dev-orchestrator-connector 0.1.0 → 0.1.1

package/dist/publisher.js

@@ -0,0 +1,182 @@
+import { mkdtemp, readFile, writeFile, rm, realpath, lstat, access, mkdir } from "node:fs/promises";
+import { join, resolve, sep } from "node:path";
+import { tmpdir } from "node:os";
+import { command, cleanGitEnv } from "./process.js";
+import { withGitHubCredential, validateGitHubCredential } from "./git-credential.js";
+import { validBranch, validRepository } from "./workspace.js";
+const validSHA = (sha) => /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(sha);
+export class Publisher {
+    context;
+    runCommand;
+    apiFetch;
+    remoteURL;
+    constructor(context, dependencies = {}) {
+        if (!validRepository(context.repository) || !validBranch(context.branch) || !validBranch(context.baseBranch) || context.branch === context.baseBranch || !context.branch.startsWith("task/") || !validSHA(context.baseline))
+            throw new Error("Invalid publication context.");
+        this.context = context;
+        this.runCommand = dependencies.runCommand ?? command;
+        this.apiFetch = dependencies.apiFetch ?? fetch;
+        this.remoteURL = dependencies.remoteURL ?? (repository => `https://github.com/${repository}.git`);
+    }
+    async status(signal) {
+        return this.trusted(async (git, sha) => {
+            const uncommitted = await git(["diff", "--no-ext-diff", "--no-textconv", "--quiet", sha, "--"], true);
+            const untracked = await git(["ls-files", "--others", "--exclude-standard"]);
+            if (uncommitted.code !== 0 || untracked.output)
+                throw new Error("Uncommitted changes remain. Codex must commit the task before publication.");
+            const diff = await git(["diff", "--no-ext-diff", "--no-textconv", "--quiet", this.context.baseline, sha, "--"], true);
+            return { changed: diff.code === 1, commit: sha };
+        }, signal);
+    }
+    async publish(title, body, credential, signal) {
+        if (!title.trim() || title.length > 240 || body.length > 64_000)
+            throw new Error("Invalid PR metadata.");
+        validateGitHubCredential(credential);
+        const status = await this.status(signal);
+        if (!status.changed)
+            throw new Error("No committed changes to publish.");
+        return this.trusted(async (git, sha, temp, objects) => {
+            await withGitHubCredential(temp, credential, env => git(["push", "--no-verify", this.remoteURL(this.context.repository), `${sha}:refs/heads/${this.context.branch}`], false, { ...env, GIT_OBJECT_DIRECTORY: objects }));
+            let pr = await this.findOpenPullRequest(credential, signal);
+            if (!pr) {
+                const [owner] = this.context.repository.split("/");
+                const created = await this.githubRequest("POST", `/repos/${this.context.repository}/pulls`, credential, {
+                    title,
+                    head: `${owner}:${this.context.branch}`,
+                    base: this.context.baseBranch,
+                    body,
+                    draft: false
+                }, signal);
+                if (created.status === 422)
+                    pr = await this.findOpenPullRequest(credential, signal);
+                else if (created.ok)
+                    pr = created.body;
+                else
+                    throw new Error("GitHub could not create a pull request for this branch.");
+            }
+            if (!this.matchesPullRequest(pr, sha))
+                throw new Error("GitHub pull request does not match the task commit.");
+            return { repository: this.context.repository, branch: this.context.branch, base_branch: this.context.baseBranch, commit: sha, pr_url: pr.html_url };
+        }, signal);
+    }
+    async findOpenPullRequest(credential, signal) {
+        const [owner] = this.context.repository.split("/");
+        const query = new URLSearchParams({ state: "open", head: `${owner}:${this.context.branch}`, per_page: "100" });
+        const response = await this.githubRequest("GET", `/repos/${this.context.repository}/pulls?${query}`, credential, undefined, signal);
+        if (!response.ok || !Array.isArray(response.body))
+            throw new Error("GitHub pull request lookup failed.");
+        const sameBranch = response.body.filter((pr) => pr?.head?.ref === this.context.branch && pr?.head?.repo?.full_name === this.context.repository);
+        const exact = sameBranch.find((pr) => pr?.base?.ref === this.context.baseBranch && pr?.base?.repo?.full_name === this.context.repository);
+        if (sameBranch.length && !exact)
+            throw new Error("An open pull request exists for this task branch with a different base repository or branch.");
+        return exact;
+    }
+    matchesPullRequest(pr, sha) {
+        const escaped = this.context.repository.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+        return pr?.state === "open" && pr?.head?.sha === sha && pr?.head?.ref === this.context.branch &&
+            pr?.head?.repo?.full_name === this.context.repository && pr?.base?.ref === this.context.baseBranch &&
+            pr?.base?.repo?.full_name === this.context.repository &&
+            new RegExp(`^https://github\\.com/${escaped}/pull/[0-9]+$`).test(pr?.html_url ?? "");
+    }
+    async githubRequest(method, path, credential, body, signal) {
+        const timeout = AbortSignal.timeout(15_000);
+        const requestSignal = signal ? AbortSignal.any([signal, timeout]) : timeout;
+        let response;
+        try {
+            response = await this.apiFetch("https://api.github.com" + path, {
+                method, redirect: "error", signal: requestSignal,
+                headers: { authorization: `Bearer ${credential.token}`, accept: "application/vnd.github+json", "x-github-api-version": "2022-11-28", "content-type": "application/json", "user-agent": "dev-orchestrator" },
+                ...(body ? { body: JSON.stringify(body) } : {})
+            });
+        }
+        catch {
+            throw new Error("GitHub pull request service is temporarily unavailable.");
+        }
+        let payload;
+        try {
+            payload = await response.json();
+        }
+        catch {
+            throw new Error("GitHub returned an invalid pull request response.");
+        }
+        return { ok: response.ok, status: response.status, body: payload };
+    }
+    async trusted(fn, signal) {
+        const workspace = await realpath(this.context.workspace);
+        const pointer = join(workspace, ".git");
+        const stat = await lstat(pointer);
+        if (stat.isSymbolicLink() || (!stat.isDirectory() && !stat.isFile()))
+            throw new Error("Publication needs valid Git metadata.");
+        let gitDir;
+        let commonDir;
+        if (stat.isDirectory()) {
+            gitDir = workspace + sep + ".git";
+            commonDir = gitDir;
+        }
+        else {
+            const content = await readFile(pointer, "utf8");
+            const match = content.match(/^gitdir: (.+)\r?\n?$/);
+            if (!match)
+                throw new Error("Publication needs valid Git worktree metadata.");
+            gitDir = await realpath(resolve(workspace, match[1]));
+            commonDir = await realpath(join(gitDir, "..", ".."));
+            const worktrees = await realpath(join(commonDir, "worktrees"));
+            if (!gitDir.startsWith(worktrees + sep) || gitDir.slice(worktrees.length + 1).includes(sep))
+                throw new Error("Publication worktree metadata escaped its repository.");
+        }
+        const objects = await realpath(join(commonDir, "objects"));
+        if (!objects.startsWith(commonDir + sep))
+            throw new Error("Publication needs an internal Git object directory.");
+        for (const forbidden of ["info/alternates", "info/http-alternates"]) {
+            try {
+                await access(join(objects, forbidden));
+                throw new Error("External Git object stores are not supported.");
+            }
+            catch (error) {
+                if (error.code !== "ENOENT")
+                    throw error;
+            }
+        }
+        const head = await readFile(join(gitDir, "HEAD"), "utf8");
+        if (head.trim() !== `ref: refs/heads/${this.context.branch}`)
+            throw new Error("Task branch changed unexpectedly.");
+        const ref = join(commonDir, "refs", "heads", this.context.branch);
+        const resolved = await realpath(ref);
+        if (!resolved.startsWith(commonDir + sep))
+            throw new Error("Unsafe Git reference.");
+        const sha = (await readFile(ref, "utf8")).trim();
+        if (!validSHA(sha))
+            throw new Error("Invalid task commit.");
+        const temporary = await mkdtemp(join(tmpdir(), "dev-orchestrator-publish-"));
+        try {
+            const bare = join(temporary, "repo.git");
+            await this.runCommand("git", ["init", "--bare", "--template=", bare], { signal });
+            await mkdir(join(bare, "info"), { mode: 0o700 });
+            const excludes = join(commonDir, "info", "exclude");
+            const excludesInfo = await lstat(excludes).catch(error => { if (error.code === "ENOENT")
+                return undefined; throw error; });
+            if (excludesInfo) {
+                if (!excludesInfo.isFile() || excludesInfo.isSymbolicLink() || excludesInfo.size > 1_048_576)
+                    throw new Error("Unsafe Git exclude metadata.");
+                await writeFile(join(bare, "info", "exclude"), await readFile(excludes, "utf8"), { mode: 0o600 });
+            }
+            try {
+                const shallow = await readFile(join(commonDir, "shallow"), "utf8");
+                if (!shallow.trim().split("\n").every(validSHA))
+                    throw new Error("Invalid shallow boundary.");
+                await writeFile(join(bare, "shallow"), shallow, { mode: 0o600 });
+            }
+            catch (error) {
+                if (error.code !== "ENOENT")
+                    throw error;
+            }
+            const env = { ...cleanGitEnv(), GIT_OBJECT_DIRECTORY: objects };
+            const git = (args, allowExitOne = false, commandEnv = env) => this.runCommand("git", ["--git-dir", bare, "--work-tree", workspace, "-c", "core.bare=false", "-c", "core.hooksPath=/dev/null", ...args], { cwd: temporary, env: commandEnv, signal, allowExitOne });
+            await git(["read-tree", sha]);
+            return await fn(git, sha, temporary, objects);
+        }
+        finally {
+            await rm(temporary, { recursive: true, force: true });
+        }
+    }
+}

package/dist/repository.js

@@ -0,0 +1,310 @@
+import { createHash, randomUUID } from "node:crypto";
+import { chmod, lstat, mkdir, open, readFile, readdir, realpath, rename, rm, unlink, writeFile } from "node:fs/promises";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { command } from "./process.js";
+import { withGitHubCredential } from "./git-credential.js";
+import { validBranch, validRepository } from "./workspace.js";
+const validId = (value) => typeof value === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(value);
+const validSHA = (value) => typeof value === "string" && /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(value);
+async function ensureDirectory(path) {
+    await mkdir(path, { recursive: true, mode: 0o700 });
+    const info = await lstat(path);
+    const canonical = await realpath(path);
+    if (!info.isDirectory() || info.isSymbolicLink() || canonical !== resolve(path))
+        throw new Error("Managed repository storage must be a canonical directory without symlinks.");
+    await chmod(path, 0o700);
+    return canonical;
+}
+async function acquireLock(path) {
+    const deadline = Date.now() + 30_000;
+    while (Date.now() < deadline) {
+        try {
+            const file = await open(path, "wx", 0o600);
+            await file.writeFile(String(process.pid));
+            await file.sync();
+            await file.close();
+            return async () => { await unlink(path).catch(error => { if (error.code !== "ENOENT")
+                throw error; }); };
+        }
+        catch (error) {
+            const code = error.code;
+            if (code !== "EEXIST")
+                throw error;
+            const info = await lstat(path).catch(() => undefined);
+            if (info?.isSymbolicLink() || (info && !info.isFile()))
+                throw new Error("Unsafe repository cache lock.");
+            const value = info ? await readFile(path, "utf8").catch(() => "") : "";
+            const pid = Number(value.trim());
+            if (Number.isInteger(pid) && pid > 0 && pid !== process.pid) {
+                try {
+                    process.kill(pid, 0);
+                }
+                catch (e) {
+                    if (e.code === "ESRCH") {
+                        await unlink(path).catch(() => { });
+                        continue;
+                    }
+                }
+            }
+            await new Promise(resolve => setTimeout(resolve, 100));
+        }
+    }
+    throw new Error("Repository cache is busy. Retry after the active repository operation finishes.");
+}
+async function worktreeGitDirectory(workspace, cache) {
+    const pointer = join(workspace, ".git");
+    const info = await lstat(pointer);
+    if (!info.isFile() || info.isSymbolicLink())
+        throw new Error("Task worktree Git pointer is invalid.");
+    const contents = await readFile(pointer, "utf8");
+    const match = contents.match(/^gitdir: (.+)\r?\n?$/);
+    if (!match)
+        throw new Error("Task worktree Git pointer is invalid.");
+    const gitdir = await realpath(resolve(workspace, match[1]));
+    const worktrees = await realpath(join(cache, "worktrees"));
+    if (!gitdir.startsWith(worktrees + sep) || relative(worktrees, gitdir).split(sep).length !== 1)
+        throw new Error("Task worktree metadata escaped its managed repository.");
+    const gitInfo = await lstat(gitdir);
+    if (!gitInfo.isDirectory() || gitInfo.isSymbolicLink())
+        throw new Error("Task worktree metadata is invalid.");
+    return gitdir;
+}
+async function readMarker(workspace, cache) {
+    const gitdir = await worktreeGitDirectory(workspace, cache);
+    const path = join(gitdir, "orchestrator.json");
+    const info = await lstat(path);
+    if (!info.isFile() || info.isSymbolicLink() || (info.mode & 0o077) !== 0)
+        throw new Error("Task worktree marker is unsafe.");
+    const marker = JSON.parse(await readFile(path, "utf8"));
+    if (!validId(marker.run) || !validId(marker.project) || !Number.isInteger(marker.lifecycle) || marker.lifecycle < 1 || !validRepository(marker.repository) || !validBranch(marker.base_branch) || !validBranch(marker.branch) || !validSHA(marker.baseline))
+        throw new Error("Task worktree marker is invalid.");
+    return marker;
+}
+async function workspaceCache(workspace) {
+    const pointer = await readFile(join(workspace, ".git"), "utf8");
+    const match = pointer.match(/^gitdir: (.+)\r?\n?$/);
+    if (!match)
+        throw new Error("Task worktree Git pointer is invalid.");
+    const gitdir = await realpath(resolve(workspace, match[1]));
+    return realpath(join(gitdir, "..", ".."));
+}
+export class RepositoryWorkspace {
+    remoteURL;
+    runCommand;
+    constructor(options = {}) {
+        this.remoteURL = options.remoteURL ?? (repository => `https://github.com/${repository}.git`);
+        this.runCommand = options.runCommand ?? command;
+    }
+    async prepare(root, lease, credential) {
+        const projectId = lease.project_id;
+        const repository = lease.snapshot?.repository;
+        const baseBranch = lease.snapshot?.base_branch;
+        if (!isAbsolute(root) || !validId(lease.id) || !validId(projectId) || !Number.isInteger(lease.lifecycle) || lease.lifecycle < 1 || !validRepository(repository) || !validBranch(baseBranch))
+            throw new Error("Task repository snapshot is invalid.");
+        const dataRoot = await ensureDirectory(root);
+        const repositories = await ensureDirectory(join(dataRoot, "repositories"));
+        const workspaces = await ensureDirectory(join(dataRoot, "workspaces"));
+        const cacheKey = createHash("sha256").update(repository).digest("hex").slice(0, 16);
+        const cache = join(repositories, `${projectId}-${cacheKey}`);
+        const workspace = join(workspaces, `${lease.id}-${lease.lifecycle}`);
+        const branch = `task/${lease.id}`;
+        const remote = this.remoteURL(repository);
+        const release = await acquireLock(cache + ".lock");
+        try {
+            return await withGitHubCredential(dataRoot, credential, async (env) => {
+                const git = (args, cwd) => this.runCommand("git", args, { cwd, env, timeout: 120_000 });
+                let cacheInfo = await lstat(cache).catch(error => { if (error.code === "ENOENT")
+                    return undefined; throw error; });
+                if (cacheInfo) {
+                    if (!cacheInfo.isDirectory() || cacheInfo.isSymbolicLink() || await realpath(cache) !== cache)
+                        throw new Error("Managed repository cache is unsafe.");
+                    if ((await git(["--git-dir", cache, "rev-parse", "--is-bare-repository"])).output !== "true")
+                        throw new Error("Managed repository cache is invalid.");
+                    const existing = (await git(["--git-dir", cache, "remote", "get-url", "origin"])).output;
+                    if (existing !== remote)
+                        throw new Error("Managed repository cache does not match the selected repository.");
+                }
+                else {
+                    await git(["-c", "core.hooksPath=/dev/null", "clone", "--bare", "--template=", "--", remote, cache]);
+                    cacheInfo = await lstat(cache);
+                    if (!cacheInfo.isDirectory() || cacheInfo.isSymbolicLink())
+                        throw new Error("Repository checkout did not create a safe cache.");
+                    await chmod(cache, 0o700);
+                }
+                await git(["--git-dir", cache, "-c", "core.hooksPath=/dev/null", "fetch", "--prune", "origin", `+refs/heads/${baseBranch}:refs/remotes/origin/${baseBranch}`]);
+                const baseline = (await git(["--git-dir", cache, "rev-parse", `refs/remotes/origin/${baseBranch}^{commit}`])).output;
+                if (!validSHA(baseline))
+                    throw new Error("Selected base branch does not resolve to a commit.");
+                const existingWorkspace = await lstat(workspace).catch(error => { if (error.code === "ENOENT")
+                    return undefined; throw error; });
+                if (existingWorkspace) {
+                    if (!existingWorkspace.isDirectory() || existingWorkspace.isSymbolicLink() || await realpath(workspace) !== workspace)
+                        throw new Error("Existing task worktree is unsafe.");
+                    const marker = await readMarker(workspace, cache);
+                    if (marker.run !== lease.id || marker.lifecycle !== lease.lifecycle || marker.project !== projectId || marker.repository !== repository || marker.base_branch !== baseBranch || marker.branch !== branch || !validSHA(marker.baseline))
+                        throw new Error("Existing task worktree identity does not match this lease.");
+                    return { path: workspace, branch, baseline: marker.baseline };
+                }
+                await git(["--git-dir", cache, "worktree", "add", "--force", "--detach", workspace, baseline]);
+                await git(["-C", workspace, "-c", "core.hooksPath=/dev/null", "switch", "-C", branch, "--ignore-other-worktrees", baseline]);
+                await git(["-C", workspace, "config", "user.name", credential.author_name]);
+                await git(["-C", workspace, "config", "user.email", credential.author_email]);
+                await git(["-C", workspace, "config", "core.hooksPath", "/dev/null"]);
+                const gitdir = await worktreeGitDirectory(workspace, cache);
+                await writeFile(join(gitdir, "orchestrator.json"), JSON.stringify({ run: lease.id, lifecycle: lease.lifecycle, project: projectId, repository, base_branch: baseBranch, baseline, branch }), { mode: 0o600, flag: "wx" });
+                return { path: workspace, branch, baseline };
+            });
+        }
+        catch (error) {
+            throw error instanceof Error && /Task repository|Managed repository|Selected base|Existing task|Task worktree/.test(error.message)
+                ? error
+                : new Error("Repository setup failed. Check GitHub App access, repository selection, base branch, and local storage.", { cause: error });
+        }
+        finally {
+            await release();
+        }
+    }
+    async writeProjectInstructions(workspace, instructions) {
+        if (typeof instructions !== "string" || Buffer.byteLength(instructions, "utf8") > 32_000)
+            throw new Error("Project instructions snapshot is invalid.");
+        const canonical = await realpath(workspace);
+        if (!isAbsolute(workspace) || canonical !== resolve(workspace))
+            throw new Error("Task worktree path must be canonical.");
+        const pointer = await readFile(join(canonical, ".git"), "utf8");
+        const match = pointer.match(/^gitdir: (.+)\r?\n?$/);
+        if (!match)
+            throw new Error("Task worktree Git pointer is invalid.");
+        const gitdir = await realpath(resolve(canonical, match[1]));
+        const cache = dirname(dirname(gitdir));
+        const marker = await readMarker(canonical, cache);
+        const target = join(canonical, `.dev-orchestrator-instructions-${marker.run}-${marker.lifecycle}.md`);
+        const release = await acquireLock(cache + ".lock");
+        try {
+            const existing = await lstat(target).catch(error => { if (error.code === "ENOENT")
+                return undefined; throw error; });
+            if (existing?.isSymbolicLink() || (existing && !existing.isFile()))
+                throw new Error("Project instructions target is unsafe.");
+            if (instructions === "") {
+                if (existing)
+                    await unlink(target);
+                return undefined;
+            }
+            if (existing) {
+                if (await readFile(target, "utf8") !== instructions)
+                    throw new Error("Project instructions target already exists with different content.");
+                return target;
+            }
+            const excludeDirPath = join(cache, "info");
+            await mkdir(excludeDirPath, { recursive: true, mode: 0o700 });
+            const excludeDir = await realpath(excludeDirPath);
+            if (!excludeDir.startsWith(cache + sep))
+                throw new Error("Worktree ignore metadata escaped its Git directory.");
+            const excludeDirInfo = await lstat(excludeDirPath);
+            if (!excludeDirInfo.isDirectory() || excludeDirInfo.isSymbolicLink())
+                throw new Error("Worktree ignore metadata is unsafe.");
+            const excludePath = join(excludeDir, "exclude");
+            await writeFile(excludePath, "", { encoding: "utf8", mode: 0o600, flag: "wx" }).catch(error => {
+                if (error.code !== "EEXIST")
+                    throw error;
+            });
+            const excludeInfo = await lstat(excludePath);
+            if (!excludeInfo.isFile() || excludeInfo.isSymbolicLink())
+                throw new Error("Worktree ignore metadata is unsafe.");
+            const exclude = await readFile(excludePath, "utf8");
+            const rule = `/${basename(target)}`;
+            if (!exclude.split(/\r?\n/).includes(rule)) {
+                const excludeTemp = join(excludeDir, `.exclude-${randomUUID()}`);
+                try {
+                    await writeFile(excludeTemp, exclude + (exclude.endsWith("\n") || exclude === "" ? "" : "\n") + rule + "\n", { encoding: "utf8", mode: 0o600, flag: "wx" });
+                    await rename(excludeTemp, excludePath);
+                }
+                catch (error) {
+                    await unlink(excludeTemp).catch(() => { });
+                    throw error;
+                }
+            }
+            const temporary = join(canonical, `.instructions-${randomUUID()}`);
+            try {
+                await writeFile(temporary, instructions, { encoding: "utf8", mode: 0o600, flag: "wx" });
+                await chmod(temporary, 0o600);
+                await rename(temporary, target);
+                return target;
+            }
+            catch (error) {
+                await unlink(temporary).catch(() => { });
+                throw error;
+            }
+        }
+        finally {
+            await release();
+        }
+    }
+    async markTerminal(workspace, outcome) {
+        const canonical = await realpath(workspace);
+        if (!isAbsolute(workspace) || canonical !== resolve(workspace))
+            throw new Error("Task worktree path must be canonical.");
+        const cache = await workspaceCache(canonical);
+        const gitdir = await worktreeGitDirectory(canonical, cache);
+        await readMarker(canonical, cache);
+        const terminalPath = join(gitdir, "terminal.json");
+        const existing = await lstat(terminalPath).catch(error => { if (error.code === "ENOENT")
+            return undefined; throw error; });
+        if (existing) {
+            if (!existing.isFile() || existing.isSymbolicLink() || (existing.mode & 0o077) !== 0)
+                throw new Error("Task terminal marker is unsafe.");
+            const previous = JSON.parse(await readFile(terminalPath, "utf8"));
+            if (previous.outcome !== outcome)
+                throw new Error("Task terminal outcome changed unexpectedly.");
+            return;
+        }
+        await writeFile(terminalPath, JSON.stringify({ outcome, recorded_at: Date.now() }), { mode: 0o600, flag: "wx" });
+    }
+    async cleanupExpired(root, protectedWorkspace, now = Date.now()) {
+        const canonicalRoot = await ensureDirectory(root);
+        const workspacesRoot = join(canonicalRoot, "workspaces");
+        const entries = await readdir(workspacesRoot, { withFileTypes: true }).catch(error => {
+            if (error.code === "ENOENT")
+                return [];
+            throw error;
+        });
+        let removed = 0;
+        for (const entry of entries) {
+            if (!entry.isDirectory() || entry.isSymbolicLink())
+                continue;
+            const workspace = join(workspacesRoot, entry.name);
+            if (workspace === protectedWorkspace)
+                continue;
+            try {
+                if (await realpath(workspace) !== workspace)
+                    continue;
+                const cache = await workspaceCache(workspace);
+                const marker = await readMarker(workspace, cache);
+                if (entry.name !== `${marker.run}-${marker.lifecycle}`)
+                    continue;
+                const terminalPath = join(await worktreeGitDirectory(workspace, cache), "terminal.json");
+                const terminalInfo = await lstat(terminalPath);
+                if (!terminalInfo.isFile() || terminalInfo.isSymbolicLink() || (terminalInfo.mode & 0o077) !== 0)
+                    continue;
+                const terminal = JSON.parse(await readFile(terminalPath, "utf8"));
+                if (!["success", "failure"].includes(String(terminal.outcome)) || typeof terminal.recorded_at !== "number")
+                    continue;
+                const retention = terminal.outcome === "success" ? 24 * 60 * 60_000 : 7 * 24 * 60 * 60_000;
+                if (now - terminal.recorded_at < retention)
+                    continue;
+                if (await realpath(cache) !== cache)
+                    continue;
+                const release = await acquireLock(cache + ".lock");
+                try {
+                    await this.runCommand("git", ["--git-dir", cache, "-c", "core.hooksPath=/dev/null", "worktree", "remove", "--force", workspace], { env: { PATH: process.env.PATH, HOME: process.env.HOME, GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null" }, timeout: 30_000 });
+                    await rm(workspace, { recursive: true, force: true });
+                    removed++;
+                }
+                finally {
+                    await release();
+                }
+            }
+            catch { /* Unknown or unsafe worktrees are retained for manual recovery. */ }
+        }
+        return removed;
+    }
+}

package/dist/types.js

@@ -0,0 +1 @@
+export {};