dorfl 0.10.0 → 0.11.0

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAC,OAAO,EAAS,MAAM,WAAW,CAAC;AAmH1C,OAAO,EAAiB,KAAK,YAAY,EAAC,MAAM,sBAAsB,CAAC;AAwCvE,OAAO,EAAgB,KAAK,mBAAmB,EAAC,MAAM,qBAAqB,CAAC;AA+xB5E;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC/B,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,OAAO,GACb,MAAM,CAoCR;AA6RD,wBAAgB,YAAY,IAAI,OAAO,CAq7GtC;AAaD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACpC,MAAM,EAAE,mBAAmB,EAC3B,KAAK,EAAE,OAAO,GACZ,MAAM,CAyBR;AA+FD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,MAAM,CAAC,IAAI,GAAE,MAAM,EAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBzE"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAC,OAAO,EAAS,MAAM,WAAW,CAAC;AAwH1C,OAAO,EAAiB,KAAK,YAAY,EAAC,MAAM,sBAAsB,CAAC;AAwCvE,OAAO,EAAgB,KAAK,mBAAmB,EAAC,MAAM,qBAAqB,CAAC;AAgyB5E;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC/B,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,OAAO,GACb,MAAM,CAoCR;AA6RD,wBAAgB,YAAY,IAAI,OAAO,CAwgHtC;AAaD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACpC,MAAM,EAAE,mBAAmB,EAC3B,KAAK,EAAE,OAAO,GACZ,MAAM,CAyBR;AA+FD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,MAAM,CAAC,IAAI,GAAE,MAAM,EAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBzE"}

package/dist/cli.js

@@ -44,7 +44,7 @@ import { harnessTaskReviewGate } from './tasker-review-loop.js';
 import { runVerify } from './verify.js';
 import { renderPrompt } from './prompt.js';
 import { resolvePromptGuidance } from './config.js';
-import { gc, RETAIN_REASON_TEXT } from './gc.js';
+import { gc, resolveArbiterKeyFromCwd, enumerateWorkspaceArbiters, RETAIN_REASON_TEXT, } from './gc.js';
 import { runPrdToSpec, } from './prd-to-spec.js';
 import { resyncProtocol } from './resync-protocol.js';
 import { sweepRemoteMergedBranches } from './reap-branches.js';
@@ -2332,7 +2332,7 @@ export function buildProgram() {
     program
         .command('gc')
         .helpGroup(ADVANCED_GROUP)
-        .description('Re-apply the provably-safe deletion predicate (ADR \u00a74) across every job worktree under workspacesDir/work/*: reap the provably-safe ones (clean tree AND branch tip reachable on the arbiter \u2014 merged or pushed) via git worktree remove (+ prune, never rm -rf), and report each RETAINED one with a reason. The catch-up for when end-of-job auto-reap did not run (runner crash/kill). --force overrides the predicate (discards un-saved work) \u2014 loud, never default.')
+        .description('Re-apply the provably-safe deletion predicate (ADR \u00a74) to job worktrees under workspacesDir/work/*: reap the provably-safe ones (clean tree AND branch tip reachable on the arbiter \u2014 merged or pushed) via git worktree remove (+ prune, never rm -rf), and report each RETAINED one with a reason. The catch-up for when end-of-job auto-reap did not run (runner crash/kill). SCOPE: by DEFAULT this is ARBITER-SCOPED \u2014 it acts ONLY on worktrees belonging to the arbiter resolved from the cwd (the same arbiter do --isolated/the mirror uses), so a gc in repo A can never reap repo B\u2019s worktrees. Pass --all-arbiters to sweep across EVERY arbiter (loud + global), or --arbiter <remote-or-url> to target a specific one. --force overrides the predicate (discards un-saved work) and requires --yes \u2014 loud, never default; --all-arbiters --force must be opted into explicitly, never reached by default.')
         .option('-c, --config <path>', 'config file path', defaultConfigPath())
         .option('--workspace <dir>', 'execution working area to sweep (default: workspacesDir / ~/.dorfl)')
         .option('--force', 'OVERRIDE the predicate: remove worktrees even with un-saved work (requires --yes; never the default)')
@@ -2340,7 +2340,8 @@ export function buildProgram() {
         .option('--ledger [repoPath]', 'SWEEP the work/ lifecycle LEDGER instead of job worktrees: REPORT (never delete) every slug present in more than one work/ status folder (the one-slug-one-folder belt-and-suspenders), with its folders + candidate canonical folder, for a HUMAN to resolve. Defaults to the cwd repo.')
         .option('--reap-stale-locks', '(with --ledger) OPT-IN: also CLEAR every ORPHAN lock the report finds via the SAME leased delete `release-lock` uses, so one command sweeps all orphaned locks instead of N hand-run release-locks. Reaps the `cleared-stale` class: a held `active` lock that is EITHER terminal on `<arbiter>/main` (stranded between the durable move and the release) OR non-terminal + SURFACED (`needsAnswers:true` + sidecar on `<arbiter>/main`) = the crash-window orphan the ordered bounce transition leaves when step 1 lands but step 2 never runs. A `kept-in-flight` (active + non-terminal + NOT surfaced — a healthy build) is NEVER reaped, even with this flag. A concurrent change to a lock ref makes its leased delete REJECT (reported), never --force. WITHOUT this flag `gc --ledger` stays report-only (fail-loud, deletes nothing).')
         .option('--remote-branches', 'SWEEP the arbiter’s remote work/* BRANCHES instead of job worktrees: delete (via git push --delete, NEVER --force) exactly those PROVABLY MERGED into <arbiter>/main (git merge-base --is-ancestor, the SAME predicate the worktree reaper uses), and RETAIN the rest with a reason. An in-flight/un-merged branch (the recovery point) is NEVER touched. Provider-agnostic plain git — works on a --bare arbiter. The merged-only complement of `requeue --reset`.')
-        .option('--arbiter <remote>', '(with --remote-branches) the arbiter git remote whose work/* branches to sweep (default: origin); resolved from --cwd')
+        .option('--arbiter <remote-or-url>', 'SCOPE the worktree sweep to a SPECIFIC arbiter (a remote NAME resolved from --cwd, or a direct arbiter URL) instead of the cwd\u2019s. (With --remote-branches / --ledger it names the arbiter git remote whose work/* branches / locks to sweep; default there: origin.)')
+        .option('--all-arbiters', 'GLOBAL, LOUD override: sweep worktrees across EVERY arbiter under workspacesDir/work/* (today\u2019s pre-scoping behaviour), not just the cwd\u2019s. Prints a banner naming every arbiter it will act on before doing anything; combining it with --force still requires --yes. This is the destructive cross-repo path \u2014 opt into it explicitly.')
         .option('--cwd <dir>', '(with --remote-branches) the local repo/clone whose --arbiter remote points at the arbiter to sweep (default: cwd); only remote refs are read + deleted, never the working tree')
         .option('--dry-run', '(with --remote-branches) REPORT which merged branches WOULD be reaped without deleting anything (a read-only preview)')
         .option('--json', 'output the raw result as JSON')
@@ -2511,6 +2512,68 @@ export function buildProgram() {
             console.log(`Summary: ${reapedCount} ${verb}, ${sweep.retained.length} retained.`);
             return;
         }
+        // SCOPE RESOLUTION (this task): the worktree reaper is ARBITER-SCOPED by
+        // default. `--all-arbiters` restores the GLOBAL (cross-arbiter) sweep behind
+        // a LOUD banner; `--arbiter <remote-or-url>` targets a specific arbiter; the
+        // bare default resolves the arbiter from the cwd (the SAME resolution
+        // `do --isolated` / the mirror uses). With NO resolvable cwd arbiter and
+        // neither flag, we REFUSE (never silently fall back to global) — gc used to
+        // default to global, and a global `gc --force --yes` from repo A could
+        // irreversibly discard repo B's un-pushed work.
+        let arbiterKey;
+        if (flags.allArbiters !== true) {
+            if (flags.arbiter !== undefined && flags.arbiter.trim() !== '') {
+                // An explicit arbiter: a direct URL (contains `://`, a scp-like `:`,
+                // or an absolute path) is keyed directly; otherwise it is a remote NAME
+                // resolved from the cwd (default `origin`).
+                const spec = flags.arbiter.trim();
+                const looksLikeUrl = spec.includes('://') ||
+                    spec.startsWith('/') ||
+                    /^[^/]+@/.test(spec);
+                // A remote NAME resolves from --cwd if given (consistent with the
+                // other gc sub-modes), else the process cwd.
+                const resolveFrom = flags.cwd ?? process.cwd();
+                arbiterKey = looksLikeUrl
+                    ? encodeRepoKey(spec)
+                    : resolveArbiterKeyFromCwd(resolveFrom, spec, process.env);
+                if (arbiterKey === undefined) {
+                    console.error(`refusing: could not resolve arbiter '${spec}' \u2014 not a URL and ` +
+                        'no git remote with that name in the cwd. Pass a remote name that ' +
+                        'exists here, an arbiter URL, or --all-arbiters.');
+                    process.exit(1);
+                }
+            }
+            else {
+                arbiterKey = resolveArbiterKeyFromCwd(flags.cwd ?? process.cwd(), config.defaultArbiter, process.env);
+                if (arbiterKey === undefined) {
+                    console.error('refusing: `gc` is now ARBITER-SCOPED and could not resolve an ' +
+                        `arbiter from the current directory (no '${config.defaultArbiter}' ` +
+                        'git remote, or not inside a repo). It will NOT fall back to a ' +
+                        'global cross-arbiter sweep. Run it from a repo with an arbiter ' +
+                        'remote, pass --arbiter <remote-or-url>, or --all-arbiters to sweep ' +
+                        'every arbiter.');
+                    process.exit(1);
+                }
+            }
+        }
+        else {
+            // GLOBAL sweep: LOUD banner naming EVERY arbiter it will act on before
+            // doing anything (this task's "loud" requirement). Global + --force must be
+            // opted into explicitly (the --yes gate below still applies), never reached
+            // by default.
+            const arbiters = enumerateWorkspaceArbiters(workspacesDir, process.env);
+            console.error('>> --all-arbiters: operating GLOBALLY across ALL arbiters under ' +
+                `${workspacesDir}/work/* (NOT scoped to the current repo).`);
+            if (arbiters.length > 0) {
+                console.error('>> arbiters in scope:');
+                for (const a of arbiters) {
+                    console.error(`>>   - ${a.url ?? a.key ?? '(malformed mirror)'}`);
+                }
+            }
+            else {
+                console.error('>> (no worktrees found under any arbiter)');
+            }
+        }
         // `--force` discards un-saved work, so it is gated behind an explicit
         // confirmation (`--yes`) — loud + intentional, NEVER the default (ADR §4).
         if (flags.force && !flags.yes) {
@@ -2525,6 +2588,7 @@ export function buildProgram() {
         }
         const result = gc({
             workspacesDir,
+            arbiterKey,
             force: flags.force === true,
             note: (message) => console.error(`>> ${message}`),
         });
@@ -2541,7 +2605,13 @@ export function buildProgram() {
         for (const retained of result.retained) {
             console.log(`  [retained] ${retained.slug} \u2014 ${RETAIN_REASON_TEXT[retained.reason]}`);
         }
-        console.log(`Summary: ${result.reaped.length} reaped, ${result.retained.length} retained.`);
+        for (const orphan of result.sweptOrphans) {
+            console.log(`  [swept]    ${orphan.dir} \u2014 ${orphan.kind}`);
+        }
+        const orphanNote = result.sweptOrphans.length > 0
+            ? `, ${result.sweptOrphans.length} orphan(s) swept`
+            : '';
+        console.log(`Summary: ${result.reaped.length} reaped, ${result.retained.length} retained${orphanNote}.`);
     });
     // `dorfl sync`: bring an already-onboarded repo up to the CURRENT protocol.
     // Always re-syncs `work/protocol/*` + bumps VERSION (the deterministic slice of