gh-stack 0.18.0 → 0.19.0

package/src/lib/git.ts

@@ -143,30 +143,92 @@ export async function isAncestor(ancestor: string, descendant: string): Promise<
   return exitCode === 0;
 }
 
-/**
- * Force-push a branch with lease protection.
- */
-export async function forcePushWithLease(branch?: string): Promise<boolean> {
-  try {
-    if (branch) {
-      await $`git push --force-with-lease origin ${branch}`;
-    } else {
-      await $`git push --force-with-lease`;
-    }
-    return true;
-  } catch {
-    return false;
+export type PushResult =
+  | { ok: true }
+  | {
+      ok: false;
+      /**
+       * `not-integrated`: origin's tip was fetched but isn't in the local
+       * branch's history (--force-if-includes refused). `stale-lease`: origin
+       * moved since the last fetch. `rejected`: anything else.
+       */
+      reason: "not-integrated" | "stale-lease" | "rejected";
+      stderr: string;
+    };
+
+/**
+ * The one way gh-stack force-pushes a branch (restack, sync, merge's advance,
+ * submit, join). Sets upstream, and works whether or not the branch exists on
+ * origin yet.
+ *
+ * By default it's `--force-with-lease --force-if-includes`: the lease refuses
+ * if origin moved since the last fetch, and --force-if-includes refuses if the
+ * fetched tip was never brought into the local branch. That second check is
+ * #28's root cause (a collapse's squash commit fetched, never pulled, then
+ * overwritten), covered here for every command.
+ *
+ * `expect` gives the lease an explicit remote sha instead. Use it only for a
+ * tip whose content was checked first (see lib/remote-guard.ts): git makes
+ * --force-if-includes a no-op then, and the push still fails if origin moved
+ * off that sha.
+ */
+export async function forcePushWithLease(
+  branch: string,
+  opts: { expect?: string } = {},
+): Promise<PushResult> {
+  const lease = opts.expect
+    ? `--force-with-lease=refs/heads/${branch}:${opts.expect}`
+    : "--force-with-lease";
+  const { exitCode, stderr } = await $`git push -u ${lease} --force-if-includes origin ${branch}`
+    .nothrow()
+    .quiet();
+  if (exitCode === 0) return { ok: true };
+  const text = stderr.toString();
+  const reason = text.includes("remote ref updated since checkout")
+    ? "not-integrated"
+    : text.includes("stale info")
+      ? "stale-lease"
+      : "rejected";
+  return { ok: false, reason, stderr: text };
+}
+
+/** Why a force-push was refused, and what to do, in gh-stack terms (plain lines). */
+export function pushFailureHint(branch: string, result: PushResult): string[] {
+  if (result.ok) return [];
+  switch (result.reason) {
+    case "not-integrated":
+      return [
+        `origin/${branch} has commits you fetched but never brought into local ${branch}, so git refused to overwrite them (--force-if-includes).`,
+        `That's how a collapsed PR's squash commit gets lost (#28). See them: git log ${branch}..origin/${branch}`,
+        `Bring them in (git pull --rebase origin ${branch}, or cherry-pick), then retry.`,
+        `To drop them on purpose: gh-stack restack --overwrite-remote`,
+      ];
+    case "stale-lease":
+      return [
+        `origin/${branch} moved since your last fetch, so the lease refused.`,
+        `Look at what's there first: git fetch origin ${branch} && git log ${branch}..origin/${branch}`,
+      ];
+    default:
+      return [
+        result.stderr
+          .trim()
+          .split("\n")
+          .find((l) => l.includes("rejected") || l.startsWith("error")) ?? result.stderr.trim(),
+      ];
   }
 }
 
 /**
- * Push a stacked branch's ref to origin, setting upstream and using
- * force-with-lease. Works whether or not the remote branch already exists
- * (creates it on first push) — so restack can reconcile every ref, including
- * a branch that was never pushed before.
+ * Fetch commits from origin without moving any ref: no remote-tracking ref
+ * update (`--refmap=`) and no FETCH_HEAD. The tracking refs are what
+ * `--force-with-lease` and `--force-if-includes` compare against, so a check
+ * that needs origin's objects must never advance them.
  */
-export async function pushStackedBranch(branch: string): Promise<boolean> {
-  const { exitCode } = await $`git push -u --force-with-lease origin ${branch}`.nothrow().quiet();
+export async function fetchObjectsOnly(refs: string[]): Promise<boolean> {
+  if (refs.length === 0) return true;
+  const { exitCode } = await $`git fetch --quiet --no-write-fetch-head --refmap= origin ${refs}`
+    .nothrow()
+    .quiet();
   return exitCode === 0;
 }
 
@@ -264,10 +326,10 @@ export async function deleteTagsMatching(pattern: string): Promise<void> {
 }
 
 /**
- * Check if a tag exists.
+ * Whether a ref (branch, tag, remote-tracking ref, or any revision) resolves.
  */
-export async function tagExists(name: string): Promise<boolean> {
-  const { exitCode } = await $`git rev-parse --verify ${name}`.nothrow().quiet();
+export async function refExists(ref: string): Promise<boolean> {
+  const { exitCode } = await $`git rev-parse --verify --quiet ${ref}`.nothrow().quiet();
   return exitCode === 0;
 }
 

package/src/lib/github.ts

@@ -203,17 +203,75 @@ export async function getPrBody(prNumber: number): Promise<string | null> {
  * squash-merge lands on this branch. Compare `headRefOid` against the live ref
  * (`getBranchRefSha`) to detect that staleness — see `merge.ts`.
  */
-export async function getPrMergeState(prNumber: number): Promise<{
+/** A PR's merge state, plus what merging it left behind. */
+export interface PrMergeResult {
   state: string;
   mergeable: string;
   mergeStateStatus: string;
   headRefName: string;
+  /** The PR's head; for a merged PR, its head when it merged. */
   headRefOid: string;
-} | null> {
+  /** The branch it targets (or merged into). */
+  baseRefName: string;
+  /** The commit merging it created on its base (for a squash merge, the squash commit). */
+  mergeCommit: string | null;
+}
+
+export async function getPrMergeState(prNumber: number): Promise<PrMergeResult | null> {
   try {
-    const result =
-      await $`gh pr view ${prNumber} --json state,mergeable,mergeStateStatus,headRefName,headRefOid`.text();
-    return JSON.parse(result.trim());
+    const data = JSON.parse(
+      (
+        await $`gh pr view ${prNumber} --json state,mergeable,mergeStateStatus,headRefName,headRefOid,baseRefName,mergeCommit`.text()
+      ).trim(),
+    );
+    return { ...data, mergeCommit: data.mergeCommit?.oid ?? null };
+  } catch {
+    return null;
+  }
+}
+
+/** A commit as a patch (`git format-patch` style), from the GitHub API. Null if unavailable. */
+export async function getCommitPatch(sha: string): Promise<string | null> {
+  const nwo = await getRepoNwo();
+  if (!nwo) return null;
+  const { stdout, exitCode } =
+    await $`gh api -H ${"Accept: application/vnd.github.patch"} repos/${nwo}/commits/${sha}`
+      .nothrow()
+      .quiet();
+  const text = stdout.toString();
+  return exitCode === 0 && text.trim() ? text : null;
+}
+
+/**
+ * The files a commit changed (path, status, blob sha after the commit), from
+ * the GitHub API. Null if unavailable, or if GitHub truncated the list (it
+ * returns at most 300 files): a partial list can't prove anything.
+ */
+export async function getCommitFiles(
+  sha: string,
+): Promise<
+  { filename: string; status: string; sha: string | null; before?: string | null }[] | null
+> {
+  const nwo = await getRepoNwo();
+  if (!nwo) return null;
+  const { stdout, exitCode } =
+    await $`gh api repos/${nwo}/commits/${sha} --jq ${"[.files[] | {filename, status, sha}]"}`
+      .nothrow()
+      .quiet();
+  if (exitCode !== 0) return null;
+  try {
+    const files: { filename: string; status: string; sha: string | null }[] = JSON.parse(
+      stdout.toString(),
+    );
+    if (!Array.isArray(files) || files.length === 0 || files.length >= 300) return null;
+    // The API gives no blob from before the commit, except that an added
+    // file had none; a removed file has no blob after it.
+    return files.map((f) => ({
+      filename: f.filename,
+      status: f.status,
+      sha: f.status === "removed" ? null : f.sha,
+      before: f.status === "added" ? null : undefined,
+    }));
   } catch {
     return null;
   }

package/src/lib/metadata.ts

@@ -11,6 +11,7 @@
 //   • A stack can never silently vanish — on write, a stale stack file is moved
 //     to `deleted/` (a recoverable tombstone), never just unlinked.
 import type { StackMetadata, Stack, Branch, RestackState } from "../types.ts";
+import { RUN_STATE_VERSION } from "../types.ts";
 import { mkdir, readdir, rename, unlink, stat } from "node:fs/promises";
 import {
   ghStackDir,
@@ -605,7 +606,7 @@ export function getOrderedBranches(stack: Stack): string[] {
  */
 export function getChildren(stack: Stack, branchName: string): string[] {
   return Object.entries(stack.branches)
-    .filter(([_, b]) => b.parent === branchName)
+    .filter(([, b]) => b.parent === branchName)
     .map(([name]) => name);
 }
 
@@ -655,23 +656,49 @@ export async function updateLastBranch(
 // ── Restack state (for --resume) ──
 
 /**
- * Save restack state for resume.
+ * Save a run's state (resume point + action log). Written after every step, so
+ * it goes through a temp file and a rename: a kill mid-write leaves the
+ * previous state, never a truncated file.
  */
 export async function saveRestackState(state: RestackState): Promise<void> {
   await ensureDirs();
-  await Bun.write(await restackStateFile(), JSON.stringify(state, null, 2) + "\n");
+  const path = await restackStateFile();
+  const tmp = `${path}.tmp`;
+  await Bun.write(tmp, JSON.stringify(state, null, 2) + "\n");
+  await rename(tmp, path);
 }
 
 /**
- * Load restack state for resume.
- * Returns null if no state file exists.
+ * Load the saved run state. Returns null if there is none. A file that can't
+ * be parsed, or was written by another version of gh-stack, throws
+ * InvalidRunStateError: it is never guessed at or upgraded.
  */
 export async function loadRestackState(): Promise<RestackState | null> {
-  const file = Bun.file(await restackStateFile());
+  const path = await restackStateFile();
+  const file = Bun.file(path);
   if (!(await file.exists())) {
     return null;
   }
-  return file.json();
+  let raw: Partial<RestackState>;
+  try {
+    raw = await file.json();
+  } catch {
+    throw new InvalidRunStateError(path, "it isn't valid JSON");
+  }
+  if (raw?.version !== RUN_STATE_VERSION) {
+    throw new InvalidRunStateError(path, "it was written by an older gh-stack");
+  }
+  return raw as RestackState;
+}
+
+/** The saved run state exists but can't be used (unreadable, or another version's shape). */
+export class InvalidRunStateError extends Error {
+  constructor(
+    readonly path: string,
+    readonly reason: string,
+  ) {
+    super(`The saved run state at ${path} can't be used: ${reason}.`);
+  }
 }
 
 /**

package/src/lib/output.ts

@@ -15,11 +15,32 @@
 import * as clack from "@clack/prompts";
 
 let _plain = false;
+let stderrOnly = false;
 
 export function setPlain(enabled: boolean): void {
   _plain = enabled;
 }
 
+/**
+ * `--json` mode: plain output, all of it on stderr, so stdout carries only the
+ * JSON document the command writes itself.
+ */
+export function setStderrOnly(): void {
+  _plain = true;
+  stderrOnly = true;
+}
+
+/** Plain-mode line: stdout normally, stderr in --json mode. */
+function say(line: string): void {
+  if (stderrOnly) console.error(line);
+  else console.log(line);
+}
+
+/** A raw line of output (tree drawings, spacing), routed like the log calls. */
+export function print(line = ""): void {
+  say(_plain ? strip(line) : line);
+}
+
 export function isPlain(): boolean {
   return _plain;
 }
@@ -65,7 +86,7 @@ export const select: typeof clack.select = (opts) => {
 // ── Banner / error ──
 export function intro(message?: string): void {
   if (_plain) {
-    if (message) console.log(strip(message));
+    if (message) say(strip(message));
   } else {
     clack.intro(message);
   }
@@ -73,7 +94,7 @@ export function intro(message?: string): void {
 
 export function outro(message?: string): void {
   if (_plain) {
-    if (message) console.log(strip(message));
+    if (message) say(strip(message));
   } else {
     clack.outro(message);
   }
@@ -89,11 +110,11 @@ export function cancel(message?: string): void {
 
 // ── log.* ──
 export const log = {
-  info: (msg: string) => (_plain ? console.log(strip(msg)) : clack.log.info(msg)),
-  success: (msg: string) => (_plain ? console.log(strip(msg)) : clack.log.success(msg)),
+  info: (msg: string) => (_plain ? say(strip(msg)) : clack.log.info(msg)),
+  success: (msg: string) => (_plain ? say(strip(msg)) : clack.log.success(msg)),
   warn: (msg: string) => (_plain ? console.warn(strip(msg)) : clack.log.warn(msg)),
   error: (msg: string) => (_plain ? console.error(strip(msg)) : clack.log.error(msg)),
-  step: (msg: string) => (_plain ? console.log(strip(msg)) : clack.log.step(msg)),
+  step: (msg: string) => (_plain ? say(strip(msg)) : clack.log.step(msg)),
 };
 
 // ── Spinner ──
@@ -107,13 +128,13 @@ export function spinner(): Spinner {
   if (!_plain) return clack.spinner() as Spinner;
   return {
     start: (msg) => {
-      if (msg) console.log(strip(msg));
+      if (msg) say(strip(msg));
     },
     stop: (msg) => {
-      if (msg) console.log(strip(msg));
+      if (msg) say(strip(msg));
     },
     message: (msg) => {
-      if (msg) console.log(strip(msg));
+      if (msg) say(strip(msg));
     },
   };
 }

package/src/lib/paths.ts

@@ -6,7 +6,7 @@
 //     archived/<stack>.json        merged/closed stacks
 //     deleted/<stack>.json         tombstones (recoverable)
 //     snapshots/<ts>__<stack>.json append-only pre-operation branch tips
-//     restack-state.json           in-flight restack/sync resume state
+//     restack-state.json           last restack/sync/join run: resume point + action log
 //
 // Everything lives inside `.git/` and is never committed — gh-stack is a
 // single-developer tool, so there's no need to share metadata across clones.

package/src/lib/remote-guard.ts

@@ -0,0 +1,281 @@
+// Before a run rewrites branches, make sure origin doesn't hold content the
+// local branches lack (#28).
+//
+// The incident: `merge --collapse` squash-merged PR2 into PR1's branch on
+// GitHub. The local PR1 never pulled that squash commit, a `sync` rebased the
+// local PR1 and force-pushed it, and the base PR silently lost every child's
+// content. `--force-with-lease` doesn't protect against this once the
+// remote-tracking ref has been fetched.
+//
+// The hard part is not crying wolf. After a `--no-push` restack, or a run
+// interrupted before its pushes, origin legitimately holds the *pre-rewrite*
+// versions of local commits. Those aren't new: local had them and rewrote them
+// on purpose. So a commit on origin counts as new content only if
+//   1. it was never in the local branch's history (its reflog, or a tip a
+//      snapshot recorded), and
+//   2. it isn't patch-equivalent to a local commit.
+import { $ } from "bun";
+import pc from "picocolors";
+import * as p from "./output.ts";
+import * as git from "./git.ts";
+import { isAutoYes } from "./ui.ts";
+import type { StackMetadata } from "../types.ts";
+
+/** A branch whose origin copy differs but couldn't be checked. */
+export interface Unverified {
+  branch: string;
+  remoteSha: string;
+  reason: string;
+}
+
+export interface RemoteOnlyContent {
+  branch: string;
+  localSha: string;
+  remoteSha: string;
+  /** "sha subject", oldest first. */
+  commits: string[];
+  /** Local is simply behind origin (a fast-forward brings the commits in). */
+  behind: boolean;
+}
+
+/** How many reflog entries count as "versions local already had". */
+const REFLOG_DEPTH = 300;
+
+/**
+ * For each branch with a copy on origin that differs from local, the commits
+ * origin has that are new content (see the module comment). `cleared` maps the
+ * branches whose origin copy differs but holds nothing new to the origin tip
+ * that was checked. `unverified` lists branches whose origin copy couldn't be
+ * checked (not fetched, or git failed): never cleared, the caller fails closed.
+ */
+export async function findRemoteOnlyContent(
+  meta: StackMetadata,
+  branches: string[],
+): Promise<{
+  found: RemoteOnlyContent[];
+  cleared: Map<string, string>;
+  unverified: Unverified[];
+}> {
+  const found: RemoteOnlyContent[] = [];
+  const cleared = new Map<string, string>();
+  const unverified: Unverified[] = [];
+  const heads = await git.remoteHeads();
+  const trunk = await git.trunkBranch();
+
+  const targets: { branch: string; local: string; remote: string }[] = [];
+  for (const branch of new Set(branches)) {
+    if (branch === trunk || branch === "main" || branch === "master") continue;
+    const remote = heads.get(branch);
+    if (!remote || !(await git.localBranchExists(branch))) continue;
+    const local = await git.revParse(branch);
+    if (remote !== local) targets.push({ branch, local, remote });
+  }
+  if (targets.length === 0) return { found, cleared, unverified };
+
+  // Origin's trunk too: commits that came from it (GitHub's "Update branch"
+  // merges main into a PR branch) aren't the user's to lose.
+  const trunkTip = heads.get(trunk);
+  await git.fetchObjectsOnly([
+    ...targets.map((t) => `refs/heads/${t.branch}`),
+    ...(trunkTip ? [`refs/heads/${trunk}`] : []),
+  ]);
+
+  for (const { branch, local, remote } of targets) {
+    if (!(await git.refExists(`${remote}^{commit}`))) {
+      unverified.push({
+        branch,
+        remoteSha: remote,
+        reason: `origin/${branch} couldn't be fetched`,
+      });
+      continue;
+    }
+    if (await git.isAncestor(remote, local)) {
+      cleared.set(branch, remote); // local already has all of it
+      continue;
+    }
+
+    const known = [
+      local,
+      ...(await reflogTips(branch)),
+      ...snapshotTips(meta, branch),
+      ...(trunkTip ? [trunkTip] : []),
+    ];
+    const candidates = await revListLines([
+      "--ignore-missing",
+      "--reverse",
+      "--no-merges",
+      remote,
+      "--not",
+      ...new Set(known),
+    ]);
+    const unmatched = await revListLines([
+      "--cherry-pick",
+      "--right-only",
+      "--no-merges",
+      `${local}...${remote}`,
+    ]);
+    if (candidates === null || unmatched === null) {
+      // No verdict is not a clean verdict: this branch stays unchecked.
+      unverified.push({ branch, remoteSha: remote, reason: "git rev-list failed comparing it" });
+      continue;
+    }
+    const fresh = candidates.filter((sha) => unmatched.includes(sha));
+    if (fresh.length === 0) {
+      cleared.set(branch, remote);
+      continue;
+    }
+    found.push({
+      branch,
+      localSha: local,
+      remoteSha: remote,
+      commits: await oneLines(fresh),
+      behind: await git.isAncestor(local, remote),
+    });
+  }
+  return { found, cleared, unverified };
+}
+
+/** Earlier tips of `refs/heads/<branch>`, newest first. */
+async function reflogTips(branch: string): Promise<string[]> {
+  const { stdout } = await $`git reflog show --format=%H refs/heads/${branch}`.nothrow().quiet();
+  return stdout.toString().split("\n").filter(Boolean).slice(0, REFLOG_DEPTH);
+}
+
+/** Tips of `branch` that snapshots recorded (the pre-rewrite versions). */
+function snapshotTips(meta: StackMetadata, branch: string): string[] {
+  const tips = new Set<string>();
+  for (const snap of meta.snapshots ?? []) {
+    const sha = snap.branches[branch];
+    if (sha) tips.add(sha);
+  }
+  return [...tips];
+}
+
+/** `git rev-list` output, or null if it failed (never an empty "nothing found"). */
+async function revListLines(args: string[]): Promise<string[] | null> {
+  const { stdout, exitCode } = await $`git rev-list ${args}`.nothrow().quiet();
+  if (exitCode !== 0) return null;
+  return stdout.toString().split("\n").filter(Boolean);
+}
+
+/** "abbrev subject" for each sha, in the given order, from one `git log`. */
+async function oneLines(shas: string[]): Promise<string[]> {
+  const { stdout } = await $`git log --no-walk=unsorted --format=${"%h %s"} ${shas}`
+    .nothrow()
+    .quiet();
+  return stdout.toString().split("\n").filter(Boolean);
+}
+
+/**
+ * Stop a run before it rewrites a branch whose origin copy has new content.
+ * Interactive: ask (default no). Under --yes: refuse, since no flag the user
+ * gave said "drop commits from origin". `--overwrite-remote` proceeds. A dry
+ * run only reports.
+ */
+export async function guardRemoteContent(
+  meta: StackMetadata,
+  branches: string[],
+  opts: { command: string; overwrite: boolean; dryRun: boolean },
+): Promise<Map<string, string>> {
+  const { found, cleared, unverified } = await findRemoteOnlyContent(meta, branches);
+  if (found.length === 0 && unverified.length === 0) return cleared;
+
+  if (unverified.length > 0) {
+    console.log();
+    p.log.error(
+      "Couldn't check these branches' copies on origin for commits the local branches lack:",
+    );
+    for (const u of unverified) {
+      console.log(
+        `  ${pc.yellow(u.branch)}  ${pc.dim(`(origin ${u.remoteSha.slice(0, 8)}: ${u.reason})`)}`,
+      );
+    }
+    console.log();
+    console.log(
+      `  ${opts.command} would rebase or force-push them without knowing what's there. Look first:`,
+    );
+    for (const u of unverified) {
+      console.log(
+        `    ${pc.green(`git fetch origin ${u.branch} && git log ${u.branch}..origin/${u.branch}`)}`,
+      );
+    }
+    console.log(`  Then re-run ${pc.green(`gh-stack ${opts.command}`)}.`);
+    console.log(
+      `  Or, to overwrite them regardless: ${pc.green(`gh-stack ${opts.command} --overwrite-remote`)}`,
+    );
+  }
+  if (found.length === 0) return decide(cleared, [], unverified, opts);
+
+  console.log();
+  p.log.error(
+    "Origin has commits that the local branches don't, and they aren't earlier versions of local commits:",
+  );
+  for (const f of found) {
+    console.log(
+      `  ${pc.yellow(f.branch)}  ${pc.dim(`(origin ${f.remoteSha.slice(0, 8)}, local ${f.localSha.slice(0, 8)})`)}`,
+    );
+    for (const c of f.commits) console.log(`    ${pc.red("+")} ${c}`);
+  }
+  console.log();
+  console.log(
+    `  ${opts.command} would rebase or force-push ${found.length === 1 ? "this branch" : "these branches"} without them, and they'd be lost from origin and the PR.`,
+  );
+  console.log(
+    "  This is what happens after `merge --collapse` squashes a child PR into its parent on GitHub.",
+  );
+  console.log();
+  console.log("  Bring them into the local branch first:");
+  for (const f of found) {
+    const shas = f.commits.map((c) => c.split(" ")[0]).join(" ");
+    console.log(
+      `    ${pc.green(f.behind ? `git checkout ${f.branch} && git pull --ff-only origin ${f.branch}` : `git checkout ${f.branch} && git cherry-pick ${shas}`)}`,
+    );
+  }
+  console.log(`  Then re-run ${pc.green(`gh-stack ${opts.command}`)}.`);
+  console.log(
+    `  Or, to drop them on purpose: ${pc.green(`gh-stack ${opts.command} --overwrite-remote`)}`,
+  );
+  return decide(cleared, found, unverified, opts);
+}
+
+/**
+ * What to do about branches with new or unchecked content on origin: report
+ * (dry run), proceed (--overwrite-remote, or an interactive yes), or stop
+ * (--yes, or no). Proceeding clears their checked tips for an explicit lease.
+ */
+async function decide(
+  cleared: Map<string, string>,
+  found: RemoteOnlyContent[],
+  unverified: Unverified[],
+  opts: { overwrite: boolean; dryRun: boolean },
+): Promise<Map<string, string>> {
+  console.log();
+  if (opts.dryRun) {
+    p.log.warn("[DRY RUN] A real run would stop here.");
+    return cleared;
+  }
+  const overwrite = () => {
+    for (const f of found) cleared.set(f.branch, f.remoteSha);
+    for (const u of unverified) cleared.set(u.branch, u.remoteSha);
+    return cleared;
+  };
+  if (opts.overwrite) {
+    p.log.warn(
+      "--overwrite-remote: continuing. Origin's copies of those branches will be overwritten.",
+    );
+    return overwrite();
+  }
+  if (isAutoYes()) {
+    p.cancel("Stopped before rewriting anything (--yes never overwrites what it couldn't check).");
+    process.exit(1);
+  }
+  const ok = await p.confirm({
+    message: "Rewrite anyway, overwriting origin's copies of those branches?",
+    initialValue: false,
+  });
+  if (p.isCancel(ok) || !ok) {
+    p.cancel("Stopped before rewriting anything.");
+    process.exit(1);
+  }
+  return overwrite();
+}