canopycms 0.0.68-int.98 → 0.1.0

package/dist/worker/github-transfer.d.ts

@@ -0,0 +1,56 @@
+import { type GitHubGateway, type GitHubPushOutcome, type GitHubPushRequest } from './github-gateway.js';
+/** What the transfers need from the worker. */
+export interface TransferContext {
+    github(): GitHubGateway;
+    readonly remoteGitPath: string;
+    /**
+     * The inactivity bound on each git here run through worker/git-process.ts; its simple-git calls
+     * (init, for-each-ref, rev-parse) carry none.
+     */
+    readonly taskTimeoutMs: number;
+}
+/**
+ * Fetch every GitHub branch into `remote.git`'s tracking namespace (`GITHUB_TRACKING_REF_PREFIX`),
+ * which then holds exactly GitHub's branches. `have` is every tip `remote.git` holds, so the
+ * bundle carries only what it lacks. Returns GitHub's branches, and what an operator must fix in
+ * remote.git for the namespace to keep up, if anything (see {@link moveTrackingRefs}).
+ */
+export declare function fetchGitHubIntoRemoteGit(ctx: TransferContext, signal?: AbortSignal): Promise<{
+    refs: ReadonlyMap<string, string>;
+    needsOperator: string | null;
+}>;
+/**
+ * Seed the new bare repository at `gitDir`, which must not exist yet, with every GitHub branch as
+ * `refs/heads/*`, and return those branches. Refuses, before creating anything, when GitHub has no
+ * `baseBranch`.
+ */
+export declare function seedFromGitHub(ctx: TransferContext, gitDir: string, baseBranch: string, signal?: AbortSignal): Promise<ReadonlyMap<string, string>>;
+/**
+ * Of `ids`, the ones that are not a commit reachable from one of `tips` in the repository at
+ * `gitDir`, an annotated tag counting as the commit it points at. One `cat-file --batch-check`
+ * and one walk, so the answer is exactly what that repository holds.
+ */
+export declare function unreachableFrom(ctx: TransferContext, gitDir: string, ids: readonly string[], tips: readonly string[]): Promise<Set<string>>;
+/** A push to GitHub of the commit `readSha` finds, as {@link pushToGitHub} takes it. */
+export interface TransferPushRequest extends Omit<GitHubPushRequest, 'sha' | 'prerequisites'> {
+    /**
+     * Branches whose GitHub tips, as `remote.git`'s tracking namespace holds them, a bundle of
+     * `branch` is built on: the branch itself, and the base for a content branch. Missing ones are
+     * skipped.
+     */
+    prerequisiteBranches: readonly string[];
+}
+/**
+ * Push the commit `readSha` reads to GitHub, and resolve with it and what the push did. The push
+ * is asked for without objects first, which covers everything GitHub already holds; only when the
+ * gateway answers `need-objects` is a bundle built from `remote.git` and sent.
+ *
+ * The bundle must say what was read: its one head is `<sha> refs/heads/<branch>`, checked as it
+ * starts to stream. When the Lambda moved the branch in between, the push starts again from
+ * `readSha` (the caller's lease and history-rewrite marker are keyed to that commit), at most
+ * {@link MAX_PUSH_RESTARTS} times, so a ref moved on every pass cannot hold a task for ever.
+ */
+export declare function pushToGitHub(ctx: TransferContext, request: TransferPushRequest, readSha: () => Promise<string>, signal?: AbortSignal): Promise<{
+    sha: string;
+    outcome: GitHubPushOutcome;
+}>;

package/dist/worker/github-transfer.js

@@ -0,0 +1,444 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { Readable } from 'node:stream';
+import { GITHUB_TRACKING_REF_PREFIX } from '../git-manager.js';
+import { getErrorMessage } from '../utils/error.js';
+import { BundleHeaderReader, hasOnlyHead } from './bundle-header.js';
+import { runGit, spawnGit } from './git-process.js';
+import { MAX_FETCH_HAVE, } from './github-gateway.js';
+import { GitHubTransientError } from './github-mirror.js';
+import { workerLogWarn } from './log.js';
+import { sharedRepoGit, sharedRepoProcessOptions } from './shared-repo-git.js';
+/**
+ * The worker's side of moving objects between `remote.git` and GitHub, through the GitHub
+ * gateway (worker/github-gateway.ts), which never runs git in, or opens a path in, anything the
+ * Lambda can write. Objects cross as git bundles:
+ * - **GitHub → remote.git:** the gateway answers a fetch with GitHub's branches and a bundle of
+ *   what `remote.git` lacks; the worker unbundles it here, under the pins, and moves the tracking
+ *   namespace to those branches itself ({@link fetchGitHubIntoRemoteGit}, {@link seedFromGitHub});
+ * - **remote.git → GitHub:** the worker asks for the push first, and only when the gateway answers
+ *   `need-objects` builds a bundle here and sends it ({@link pushToGitHub}).
+ *
+ * The worker does not fsck what it receives: its peer is the gateway, and the objects came from
+ * GitHub. The gateway checks every object it is sent.
+ */
+const GIT_ZERO_OID = '0000000000000000000000000000000000000000';
+/** How many times a push restarts because the branch moved while its bundle was built. */
+const MAX_PUSH_RESTARTS = 3;
+/**
+ * Fetch every GitHub branch into `remote.git`'s tracking namespace (`GITHUB_TRACKING_REF_PREFIX`),
+ * which then holds exactly GitHub's branches. `have` is every tip `remote.git` holds, so the
+ * bundle carries only what it lacks. Returns GitHub's branches, and what an operator must fix in
+ * remote.git for the namespace to keep up, if anything (see {@link moveTrackingRefs}).
+ */
+export async function fetchGitHubIntoRemoteGit(ctx, signal) {
+    const gitDir = ctx.remoteGitPath;
+    const { refs, bundleId } = await ctx.github().fetch({ have: await haveOf(gitDir) }, signal);
+    if (bundleId !== null)
+        await unbundle(ctx, gitDir, bundleId, signal);
+    const needsOperator = await moveTrackingRefs(ctx, gitDir, refs, signal);
+    return { refs, needsOperator };
+}
+/**
+ * Seed the new bare repository at `gitDir`, which must not exist yet, with every GitHub branch as
+ * `refs/heads/*`, and return those branches. Refuses, before creating anything, when GitHub has no
+ * `baseBranch`.
+ */
+export async function seedFromGitHub(ctx, gitDir, baseBranch, signal) {
+    const { refs, bundleId } = await ctx.github().fetch({ have: [] }, signal);
+    if (!refs.has(baseBranch))
+        throw new Error(`GitHub has no branch '${baseBranch}'`);
+    await fs.mkdir(gitDir);
+    await sharedRepoGit(gitDir, 'bare').raw(['init', '--quiet', '--bare']);
+    if (bundleId !== null)
+        await unbundle(ctx, gitDir, bundleId, signal);
+    await updateRefs(ctx, gitDir, [...refs].map(([name, sha]) => ({ ref: `refs/heads/${name}`, to: sha, from: GIT_ZERO_OID })), signal);
+    return refs;
+}
+/**
+ * Of `ids`, the ones that are not a commit reachable from one of `tips` in the repository at
+ * `gitDir`, an annotated tag counting as the commit it points at. One `cat-file --batch-check`
+ * and one walk, so the answer is exactly what that repository holds.
+ */
+export async function unreachableFrom(ctx, gitDir, ids, tips) {
+    const unreachable = new Set();
+    const peeled = new Map();
+    const valid = ids.filter((id) => {
+        if (OBJECT_ID.test(id))
+            return true;
+        unreachable.add(id);
+        return false;
+    });
+    if (valid.length > 0) {
+        const lines = (await runGit(['cat-file', '--batch-check=%(objectname) %(objecttype)', '--end-of-options'], {
+            ...sharedRepoProcessOptions(gitDir, 'bare'),
+            stdin: valid.map((id) => `${id}^{commit}\n`).join(''),
+            inactivityTimeoutMs: ctx.taskTimeoutMs,
+        })).split('\n');
+        valid.forEach((id, i) => {
+            const match = /^([0-9a-f]{40}|[0-9a-f]{64}) commit$/.exec(lines[i] ?? '');
+            if (match)
+                peeled.set(id, match[1]);
+            else
+                unreachable.add(id);
+        });
+    }
+    const commits = [...new Set(peeled.values())];
+    if (commits.length > 0) {
+        const notReached = new Set((await runGit(['rev-list', '--stdin', '--end-of-options'], {
+            ...sharedRepoProcessOptions(gitDir, 'bare'),
+            stdin: [...commits, ...tips.map((tip) => `^${tip}`)].map((l) => `${l}\n`).join(''),
+            inactivityTimeoutMs: ctx.taskTimeoutMs,
+        }))
+            .split('\n')
+            .filter(Boolean));
+        for (const [id, commit] of peeled)
+            if (notReached.has(commit))
+                unreachable.add(id);
+    }
+    return unreachable;
+}
+/**
+ * Push the commit `readSha` reads to GitHub, and resolve with it and what the push did. The push
+ * is asked for without objects first, which covers everything GitHub already holds; only when the
+ * gateway answers `need-objects` is a bundle built from `remote.git` and sent.
+ *
+ * The bundle must say what was read: its one head is `<sha> refs/heads/<branch>`, checked as it
+ * starts to stream. When the Lambda moved the branch in between, the push starts again from
+ * `readSha` (the caller's lease and history-rewrite marker are keyed to that commit), at most
+ * {@link MAX_PUSH_RESTARTS} times, so a ref moved on every pass cannot hold a task for ever.
+ */
+export async function pushToGitHub(ctx, request, readSha, signal) {
+    const { prerequisiteBranches, ...rest } = request;
+    for (let restarts = 0;; restarts++) {
+        const sha = await readSha();
+        const prerequisites = await trackingTips(ctx.remoteGitPath, prerequisiteBranches);
+        const ask = { ...rest, sha, prerequisites };
+        const first = await ctx.github().push(ask, undefined, signal);
+        if (first.kind === 'pushed')
+            return { sha, outcome: outcomeOf(first) };
+        const bundle = await startBundle(ctx, request.branch, sha, first.usable, signal);
+        if (bundle === 'moved') {
+            if (restarts < MAX_PUSH_RESTARTS)
+                continue;
+            throw new GitHubTransientError('ref-kept-moving', `${request.branch} moved in remote.git while its push was being prepared, ` +
+                `${MAX_PUSH_RESTARTS + 1} times in a row`);
+        }
+        // Nothing to bundle: what is left to send, GitHub has. A second `need-objects` would only
+        // ask for the same again.
+        const second = await (bundle === 'empty'
+            ? ctx.github().push(ask, undefined, signal)
+            : sendBundle(ctx, ask, bundle, signal));
+        if (second.kind === 'pushed')
+            return { sha, outcome: outcomeOf(second) };
+        throw new GitHubTransientError('objects-still-needed', `The GitHub gateway still lacks objects for ${request.branch} after they were offered`);
+    }
+}
+function outcomeOf(answer) {
+    const { kind: _kind, ...outcome } = answer;
+    return outcome;
+}
+/**
+ * Start `bundle create` of `refs/heads/<branch>` in `remote.git`, built on `usable`, and read its
+ * header: `moved` when its head is not `sha`, `empty` when git refused an empty bundle (GitHub
+ * already has every commit it would hold), else the bundle to send, each prerequisite's comment
+ * shortened to what the gateway takes.
+ */
+async function startBundle(ctx, branch, sha, usable, signal) {
+    const proc = spawnGit(['bundle', 'create', '--progress', '--end-of-options', '-', `refs/heads/${branch}`, '--stdin'], {
+        ...sharedRepoProcessOptions(ctx.remoteGitPath, 'bare'),
+        stdin: usable
+            .filter((id) => OBJECT_ID.test(id))
+            .map((id) => `^${id}\n`)
+            .join(''),
+        inactivityTimeoutMs: ctx.taskTimeoutMs,
+        signal,
+    });
+    const chunks = proc.stdout[Symbol.asyncIterator]();
+    // A prerequisite's comment is a commit subject, any length; the gateway takes only a short one.
+    const reader = new BundleHeaderReader('shorten');
+    let unreadable = null;
+    try {
+        for (;;) {
+            const next = await chunks.next();
+            if (next.done)
+                break;
+            let read;
+            try {
+                read = reader.push(next.value);
+            }
+            catch (err) {
+                unreadable = err;
+                break;
+            }
+            if (read === null)
+                continue;
+            if (!hasOnlyHead(read.header, sha, branch)) {
+                proc.kill('the branch moved');
+                return 'moved';
+            }
+            const { bytes, rest: first } = read;
+            const stream = Readable.from((async function* () {
+                yield bytes;
+                if (first.length > 0)
+                    yield first;
+                for (;;) {
+                    const rest = await chunks.next();
+                    if (rest.done)
+                        return;
+                    yield rest.value;
+                }
+            })());
+            return { process: proc, stream };
+        }
+    }
+    catch (err) {
+        throw await causeOf(proc, err, 'its header could not be read');
+    }
+    if (unreadable !== null) {
+        // git writes a header with no head before it refuses an empty bundle, so its exit says which
+        // this is. Otherwise the header is the failure, whatever git makes of losing its reader.
+        proc.stdout.destroy();
+        if (await refusedAsEmpty(proc).catch(() => false))
+            return 'empty';
+        throw unreadable;
+    }
+    // stdout ended before a whole header: git failed, or found nothing to bundle.
+    if (await refusedAsEmpty(proc))
+        return 'empty';
+    throw new Error(`git bundle create printed no header for ${branch}`);
+}
+/** Whether `bundle create` exited refusing an empty bundle; any other failure is thrown. */
+async function refusedAsEmpty(proc) {
+    try {
+        await proc.exited;
+        return false;
+    }
+    catch (err) {
+        if (/Refusing to create empty bundle/.test(getErrorMessage(err)))
+            return true;
+        throw err;
+    }
+}
+/**
+ * Send a started bundle with the push. When the push fails, git's own failure, if it had one,
+ * is the cause; otherwise the gateway's.
+ */
+async function sendBundle(ctx, request, bundle, signal) {
+    let answer;
+    try {
+        answer = await ctx.github().push(request, bundle.stream, signal);
+    }
+    catch (err) {
+        throw await causeOf(bundle.process, err, 'the push failed');
+    }
+    // An answer is the push's outcome; how git exits after it changes nothing.
+    await bundle.process.exited.catch(() => undefined);
+    return answer;
+}
+/**
+ * What to report for a failure while `proc` was writing a bundle: git's own failure when it had
+ * one first (an abort, an inactivity kill, an error of its own), of which a stream error is only
+ * the symptom, else `err`. Stops git either way, with `reason`.
+ */
+async function causeOf(proc, err, reason) {
+    proc.kill(reason);
+    const own = await proc.exited.then(() => null, (gitErr) => gitErr);
+    return own !== null && getErrorMessage(own) !== reason ? own : err;
+}
+/**
+ * Unbundle the gateway's bundle `bundleId` into the repository at `gitDir`, under the pins. It
+ * adds objects and moves no ref.
+ */
+async function unbundle(ctx, gitDir, bundleId, signal) {
+    const stream = await ctx.github().openBundle(bundleId);
+    try {
+        await runGit(['bundle', 'unbundle', '--progress', '--end-of-options', '-'], {
+            ...sharedRepoProcessOptions(gitDir, 'bare'),
+            stdin: stream,
+            inactivityTimeoutMs: ctx.taskTimeoutMs,
+            signal,
+        });
+    }
+    finally {
+        stream.destroy();
+    }
+}
+/**
+ * Move the tracking namespace to exactly `refs`, every move stating the value it expects: all
+ * deletions in one `update-ref` transaction, then every create and update in another. One
+ * transaction cannot do both: deleting `a` and creating `a/b` together fails on the
+ * directory/file conflict, and a transaction is all-or-nothing, so a GitHub-side rename of
+ * `release` to `release/1.0` would freeze the namespace for ever. When a transaction fails on a
+ * ref (see {@link lostRace}), each of its moves is tried on its own, and the losers are logged;
+ * the next fetch retries them. The Lambda only reads this namespace, so per-ref
+ * atomicity is all it needs.
+ */
+async function moveTrackingRefs(ctx, gitDir, refs, signal) {
+    let needsOperator = null;
+    const current = new Map();
+    const listing = await sharedRepoGit(gitDir, 'bare').raw([
+        'for-each-ref',
+        '--format=%(objectname) %(refname)',
+        '--end-of-options',
+        GITHUB_TRACKING_REF_PREFIX,
+    ]);
+    for (const line of listing.split('\n')) {
+        const space = line.indexOf(' ');
+        if (space !== -1)
+            current.set(line.slice(space + 1), line.slice(0, space));
+    }
+    const deletions = [];
+    for (const [ref, sha] of current) {
+        if (!refs.has(ref.slice(GITHUB_TRACKING_REF_PREFIX.length))) {
+            deletions.push({ ref, to: null, from: sha });
+        }
+    }
+    const updates = [];
+    for (const [name, sha] of refs) {
+        const ref = `${GITHUB_TRACKING_REF_PREFIX}${name}`;
+        const from = current.get(ref);
+        if (from !== sha)
+            updates.push({ ref, to: sha, from: from ?? GIT_ZERO_OID });
+    }
+    for (const moves of [deletions, updates]) {
+        if (moves.length === 0)
+            continue;
+        try {
+            await updateRefs(ctx, gitDir, moves, signal);
+        }
+        catch (err) {
+            if (!lostRace(err))
+                throw err;
+            const losers = [];
+            if (PACKED_REFS_LOCKED.test(getErrorMessage(err))) {
+                // Every deletion takes packed-refs.lock, so each would wait for it and lose the same way.
+                losers.push(...moves.map((move) => move.ref));
+                needsOperator = await stalePackedRefsLock(gitDir);
+            }
+            else {
+                for (const move of moves) {
+                    await updateRefs(ctx, gitDir, [move], signal).catch((moveErr) => {
+                        if (!lostRace(moveErr))
+                            throw moveErr;
+                        losers.push(move.ref);
+                    });
+                }
+            }
+            if (losers.length > 0) {
+                workerLogWarn(`Could not move ${losers.length} GitHub tracking ref(s), retrying next sync: ` +
+                    `${losers.join(', ')} (${getErrorMessage(err).trim()})`);
+            }
+        }
+    }
+    return needsOperator;
+}
+const PACKED_REFS_LOCKED = /Unable to create '[^']*packed-refs\.lock': File exists/;
+/** How old remote.git's packed-refs.lock must be before the worker reports it as left behind. */
+const STALE_PACKED_REFS_LOCK_MS = 10 * 60 * 1000;
+/**
+ * What to tell an operator about remote.git's `packed-refs.lock` once it is older than
+ * {@link STALE_PACKED_REFS_LOCK_MS}, which no git holds it for: a writer killed mid-delete left
+ * it, and it blocks every branch deletion there, the Lambda's included. The worker never removes
+ * it: the Lambda shares the repository, and the worker cannot tell a lock left behind from one
+ * a live writer holds on a host whose clock or NFS attributes it does not see.
+ */
+async function stalePackedRefsLock(gitDir) {
+    const lock = path.join(gitDir, 'packed-refs.lock');
+    const stat = await fs.stat(lock).catch(() => null);
+    if (stat === null || Date.now() - stat.mtimeMs < STALE_PACKED_REFS_LOCK_MS)
+        return null;
+    return (`${lock} has been there since ${stat.mtime.toISOString()}: a git killed while it deleted a ` +
+        `branch left it, and every branch deletion in remote.git fails until it is removed. ` +
+        `Check that no git is running in remote.git, then remove that file.`);
+}
+/**
+ * Whether `update-ref` failed because a ref was not at the value a move stated, a lock was held
+ * (a ref's own, or `packed-refs.lock`, which every deletion takes), or a directory/file conflict
+ * stood in the way: a failure confined to the namespace's refs, logged and retried by the next
+ * fetch, which never holds back the other transaction. Anything else (an abort, a missing object)
+ * is thrown.
+ */
+function lostRace(err) {
+    return /cannot lock ref|Unable to create '[^']*\.lock': File exists|exists; cannot create/.test(getErrorMessage(err));
+}
+/** Apply `moves` as one `update-ref` transaction, NUL-separated, so no refname can split a line. */
+async function updateRefs(ctx, gitDir, moves, signal) {
+    const input = moves
+        .map((move) => {
+        if (move.ref.includes('\0'))
+            throw new Error(`A ref name holds a NUL: ${JSON.stringify(move.ref)}`);
+        return move.to === null
+            ? `delete ${move.ref}\0${move.from}\0`
+            : `update ${move.ref}\0${move.to}\0${move.from}\0`;
+    })
+        .join('');
+    await runGit(['update-ref', '-z', '--stdin', '--end-of-options'], {
+        ...sharedRepoProcessOptions(gitDir, 'bare'),
+        stdin: input,
+        inactivityTimeoutMs: ctx.taskTimeoutMs,
+        signal,
+    });
+}
+/**
+ * What `gitDir` has, for a fetch's `have`, up to {@link MAX_FETCH_HAVE} IDs: its GitHub tracking
+ * tips first, which describe most of what GitHub has, then its branches' tips. With no tracking
+ * ref at all (a remote.git no fetch has written yet), a branch ahead of GitHub names no commit
+ * the gateway holds, and the bundle would resend history remote.git already has, so each branch
+ * then adds its first-parent ancestors 1, 2, 4, … commits back, as git's own negotiation does.
+ */
+async function haveOf(gitDir) {
+    const list = async (namespace) => (await sharedRepoGit(gitDir, 'bare').raw([
+        'for-each-ref',
+        '--format=%(objectname)',
+        '--end-of-options',
+        namespace,
+    ]))
+        .split('\n')
+        .filter((id) => OBJECT_ID.test(id));
+    const tracking = await list(GITHUB_TRACKING_REF_PREFIX);
+    const heads = await list('refs/heads/');
+    const have = new Set([...tracking, ...heads]);
+    if (tracking.length === 0) {
+        for (const tip of new Set(heads)) {
+            if (have.size >= MAX_FETCH_HAVE)
+                break;
+            const ancestors = (await sharedRepoGit(gitDir, 'bare').raw([
+                'rev-list',
+                '--first-parent',
+                `--max-count=${SKIP_LIST_DEPTH}`,
+                '--end-of-options',
+                tip,
+            ]))
+                .split('\n')
+                .filter((id) => OBJECT_ID.test(id));
+            for (let step = 1; step < ancestors.length; step *= 2)
+                have.add(ancestors[step]);
+            if (ancestors.length > 0)
+                have.add(ancestors[ancestors.length - 1]);
+        }
+    }
+    return [...have].slice(0, MAX_FETCH_HAVE);
+}
+/** How far back {@link haveOf} looks along one branch. */
+const SKIP_LIST_DEPTH = 4096;
+/** The tracking-namespace tips of `branches` in `gitDir`, skipping any it lacks. */
+async function trackingTips(gitDir, branches) {
+    const tips = [];
+    for (const branch of new Set(branches)) {
+        const sha = await sharedRepoGit(gitDir, 'bare')
+            .raw([
+            'rev-parse',
+            '--verify',
+            '--quiet',
+            '--end-of-options',
+            `${GITHUB_TRACKING_REF_PREFIX}${branch}`,
+        ])
+            .then((out) => out.split('\n')[0] ?? '')
+            .catch(() => '');
+        if (OBJECT_ID.test(sha) && !tips.includes(sha))
+            tips.push(sha);
+    }
+    return tips;
+}
+const OBJECT_ID = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/;

package/dist/worker/history-rewrite.d.ts

@@ -23,10 +23,9 @@ export type HistoryRewriteContext = Pick<WorkerContext, 'remoteGitPath' | 'conte
  * What `remote.git` currently holds for `branchRef`, or null when this branch
  * was never published there (never submitted) or the ref is unreadable.
  *
- * Explicit `--git-dir`, like verifyBaseBranchExists() in cms-worker.ts:
- * reading a bare repo that way does not depend on `safe.bareRepository` being
- * permissive, which is why prod code takes this route rather than the config
- * override the test-only `openBareRepo` helper uses.
+ * Names the repository outright (sharedRepoGit's GIT_DIR), like
+ * verifyBaseBranchExists() in cms-worker.ts: reading a bare repo that way does
+ * not depend on `safe.bareRepository` being permissive.
  */
 export declare function readPublishedSha(ctx: Pick<HistoryRewriteContext, 'remoteGitPath'>, branchRef: string): Promise<string | null>;
 /**
@@ -55,7 +54,7 @@ export declare function markHistoryRewritten(ctx: Pick<HistoryRewriteContext, 'c
  * it on GitHub" diagnosis that is false -- we did.
  *
  * Tracked, with the concurrent-clear race that can drop a marker mid-arming,
- * in .claude/future-tasks/worker-history-rewrite-marker-races.md.
+ * in safeinsights/canopycms#902.
  */
 export declare function clearHistoryRewrittenMarker(ctx: Pick<HistoryRewriteContext, 'contentBranchesPath'>, branchPath: string, branchDir: string): Promise<void>;
 /**

package/dist/worker/history-rewrite.js

@@ -1,26 +1,22 @@
 import path from 'node:path';
-import { simpleGit } from 'simple-git';
 import { BranchMetadataFileManager, getBranchMetadataFileManager } from '../branch-metadata.js';
-import { gitChildEnv } from '../git-manager.js';
 import { sanitizeBranchName } from '../paths/branch-name.js';
 import { getErrorMessage, redactCredentials } from '../utils/error.js';
 import { isStaleLeaseRejection } from '../utils/git.js';
 import { enqueueTask, listTasks } from '../task-queue/cms-task-queue.js';
+import { pinnedReceivePack, sharedRepoGit } from './shared-repo-git.js';
 import { workerLog, workerLogWarn } from './log.js';
 /**
  * What `remote.git` currently holds for `branchRef`, or null when this branch
  * was never published there (never submitted) or the ref is unreadable.
  *
- * Explicit `--git-dir`, like verifyBaseBranchExists() in cms-worker.ts:
- * reading a bare repo that way does not depend on `safe.bareRepository` being
- * permissive, which is why prod code takes this route rather than the config
- * override the test-only `openBareRepo` helper uses.
+ * Names the repository outright (sharedRepoGit's GIT_DIR), like
+ * verifyBaseBranchExists() in cms-worker.ts: reading a bare repo that way does
+ * not depend on `safe.bareRepository` being permissive.
  */
 export async function readPublishedSha(ctx, branchRef) {
     try {
-        const out = await simpleGit().raw([
-            '--git-dir',
-            ctx.remoteGitPath,
+        const out = await sharedRepoGit(ctx.remoteGitPath, 'bare').raw([
             'rev-parse',
             '--verify',
             `refs/heads/${branchRef}`,
@@ -66,7 +62,7 @@ export async function markHistoryRewritten(ctx, branchPath, branchDir, expectedS
  * it on GitHub" diagnosis that is false -- we did.
  *
  * Tracked, with the concurrent-clear race that can drop a marker mid-arming,
- * in .claude/future-tasks/worker-history-rewrite-marker-races.md.
+ * in safeinsights/canopycms#902.
  */
 export async function clearHistoryRewrittenMarker(ctx, branchPath, branchDir) {
     try {
@@ -94,17 +90,16 @@ export async function clearHistoryRewrittenMarker(ctx, branchPath, branchDir) {
  * push moved the ref; logged and retried by the self-heal pass, never thrown.
  */
 export async function forcePublishToLocalRemote(ctx, branchPath, branchRef, expectedSha) {
-    // A dedicated instance rather than the caller's: `.env()` replaces the whole
-    // child environment, and the rebase loop's instance must keep its ambient
-    // one. gitChildEnv (not gitNetworkChildEnv) because this push targets the
-    // local bare repo -- and its locale pin is what keeps isStaleLeaseRejection
-    // below from silently becoming a no-op on a non-English host.
-    const pushGit = simpleGit({ baseDir: branchPath, timeout: { block: ctx.taskTimeoutMs } });
-    pushGit.env(gitChildEnv({}));
+    // sharedRepoGit's env is gitChildEnv's, whose C-locale pin is what keeps
+    // isStaleLeaseRejection below from silently becoming a no-op on a
+    // non-English host.
+    const pushGit = sharedRepoGit(branchPath, 'worktree', { timeout: { block: ctx.taskTimeoutMs } });
     try {
         await pushGit.raw([
             'push',
             `--force-with-lease=${branchRef}:${expectedSha}`,
+            // Otherwise remote.git's own hooks run, as the worker.
+            `--receive-pack=${pinnedReceivePack()}`,
             // Real flags must precede --end-of-options; everything after it is
             // positional (see GitManager.push() for the same guard).
             '--end-of-options',

package/dist/worker/provisioned-workspace.d.ts

@@ -18,17 +18,17 @@ export type ProvisionedWorkspaceHold = {
 };
 /**
  * Take a branch workspace's provisioning lock for the sync loop, the same cross-host lock the
- * Lambda holds while it clones the workspace (`branch-workspace.ts`), so the worker never runs git
- * against a half-made clone. The caller holds it across its dirty check and every git step, and
+ * Lambda holds while it publishes the workspace (branch-provisioning.ts) and admin actions hold
+ * while they repair or purge it. The caller holds it across its dirty check and every git step, and
  * releases it in a `finally`.
  *
  * Zero retries: the worker skips and retries next cycle rather than wait, so it never blocks on
  * the Lambda and cannot deadlock with it. The rebase nests the content-write lock inside this one;
  * the worker takes that one try-only as well, so the nesting cannot deadlock either.
  *
- * Provisioned means a `.git` directory AND `branch.json`. The Lambda clones directly into the
- * target path, so `.git` appears early, and writes `branch.json` only after the clone and its
- * lock are done.
+ * Provisioned means a `.git` directory AND `branch.json`. A workspace is published complete with
+ * both ([PROV-1], branch-provisioning.ts), so anything else at a branch name is a leftover for
+ * `repairBranchDirResidue` (git-sync.ts).
  */
 export declare function holdProvisionedWorkspace(contentBranchesPath: string, dirName: string): Promise<ProvisionedWorkspaceHold>;
 /** Release a hold, logging rather than throwing: the sync loop's callers never throw. */

package/dist/worker/provisioned-workspace.js

@@ -6,17 +6,17 @@ import { branchProvisioningLockName, tryAcquireProvisioningLock } from '../utils
 import { workerLogWarn } from './log.js';
 /**
  * Take a branch workspace's provisioning lock for the sync loop, the same cross-host lock the
- * Lambda holds while it clones the workspace (`branch-workspace.ts`), so the worker never runs git
- * against a half-made clone. The caller holds it across its dirty check and every git step, and
+ * Lambda holds while it publishes the workspace (branch-provisioning.ts) and admin actions hold
+ * while they repair or purge it. The caller holds it across its dirty check and every git step, and
  * releases it in a `finally`.
  *
  * Zero retries: the worker skips and retries next cycle rather than wait, so it never blocks on
  * the Lambda and cannot deadlock with it. The rebase nests the content-write lock inside this one;
  * the worker takes that one try-only as well, so the nesting cannot deadlock either.
  *
- * Provisioned means a `.git` directory AND `branch.json`. The Lambda clones directly into the
- * target path, so `.git` appears early, and writes `branch.json` only after the clone and its
- * lock are done.
+ * Provisioned means a `.git` directory AND `branch.json`. A workspace is published complete with
+ * both ([PROV-1], branch-provisioning.ts), so anything else at a branch name is a leftover for
+ * `repairBranchDirResidue` (git-sync.ts).
  */
 export async function holdProvisionedWorkspace(contentBranchesPath, dirName) {
     let release;

package/dist/worker/rebase.d.ts

@@ -20,7 +20,7 @@ import type { WorkerContext } from './worker-context.js';
  * but still need their PR's resolution polled, and this loop is the only thing
  * that walks every branch workspace.
  */
-export type RebaseContext = Pick<WorkerContext, 'githubOwner' | 'githubRepo' | 'baseBranch' | 'sanitizedBaseBranch' | 'contentBranchesPath' | 'contentRoot' | 'remoteGitPath' | 'taskDir' | 'taskTimeoutMs' | 'octokit' | 'afterConflictDetectedForTesting' | 'afterRebaseCompletedForTesting' | 'ensureSettingsBranch'>;
+export type RebaseContext = Pick<WorkerContext, 'baseBranch' | 'sanitizedBaseBranch' | 'contentBranchesPath' | 'contentRoot' | 'remoteGitPath' | 'taskDir' | 'taskTimeoutMs' | 'github' | 'afterConflictDetectedForTesting' | 'afterRebaseCompletedForTesting' | 'ensureSettingsBranch' | 'isDraining'>;
 /**
  * Per-cycle outcome of `rebaseActiveBranches()`, folded by `syncGit()` into the
  * worker's self-reported status (`WorkerStatusReport.lastGitSync`, see