@telora/daemon 0.22.245 → 0.22.290

package/dist/worktree/verify-interlock.js

@@ -1,11 +1,13 @@
 // PINNED-BY-BEGIN (generated by gen:pinned-by -- do not hand-edit; checked by lint:pinned-by)
-// Pinned by: packages/daemon/src/directive/directive-verify-hold-disposal-convergence.test.ts,
-//   packages/daemon/src/directive/directive-verify-hold-gate.test.ts,
+// Pinned by: packages/daemon/src/directive/directive-verify-hold-gate.test.ts,
 //   packages/daemon/src/focus/pending-spawn-verify-hold.test.ts,
-//   packages/daemon/src/verify/verification-baseline-run.test.ts,
-//   packages/daemon/src/verify/verification-checkout.test.ts,
-//   packages/daemon/src/verify/verification-commit-sharing.test.ts,
-//   packages/daemon/src/verify/verification-deterministic.test.ts,
+//   packages/daemon/src/spawn/directive-verify-hold-disposal-convergence.test.ts,
+//   packages/daemon/src/verify/attribution/verification-baseline-run.test.ts,
+//   packages/daemon/src/verify/deterministic-gate/verification-checkout.test.ts,
+//   packages/daemon/src/verify/deterministic-gate/verification-deterministic.test.ts,
+//   packages/daemon/src/verify/engine/verification-commit-sharing.test.ts,
+//   packages/daemon/src/verify/gate-verdicts/gate-run-activity.test.ts,
+//   packages/daemon/src/worktree/verify-interlock.test.ts,
 //   packages/daemon/src/worktree/worktree-package-provisioning.test.ts
 // PINNED-BY-END
 /**
@@ -20,7 +22,8 @@
  * lands inside that window it snapshots the transient drift into the index; the
  * verify's restore then reverts the working tree; the commit never lands --
  * leaving a staged entry with no worktree content behind it (a TORN WRITE, which
- * wedged a focus permanently: escalation 2170fdde, 2026-08-16).
+ * can wedge a focus permanently).
+ * History: docs/daemon/history-platform.md (worktree/verify-interlock.ts).
  *
  * The fix belongs at the daemon, not any one product's verify script: a daemon
  * that runs arbitrary configured commands in a worktree it also commits from must
@@ -29,19 +32,20 @@
  * daemon-authored commit path. While a worktree is held, no commit path stages or
  * commits in it; the commit is DEFERRED (retried on the next poll), never lost.
  *
- * In-memory by design: the hold protects a LIVE process's mutation window, so it
- * is only meaningful while this daemon process is running. A daemon restart kills
- * any in-flight verify AND resets the map -- so a restart can never leave a stale
- * hold that wedges a worktree forever (which would reproduce the very stall this
- * focus removes). The map is keyed by the CANONICAL worktree path (realpath, with
- * a `path.resolve` fallback) so the verify's cwd and a commit path's worktreePath
- * key identically even across symlinks or a trailing slash.
+ * In-memory by design: the hold protects a LIVE process's mutation window, so
+ * it is only meaningful while this daemon process is running. A daemon restart
+ * kills any in-flight verify AND resets the map -- so a restart can never leave
+ * a stale hold that wedges a worktree forever. The map is keyed by the
+ * CANONICAL worktree path (realpath, with a `path.resolve` fallback) so the
+ * verify's cwd and a commit path's worktreePath key identically even across
+ * symlinks or a trailing slash.
  *
  * @module worktree/verify-interlock
  */
 import { realpathSync } from 'node:fs';
 import { resolve } from 'node:path';
-import { createLogger } from '../shell/log.js';
+import { createLogger } from '../log/daemon-log.js';
+import { stopFires } from '../supervision/stop-registry.js';
 const log = createLogger({ module: 'worktree' });
 /**
  * Active verify holds: canonical worktree path -> count of in-flight verifies.
@@ -59,6 +63,20 @@ const holds = new Map();
  * with no delivery id (a caller that judges none) records nothing here.
  */
 const heldDeliveries = new Map();
+/**
+ * When each standing hold can stand until at the latest: canonical worktree path ->
+ * hold token -> epoch ms (acquired-at plus the kill timeout its owner declared), or
+ * null for an owner that declared none. Read by {@link verifyHoldOutlastsMs}.
+ */
+const holdDeadlines = new Map();
+/** Who waits for a worktree's holds to clear: canonical worktree path -> wakers (see {@link awaitVerifyHoldRelease}). */
+const releaseWaiters = new Map();
+function wakeReleaseWaiters(key) {
+    const waiters = releaseWaiters.get(key);
+    releaseWaiters.delete(key);
+    for (const wake of waiters ?? [])
+        wake();
+}
 function adjustDeliveryHold(key, deliveryId, delta) {
     const byDelivery = heldDeliveries.get(key) ?? new Map();
     const next = (byDelivery.get(deliveryId) ?? 0) + delta;
@@ -91,12 +109,18 @@ function keyFor(worktreePath) {
  *
  * `deliveryId` names the delivery the verify is judging, so the actionable-work
  * predicate can withhold exactly that delivery (see {@link verifyHeldDeliveryIds}).
+ * `maxHoldMs` is the owner's kill timeout -- how long its process can live -- so a
+ * waiter can bound its wait by it ({@link verifyHoldOutlastsMs}).
  */
-export function acquireVerifyHold(worktreePath, deliveryId) {
+export function acquireVerifyHold(worktreePath, deliveryId, maxHoldMs) {
     const key = keyFor(worktreePath);
     holds.set(key, (holds.get(key) ?? 0) + 1);
     if (deliveryId)
         adjustDeliveryHold(key, deliveryId, 1);
+    const token = Symbol(key);
+    const deadlines = holdDeadlines.get(key) ?? new Map();
+    deadlines.set(token, maxHoldMs !== undefined ? Date.now() + maxHoldMs : null);
+    holdDeadlines.set(key, deadlines);
     log.debug(`verify-interlock: hold acquired for ${key} (depth ${holds.get(key)}${deliveryId ? `, delivery ${deliveryId}` : ''})`);
     let released = false;
     return () => {
@@ -106,12 +130,16 @@ export function acquireVerifyHold(worktreePath, deliveryId) {
         const next = (holds.get(key) ?? 1) - 1;
         if (next <= 0) {
             holds.delete(key);
+            wakeReleaseWaiters(key);
         }
         else {
             holds.set(key, next);
         }
         if (deliveryId)
             adjustDeliveryHold(key, deliveryId, -1);
+        deadlines.delete(token);
+        if (deadlines.size === 0 && holdDeadlines.get(key) === deadlines)
+            holdDeadlines.delete(key);
         log.debug(`verify-interlock: hold released for ${key} (depth ${next <= 0 ? 0 : next})`);
     };
 }
@@ -132,10 +160,61 @@ export function verifyHeldDeliveryIds(worktreePath) {
 export function isWorktreeUnderVerify(worktreePath) {
     return (holds.get(keyFor(worktreePath)) ?? 0) > 0;
 }
-/** Test seam: clear all holds between cases. */
+/**
+ * How long, from `now`, the holds standing on `worktreePath` can still stand: the
+ * latest deadline among them, each its acquisition plus the kill timeout its owner
+ * declared; a hold whose owner declared none counts as standing `undeclaredMs` more.
+ * 0 when nothing holds the worktree. A wait bounded by at least this never ends
+ * before a legitimate hold's own timeout ends it.
+ */
+export function verifyHoldOutlastsMs(worktreePath, undeclaredMs, now) {
+    let outlasts = 0;
+    for (const deadline of holdDeadlines.get(keyFor(worktreePath))?.values() ?? []) {
+        outlasts = Math.max(outlasts, deadline === null ? undeclaredMs : deadline - now);
+    }
+    return outlasts;
+}
+/**
+ * Resolve once no verify holds `worktreePath` -- at once when none does -- or when
+ * `maxWaitMs` elapses first ('timed_out'). The bound is a backstop, not the
+ * expected path: every hold is released when its verify process exits, and that
+ * process is killed at its own timeout, so a wait bounded past that timeout
+ * ({@link verifyHoldOutlastsMs}) outlives the bound only when a hold leaked. A gate
+ * run waits here before it takes a verification slot, so it does not start in a
+ * worktree another verify is judging -- nor after a timed-out wait, which ends
+ * that dispatch unstarted (verify/engine/verification-engine.ts).
+ */
+export function awaitVerifyHoldRelease(worktreePath, maxWaitMs) {
+    const key = keyFor(worktreePath);
+    if ((holds.get(key) ?? 0) <= 0)
+        return Promise.resolve('released');
+    return new Promise((resolveWait) => {
+        let waiters = releaseWaiters.get(key);
+        if (waiters === undefined) {
+            waiters = new Set();
+            releaseWaiters.set(key, waiters);
+        }
+        const wake = () => {
+            clearTimeout(timer);
+            resolveWait('released');
+        };
+        const timer = setTimeout(() => {
+            waiters.delete(wake);
+            if (waiters.size === 0 && releaseWaiters.get(key) === waiters)
+                releaseWaiters.delete(key);
+            resolveWait('timed_out');
+        }, maxWaitMs);
+        timer.unref?.();
+        waiters.add(wake);
+    });
+}
+/** Test seam: clear all holds between cases (anyone waiting on a release is woken). */
 export function __resetVerifyHolds() {
     holds.clear();
     heldDeliveries.clear();
+    holdDeadlines.clear();
+    for (const key of [...releaseWaiters.keys()])
+        wakeReleaseWaiters(key);
 }
 /**
  * The ONE boundary every daemon path that REWRITES an existing worktree passes
@@ -152,12 +231,12 @@ export function __resetVerifyHolds() {
  * inline `isWorktreeUnderVerify` check re-implemented per call site) means a
  * worktree-write path added later cannot silently bypass the interlock: it either
  * calls this boundary or it does not rewrite the worktree at all. The probe is
- * injectable so the boundary is unit-testable without a real worktree or a live
- * verify.
+ * the caller's (production binds {@link isWorktreeUnderVerify}), so the boundary
+ * is unit-testable without a real worktree or a live verify.
  */
-export function runWorktreeMutationUnderInterlock(worktreePath, mutate, deps = {}) {
-    const underVerify = deps.isWorktreeUnderVerify ?? isWorktreeUnderVerify;
-    if (underVerify(worktreePath)) {
+export function runWorktreeMutationUnderInterlock(worktreePath, mutate, deps) {
+    // The deferral is the verify_interlock stop-registry row's decision.
+    if (stopFires('verify_interlock', { worktreeUnderVerify: deps.isWorktreeUnderVerify(worktreePath) })) {
         return { deferred: true };
     }
     return { deferred: false, result: mutate() };

package/dist/worktree/verify-interlock.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify-interlock.js","sourceRoot":"","sources":["../../src/worktree/verify-interlock.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,+FAA+F;AAC/F,sEAAsE;AACtE,iEAAiE;AACjE,kEAAkE;AAClE,8DAA8D;AAC9D,oEAAoE;AACpE,mEAAmE;AACnE,uEAAuE;AACvE,gBAAgB;AAEhB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;AAExC;;;;;;;GAOG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,EAA+B,CAAC;AAE9D,SAAS,kBAAkB,CAAC,GAAW,EAAE,UAAkB,EAAE,KAAa;IACxE,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,EAAkB,CAAC;IACxE,MAAM,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC;IACvD,IAAI,IAAI,IAAI,CAAC;QAAE,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;;QACxC,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACtC,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC;QAAE,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;;QACjD,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;AAC3C,CAAC;AAED,gFAAgF;AAChF,SAAS,MAAM,CAAC,YAAoB;IAClC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,YAAY,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAAC,YAAoB,EAAE,UAAmB;IACzE,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;IACjC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,IAAI,UAAU;QAAE,kBAAkB,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;IACvD,GAAG,CAAC,KAAK,CAAC,uCAAuC,GAAG,WAAW,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,cAAc,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACjI,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,OAAO,GAAG,EAAE;QACV,IAAI,QAAQ;YAAE,OAAO;QACrB,QAAQ,GAAG,IAAI,CAAC;QAChB,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;YACd,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACvB,CAAC;QACD,IAAI,UAAU;YAAE,kBAAkB,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;QACxD,GAAG,CAAC,KAAK,CAAC,uCAAuC,GAAG,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;IAC1F,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,YAAoB;IACxD,OAAO,IAAI,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,YAAoB;IACxD,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AACpD,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,kBAAkB;IAChC,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,cAAc,CAAC,KAAK,EAAE,CAAC;AACzB,CAAC;AAgBD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,iCAAiC,CAC/C,YAAoB,EACpB,MAAe,EACf,OAAsC,EAAE;IAExC,MAAM,WAAW,GAAG,IAAI,CAAC,qBAAqB,IAAI,qBAAqB,CAAC;IACxE,IAAI,WAAW,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC5B,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC;AAC/C,CAAC"}
+{"version":3,"file":"verify-interlock.js","sourceRoot":"","sources":["../../src/worktree/verify-interlock.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,+EAA+E;AAC/E,iEAAiE;AACjE,kFAAkF;AAClF,8EAA8E;AAC9E,iFAAiF;AACjF,sFAAsF;AACtF,2EAA2E;AAC3E,wEAAwE;AACxE,2DAA2D;AAC3D,uEAAuE;AACvE,gBAAgB;AAEhB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,iCAAiC,CAAC;AAE5D,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;AAExC;;;;;;;GAOG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,EAA+B,CAAC;AAE9D;;;;GAIG;AACH,MAAM,aAAa,GAAG,IAAI,GAAG,EAAsC,CAAC;AAEpE,yHAAyH;AACzH,MAAM,cAAc,GAAG,IAAI,GAAG,EAA2B,CAAC;AAE1D,SAAS,kBAAkB,CAAC,GAAW;IACrC,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACxC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,OAAO,IAAI,EAAE;QAAE,IAAI,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW,EAAE,UAAkB,EAAE,KAAa;IACxE,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,EAAkB,CAAC;IACxE,MAAM,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC;IACvD,IAAI,IAAI,IAAI,CAAC;QAAE,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;;QACxC,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACtC,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC;QAAE,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;;QACjD,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;AAC3C,CAAC;AAED,gFAAgF;AAChF,SAAS,MAAM,CAAC,YAAoB;IAClC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,YAAY,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAAC,YAAoB,EAAE,UAAmB,EAAE,SAAkB;IAC7F,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;IACjC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,IAAI,UAAU;QAAE,kBAAkB,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,EAAyB,CAAC;IAC7E,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC9E,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAClC,GAAG,CAAC,KAAK,CAAC,uCAAuC,GAAG,WAAW,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,cAAc,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACjI,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,OAAO,GAAG,EAAE;QACV,IAAI,QAAQ;YAAE,OAAO;QACrB,QAAQ,GAAG,IAAI,CAAC;QAChB,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;YACd,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAClB,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACvB,CAAC;QACD,IAAI,UAAU;YAAE,kBAAkB,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;QACxD,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS;YAAE,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5F,GAAG,CAAC,KAAK,CAAC,uCAAuC,GAAG,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;IAC1F,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,YAAoB;IACxD,OAAO,IAAI,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,YAAoB;IACxD,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,YAAoB,EAAE,YAAoB,EAAE,GAAW;IAC1F,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,QAAQ,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;QAC/E,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,YAAoB,EAAE,SAAiB;IAC5E,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;IACjC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACnE,OAAO,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE;QACjC,IAAI,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,GAAG,IAAI,GAAG,EAAE,CAAC;YACpB,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACnC,CAAC;QACD,MAAM,IAAI,GAAG,GAAS,EAAE;YACtB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,WAAW,CAAC,UAAU,CAAC,CAAC;QAC1B,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACrB,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,OAAO;gBAAE,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC1F,WAAW,CAAC,WAAW,CAAC,CAAC;QAC3B,CAAC,EAAE,SAAS,CAAC,CAAC;QACd,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,kBAAkB;IAChC,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,cAAc,CAAC,KAAK,EAAE,CAAC;IACvB,aAAa,CAAC,KAAK,EAAE,CAAC;IACtB,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,cAAc,CAAC,IAAI,EAAE,CAAC;QAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC;AACxE,CAAC;AAeD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,iCAAiC,CAC/C,YAAoB,EACpB,MAAe,EACf,IAAmC;IAEnC,qEAAqE;IACrE,IAAI,SAAS,CAAC,kBAAkB,EAAE,EAAE,mBAAmB,EAAE,IAAI,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,CAAC;QACrG,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC5B,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC;AAC/C,CAAC"}

package/dist/worktree/worktree-hooks.d.ts

@@ -0,0 +1,232 @@
+import type { GitResult } from '@telora/daemon-core';
+/**
+ * The git runner configureWorktreeHooksPath is handed (the hook installers
+ * below pass the real `runGitSync`); tests hand a fake
+ * to drive the (otherwise hard-to-provoke) `extensions.worktreeConfig` /
+ * `--worktree` write-failure branches deterministically and to observe that no
+ * shared `core.hooksPath` write is ever attempted on any path.
+ */
+type GitRunner = (args: string[], cwd: string) => GitResult;
+/**
+ * Point THIS worktree's git hooks at its own `.telora-hooks/` dir, scoped so it
+ * cannot depend on -- or govern -- any OTHER worktree of the same repository.
+ *
+ * A plain `git config core.hooksPath ...` writes the SHARED `.git/config`
+ * (verified 2026-08-18 on git 2.47.3: a value set from a linked worktree reads
+ * back from the main checkout), so one focus's ephemeral worktree would govern
+ * hook execution for the whole repo -- and when that worktree is removed, git
+ * runs NO hooks anywhere and the attribution guard silently disappears. Instead
+ * we enable `extensions.worktreeConfig` (repo-global, idempotent) and write
+ * core.hooksPath with `git config --worktree`, so each worktree carries its own
+ * hooksPath and another worktree's create/reuse/removal cannot touch it.
+ *
+ * We NEVER write a shared `core.hooksPath` -- not even as a fallback. That write
+ * is the exact defect the migration/verification siblings exist to undo, and a
+ * fallback here would let the next provisioning cycle re-damage a repo the
+ * migration just repaired. So this fails CLOSED: if per-worktree scoping cannot
+ * be established (worktreeConfig will not enable, or the `--worktree` write
+ * fails), the repo's shared config is left untouched and this worktree simply
+ * runs WITHOUT the attribution guard.
+ *
+ * The enforcement self-check runs on EVERY path (there is no early return before
+ * it): on a failed path it finds the guard is not in effect and logs the loud
+ * "failing OPEN" WARN, which is how an unguarded worktree is reported.
+ */
+export declare function configureWorktreeHooksPath(worktreePath: string, hooksDir: string, runGit: GitRunner): void;
+/**
+ * Migrate away a stale, daemon-written SHARED `core.hooksPath` that a pre-0.21.62
+ * daemon wrote pointing into a daemon worktree's `.telora-hooks` dir -- an
+ * ephemeral agent worktree under `.telora/worktrees/`, or the persistent merge
+ * worktree under `.telora/merge-worktree/`.
+ *
+ * `f629f3e63` (2026-08-18) switched new writes to per-worktree config
+ * (`git config --worktree`, see configureWorktreeHooksPath), fixing the CAUSE but
+ * leaving every already-damaged repo damaged: nothing unsets the stale shared
+ * value. That value is the single cause of both faces of the defect --
+ *   - while the worktree it names still exists, the guard is wrongly enforced in
+ *     the MAIN checkout (where it was never meant to apply); and
+ *   - once that worktree is deleted, git resolves a dangling hooksPath and runs
+ *     NO hooks anywhere, so the attribution guard silently disappears.
+ * Removing the stale shared value resolves both.
+ *
+ * Conservative about ownership. We read the SHARED value SPECIFICALLY via
+ * `git config --local --get core.hooksPath` (which reads `.git/config` and
+ * EXCLUDES the per-worktree `config.worktree` scope) -- NOT the plain
+ * `git config --get`, which layers worktree config on top and could report (and
+ * then delete) a live per-worktree value. We act only when that shared value
+ * carries the daemon's own hooks-dir SIGNATURE -- a `.telora-hooks` directory
+ * inside this repo's `.telora/` tree (under `.telora/worktrees/` for an ephemeral
+ * agent worktree, or `.telora/merge-worktree/` for the persistent merge worktree).
+ * Recognising by that signature, not by an agent-worktree path prefix, is what
+ * reaches the persistent merge worktree's value. A `core.hooksPath` pointing
+ * anywhere else (husky, lefthook, a hand-rolled setup, or a non-hooks path under
+ * `.telora/`) is left strictly alone; we err toward leaving it.
+ *
+ * The unset applies whether or not the pointed-at directory still exists: an
+ * alive-but-stale path is exactly the wrongful-enforcement face and must also be
+ * cleared. Per-worktree (`--worktree`) values the current code writes are never
+ * touched -- `--local` does not read or write that scope. Idempotent: a repo with
+ * no matching shared value is a no-op.
+ *
+ * Returns the removed value (for logging/tests) or null when nothing was cleared.
+ */
+export declare function migrateStaleSharedHooksPath(repoPath: string): {
+    removed: string | null;
+};
+/** How a repo's EFFECTIVE core.hooksPath resolves, from the checkout it runs in. */
+export type RepoHookEnforcementState = 'unset' | 'dangling' | 'enforced';
+/**
+ * Classify the git-hook enforcement state a repo is actually IN, evaluated from
+ * the checkout `repoPath` names -- not the state just written at worktree
+ * provisioning (that is `verifyHookEnforcementInEffect`).
+ *
+ * This closes the blind spot that let a silent fail-open survive the fix written
+ * to prevent silent fail-open: `verifyHookEnforcementInEffect` only ever inspects
+ * a worktree the daemon just configured, so the one place enforcement is silently
+ * absent -- the main checkout that inherited a stale shared value -- is the one
+ * place it never looks.
+ *
+ * Reads the EFFECTIVE value with `git config --get core.hooksPath` (worktree
+ * config layered over shared -- what git will actually use in this directory), so
+ * it must be run in the directory whose state you want to judge (the main
+ * checkout, to see what the main checkout inherits).
+ *
+ *   - unset     -> no core.hooksPath configured. This is the CORRECT steady state
+ *                  for a main checkout after the stale-value migration; NOT a
+ *                  fault, no warning.
+ *   - dangling  -> configured but the directory does not exist. git runs NO hooks
+ *                  here: the attribution guard is failing OPEN. Logged as a loud
+ *                  WARN naming the repo, the resolved path, and the consequence.
+ *   - enforced  -> configured and the directory exists (live enforcement). Fine.
+ *
+ * Files NO escalation for any state: this is observable repo state the daemon
+ * resolves itself via migrateStaleSharedHooksPath (config gaps are state, not
+ * escalations).
+ */
+export declare function checkRepoHookEnforcementState(repoPath: string): RepoHookEnforcementState;
+/**
+ * Install a pre-commit hook in a worktree that blocks all commits.
+ * Used for read-only audit sessions.
+ */
+export declare function installAuditPreCommitHook(worktreePath: string): void;
+/**
+ * Write (or merge into) the worktree's `.claude/settings.json` a write-deny
+ * overlay so a read-only audit team physically cannot Write/Edit or run
+ * write-shaped Bash.
+ *
+ * The daemon spawns agents with `--dangerously-skip-permissions
+ * --setting-sources project,local`, which reads the worktree's
+ * `.claude/settings.json` (project source). Two properties make this deny
+ * overlay the tool-layer enforcement of read-only mode:
+ *   - `--dangerously-skip-permissions` only auto-approves the *ask* tier;
+ *     explicit `permissions.deny` entries are still enforced.
+ *   - Crucially, `deny` is honored even in an UNTRUSTED worktree -- the case
+ *     that actually matters, because a daemon-created worktree is a fresh path
+ *     and untrusted by default. In an untrusted worktree `permissions.allow` is
+ *     DISCARDED ("this workspace has not been trusted"), so it would be wrong to
+ *     assume `deny` shares that fate: `deny` is a restriction, not a grant, so
+ *     honoring it from an untrusted project is safe, and Claude Code does.
+ *
+ * This is not assumed -- it is verified. See
+ * `templates/read-only-deny-enforcement-evidence.test.ts` for the reproduction
+ * (untrusted worktree + deny overlay -> the Write tool is removed from the
+ * session and no file is written; the same untrusted worktree WITHOUT deny ->
+ * Write is available and succeeds while the allow list is ignored), measured
+ * against Claude Code 2.1.221 on 2026-08-04. Re-run that reproduction when
+ * bumping the Claude CLI.
+ *
+ * The pre-commit hook (installAuditPreCommitHook) and the completion-side
+ * revert are retained as defense-in-depth ON TOP of this tool-layer guard --
+ * not as the only guards.
+ *
+ * Idempotent: re-running merges the deny list, deduplicated, producing no diff.
+ * MUST only be called for read-only focuses -- a writable focus's settings
+ * must never carry a `deny` key.
+ */
+export declare function writeReadOnlyDenyOverlay(worktreePath: string): void;
+/**
+ * Write Codex's read-only audit overlay into the worktree-local project config.
+ *
+ * Codex project config is a durable record for the worktree; spawn-time `-c`
+ * overrides still select `default_permissions="telora_read_only"` so read-only
+ * enforcement does not depend on project trust. The profile itself is kept here
+ * for parity, inspection, and trusted-project runs.
+ */
+export declare function writeCodexReadOnlyOverlay(worktreePath: string): void;
+/**
+ * Install all read-only audit enforcement in a worktree: the commit-blocking
+ * pre-commit hook, Claude's write-deny settings overlay, and Codex's
+ * read-only permission profile. Single entry point so every read-only
+ * worktree-setup site gets identical coverage.
+ */
+export declare function installReadOnlyAuditGuards(worktreePath: string): void;
+/**
+ * Install a `commit-msg` hook in a worktree that REFUSES any commit whose
+ * message lacks a well-formed `Telora-Delivery: <uuid>` trailer.
+ *
+ * The trailer is the one durable per-commit fact every delivery-attribution
+ * read rests on (`readDeliveryTrailer` in resolvers/shared/git-diff.ts reads it
+ * via `git show -s --format=%(trailers:key=Telora-Delivery,valueonly)`). Prose
+ * in the execution prompt + agent CLAUDE.md asks agents to stamp it, but prose
+ * has already failed silently once (2026-08-13: the daemon's own recommended
+ * `-m` form voided the trailer when `Co-Authored-By` was appended). This hook
+ * makes the mandate mechanical at commit time.
+ *
+ * The hook validates SHAPE via git's OWN trailer parse, not a substring match:
+ *   - It uses `git interpret-trailers --parse` on the message file, so the value
+ *     it reads is exactly what the read side reads. A `Telora-Delivery:` line
+ *     sitting in the commit BODY (separated from the trailer block by a blank
+ *     line) is VOIDED by git and does not parse -- the read side rejects it, so
+ *     the hook must too. A naive `grep 'Telora-Delivery'` on the raw message
+ *     would wrongly PASS such a voided commit; this does not.
+ *   - A trailing `Co-Authored-By:` (or any other trailer) in the same block
+ *     still parses, so the commit PASSES -- the 2026-08-13 failure mode.
+ *   - The value must be a well-formed UUID (8-4-4-4-12 hex) OR the explicit
+ *     non-delivery sentinel `Telora-Delivery: none` (NON_DELIVERY_SENTINEL,
+ *     matched case-insensitively), or the daemon's unattributed-capture marker
+ *     `Telora-Delivery: unattributed` (UNATTRIBUTED_CAPTURE_SENTINEL, stamped on
+ *     a capture of delivery work whose delivery it could not determine); a
+ *     malformed or truncated id FAILS, and a sentinel voided into the body FAILS
+ *     like any other voided value. The refusal text does not advertise the
+ *     capture marker: an agent attributes its own work, or declares `none`.
+ *
+ * The sentinel lets a genuinely delivery-less commit (daemon housekeeping, or
+ * any commit an agent cannot attribute to a delivery) declare itself as such
+ * rather than being forced to borrow a real delivery id -- which would falsely
+ * attribute that work to the borrowed delivery's verify evidence. It is a
+ * trailer VALUE, not a bypass: a sentinel commit is still labelled, so the
+ * verify gate's partition stays total (see NON_DELIVERY_SENTINEL in git-diff).
+ *
+ * The failure message names the missing trailer, the sentinel escape for a
+ * non-delivery commit, and the exact `git commit --trailer` forms, so an agent
+ * self-corrects without escalating or borrowing an id.
+ *
+ * The hook lives in the SAME `.telora-hooks/` directory as any audit
+ * `pre-commit` hook, because `core.hooksPath` is a single value -- git runs
+ * every hook file in that one dir by name. So this coexists with the read-only
+ * audit pre-commit block (which runs first and blocks the commit outright)
+ * without weakening it.
+ */
+export declare function installDeliveryTrailerCommitMsgHook(worktreePath: string): void;
+/**
+ * Install the execution-worktree git guards: the delivery-trailer `commit-msg`
+ * hook on EVERY writable worktree, plus -- when the focus is read-only -- the
+ * full audit guard set (commit-blocking pre-commit hook + Claude/Codex
+ * read-only overlays). Single entry point so every worktree create/reuse site
+ * gets identical, idempotent coverage.
+ *
+ * The hook FILES live under the worktree's `.telora-hooks/` (not tracked tree
+ * content) and `core.hooksPath` is set PER-WORKTREE via `git config --worktree`
+ * (backed by repo-global `extensions.worktreeConfig=true`), so this must be
+ * RE-ASSERTED on every reuse/spawn (it is idempotent -- re-running produces the
+ * same files + config). Per-worktree scoping is deliberate: a plain
+ * `git config core.hooksPath` writes the SHARED `.git/config` and would let one
+ * worktree govern -- and, on removal, silently disable -- hook enforcement for
+ * every checkout of the repo (the 2026-08-17 wedge). A read-only worktree still
+ * gets the trailer hook, but its pre-commit block runs first and refuses the
+ * commit outright, so the two coexist without the trailer hook weakening the
+ * read-only guarantee.
+ */
+export declare function installExecutionWorktreeGuards(worktreePath: string, readOnly: boolean): void;
+export {};
+//# sourceMappingURL=worktree-hooks.d.ts.map

package/dist/worktree/worktree-hooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worktree-hooks.d.ts","sourceRoot":"","sources":["../../src/worktree/worktree-hooks.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAYrD;;;;;;GAMG;AACH,KAAK,SAAS,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,KAAK,SAAS,CAAC;AAE5D;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,0BAA0B,CACxC,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,SAAS,GAChB,IAAI,CAsBN;AA2BD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CA8CxF;AAED,oFAAoF;AACpF,MAAM,MAAM,wBAAwB,GAAG,OAAO,GAAG,UAAU,GAAG,UAAU,CAAC;AAEzE;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,MAAM,GAAG,wBAAwB,CAiBxF;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAmCpE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CA0BnE;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CA8BpE;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAIrE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,wBAAgB,mCAAmC,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CA4F9E;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,8BAA8B,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,IAAI,CAK5F"}