@webpieces/repo-workflow-core 0.0.1

package/src/main-sync-status.js

@@ -0,0 +1,555 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MainSyncStatusService = exports.MainSyncLock = exports.DEFAULT_HANG_TIMEOUT_MINUTES = exports.MAIN_SYNC_STATUS_VERSION = exports.PullRequestIndex = exports.MainSyncStatusFile = exports.MainSyncStatus = void 0;
+exports.mainSyncStatusPath = mainSyncStatusPath;
+exports.mainSyncLockPath = mainSyncLockPath;
+exports.readMainSyncStatus = readMainSyncStatus;
+exports.readMainSyncStatusFile = readMainSyncStatusFile;
+exports.writeMainSyncStatus = writeMainSyncStatus;
+exports.writeMainSyncStatusFile = writeMainSyncStatusFile;
+exports.readMainSyncLock = readMainSyncLock;
+exports.writeMainSyncLock = writeMainSyncLock;
+exports.isLockStale = isLockStale;
+exports.isRefreshInProgress = isRefreshInProgress;
+exports.tryAcquireMainSyncLock = tryAcquireMainSyncLock;
+exports.inProcessLock = inProcessLock;
+exports.finishedLock = finishedLock;
+exports.computeMainSyncStatus = computeMainSyncStatus;
+exports.computeAllMainSyncStatuses = computeAllMainSyncStatuses;
+exports.squashRecoverySteps = squashRecoverySteps;
+exports.stampCleanMainSyncStatus = stampCleanMainSyncStatus;
+const tslib_1 = require("tslib");
+const child_process_1 = require("child_process");
+const fs = tslib_1.__importStar(require("fs"));
+const path = tslib_1.__importStar(require("path"));
+const inversify_1 = require("inversify");
+const tooling_common_1 = require("@webpieces/tooling-common");
+const main_sync_file_1 = require("./main-sync-file");
+Object.defineProperty(exports, "MAIN_SYNC_STATUS_VERSION", { enumerable: true, get: function () { return main_sync_file_1.MAIN_SYNC_STATUS_VERSION; } });
+Object.defineProperty(exports, "MainSyncStatus", { enumerable: true, get: function () { return main_sync_file_1.MainSyncStatus; } });
+Object.defineProperty(exports, "MainSyncStatusFile", { enumerable: true, get: function () { return main_sync_file_1.MainSyncStatusFile; } });
+Object.defineProperty(exports, "PullRequestIndex", { enumerable: true, get: function () { return main_sync_file_1.PullRequestIndex; } });
+const tooling_common_2 = require("@webpieces/tooling-common");
+const to_error_1 = require("@webpieces/tooling-common/to-error");
+const worktrees_1 = require("./worktrees");
+// Shared "is my feature branch healthy relative to origin/main?" state. The SLOW signals (git fetch +
+// merge-base + same-file-overlap + a merged-PR lookup) are computed by the ai-hook-rules refresher in a
+// DETACHED background process; the feature-branch-guard only READS this cached file. pr-gate's merge
+// flow also writes it synchronously after a merge. Lives here (the shared dep of both).
+// How long an `inprocess` refresher lock may sit before a new refresher assumes the prior run hung.
+exports.DEFAULT_HANG_TIMEOUT_MINUTES = 5;
+const MAIN_SYNC_STATUS_FILE = 'main-sync-status.json';
+const MAIN_SYNC_LOCK_FILE = 'main-sync.lock.json';
+const LOCK_STATE_INPROCESS = 'inprocess';
+const LOCK_STATE_FINISHED = 'finished';
+// Concurrency state machine for the detached refresher. `started` is epoch ms. `pid` is the refresher
+// process's pid (0 = unknown) — used so a KILLED refresher doesn't wedge `inprocess` for the timeout.
+class MainSyncLock {
+    state;
+    started;
+    pid;
+    constructor(state, started, pid = 0) {
+        this.state = state;
+        this.started = started;
+        this.pid = pid;
+    }
+}
+exports.MainSyncLock = MainSyncLock;
+/**
+ * Reads/writes the main-sync cache + lock and computes the slow "is my branch healthy vs origin/main?"
+ * status. `@injectable(bindingScopeValues.Singleton)` so it's injectable and drawn in consumers’ DI designs.
+ */
+let MainSyncStatusService = class MainSyncStatusService {
+    dotDir;
+    atomicFile;
+    store;
+    worktrees;
+    constructor(dotDir = tooling_common_2.dotWebpieces, atomicFile = new tooling_common_1.AtomicFile(), store = new main_sync_file_1.MainSyncFileStore(atomicFile), worktrees = new worktrees_1.WorktreeService()) {
+        this.dotDir = dotDir;
+        this.atomicFile = atomicFile;
+        this.store = store;
+        this.worktrees = worktrees;
+    }
+    /**
+     * SHARED scope: `<primary>/.webpieces/main-sync-status.json`, one per repo.
+     *
+     * It is the OUTPUT of the single-flight refresher below, so it has to live where the lock lives —
+     * one `.git`, one `origin/main`, one fetch, one answer. A per-worktree copy under single-flight
+     * would only ever be written for whichever worktree won the lock anyway.
+     *
+     * FORMERLY a known defect, now fixed: the file's CONTENT used to be keyed to ONE branch, and every
+     * reader fails OPEN when the cached branch is not the branch being judged (`stale-cross-branch-cache
+     * (fail-open)`). With several worktrees on several branches, only the winner of the lock was ever
+     * described, so every other worktree's guards abstained — and which one was armed thrashed as the
+     * lock changed hands. The file is now a MAP of branch -> status (see MainSyncStatusFile): the single
+     * winning refresher enumerates every worktree and records all of their branches in one atomic write,
+     * so one fetch arms everyone. Single-flight is unchanged; only what the winner writes changed.
+     */
+    mainSyncStatusPath(repoRoot) {
+        return this.dotDir.sharedFile(repoRoot, MAIN_SYNC_STATUS_FILE);
+    }
+    /**
+     * SHARED scope — the single-flight lock for the whole repo.
+     *
+     * This is the fix for the filed bug "the detached main-sync refresher's `git fetch` races the
+     * agent's foreground `git fetch`/`git pull` and corrupts `.git/FETCH_HEAD`". The lock was already
+     * atomic (O_CREAT|O_EXCL) and already serialised refreshers against each other — but only WITHIN
+     * one worktree, so N worktrees meant N locks and up to N concurrent `git fetch`es against the ONE
+     * shared `.git`, which is exactly how a duplicate `for-merge` line lands in FETCH_HEAD. There is
+     * one `.git`, so there is now one lock: at most one refresher in flight across all worktrees.
+     *
+     * Stale-lock handling is unchanged and still required (a lock nobody can clear is worse than the
+     * race): the holder records pid + start epoch, and `tryAcquireMainSyncLock` reclaims it once
+     * `isRefreshInProgress` proves the holder is finished, hung past hangTimeoutMinutes, or dead.
+     */
+    mainSyncLockPath(repoRoot) {
+        return this.dotDir.sharedFile(repoRoot, MAIN_SYNC_LOCK_FILE);
+    }
+    /**
+     * The cached status FOR ONE BRANCH — the only read the four main-sync guards perform.
+     *
+     * `branch` is mandatory and is the branch being judged. A branch the last refresh never saw
+     * returns null, which every guard already treats as `no-sync-cache (fail-open)`, so an unknown
+     * branch degrades exactly as a missing file did. Any error (missing, truncated, malformed JSON)
+     * also returns null — this must never throw on the blocking path.
+     */
+    readMainSyncStatus(repoRoot, branch) {
+        return this.store.branchStatus(this.readMainSyncStatusFile(repoRoot), branch);
+    }
+    // The whole branch-keyed document, or null. Callers that need more than one branch use this.
+    readMainSyncStatusFile(repoRoot) {
+        return this.store.readFile(this.mainSyncStatusPath(repoRoot));
+    }
+    /**
+     * Merge ONE branch's entry into the existing map, atomically, leaving siblings untouched.
+     *
+     * Read-modify-write rather than replace: this is the writer used by everyone who is NOT the
+     * single-flight refresher (notably pr-gate's post-merge stamp, which holds no lock and knows about
+     * exactly one branch). Replacing the document from there would erase every other worktree's entry
+     * and silently disarm their guards until the next refresh.
+     */
+    writeMainSyncStatus(repoRoot, status) {
+        this.store.mergeBranch(this.mainSyncStatusPath(repoRoot), status);
+    }
+    /**
+     * Replace the WHOLE document — only the winning refresher may do this.
+     *
+     * ATOMIC (temp file + `rename()` in the same directory). The refresher writes this file while
+     * guards on the blocking path read it, possibly from another worktree; a plain `writeFileSync`
+     * truncates first, so a reader landing in that window gets a torn document. See AtomicFile.
+     */
+    writeMainSyncStatusFile(repoRoot, file) {
+        this.store.writeFile(this.mainSyncStatusPath(repoRoot), file);
+    }
+    readMainSyncLock(repoRoot) {
+        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions
+        try {
+            const lockPath = this.mainSyncLockPath(repoRoot);
+            if (!fs.existsSync(lockPath))
+                return null;
+            const raw = JSON.parse(fs.readFileSync(lockPath, 'utf8'));
+            return new MainSyncLock(raw.state ?? LOCK_STATE_FINISHED, raw.started ?? 0, raw.pid ?? 0);
+        }
+        catch (err) {
+            const error = (0, to_error_1.toError)(err);
+            void error;
+            return null;
+        }
+    }
+    writeMainSyncLock(repoRoot, lock) {
+        const lockPath = this.mainSyncLockPath(repoRoot);
+        this.ensureDir(lockPath);
+        fs.writeFileSync(lockPath, JSON.stringify(lock, null, 2) + '\n');
+    }
+    // A lock is stale (prior refresher assumed hung) once `inprocess` longer than hangTimeoutMinutes.
+    isLockStale(lock, hangTimeoutMinutes, now = Date.now()) {
+        return now - lock.started > hangTimeoutMinutes * 60 * 1000;
+    }
+    // True when another refresher is actively running and we should NOT start a second one.
+    isRefreshInProgress(repoRoot, hangTimeoutMinutes, now = Date.now()) {
+        const lock = this.readMainSyncLock(repoRoot);
+        if (!lock)
+            return false;
+        if (lock.state !== LOCK_STATE_INPROCESS)
+            return false;
+        if (this.isLockStale(lock, hangTimeoutMinutes, now))
+            return false;
+        return this.isProcessAlive(lock.pid);
+    }
+    /**
+     * ATOMICALLY take the refresher lock. Returns the held lock, or null when someone else holds it.
+     *
+     * Replaces the check-then-write pair (`isRefreshInProgress` then `writeMainSyncLock`), whose gap
+     * let two detached refreshers both pass the check and then both run `git fetch` at once — the
+     * concurrency this lock exists to prevent. The create uses the `wx` flag (O_CREAT|O_EXCL), so of
+     * N racing refreshers exactly one creates the file.
+     *
+     * A lock file left behind by a FINISHED, hung, or killed refresher is reclaimed: we only unlink
+     * and re-take it once `isRefreshInProgress` says the holder is provably not running, and we
+     * re-read afterwards to confirm the entry we see is ours before claiming the lock.
+     */
+    tryAcquireMainSyncLock(repoRoot, hangTimeoutMinutes, now = Date.now(), pid = process.pid) {
+        const lockPath = this.mainSyncLockPath(repoRoot);
+        this.ensureDir(lockPath);
+        const lock = this.inProcessLock(now, pid);
+        const payload = JSON.stringify(lock, null, 2) + '\n';
+        if (this.createExclusive(lockPath, payload))
+            return lock;
+        // The file already exists. Leave it alone while a live refresher owns it.
+        if (this.isRefreshInProgress(repoRoot, hangTimeoutMinutes, now))
+            return null;
+        // Reclaim it: remove the dead entry, then re-take it exclusively so only one reclaimer wins.
+        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions
+        try {
+            fs.unlinkSync(lockPath);
+        }
+        catch (err) {
+            const error = (0, to_error_1.toError)(err);
+            void error; // someone else reclaimed it first — the exclusive create below decides
+        }
+        if (!this.createExclusive(lockPath, payload))
+            return null;
+        // Confirm the lock on disk is OURS (a simultaneous reclaimer could have unlinked ours and
+        // written its own between the two calls above).
+        const held = this.readMainSyncLock(repoRoot);
+        if (!held || held.pid !== pid || held.started !== lock.started)
+            return null;
+        return lock;
+    }
+    // O_CREAT|O_EXCL write: true when THIS call created the file, false when it already existed.
+    createExclusive(lockPath, payload) {
+        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions
+        try {
+            fs.writeFileSync(lockPath, payload, { flag: 'wx' });
+            return true;
+        }
+        catch (err) {
+            const error = (0, to_error_1.toError)(err);
+            void error;
+            return false;
+        }
+    }
+    inProcessLock(now = Date.now(), pid = process.pid) {
+        return new MainSyncLock(LOCK_STATE_INPROCESS, now, pid);
+    }
+    finishedLock(started) {
+        return new MainSyncLock(LOCK_STATE_FINISHED, started, 0);
+    }
+    /**
+     * The SLOW path for ONE branch: the branch checked out in `repoRoot`. Runs its own fetch and its
+     * own `gh` query, so it is the right entry point for a single-worktree caller and for tests.
+     * The refresher uses computeAllMainSyncStatuses instead — see there for why.
+     */
+    computeMainSyncStatus(repoRoot) {
+        // Best-effort network refresh; offline just means we evaluate against the last-fetched ref.
+        this.fetchOriginMain(repoRoot);
+        return this.computeBranchStatus(repoRoot, this.gitBranch(repoRoot), this.loadPullRequestIndex(repoRoot));
+    }
+    /**
+     * The SLOW path for EVERY branch this repo has checked out — what the detached refresher runs.
+     *
+     * The cache is shared by all worktrees but was written for one branch, so only one worktree's
+     * guards were ever armed. Enumerating the worktrees here and writing all of their branches in one
+     * atomic map arms every worktree off a single refresh.
+     *
+     * NETWORK COST DOES NOT SCALE WITH BRANCH COUNT, which is the whole reason this is a separate
+     * method: ONE `git fetch` and ONE repo-wide `gh pr list` for all N branches (the old code asked
+     * `gh` twice per branch, so looping it would have cost 2N round trips). Everything after that is
+     * local git in each worktree — merge-base, rev-parse, diff, ls-files.
+     *
+     * The map is rebuilt from the LIVE worktree set every refresh, so a deleted branch or removed
+     * worktree simply stops appearing. No pruning pass, no unbounded growth.
+     */
+    computeAllMainSyncStatuses(repoRoot) {
+        this.fetchOriginMain(repoRoot);
+        const index = this.loadPullRequestIndex(repoRoot);
+        const branches = {};
+        for (const tree of this.worktrees.listWorktrees(repoRoot)) {
+            // Detached HEAD (and a bare worktree) has no branch to key an entry on. Skipping it must
+            // not stop the others being recorded, which is why this is a `continue`, not a bail-out.
+            if (tree.branch === '' || this.hasBranch(branches, tree.branch))
+                continue;
+            branches[tree.branch] = this.computeBranchStatus(tree.path, tree.branch, index);
+        }
+        // `main` always present, even with no worktree on it: read-stale-guard's state A looks itself
+        // up under 'main', and an absent entry there would silently disarm the stale-main block.
+        if (!this.hasBranch(branches, 'main'))
+            branches['main'] = this.mainOnlyStatus(repoRoot);
+        return new main_sync_file_1.MainSyncStatusFile(main_sync_file_1.MAIN_SYNC_STATUS_VERSION, new Date().toISOString(), branches);
+    }
+    hasBranch(branches, branch) {
+        return Object.prototype.hasOwnProperty.call(branches, branch);
+    }
+    /**
+     * One branch's status, computed in `worktreePath` (the tree that has it checked out — the
+     * working-tree overlap signals are only correct from there). Does NOT fetch and does NOT call
+     * `gh`: both are done once per refresh by the caller.
+     */
+    // webpieces-disable max-lines-new-methods -- one cohesive slow-path computation
+    computeBranchStatus(repoRoot, branch, index) {
+        return this.stampForge(this.computeBranchStatusInner(repoRoot, branch, index), index);
+    }
+    // Every return path of the computation below has to carry the forge flag, and threading it through
+    // four constructions is how one of them would end up missing it. One wrapper, one assignment.
+    stampForge(status, index) {
+        status.forgeReachable = index.forgeReachable;
+        return status;
+    }
+    // webpieces-disable max-lines-new-methods -- one cohesive slow-path computation
+    computeBranchStatusInner(repoRoot, branch, index) {
+        const mergedPr = index.mergedFor(branch);
+        const openPr = index.openFor(branch);
+        const head = this.capture(repoRoot, 'git', ['rev-parse', 'HEAD']);
+        const originMain = this.capture(repoRoot, 'git', ['rev-parse', 'origin/main']);
+        const localMain = this.localMainHash(repoRoot);
+        const featureHead = head.ok ? head.out : '';
+        if (!head.ok || !originMain.ok) {
+            const status = this.benignStatus(branch, featureHead);
+            status.branchAlreadyMerged = mergedPr !== '';
+            status.mergedPr = mergedPr;
+            status.openPr = openPr;
+            status.localMain = localMain;
+            status.commitsBehind = this.commitDistance(repoRoot, localMain, originMain.ok ? originMain.out : '');
+            return status;
+        }
+        const forkPoint = this.capture(repoRoot, 'git', ['merge-base', 'origin/main', 'HEAD']);
+        if (!forkPoint.ok || forkPoint.out === '') {
+            const noFork = new main_sync_file_1.MainSyncStatus(branch, mergedPr !== '', mergedPr, false, null, originMain.out, featureHead, false, [], new Date().toISOString());
+            noFork.openPr = openPr;
+            noFork.localMain = localMain;
+            noFork.commitsBehind = this.commitDistance(repoRoot, localMain, originMain.out);
+            return noFork;
+        }
+        const featureFiles = new Set(this.featureChangedFiles(repoRoot, forkPoint.out));
+        const mainFiles = this.changedFiles(repoRoot, forkPoint.out, 'origin/main');
+        const conflictFiles = mainFiles.filter((file) => featureFiles.has(file));
+        const status = new main_sync_file_1.MainSyncStatus(branch, mergedPr !== '', mergedPr, true, forkPoint.out, originMain.out, featureHead, conflictFiles.length > 0, conflictFiles, new Date().toISOString());
+        status.openPr = openPr;
+        status.localMain = localMain;
+        status.commitsBehind = this.commitDistance(repoRoot, localMain, originMain.out);
+        return status;
+    }
+    // The recovery steps when there is no fork point with origin/main (a bad merge of main into branch).
+    squashRecoverySteps(currentBranch) {
+        return [
+            '1. Fetch latest main:            git fetch origin main',
+            `2. New branch off origin/main:   git checkout -b ${currentBranch}-v2 origin/main`,
+            `3. Squash-merge old branch:      git merge --squash ${currentBranch}`,
+            '   ^^ HUMAN-ONLY. `git merge` is blocked for AI (redirect-how-to-merge-main). AI: ask the',
+            '   human to run step 3, and warn them it is a raw merge — only correct here because the',
+            '   branch is already broken. For a normal update from main they should push back and',
+            '   tell you to use the gated 3-point merge instead: `pnpm wp-start-update` (paired with',
+            '   `pnpm wp-finish-update`) when no PR is open, or `pnpm wp-start-upsert-pr` (paired with',
+            '   `pnpm wp-finish-upsert-pr`) when a PR IS open — a PR MUST use the upsert-pr pair.',
+            `4. Commit the squash:            git add -A && git commit -m "Squashed from ${currentBranch}"`,
+            '5. If a PR exists:               open a NEW PR for the -v2 branch and close the old one.',
+        ];
+    }
+    /**
+     * Synchronously stamp a clean "up to date with main" status — call right after a successful merge.
+     *
+     * This is the one writer that takes NO lock, and it knows about exactly one branch. It therefore
+     * goes through writeMainSyncStatus, which MERGES its entry into the existing map; writing a whole
+     * document from here would wipe every other worktree's entry.
+     */
+    stampCleanMainSyncStatus(repoRoot) {
+        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions
+        try {
+            const branch = this.gitBranch(repoRoot);
+            const originMain = this.capture(repoRoot, 'git', ['rev-parse', 'origin/main']);
+            const featureHead = this.capture(repoRoot, 'git', ['rev-parse', 'HEAD']);
+            if (!originMain.ok || !featureHead.ok)
+                return;
+            const status = new main_sync_file_1.MainSyncStatus(branch, false, '', true, originMain.out, originMain.out, featureHead.out, false, [], new Date().toISOString());
+            status.localMain = this.localMainHash(repoRoot);
+            status.commitsBehind = 0;
+            this.writeMainSyncStatus(repoRoot, status);
+        }
+        catch (err) {
+            const error = (0, to_error_1.toError)(err);
+            void error;
+        }
+    }
+    /**
+     * Refresh `origin/main` WITHOUT writing `.git/FETCH_HEAD`.
+     *
+     * WHY the flag is not optional: this runs in a DETACHED background process while the agent is
+     * running its own foreground `git fetch` / `git pull` in the very same repo. `.git/FETCH_HEAD` is
+     * a single file that git takes no lock on, so two overlapping fetches interleave their writes and
+     * can leave the SAME `for-merge` line twice. `git pull` then reads two for-merge entries and dies
+     * with `fatal: Cannot fast-forward to multiple branches` — wedging the exact command the
+     * read-stale-guard tells the agent to run. `--no-write-fetch-head` (git >= 2.29) still updates the
+     * remote-tracking ref, which is all anything downstream reads (`origin/main`, merge-base), so
+     * nothing here needs FETCH_HEAD written at all.
+     *
+     * Older git rejects the flag; only then do we retry the plain form, accepting the old behaviour
+     * rather than losing the refresh entirely on a pre-2020 git.
+     */
+    fetchOriginMain(repoRoot) {
+        const safe = (0, child_process_1.spawnSync)('git', ['fetch', '--no-write-fetch-head', 'origin', 'main'], {
+            cwd: repoRoot, encoding: 'utf8', stdio: ['ignore', 'ignore', 'pipe'],
+        });
+        if (safe.status === 0)
+            return;
+        if (!this.isUnknownGitOption(safe.stderr))
+            return; // a real failure (offline, auth) — not our business
+        (0, child_process_1.spawnSync)('git', ['fetch', 'origin', 'main'], { cwd: repoRoot, stdio: 'ignore' });
+    }
+    // Did git reject the flag itself (too old), as opposed to failing the network refresh?
+    isUnknownGitOption(stderr) {
+        const text = (stderr ?? '').toLowerCase();
+        return text.includes('unknown option') || text.includes('unknown switch') || text.includes('unrecognized option');
+    }
+    ensureDir(filePath) {
+        fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    }
+    // Liveness probe: is `pid` still a running process? pid <= 0 (unknown) → assume alive.
+    isProcessAlive(pid) {
+        if (pid <= 0)
+            return true;
+        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions
+        try {
+            process.kill(pid, 0);
+            return true;
+        }
+        catch (err) {
+            const error = (0, to_error_1.toError)(err);
+            return !error.message.includes('ESRCH');
+        }
+    }
+    // Run a command capturing trimmed stdout; ok=false on spawn failure or non-zero exit.
+    capture(repoRoot, cmd, args) {
+        const result = (0, child_process_1.spawnSync)(cmd, args, { cwd: repoRoot, encoding: 'utf8' });
+        if (result.status !== 0 || typeof result.stdout !== 'string')
+            return { ok: false, out: '' };
+        return { ok: true, out: result.stdout.trim() };
+    }
+    // The actual checked-out branch in repoRoot — cwd-correct so the cache's `branch` label matches.
+    gitBranch(repoRoot) {
+        const result = this.capture(repoRoot, 'git', ['rev-parse', '--abbrev-ref', 'HEAD']);
+        return result.ok ? result.out : '';
+    }
+    // The LOCAL main hash. `refs/heads/main` (not the bare name) so it can never resolve to a remote
+    // ref or a tag. '' when main does not exist locally — which the guard treats as fail-open.
+    localMainHash(repoRoot) {
+        const result = this.capture(repoRoot, 'git', ['rev-parse', 'refs/heads/main']);
+        return result.ok ? result.out : '';
+    }
+    // Slow-path only: the detached refresher calls this after fetching. Guards never count commits.
+    commitDistance(repoRoot, localMain, originMain) {
+        if (localMain === '' || originMain === '')
+            return null;
+        const result = this.capture(repoRoot, 'git', ['rev-list', '--count', `${localMain}..${originMain}`]);
+        if (!result.ok || !/^\d+$/.test(result.out))
+            return null;
+        return Number(result.out);
+    }
+    changedFiles(repoRoot, base, head) {
+        const result = this.capture(repoRoot, 'git', ['diff', '--name-only', base, head]);
+        if (!result.ok || result.out === '')
+            return [];
+        return result.out.split('\n').map((line) => line.trim()).filter((line) => line.length > 0);
+    }
+    // Every file this feature branch has touched since the fork point — committed AND still in the
+    // working tree (staged / unstaged / untracked), so a conflict is visible WHILE editing.
+    featureChangedFiles(repoRoot, forkPoint) {
+        const out = new Set();
+        const add = (args) => {
+            const r = this.capture(repoRoot, 'git', args);
+            if (!r.ok || r.out === '')
+                return;
+            for (const line of r.out.split('\n')) {
+                const f = line.trim();
+                if (f.length > 0)
+                    out.add(f);
+            }
+        };
+        add(['diff', '--name-only', forkPoint, 'HEAD']); // committed since the fork point
+        add(['diff', '--name-only', 'HEAD']); // unstaged working-tree edits
+        add(['diff', '--name-only', '--cached', 'HEAD']); // staged edits
+        add(['ls-files', '--others', '--exclude-standard']); // untracked new files (respects .gitignore)
+        return [...out];
+    }
+    /**
+     * ONE repo-wide `gh pr list` giving every branch's merged/open PR — replaces the two per-branch
+     * `--head <branch>` queries. `--limit 200` bounds it; a branch whose only PR is older than that
+     * falls out of the index and reads as "no PR", which is the fail-OPEN direction (no merged PR =
+     * no block), the same way a missing `gh` or an offline machine already degraded.
+     */
+    loadPullRequestIndex(repoRoot) {
+        const result = this.capture(repoRoot, 'gh', [
+            'pr', 'list', '--state', 'all', '--json', 'number,headRefName,state', '--limit', '200',
+        ]);
+        // `gh` could not be run, or exited non-zero (missing, unauthenticated, rate-limited, offline).
+        // An EMPTY index is the same fail-open answer as before — but it is now labelled UNREACHABLE, so
+        // the guards can report an abstention rather than an approval. Empty STDOUT on a zero exit is a
+        // real answer ("this repo has no PRs"), so only the failure path clears the flag.
+        if (!result.ok)
+            return new main_sync_file_1.PullRequestIndex({}, {}, false);
+        if (result.out === '')
+            return new main_sync_file_1.PullRequestIndex({}, {}, true);
+        return this.store.indexPullRequests(result.out);
+    }
+    /**
+     * A `main` entry synthesised WITHOUT a worktree standing on main. Carries only the two hashes
+     * read-stale-guard / stale-main-bash-guard actually compare (originMain vs the live tree's
+     * ancestry) — never merged, never conflicting, so it can only ever produce the stale-main verdict.
+     */
+    mainOnlyStatus(repoRoot) {
+        const originMain = this.capture(repoRoot, 'git', ['rev-parse', 'origin/main']);
+        const localMain = this.localMainHash(repoRoot);
+        const status = new main_sync_file_1.MainSyncStatus('main', false, '', true, localMain === '' ? null : localMain, originMain.ok ? originMain.out : '', localMain, false, [], new Date().toISOString());
+        status.localMain = localMain;
+        status.commitsBehind = this.commitDistance(repoRoot, localMain, originMain.ok ? originMain.out : '');
+        return status;
+    }
+    // A benign status that never blocks — used when origin/main can't be resolved.
+    benignStatus(branch, featureHead) {
+        return new main_sync_file_1.MainSyncStatus(branch, false, '', true, null, '', featureHead, false, [], new Date().toISOString());
+    }
+};
+exports.MainSyncStatusService = MainSyncStatusService;
+exports.MainSyncStatusService = MainSyncStatusService = tslib_1.__decorate([
+    (0, inversify_1.injectable)(inversify_1.bindingScopeValues.Singleton),
+    tslib_1.__metadata("design:paramtypes", [tooling_common_2.DotWebpieces,
+        tooling_common_1.AtomicFile,
+        main_sync_file_1.MainSyncFileStore,
+        worktrees_1.WorktreeService])
+], MainSyncStatusService);
+// Temporary migration delegators to MainSyncStatusService — removed once consumers inject it.
+const mainSyncSvc = new MainSyncStatusService();
+// webpieces-disable no-function-outside-class -- temporary back-compat delegator to MainSyncStatusService; removed once consumers inject it
+function mainSyncStatusPath(repoRoot) { return mainSyncSvc.mainSyncStatusPath(repoRoot); }
+// webpieces-disable no-function-outside-class -- temporary back-compat delegator to MainSyncStatusService; removed once consumers inject it
+function mainSyncLockPath(repoRoot) { return mainSyncSvc.mainSyncLockPath(repoRoot); }
+// webpieces-disable no-function-outside-class -- temporary back-compat delegator to MainSyncStatusService; removed once consumers inject it
+function readMainSyncStatus(repoRoot, branch) { return mainSyncSvc.readMainSyncStatus(repoRoot, branch); }
+// webpieces-disable no-function-outside-class -- temporary back-compat delegator to MainSyncStatusService; removed once consumers inject it
+function readMainSyncStatusFile(repoRoot) { return mainSyncSvc.readMainSyncStatusFile(repoRoot); }
+// webpieces-disable no-function-outside-class -- temporary back-compat delegator to MainSyncStatusService; removed once consumers inject it
+function writeMainSyncStatus(repoRoot, status) { mainSyncSvc.writeMainSyncStatus(repoRoot, status); }
+// webpieces-disable no-function-outside-class -- temporary back-compat delegator to MainSyncStatusService; removed once consumers inject it
+function writeMainSyncStatusFile(repoRoot, file) { mainSyncSvc.writeMainSyncStatusFile(repoRoot, file); }
+// webpieces-disable no-function-outside-class -- temporary back-compat delegator to MainSyncStatusService; removed once consumers inject it
+function readMainSyncLock(repoRoot) { return mainSyncSvc.readMainSyncLock(repoRoot); }
+// webpieces-disable no-function-outside-class -- temporary back-compat delegator to MainSyncStatusService; removed once consumers inject it
+function writeMainSyncLock(repoRoot, lock) { mainSyncSvc.writeMainSyncLock(repoRoot, lock); }
+// webpieces-disable no-function-outside-class -- temporary back-compat delegator to MainSyncStatusService; removed once consumers inject it
+function isLockStale(lock, hangTimeoutMinutes, now = Date.now()) { return mainSyncSvc.isLockStale(lock, hangTimeoutMinutes, now); }
+// webpieces-disable no-function-outside-class -- temporary back-compat delegator to MainSyncStatusService; removed once consumers inject it
+function isRefreshInProgress(repoRoot, hangTimeoutMinutes, now = Date.now()) { return mainSyncSvc.isRefreshInProgress(repoRoot, hangTimeoutMinutes, now); }
+// webpieces-disable no-function-outside-class -- temporary back-compat delegator to MainSyncStatusService; removed once consumers inject it
+function tryAcquireMainSyncLock(repoRoot, hangTimeoutMinutes, now = Date.now(), pid = process.pid) { return mainSyncSvc.tryAcquireMainSyncLock(repoRoot, hangTimeoutMinutes, now, pid); }
+// webpieces-disable no-function-outside-class -- temporary back-compat delegator to MainSyncStatusService; removed once consumers inject it
+function inProcessLock(now = Date.now(), pid = process.pid) { return mainSyncSvc.inProcessLock(now, pid); }
+// webpieces-disable no-function-outside-class -- temporary back-compat delegator to MainSyncStatusService; removed once consumers inject it
+function finishedLock(started) { return mainSyncSvc.finishedLock(started); }
+// webpieces-disable no-function-outside-class -- temporary back-compat delegator to MainSyncStatusService; removed once consumers inject it
+function computeMainSyncStatus(repoRoot) { return mainSyncSvc.computeMainSyncStatus(repoRoot); }
+// webpieces-disable no-function-outside-class -- temporary back-compat delegator to MainSyncStatusService; removed once consumers inject it
+function computeAllMainSyncStatuses(repoRoot) { return mainSyncSvc.computeAllMainSyncStatuses(repoRoot); }
+// webpieces-disable no-function-outside-class -- temporary back-compat delegator to MainSyncStatusService; removed once consumers inject it
+function squashRecoverySteps(currentBranch) { return mainSyncSvc.squashRecoverySteps(currentBranch); }
+// webpieces-disable no-function-outside-class -- temporary back-compat delegator to MainSyncStatusService; removed once consumers inject it
+function stampCleanMainSyncStatus(repoRoot) { mainSyncSvc.stampCleanMainSyncStatus(repoRoot); }
+//# sourceMappingURL=main-sync-status.js.map