git-workspace-bare 0.1.1 → 0.3.0

package/test/fixtures/checkpoint.js

@@ -0,0 +1,14 @@
+import os from 'bare-os'
+import process from 'bare-process'
+
+const home = Bare.argv.splice(2, 1)[0]
+os.homedir = () => home
+const { default: checkpoint, readCheckpoint } = await import('../../lib/checkpoint.js')
+try {
+  console.log(
+    Bare.argv.includes('--show') ? readCheckpoint() || 'No applied checkpoint' : checkpoint()
+  )
+} catch (err) {
+  console.error(err.message)
+  process.exitCode = 1
+}

package/test/fixtures/completion.bash

@@ -0,0 +1,28 @@
+# Drive the same completion functions that Bash invokes on Tab.
+completion_bin=$1
+git_completion=$2
+shift 2
+export PATH="$completion_bin:$PATH"
+
+if [ -n "$git_completion" ]; then
+    source "$git_completion" || exit 1
+    git_before=$(complete -p git)
+fi
+completion_script=$(command git-workspace completion bash) || exit 1
+eval "$completion_script" || exit 1
+
+COMP_WORDS=("$@")
+COMP_CWORD=$(( ${#COMP_WORDS[@]} - 1 ))
+COMP_LINE="${COMP_WORDS[*]}"
+COMP_POINT=${#COMP_LINE}
+COMP_TYPE=9
+COMPREPLY=()
+if [ "${COMP_WORDS[0]}" = git ]; then
+    [ "$(complete -p git)" = "$git_before" ] || exit 1
+    __git_func_wrap __git_main
+else
+    _git_workspace_direct
+fi
+for candidate in "${COMPREPLY[@]}"; do
+    printf '%s\n' "$candidate"
+done

package/test/helpers.js

@@ -15,19 +15,58 @@ export default function setup(t, { initialize = true } = {}) {
   fs.mkdirSync(path.join(temporary, 'hooks'))
   fs.writeFileSync(config, '')
 
+  // A private PATH prevents tests from running hooks installed on the developer's machine.
+  const bin = path.join(temporary, 'bin')
+  fs.mkdirSync(bin)
+  const gitPath = spawnSync('which', ['git']).stdout.toString().trim()
+  fs.symlinkSync(gitPath, path.join(bin, 'git'))
+  fs.symlinkSync(os.execPath(), path.join(bin, 'bare'))
+  for (const name of [
+    'bash',
+    'sh',
+    'env',
+    'which',
+    'cat',
+    'dirname',
+    'basename',
+    'sed',
+    'tr',
+    'sort',
+    'cut',
+    'grep',
+    'head',
+    'mkdir',
+    'rm',
+    'uname',
+    'pwd',
+    'perl',
+    'sleep',
+    'touch',
+    'wc',
+    'awk',
+    'ln'
+  ]) {
+    const executable = ['/bin', '/usr/bin']
+      .map((directory) => path.join(directory, name))
+      .find((file) => fs.existsSync(file))
+    if (executable) fs.symlinkSync(executable, path.join(bin, name))
+  }
+
   const env = { ...process.env }
   for (const key of Object.keys(env)) {
     if (key.startsWith('GIT_')) delete env[key]
   }
   Object.assign(env, {
+    PATH: bin,
+    GIT_WORKSPACE_HOOK: '',
     GIT_CONFIG_NOSYSTEM: '1',
     GIT_CONFIG_GLOBAL: config,
     GIT_ALLOW_PROTOCOL: 'file',
     GIT_TERMINAL_PROMPT: '0'
   })
 
-  function run(file, args) {
-    const result = spawnSync(file, args, { cwd: temporary, env })
+  function run(file, args, { env: overrides = {} } = {}) {
+    const result = spawnSync(file, args, { cwd: temporary, env: { ...env, ...overrides } })
     if (result.error) throw result.error
     return {
       status: result.status,
@@ -68,11 +107,30 @@ export default function setup(t, { initialize = true } = {}) {
     return result.stdout
   }
 
+  const checkpointRunner = fs.realpathSync(new URL('./fixtures/checkpoint.js', import.meta.url))
+  function checkAt(directory, ...args) {
+    return run(os.execPath(), [checkpointRunner, directory, ...args])
+  }
+  function check(...args) {
+    return checkAt(home, ...args)
+  }
+  function checked(...args) {
+    const result = check(...args)
+    if (result.status !== 0) throw new Error(result.stderr)
+    return result.stdout
+  }
+
   if (initialize) ok('init', 'owner/workspace')
 
   return {
+    bin,
+    env,
+    run,
     cli,
     cliAt,
+    check,
+    checkAt,
+    checked,
     ok,
     git,
     home,

package/test/hooks.js

@@ -0,0 +1,451 @@
+import test from 'brittle'
+import fs from 'bare-fs'
+import path from 'bare-path'
+import os from 'bare-os'
+import setup from './helpers.js'
+
+const quote = (value) => "'" + value.replaceAll("'", "'\\''") + "'"
+const runner = fs.realpathSync(new URL('./fixtures/cli.js', import.meta.url))
+const logPath = (context) => path.join(context.home, 'hook.jsonl')
+const logs = (context) =>
+  fs.existsSync(logPath(context))
+    ? fs.readFileSync(logPath(context), 'utf8').trim().split('\n').filter(Boolean).map(JSON.parse)
+    : []
+
+function install(context, command, name = 'capture', body = '') {
+  const file = path.join(context.bin, `git-workspace-hook-${command}-post-${name}`)
+  fs.writeFileSync(file, `#!/bin/sh\ncat >> ${quote(logPath(context))}\n${body}\n`, { mode: 0o755 })
+  return file
+}
+
+test('hooks are discovered before init, using executable PATH entries and deterministic order', (t) => {
+  const context = setup(t, { initialize: false })
+  const { home, bin, env, run, ok } = context
+  const first = install(context, 'add', 'zebra')
+  const second = install(context, 'add', 'alpha')
+  const linked = path.join(bin, 'git-workspace-hook-remove-post-linked')
+  fs.symlinkSync(second, linked)
+  const ignored = install(context, 'rename', 'ignored')
+  fs.chmodSync(ignored, 0o644)
+  fs.mkdirSync(path.join(bin, 'git-workspace-hook-add-post-directory'))
+  install(context, 'fetch', 'future')
+  fs.symlinkSync(path.join(home, 'missing'), path.join(bin, 'git-workspace-hook-add-post-broken'))
+  const other = path.join(home, 'other bin')
+  fs.mkdirSync(other)
+  fs.writeFileSync(path.join(other, path.basename(first)), '#!/bin/sh\nexit 99\n', { mode: 0o755 })
+  const fallback = path.join(other, path.basename(ignored))
+  fs.writeFileSync(fallback, '#!/bin/sh\nexit 99\n', { mode: 0o755 })
+  const result = run(os.execPath(), [runner, home, 'hook', 'list'], {
+    env: { PATH: bin + ':' + other }
+  })
+  t.is(result.status, 0)
+  t.is(result.stderr, '')
+  t.is(
+    result.stdout,
+    `add/post\talpha\t${second}\nadd/post\tzebra\t${first}\nremove/post\tlinked\t${linked}\nrename/post\tignored\t${fallback}\n`
+  )
+  t.is(env.PATH, bin, 'the fixture has an isolated PATH')
+  t.is(logs(context).length, 0, 'listing never executes hooks')
+  t.ok(ok('hook', 'list', '-h').includes('List available post hooks'))
+})
+
+test('one add post hook includes implicit root, stable IDs, argv, cwd and committed state', (t) => {
+  const context = setup(t)
+  const { ok, git, root, registry, home } = context
+  const metadata = path.join(home, 'metadata')
+  const directory = path.dirname(registry)
+  install(
+    context,
+    'add',
+    'capture',
+    `printf '%s\\n' "$1" "$2" "$PWD" "$GIT_WORKSPACE_HOOK" > ${quote(metadata)}\ngit -C ${quote(directory)} rev-parse HEAD refs/git-workspace/applied >> ${quote(metadata)}\necho hook-output\necho hook-error >&2`
+  )
+  const result = context.cli('add', 'owner/repo@jobs')
+  t.is(result.status, 0, result.stderr)
+  t.ok(result.stderr.includes('hook-output\nhook-error\n'), 'both hook streams go to stderr')
+  t.absent(result.stdout.includes('hook-output'))
+  const [payload] = logs(context)
+  t.is(logs(context).length, 1, 'implicit root does not dispatch another add')
+  t.is(payload.version, 1)
+  t.is(payload.command, 'add')
+  t.is(payload.phase, 'post')
+  t.is(payload.operation.source, 'cli')
+  t.is(payload.operation.resumed, false)
+  t.ok(payload.operation.id)
+  t.alike(payload.workspace, { root: path.join(home, 'workspace'), manifest: registry })
+  t.alike(payload.input, { repository: 'owner/repo@jobs' })
+  t.is(payload.result.status, 'ok')
+  t.is(payload.result.error, null)
+  const entries = JSON.parse(fs.readFileSync(registry, 'utf8')).repositories
+  const [parent, child] = payload.result.data.checkouts
+  t.is(parent.before.exists, false)
+  t.is(parent.after.id, entries[0].id)
+  t.is(parent.after.path, root)
+  t.is(child.after.id, entries[0].worktrees[0].id)
+  t.is(child.after.repository.id, entries[0].id)
+  t.is(child.after.branch, 'jobs')
+  t.is(child.after.exists, true)
+  t.is(child.after.registered, true)
+  const head = git('-C', directory, 'rev-parse', 'HEAD')
+  t.is(
+    fs.readFileSync(metadata, 'utf8'),
+    `add\npost\n${path.join(home, 'workspace')}\n1\n${head}\n${head}\n`
+  )
+  ok('add', 'owner/repo@jobs')
+  const repeated = logs(context)[1]
+  t.is(repeated.result.data.changed, false, 'no-op adds still deliver hooks')
+  t.unlike(repeated.operation.id, payload.operation.id, 'each CLI invocation has a new ID')
+})
+
+test('rename and remove preserve old identities, including root-linked unregistered worktrees', (t) => {
+  const context = setup(t)
+  const { ok, git, root } = context
+  ok('add', 'owner/repo@jobs')
+  git('-C', root, 'worktree', 'add', '-b', 'extra', root + '@extra')
+  git('-C', root, 'worktree', 'add', '-b', 'extra+native', root + '@extra+native')
+  install(context, 'rename')
+  install(context, 'remove')
+  ok('rename', 'owner/repo@jobs', 'owner/repo@fixes')
+  ok('rename', 'owner/repo', 'other/new')
+  const [branch, parent] = logs(context)
+  const moved = branch.result.data.checkouts[0]
+  t.is(moved.before.branch, 'jobs')
+  t.is(moved.after.branch, 'fixes')
+  t.is(moved.before.id, moved.after.id)
+  t.is(moved.after.name, 'owner/repo@fixes')
+  const children = parent.result.data.checkouts
+  t.alike(
+    children.map(({ after }) => after.name),
+    ['other/new', 'other/new@fixes', 'other/new@extra', 'other/new@extra+native']
+  )
+  t.is(children[0].after.origin, 'git@github.com:other/new.git')
+  t.is(children[1].before.id, children[1].after.id)
+  t.is(children[2].after.id, null, 'unregistered worktrees have no fabricated ID')
+  t.is(children[2].after.registered, false)
+  t.is(children[3].after.branch, 'extra+native', 'ordinary Git worktree names are preserved')
+  t.is(children[3].after.id, null)
+  ok('remove', 'other/new@fixes')
+  const removed = logs(context)[2].result.data.checkouts[0]
+  t.is(removed.before.id, moved.before.id)
+  t.is(removed.after.id, removed.before.id)
+  t.is(removed.before.exists, true)
+  t.is(removed.after.exists, false)
+  t.is(removed.after.registered, false)
+  t.is(removed.after.ref, null)
+  t.is(removed.before.branch, 'fixes')
+})
+
+test('hook errors warn, continue in order and preserve command status; --no-hooks bypasses delivery', (t) => {
+  const context = setup(t)
+  const { cli, ok, bin, root } = context
+  ok('add', 'owner/repo')
+  install(context, 'add', 'alpha', 'echo alpha; exit 7')
+  const broken = path.join(bin, 'git-workspace-hook-add-post-middle')
+  fs.writeFileSync(broken, '#!/missing-hook-interpreter\n', { mode: 0o755 })
+  install(context, 'add', 'signal', 'kill -TERM "$$"')
+  install(context, 'add', 'zebra', 'echo zebra')
+  const result = cli('add', 'owner/repo')
+  t.is(result.status, 0)
+  t.is(result.stdout, '')
+  t.ok(result.stderr.includes('exit status 7'))
+  t.ok(result.stderr.includes('hook git-workspace-hook-add-post-middle failed'))
+  t.ok(result.stderr.includes('hook git-workspace-hook-add-post-signal failed: signal'))
+  t.ok(result.stderr.indexOf('alpha') < result.stderr.indexOf('zebra'))
+  t.is(logs(context).length, 3)
+  ok('add', '--no-hooks', 'owner/repo@skip')
+  install(context, 'remove')
+  install(context, 'rename')
+  ok('rename', '--no-hooks', 'owner/repo@skip', 'owner/repo@skipped')
+  ok('remove', '--no-hooks', 'owner/repo@skipped')
+  t.is(logs(context).length, 3)
+  ok('add', '-h')
+  ok('--complete', 'add', '')
+  t.is(cli('add', '../invalid').status, 1)
+  t.is(logs(context).length, 3, 'help, completion and invalid names do not dispatch')
+  fs.writeFileSync(path.join(root, 'dirty'), 'local')
+  const failed = cli('remove', 'owner/repo')
+  t.is(failed.status, 1)
+  t.is(logs(context).at(-1).result.status, 'error')
+  t.is(logs(context).at(-1).result.data.changed, false)
+})
+
+test('a hook invoking another workspace command does not recursively invoke hooks', (t) => {
+  const context = setup(t)
+  install(
+    context,
+    'add',
+    'nested',
+    `${quote(os.execPath())} ${quote(runner)} ${quote(context.home)} add owner/repo`
+  )
+  t.is(context.cli('add', 'owner/repo').status, 0)
+  t.is(logs(context).length, 1)
+})
+
+test('post hooks report implicit-root and manifest-commit partial failures', (t) => {
+  const context = setup(t)
+  const { cli, ok, registry, root } = context
+  install(context, 'add')
+  t.is(cli('add', 'owner/repo@main').status, 1, 'main is already checked out by the new root')
+  const failed = logs(context)[0]
+  t.is(failed.result.status, 'partial')
+  t.is(failed.result.data.checkouts[0].after.exists, true)
+  t.is(failed.result.data.checkouts[0].after.registered, true)
+  t.is(failed.result.data.checkouts[1].after.exists, false)
+  ok('add', '--no-hooks', 'owner/repo')
+  const lock = path.join(path.dirname(registry), '.git/index.lock')
+  fs.writeFileSync(lock, '')
+  t.is(cli('add', 'owner/repo@jobs').status, 1)
+  const commit = logs(context)[1]
+  t.is(commit.result.status, 'partial')
+  t.ok(commit.result.error.message.includes('could not commit the manifest'))
+  t.is(commit.result.data.checkouts[1].after.exists, true)
+  t.is(commit.result.data.checkouts[1].after.registered, true)
+  t.ok(fs.existsSync(root + '@jobs'))
+})
+
+test('partial remove and branch rename contexts describe actual remaining paths and refs', (t) => {
+  const context = setup(t)
+  const { cli, ok, root } = context
+  ok('add', 'owner/repo@jobs')
+  install(context, 'remove')
+  const lock = path.join(root, '.git/refs/heads/jobs.lock')
+  fs.writeFileSync(lock, '')
+  t.is(cli('remove', 'owner/repo@jobs').status, 1)
+  const removed = logs(context)[0]
+  t.is(removed.result.status, 'partial')
+  const after = removed.result.data.checkouts[0].after
+  t.is(after.exists, false)
+  t.is(after.registered, true)
+  t.ok(after.ref, 'branch still exists after worktree removal')
+  fs.unlinkSync(lock)
+  ok('remove', '--no-hooks', 'owner/repo@jobs')
+  ok('add', 'owner/repo@jobs')
+  install(context, 'rename')
+  fs.writeFileSync(path.join(root, '.git/config.lock'), '')
+  t.is(cli('rename', 'owner/repo@jobs', 'owner/repo@fixes').status, 1)
+  const renamed = logs(context)[1]
+  t.is(renamed.result.status, 'partial')
+  const moved = renamed.result.data.checkouts[0]
+  t.is(moved.before.name, 'owner/repo@jobs')
+  t.is(moved.after.name, 'owner/repo@fixes')
+  t.is(moved.after.branch, 'fixes')
+  t.is(moved.after.registered, false, 'manifest retains the old name on failure')
+  t.is(moved.before.id, moved.after.id)
+})
+
+function machines(t) {
+  const context = setup(t)
+  const { ok, git, registry, upstream, home } = context
+  ok('add', 'owner/repo@jobs')
+  const directory = path.dirname(registry)
+  git('clone', '--bare', directory, path.join(upstream, 'owner/workspace.git'))
+  const second = path.join(home, 'second')
+  fs.mkdirSync(second)
+  const cli = (...args) => context.cliAt(second, ...args)
+  for (const args of [
+    ['init', 'owner/workspace'],
+    ['add', 'owner/repo@jobs']
+  ]) {
+    const result = cli(...args)
+    if (result.status !== 0) throw new Error(result.stderr)
+  }
+  return {
+    ...context,
+    second,
+    cli,
+    local: path.join(second, 'workspace/owner/workspace'),
+    root: path.join(second, 'workspace/owner/repo'),
+    push: () => git('-C', directory, 'push', 'origin', 'main')
+  }
+}
+
+test('pull dispatches each logical operation with stable IDs and never hooks a dry run', (t) => {
+  const context = machines(t)
+  const { ok, cli, push, local } = context
+  ok('rename', 'owner/repo@jobs', 'owner/repo@fixes')
+  ok('add', 'owner/repo@new')
+  push()
+  for (const command of ['add', 'remove', 'rename']) install(context, command)
+  t.is(cli('pull', '--dry-run').status, 0)
+  t.is(logs(context).length, 0)
+  const result = cli('pull')
+  t.is(result.status, 0, result.stderr)
+  const [renamed, added] = logs(context)
+  t.is(logs(context).length, 2)
+  t.is(renamed.command, 'rename')
+  t.is(added.command, 'add')
+  for (const payload of logs(context)) {
+    t.is(payload.operation.source, 'pull')
+    t.is(payload.operation.resumed, false)
+    t.is(payload.result.status, 'ok')
+    t.is(payload.workspace.manifest, path.join(local, 'workspace.json'))
+  }
+  const entries = JSON.parse(fs.readFileSync(path.join(local, 'workspace.json'), 'utf8'))
+    .repositories[0]
+  t.is(
+    added.result.data.checkouts[1].after.id,
+    entries.worktrees.find((entry) => entry.branch === 'new').id
+  )
+  t.is(renamed.result.data.checkouts[0].before.id, renamed.result.data.checkouts[0].after.id)
+  ok('remove', '--no-hooks', 'owner/repo@new')
+  push()
+  t.is(cli('pull', '--no-hooks').status, 0)
+  t.is(logs(context).length, 2)
+})
+
+for (const skip of [false, true]) {
+  test(`pull preserves completed removal and pending hook across a crash${skip ? ' with --no-hooks recovery' : ''}`, (t) => {
+    const context = machines(t)
+    const { ok, cli, push, local, root, home, git } = context
+    ok('remove', 'owner/repo@jobs')
+    push()
+    const marker = path.join(home, 'delivered')
+    install(
+      context,
+      'remove',
+      'crash',
+      `if [ ! -e ${quote(marker)} ]; then touch ${quote(marker)}; kill -KILL "$PPID"; fi`
+    )
+    t.unlike(cli('pull').status, 0)
+    const progress = path.join(local, '.git/workspace-pull.json')
+    const state = JSON.parse(fs.readFileSync(progress, 'utf8'))
+    t.is(state.completed, 1)
+    t.is(state.pending, false)
+    t.ok(state.postHook)
+    t.absent(fs.existsSync(root + '@jobs'))
+    const bytes = fs.readFileSync(progress, 'utf8')
+    t.is(cli('pull', '--dry-run').status, 0)
+    t.is(fs.readFileSync(progress, 'utf8'), bytes, 'dry-run preserves pending delivery')
+    t.is(logs(context).length, 1)
+    const resumed = cli('pull', ...(skip ? ['--no-hooks'] : []))
+    t.is(resumed.status, 0, resumed.stderr)
+    t.is(logs(context).length, skip ? 1 : 2)
+    if (!skip) {
+      const [first, retry] = logs(context)
+      t.is(retry.operation.id, first.operation.id)
+      t.is(retry.operation.resumed, true)
+      t.alike(retry.result, first.result, 'recovery delivers the saved removal snapshot')
+    }
+    t.absent(fs.existsSync(progress))
+    t.is(
+      git('-C', local, 'rev-parse', 'refs/git-workspace/applied'),
+      git('-C', local, 'rev-parse', 'HEAD')
+    )
+  })
+}
+
+test('pull retains operation identity and original paths when recovering a partial rename', (t) => {
+  const context = machines(t)
+  const { ok, cli, push, root, local } = context
+  ok('rename', 'owner/repo@jobs', 'owner/repo@fixes')
+  push()
+  install(context, 'rename')
+  const lock = path.join(root, '.git/config.lock')
+  fs.writeFileSync(lock, '')
+  t.is(cli('pull').status, 1)
+  const failed = logs(context)[0]
+  t.is(failed.result.status, 'partial')
+  t.is(failed.result.data.checkouts[0].after.name, 'owner/repo@fixes')
+  fs.unlinkSync(lock)
+  const resumed = cli('pull')
+  t.is(resumed.status, 0, resumed.stderr)
+  const completed = logs(context)[1]
+  t.is(completed.operation.id, failed.operation.id)
+  t.is(completed.operation.resumed, true)
+  t.is(completed.result.status, 'ok')
+  t.is(completed.result.data.checkouts[0].before.name, 'owner/repo@jobs')
+  t.is(completed.result.data.checkouts[0].after.registered, true)
+  t.absent(fs.existsSync(path.join(local, '.git/workspace-pull.json')))
+})
+
+test('pull recovers an interrupted root move before post context was saved', (t) => {
+  const context = machines(t)
+  const { ok, cli, push, local, second, root, run, home, env } = context
+  ok('rename', 'owner/repo', 'other/new')
+  push()
+  install(context, 'rename')
+  const shim = path.join(home, 'git-shim')
+  fs.mkdirSync(shim)
+  const realGit = fs.realpathSync(path.join(context.bin, 'git'))
+  fs.writeFileSync(
+    path.join(shim, 'git'),
+    `#!/bin/sh\ncase "$*" in\n  *'worktree repair'*) kill -KILL "$PPID"; exit 99;;\nesac\nexec ${quote(realGit)} "$@"\n`,
+    { mode: 0o755 }
+  )
+  const interrupted = run(os.execPath(), [runner, second, 'pull'], {
+    env: { PATH: shim + ':' + env.PATH }
+  })
+  t.unlike(interrupted.status, 0)
+  const progress = path.join(local, '.git/workspace-pull.json')
+  const state = JSON.parse(fs.readFileSync(progress, 'utf8'))
+  t.is(state.completed, 0)
+  t.is(state.pending, true)
+  t.absent(state.postHook)
+  t.is(logs(context).length, 0)
+  t.absent(fs.existsSync(root))
+  const resumed = cli('pull')
+  t.is(resumed.status, 0, resumed.stderr)
+  const [payload] = logs(context)
+  t.is(logs(context).length, 1)
+  t.is(payload.operation.id, state.hookOperation.context.operation.id)
+  t.is(payload.operation.resumed, true)
+  t.is(payload.result.status, 'ok')
+  t.alike(
+    payload.result.data.checkouts.map(({ before, after }) => [before.name, after.name]),
+    [
+      ['owner/repo', 'other/new'],
+      ['owner/repo@jobs', 'other/new@jobs']
+    ]
+  )
+  t.is(payload.result.data.checkouts[1].after.exists, true)
+  t.is(payload.result.data.checkouts[1].after.branch, 'jobs')
+})
+
+test('failed pull hooks count as delivered and do not block later operations or the checkpoint', (t) => {
+  const context = machines(t)
+  const { ok, cli, push, local, git } = context
+  ok('remove', 'owner/repo@jobs')
+  ok('add', 'owner/repo@new')
+  push()
+  install(context, 'remove', 'failure', 'exit 7')
+  install(context, 'add')
+  const result = cli('pull')
+  t.is(result.status, 0, result.stderr)
+  t.ok(result.stderr.includes('exit status 7'))
+  t.alike(
+    logs(context).map(({ command }) => command),
+    ['remove', 'add']
+  )
+  t.absent(fs.existsSync(path.join(local, '.git/workspace-pull.json')))
+  t.is(
+    git('-C', local, 'rev-parse', 'refs/git-workspace/applied'),
+    git('-C', local, 'rev-parse', 'HEAD')
+  )
+})
+
+test('invalid saved hook context is refused without delivering it or replaying checkouts', (t) => {
+  const context = machines(t)
+  const { ok, cli, push, local, root, home } = context
+  ok('remove', 'owner/repo@jobs')
+  push()
+  const marker = path.join(home, 'once')
+  install(
+    context,
+    'remove',
+    'crash',
+    `if [ ! -e ${quote(marker)} ]; then touch ${quote(marker)}; kill -KILL "$PPID"; fi`
+  )
+  t.unlike(cli('pull').status, 0)
+  const progress = path.join(local, '.git/workspace-pull.json')
+  const state = JSON.parse(fs.readFileSync(progress, 'utf8'))
+  const original = JSON.stringify(state)
+  state.postHook.input.repository = 'other/repo'
+  fs.writeFileSync(progress, JSON.stringify(state))
+  const refused = cli('pull')
+  t.is(refused.status, 1)
+  t.ok(refused.stderr.includes('Invalid hook progress'))
+  t.is(logs(context).length, 1)
+  t.absent(fs.existsSync(root + '@jobs'))
+  fs.writeFileSync(progress, original)
+  t.is(cli('pull').status, 0)
+})