@webpieces/pr-gate 0.4.721 → 0.4.723

package/src/scripts/commands/reap-worktree-command.d.ts

@@ -1,4 +1,4 @@
-import { RepoRootFinder } from '@webpieces/rules-config';
+import { RepoRootFinder, WorktreeService } from '@webpieces/rules-config';
 import { ReapOutcomeSignal } from '../workflow/reap-outcome';
 import { WorktreeCleanupSection } from './worktree-cleanup';
 /**
@@ -11,7 +11,8 @@ import { WorktreeCleanupSection } from './worktree-cleanup';
  * PR. LandedWorktreeReaper spawns it by absolute path; see that class for why a child rather than a
  * `process.chdir`.
  *
- * WHAT IT WILL NOT TAKE ON TRUST. The parent tells it a path and a branch; it believes neither.
+ * WHAT IT WILL NOT TAKE ON TRUST. The parent tells it a path, a branch and the HEAD sha it selected the
+ * tree by; it believes none of the three.
  * The verdict is recomputed here, from scratch, by the same MergedBranchesService that backs
  * `wp-cleanup` — so a worktree is removed only when it is PROVABLY dead (its PR is merged), and never
  * because a caller said so. That is what keeps "never remove a tree still holding unmerged work" true
@@ -25,7 +26,8 @@ export declare class ReapWorktreeCommand {
     private readonly repoRootFinder;
     private readonly worktreeSection;
     private readonly signal;
-    constructor(repoRootFinder: RepoRootFinder, worktreeSection: WorktreeCleanupSection, signal: ReapOutcomeSignal);
+    private readonly worktrees;
+    constructor(repoRootFinder: RepoRootFinder, worktreeSection: WorktreeCleanupSection, signal: ReapOutcomeSignal, worktrees: WorktreeService);
     /**
      * Every exit from here states an OUTCOME, because the exit code cannot: refusals exit 0 (see
      * `resolveTarget`), so a parent with only a status has no way to tell "removed" from "declined to
@@ -45,6 +47,19 @@ export declare class ReapWorktreeCommand {
      * emits a ReapOutcomeSignal — the caller must be able to tell this exit 0 from a successful one.
      */
     private resolveTarget;
+    /**
+     * That worktree's HEAD as git reports it right now, '' when git cannot place the path at all.
+     * '' can never equal a real sha, so "git would not answer" fails SAFE — it declines the removal.
+     */
+    private headOf;
     private render;
+    /**
+     * `<worktree-path> <branch> <head-sha>`, all three required. The sha is not optional and has no
+     * default: a defaulted '' would mean "do not check", i.e. exactly the name-only removal both
+     * processes exist to refuse, so a caller that omits it must fail to run rather than run wider.
+     *
+     * Thrown rather than printed: bad argv means the caller is broken, and there is no landed PR in this
+     * process whose success a non-zero exit could misreport.
+     */
     private parse;
 }

package/src/scripts/commands/reap-worktree-command.js

@@ -18,7 +18,8 @@ const SEP = '━━━━━━━━━━━━━━━━━━━━━━
  * PR. LandedWorktreeReaper spawns it by absolute path; see that class for why a child rather than a
  * `process.chdir`.
  *
- * WHAT IT WILL NOT TAKE ON TRUST. The parent tells it a path and a branch; it believes neither.
+ * WHAT IT WILL NOT TAKE ON TRUST. The parent tells it a path, a branch and the HEAD sha it selected the
+ * tree by; it believes none of the three.
  * The verdict is recomputed here, from scratch, by the same MergedBranchesService that backs
  * `wp-cleanup` — so a worktree is removed only when it is PROVABLY dead (its PR is merged), and never
  * because a caller said so. That is what keeps "never remove a tree still holding unmerged work" true
@@ -32,10 +33,12 @@ let ReapWorktreeCommand = class ReapWorktreeCommand {
     repoRootFinder;
     worktreeSection;
     signal;
-    constructor(repoRootFinder, worktreeSection, signal) {
+    worktrees;
+    constructor(repoRootFinder, worktreeSection, signal, worktrees) {
         this.repoRootFinder = repoRootFinder;
         this.worktreeSection = worktreeSection;
         this.signal = signal;
+        this.worktrees = worktrees;
     }
     /**
      * Every exit from here states an OUTCOME, because the exit code cannot: refusals exit 0 (see
@@ -90,6 +93,17 @@ let ReapWorktreeCommand = class ReapWorktreeCommand {
                 + '       Refusing to remove a worktree whose branch changed since the PR landed.\n');
             return null;
         }
+        // …and the NAME is not the identity. The parent selected this directory because its HEAD was the
+        // exact commit GitHub squashed; that selection is recomputed here from git rather than taken on
+        // trust, so a commit made in that tree between landing and reaping — work the archive tag of the
+        // squashed tip does not contain — stops the removal instead of being buried with it.
+        const here = this.headOf(repoRoot, wanted);
+        if (here !== request.head) {
+            process.stdout.write(`\n   ⚠️  ${request.worktreePath} is at ${here === '' ? '(unknown)' : here}, not the landed\n`
+                + `       commit ${request.head}.\n`
+                + '       Refusing to remove a worktree whose HEAD moved since the PR landed.\n');
+            return null;
+        }
         if (!target.deletable) {
             process.stdout.write(`\n   ⚠️  ${request.worktreePath} is not provably dead: ${target.reason}\n`
                 + '       Refusing to remove a worktree that may still hold unmerged work.\n');
@@ -97,6 +111,15 @@ let ReapWorktreeCommand = class ReapWorktreeCommand {
         }
         return target;
     }
+    /**
+     * That worktree's HEAD as git reports it right now, '' when git cannot place the path at all.
+     * '' can never equal a real sha, so "git would not answer" fails SAFE — it declines the removal.
+     */
+    headOf(repoRoot, resolvedPath) {
+        const tree = this.worktrees.listWorktrees(repoRoot)
+            .find((candidate) => path.resolve(candidate.path) === resolvedPath);
+        return tree?.head ?? '';
+    }
     // The reap report, plus the spared case — which report() renders as '' because from wp-cleanup's
     // point of view "nothing happened" is a whole answer. Here it never is: we asked for exactly one.
     render(repoRoot, result) {
@@ -108,18 +131,25 @@ let ReapWorktreeCommand = class ReapWorktreeCommand {
         }
         return this.worktreeSection.report(repoRoot, result);
     }
-    // `<worktree-path> <branch>`, both required. Thrown rather than printed: bad argv means the caller
-    // is broken, and there is no landed PR in this process whose success a non-zero exit could misreport.
+    /**
+     * `<worktree-path> <branch> <head-sha>`, all three required. The sha is not optional and has no
+     * default: a defaulted '' would mean "do not check", i.e. exactly the name-only removal both
+     * processes exist to refuse, so a caller that omits it must fail to run rather than run wider.
+     *
+     * Thrown rather than printed: bad argv means the caller is broken, and there is no landed PR in this
+     * process whose success a non-zero exit could misreport.
+     */
     parse(args) {
         const worktreePath = args[0] ?? '';
         const branch = args[1] ?? '';
-        if (worktreePath === '' || branch === '') {
+        const head = args[2] ?? '';
+        if (worktreePath === '' || branch === '' || head === '') {
             throw new rules_config_1.InformAiError('\n' + SEP + '❌ wp-reap-worktree: missing arguments\n' + SEP + '\n'
-                + 'Usage: node wp-reap-worktree.js <worktree-path> <branch>\n\n'
+                + 'Usage: node wp-reap-worktree.js <worktree-path> <branch> <head-sha>\n\n'
                 + 'This is an INTERNAL entry point, spawned by `pnpm wp-land-pr` with cwd set to the\n'
                 + 'primary clone. To clean up by hand, run `pnpm wp-cleanup` from the primary clone.\n' + SEP);
         }
-        return new ReapRequest(worktreePath, branch);
+        return new ReapRequest(worktreePath, branch, head);
     }
 };
 exports.ReapWorktreeCommand = ReapWorktreeCommand;
@@ -127,15 +157,19 @@ exports.ReapWorktreeCommand = ReapWorktreeCommand = tslib_1.__decorate([
     (0, inversify_1.injectable)(inversify_1.bindingScopeValues.Singleton),
     tslib_1.__metadata("design:paramtypes", [rules_config_1.RepoRootFinder,
         worktree_cleanup_1.WorktreeCleanupSection,
-        reap_outcome_1.ReapOutcomeSignal])
+        reap_outcome_1.ReapOutcomeSignal,
+        rules_config_1.WorktreeService])
 ], ReapWorktreeCommand);
-// Data-only (per CLAUDE.md, classes for data): the pair of argv values this entry point takes.
+// Data-only (per CLAUDE.md, classes for data): the argv values this entry point takes.
 class ReapRequest {
     worktreePath;
     branch;
-    constructor(worktreePath, branch) {
+    /** The commit the parent proved this worktree was at — re-verified here, never trusted. */
+    head;
+    constructor(worktreePath, branch, head) {
         this.worktreePath = worktreePath;
         this.branch = branch;
+        this.head = head;
     }
 }
 //# sourceMappingURL=reap-worktree-command.js.map

package/src/scripts/commands/reap-worktree-command.js.map

@@ -1 +1 @@
-{"version":3,"file":"reap-worktree-command.js","sourceRoot":"","sources":["../../../../../../../packages/tooling/pr-gate/src/scripts/commands/reap-worktree-command.ts"],"names":[],"mappings":";;;;AAAA,mDAA6B;AAC7B,0DAMiC;AACjC,yCAA2D;AAE3D,2DAKkC;AAElC,yDAA4D;AAE5D,MAAM,GAAG,GAAG,0DAA0D,CAAC;AAEvE;;;;;;;;;;;;;;;;;;;GAmBG;AAEI,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAEP;IACA;IACA;IAHrB,YACqB,cAA8B,EAC9B,eAAuC,EACvC,MAAyB;QAFzB,mBAAc,GAAd,cAAc,CAAgB;QAC9B,oBAAe,GAAf,eAAe,CAAwB;QACvC,WAAM,GAAN,MAAM,CAAmB;IAC3C,CAAC;IAEJ;;;;OAIG;IACH,KAAK,CAAC,GAAG,CAAC,IAAc;QACpB,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAEpE,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACrD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAoB,CAAC,CAAC,CAAC;YAC7D,OAAO;QACX,CAAC;QAED,MAAM,SAAS,GAAG,IAAA,8BAAe,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC;QAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,CAAC;QACtF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QACpD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACnE,CAAC;IAED;;;;OAIG;IACK,SAAS,CAAC,MAA0B;QACxC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,mCAAoB,CAAC;QAC1D,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,kCAAmB,CAAC,CAAC,CAAC,mCAAoB,CAAC;IACjF,CAAC;IAED;;;;;OAKG;IACK,aAAa,CAAC,QAAgB,EAAE,OAAoB;QACxD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAClD,yFAAyF;QACzF,2FAA2F;QAC3F,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;aACxD,IAAI,CAAC,CAAC,IAAuB,EAAW,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,CAAC;QAEpF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAChB,YAAY,OAAO,CAAC,YAAY,4DAA4D;kBAC1F,4DAA4D,CAAC,CAAC;YACpE,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,8FAA8F;QAC9F,uEAAuE;QACvE,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;YACnC,OAAO,CAAC,MAAM,CAAC,KAAK,CAChB,YAAY,OAAO,CAAC,YAAY,eAAe,MAAM,CAAC,MAAM,WAAW,OAAO,CAAC,MAAM,MAAM;kBACzF,kFAAkF,CAAC,CAAC;YAC1F,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAChB,YAAY,OAAO,CAAC,YAAY,0BAA0B,MAAM,CAAC,MAAM,IAAI;kBACzE,2EAA2E,CAAC,CAAC;YACnF,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,iGAAiG;IACjG,kGAAkG;IAC1F,MAAM,CAAC,QAAgB,EAAE,MAA0B;QACvD,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3D,IAAI,GAAG,GAAG,IAAI,GAAG,GAAG,GAAG,sBAAsB,GAAG,GAAG,GAAG,IAAI,CAAC;YAC3D,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM;gBAAE,GAAG,IAAI,QAAQ,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,MAAM,IAAI,CAAC;YAChF,OAAO,GAAG,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACzD,CAAC;IAED,mGAAmG;IACnG,sGAAsG;IAC9F,KAAK,CAAC,IAAc;QACxB,MAAM,YAAY,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,YAAY,KAAK,EAAE,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;YACvC,MAAM,IAAI,4BAAa,CACnB,IAAI,GAAG,GAAG,GAAG,yCAAyC,GAAG,GAAG,GAAG,IAAI;kBACjE,8DAA8D;kBAC9D,qFAAqF;kBACrF,qFAAqF,GAAG,GAAG,CAAC,CAAC;QACvG,CAAC;QACD,OAAO,IAAI,WAAW,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;CACJ,CAAA;AApGY,kDAAmB;8BAAnB,mBAAmB;IAD/B,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;6CAGA,6BAAc;QACb,yCAAsB;QAC/B,gCAAiB;GAJrC,mBAAmB,CAoG/B;AAED,+FAA+F;AAC/F,MAAM,WAAW;IACb,YAAY,CAAS;IACrB,MAAM,CAAS;IAEf,YAAY,YAAoB,EAAE,MAAc;QAC5C,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACzB,CAAC;CACJ","sourcesContent":["import * as path from 'path';\nimport {\n    DeletableWorktree,\n    InformAiError,\n    RepoRootFinder,\n    WorktreeReapResult,\n    loadAndValidate,\n} from '@webpieces/rules-config';\nimport { injectable, bindingScopeValues } from 'inversify';\n\nimport {\n    ReapOutcomeSignal,\n    REAP_OUTCOME_FAILED,\n    REAP_OUTCOME_REFUSED,\n    REAP_OUTCOME_REMOVED,\n} from '../workflow/reap-outcome';\n\nimport { WorktreeCleanupSection } from './worktree-cleanup';\n\nconst SEP = '━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n';\n\n/**\n * The CHILD side of `wp-land-pr`'s re-exec: reap ONE named worktree, from a process whose cwd is the\n * primary clone.\n *\n * It is not a published `bin`. Nothing about it is a verb a human should reach for — `pnpm wp-cleanup`\n * is that verb, and it does strictly more. This exists so the parent can hand off a SINGLE, already\n * identified corpse without also reaping every other agent's worktree as a side effect of landing one\n * PR. LandedWorktreeReaper spawns it by absolute path; see that class for why a child rather than a\n * `process.chdir`.\n *\n * WHAT IT WILL NOT TAKE ON TRUST. The parent tells it a path and a branch; it believes neither.\n * The verdict is recomputed here, from scratch, by the same MergedBranchesService that backs\n * `wp-cleanup` — so a worktree is removed only when it is PROVABLY dead (its PR is merged), and never\n * because a caller said so. That is what keeps \"never remove a tree still holding unmerged work\" true\n * even if the parent is wrong, out of date, or someone runs this by hand.\n *\n * The primary clone can never be a target: `classifyWorktrees` drops the main worktree from the\n * verdicts outright, so a path pointing at it simply does not resolve to a target — and WorktreeReaper\n * refuses it a second time by name. Neither rail is load-bearing alone.\n */\n@injectable(bindingScopeValues.Singleton)\nexport class ReapWorktreeCommand {\n    constructor(\n        private readonly repoRootFinder: RepoRootFinder,\n        private readonly worktreeSection: WorktreeCleanupSection,\n        private readonly signal: ReapOutcomeSignal,\n    ) {}\n\n    /**\n     * Every exit from here states an OUTCOME, because the exit code cannot: refusals exit 0 (see\n     * `resolveTarget`), so a parent with only a status has no way to tell \"removed\" from \"declined to\n     * remove\". The token is the last thing written, and LandedWorktreeReaper strips it before printing.\n     */\n    async run(args: string[]): Promise<void> {\n        await Promise.resolve();\n        const request = this.parse(args);\n        const repoRoot = this.repoRootFinder.resolveRepoRoot(process.cwd());\n\n        const target = this.resolveTarget(repoRoot, request);\n        if (target === null) {\n            process.stdout.write(this.signal.line(REAP_OUTCOME_REFUSED));\n            return;\n        }\n\n        const retention = loadAndValidate(repoRoot).prGate.landPr.branchRetention;\n        const result = this.worktreeSection.reap(repoRoot, 'wp-land-pr', [target], retention);\n        process.stdout.write(this.render(repoRoot, result));\n        process.stdout.write(this.signal.line(this.outcomeOf(result)));\n    }\n\n    /**\n     * `reaped` is the only entry that means the DIRECTORY is gone. A tree that reached the reaper and\n     * came back in neither list was spared by one of WorktreeReaper's own rails (it is the cwd, it is\n     * the primary clone) — nothing was attempted, which is a refusal, not a failure.\n     */\n    private outcomeOf(result: WorktreeReapResult): string {\n        if (result.reaped.length > 0) return REAP_OUTCOME_REMOVED;\n        return result.failed.length > 0 ? REAP_OUTCOME_FAILED : REAP_OUTCOME_REFUSED;\n    }\n\n    /**\n     * The verdict for the requested path, or null after printing WHY it is not reapable. Refusals are\n     * printed rather than thrown: the PR they follow is already merged, and exiting non-zero after a\n     * successful landing would report a landed PR as a failed command. That is exactly why `run` also\n     * emits a ReapOutcomeSignal — the caller must be able to tell this exit 0 from a successful one.\n     */\n    private resolveTarget(repoRoot: string, request: ReapRequest): DeletableWorktree | null {\n        const wanted = path.resolve(request.worktreePath);\n        // `false`: this reaps ONE named worktree after its PR landed, and it is not the place to\n        // override anybody's lock — a lock still standing here is exactly the refusal this prints.\n        const target = this.worktreeSection.verdicts(repoRoot, false)\n            .find((tree: DeletableWorktree): boolean => path.resolve(tree.path) === wanted);\n\n        if (target === undefined) {\n            process.stdout.write(\n                `\\n   ℹ️  ${request.worktreePath} is not a removable worktree of this repo (it may be the\\n`\n                + '       primary clone, or already gone). Nothing removed.\\n');\n            return null;\n        }\n        // The branch moved under us between landing and reaping — somebody checked something else out\n        // there. Whatever that is, it is not the corpse we were asked to bury.\n        if (target.branch !== request.branch) {\n            process.stdout.write(\n                `\\n   ⚠️  ${request.worktreePath} now holds '${target.branch}', not '${request.branch}'.\\n`\n                + '       Refusing to remove a worktree whose branch changed since the PR landed.\\n');\n            return null;\n        }\n        if (!target.deletable) {\n            process.stdout.write(\n                `\\n   ⚠️  ${request.worktreePath} is not provably dead: ${target.reason}\\n`\n                + '       Refusing to remove a worktree that may still hold unmerged work.\\n');\n            return null;\n        }\n        return target;\n    }\n\n    // The reap report, plus the spared case — which report() renders as '' because from wp-cleanup's\n    // point of view \"nothing happened\" is a whole answer. Here it never is: we asked for exactly one.\n    private render(repoRoot: string, result: WorktreeReapResult): string {\n        if (result.reaped.length === 0 && result.failed.length === 0) {\n            let out = '\\n' + SEP + '🛑 Nothing removed\\n' + SEP + '\\n';\n            for (const tree of result.spared) out += `   · ${tree.path} — ${tree.reason}\\n`;\n            return out;\n        }\n        return this.worktreeSection.report(repoRoot, result);\n    }\n\n    // `<worktree-path> <branch>`, both required. Thrown rather than printed: bad argv means the caller\n    // is broken, and there is no landed PR in this process whose success a non-zero exit could misreport.\n    private parse(args: string[]): ReapRequest {\n        const worktreePath = args[0] ?? '';\n        const branch = args[1] ?? '';\n        if (worktreePath === '' || branch === '') {\n            throw new InformAiError(\n                '\\n' + SEP + '❌ wp-reap-worktree: missing arguments\\n' + SEP + '\\n'\n                + 'Usage: node wp-reap-worktree.js <worktree-path> <branch>\\n\\n'\n                + 'This is an INTERNAL entry point, spawned by `pnpm wp-land-pr` with cwd set to the\\n'\n                + 'primary clone. To clean up by hand, run `pnpm wp-cleanup` from the primary clone.\\n' + SEP);\n        }\n        return new ReapRequest(worktreePath, branch);\n    }\n}\n\n// Data-only (per CLAUDE.md, classes for data): the pair of argv values this entry point takes.\nclass ReapRequest {\n    worktreePath: string;\n    branch: string;\n\n    constructor(worktreePath: string, branch: string) {\n        this.worktreePath = worktreePath;\n        this.branch = branch;\n    }\n}\n"]}
+{"version":3,"file":"reap-worktree-command.js","sourceRoot":"","sources":["../../../../../../../packages/tooling/pr-gate/src/scripts/commands/reap-worktree-command.ts"],"names":[],"mappings":";;;;AAAA,mDAA6B;AAC7B,0DAQiC;AACjC,yCAA2D;AAE3D,2DAKkC;AAElC,yDAA4D;AAE5D,MAAM,GAAG,GAAG,0DAA0D,CAAC;AAEvE;;;;;;;;;;;;;;;;;;;;GAoBG;AAEI,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAEP;IACA;IACA;IACA;IAJrB,YACqB,cAA8B,EAC9B,eAAuC,EACvC,MAAyB,EACzB,SAA0B;QAH1B,mBAAc,GAAd,cAAc,CAAgB;QAC9B,oBAAe,GAAf,eAAe,CAAwB;QACvC,WAAM,GAAN,MAAM,CAAmB;QACzB,cAAS,GAAT,SAAS,CAAiB;IAC5C,CAAC;IAEJ;;;;OAIG;IACH,KAAK,CAAC,GAAG,CAAC,IAAc;QACpB,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAEpE,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACrD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAoB,CAAC,CAAC,CAAC;YAC7D,OAAO;QACX,CAAC;QAED,MAAM,SAAS,GAAG,IAAA,8BAAe,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC;QAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,CAAC;QACtF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QACpD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACnE,CAAC;IAED;;;;OAIG;IACK,SAAS,CAAC,MAA0B;QACxC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,mCAAoB,CAAC;QAC1D,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,kCAAmB,CAAC,CAAC,CAAC,mCAAoB,CAAC;IACjF,CAAC;IAED;;;;;OAKG;IACK,aAAa,CAAC,QAAgB,EAAE,OAAoB;QACxD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAClD,yFAAyF;QACzF,2FAA2F;QAC3F,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;aACxD,IAAI,CAAC,CAAC,IAAuB,EAAW,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,CAAC;QAEpF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAChB,YAAY,OAAO,CAAC,YAAY,4DAA4D;kBAC1F,4DAA4D,CAAC,CAAC;YACpE,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,8FAA8F;QAC9F,uEAAuE;QACvE,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;YACnC,OAAO,CAAC,MAAM,CAAC,KAAK,CAChB,YAAY,OAAO,CAAC,YAAY,eAAe,MAAM,CAAC,MAAM,WAAW,OAAO,CAAC,MAAM,MAAM;kBACzF,kFAAkF,CAAC,CAAC;YAC1F,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,iGAAiG;QACjG,gGAAgG;QAChG,iGAAiG;QACjG,qFAAqF;QACrF,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC3C,IAAI,IAAI,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC;YACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAChB,YAAY,OAAO,CAAC,YAAY,UAAU,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,oBAAoB;kBAC5F,iBAAiB,OAAO,CAAC,IAAI,KAAK;kBAClC,8EAA8E,CAAC,CAAC;YACtF,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAChB,YAAY,OAAO,CAAC,YAAY,0BAA0B,MAAM,CAAC,MAAM,IAAI;kBACzE,2EAA2E,CAAC,CAAC;YACnF,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;IAED;;;OAGG;IACK,MAAM,CAAC,QAAgB,EAAE,YAAoB;QACjD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC;aAC9C,IAAI,CAAC,CAAC,SAAmB,EAAW,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,YAAY,CAAC,CAAC;QAC3F,OAAO,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC;IAC5B,CAAC;IAED,iGAAiG;IACjG,kGAAkG;IAC1F,MAAM,CAAC,QAAgB,EAAE,MAA0B;QACvD,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3D,IAAI,GAAG,GAAG,IAAI,GAAG,GAAG,GAAG,sBAAsB,GAAG,GAAG,GAAG,IAAI,CAAC;YAC3D,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM;gBAAE,GAAG,IAAI,QAAQ,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,MAAM,IAAI,CAAC;YAChF,OAAO,GAAG,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACzD,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,IAAc;QACxB,MAAM,YAAY,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3B,IAAI,YAAY,KAAK,EAAE,IAAI,MAAM,KAAK,EAAE,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;YACtD,MAAM,IAAI,4BAAa,CACnB,IAAI,GAAG,GAAG,GAAG,yCAAyC,GAAG,GAAG,GAAG,IAAI;kBACjE,yEAAyE;kBACzE,qFAAqF;kBACrF,qFAAqF,GAAG,GAAG,CAAC,CAAC;QACvG,CAAC;QACD,OAAO,IAAI,WAAW,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC;CACJ,CAAA;AAlIY,kDAAmB;8BAAnB,mBAAmB;IAD/B,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;6CAGA,6BAAc;QACb,yCAAsB;QAC/B,gCAAiB;QACd,8BAAe;GALtC,mBAAmB,CAkI/B;AAED,uFAAuF;AACvF,MAAM,WAAW;IACb,YAAY,CAAS;IACrB,MAAM,CAAS;IACf,2FAA2F;IAC3F,IAAI,CAAS;IAEb,YAAY,YAAoB,EAAE,MAAc,EAAE,IAAY;QAC1D,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACrB,CAAC;CACJ","sourcesContent":["import * as path from 'path';\nimport {\n    DeletableWorktree,\n    InformAiError,\n    RepoRootFinder,\n    Worktree,\n    WorktreeReapResult,\n    WorktreeService,\n    loadAndValidate,\n} from '@webpieces/rules-config';\nimport { injectable, bindingScopeValues } from 'inversify';\n\nimport {\n    ReapOutcomeSignal,\n    REAP_OUTCOME_FAILED,\n    REAP_OUTCOME_REFUSED,\n    REAP_OUTCOME_REMOVED,\n} from '../workflow/reap-outcome';\n\nimport { WorktreeCleanupSection } from './worktree-cleanup';\n\nconst SEP = '━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n';\n\n/**\n * The CHILD side of `wp-land-pr`'s re-exec: reap ONE named worktree, from a process whose cwd is the\n * primary clone.\n *\n * It is not a published `bin`. Nothing about it is a verb a human should reach for — `pnpm wp-cleanup`\n * is that verb, and it does strictly more. This exists so the parent can hand off a SINGLE, already\n * identified corpse without also reaping every other agent's worktree as a side effect of landing one\n * PR. LandedWorktreeReaper spawns it by absolute path; see that class for why a child rather than a\n * `process.chdir`.\n *\n * WHAT IT WILL NOT TAKE ON TRUST. The parent tells it a path, a branch and the HEAD sha it selected the\n * tree by; it believes none of the three.\n * The verdict is recomputed here, from scratch, by the same MergedBranchesService that backs\n * `wp-cleanup` — so a worktree is removed only when it is PROVABLY dead (its PR is merged), and never\n * because a caller said so. That is what keeps \"never remove a tree still holding unmerged work\" true\n * even if the parent is wrong, out of date, or someone runs this by hand.\n *\n * The primary clone can never be a target: `classifyWorktrees` drops the main worktree from the\n * verdicts outright, so a path pointing at it simply does not resolve to a target — and WorktreeReaper\n * refuses it a second time by name. Neither rail is load-bearing alone.\n */\n@injectable(bindingScopeValues.Singleton)\nexport class ReapWorktreeCommand {\n    constructor(\n        private readonly repoRootFinder: RepoRootFinder,\n        private readonly worktreeSection: WorktreeCleanupSection,\n        private readonly signal: ReapOutcomeSignal,\n        private readonly worktrees: WorktreeService,\n    ) {}\n\n    /**\n     * Every exit from here states an OUTCOME, because the exit code cannot: refusals exit 0 (see\n     * `resolveTarget`), so a parent with only a status has no way to tell \"removed\" from \"declined to\n     * remove\". The token is the last thing written, and LandedWorktreeReaper strips it before printing.\n     */\n    async run(args: string[]): Promise<void> {\n        await Promise.resolve();\n        const request = this.parse(args);\n        const repoRoot = this.repoRootFinder.resolveRepoRoot(process.cwd());\n\n        const target = this.resolveTarget(repoRoot, request);\n        if (target === null) {\n            process.stdout.write(this.signal.line(REAP_OUTCOME_REFUSED));\n            return;\n        }\n\n        const retention = loadAndValidate(repoRoot).prGate.landPr.branchRetention;\n        const result = this.worktreeSection.reap(repoRoot, 'wp-land-pr', [target], retention);\n        process.stdout.write(this.render(repoRoot, result));\n        process.stdout.write(this.signal.line(this.outcomeOf(result)));\n    }\n\n    /**\n     * `reaped` is the only entry that means the DIRECTORY is gone. A tree that reached the reaper and\n     * came back in neither list was spared by one of WorktreeReaper's own rails (it is the cwd, it is\n     * the primary clone) — nothing was attempted, which is a refusal, not a failure.\n     */\n    private outcomeOf(result: WorktreeReapResult): string {\n        if (result.reaped.length > 0) return REAP_OUTCOME_REMOVED;\n        return result.failed.length > 0 ? REAP_OUTCOME_FAILED : REAP_OUTCOME_REFUSED;\n    }\n\n    /**\n     * The verdict for the requested path, or null after printing WHY it is not reapable. Refusals are\n     * printed rather than thrown: the PR they follow is already merged, and exiting non-zero after a\n     * successful landing would report a landed PR as a failed command. That is exactly why `run` also\n     * emits a ReapOutcomeSignal — the caller must be able to tell this exit 0 from a successful one.\n     */\n    private resolveTarget(repoRoot: string, request: ReapRequest): DeletableWorktree | null {\n        const wanted = path.resolve(request.worktreePath);\n        // `false`: this reaps ONE named worktree after its PR landed, and it is not the place to\n        // override anybody's lock — a lock still standing here is exactly the refusal this prints.\n        const target = this.worktreeSection.verdicts(repoRoot, false)\n            .find((tree: DeletableWorktree): boolean => path.resolve(tree.path) === wanted);\n\n        if (target === undefined) {\n            process.stdout.write(\n                `\\n   ℹ️  ${request.worktreePath} is not a removable worktree of this repo (it may be the\\n`\n                + '       primary clone, or already gone). Nothing removed.\\n');\n            return null;\n        }\n        // The branch moved under us between landing and reaping — somebody checked something else out\n        // there. Whatever that is, it is not the corpse we were asked to bury.\n        if (target.branch !== request.branch) {\n            process.stdout.write(\n                `\\n   ⚠️  ${request.worktreePath} now holds '${target.branch}', not '${request.branch}'.\\n`\n                + '       Refusing to remove a worktree whose branch changed since the PR landed.\\n');\n            return null;\n        }\n        // …and the NAME is not the identity. The parent selected this directory because its HEAD was the\n        // exact commit GitHub squashed; that selection is recomputed here from git rather than taken on\n        // trust, so a commit made in that tree between landing and reaping — work the archive tag of the\n        // squashed tip does not contain — stops the removal instead of being buried with it.\n        const here = this.headOf(repoRoot, wanted);\n        if (here !== request.head) {\n            process.stdout.write(\n                `\\n   ⚠️  ${request.worktreePath} is at ${here === '' ? '(unknown)' : here}, not the landed\\n`\n                + `       commit ${request.head}.\\n`\n                + '       Refusing to remove a worktree whose HEAD moved since the PR landed.\\n');\n            return null;\n        }\n        if (!target.deletable) {\n            process.stdout.write(\n                `\\n   ⚠️  ${request.worktreePath} is not provably dead: ${target.reason}\\n`\n                + '       Refusing to remove a worktree that may still hold unmerged work.\\n');\n            return null;\n        }\n        return target;\n    }\n\n    /**\n     * That worktree's HEAD as git reports it right now, '' when git cannot place the path at all.\n     * '' can never equal a real sha, so \"git would not answer\" fails SAFE — it declines the removal.\n     */\n    private headOf(repoRoot: string, resolvedPath: string): string {\n        const tree = this.worktrees.listWorktrees(repoRoot)\n            .find((candidate: Worktree): boolean => path.resolve(candidate.path) === resolvedPath);\n        return tree?.head ?? '';\n    }\n\n    // The reap report, plus the spared case — which report() renders as '' because from wp-cleanup's\n    // point of view \"nothing happened\" is a whole answer. Here it never is: we asked for exactly one.\n    private render(repoRoot: string, result: WorktreeReapResult): string {\n        if (result.reaped.length === 0 && result.failed.length === 0) {\n            let out = '\\n' + SEP + '🛑 Nothing removed\\n' + SEP + '\\n';\n            for (const tree of result.spared) out += `   · ${tree.path} — ${tree.reason}\\n`;\n            return out;\n        }\n        return this.worktreeSection.report(repoRoot, result);\n    }\n\n    /**\n     * `<worktree-path> <branch> <head-sha>`, all three required. The sha is not optional and has no\n     * default: a defaulted '' would mean \"do not check\", i.e. exactly the name-only removal both\n     * processes exist to refuse, so a caller that omits it must fail to run rather than run wider.\n     *\n     * Thrown rather than printed: bad argv means the caller is broken, and there is no landed PR in this\n     * process whose success a non-zero exit could misreport.\n     */\n    private parse(args: string[]): ReapRequest {\n        const worktreePath = args[0] ?? '';\n        const branch = args[1] ?? '';\n        const head = args[2] ?? '';\n        if (worktreePath === '' || branch === '' || head === '') {\n            throw new InformAiError(\n                '\\n' + SEP + '❌ wp-reap-worktree: missing arguments\\n' + SEP + '\\n'\n                + 'Usage: node wp-reap-worktree.js <worktree-path> <branch> <head-sha>\\n\\n'\n                + 'This is an INTERNAL entry point, spawned by `pnpm wp-land-pr` with cwd set to the\\n'\n                + 'primary clone. To clean up by hand, run `pnpm wp-cleanup` from the primary clone.\\n' + SEP);\n        }\n        return new ReapRequest(worktreePath, branch, head);\n    }\n}\n\n// Data-only (per CLAUDE.md, classes for data): the argv values this entry point takes.\nclass ReapRequest {\n    worktreePath: string;\n    branch: string;\n    /** The commit the parent proved this worktree was at — re-verified here, never trusted. */\n    head: string;\n\n    constructor(worktreePath: string, branch: string, head: string) {\n        this.worktreePath = worktreePath;\n        this.branch = branch;\n        this.head = head;\n    }\n}\n"]}

package/src/scripts/pr-gate-app.d.ts

@@ -5,7 +5,7 @@ import { FinishUpsertPrCommand } from './commands/finish-upsert-pr-command';
 import { CleanupCommand } from './commands/cleanup-command';
 import { CleanupOptions } from './commands/cleanup-options';
 import { CheckoutCleanMainCommand } from './commands/checkout-clean-main-command';
-import { LandPrCommand } from './commands/land-pr-command';
+import { LandPrCommand, LandPrRequest } from './commands/land-pr-command';
 import { CheckPrCommand } from './commands/check-pr-command';
 import { ReviewUpsertPrCommand, ReviewUpsertPrOptions } from './commands/review-upsert-pr-command';
 import { ReapWorktreeCommand } from './commands/reap-worktree-command';
@@ -82,8 +82,11 @@ export declare class PrGateApp {
      * rather than surviving beside this.
      */
     checkoutCleanMain(): Promise<void>;
-    /** `wp-land-pr`: squash-merge this branch's PR into main with the compact commit body. */
-    landPr(): Promise<void>;
+    /**
+     * `wp-land-pr`: squash-merge a PR into main with the compact commit body — this branch's by default,
+     * or the one `--pr <n>` names, which is how a coordinator finishes a gone agent's work.
+     */
+    landPr(request: LandPrRequest): Promise<void>;
     /**
      * `wp-review-upsert-pr`: STAGE ② — validate the 3-point merge, run the build gate, extract this
      * branch's diff, and brief the reviewer subagents. Unlike the report-only command it replaces, this CAN

package/src/scripts/pr-gate-app.js

@@ -133,10 +133,13 @@ let PrGateApp = class PrGateApp {
         this.assertNoResolveInProgress('wp-checkout-clean-main');
         return this.checkoutCleanMainCommand.run();
     }
-    /** `wp-land-pr`: squash-merge this branch's PR into main with the compact commit body. */
-    landPr() {
+    /**
+     * `wp-land-pr`: squash-merge a PR into main with the compact commit body — this branch's by default,
+     * or the one `--pr <n>` names, which is how a coordinator finishes a gone agent's work.
+     */
+    landPr(request) {
         this.assertNoResolveInProgress('wp-land-pr');
-        return this.landPrCommand.run();
+        return this.landPrCommand.run(request);
     }
     /**
      * `wp-review-upsert-pr`: STAGE ② — validate the 3-point merge, run the build gate, extract this

package/src/scripts/pr-gate-app.js.map

@@ -1 +1 @@
-{"version":3,"file":"pr-gate-app.js","sourceRoot":"","sources":["../../../../../../packages/tooling/pr-gate/src/scripts/pr-gate-app.ts"],"names":[],"mappings":";;;;AAAA,0DAAyD;AACzD,yCAA2D;AAC3D,0EAAqE;AACrE,4EAAuE;AACvE,gFAA0E;AAC1E,kFAA4E;AAC5E,gEAA4D;AAE5D,wFAAkF;AAClF,gEAA2D;AAC3D,kEAA6D;AAC7D,kFAAmG;AACnG,4EAAuE;AACvE,4DAAsE;AACtE,kEAA6E;AAC7E,gFAAgG;AAChG,8DAA8D;AAC9D,0DAAyD;AAEzD;;;;;GAKG;AAGI,IAAM,SAAS,GAAf,MAAM,SAAS;IAEG;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IAfrB,YACqB,kBAAsC,EACtC,mBAAwC,EACxC,oBAA0C,EAC1C,qBAA4C,EAC5C,cAA8B,EAC9B,wBAAkD,EAClD,aAA4B,EAC5B,cAA8B,EAC9B,qBAA4C,EAC5C,mBAAwC,EACxC,YAA0B,EAC1B,cAA8B,EAC9B,oBAA0C,EAC1C,iBAAoC,EACpC,cAA8B;QAd9B,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,wBAAmB,GAAnB,mBAAmB,CAAqB;QACxC,yBAAoB,GAApB,oBAAoB,CAAsB;QAC1C,0BAAqB,GAArB,qBAAqB,CAAuB;QAC5C,mBAAc,GAAd,cAAc,CAAgB;QAC9B,6BAAwB,GAAxB,wBAAwB,CAA0B;QAClD,kBAAa,GAAb,aAAa,CAAe;QAC5B,mBAAc,GAAd,cAAc,CAAgB;QAC9B,0BAAqB,GAArB,qBAAqB,CAAuB;QAC5C,wBAAmB,GAAnB,mBAAmB,CAAqB;QACxC,iBAAY,GAAZ,YAAY,CAAc;QAC1B,mBAAc,GAAd,cAAc,CAAgB;QAC9B,yBAAoB,GAApB,oBAAoB,CAAsB;QAC1C,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,mBAAc,GAAd,cAAc,CAAgB;IAChD,CAAC;IAEJ;;;;;;;OAOG;IACK,yBAAyB,CAAC,OAAe;QAC7C,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,sBAAsB,CAAC,OAAO,CAAC;YAAE,OAAO;QACpE,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IACnG,CAAC;IAED,+GAA+G;IAC/G,OAAO,CAAC,OAAuB,IAAI,iCAAc,EAAE;QAC/C,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IAED,mGAAmG;IACnG,aAAa,CAAC,OAA6B,IAAI,8CAAoB,EAAE;QACjE,OAAO,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/C,CAAC;IAED;;;;OAIG;IACH,YAAY,CAAC,IAAc;QACvB,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,IAAkB;QACpB,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IAED,kEAAkE;IAClE,WAAW;QACP,IAAI,CAAC,yBAAyB,CAAC,iBAAiB,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC;IACzC,CAAC;IAED,gFAAgF;IAChF,YAAY;QACR,IAAI,CAAC,yBAAyB,CAAC,kBAAkB,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,CAAC;IAC1C,CAAC;IAED,4GAA4G;IAC5G,aAAa;QACT,IAAI,CAAC,yBAAyB,CAAC,oBAAoB,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC,oBAAoB,CAAC,GAAG,EAAE,CAAC;IAC3C,CAAC;IAED,oGAAoG;IACpG,cAAc;QACV,IAAI,CAAC,yBAAyB,CAAC,qBAAqB,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,CAAC;IAC5C,CAAC;IAED;;;OAGG;IACH,OAAO,CAAC,OAAuB;QAC3B,IAAI,CAAC,yBAAyB,CAAC,YAAY,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;OAKG;IACH,iBAAiB;QACb,IAAI,CAAC,yBAAyB,CAAC,wBAAwB,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC,wBAAwB,CAAC,GAAG,EAAE,CAAC;IAC/C,CAAC;IAED,0FAA0F;IAC1F,MAAM;QACF,IAAI,CAAC,yBAAyB,CAAC,YAAY,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC;IACpC,CAAC;IAED;;;;OAIG;IACH,cAAc,CAAC,OAA8B,IAAI,gDAAqB,EAAE;QACpE,IAAI,CAAC,yBAAyB,CAAC,qBAAqB,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChD,CAAC;IAED,+GAA+G;IAC/G,OAAO;QACH,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC;IACrC,CAAC;CACJ,CAAA;AA5HY,8BAAS;oBAAT,SAAS;IAFrB,IAAA,6BAAc,GAAE;IAChB,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;6CAGI,yCAAkB;QACjB,2CAAmB;QAClB,8CAAoB;QACnB,gDAAqB;QAC5B,gCAAc;QACJ,sDAAwB;QACnC,+BAAa;QACZ,iCAAc;QACP,gDAAqB;QACvB,2CAAmB;QAC1B,4BAAY;QACV,iCAAc;QACR,8CAAoB;QACvB,kCAAiB;QACpB,6BAAc;GAhB1C,SAAS,CA4HrB","sourcesContent":["import { DocumentDesign } from '@webpieces/rules-config';\nimport { injectable, bindingScopeValues } from 'inversify';\nimport { StartUpdateCommand } from './commands/start-update-command';\nimport { FinishUpdateCommand } from './commands/finish-update-command';\nimport { StartUpsertPrCommand } from './commands/start-upsert-pr-command';\nimport { FinishUpsertPrCommand } from './commands/finish-upsert-pr-command';\nimport { CleanupCommand } from './commands/cleanup-command';\nimport { CleanupOptions } from './commands/cleanup-options';\nimport { CheckoutCleanMainCommand } from './commands/checkout-clean-main-command';\nimport { LandPrCommand } from './commands/land-pr-command';\nimport { CheckPrCommand } from './commands/check-pr-command';\nimport { ReviewUpsertPrCommand, ReviewUpsertPrOptions } from './commands/review-upsert-pr-command';\nimport { ReapWorktreeCommand } from './commands/reap-worktree-command';\nimport { BuildCommand, BuildOptions } from './commands/build-command';\nimport { PushDevCommand, PushDevOptions } from './commands/push-dev-command';\nimport { FinishPushDevCommand, FinishPushDevOptions } from './commands/finish-push-dev-command';\nimport { PushDevStateStore } from './workflow/push-dev-state';\nimport { RepoRootFinder } from '@webpieces/rules-config';\n\n/**\n * The pr-gate application root. `container.get(PrGateApp)` resolves the entire workflow DAG (the command\n * classes → the injected git/merge/dashboard services). `@DocumentDesign` marks it the\n * top-of-DAG the DI-design analyzer roots on, so `role:app` pr-gate draws its design. Each `bin/*`\n * entry resolves THIS and calls the matching command method.\n */\n@DocumentDesign()\n@injectable(bindingScopeValues.Singleton)\nexport class PrGateApp {\n    constructor(\n        private readonly startUpdateCommand: StartUpdateCommand,\n        private readonly finishUpdateCommand: FinishUpdateCommand,\n        private readonly startUpsertPrCommand: StartUpsertPrCommand,\n        private readonly finishUpsertPrCommand: FinishUpsertPrCommand,\n        private readonly cleanupCommand: CleanupCommand,\n        private readonly checkoutCleanMainCommand: CheckoutCleanMainCommand,\n        private readonly landPrCommand: LandPrCommand,\n        private readonly checkPrCommand: CheckPrCommand,\n        private readonly reviewUpsertPrCommand: ReviewUpsertPrCommand,\n        private readonly reapWorktreeCommand: ReapWorktreeCommand,\n        private readonly buildCommand: BuildCommand,\n        private readonly pushDevCommand: PushDevCommand,\n        private readonly finishPushDevCommand: FinishPushDevCommand,\n        private readonly pushDevStateStore: PushDevStateStore,\n        private readonly repoRootFinder: RepoRootFinder,\n    ) {}\n\n    /**\n     * Refuse `command` while a `wp-push-dev --resolve` is half-finished.\n     *\n     * Enforced HERE, at the one place every bin funnels through, rather than in each command: a resolve\n     * parks the checkout on a throwaway branch, so every command below would act on a branch that is not\n     * the one it thinks it is. Putting the check in nine constructors is nine chances to forget it in the\n     * tenth. PushDevStateStore owns the blocked list AND renders the hint from it, so the two cannot drift.\n     */\n    private assertNoResolveInProgress(command: string): void {\n        if (!this.pushDevStateStore.isBlockedDuringResolve(command)) return;\n        this.pushDevStateStore.assertIdle(this.repoRootFinder.resolveRepoRoot(process.cwd()), command);\n    }\n\n    /** `wp-push-dev`: publish a DISPOSABLE copy of this branch for the shared dev environment. No PR, no build. */\n    pushDev(opts: PushDevOptions = new PushDevOptions()): Promise<void> {\n        return this.pushDevCommand.run(opts);\n    }\n\n    /** `wp-finish-push-dev`: commit a resolved dev composition and publish it (conflict path only). */\n    finishPushDev(opts: FinishPushDevOptions = new FinishPushDevOptions()): Promise<void> {\n        return this.finishPushDevCommand.run(opts);\n    }\n\n    /**\n     * INTERNAL (`wp-reap-worktree.js`, no `bin` entry): remove ONE named worktree and its branch.\n     * `wp-land-pr` spawns it with cwd = the primary clone so the tree it just landed from can be\n     * reaped by a process that is not standing in it.\n     */\n    reapWorktree(args: string[]): Promise<void> {\n        return this.reapWorktreeCommand.run(args);\n    }\n\n    /**\n     * `wp-build`: run this repo's ONE configured build (`commands.pr-gate.buildCommand`) — the same\n     * command, resolved by the same resolver, that the PR gate's build stage runs. Not blocked during a\n     * `wp-push-dev --resolve`: it mutates nothing and reads no branch state.\n     */\n    build(opts: BuildOptions): Promise<void> {\n        return this.buildCommand.run(opts);\n    }\n\n    /** `wp-start-update`: 3-point squash-update from main (no PR). */\n    startUpdate(): Promise<void> {\n        this.assertNoResolveInProgress('wp-start-update');\n        return this.startUpdateCommand.run();\n    }\n\n    /** `wp-finish-update`: validate + finalize a resolved 3-point merge (no PR). */\n    finishUpdate(): Promise<void> {\n        this.assertNoResolveInProgress('wp-finish-update');\n        return this.finishUpdateCommand.run();\n    }\n\n    /** `wp-start-upsert-pr`: update from main (3-point merge), hand off review.json. No build gate, no push. */\n    startUpsertPr(): Promise<void> {\n        this.assertNoResolveInProgress('wp-start-upsert-pr');\n        return this.startUpsertPrCommand.run();\n    }\n\n    /** `wp-finish-upsert-pr`: finalize merge, authoritative build gate, dashboard, create/update PR. */\n    finishUpsertPr(): Promise<void> {\n        this.assertNoResolveInProgress('wp-finish-upsert-pr');\n        return this.finishUpsertPrCommand.run();\n    }\n\n    /**\n     * `wp-cleanup`: reap what is provably merged AND every zero-commit husk, then report the rest with\n     * the exact flags that take it. `options` carries what argv said — see CleanupOptions.\n     */\n    cleanup(options: CleanupOptions): Promise<void> {\n        this.assertNoResolveInProgress('wp-cleanup');\n        return this.cleanupCommand.run(options);\n    }\n\n    /**\n     * `wp-checkout-clean-main`: go to main, fast-forward it, reap dead worktrees and branches, and sweep\n     * the orphan directories a project move leaves behind. Replaces `git checkout main && git pull\n     * origin main` outright — see CheckoutCleanMainCommand for why the old pair must stop being accepted\n     * rather than surviving beside this.\n     */\n    checkoutCleanMain(): Promise<void> {\n        this.assertNoResolveInProgress('wp-checkout-clean-main');\n        return this.checkoutCleanMainCommand.run();\n    }\n\n    /** `wp-land-pr`: squash-merge this branch's PR into main with the compact commit body. */\n    landPr(): Promise<void> {\n        this.assertNoResolveInProgress('wp-land-pr');\n        return this.landPrCommand.run();\n    }\n\n    /**\n     * `wp-review-upsert-pr`: STAGE ② — validate the 3-point merge, run the build gate, extract this\n     * branch's diff, and brief the reviewer subagents. Unlike the report-only command it replaces, this CAN\n     * fail — before any reviewer is spawned, so a broken branch costs no reviewer tokens.\n     */\n    reviewUpsertPr(opts: ReviewUpsertPrOptions = new ReviewUpsertPrOptions()): Promise<void> {\n        this.assertNoResolveInProgress('wp-review-upsert-pr');\n        return this.reviewUpsertPrCommand.run(opts);\n    }\n\n    /** `wp-check-pr`: READ-ONLY CI check — verify the PR body carries a valid HMAC gate token for its head sha. */\n    checkPr(): Promise<void> {\n        return this.checkPrCommand.run();\n    }\n}\n"]}
+{"version":3,"file":"pr-gate-app.js","sourceRoot":"","sources":["../../../../../../packages/tooling/pr-gate/src/scripts/pr-gate-app.ts"],"names":[],"mappings":";;;;AAAA,0DAAyD;AACzD,yCAA2D;AAC3D,0EAAqE;AACrE,4EAAuE;AACvE,gFAA0E;AAC1E,kFAA4E;AAC5E,gEAA4D;AAE5D,wFAAkF;AAClF,gEAA0E;AAC1E,kEAA6D;AAC7D,kFAAmG;AACnG,4EAAuE;AACvE,4DAAsE;AACtE,kEAA6E;AAC7E,gFAAgG;AAChG,8DAA8D;AAC9D,0DAAyD;AAEzD;;;;;GAKG;AAGI,IAAM,SAAS,GAAf,MAAM,SAAS;IAEG;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IAfrB,YACqB,kBAAsC,EACtC,mBAAwC,EACxC,oBAA0C,EAC1C,qBAA4C,EAC5C,cAA8B,EAC9B,wBAAkD,EAClD,aAA4B,EAC5B,cAA8B,EAC9B,qBAA4C,EAC5C,mBAAwC,EACxC,YAA0B,EAC1B,cAA8B,EAC9B,oBAA0C,EAC1C,iBAAoC,EACpC,cAA8B;QAd9B,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,wBAAmB,GAAnB,mBAAmB,CAAqB;QACxC,yBAAoB,GAApB,oBAAoB,CAAsB;QAC1C,0BAAqB,GAArB,qBAAqB,CAAuB;QAC5C,mBAAc,GAAd,cAAc,CAAgB;QAC9B,6BAAwB,GAAxB,wBAAwB,CAA0B;QAClD,kBAAa,GAAb,aAAa,CAAe;QAC5B,mBAAc,GAAd,cAAc,CAAgB;QAC9B,0BAAqB,GAArB,qBAAqB,CAAuB;QAC5C,wBAAmB,GAAnB,mBAAmB,CAAqB;QACxC,iBAAY,GAAZ,YAAY,CAAc;QAC1B,mBAAc,GAAd,cAAc,CAAgB;QAC9B,yBAAoB,GAApB,oBAAoB,CAAsB;QAC1C,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,mBAAc,GAAd,cAAc,CAAgB;IAChD,CAAC;IAEJ;;;;;;;OAOG;IACK,yBAAyB,CAAC,OAAe;QAC7C,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,sBAAsB,CAAC,OAAO,CAAC;YAAE,OAAO;QACpE,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IACnG,CAAC;IAED,+GAA+G;IAC/G,OAAO,CAAC,OAAuB,IAAI,iCAAc,EAAE;QAC/C,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IAED,mGAAmG;IACnG,aAAa,CAAC,OAA6B,IAAI,8CAAoB,EAAE;QACjE,OAAO,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/C,CAAC;IAED;;;;OAIG;IACH,YAAY,CAAC,IAAc;QACvB,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,IAAkB;QACpB,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IAED,kEAAkE;IAClE,WAAW;QACP,IAAI,CAAC,yBAAyB,CAAC,iBAAiB,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC;IACzC,CAAC;IAED,gFAAgF;IAChF,YAAY;QACR,IAAI,CAAC,yBAAyB,CAAC,kBAAkB,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,CAAC;IAC1C,CAAC;IAED,4GAA4G;IAC5G,aAAa;QACT,IAAI,CAAC,yBAAyB,CAAC,oBAAoB,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC,oBAAoB,CAAC,GAAG,EAAE,CAAC;IAC3C,CAAC;IAED,oGAAoG;IACpG,cAAc;QACV,IAAI,CAAC,yBAAyB,CAAC,qBAAqB,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,CAAC;IAC5C,CAAC;IAED;;;OAGG;IACH,OAAO,CAAC,OAAuB;QAC3B,IAAI,CAAC,yBAAyB,CAAC,YAAY,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;OAKG;IACH,iBAAiB;QACb,IAAI,CAAC,yBAAyB,CAAC,wBAAwB,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC,wBAAwB,CAAC,GAAG,EAAE,CAAC;IAC/C,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,OAAsB;QACzB,IAAI,CAAC,yBAAyB,CAAC,YAAY,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED;;;;OAIG;IACH,cAAc,CAAC,OAA8B,IAAI,gDAAqB,EAAE;QACpE,IAAI,CAAC,yBAAyB,CAAC,qBAAqB,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChD,CAAC;IAED,+GAA+G;IAC/G,OAAO;QACH,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC;IACrC,CAAC;CACJ,CAAA;AA/HY,8BAAS;oBAAT,SAAS;IAFrB,IAAA,6BAAc,GAAE;IAChB,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;6CAGI,yCAAkB;QACjB,2CAAmB;QAClB,8CAAoB;QACnB,gDAAqB;QAC5B,gCAAc;QACJ,sDAAwB;QACnC,+BAAa;QACZ,iCAAc;QACP,gDAAqB;QACvB,2CAAmB;QAC1B,4BAAY;QACV,iCAAc;QACR,8CAAoB;QACvB,kCAAiB;QACpB,6BAAc;GAhB1C,SAAS,CA+HrB","sourcesContent":["import { DocumentDesign } from '@webpieces/rules-config';\nimport { injectable, bindingScopeValues } from 'inversify';\nimport { StartUpdateCommand } from './commands/start-update-command';\nimport { FinishUpdateCommand } from './commands/finish-update-command';\nimport { StartUpsertPrCommand } from './commands/start-upsert-pr-command';\nimport { FinishUpsertPrCommand } from './commands/finish-upsert-pr-command';\nimport { CleanupCommand } from './commands/cleanup-command';\nimport { CleanupOptions } from './commands/cleanup-options';\nimport { CheckoutCleanMainCommand } from './commands/checkout-clean-main-command';\nimport { LandPrCommand, LandPrRequest } from './commands/land-pr-command';\nimport { CheckPrCommand } from './commands/check-pr-command';\nimport { ReviewUpsertPrCommand, ReviewUpsertPrOptions } from './commands/review-upsert-pr-command';\nimport { ReapWorktreeCommand } from './commands/reap-worktree-command';\nimport { BuildCommand, BuildOptions } from './commands/build-command';\nimport { PushDevCommand, PushDevOptions } from './commands/push-dev-command';\nimport { FinishPushDevCommand, FinishPushDevOptions } from './commands/finish-push-dev-command';\nimport { PushDevStateStore } from './workflow/push-dev-state';\nimport { RepoRootFinder } from '@webpieces/rules-config';\n\n/**\n * The pr-gate application root. `container.get(PrGateApp)` resolves the entire workflow DAG (the command\n * classes → the injected git/merge/dashboard services). `@DocumentDesign` marks it the\n * top-of-DAG the DI-design analyzer roots on, so `role:app` pr-gate draws its design. Each `bin/*`\n * entry resolves THIS and calls the matching command method.\n */\n@DocumentDesign()\n@injectable(bindingScopeValues.Singleton)\nexport class PrGateApp {\n    constructor(\n        private readonly startUpdateCommand: StartUpdateCommand,\n        private readonly finishUpdateCommand: FinishUpdateCommand,\n        private readonly startUpsertPrCommand: StartUpsertPrCommand,\n        private readonly finishUpsertPrCommand: FinishUpsertPrCommand,\n        private readonly cleanupCommand: CleanupCommand,\n        private readonly checkoutCleanMainCommand: CheckoutCleanMainCommand,\n        private readonly landPrCommand: LandPrCommand,\n        private readonly checkPrCommand: CheckPrCommand,\n        private readonly reviewUpsertPrCommand: ReviewUpsertPrCommand,\n        private readonly reapWorktreeCommand: ReapWorktreeCommand,\n        private readonly buildCommand: BuildCommand,\n        private readonly pushDevCommand: PushDevCommand,\n        private readonly finishPushDevCommand: FinishPushDevCommand,\n        private readonly pushDevStateStore: PushDevStateStore,\n        private readonly repoRootFinder: RepoRootFinder,\n    ) {}\n\n    /**\n     * Refuse `command` while a `wp-push-dev --resolve` is half-finished.\n     *\n     * Enforced HERE, at the one place every bin funnels through, rather than in each command: a resolve\n     * parks the checkout on a throwaway branch, so every command below would act on a branch that is not\n     * the one it thinks it is. Putting the check in nine constructors is nine chances to forget it in the\n     * tenth. PushDevStateStore owns the blocked list AND renders the hint from it, so the two cannot drift.\n     */\n    private assertNoResolveInProgress(command: string): void {\n        if (!this.pushDevStateStore.isBlockedDuringResolve(command)) return;\n        this.pushDevStateStore.assertIdle(this.repoRootFinder.resolveRepoRoot(process.cwd()), command);\n    }\n\n    /** `wp-push-dev`: publish a DISPOSABLE copy of this branch for the shared dev environment. No PR, no build. */\n    pushDev(opts: PushDevOptions = new PushDevOptions()): Promise<void> {\n        return this.pushDevCommand.run(opts);\n    }\n\n    /** `wp-finish-push-dev`: commit a resolved dev composition and publish it (conflict path only). */\n    finishPushDev(opts: FinishPushDevOptions = new FinishPushDevOptions()): Promise<void> {\n        return this.finishPushDevCommand.run(opts);\n    }\n\n    /**\n     * INTERNAL (`wp-reap-worktree.js`, no `bin` entry): remove ONE named worktree and its branch.\n     * `wp-land-pr` spawns it with cwd = the primary clone so the tree it just landed from can be\n     * reaped by a process that is not standing in it.\n     */\n    reapWorktree(args: string[]): Promise<void> {\n        return this.reapWorktreeCommand.run(args);\n    }\n\n    /**\n     * `wp-build`: run this repo's ONE configured build (`commands.pr-gate.buildCommand`) — the same\n     * command, resolved by the same resolver, that the PR gate's build stage runs. Not blocked during a\n     * `wp-push-dev --resolve`: it mutates nothing and reads no branch state.\n     */\n    build(opts: BuildOptions): Promise<void> {\n        return this.buildCommand.run(opts);\n    }\n\n    /** `wp-start-update`: 3-point squash-update from main (no PR). */\n    startUpdate(): Promise<void> {\n        this.assertNoResolveInProgress('wp-start-update');\n        return this.startUpdateCommand.run();\n    }\n\n    /** `wp-finish-update`: validate + finalize a resolved 3-point merge (no PR). */\n    finishUpdate(): Promise<void> {\n        this.assertNoResolveInProgress('wp-finish-update');\n        return this.finishUpdateCommand.run();\n    }\n\n    /** `wp-start-upsert-pr`: update from main (3-point merge), hand off review.json. No build gate, no push. */\n    startUpsertPr(): Promise<void> {\n        this.assertNoResolveInProgress('wp-start-upsert-pr');\n        return this.startUpsertPrCommand.run();\n    }\n\n    /** `wp-finish-upsert-pr`: finalize merge, authoritative build gate, dashboard, create/update PR. */\n    finishUpsertPr(): Promise<void> {\n        this.assertNoResolveInProgress('wp-finish-upsert-pr');\n        return this.finishUpsertPrCommand.run();\n    }\n\n    /**\n     * `wp-cleanup`: reap what is provably merged AND every zero-commit husk, then report the rest with\n     * the exact flags that take it. `options` carries what argv said — see CleanupOptions.\n     */\n    cleanup(options: CleanupOptions): Promise<void> {\n        this.assertNoResolveInProgress('wp-cleanup');\n        return this.cleanupCommand.run(options);\n    }\n\n    /**\n     * `wp-checkout-clean-main`: go to main, fast-forward it, reap dead worktrees and branches, and sweep\n     * the orphan directories a project move leaves behind. Replaces `git checkout main && git pull\n     * origin main` outright — see CheckoutCleanMainCommand for why the old pair must stop being accepted\n     * rather than surviving beside this.\n     */\n    checkoutCleanMain(): Promise<void> {\n        this.assertNoResolveInProgress('wp-checkout-clean-main');\n        return this.checkoutCleanMainCommand.run();\n    }\n\n    /**\n     * `wp-land-pr`: squash-merge a PR into main with the compact commit body — this branch's by default,\n     * or the one `--pr <n>` names, which is how a coordinator finishes a gone agent's work.\n     */\n    landPr(request: LandPrRequest): Promise<void> {\n        this.assertNoResolveInProgress('wp-land-pr');\n        return this.landPrCommand.run(request);\n    }\n\n    /**\n     * `wp-review-upsert-pr`: STAGE ② — validate the 3-point merge, run the build gate, extract this\n     * branch's diff, and brief the reviewer subagents. Unlike the report-only command it replaces, this CAN\n     * fail — before any reviewer is spawned, so a broken branch costs no reviewer tokens.\n     */\n    reviewUpsertPr(opts: ReviewUpsertPrOptions = new ReviewUpsertPrOptions()): Promise<void> {\n        this.assertNoResolveInProgress('wp-review-upsert-pr');\n        return this.reviewUpsertPrCommand.run(opts);\n    }\n\n    /** `wp-check-pr`: READ-ONLY CI check — verify the PR body carries a valid HMAC gate token for its head sha. */\n    checkPr(): Promise<void> {\n        return this.checkPrCommand.run();\n    }\n}\n"]}

package/src/scripts/workflow/landed-tree-resolver.d.ts

@@ -0,0 +1,75 @@
+import { Worktree, WorktreeService } from '@webpieces/rules-config';
+/**
+ * WHICH LOCAL TREE HOLDS THE COMMIT GITHUB JUST SQUASHED — asked as a fact, answered from anywhere.
+ *
+ * `wp-land-pr` does two things with different scopes: the MERGE belongs to the PR and is reachable from
+ * any directory, while the BOOKKEEPING (archive the pre-squash tip, promote merge-info, reap the landed
+ * worktree) belongs to the tree that really holds those objects. Until now the second half was resolved
+ * from `process.cwd()` — and `pnpm` hoists a bin's cwd to the workspace root, so a command run inside
+ * `<primary>/.claude/worktrees/agent-<id>` executed in the PRIMARY CLONE. Every agent worktree is nested
+ * like that, so the answer was wrong in exactly the case the mechanism was built for.
+ *
+ * The fix is to stop asking "where am I" and start asking "where is it". Both halves of that question are
+ * facts nobody has to record:
+ *
+ *   `gh pr view <n> --json headRefName,headRefOid`  →  the branch, and the exact commit being squashed
+ *   `git worktree list --porcelain`                 →  every (path, branch, HEAD sha) in this repo
+ *
+ * The worktree list lives in the COMMON dir, so it reads identically from the primary clone, from any
+ * linked worktree, and from a coordinator that never saw the agent that built the branch. That is what
+ * makes `wp-land-pr --pr <n>` able to finish a dead agent's work.
+ *
+ * ─── WHY THE PAIR, AND NEVER THE NAME ALONE ───────────────────────────────────────────────────────
+ * A branch NAME does not identify a tree. A second clone, or a worktree somebody has since committed to,
+ * holds the same name at a different commit, and archiving `archive/<date>/<branch>` from there tags the
+ * wrong objects under the right name. So the selection key is `(headRefName, headRefOid)` together, and a
+ * name-only match is never enough to remove or archive anything — in this process or in the child that
+ * re-verifies it (see ReapWorktreeCommand).
+ *
+ * ─── WHY NOT A `.webpieces/**` RECEIPT ────────────────────────────────────────────────────────────
+ * The obvious alternative is for `wp-finish-upsert-pr` to write `{ pr, branch, worktreePath, headRefOid }`
+ * to a sidecar and for landing to read it back. `decisions/0005-the-pr-description-is-the-merge-body.md`
+ * already deleted that pattern once: a recorded claim can only ever be missing, stale, or on the wrong
+ * computer — and a worktree PATH is more volatile than the commit body that argument was made about,
+ * since the directory is moved, reaped, or recreated under a new agent id between finish and land.
+ * `(headRefOid, git worktree list)` is a pair of facts, needs no stored state, and works from a fresh
+ * clone. Nothing here reads state.
+ */
+/** A linked worktree holds the branch AT the squashed commit: archive here, and reap THAT directory. */
+export declare const LANDED_TREE_WORKTREE = "worktree";
+/** No worktree holds it, but the branch ref in this repo IS the squashed commit: archive, nothing to reap. */
+export declare const LANDED_TREE_BRANCH_ONLY = "branch-only";
+/** The name is here, the commit is not. Merge stands; bookkeeping is declined out loud. */
+export declare const LANDED_TREE_WRONG_TIP = "wrong-tip";
+/** The branch is not in this repo at all — landed from a tree that does not hold it. */
+export declare const LANDED_TREE_ABSENT = "absent";
+/**
+ * Data-only (per CLAUDE.md, classes for data). Where the landed commit lives locally, and therefore
+ * whether the bookkeeping half may run at all.
+ *
+ * `bookkeepingAllowed` is PRECOMPUTED rather than re-derived by the caller, for the same reason
+ * `EffectiveTree.redirected` and `WorktreeReapHandoff.canReap` are: a deletion rule spelled out twice is
+ * a deletion rule that eventually disagrees with itself.
+ */
+export declare class LandedTree {
+    readonly kind: string;
+    /** The linked worktree to reap — non-null ONLY for {@link LANDED_TREE_WORKTREE}. */
+    readonly worktree: Worktree | null;
+    /** The sha found locally under that branch name, '' when the branch is absent. Printed on a mismatch. */
+    readonly localSha: string;
+    readonly bookkeepingAllowed: boolean;
+    constructor(kind: string, worktree: Worktree | null, localSha: string);
+}
+export declare class LandedTreeResolver {
+    private readonly worktrees;
+    constructor(worktrees: WorktreeService);
+    /**
+     * The four-row table this whole design exists to implement, in order of what it can prove.
+     *
+     * `headRefOid === ''` means `gh` did not tell us which commit it is squashing. That cannot be turned
+     * into a mismatch — a fact we do not have is not evidence of disagreement — so the local tip is taken
+     * as the landed one, which is exactly what the old `ref.headRefOid !== ''` guard did.
+     */
+    resolve(repoRoot: string, branch: string, headRefOid: string): LandedTree;
+    private revParse;
+}

package/src/scripts/workflow/landed-tree-resolver.js

@@ -0,0 +1,112 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LandedTreeResolver = exports.LandedTree = exports.LANDED_TREE_ABSENT = exports.LANDED_TREE_WRONG_TIP = exports.LANDED_TREE_BRANCH_ONLY = exports.LANDED_TREE_WORKTREE = void 0;
+const tslib_1 = require("tslib");
+const child_process_1 = require("child_process");
+const rules_config_1 = require("@webpieces/rules-config");
+const inversify_1 = require("inversify");
+/**
+ * WHICH LOCAL TREE HOLDS THE COMMIT GITHUB JUST SQUASHED — asked as a fact, answered from anywhere.
+ *
+ * `wp-land-pr` does two things with different scopes: the MERGE belongs to the PR and is reachable from
+ * any directory, while the BOOKKEEPING (archive the pre-squash tip, promote merge-info, reap the landed
+ * worktree) belongs to the tree that really holds those objects. Until now the second half was resolved
+ * from `process.cwd()` — and `pnpm` hoists a bin's cwd to the workspace root, so a command run inside
+ * `<primary>/.claude/worktrees/agent-<id>` executed in the PRIMARY CLONE. Every agent worktree is nested
+ * like that, so the answer was wrong in exactly the case the mechanism was built for.
+ *
+ * The fix is to stop asking "where am I" and start asking "where is it". Both halves of that question are
+ * facts nobody has to record:
+ *
+ *   `gh pr view <n> --json headRefName,headRefOid`  →  the branch, and the exact commit being squashed
+ *   `git worktree list --porcelain`                 →  every (path, branch, HEAD sha) in this repo
+ *
+ * The worktree list lives in the COMMON dir, so it reads identically from the primary clone, from any
+ * linked worktree, and from a coordinator that never saw the agent that built the branch. That is what
+ * makes `wp-land-pr --pr <n>` able to finish a dead agent's work.
+ *
+ * ─── WHY THE PAIR, AND NEVER THE NAME ALONE ───────────────────────────────────────────────────────
+ * A branch NAME does not identify a tree. A second clone, or a worktree somebody has since committed to,
+ * holds the same name at a different commit, and archiving `archive/<date>/<branch>` from there tags the
+ * wrong objects under the right name. So the selection key is `(headRefName, headRefOid)` together, and a
+ * name-only match is never enough to remove or archive anything — in this process or in the child that
+ * re-verifies it (see ReapWorktreeCommand).
+ *
+ * ─── WHY NOT A `.webpieces/**` RECEIPT ────────────────────────────────────────────────────────────
+ * The obvious alternative is for `wp-finish-upsert-pr` to write `{ pr, branch, worktreePath, headRefOid }`
+ * to a sidecar and for landing to read it back. `decisions/0005-the-pr-description-is-the-merge-body.md`
+ * already deleted that pattern once: a recorded claim can only ever be missing, stale, or on the wrong
+ * computer — and a worktree PATH is more volatile than the commit body that argument was made about,
+ * since the directory is moved, reaped, or recreated under a new agent id between finish and land.
+ * `(headRefOid, git worktree list)` is a pair of facts, needs no stored state, and works from a fresh
+ * clone. Nothing here reads state.
+ */
+/** A linked worktree holds the branch AT the squashed commit: archive here, and reap THAT directory. */
+exports.LANDED_TREE_WORKTREE = 'worktree';
+/** No worktree holds it, but the branch ref in this repo IS the squashed commit: archive, nothing to reap. */
+exports.LANDED_TREE_BRANCH_ONLY = 'branch-only';
+/** The name is here, the commit is not. Merge stands; bookkeeping is declined out loud. */
+exports.LANDED_TREE_WRONG_TIP = 'wrong-tip';
+/** The branch is not in this repo at all — landed from a tree that does not hold it. */
+exports.LANDED_TREE_ABSENT = 'absent';
+/**
+ * Data-only (per CLAUDE.md, classes for data). Where the landed commit lives locally, and therefore
+ * whether the bookkeeping half may run at all.
+ *
+ * `bookkeepingAllowed` is PRECOMPUTED rather than re-derived by the caller, for the same reason
+ * `EffectiveTree.redirected` and `WorktreeReapHandoff.canReap` are: a deletion rule spelled out twice is
+ * a deletion rule that eventually disagrees with itself.
+ */
+class LandedTree {
+    kind;
+    /** The linked worktree to reap — non-null ONLY for {@link LANDED_TREE_WORKTREE}. */
+    worktree;
+    /** The sha found locally under that branch name, '' when the branch is absent. Printed on a mismatch. */
+    localSha;
+    bookkeepingAllowed;
+    constructor(kind, worktree, localSha) {
+        this.kind = kind;
+        this.worktree = worktree;
+        this.localSha = localSha;
+        this.bookkeepingAllowed = kind === exports.LANDED_TREE_WORKTREE || kind === exports.LANDED_TREE_BRANCH_ONLY;
+    }
+}
+exports.LandedTree = LandedTree;
+let LandedTreeResolver = class LandedTreeResolver {
+    worktrees;
+    constructor(worktrees) {
+        this.worktrees = worktrees;
+    }
+    /**
+     * The four-row table this whole design exists to implement, in order of what it can prove.
+     *
+     * `headRefOid === ''` means `gh` did not tell us which commit it is squashing. That cannot be turned
+     * into a mismatch — a fact we do not have is not evidence of disagreement — so the local tip is taken
+     * as the landed one, which is exactly what the old `ref.headRefOid !== ''` guard did.
+     */
+    resolve(repoRoot, branch, headRefOid) {
+        // Only LINKED worktrees are reapable; the primary clone is the thing reaped FROM, never a target.
+        const holder = this.worktrees.linkedWorktrees(repoRoot)
+            .find((tree) => tree.branch === branch) ?? null;
+        const local = holder !== null ? holder.head : this.revParse(repoRoot, branch);
+        if (local === '')
+            return new LandedTree(exports.LANDED_TREE_ABSENT, null, '');
+        if (headRefOid !== '' && local !== headRefOid) {
+            return new LandedTree(exports.LANDED_TREE_WRONG_TIP, null, local);
+        }
+        return holder !== null
+            ? new LandedTree(exports.LANDED_TREE_WORKTREE, holder, local)
+            : new LandedTree(exports.LANDED_TREE_BRANCH_ONLY, null, local);
+    }
+    // Best-effort sha of a ref — '' when it cannot resolve, which reads as "the branch is not here".
+    revParse(repoRoot, ref) {
+        const result = (0, child_process_1.spawnSync)('git', ['rev-parse', ref], { cwd: repoRoot, encoding: 'utf8' });
+        return result.status === 0 ? (result.stdout ?? '').trim() : '';
+    }
+};
+exports.LandedTreeResolver = LandedTreeResolver;
+exports.LandedTreeResolver = LandedTreeResolver = tslib_1.__decorate([
+    (0, inversify_1.injectable)(inversify_1.bindingScopeValues.Singleton),
+    tslib_1.__metadata("design:paramtypes", [rules_config_1.WorktreeService])
+], LandedTreeResolver);
+//# sourceMappingURL=landed-tree-resolver.js.map

package/src/scripts/workflow/landed-tree-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"landed-tree-resolver.js","sourceRoot":"","sources":["../../../../../../../packages/tooling/pr-gate/src/scripts/workflow/landed-tree-resolver.ts"],"names":[],"mappings":";;;;AAAA,iDAA0C;AAC1C,0DAAoE;AACpE,yCAA2D;AAE3D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,wGAAwG;AAC3F,QAAA,oBAAoB,GAAG,UAAU,CAAC;AAC/C,8GAA8G;AACjG,QAAA,uBAAuB,GAAG,aAAa,CAAC;AACrD,2FAA2F;AAC9E,QAAA,qBAAqB,GAAG,WAAW,CAAC;AACjD,wFAAwF;AAC3E,QAAA,kBAAkB,GAAG,QAAQ,CAAC;AAE3C;;;;;;;GAOG;AACH,MAAa,UAAU;IACV,IAAI,CAAS;IACtB,oFAAoF;IAC3E,QAAQ,CAAkB;IACnC,yGAAyG;IAChG,QAAQ,CAAS;IACjB,kBAAkB,CAAU;IAErC,YAAY,IAAY,EAAE,QAAyB,EAAE,QAAgB;QACjE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,kBAAkB,GAAG,IAAI,KAAK,4BAAoB,IAAI,IAAI,KAAK,+BAAuB,CAAC;IAChG,CAAC;CACJ;AAdD,gCAcC;AAGM,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IACE;IAA7B,YAA6B,SAA0B;QAA1B,cAAS,GAAT,SAAS,CAAiB;IAAG,CAAC;IAE3D;;;;;;OAMG;IACH,OAAO,CAAC,QAAgB,EAAE,MAAc,EAAE,UAAkB;QACxD,kGAAkG;QAClG,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,QAAQ,CAAC;aAClD,IAAI,CAAC,CAAC,IAAc,EAAW,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC;QACvE,MAAM,KAAK,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAE9E,IAAI,KAAK,KAAK,EAAE;YAAE,OAAO,IAAI,UAAU,CAAC,0BAAkB,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QACtE,IAAI,UAAU,KAAK,EAAE,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;YAC5C,OAAO,IAAI,UAAU,CAAC,6BAAqB,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,MAAM,KAAK,IAAI;YAClB,CAAC,CAAC,IAAI,UAAU,CAAC,4BAAoB,EAAE,MAAM,EAAE,KAAK,CAAC;YACrD,CAAC,CAAC,IAAI,UAAU,CAAC,+BAAuB,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/D,CAAC;IAED,iGAAiG;IACzF,QAAQ,CAAC,QAAgB,EAAE,GAAW;QAC1C,MAAM,MAAM,GAAG,IAAA,yBAAS,EAAC,KAAK,EAAE,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACzF,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,CAAC;CACJ,CAAA;AA9BY,gDAAkB;6BAAlB,kBAAkB;IAD9B,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;6CAEG,8BAAe;GAD9C,kBAAkB,CA8B9B","sourcesContent":["import { spawnSync } from 'child_process';\nimport { Worktree, WorktreeService } from '@webpieces/rules-config';\nimport { injectable, bindingScopeValues } from 'inversify';\n\n/**\n * WHICH LOCAL TREE HOLDS THE COMMIT GITHUB JUST SQUASHED — asked as a fact, answered from anywhere.\n *\n * `wp-land-pr` does two things with different scopes: the MERGE belongs to the PR and is reachable from\n * any directory, while the BOOKKEEPING (archive the pre-squash tip, promote merge-info, reap the landed\n * worktree) belongs to the tree that really holds those objects. Until now the second half was resolved\n * from `process.cwd()` — and `pnpm` hoists a bin's cwd to the workspace root, so a command run inside\n * `<primary>/.claude/worktrees/agent-<id>` executed in the PRIMARY CLONE. Every agent worktree is nested\n * like that, so the answer was wrong in exactly the case the mechanism was built for.\n *\n * The fix is to stop asking \"where am I\" and start asking \"where is it\". Both halves of that question are\n * facts nobody has to record:\n *\n *   `gh pr view <n> --json headRefName,headRefOid`  →  the branch, and the exact commit being squashed\n *   `git worktree list --porcelain`                 →  every (path, branch, HEAD sha) in this repo\n *\n * The worktree list lives in the COMMON dir, so it reads identically from the primary clone, from any\n * linked worktree, and from a coordinator that never saw the agent that built the branch. That is what\n * makes `wp-land-pr --pr <n>` able to finish a dead agent's work.\n *\n * ─── WHY THE PAIR, AND NEVER THE NAME ALONE ───────────────────────────────────────────────────────\n * A branch NAME does not identify a tree. A second clone, or a worktree somebody has since committed to,\n * holds the same name at a different commit, and archiving `archive/<date>/<branch>` from there tags the\n * wrong objects under the right name. So the selection key is `(headRefName, headRefOid)` together, and a\n * name-only match is never enough to remove or archive anything — in this process or in the child that\n * re-verifies it (see ReapWorktreeCommand).\n *\n * ─── WHY NOT A `.webpieces/**` RECEIPT ────────────────────────────────────────────────────────────\n * The obvious alternative is for `wp-finish-upsert-pr` to write `{ pr, branch, worktreePath, headRefOid }`\n * to a sidecar and for landing to read it back. `decisions/0005-the-pr-description-is-the-merge-body.md`\n * already deleted that pattern once: a recorded claim can only ever be missing, stale, or on the wrong\n * computer — and a worktree PATH is more volatile than the commit body that argument was made about,\n * since the directory is moved, reaped, or recreated under a new agent id between finish and land.\n * `(headRefOid, git worktree list)` is a pair of facts, needs no stored state, and works from a fresh\n * clone. Nothing here reads state.\n */\n\n/** A linked worktree holds the branch AT the squashed commit: archive here, and reap THAT directory. */\nexport const LANDED_TREE_WORKTREE = 'worktree';\n/** No worktree holds it, but the branch ref in this repo IS the squashed commit: archive, nothing to reap. */\nexport const LANDED_TREE_BRANCH_ONLY = 'branch-only';\n/** The name is here, the commit is not. Merge stands; bookkeeping is declined out loud. */\nexport const LANDED_TREE_WRONG_TIP = 'wrong-tip';\n/** The branch is not in this repo at all — landed from a tree that does not hold it. */\nexport const LANDED_TREE_ABSENT = 'absent';\n\n/**\n * Data-only (per CLAUDE.md, classes for data). Where the landed commit lives locally, and therefore\n * whether the bookkeeping half may run at all.\n *\n * `bookkeepingAllowed` is PRECOMPUTED rather than re-derived by the caller, for the same reason\n * `EffectiveTree.redirected` and `WorktreeReapHandoff.canReap` are: a deletion rule spelled out twice is\n * a deletion rule that eventually disagrees with itself.\n */\nexport class LandedTree {\n    readonly kind: string;\n    /** The linked worktree to reap — non-null ONLY for {@link LANDED_TREE_WORKTREE}. */\n    readonly worktree: Worktree | null;\n    /** The sha found locally under that branch name, '' when the branch is absent. Printed on a mismatch. */\n    readonly localSha: string;\n    readonly bookkeepingAllowed: boolean;\n\n    constructor(kind: string, worktree: Worktree | null, localSha: string) {\n        this.kind = kind;\n        this.worktree = worktree;\n        this.localSha = localSha;\n        this.bookkeepingAllowed = kind === LANDED_TREE_WORKTREE || kind === LANDED_TREE_BRANCH_ONLY;\n    }\n}\n\n@injectable(bindingScopeValues.Singleton)\nexport class LandedTreeResolver {\n    constructor(private readonly worktrees: WorktreeService) {}\n\n    /**\n     * The four-row table this whole design exists to implement, in order of what it can prove.\n     *\n     * `headRefOid === ''` means `gh` did not tell us which commit it is squashing. That cannot be turned\n     * into a mismatch — a fact we do not have is not evidence of disagreement — so the local tip is taken\n     * as the landed one, which is exactly what the old `ref.headRefOid !== ''` guard did.\n     */\n    resolve(repoRoot: string, branch: string, headRefOid: string): LandedTree {\n        // Only LINKED worktrees are reapable; the primary clone is the thing reaped FROM, never a target.\n        const holder = this.worktrees.linkedWorktrees(repoRoot)\n            .find((tree: Worktree): boolean => tree.branch === branch) ?? null;\n        const local = holder !== null ? holder.head : this.revParse(repoRoot, branch);\n\n        if (local === '') return new LandedTree(LANDED_TREE_ABSENT, null, '');\n        if (headRefOid !== '' && local !== headRefOid) {\n            return new LandedTree(LANDED_TREE_WRONG_TIP, null, local);\n        }\n        return holder !== null\n            ? new LandedTree(LANDED_TREE_WORKTREE, holder, local)\n            : new LandedTree(LANDED_TREE_BRANCH_ONLY, null, local);\n    }\n\n    // Best-effort sha of a ref — '' when it cannot resolve, which reads as \"the branch is not here\".\n    private revParse(repoRoot: string, ref: string): string {\n        const result = spawnSync('git', ['rev-parse', ref], { cwd: repoRoot, encoding: 'utf8' });\n        return result.status === 0 ? (result.stdout ?? '').trim() : '';\n    }\n}\n"]}

package/src/scripts/workflow/landed-worktree-reaper.d.ts

@@ -1,4 +1,4 @@
-import { WorktreeService } from '@webpieces/rules-config';
+import { Worktree, WorktreeService } from '@webpieces/rules-config';
 import { ReapOutcomeSignal } from './reap-outcome';
 /**
  * Data-only (per CLAUDE.md, classes for data). The decision about the just-landed worktree: which
@@ -8,15 +8,30 @@ export declare class WorktreeReapHandoff {
     /** The linked worktree holding the branch that was just landed. */
     readonly worktreePath: string;
     readonly branch: string;
+    /**
+     * That worktree's HEAD — which is, by construction, the exact commit GitHub squashed (see
+     * LandedTreeResolver). Carried so the child can re-verify the SELECTION rather than take a path on
+     * trust: a branch name is not an identity, and this is the half that makes it one.
+     */
+    readonly head: string;
     /** The primary clone — the child's `cwd`, and the directory a human must `cd` to afterwards. */
     readonly primaryPath: string;
     /** The compiled entry the child runs. '' when it could not be located on disk. */
     readonly entryScript: string;
     /** '' when the hand-off can run; otherwise the reason it cannot, in one human-readable clause. */
     readonly blockedBecause: string;
+    /**
+     * Is the OPERATOR'S OWN shell inside the directory about to be removed?
+     *
+     * True is the `/full-cycle` case (the agent lands its own PR from its own worktree) and it is the
+     * only case where "your cwd no longer exists" is a true sentence worth shouting. False is the
+     * coordinator case — `wp-land-pr --pr <n>` from the primary clone — where saying it would send a
+     * reader chasing a directory move they do not need to make.
+     */
+    readonly standingHere: boolean;
     /** Precomputed (as EffectiveTree does with `redirected`) so no caller re-derives the rule. */
     readonly canReap: boolean;
-    constructor(worktreePath: string, branch: string, primaryPath: string, entryScript: string, blockedBecause: string);
+    constructor(worktreePath: string, branch: string, head: string, primaryPath: string, entryScript: string, blockedBecause: string, standingHere: boolean);
 }
 export declare class LandedWorktreeReaper {
     private readonly worktrees;
@@ -25,12 +40,27 @@ export declare class LandedWorktreeReaper {
     /**
      * Is there a worktree to reap at all, and can the hand-off run?
      *
-     * `null` means "nothing to do here" — we are in the primary clone, or in a worktree that does not
-     * hold the branch that just landed. That is the ordinary `pnpm wp-cleanup` case and needs no
-     * special sentence. A non-null handoff with `canReap === false` means there IS a corpse but the
-     * re-exec is not safely achievable, which is the case that must keep the manual notice.
+     * IT IS TOLD WHICH TREE, AND NO LONGER LOOKS. This used to call `currentWorktree(repoRoot)` and reap
+     * only when the tree it was STANDING IN held the landed branch — which made the whole #512 mechanism
+     * dead code in the one case it was built for, because `pnpm` hoists a bin's cwd out of a nested
+     * `.claude/worktrees/**` worktree and into the primary clone, where `isMain` is true and this
+     * returned null. Worse, "the tree I am in" was never the right question: a coordinator landing a dead
+     * agent's PR is standing somewhere else entirely. LandedTreeResolver answers the right one — which
+     * tree's HEAD is the commit GitHub squashed — and hands the answer here.
+     *
+     * `null` means there is genuinely no worktree to reap: the branch lived only in the primary clone, or
+     * nowhere the sha agrees with. That is the ordinary `pnpm wp-cleanup` case and needs no special
+     * sentence. A non-null handoff with `canReap === false` means there IS a corpse but the re-exec is
+     * not safely achievable, which is the case that must keep the manual notice.
+     */
+    plan(repoRoot: string, landed: Worktree | null, invocationCwd: string): WorktreeReapHandoff | null;
+    /**
+     * Is `cwd` the worktree itself or somewhere beneath it? A path COMPARISON, not a git question:
+     * the operator may have been in a subdirectory when they ran the command, and that shell is just as
+     * dead once the tree goes. Both sides are resolved first so `.`/`..` and a trailing slash cannot
+     * turn a match into a miss.
      */
-    plan(repoRoot: string, landedBranch: string): WorktreeReapHandoff | null;
+    private isInside;
     /**
      * Run the reap in a child process rooted in the primary clone, and render what happened.
      *
@@ -57,9 +87,11 @@ export declare class LandedWorktreeReaper {
      */
     manualNotice(handoff: WorktreeReapHandoff): string;
     /**
-     * The one thing a human or agent MUST be told after a successful reap: the shell they typed this
-     * into is now sitting in a directory that no longer exists. Every relative path from here on is a
-     * mystery ENOENT unless they move.
+     * The one thing a human or agent MUST be told after a successful reap — but only when it is TRUE of
+     * them. Landing from inside the tree that just went (the `/full-cycle` case) leaves the shell in a
+     * deleted directory and every following relative path is a mystery ENOENT until they move. Landing a
+     * dead agent's PR from the primary clone removes somebody ELSE's directory, and telling that operator
+     * to `cd` somewhere sends them chasing a move they do not need to make.
      */
     private afterReap;
     /**