHash,
-            focusKey,
-            worktreeRemoved: true,
-            branchPreserved: false,
-        };
-    }
-    const unmergedCount = countUnmergedCommits(branchName, integrationBranch, repoPath);
-    // Step 3a: Unrecoverable corner -- the work is uncommitted (safety commit
-    // failed) so it lives only in the worktree dir. KEEP the worktree (dropping it
-    // would lose the work) and the branch; the caller decides whether to escalate
-    // based on whether the focus can be anchored.
-    if (safetyCommitFailed) {
-        log.warn(`[crash-recovery] Preserving worktree + branch (uncommitted work could not be captured): ${worktreePath} [${branchName}]`);
-        return {
-            worktreePath,
-            branchName,
-            action: 'preserved',
-            unmergedCommitCount: unmergedCount,
-            focusKey,
-            worktreeRemoved: false,
-            branchPreserved: true,
-            workUncaptured: true,
-        };
-    }
-    // Step 3b: Normal unmerged case -- the work IS captured on the branch ref.
-    // Self-resolve as housekeeping: PRESERVE THE BRANCH (cheap, recoverable) and
-    // DROP THE WORKTREE DIRECTORY (no disk detritus). removeWorktreeDir does a
-    // `git worktree remove --force` + prune, leaving the branch ref intact --
-    // bypassing removeWorktree's unmerged-commit guard since we keep the branch.
-    log.info(`[crash-recovery] Preserving branch + dropping worktree for orphan with ${unmergedCount} unmerged commit(s): ${worktreePath} [${branchName}]`);
-    const worktreeRemoved = deps.removeWorktreeDir(repoPath, worktreePath);
-    if (!worktreeRemoved) {
-        log.warn(`[crash-recovery] Failed to remove worktree dir (branch ${branchName} still preserved): ${worktreePath}`);
-    }
-    return {
-        worktreePath,
-        branchName,
-        action: commitHash ? 'safety-committed' : 'preserved',
-        commitHash,
-        unmergedCommitCount: unmergedCount,
-        focusKey,
-        worktreeRemoved,
-        branchPreserved: true,
-    };
-}
-/** Capture a registered orphan's dirt (attributed, conflict-refused), then clean it up. */
-async function captureAndCleanupOrphan(orphan, config, deps) {
-    const capture = orphan.unregistered
-        ? { failed: false }
-        : await captureOrphanWork(orphan, config, extractFocusKeyFromBranch(orphan.branchName) ?? undefined, deps);
-    const action = cleanupSingleOrphan(orphan, config, deps, capture);
-    if (capture.resolvedFocusId)
-        action.resolvedFocusId = capture.resolvedFocusId;
-    if (capture.unmergedEscalated)
-        action.unmergedEscalated = true;
-    return action;
-}
-/**
- * Clean up all orphaned worktrees. Returns actions taken and
- * any preserved orphans that need escalation.
- */
-export async function cleanupOrphanedWorktrees(orphans, config, deps = defaultDeps) {
-    const actions = [];
-    // Mark orphaned sessions as failed in DB
-    for (const orphan of orphans) {
-        if (orphan.session) {
-            try {
-                await deps.updateSession(orphan.session.id, {
-                    status: 'failed',
-                    exit_reason: 'Daemon crash recovery: session was active when daemon restarted',
-                    exit_category: 'recovery_cleanup',
-                    ended_at: new Date().toISOString(),
-                });
-                log.info(`Marked session ${orphan.session.id} as failed (crash recovery)`);
-            }
-            catch (err) {
-                log.warn(`[crash-recovery] Failed to update session ${orphan.session.id}: ${err instanceof Error ? err.message : String(err)}`);
-            }
-        }
-    }
-    // Process each orphan
-    for (const orphan of orphans) {
-        try {
-            actions.push(await captureAndCleanupOrphan(orphan, config, deps));
-        }
-        catch (err) {
-            log.error(`[crash-recovery] Error cleaning up orphan ${orphan.worktreePath}: ${err instanceof Error ? err.message : String(err)}`);
-        }
-    }
-    // Resolve the owning focus from each preserved orphan's branch focus-key, so
-    // any residual signal is anchored to the focus the branch encodes rather than
-    // landing unanchored. productId is always known from the (product-scoped)
-    // config; focusId resolves where the focus still exists.
-    const preserved = actions.filter((a) => a.branchPreserved);
-    for (const a of preserved) {
-        if (a.focusKey && !a.resolvedFocusId) {
-            const resolved = await deps.resolveFocusByKeyPrefix(a.focusKey, config.productId);
-            if (resolved?.focusId)
-                a.resolvedFocusId = resolved.focusId;
-        }
-    }
-    // Housekeeping: a preserved branch is recoverable (work on the ref) and
-    // anchored (productId + resolved focus / focus-key), so it self-resolves as a
-    // LOG LINE, not a needs_operator escalation -- the daemon SUCCEEDS at the
-    // merge/drop housekeeping it owns instead of routing the decision to a human.
-    for (const a of preserved) {
-        if (a.workUncaptured)
-            continue; // the unrecoverable corner is handled below
-        const focusRef = a.resolvedFocusId
-            ? `focus ${a.resolvedFocusId}`
-            : a.focusKey
-                ? `focus-key ${a.focusKey}`
-                : 'focus unresolved';
-        const worktreeNote = a.worktreeRemoved ? 'worktree dropped' : 'worktree kept';
-        log.info(`[crash-recovery] Housekeeping: preserved branch ${a.branchName} ` +
-            `(${worktreeNote}; ${focusRef}` +
-            (a.unmergedCommitCount ? `; ${a.unmergedCommitCount} unmerged commit(s)` : '') +
-            (a.commitHash ? `; safety commit ${a.commitHash.slice(0, 8)}` : '') +
-            `) [product ${config.productId ?? 'unknown'}]`);
-        // Removal failed: the dir is still on disk. The work is safe on the
-        // preserved branch (not work-loss, so no escalation), but it is NOT the
-        // clean "worktree dropped" outcome -- surface it distinctly at WARN so the
-        // leftover dir is visible; recoverFromCrash also lifts it into the summary.
-        if (!a.worktreeRemoved) {
-            log.warn(`[crash-recovery] Worktree dir could NOT be removed for preserved branch ` +
-                `${a.branchName}; leftover dir remains on disk (manual prune may be needed): ${a.worktreePath}`);
-        }
-    }
-    // File ONLY the genuinely unrecoverable corner: the work could NOT be captured
-    // on a ref (safety commit failed, worktree kept dirty), the focus could NOT be
-    // resolved from the branch, and no conflict-refusal escalation already names it.
-    const unrecoverable = preserved.filter((a) => a.workUncaptured && !a.resolvedFocusId && !a.unmergedEscalated);
-    if (unrecoverable.length > 0) {
-        const lines = unrecoverable.map((a) => `- ${a.branchName} (${a.worktreePath})` +
-            (a.unmergedCommitCount ? ` — ${a.unmergedCommitCount} unmerged commit(s)` : '') +
-            (a.focusKey ? ` — focus-key: ${a.focusKey}` : ''));
-        const description = `Daemon crash recovery found ${unrecoverable.length} orphaned worktree(s) whose ` +
-            `uncommitted work could not be captured on a branch and whose owning focus could not ` +
-            `be resolved from the branch:\n\n` +
-            lines.join('\n') +
-            '\n\nThese worktrees have been preserved on disk for manual inspection.';
-        // Anchor with whatever we have: productId is stamped explicitly from the
-        // product-scoped config (always wins over derived provenance). The focus is
-        // unresolvable by construction here (the `!resolvedFocusId` gate put the
-        // orphan in this corner), so focus_key travels in metadata for forensics.
-        const head = unrecoverable[0];
-        try {
-            await deps.createEscalation({
-                organizationId: config.organizationId,
-                sessionId: head.branchName, // No session available, use branch as context
-                issueId: null,
-                reasonType: ESCALATION_REASONS.NEEDS_CLARIFICATION,
-                // Capturing the work onto a branch is git work: no human act (observation).
-                disposition: ESCALATION_DISPOSITIONS.NEEDS_OPERATOR,
-                humanAct: NO_HUMAN_ACT,
-                ...(config.productId ? { productId: config.productId } : {}),
-                anchor: { branch: head.branchName },
-                metadata: {
-                    branch_name: head.branchName,
-                    ...(head.focusKey ? { focus_key: head.focusKey } : {}),
-                },
-                description,
-                whatWasTried: 'Daemon crash recovery preserved the worktree; the uncommitted work could not be captured on a branch and the focus could not be resolved from the branch name.',
-                helpNeeded: 'Inspect the preserved worktree and recover or discard the uncommitted work.',
-            });
-            log.info(`Created escalation for ${unrecoverable.length} unrecoverable orphan(s)`);
-        }
-        catch (err) {
-            log.warn(`[crash-recovery] Failed to create escalation: ${err instanceof Error ? err.message : String(err)}`);
-        }
-    }
-    return actions;
-}
-// ── Stale branch pruning ─────────────────────────────────────────
-/**
- * List all local branches matching the agent/* pattern.
- */
-function listAgentBranches(repoPath) {
-    const result = runGitSync(['branch', '--list', 'agent/*'], repoPath);
-    if (!result.success)
-        return [];
-    return result.output
-        .split('\n')
-        .map((line) => line.replace(/^[*+]?\s+/, '').trim())
-        .filter(Boolean);
-}
-/**
- * Prune stale agent branches that have no worktree and no unmerged commits.
- *
- * Same housekeeping policy as the orphaned-worktree path: a branch with
- * unmerged commits is PRESERVED and LOGGED (the commits are recoverable from
- * the ref), never escalated. A merged branch with no worktree is safe to delete.
- * No path here files a needs_operator escalation -- branch-only orphans are
- * reality-side housekeeping the daemon owns.
- */
-export function pruneStaleAgentBranches(config) {
-    const { repoPath, integrationBranch } = config;
-    const branches = listAgentBranches(repoPath);
-    const pruned = [];
-    const preserved = [];
-    if (branches.length === 0) {
-        log.info('No stale agent branches found');
-        return { pruned, preserved };
-    }
-    // Get set of branches that have active worktrees
-    const worktreeMap = parseWorktreeList(repoPath);
-    const worktreeBranches = new Set(worktreeMap.values());
-    for (const branch of branches) {
-        // Skip branches with active worktrees
-        if (worktreeBranches.has(branch))
-            continue;
-        // Check for unmerged commits
-        if (branchHasUnmergedCommits(branch, integrationBranch, repoPath)) {
-            const focusKey = extractFocusKeyFromBranch(branch);
-            log.info(`[crash-recovery] Housekeeping: preserving stale branch with unmerged commits: ${branch}` +
-                (focusKey ? ` (focus-key ${focusKey})` : ''));
-            preserved.push(branch);
-            continue;
-        }
-        // Safe to delete
-        const deleteResult = runGitSync(['branch', '-D', branch], repoPath);
-        if (deleteResult.success) {
-            log.info(`Pruned stale branch: ${branch}`);
-            pruned.push(branch);
-        }
-        else {
-            log.warn(`Failed to prune branch ${branch}: ${deleteResult.error}`);
-        }
-    }
-    log.info(`[crash-recovery] Branch pruning: ${pruned.length} pruned, ${preserved.length} preserved with unmerged work`);
-    return { pruned, preserved };
-}
-// ── Main recovery orchestrator ───────────────────────────────────
-/**
- * Run full crash recovery: detect orphans, clean up, prune branches.
- *
- * Safe to call multiple times — idempotent by design. A second run
- * with no new crashes finds nothing to clean.
- */
-export async function recoverFromCrash(config, deps = defaultDeps) {
-    log.info('Starting crash recovery scan...');
-    const result = {
-        orphansDetected: 0,
-        orphansCleaned: 0,
-        orphansPreserved: 0,
-        branchesPruned: 0,
-        branchesPreserved: 0,
-        actions: [],
-        errors: [],
-    };
-    // Step 1: Detect orphaned worktrees
-    let orphans;
-    try {
-        orphans = await detectOrphanedWorktrees(config, deps);
-        result.orphansDetected = orphans.length;
-    }
-    catch (err) {
-        const msg = `Failed to detect orphaned worktrees: ${err instanceof Error ? err.message : String(err)}`;
-        log.error(`${msg}`);
-        result.errors.push(msg);
-        orphans = [];
-    }
-    if (orphans.length === 0) {
-        log.info('No orphaned worktrees found');
-    }
-    else {
-        log.info(`Found ${orphans.length} orphaned worktree(s)`);
-    }
-    // Step 2: Clean up orphans
-    if (orphans.length > 0) {
-        try {
-            const actions = await cleanupOrphanedWorktrees(orphans, config, deps);
-            result.actions = actions;
-            result.orphansCleaned = actions.filter((a) => a.action === 'removed' || a.action === 'safety-committed-and-removed').length;
-            result.orphansPreserved = actions.filter((a) => a.action === 'preserved' || a.action === 'safety-committed').length;
-            // Recoverable orphans whose worktree dir could not be dropped leave disk
-            // detritus. Non-fatal (work is safe on the branch), but surfaced as a
-            // recovery error so the summary's error count makes the leftover visible.
-            const worktreesLeftOnDisk = actions.filter((a) => a.branchPreserved && !a.worktreeRemoved && !a.workUncaptured).length;
-            if (worktreesLeftOnDisk > 0) {
-                result.errors.push(`${worktreesLeftOnDisk} preserved-branch worktree dir(s) could not be removed and remain on disk (manual prune may be needed)`);
-            }
-        }
-        catch (err) {
-            const msg = `Failed during orphan cleanup: ${err instanceof Error ? err.message : String(err)}`;
-            log.error(`${msg}`);
-            result.errors.push(msg);
-        }
-    }
-    // Step 3: Prune stale agent branches
-    try {
-        const { pruned, preserved } = pruneStaleAgentBranches(config);
-        result.branchesPruned = pruned.length;
-        result.branchesPreserved = preserved.length;
-    }
-    catch (err) {
-        const msg = `Failed during branch pruning: ${err instanceof Error ? err.message : String(err)}`;
-        log.error(`${msg}`);
-        result.errors.push(msg);
-    }
-    // Step 4: Mark remaining active sessions failed (DB-driven reconciliation) -- ones left
-    // behind with no worktree. Every row this pass writes it stamps failed, so it reads only
-    // what we OWN and closes only what is provably STOPPED: see reconcileOwnedSessions.
-    try {
-        const activeSessions = await deps.getActiveSessions(ownedSessionScope(config.productId));
-        // Drop sessions already handled during worktree cleanup, then keep only those
-        // whose owning daemon instance is provably gone.
-        const handled = new Set(orphans.filter(o => o.session !== null).map(o => o.session.id));
-        const remainingSessions = reconcileOwnedSessions(activeSessions.filter(s => !handled.has(s.id)), deps);
-        if (remainingSessions.length > 0) {
-            log.info(`Found ${remainingSessions.length} orphaned session(s) of a stopped daemon without worktrees, marking as failed`);
-            const sessionResults = await Promise.allSettled(remainingSessions.map(session => deps.updateSession(session.id, {
-                status: 'failed',
-                exit_reason: 'Daemon crash recovery: session was active when daemon restarted',
-                exit_category: 'recovery_cleanup',
-                ended_at: new Date().toISOString(),
-            })));
-            const succeeded = sessionResults.filter(r => r.status === 'fulfilled').length;
-            const failed = sessionResults.filter(r => r.status === 'rejected').length;
-            if (failed > 0) {
-                log.warn(`${failed} session update(s) failed during DB reconciliation`);
-            }
-            log.info(`Marked ${succeeded} orphaned session(s) as failed (DB reconciliation)`);
-        }
-        else if (activeSessions.length > 0) {
-            log.info(`All ${activeSessions.length} active session(s) were already handled during worktree cleanup`);
-        }
-    }
-    catch (err) {
-        const msg = `Failed during DB session reconciliation: ${err instanceof Error ? err.message : String(err)}`;
-        log.error(`${msg}`);
-        result.errors.push(msg);
-    }
-    // Summary. Preserved counts are housekeeping (branch kept, worktree dropped),
-    // not pending human work -- they are logged so the count stays visible.
-    log.info(`[crash-recovery] Recovery complete: ` +
-        `${result.orphansDetected} orphan(s) detected, ` +
-        `${result.orphansCleaned} cleaned, ` +
-        `${result.orphansPreserved} branch(es) preserved (housekeeping), ` +
-        `${result.branchesPruned} branch(es) pruned, ` +
-        `${result.branchesPreserved} stale branch(es) preserved (housekeeping)`);
-    if (result.errors.length > 0) {
-        log.warn(`${result.errors.length} error(s) during recovery (non-fatal)`);
-    }
-    return result;
-}
-//# sourceMappingURL=crash-recovery.js.map