agor-live 0.16.4 → 0.17.0

package/dist/cli/commands/admin/sync-unix.js

@@ -1,6 +1,6 @@
 // src/commands/admin/sync-unix.ts
 import { execSync } from "child_process";
-import { existsSync } from "fs";
+import { existsSync, readlinkSync } from "fs";
 import { homedir } from "os";
 import { join } from "path";
 import { loadConfig } from "@agor/core/config";
@@ -15,14 +15,29 @@ import {
   worktreeOwners,
   worktrees
 } from "@agor/core/db";
+import { restoreWorktreeFilesystem } from "@agor/core/git";
 import {
   AGOR_USERS_GROUP,
+  CommandError,
+  createAdminExecutor,
   generateRepoGroupName,
   generateWorktreeGroupName,
+  getGroupMembers,
+  getUserGroups,
+  getUserWorktreesDir,
+  getWorktreeDirectoryAction,
   getWorktreePermissionMode,
+  getWorktreeSymlinkPath,
+  groupExists,
+  isUserInGroup,
+  listAgorUsers,
+  listRepoGroups,
+  listWorktreeGroups,
   REPO_GIT_PERMISSION_MODE,
+  SymlinkCommands,
   UnixGroupCommands,
-  UnixUserCommands
+  UnixUserCommands,
+  unixUserExists
 } from "@agor/core/unix";
 import { Command, Flags } from "@oclif/core";
 import chalk from "chalk";
@@ -32,7 +47,8 @@ var SyncUnix = class _SyncUnix extends Command {
     "<%= config.bin %> <%= command.id %>                # Full sync (creates users, groups, sets permissions)",
     "<%= config.bin %> <%= command.id %> --dry-run      # Preview what would be done",
     "<%= config.bin %> <%= command.id %> --cleanup      # Full sync + remove stale users/groups",
-    "<%= config.bin %> <%= command.id %> --verbose      # Show detailed output"
+    "<%= config.bin %> <%= command.id %> --verbose      # Show detailed output",
+    "<%= config.bin %> <%= command.id %> --worktree-id <uuid> --dry-run  # Preview sync for a single worktree"
   ];
   static flags = {
     "dry-run": Flags.boolean({
@@ -57,193 +73,79 @@ var SyncUnix = class _SyncUnix extends Command {
     "cleanup-users": Flags.boolean({
       description: "Delete stale agor_* users not in database (keeps home directories)",
       default: false
+    }),
+    "worktree-id": Flags.string({
+      char: "w",
+      description: "Sync a single worktree and its parent repo (skips unrelated user/membership/symlink phases)"
     })
   };
-  /**
-   * Check if a Unix user exists on the system
-   */
-  userExists(username) {
-    try {
-      execSync(UnixUserCommands.userExists(username), { stdio: "ignore" });
-      return true;
-    } catch {
-      return false;
-    }
-  }
-  /**
-   * Get groups a Unix user belongs to
-   */
-  getUserGroups(username) {
-    try {
-      const output = execSync(UnixUserCommands.getUserGroups(username), {
-        encoding: "utf-8",
-        stdio: ["pipe", "pipe", "ignore"]
-      });
-      return output.trim().split(/\s+/).filter(Boolean);
-    } catch {
-      return [];
-    }
-  }
-  /**
-   * Check if a Unix group exists
-   */
-  groupExists(groupName) {
-    try {
-      execSync(UnixGroupCommands.groupExists(groupName), { stdio: "ignore" });
-      return true;
-    } catch {
-      return false;
-    }
-  }
-  /**
-   * Check if a Unix user is in a group
-   */
-  isUserInGroup(username, groupName) {
-    try {
-      execSync(UnixGroupCommands.isUserInGroup(username, groupName), { stdio: "ignore" });
-      return true;
-    } catch {
-      return false;
-    }
-  }
-  /**
-   * Create a Unix user (assumes running as root via sudo)
-   */
-  createUser(username, dryRun) {
-    const cmd = UnixUserCommands.createUser(username);
-    if (dryRun) {
-      this.log(chalk.gray(`  [dry-run] Would run: ${cmd}`));
-      return true;
-    }
-    try {
-      execSync(cmd, { stdio: "inherit" });
-      return true;
-    } catch {
-      return false;
-    }
-  }
-  /**
-   * Add user to a group (assumes running as root via sudo)
-   */
-  addUserToGroup(username, groupName, dryRun) {
-    const cmd = UnixGroupCommands.addUserToGroup(username, groupName);
-    if (dryRun) {
-      this.log(chalk.gray(`  [dry-run] Would run: ${cmd}`));
-      return true;
-    }
-    try {
-      execSync(cmd, { stdio: "inherit" });
-      return true;
-    } catch {
-      return false;
-    }
-  }
-  /**
-   * Create a Unix group (assumes running as root via sudo)
-   */
-  createGroup(groupName, dryRun) {
-    const cmd = UnixGroupCommands.createGroup(groupName);
-    if (dryRun) {
-      this.log(chalk.gray(`  [dry-run] Would run: ${cmd}`));
-      return true;
-    }
-    try {
-      execSync(cmd, { stdio: "inherit" });
-      return true;
-    } catch {
-      return false;
-    }
-  }
-  /**
-   * Delete a Unix user (keeps home directory)
-   */
-  deleteUser(username, dryRun) {
-    const cmd = UnixUserCommands.deleteUser(username);
-    if (dryRun) {
-      this.log(chalk.gray(`  [dry-run] Would run: ${cmd}`));
-      return true;
-    }
-    try {
-      execSync(cmd, { stdio: "inherit" });
-      return true;
-    } catch {
-      return false;
-    }
-  }
-  /**
-   * Delete a Unix group
-   */
-  deleteGroup(groupName, dryRun) {
-    const cmd = UnixGroupCommands.deleteGroup(groupName);
-    if (dryRun) {
-      this.log(chalk.gray(`  [dry-run] Would run: ${cmd}`));
-      return true;
-    }
-    try {
-      execSync(cmd, { stdio: "inherit" });
-      return true;
-    } catch {
-      return false;
-    }
-  }
-  /**
-   * List all agor_* users on the system (auto-generated format: agor_<8-hex>)
-   */
-  listAgorUsers() {
-    try {
-      const output = execSync("getent passwd | grep '^agor_' | cut -d: -f1", {
-        encoding: "utf-8",
-        stdio: ["pipe", "pipe", "ignore"]
-      });
-      return output.trim().split("\n").filter((u) => u && /^agor_[0-9a-f]{8}$/.test(u));
-    } catch {
-      return [];
-    }
-  }
-  /**
-   * List all agor_wt_* groups on the system
-   */
-  listWorktreeGroups() {
-    try {
-      const output = execSync("getent group | grep '^agor_wt_' | cut -d: -f1", {
-        encoding: "utf-8",
-        stdio: ["pipe", "pipe", "ignore"]
-      });
-      return output.trim().split("\n").filter((g) => g && /^agor_wt_[0-9a-f]{8}$/.test(g));
-    } catch {
-      return [];
-    }
-  }
-  /**
-   * List all agor_rp_* (repo) groups on the system
-   */
-  listRepoGroups() {
-    try {
-      const output = execSync("getent group | grep '^agor_rp_' | cut -d: -f1", {
-        encoding: "utf-8",
-        stdio: ["pipe", "pipe", "ignore"]
-      });
-      return output.trim().split("\n").filter((g) => g && /^agor_rp_[0-9a-f]{8}$/.test(g));
-    } catch {
-      return [];
-    }
-  }
   async run() {
     const { flags } = await this.parse(_SyncUnix);
     const dryRun = flags["dry-run"];
     const verbose = flags.verbose;
     const cleanupGroups = flags.cleanup || flags["cleanup-groups"];
     const cleanupUsers = flags.cleanup || flags["cleanup-users"];
+    const targetWorktreeId = flags["worktree-id"];
+    if (targetWorktreeId) {
+      this.log(chalk.cyan(`\u{1F3AF} Targeting single worktree: ${targetWorktreeId}
+`));
+    }
     if (dryRun) {
       this.log(chalk.yellow("\u{1F50D} Dry run mode - no changes will be made\n"));
     }
+    const executor = createAdminExecutor({ "dry-run": dryRun, verbose });
+    const logCmdError = (err, fallbackCmd) => {
+      if (err instanceof CommandError) {
+        const cmd = err.command || fallbackCmd;
+        const stderr = err.result.stderr.trim();
+        if (cmd) this.log(chalk.red(`      \u21B3 ${cmd}`));
+        if (stderr) {
+          for (const line of stderr.split("\n").slice(0, 10)) {
+            this.log(chalk.red(`        ${line}`));
+          }
+        }
+        this.log(chalk.red(`        (exit ${err.result.exitCode})`));
+      } else {
+        const msg = err instanceof Error ? err.message : String(err);
+        if (fallbackCmd) this.log(chalk.red(`      \u21B3 ${fallbackCmd}`));
+        this.log(chalk.red(`        ${msg}`));
+      }
+    };
+    const execCmd = async (cmd) => {
+      try {
+        await executor.exec(cmd);
+        return true;
+      } catch (err) {
+        logCmdError(err, cmd);
+        return false;
+      }
+    };
+    const execAllCmds = async (cmds) => {
+      try {
+        await executor.execAll(cmds);
+        return true;
+      } catch (err) {
+        logCmdError(err);
+        return false;
+      }
+    };
     let groupsCreated = 0;
     let groupsDeleted = 0;
     let usersDeleted = 0;
     let cleanupErrors = 0;
     let worktreesSynced = 0;
+    let worktreesBackfilled = 0;
+    let worktreeDirsCreated = 0;
+    let worktreesRestored = 0;
+    let groupsCleaned = 0;
+    let statusFixed = 0;
+    let worktreesSkipped = 0;
     let reposBackfilled = 0;
     let reposPermSynced = 0;
+    let membershipsRemoved = 0;
+    let daemonAclsApplied = 0;
+    let symlinksCreated = 0;
+    let symlinksCleaned = 0;
     let syncErrors = 0;
     try {
       let databaseUrl = process.env.DATABASE_URL;
@@ -302,11 +204,25 @@ Hint: Running as root via sudo. Expected database at ~${sudoUser}/.agor/agor.db`
         );
       }
       let daemonMembershipsAdded = 0;
+      let targetRepoId;
+      if (targetWorktreeId) {
+        const targetWts = await select(db).from(worktrees).where(eq(worktrees.worktree_id, targetWorktreeId)).all();
+        if (targetWts.length === 0) {
+          this.log(chalk.red(`\u2717 Worktree ${targetWorktreeId} not found in database
+`));
+          process.exit(1);
+        }
+        targetRepoId = targetWts[0].repo_id;
+        this.log(
+          chalk.cyan(`   Parent repo: ${targetRepoId.substring(0, 8)} (also scoped to this repo)
+`)
+        );
+      }
       this.log(chalk.cyan(`Checking ${AGOR_USERS_GROUP} group...
 `));
-      if (!this.groupExists(AGOR_USERS_GROUP)) {
+      if (!groupExists(AGOR_USERS_GROUP)) {
         this.log(chalk.yellow(`   \u2192 Creating ${AGOR_USERS_GROUP} group...`));
-        if (this.createGroup(AGOR_USERS_GROUP, dryRun)) {
+        if (await execCmd(UnixGroupCommands.createGroup(AGOR_USERS_GROUP))) {
           groupsCreated++;
           this.log(chalk.green(`   \u2713 Created ${AGOR_USERS_GROUP} group
 `));
@@ -321,136 +237,153 @@ Hint: Running as root via sudo. Expected database at ~${sudoUser}/.agor/agor.db`
       const allUsers = await select(db).from(users).all();
       const validUsers = allUsers.filter((u) => u.unix_username);
       const results = [];
-      if (validUsers.length === 0) {
-        this.log(chalk.yellow("No users with unix_username found in database"));
-        this.log(chalk.gray("\nTo set a unix_username for a user:"));
-        this.log(chalk.gray("  agor user update <email> --unix-username <username>\n"));
-      } else {
-        this.log(chalk.cyan(`Found ${validUsers.length} user(s) with unix_username
-`));
-        const userIds = validUsers.map((u) => u.user_id);
-        const allOwnerships = await db.select().from(worktreeOwners).innerJoin(worktrees, eq(worktreeOwners.worktree_id, worktrees.worktree_id)).where(inArray(worktreeOwners.user_id, userIds));
-        const ownershipsByUser = /* @__PURE__ */ new Map();
-        for (const row of allOwnerships) {
-          const userId = row.worktree_owners.user_id;
-          const ownership = {
-            worktree_id: row.worktrees.worktree_id,
-            name: row.worktrees.name,
-            unix_group: row.worktrees.unix_group,
-            repo_id: row.worktrees.repo_id
-          };
-          const existing = ownershipsByUser.get(userId) || [];
-          existing.push(ownership);
-          ownershipsByUser.set(userId, existing);
-        }
-        let allRepos = await select(db).from(repos).all();
+      {
+        const reposInScope = targetRepoId ? await select(db).from(repos).where(eq(repos.repo_id, targetRepoId)).all() : await select(db).from(repos).all();
         this.log(chalk.cyan.bold("\n\u2501\u2501\u2501 Sync Repos \u2501\u2501\u2501\n"));
-        const reposWithoutGroup = allRepos.filter(
-          (r) => r.unix_group === null
-        );
-        if (reposWithoutGroup.length === 0) {
-          this.log(chalk.green("   \u2713 All repos have unix_group set\n"));
+        if (reposInScope.length === 0) {
+          this.log(chalk.yellow("   No repos in scope\n"));
         } else {
+          this.log(chalk.cyan(`Processing ${reposInScope.length} repo(s)
+`));
+        }
+        for (const repo of reposInScope) {
+          const rawRepo = repo;
+          const expectedGroup = rawRepo.unix_group || generateRepoGroupName(rawRepo.repo_id);
+          const dbNeedsBackfill = rawRepo.unix_group === null;
+          const groupMissingOnSystem = !groupExists(expectedGroup);
+          const repoPath = rawRepo.data?.local_path;
+          const pathUsable = repoPath ? existsSync(repoPath) : false;
+          this.log(chalk.bold(`\u{1F4C1} ${rawRepo.slug}`));
+          this.log(chalk.gray(`   repo_id: ${rawRepo.repo_id.substring(0, 8)}`));
           this.log(
-            chalk.cyan(
-              `Found ${reposWithoutGroup.length} repo(s) without unix_group (of ${allRepos.length} total)
-`
-            )
+            chalk.gray(`   unix_group: ${expectedGroup}${dbNeedsBackfill ? " (to backfill)" : ""}`)
           );
-          for (const repo of reposWithoutGroup) {
-            const rawRepo = repo;
-            const repoGroup = generateRepoGroupName(rawRepo.repo_id);
-            this.log(chalk.bold(`\u{1F4C1} ${rawRepo.slug}`));
-            this.log(chalk.gray(`   repo_id: ${rawRepo.repo_id.substring(0, 8)}`));
-            this.log(chalk.gray(`   generated group: ${repoGroup}`));
-            const groupExistsOnSystem = this.groupExists(repoGroup);
-            if (groupExistsOnSystem) {
-              this.log(chalk.green(`   \u2713 Unix group already exists`));
+          if (repoPath) {
+            this.log(chalk.gray(`   repo path: ${repoPath}${pathUsable ? "" : " (missing)"}`));
+          } else {
+            this.log(chalk.gray(`   repo path: <none in data.local_path>`));
+          }
+          let hadError = false;
+          if (groupMissingOnSystem) {
+            this.log(chalk.yellow(`   \u2192 Creating Unix group ${expectedGroup}...`));
+            if (await execCmd(UnixGroupCommands.createGroup(expectedGroup))) {
+              groupsCreated++;
+              this.log(chalk.green(`   \u2713 Created Unix group ${expectedGroup}`));
             } else {
-              this.log(chalk.yellow(`   \u2192 Creating Unix group ${repoGroup}...`));
-              if (this.createGroup(repoGroup, dryRun)) {
-                groupsCreated++;
-                this.log(chalk.green(`   \u2713 Created Unix group ${repoGroup}`));
+              syncErrors++;
+              hadError = true;
+              this.log(chalk.red(`   \u2717 Failed to create Unix group ${expectedGroup}`));
+            }
+          } else if (verbose) {
+            this.log(chalk.gray(`   \u2713 Unix group exists`));
+          }
+          if (!hadError && daemonUser) {
+            const daemonInGroup = dryRun ? false : isUserInGroup(daemonUser, expectedGroup);
+            if (!daemonInGroup) {
+              this.log(
+                chalk.yellow(`   \u2192 Adding daemon user ${daemonUser} to ${expectedGroup}...`)
+              );
+              if (await execCmd(UnixGroupCommands.addUserToGroup(daemonUser, expectedGroup))) {
+                daemonMembershipsAdded++;
+                this.log(chalk.green(`   \u2713 Added daemon user to ${expectedGroup}`));
               } else {
                 syncErrors++;
-                this.log(chalk.red(`   \u2717 Failed to create Unix group ${repoGroup}`));
-                this.log("");
-                continue;
-              }
-            }
-            if (daemonUser) {
-              const daemonInGroup = dryRun ? false : this.isUserInGroup(daemonUser, repoGroup);
-              if (!daemonInGroup) {
-                this.log(chalk.yellow(`   \u2192 Adding daemon user ${daemonUser} to ${repoGroup}...`));
-                if (this.addUserToGroup(daemonUser, repoGroup, dryRun)) {
-                  daemonMembershipsAdded++;
-                  this.log(chalk.green(`   \u2713 Added daemon user to ${repoGroup}`));
-                } else {
-                  this.log(chalk.red(`   \u2717 Failed to add daemon user to ${repoGroup}`));
-                }
-              } else if (verbose) {
-                this.log(chalk.gray(`   \u2713 Daemon user already in ${repoGroup}`));
+                this.log(chalk.red(`   \u2717 Failed to add daemon user to ${expectedGroup}`));
               }
+            } else if (verbose) {
+              this.log(chalk.gray(`   \u2713 Daemon user already in ${expectedGroup}`));
             }
+          }
+          if (!hadError && dbNeedsBackfill) {
             if (dryRun) {
               this.log(
                 chalk.gray(
-                  `   [dry-run] Would update database: SET unix_group = '${repoGroup}' WHERE repo_id = '${rawRepo.repo_id}'`
+                  `   [dry-run] Would update database: SET unix_group = '${expectedGroup}' WHERE repo_id = '${rawRepo.repo_id}'`
                 )
               );
+              reposBackfilled++;
             } else {
               try {
-                await update(db, repos).set({ unix_group: repoGroup }).where(eq(repos.repo_id, rawRepo.repo_id)).run();
-                this.log(chalk.green(`   \u2713 Updated database with unix_group`));
+                await update(db, repos).set({ unix_group: expectedGroup }).where(eq(repos.repo_id, rawRepo.repo_id)).run();
+                reposBackfilled++;
+                this.log(chalk.green(`   \u2713 Backfilled unix_group in database`));
               } catch (error) {
                 syncErrors++;
+                hadError = true;
                 this.log(chalk.red(`   \u2717 Failed to update database: ${error}`));
-                this.log("");
-                continue;
               }
             }
-            const repoPath = rawRepo.data?.local_path;
-            if (repoPath) {
+          }
+          if (!hadError) {
+            if (!repoPath) {
+              this.log(chalk.yellow(`   \u26A0 No local_path in repo data, skipping permissions`));
+            } else if (!pathUsable) {
+              if (verbose) {
+                this.log(chalk.gray(`   \u2298 Repo path missing on disk, skipping permissions`));
+              }
+            } else {
               const gitPath = `${repoPath}/.git`;
-              this.log(chalk.gray(`   .git path: ${gitPath}`));
-              if (dryRun) {
-                this.log(chalk.gray(`   [dry-run] Would run: chgrp -R ${repoGroup} "${gitPath}"`));
+              const rootCmds = UnixGroupCommands.setDirectoryGroupShallow(
+                repoPath,
+                expectedGroup,
+                REPO_GIT_PERMISSION_MODE
+              );
+              const cmds = existsSync(gitPath) ? [
+                ...rootCmds,
+                ...UnixGroupCommands.setDirectoryGroup(
+                  gitPath,
+                  expectedGroup,
+                  REPO_GIT_PERMISSION_MODE
+                )
+              ] : rootCmds;
+              if (await execAllCmds(cmds)) {
+                reposPermSynced++;
                 this.log(
-                  chalk.gray(
-                    `   [dry-run] Would run: chmod -R ${REPO_GIT_PERMISSION_MODE} "${gitPath}"`
-                  )
+                  chalk.green(`   \u2713 Applied repo permissions (${REPO_GIT_PERMISSION_MODE})`)
                 );
-              } else {
-                try {
-                  for (const cmd of UnixGroupCommands.setDirectoryGroup(
-                    gitPath,
-                    repoGroup,
-                    REPO_GIT_PERMISSION_MODE
-                  )) {
-                    execSync(cmd, { stdio: "pipe" });
-                  }
-                  this.log(
-                    chalk.green(`   \u2713 Applied .git permissions (${REPO_GIT_PERMISSION_MODE})`)
-                  );
-                } catch (error) {
-                  syncErrors++;
-                  this.log(chalk.red(`   \u2717 Failed to set .git permissions: ${error}`));
+                if (!existsSync(gitPath) && verbose) {
+                  this.log(chalk.gray(`   \u2298 .git path missing on disk, root traversal only`));
                 }
+              } else {
+                syncErrors++;
+                this.log(chalk.red(`   \u2717 Failed to set repo permissions`));
               }
-            } else {
-              this.log(chalk.yellow(`   \u26A0 No local_path found, skipping .git permissions`));
             }
-            reposBackfilled++;
-            this.log("");
-          }
-          this.log(chalk.bold("Repo Backfill Summary:"));
-          this.log(`  Repos backfilled: ${reposBackfilled}${dryRun ? " (dry-run)" : ""}`);
-          if (syncErrors > 0) {
-            this.log(chalk.red(`  Errors: ${syncErrors}`));
           }
           this.log("");
-          allRepos = await select(db).from(repos).all();
         }
+        if (reposInScope.length > 0) {
+          this.log(chalk.bold("Sync Repos Summary:"));
+          this.log(`  DB backfilled:     ${reposBackfilled}${dryRun ? " (dry-run)" : ""}`);
+          this.log(`  Permissions synced:${reposPermSynced}${dryRun ? " (dry-run)" : ""}`);
+          this.log("");
+        }
+      }
+      if (targetWorktreeId) {
+        this.log(chalk.gray("   \u2298 Skipping user sync phase (--worktree-id mode)\n"));
+      } else if (validUsers.length === 0) {
+        this.log(chalk.yellow("No users with unix_username found in database"));
+        this.log(chalk.gray("\nTo set a unix_username for a user:"));
+        this.log(chalk.gray("  agor user update <email> --unix-username <username>\n"));
+      } else {
+        this.log(chalk.cyan(`Found ${validUsers.length} user(s) with unix_username
+`));
+        const userIds = validUsers.map((u) => u.user_id);
+        const allOwnerships = await db.select().from(worktreeOwners).innerJoin(worktrees, eq(worktreeOwners.worktree_id, worktrees.worktree_id)).where(inArray(worktreeOwners.user_id, userIds));
+        const ownershipsByUser = /* @__PURE__ */ new Map();
+        for (const row of allOwnerships) {
+          const userId = row.worktree_owners.user_id;
+          const ownership = {
+            worktree_id: row.worktrees.worktree_id,
+            name: row.worktrees.name,
+            unix_group: row.worktrees.unix_group,
+            repo_id: row.worktrees.repo_id
+          };
+          const existing = ownershipsByUser.get(userId) || [];
+          existing.push(ownership);
+          ownershipsByUser.set(userId, existing);
+        }
+        const allRepos = await select(db).from(repos).all();
         const repoGroupMap = /* @__PURE__ */ new Map();
         for (const repo of allRepos) {
           const r = repo;
@@ -472,13 +405,13 @@ Hint: Running as root via sudo. Expected database at ~${sudoUser}/.agor/agor.db`
           this.log(chalk.bold(`\u{1F4CB} ${user.email}`));
           this.log(chalk.gray(`   unix_username: ${user.unix_username}`));
           this.log(chalk.gray(`   user_id: ${user.user_id.substring(0, 8)}`));
-          result.unixUserExists = this.userExists(user.unix_username);
+          result.unixUserExists = unixUserExists(user.unix_username);
           if (result.unixUserExists) {
             this.log(chalk.green(`   \u2713 Unix user exists`));
           } else {
             this.log(chalk.red(`   \u2717 Unix user does not exist`));
             this.log(chalk.yellow(`   \u2192 Creating Unix user...`));
-            if (this.createUser(user.unix_username, dryRun)) {
+            if (await execCmd(UnixUserCommands.createUser(user.unix_username))) {
               result.unixUserCreated = true;
               result.unixUserExists = true;
               this.log(chalk.green(`   \u2713 Unix user created`));
@@ -488,13 +421,15 @@ Hint: Running as root via sudo. Expected database at ~${sudoUser}/.agor/agor.db`
             }
           }
           if (result.unixUserExists || dryRun) {
-            result.groups.actual = result.unixUserExists ? this.getUserGroups(user.unix_username) : [];
+            result.groups.actual = result.unixUserExists ? getUserGroups(user.unix_username) : [];
             if (verbose && result.groups.actual.length > 0) {
               this.log(chalk.gray(`   Current groups: ${result.groups.actual.join(", ")}`));
             }
             if (!result.groups.actual.includes(AGOR_USERS_GROUP)) {
               this.log(chalk.yellow(`   \u2192 Adding to ${AGOR_USERS_GROUP}...`));
-              if (this.addUserToGroup(user.unix_username, AGOR_USERS_GROUP, dryRun)) {
+              if (await execCmd(
+                UnixGroupCommands.addUserToGroup(user.unix_username, AGOR_USERS_GROUP)
+              )) {
                 result.groups.added.push(AGOR_USERS_GROUP);
                 this.log(chalk.green(`   \u2713 Added to ${AGOR_USERS_GROUP}`));
               } else {
@@ -510,7 +445,7 @@ Hint: Running as root via sudo. Expected database at ~${sudoUser}/.agor/agor.db`
               const expectedGroup = wt.unix_group || generateWorktreeGroupName(wt.worktree_id);
               result.groups.expected.push(expectedGroup);
               const isInGroup = result.groups.actual.includes(expectedGroup);
-              const groupExistsOnSystem = this.groupExists(expectedGroup);
+              const groupExistsOnSystem = groupExists(expectedGroup);
               if (verbose) {
                 this.log(
                   chalk.gray(
@@ -521,7 +456,7 @@ Hint: Running as root via sudo. Expected database at ~${sudoUser}/.agor/agor.db`
               let groupReady = groupExistsOnSystem;
               if (!groupExistsOnSystem) {
                 this.log(chalk.yellow(`   \u2192 Creating group ${expectedGroup}...`));
-                if (this.createGroup(expectedGroup, dryRun)) {
+                if (await execCmd(UnixGroupCommands.createGroup(expectedGroup))) {
                   groupsCreated++;
                   groupReady = true;
                   this.log(chalk.green(`   \u2713 Created group ${expectedGroup}`));
@@ -532,7 +467,7 @@ Hint: Running as root via sudo. Expected database at ~${sudoUser}/.agor/agor.db`
               }
               if (groupReady && !isInGroup) {
                 this.log(chalk.yellow(`   \u2192 Adding to group ${expectedGroup}...`));
-                if (this.addUserToGroup(user.unix_username, expectedGroup, dryRun)) {
+                if (await execCmd(UnixGroupCommands.addUserToGroup(user.unix_username, expectedGroup))) {
                   result.groups.added.push(expectedGroup);
                   this.log(chalk.green(`   \u2713 Added to ${expectedGroup}`));
                 } else {
@@ -541,12 +476,12 @@ Hint: Running as root via sudo. Expected database at ~${sudoUser}/.agor/agor.db`
                 }
               }
               if (groupReady && daemonUser) {
-                const daemonInWtGroup = dryRun ? false : this.isUserInGroup(daemonUser, expectedGroup);
+                const daemonInWtGroup = dryRun ? false : isUserInGroup(daemonUser, expectedGroup);
                 if (!daemonInWtGroup) {
                   this.log(
                     chalk.yellow(`   \u2192 Adding daemon user ${daemonUser} to ${expectedGroup}...`)
                   );
-                  if (this.addUserToGroup(daemonUser, expectedGroup, dryRun)) {
+                  if (await execCmd(UnixGroupCommands.addUserToGroup(daemonUser, expectedGroup))) {
                     daemonMembershipsAdded++;
                     this.log(chalk.green(`   \u2713 Added daemon user to ${expectedGroup}`));
                   } else {
@@ -564,7 +499,7 @@ Hint: Running as root via sudo. Expected database at ~${sudoUser}/.agor/agor.db`
               const repoGroup = repoGroupMap.get(wt.repo_id) || generateRepoGroupName(wt.repo_id);
               result.groups.expected.push(repoGroup);
               const isInRepoGroup = result.groups.actual.includes(repoGroup);
-              const repoGroupExistsOnSystem = this.groupExists(repoGroup);
+              const repoGroupExistsOnSystem = groupExists(repoGroup);
               if (verbose) {
                 this.log(
                   chalk.gray(
@@ -575,7 +510,7 @@ Hint: Running as root via sudo. Expected database at ~${sudoUser}/.agor/agor.db`
               let repoGroupReady = repoGroupExistsOnSystem;
               if (!repoGroupExistsOnSystem) {
                 this.log(chalk.yellow(`   \u2192 Creating repo group ${repoGroup}...`));
-                if (this.createGroup(repoGroup, dryRun)) {
+                if (await execCmd(UnixGroupCommands.createGroup(repoGroup))) {
                   groupsCreated++;
                   repoGroupReady = true;
                   this.log(chalk.green(`   \u2713 Created repo group ${repoGroup}`));
@@ -586,7 +521,7 @@ Hint: Running as root via sudo. Expected database at ~${sudoUser}/.agor/agor.db`
               }
               if (repoGroupReady && !isInRepoGroup) {
                 this.log(chalk.yellow(`   \u2192 Adding to repo group ${repoGroup}...`));
-                if (this.addUserToGroup(user.unix_username, repoGroup, dryRun)) {
+                if (await execCmd(UnixGroupCommands.addUserToGroup(user.unix_username, repoGroup))) {
                   result.groups.added.push(repoGroup);
                   this.log(chalk.green(`   \u2713 Added to ${repoGroup}`));
                 } else {
@@ -595,12 +530,12 @@ Hint: Running as root via sudo. Expected database at ~${sudoUser}/.agor/agor.db`
                 }
               }
               if (repoGroupReady && daemonUser) {
-                const daemonInRpGroup = dryRun ? false : this.isUserInGroup(daemonUser, repoGroup);
+                const daemonInRpGroup = dryRun ? false : isUserInGroup(daemonUser, repoGroup);
                 if (!daemonInRpGroup) {
                   this.log(
                     chalk.yellow(`   \u2192 Adding daemon user ${daemonUser} to ${repoGroup}...`)
                   );
-                  if (this.addUserToGroup(daemonUser, repoGroup, dryRun)) {
+                  if (await execCmd(UnixGroupCommands.addUserToGroup(daemonUser, repoGroup))) {
                     daemonMembershipsAdded++;
                     this.log(chalk.green(`   \u2713 Added daemon user to ${repoGroup}`));
                   } else {
@@ -616,11 +551,118 @@ Hint: Running as root via sudo. Expected database at ~${sudoUser}/.agor/agor.db`
           this.log("");
         }
       }
+      this.log(chalk.cyan.bold("\n\u2501\u2501\u2501 Sync Worktree Groups \u2501\u2501\u2501\n"));
+      const allWorktreesForBackfill = targetWorktreeId ? await select(db).from(worktrees).where(eq(worktrees.worktree_id, targetWorktreeId)).all() : await select(db).from(worktrees).all();
+      const worktreesForGroupSync = allWorktreesForBackfill.filter(
+        (wt) => !(wt.archived && wt.filesystem_status === "deleted")
+      );
+      if (worktreesForGroupSync.length === 0) {
+        this.log(chalk.yellow("   No active worktrees in scope\n"));
+      } else {
+        this.log(chalk.cyan(`Processing ${worktreesForGroupSync.length} worktree(s)
+`));
+        for (const wt of worktreesForGroupSync) {
+          const rawWt = wt;
+          const expectedGroup = rawWt.unix_group || generateWorktreeGroupName(rawWt.worktree_id);
+          const dbNeedsBackfill = rawWt.unix_group === null;
+          const groupMissingOnSystem = !groupExists(expectedGroup);
+          if (!dbNeedsBackfill && !groupMissingOnSystem && !verbose) {
+            if (daemonUser && !isUserInGroup(daemonUser, expectedGroup)) {
+              this.log(chalk.bold(`\u{1F4C1} ${rawWt.name}`));
+              this.log(
+                chalk.yellow(`   \u2192 Adding daemon user ${daemonUser} to ${expectedGroup}...`)
+              );
+              if (await execCmd(UnixGroupCommands.addUserToGroup(daemonUser, expectedGroup))) {
+                daemonMembershipsAdded++;
+                this.log(chalk.green(`   \u2713 Added daemon user to ${expectedGroup}
+`));
+              } else {
+                syncErrors++;
+                this.log(chalk.red(`   \u2717 Failed to add daemon user to ${expectedGroup}
+`));
+              }
+            }
+            continue;
+          }
+          this.log(chalk.bold(`\u{1F4C1} ${rawWt.name}`));
+          this.log(chalk.gray(`   worktree_id: ${rawWt.worktree_id.substring(0, 8)}`));
+          this.log(
+            chalk.gray(`   unix_group: ${expectedGroup}${dbNeedsBackfill ? " (to backfill)" : ""}`)
+          );
+          let hadError = false;
+          if (groupMissingOnSystem) {
+            this.log(chalk.yellow(`   \u2192 Creating Unix group ${expectedGroup}...`));
+            if (await execCmd(UnixGroupCommands.createGroup(expectedGroup))) {
+              groupsCreated++;
+              this.log(chalk.green(`   \u2713 Created Unix group ${expectedGroup}`));
+            } else {
+              syncErrors++;
+              hadError = true;
+              this.log(chalk.red(`   \u2717 Failed to create Unix group ${expectedGroup}`));
+            }
+          } else if (verbose) {
+            this.log(chalk.gray(`   \u2713 Unix group exists`));
+          }
+          if (!hadError && daemonUser) {
+            const daemonInGroup = dryRun ? false : isUserInGroup(daemonUser, expectedGroup);
+            if (!daemonInGroup) {
+              this.log(
+                chalk.yellow(`   \u2192 Adding daemon user ${daemonUser} to ${expectedGroup}...`)
+              );
+              if (await execCmd(UnixGroupCommands.addUserToGroup(daemonUser, expectedGroup))) {
+                daemonMembershipsAdded++;
+                this.log(chalk.green(`   \u2713 Added daemon user to ${expectedGroup}`));
+              } else {
+                syncErrors++;
+                this.log(chalk.red(`   \u2717 Failed to add daemon user to ${expectedGroup}`));
+              }
+            } else if (verbose) {
+              this.log(chalk.gray(`   \u2713 Daemon user already in ${expectedGroup}`));
+            }
+          }
+          if (!hadError && dbNeedsBackfill) {
+            if (dryRun) {
+              this.log(
+                chalk.gray(
+                  `   [dry-run] Would update database: SET unix_group = '${expectedGroup}' WHERE worktree_id = '${rawWt.worktree_id}'`
+                )
+              );
+              worktreesBackfilled++;
+            } else {
+              try {
+                await update(db, worktrees).set({ unix_group: expectedGroup }).where(eq(worktrees.worktree_id, rawWt.worktree_id)).run();
+                worktreesBackfilled++;
+                this.log(chalk.green(`   \u2713 Backfilled unix_group in database`));
+              } catch (error) {
+                syncErrors++;
+                this.log(chalk.red(`   \u2717 Failed to update database: ${error}`));
+              }
+            }
+          }
+          this.log("");
+        }
+        if (worktreesBackfilled > 0 || groupsCreated > 0 || daemonMembershipsAdded > 0) {
+          this.log(chalk.bold("Sync Worktree Groups Summary:"));
+          this.log(`  DB backfilled: ${worktreesBackfilled}${dryRun ? " (dry-run)" : ""}`);
+          this.log("");
+        }
+      }
       this.log(chalk.cyan.bold("\n\u2501\u2501\u2501 Sync Worktree Permissions \u2501\u2501\u2501\n"));
-      const allWorktreesForSync = await select(db).from(worktrees).all();
+      const allWorktreesForSync = targetWorktreeId ? await select(db).from(worktrees).where(eq(worktrees.worktree_id, targetWorktreeId)).all() : await select(db).from(worktrees).all();
       const worktreesWithGroup = allWorktreesForSync.filter(
         (wt) => wt.unix_group !== null
       );
+      const allReposForWtSync = await select(db).from(repos).all();
+      const repoPathMap = /* @__PURE__ */ new Map();
+      for (const repo of allReposForWtSync) {
+        const r = repo;
+        if (r.data?.local_path) {
+          repoPathMap.set(r.repo_id, {
+            localPath: r.data.local_path,
+            defaultBranch: r.data.default_branch || "main"
+          });
+        }
+      }
       if (worktreesWithGroup.length === 0) {
         this.log(chalk.yellow("No worktrees with unix_group found\n"));
       } else {
@@ -630,141 +672,398 @@ Hint: Running as root via sudo. Expected database at ~${sudoUser}/.agor/agor.db`
           const rawWorktree = wt;
           const worktreePath = rawWorktree.data?.path;
           if (!worktreePath) {
-            this.log(chalk.yellow(`\u{1F4C1} ${rawWorktree.name}`));
+            if (verbose) {
+              this.log(chalk.gray(`   \u26A0 ${rawWorktree.name}: no path in data, skipping`));
+            }
+            worktreesSkipped++;
+            continue;
+          }
+          const dirExists = existsSync(worktreePath);
+          const action = getWorktreeDirectoryAction(
+            dirExists,
+            rawWorktree.archived,
+            rawWorktree.filesystem_status
+          );
+          if (action === "cleanup") {
+            const wtGroup = rawWorktree.unix_group;
+            if (groupExists(wtGroup)) {
+              this.log(
+                chalk.yellow(
+                  `   \u{1F9F9} ${rawWorktree.name}: archived+deleted, removing group ${wtGroup}...`
+                )
+              );
+              if (await execCmd(UnixGroupCommands.deleteGroup(wtGroup))) {
+                groupsCleaned++;
+                this.log(chalk.green(`   \u2713 Deleted group ${wtGroup}`));
+              } else {
+                syncErrors++;
+                this.log(chalk.red(`   \u2717 Failed to delete group ${wtGroup}`));
+              }
+            } else if (verbose) {
+              this.log(
+                chalk.gray(
+                  `   \u2298 ${rawWorktree.name}: archived+deleted, group ${wtGroup} already gone`
+                )
+              );
+            }
+            continue;
+          }
+          if (action === "skip") {
+            if (verbose) {
+              const reason = rawWorktree.filesystem_status === "creating" ? "still creating" : rawWorktree.archived && !dirExists ? `archived (${rawWorktree.filesystem_status || "unknown"}), dir missing` : "unknown";
+              this.log(chalk.gray(`   \u2298 ${rawWorktree.name}: ${reason}, skipping`));
+            }
+            worktreesSkipped++;
+            continue;
+          }
+          if (action === "restore") {
+            const repoInfo = repoPathMap.get(rawWorktree.repo_id);
+            if (!repoInfo) {
+              if (verbose) {
+                this.log(
+                  chalk.gray(
+                    `   \u2298 ${rawWorktree.name}: failed, no repo path found, skipping restore`
+                  )
+                );
+              }
+              worktreesSkipped++;
+              continue;
+            }
+            const baseRef = rawWorktree.data?.base_ref || repoInfo.defaultBranch;
+            this.log(chalk.bold(`\u{1F527} ${rawWorktree.name}`));
             this.log(chalk.gray(`   worktree_id: ${rawWorktree.worktree_id.substring(0, 8)}`));
-            this.log(chalk.gray(`   unix_group: ${rawWorktree.unix_group}`));
-            this.log(chalk.red(`   \u26A0 No path found in worktree data, skipping
-`));
+            this.log(chalk.gray(`   status: failed \u2192 attempting restore`));
+            this.log(chalk.gray(`   ref: ${rawWorktree.ref}, base: ${baseRef}`));
+            this.log(chalk.gray(`   path: ${worktreePath}`));
+            if (dryRun) {
+              this.log(
+                chalk.gray(
+                  `   [dry-run] Would attempt restoreWorktreeFilesystem() for ${rawWorktree.ref} at ${worktreePath}`
+                )
+              );
+              worktreesRestored++;
+              this.log("");
+              continue;
+            }
+            this.log(chalk.yellow(`   \u2192 Restoring worktree filesystem...`));
+            const result = await restoreWorktreeFilesystem(
+              repoInfo.localPath,
+              worktreePath,
+              rawWorktree.ref,
+              baseRef
+            );
+            if (result.success) {
+              await update(db, worktrees).set({ filesystem_status: "ready" }).where(eq(worktrees.worktree_id, rawWorktree.worktree_id)).run();
+              worktreesRestored++;
+              this.log(chalk.green(`   \u2713 Restored worktree (${result.strategy}), status \u2192 ready`));
+            } else {
+              syncErrors++;
+              this.log(chalk.red(`   \u2717 Failed to restore worktree: ${result.error}`));
+            }
+            this.log("");
             continue;
           }
           this.log(chalk.bold(`\u{1F4C1} ${rawWorktree.name}`));
           this.log(chalk.gray(`   worktree_id: ${rawWorktree.worktree_id.substring(0, 8)}`));
           this.log(chalk.gray(`   unix_group: ${rawWorktree.unix_group}`));
           this.log(chalk.gray(`   path: ${worktreePath}`));
+          if (rawWorktree.archived) {
+            this.log(
+              chalk.gray(`   archived: yes (fs: ${rawWorktree.filesystem_status || "preserved"})`)
+            );
+          }
+          if (action === "create") {
+            const repoInfo = repoPathMap.get(rawWorktree.repo_id);
+            if (repoInfo) {
+              const baseRef = rawWorktree.data?.base_ref || repoInfo.defaultBranch;
+              this.log(
+                chalk.yellow(
+                  `   \u2192 Directory missing, creating git worktree (branch: ${rawWorktree.ref}, base: ${baseRef})...`
+                )
+              );
+              if (dryRun) {
+                worktreeDirsCreated++;
+                this.log(
+                  chalk.gray(
+                    `   [dry-run] Would run restoreWorktreeFilesystem() for ${rawWorktree.ref} at ${worktreePath}`
+                  )
+                );
+              } else {
+                const result = await restoreWorktreeFilesystem(
+                  repoInfo.localPath,
+                  worktreePath,
+                  rawWorktree.ref,
+                  baseRef
+                );
+                if (result.success) {
+                  worktreeDirsCreated++;
+                  this.log(chalk.green(`   \u2713 Created git worktree (${result.strategy})`));
+                } else {
+                  this.log(
+                    chalk.yellow(
+                      `   \u26A0 git worktree add failed (${result.error}), falling back to mkdir -p`
+                    )
+                  );
+                  if (await execCmd(`sudo -n mkdir -p "${worktreePath}"`)) {
+                    worktreeDirsCreated++;
+                    this.log(chalk.green(`   \u2713 Created directory (mkdir fallback)`));
+                  } else {
+                    syncErrors++;
+                    this.log(chalk.red(`   \u2717 Failed to create directory`));
+                    this.log("");
+                    continue;
+                  }
+                }
+              }
+            } else {
+              this.log(
+                chalk.yellow(`   \u2192 Directory missing, creating (no repo path for git worktree)...`)
+              );
+              if (await execCmd(`sudo -n mkdir -p "${worktreePath}"`)) {
+                worktreeDirsCreated++;
+                this.log(chalk.green(`   \u2713 Created directory`));
+              } else {
+                syncErrors++;
+                this.log(chalk.red(`   \u2717 Failed to create directory`));
+                this.log("");
+                continue;
+              }
+            }
+          }
+          if (action === "sync" && !rawWorktree.archived && (rawWorktree.filesystem_status === "deleted" || rawWorktree.filesystem_status === "preserved")) {
+            const gitFilePath = join(worktreePath, ".git");
+            if (existsSync(gitFilePath)) {
+              const oldStatus = rawWorktree.filesystem_status;
+              this.log(chalk.yellow(`   \u2192 Fixing filesystem_status: ${oldStatus} \u2192 ready`));
+              if (!dryRun) {
+                try {
+                  await update(db, worktrees).set({ filesystem_status: "ready" }).where(eq(worktrees.worktree_id, rawWorktree.worktree_id)).run();
+                  this.log(
+                    chalk.green(
+                      `   \u2713 Fixed filesystem_status: ${oldStatus} \u2192 ready for ${rawWorktree.name}`
+                    )
+                  );
+                } catch (error) {
+                  syncErrors++;
+                  this.log(chalk.red(`   \u2717 Failed to fix filesystem_status: ${error}`));
+                }
+              } else {
+                this.log(
+                  chalk.gray(
+                    `   [dry-run] Would fix filesystem_status: ${oldStatus} \u2192 ready for ${rawWorktree.name}`
+                  )
+                );
+              }
+              statusFixed++;
+            }
+          }
           const othersAccess = rawWorktree.others_fs_access || "read";
           const permissionMode = getWorktreePermissionMode(othersAccess);
           this.log(chalk.gray(`   others_fs_access: ${othersAccess} \u2192 mode: ${permissionMode}`));
-          if (dryRun) {
-            this.log(
-              chalk.gray(
-                `   [dry-run] Would run: chgrp -R ${rawWorktree.unix_group} "${worktreePath}"`
-              )
-            );
-            this.log(
-              chalk.gray(`   [dry-run] Would run: chmod -R ${permissionMode} "${worktreePath}"`)
-            );
-            this.log("");
+          const permCmds = UnixGroupCommands.setDirectoryGroup(
+            worktreePath,
+            rawWorktree.unix_group,
+            permissionMode
+          );
+          if (await execAllCmds(permCmds)) {
+            worktreesSynced++;
+            this.log(chalk.green(`   \u2713 Applied permissions (${permissionMode})`));
           } else {
-            try {
-              for (const cmd of UnixGroupCommands.setDirectoryGroup(
-                worktreePath,
-                rawWorktree.unix_group,
-                permissionMode
-              )) {
-                execSync(cmd, { stdio: "pipe" });
+            syncErrors++;
+            this.log(chalk.red(`   \u2717 Failed to set permissions`));
+          }
+          if (daemonUser && (dirExists || action === "create")) {
+            const aclCmds = UnixGroupCommands.setUserAcl(worktreePath, daemonUser);
+            if (await execAllCmds(aclCmds)) {
+              daemonAclsApplied++;
+              if (verbose) {
+                this.log(chalk.green(`   \u2713 Applied daemon ACL for ${daemonUser}`));
               }
-              worktreesSynced++;
-              this.log(chalk.green(`   \u2713 Applied permissions (${permissionMode})
-`));
-            } catch (error) {
+            } else {
               syncErrors++;
-              this.log(chalk.red(`   \u2717 Failed: ${error}
-`));
+              this.log(chalk.red(`   \u2717 Failed to set daemon ACL`));
             }
           }
+          this.log("");
         }
         this.log(chalk.bold("Worktree Sync Summary:"));
         this.log(`  Worktrees synced: ${worktreesSynced}${dryRun ? " (dry-run)" : ""}`);
+        this.log(`  Directories created: ${worktreeDirsCreated}${dryRun ? " (dry-run)" : ""}`);
+        this.log(`  Worktrees restored: ${worktreesRestored}${dryRun ? " (dry-run)" : ""}`);
+        this.log(`  Groups cleaned: ${groupsCleaned}${dryRun ? " (dry-run)" : ""}`);
+        this.log(`  Status fixed: ${statusFixed}${dryRun ? " (dry-run)" : ""}`);
+        this.log(`  Daemon ACLs applied: ${daemonAclsApplied}${dryRun ? " (dry-run)" : ""}`);
+        this.log(`  Skipped: ${worktreesSkipped}`);
         if (syncErrors > 0) {
           this.log(chalk.red(`  Errors: ${syncErrors}`));
         }
         this.log("");
       }
-      this.log(chalk.cyan.bold("\n\u2501\u2501\u2501 Sync Repo Permissions \u2501\u2501\u2501\n"));
-      const allReposForSync = await select(db).from(repos).all();
-      const reposWithGroup = allReposForSync.filter(
-        (r) => r.unix_group !== null
-      );
-      if (reposWithGroup.length === 0) {
-        this.log(chalk.yellow("No repos with unix_group found\n"));
+      if (targetWorktreeId) {
+        this.log(chalk.gray("   \u2298 Skipping membership pruning phase (--worktree-id mode)\n"));
       } else {
-        this.log(chalk.cyan(`Found ${reposWithGroup.length} repo(s) with unix_group
-`));
-        for (const repo of reposWithGroup) {
-          const rawRepo = repo;
-          const repoPath = rawRepo.data?.local_path;
-          if (!repoPath) {
-            this.log(chalk.yellow(`\u{1F4C1} ${rawRepo.slug}`));
-            this.log(chalk.gray(`   repo_id: ${rawRepo.repo_id.substring(0, 8)}`));
-            this.log(chalk.gray(`   unix_group: ${rawRepo.unix_group}`));
-            this.log(chalk.red(`   \u26A0 No local_path found in repo data, skipping
-`));
-            continue;
+        this.log(chalk.cyan.bold("\n\u2501\u2501\u2501 Prune Stale Group Memberships \u2501\u2501\u2501\n"));
+        {
+          const allWtForPrune = await select(db).from(worktrees).all();
+          const allOwnerRows = await select(db).from(worktreeOwners).all();
+          const wtGroupMap = /* @__PURE__ */ new Map();
+          for (const wt of allWtForPrune) {
+            const raw = wt;
+            if (raw.unix_group) {
+              wtGroupMap.set(raw.worktree_id, raw.unix_group);
+            }
           }
-          const gitPath = `${repoPath}/.git`;
-          this.log(chalk.bold(`\u{1F4C1} ${rawRepo.slug}`));
-          this.log(chalk.gray(`   repo_id: ${rawRepo.repo_id.substring(0, 8)}`));
-          this.log(chalk.gray(`   unix_group: ${rawRepo.unix_group}`));
-          this.log(chalk.gray(`   .git path: ${gitPath}`));
-          this.log(chalk.gray(`   mode: ${REPO_GIT_PERMISSION_MODE} (setgid, owner+group rwx)`));
-          if (daemonUser) {
-            const daemonInThisRepoGroup = dryRun ? false : this.isUserInGroup(daemonUser, rawRepo.unix_group);
-            if (!daemonInThisRepoGroup) {
-              this.log(
-                chalk.yellow(`   \u2192 Adding daemon user ${daemonUser} to ${rawRepo.unix_group}...`)
-              );
-              if (this.addUserToGroup(daemonUser, rawRepo.unix_group, dryRun)) {
-                daemonMembershipsAdded++;
-                this.log(chalk.green(`   \u2713 Added daemon user to ${rawRepo.unix_group}`));
+          const groupToOwnerIds = /* @__PURE__ */ new Map();
+          for (const row of allOwnerRows) {
+            const raw = row;
+            const group = wtGroupMap.get(raw.worktree_id);
+            if (group) {
+              const owners = groupToOwnerIds.get(group) || /* @__PURE__ */ new Set();
+              owners.add(raw.user_id);
+              groupToOwnerIds.set(group, owners);
+            }
+          }
+          const allUsersForPrune = await select(db).from(users).all();
+          const userIdToUnixName = /* @__PURE__ */ new Map();
+          const unixNameToUserId = /* @__PURE__ */ new Map();
+          for (const u of allUsersForPrune) {
+            if (u.unix_username) {
+              userIdToUnixName.set(u.user_id, u.unix_username);
+              unixNameToUserId.set(u.unix_username, u.user_id);
+            }
+          }
+          let pruneChecked = 0;
+          for (const [, group] of wtGroupMap.entries()) {
+            if (!groupExists(group)) continue;
+            pruneChecked++;
+            const ownerIds = groupToOwnerIds.get(group) || /* @__PURE__ */ new Set();
+            const expectedUsernames = /* @__PURE__ */ new Set();
+            for (const ownerId of ownerIds) {
+              const uname = userIdToUnixName.get(ownerId);
+              if (uname) expectedUsernames.add(uname);
+            }
+            if (daemonUser) expectedUsernames.add(daemonUser);
+            const actualMembers = getGroupMembers(group);
+            for (const member of actualMembers) {
+              if (expectedUsernames.has(member)) continue;
+              if (daemonUser && member === daemonUser) continue;
+              if (!unixNameToUserId.has(member)) continue;
+              this.log(chalk.yellow(`   \u2192 Removing ${member} from ${group} (no longer owner)`));
+              if (await execCmd(UnixGroupCommands.removeUserFromGroup(member, group))) {
+                membershipsRemoved++;
+                this.log(chalk.green(`   \u2713 Removed ${member} from ${group}`));
               } else {
-                this.log(chalk.red(`   \u2717 Failed to add daemon user to ${rawRepo.unix_group}`));
+                syncErrors++;
+                this.log(chalk.red(`   \u2717 Failed to remove ${member} from ${group}`));
               }
-            } else if (verbose) {
-              this.log(chalk.gray(`   \u2713 Daemon user already in ${rawRepo.unix_group}`));
             }
           }
-          if (dryRun) {
+          if (membershipsRemoved === 0) {
             this.log(
-              chalk.gray(`   [dry-run] Would run: chgrp -R ${rawRepo.unix_group} "${gitPath}"`)
-            );
-            this.log(
-              chalk.gray(
-                `   [dry-run] Would run: chmod -R ${REPO_GIT_PERMISSION_MODE} "${gitPath}"`
-              )
+              chalk.green(`   \u2713 No stale memberships found (checked ${pruneChecked} groups)
+`)
             );
-            this.log("");
           } else {
+            this.log("");
+            this.log(chalk.bold("Membership Pruning Summary:"));
+            this.log(`  Memberships removed: ${membershipsRemoved}${dryRun ? " (dry-run)" : ""}`);
+            this.log("");
+          }
+        }
+      }
+      if (targetWorktreeId) {
+        this.log(chalk.gray("   \u2298 Skipping symlink sync phase (--worktree-id mode)\n"));
+      } else if (validUsers.length > 0) {
+        this.log(chalk.cyan.bold("\n\u2501\u2501\u2501 Sync User Symlinks \u2501\u2501\u2501\n"));
+        const allWtForSymlinks = await select(db).from(worktrees).all();
+        const allOwnershipsForSymlinks = await select(db).from(worktreeOwners).all();
+        const wtInfoMap = /* @__PURE__ */ new Map();
+        for (const wt of allWtForSymlinks) {
+          const raw = wt;
+          wtInfoMap.set(raw.worktree_id, {
+            name: raw.name,
+            path: raw.data?.path,
+            archived: raw.archived,
+            filesystem_status: raw.filesystem_status
+          });
+        }
+        const userToWorktrees = /* @__PURE__ */ new Map();
+        for (const row of allOwnershipsForSymlinks) {
+          const raw = row;
+          const existing = userToWorktrees.get(raw.user_id) || [];
+          existing.push(raw.worktree_id);
+          userToWorktrees.set(raw.user_id, existing);
+        }
+        for (const user of validUsers) {
+          const worktreesDir = getUserWorktreesDir(user.unix_username);
+          if (verbose) {
+            this.log(chalk.gray(`   ${user.unix_username}: checking symlinks...`));
+          }
+          if (!existsSync(worktreesDir)) {
+            const setupCmds = UnixUserCommands.setupWorktreesDir(user.unix_username);
+            if (!await execAllCmds(setupCmds)) {
+              if (verbose) {
+                this.log(chalk.gray(`   \u26A0 Could not create ${worktreesDir}`));
+              }
+              continue;
+            }
+          }
+          if (existsSync(worktreesDir)) {
+            await execCmd(SymlinkCommands.removeBrokenSymlinks(worktreesDir));
+            symlinksCleaned++;
+          }
+          const ownedWtIds = userToWorktrees.get(user.user_id) || [];
+          for (const wtId of ownedWtIds) {
+            const wtInfo = wtInfoMap.get(wtId);
+            if (!wtInfo?.path) continue;
+            if (wtInfo.archived && wtInfo.filesystem_status === "deleted") continue;
+            if (!existsSync(wtInfo.path)) continue;
+            const symlinkPath = getWorktreeSymlinkPath(user.unix_username, wtInfo.name);
+            let needsCreate = true;
             try {
-              for (const cmd of UnixGroupCommands.setDirectoryGroup(
-                gitPath,
-                rawRepo.unix_group,
-                REPO_GIT_PERMISSION_MODE
-              )) {
-                execSync(cmd, { stdio: "pipe" });
+              const currentTarget = readlinkSync(symlinkPath);
+              if (currentTarget === wtInfo.path) {
+                needsCreate = false;
+              }
+            } catch {
+            }
+            if (!needsCreate) continue;
+            const symlinkCmds = SymlinkCommands.createSymlinkWithOwnership(
+              wtInfo.path,
+              symlinkPath,
+              user.unix_username
+            ).map((cmd) => `sudo -n ${cmd}`);
+            if (await execAllCmds(symlinkCmds)) {
+              symlinksCreated++;
+              if (verbose) {
+                this.log(
+                  chalk.green(`   \u2713 ${user.unix_username}: ${wtInfo.name} \u2192 ${wtInfo.path}`)
+                );
+              }
+            } else {
+              if (verbose) {
+                this.log(chalk.red(`   \u2717 Failed to create symlink for ${wtInfo.name}`));
               }
-              reposPermSynced++;
-              this.log(
-                chalk.green(`   \u2713 Applied .git permissions (${REPO_GIT_PERMISSION_MODE})
-`)
-              );
-            } catch (error) {
               syncErrors++;
-              this.log(chalk.red(`   \u2717 Failed: ${error}
-`));
             }
           }
         }
-        this.log(chalk.bold("Repo Permission Sync Summary:"));
-        this.log(`  Repos synced: ${reposPermSynced}${dryRun ? " (dry-run)" : ""}`);
-        if (syncErrors > 0) {
-          this.log(chalk.red(`  Errors: ${syncErrors}`));
+        if (symlinksCreated > 0 || symlinksCleaned > 0) {
+          this.log("");
+          this.log(chalk.bold("Symlink Sync Summary:"));
+          this.log(`  Symlinks created: ${symlinksCreated}${dryRun ? " (dry-run)" : ""}`);
+          this.log(`  Users cleaned: ${symlinksCleaned}${dryRun ? " (dry-run)" : ""}`);
+          this.log("");
+        } else {
+          this.log(chalk.green("   \u2713 All symlinks up to date\n"));
         }
-        this.log("");
       }
-      if (cleanupGroups || cleanupUsers) {
+      if (targetWorktreeId && (cleanupGroups || cleanupUsers)) {
+        this.log(chalk.gray("   \u2298 Skipping cleanup phase (--worktree-id mode)\n"));
+      } else if (cleanupGroups || cleanupUsers) {
         this.log(chalk.cyan.bold("\u2501\u2501\u2501 Cleanup \u2501\u2501\u2501\n"));
       }
-      if (cleanupGroups) {
+      if (cleanupGroups && !targetWorktreeId) {
         this.log(chalk.cyan("Checking for stale worktree groups...\n"));
         const allWorktrees = await select(db).from(worktrees).all();
         const expectedGroups = new Set(
@@ -772,7 +1071,7 @@ Hint: Running as root via sudo. Expected database at ~${sudoUser}/.agor/agor.db`
             (wt) => wt.unix_group || generateWorktreeGroupName(wt.worktree_id)
           )
         );
-        const systemGroups = this.listWorktreeGroups();
+        const systemGroups = listWorktreeGroups();
         if (verbose) {
           this.log(chalk.gray(`   Found ${systemGroups.length} agor_wt_* group(s) on system`));
           this.log(chalk.gray(`   Expected ${expectedGroups.size} group(s) from database`));
@@ -785,7 +1084,7 @@ Hint: Running as root via sudo. Expected database at ~${sudoUser}/.agor/agor.db`
 `));
           for (const groupName of staleGroups) {
             this.log(chalk.yellow(`   \u2192 Deleting group ${groupName}...`));
-            if (this.deleteGroup(groupName, dryRun)) {
+            if (await execCmd(UnixGroupCommands.deleteGroup(groupName))) {
               groupsDeleted++;
               this.log(chalk.green(`   \u2713 Deleted ${groupName}`));
             } else {
@@ -802,7 +1101,7 @@ Hint: Running as root via sudo. Expected database at ~${sudoUser}/.agor/agor.db`
             (r) => r.unix_group || generateRepoGroupName(r.repo_id)
           )
         );
-        const systemRepoGroups = this.listRepoGroups();
+        const systemRepoGroups = listRepoGroups();
         if (verbose) {
           this.log(chalk.gray(`   Found ${systemRepoGroups.length} agor_rp_* group(s) on system`));
           this.log(chalk.gray(`   Expected ${expectedRepoGroups.size} group(s) from database`));
@@ -817,7 +1116,7 @@ Hint: Running as root via sudo. Expected database at ~${sudoUser}/.agor/agor.db`
           );
           for (const groupName of staleRepoGroups) {
             this.log(chalk.yellow(`   \u2192 Deleting group ${groupName}...`));
-            if (this.deleteGroup(groupName, dryRun)) {
+            if (await execCmd(UnixGroupCommands.deleteGroup(groupName))) {
               groupsDeleted++;
               this.log(chalk.green(`   \u2713 Deleted ${groupName}`));
             } else {
@@ -828,12 +1127,12 @@ Hint: Running as root via sudo. Expected database at ~${sudoUser}/.agor/agor.db`
           this.log("");
         }
       }
-      if (cleanupUsers) {
+      if (cleanupUsers && !targetWorktreeId) {
         this.log(chalk.cyan("Checking for stale Agor users...\n"));
         const expectedUsers = new Set(
           validUsers.map((u) => u.unix_username).filter((u) => /^agor_[0-9a-f]{8}$/.test(u))
         );
-        const systemUsers = this.listAgorUsers();
+        const systemUsers = listAgorUsers();
         if (verbose) {
           this.log(chalk.gray(`   Found ${systemUsers.length} agor_* user(s) on system`));
           this.log(chalk.gray(`   Expected ${expectedUsers.size} user(s) from database`));
@@ -847,7 +1146,7 @@ Hint: Running as root via sudo. Expected database at ~${sudoUser}/.agor/agor.db`
           this.log(chalk.gray("   Note: Home directories will be kept\n"));
           for (const username of staleUsers) {
             this.log(chalk.yellow(`   \u2192 Deleting user ${username}...`));
-            if (this.deleteUser(username, dryRun)) {
+            if (await execCmd(UnixUserCommands.deleteUser(username))) {
               usersDeleted++;
               this.log(chalk.green(`   \u2713 Deleted ${username}`));
             } else {
@@ -869,15 +1168,28 @@ Hint: Running as root via sudo. Expected database at ~${sudoUser}/.agor/agor.db`
       this.log(`  Users created:     ${usersCreated}${dryRunSuffix}`);
       this.log(`  Groups created:    ${groupsCreated}${dryRunSuffix}`);
       this.log(`  Memberships added: ${groupsAdded}${dryRunSuffix}`);
+      this.log(`  Memberships removed: ${membershipsRemoved}${dryRunSuffix}`);
       if (daemonUser) {
         this.log(`  Daemon memberships: ${daemonMembershipsAdded}${dryRunSuffix}`);
       }
       this.log("");
       this.log(chalk.bold("Filesystem Sync:"));
+      this.log(`  WT groups backfilled: ${worktreesBackfilled}${dryRunSuffix}`);
       this.log(`  Worktrees synced:  ${worktreesSynced}${dryRunSuffix}`);
+      this.log(`  Dirs created:      ${worktreeDirsCreated}${dryRunSuffix}`);
+      this.log(`  Worktrees restored:${worktreesRestored}${dryRunSuffix}`);
+      this.log(`  Groups cleaned:    ${groupsCleaned}${dryRunSuffix}`);
+      this.log(`  Status fixed:      ${statusFixed}${dryRunSuffix}`);
+      this.log(`  Skipped:           ${worktreesSkipped}`);
+      this.log(`  Daemon ACLs:       ${daemonAclsApplied}${dryRunSuffix}`);
       this.log(`  Repos backfilled:  ${reposBackfilled}${dryRunSuffix}`);
       this.log(`  Repo perms synced: ${reposPermSynced}${dryRunSuffix}`);
+      this.log("");
+      this.log(chalk.bold("Symlinks:"));
+      this.log(`  Created:           ${symlinksCreated}${dryRunSuffix}`);
+      this.log(`  Users cleaned:     ${symlinksCleaned}${dryRunSuffix}`);
       if (syncErrors > 0) {
+        this.log("");
         this.log(chalk.red(`  Sync errors:       ${syncErrors}`));
       }
       if (cleanupGroups || cleanupUsers) {
@@ -894,7 +1206,7 @@ Hint: Running as root via sudo. Expected database at ~${sudoUser}/.agor/agor.db`
         this.log("");
         this.log(chalk.red(`Errors:              ${totalErrors}`));
       }
-      const hasChanges = usersCreated > 0 || groupsAdded > 0 || groupsCreated > 0 || daemonMembershipsAdded > 0 || usersDeleted > 0 || groupsDeleted > 0 || worktreesSynced > 0 || reposBackfilled > 0 || reposPermSynced > 0;
+      const hasChanges = usersCreated > 0 || groupsAdded > 0 || groupsCreated > 0 || daemonMembershipsAdded > 0 || membershipsRemoved > 0 || usersDeleted > 0 || groupsDeleted > 0 || worktreesSynced > 0 || worktreesBackfilled > 0 || worktreeDirsCreated > 0 || worktreesRestored > 0 || groupsCleaned > 0 || statusFixed > 0 || daemonAclsApplied > 0 || reposBackfilled > 0 || reposPermSynced > 0 || symlinksCreated > 0 || symlinksCleaned > 0;
       if (dryRun && hasChanges) {
         this.log(chalk.yellow("\nRun without --dry-run to apply changes"));
       }