omp-conductor 0.18.0 → 0.18.1

package/src/failure-class.ts

@@ -17,9 +17,14 @@
 
 import type { Caps, FailureClass, RecoveryAction, RunRecord } from "./types.ts";
 
-/** Facts the caller fetched, each only for the rows that need it. */
+/** Facts the caller fetched, each only for the rows that need it.
+ *
+ *  `pr` can also be `"missing"`: the tracker has proven the claimed PR
+ *  definitively does not exist (#779). It is a fact, the same way `"closed"`
+ *  is — a REST 404 the adapter corroborated with a same-repository pulls-list
+ *  read — never a transient "could not tell", which stays `undefined`. */
 export interface ClassifyFacts {
-  pr?: "open" | "merged" | "closed";
+  pr?: "open" | "merged" | "closed" | "missing";
   mergeable?: "conflicting" | "clean" | "unknown";
   checks?: { name: string; state: string; link?: string }[];
   /** Full session error recovered from the transcript. Kept as a fact so a
@@ -142,6 +147,12 @@ const START_FAILURE_SIGNATURES = [
   "invalid api key",
   "authentication failed",
   "could not load its peer dependency",
+  // The pre-launch identity gate (#798/#828): the account is missing, or the
+  // harness binding a worker resolves through is not established. The daemon
+  // refuses before it spawns anything, so no attempt was spent — and the
+  // symptom this replaced (the child dying on the peer import) already read as
+  // a start failure, so charging one here would be a regression dressed as a fix.
+  "worker identity unavailable",
 ] as const;
 
 /**
@@ -512,6 +523,21 @@ export function classifyRun(
   if (run.state === "failed" && facts.pr === "open") {
     const checks = facts.checks ?? [];
     const unresolved = checks.filter((c) => !SUCCESS_CHECK_STATES[normalise(c.state)] === true);
+    if (checks.length > 0 && unresolved.length === 0) {
+      // The PR is open and every check is green: the strongest mechanical
+      // success evidence there is short of merge. The row's `failed` state is
+      // stale — whatever the worker recorded, its work is passing — so this is
+      // not a failure of any class. `none` recovery restores it to
+      // `pushed-green` in classifyAndRecover instead of escalating an
+      // `[unknown]` that charges an attempt (#766). An empty check list is
+      // "could not tell", not all-green, and still falls through to `unknown`
+      // below.
+      return {
+        cls: "unknown",
+        recovery: "none",
+        evidence: `${run.prUrl ?? "the PR"} is open and every check is green`,
+      };
+    }
     if (checks.length > 0 && unresolved.length > 0) {
       // A failed check whose *log* smells like infrastructure — a registry 429,
       // a runner shutdown, a DNS failure (#177). The check has a verdict, so

package/src/fleet.ts

@@ -50,8 +50,24 @@ import { inspectBriefLayout } from "./brief-upgrade.ts";
 import { dbPath, openStore } from "./store.ts";
 import { renderBriefForProject } from "./setup.ts";
 import { DEFAULT_ARM_PROOF, type ArmProof, type DaemonStop, type ProjectConfig, type Store } from "./types.ts";
-import { probeCodeGraph, type CodeGraphHealth } from "./graph-health.ts";
+import { DEFAULT_DEPS, probeCodeGraph, type CodeGraphHealth } from "./graph-health.ts";
 import { isPaused, setPaused, statusSnapshot, type StatusSnapshot } from "./daemon.ts";
+// The drain surface belongs beside hold/releaseHold on the operator surface:
+// the record is daemon state (implemented next to the pause sentinel), but the
+// later CLI and release #484 children import from here, exactly where they find
+// every other fleet control.
+export {
+  cancelDrain,
+  consumeDrain,
+  createDrain,
+  drainPath,
+  readDrain,
+  type CreateDrainOptions,
+  type DrainProblem,
+  type DrainRecord,
+  type DrainStatus,
+  type DrainVerdict,
+} from "./daemon.ts";
 import {
   healthCheck,
   isAlive,
@@ -59,6 +75,7 @@ import {
   probeUnit,
   runSystemctl,
   stopDaemon,
+  type HealthCheckResult,
   type StopResult,
 } from "./lifecycle.ts";
 import type { WorkerPausePhase } from "./worker.ts";
@@ -1053,21 +1070,15 @@ export function parseHerdrAgentList(rawOutput: string): HerdrAgent[] {
   return out;
 }
 
-async function herdrOmpForegroundPids(paneId: string, deps: PaneStopDeps): Promise<number[]> {
-  const bin = deps.herdrBin ?? "herdr";
-  const session =
-    deps.herdrSession ??
-    resolveHerdrSessionWithBridge({ env: process.env, herdrBin: bin });
-  const res = spawnSync(bin, ["--session", session, "pane", "process-info", "--pane", paneId], {
-    encoding: "utf8",
-    timeout: 8_000,
-    env: process.env,
-  });
-  if (res.error) throw res.error;
-  if (res.status !== 0) {
-    throw new Error((res.stderr ?? res.stdout ?? `process-info exit ${String(res.status)}`).trim());
-  }
-  const raw = (res.stdout ?? "").trim();
+/**
+ * The `process_info` document out of `herdr pane process-info` output
+ * (#832): every caller that maps the fleet pane's live omp processes starts
+ * from this schema, whether the output carries herdr's CLI `result` envelope
+ * or the bare document. Throws when the output cannot be read; the caller
+ * decides what an unreadable answer means.
+ */
+export function parseHerdrProcessInfo(stdout: string, paneId: string): ProcessInfo {
+  const raw = stdout.trim();
   if (raw.length === 0) {
     throw new Error(`herdr pane process-info printed nothing for ${paneId}`);
   }
@@ -1083,10 +1094,27 @@ async function herdrOmpForegroundPids(paneId: string, deps: PaneStopDeps): Promi
   if (info === undefined) {
     throw new Error(`herdr pane process-info has no process_info for ${paneId} — unrecognized schema`);
   }
-  return ompPidsFromProcessInfo(info);
+  return info;
 }
 
-interface ProcessInfo {
+async function herdrOmpForegroundPids(paneId: string, deps: PaneStopDeps): Promise<number[]> {
+  const bin = deps.herdrBin ?? "herdr";
+  const session =
+    deps.herdrSession ??
+    resolveHerdrSessionWithBridge({ env: process.env, herdrBin: bin });
+  const res = spawnSync(bin, ["--session", session, "pane", "process-info", "--pane", paneId], {
+    encoding: "utf8",
+    timeout: 8_000,
+    env: process.env,
+  });
+  if (res.error) throw res.error;
+  if (res.status !== 0) {
+    throw new Error((res.stderr ?? res.stdout ?? `process-info exit ${String(res.status)}`).trim());
+  }
+  return ompPidsFromProcessInfo(parseHerdrProcessInfo(res.stdout ?? "", paneId));
+}
+
+export interface ProcessInfo {
   shell_pid?: number;
   foreground_processes?: ForegroundProc[];
 }
@@ -1121,6 +1149,85 @@ function isOmpProcess(proc: ForegroundProc): boolean {
   return false;
 }
 
+/**
+ * The omp processes the fleet pane claims, resolved to their start times
+ * (#832), or why they could not be read. Structurally identical to
+ * upgrade-verify's `PaneOmpProbe` — the upgrade engine and the post-restart
+ * verifier pass this straight into the pure verdicts, and the type is
+ * repeated here because the verifier leaf must not import this module (fleet
+ * reaches the daemon, which reaches the verifier).
+ */
+export type PaneProbeResult = { starts: readonly number[] } | { problem: string };
+
+/**
+ * Every omp process the fleet pane currently claims by herdr, resolved to
+ * its start time (#832): the pane is where an *external* orchestrator
+ * session lives, and the only fact that proves it reloaded is the live
+ * process's own start — a pane process still running from before the install
+ * began loaded the pre-upgrade extension. Every unreadable answer is a
+ * `problem`: absence of evidence is never a reload.
+ *
+ * `run` is the injected command runner (the upgrade's scripted seam, the
+ * daemon's `runCommand`), and `startTime` resolves one pid to its start —
+ * the /proc read lives with the verifier's other live-process facts.
+ */
+export async function herdrPaneOmpStarts(
+  run: (
+    command: string,
+    args: readonly string[],
+  ) => Promise<{ code: number; stdout: string; stderr: string }>,
+  session: string,
+  startTime: (pid: number) => number | undefined,
+): Promise<PaneProbeResult> {
+  const agents = await run("herdr", ["--session", session, "agent", "list"]);
+  if (agents.code !== 0) {
+    return {
+      problem:
+        `herdr agent list failed: ${agents.stderr.trim() || agents.stdout.trim() || `exit ${agents.code}`}`,
+    };
+  }
+  let parsed: HerdrAgent[];
+  try {
+    parsed = parseHerdrAgentList(agents.stdout);
+  } catch (err) {
+    return { problem: err instanceof Error ? err.message : String(err) };
+  }
+  const starts: number[] = [];
+  for (const agent of parsed) {
+    // A name without a live omp claim is a leftover label, not a pane process.
+    if (agent.agent === undefined) continue;
+    const info = await run("herdr", [
+      "--session",
+      session,
+      "pane",
+      "process-info",
+      "--pane",
+      agent.paneId,
+    ]);
+    if (info.code !== 0) {
+      return {
+        problem:
+          `herdr pane process-info for ${agent.paneId} failed: ` +
+          `${info.stderr.trim() || info.stdout.trim() || `exit ${info.code}`}`,
+      };
+    }
+    let pids: number[];
+    try {
+      pids = ompPidsFromProcessInfo(parseHerdrProcessInfo(info.stdout, agent.paneId));
+    } catch (err) {
+      return { problem: err instanceof Error ? err.message : String(err) };
+    }
+    for (const pid of pids) {
+      const startedAt = startTime(pid);
+      if (startedAt === undefined) {
+        return { problem: `cannot read the start time of pane process ${pid} — reload unproven` };
+      }
+      starts.push(startedAt);
+    }
+  }
+  return { starts };
+}
+
 /**
  * The project a bare read means, when the config leaves no doubt.
  *
@@ -1355,7 +1462,7 @@ export function workerPhasesFromHealthz(
  */
 export function classifyDaemonProjectHealth(
   record: { project?: string } | undefined,
-  health: { ok: boolean; body?: string } | undefined,
+  health: HealthCheckResult | undefined,
   project: string,
 ): DaemonProjectHealth {
   if (record === undefined) return { kind: "stopped" };
@@ -1365,7 +1472,13 @@ export function classifyDaemonProjectHealth(
   if (record.project !== undefined && record.project !== project) {
     return { kind: "other-project", serves: record.project };
   }
-  if (health?.ok !== true) return { kind: "unreachable" };
+  // #685: a timed-out probe is a probe outcome, never a death verdict — the
+  // pid is up but wedged, so it must not read as `not running`. Only a
+  // refusal or other failure (nothing listening, a torn answer) stays
+  // `unreachable`.
+  if (health?.ok !== true) {
+    return health?.failure === "timeout" ? { kind: "unresponsive" } : { kind: "unreachable" };
+  }
   try {
     const payload = JSON.parse(health.body ?? "null") as unknown;
     if (payload === null || typeof payload !== "object") {
@@ -1455,7 +1568,12 @@ export async function collectFleetStatus(projectName?: string): Promise<FleetSta
         };
   const healthBody = projectHealth.kind === "ok" ? rawHealth?.body : undefined;
   const cached = codeGraphFromHealthz(healthBody, project.name);
-  const codeGraph = cached ?? (await probeCodeGraph(project));
+  // The runtime half of the code-graph finding (#726): the probe reads the
+  // store-backed per-run observations, so "observed" is always grounded in
+  // dispatched runs, never in the daemon's own process or in mcp.json. The
+  // store stays scoped to the same try/finally as the other reads so a
+  // throwing probe cannot leak its handle.
+  const store = openStore(dbPath());
   const workerPhases = [...workerPhasesFromHealthz(healthBody, project.name)].map(
     ([issue, phase]) => ({ issue, phase }),
   );
@@ -1464,10 +1582,16 @@ export async function collectFleetStatus(projectName?: string): Promise<FleetSta
   // and rendered identically from either project: the daemon_stops table is
   // deliberately not partitioned by project, because the daemon serves every
   // project and the uninvolved one must see who stopped it too.
-  const store = openStore(dbPath());
+  let codeGraph: CodeGraphHealth;
   let lastStop: DaemonStop | undefined;
   let siblings: { project: string; live: number }[] = [];
   try {
+    codeGraph =
+      cached ??
+      (await probeCodeGraph(project, {
+        ...DEFAULT_DEPS,
+        graphToolsObservations: () => store.graphToolsObservationCounts(project.name),
+      }));
     lastStop = store.latestDaemonStop();
     // Shared-daemon visibility (#545): every configured project other than the
     // one being viewed, with its live-run count.

package/src/gitops.ts

@@ -17,7 +17,8 @@
  * branch cannot disagree.
  */
 
-import { existsSync } from "node:fs";
+import { existsSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { homedir, tmpdir } from "node:os";
 import { join } from "node:path";
 
 import { parseChainSource, type ChainEntry } from "./chain-check.ts";
@@ -75,6 +76,98 @@ export function credentialedEnv(
   return { ...env, ...extra };
 }
 
+/**
+ * The exact per-run dubious-ownership exemption for a daemon git call against
+ * a worker-owned run repository (#816).
+ *
+ * Every daemon-side invocation whose cwd (or opening) is the run repository
+ * carries the run's own path as a command-line `-c safe.directory=<path>` —
+ * never a wildcard, and never an entry in the daemon's global config, which
+ * would grow one line per run forever. Git 2.35+ refuses to open a repository
+ * owned by another uid ("dubious ownership"); the run repository was handed
+ * to the worker identity at dispatch, so the daemon's own `rev-parse`,
+ * salvage, lane probe and cleanup calls are exactly that shape.
+ */
+export function runRepoSafeDirectoryExemption(runRepoPath: string): [string, string] {
+  return ["-c", `safe.directory=${runRepoPath}`];
+}
+
+/**
+ * A daemon-owned, per-call global git config granting the *source-side*
+ * ownership exemption for a local-path fetch out of one worker-owned run
+ * repository.
+ *
+ * `git fetch <runRepo>` from the mirror is the one daemon git call whose
+ * *source* is worker-owned, and the one shape command-line config cannot
+ * reach: git spawns `upload-pack` against the source — `.git` dubious-ownership
+ * check included — and that subprocess sees none of the destination process's
+ * `-c` options. The only real config file the subprocess reads that this side
+ * controls is the global one, so the run's exemption is materialised there,
+ * for exactly this call: a temp file (0700, daemon's own) naming precisely the
+ * run's repo path and its gitdir, never a wildcard, with the daemon's existing
+ * global config replayed through `include.path` so nothing else about the
+ * caller's git behavior changes. The file is removed when the call is done.
+ */
+export interface ScopedSafeDirectory {
+  /** The env additions for one git call; the caller's own use of it is what
+   *  scopes the exemption to that call. */
+  env: Record<string, string>;
+  /** Remove the daemon-owned temp file. The call must not outlive it. */
+  close: () => void;
+}
+
+/** A config value: git's quoting accepts C escapes in double quotes. */
+function quoteGitConfigValue(value: string): string {
+  return `"${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;
+}
+
+export function scopedSafeDirectoryEnv(...runRepos: readonly string[]): ScopedSafeDirectory {
+  const dir = mkdtempSync(join(tmpdir(), "omp-conductor-safe-"));
+  try {
+    // The global-config chain the daemon normally reads, replayed: setting
+    // GIT_CONFIG_GLOBAL would otherwise replace those files rather than
+    // augmenting them, dropping e.g. credential helpers and `insteadOf` rules
+    // for the duration of this one call.
+    const globals: string[] = [];
+    const globalOverride = process.env["GIT_CONFIG_GLOBAL"];
+    if (globalOverride !== undefined && globalOverride !== "") {
+      globals.push(globalOverride);
+    } else {
+      const xdgHome = process.env["XDG_CONFIG_HOME"];
+      const xdgConfig = xdgHome === undefined || xdgHome === ""
+        ? join(homedir(), ".config", "git", "config")
+        : join(xdgHome, "git", "config");
+      if (existsSync(xdgConfig)) globals.push(xdgConfig);
+      const home = homedir();
+      if (home !== "") {
+        const gitconfig = join(home, ".gitconfig");
+        if (existsSync(gitconfig)) globals.push(gitconfig);
+      }
+    }
+    const lines = [
+      ...globals.flatMap((file) => ["[include]", `\tpath = ${quoteGitConfigValue(file)}`]),
+      "[safe]",
+      // Both spellings git actually checks (2.43 and later use the gitdir
+      // path for a local-path source; a direct open names the worktree path).
+      // Both are exact, never a wildcard.
+      ...runRepos.flatMap((repo) => [
+        `\tdirectory = ${quoteGitConfigValue(repo)}`,
+        `\tdirectory = ${quoteGitConfigValue(join(repo, ".git"))}`,
+      ]),
+      "",
+    ];
+    const file = join(dir, "gitconfig");
+    writeFileSync(file, lines.join("\n"));
+    return {
+      env: { ...credentialedEnv(), GIT_CONFIG_GLOBAL: file },
+      close: () => rmSync(dir, { recursive: true, force: true }),
+    };
+  } catch (err) {
+    rmSync(dir, { recursive: true, force: true });
+    throw err;
+  }
+}
+
 // ------------------------------------------------- the privileged publish path
 
 /** One run's own repository, as the daemon addresses it. */
@@ -163,7 +256,11 @@ export async function probeRunLane(
     for (const line of stdout.split("\n")) add(line.trim(), source);
   };
   if (input.worktree !== "") {
-    const status = await exec(["git", "-C", input.worktree, "status", "--porcelain"], {});
+    // The live run's worktree is owned by the worker identity (#798), so
+    // every daemon-side read of it carries the exact per-run exemption — no
+    // wildcard, no global safe.directory (#816).
+    const exemption = runRepoSafeDirectoryExemption(input.worktree);
+    const status = await exec(["git", ...exemption, "-C", input.worktree, "status", "--porcelain"], {});
     if (status.code === 0) {
       const { untracked, tracked } = parsePorcelain(status.stdout);
       // Untracked files are authored by construction: a merge stages the files
@@ -183,12 +280,12 @@ export async function probeRunLane(
         // resolution. An unreadable divergence read fails open — no tracked
         // occupancy is claimed while the merge makes the read ambiguous.
         const merge = await exec(
-          ["git", "-C", input.worktree, "rev-parse", "-q", "--verify", "MERGE_HEAD"],
+          ["git", ...exemption, "-C", input.worktree, "rev-parse", "-q", "--verify", "MERGE_HEAD"],
           {},
         );
         if (merge.code === 0) {
           const diverged = await exec(
-            ["git", "-C", input.worktree, "diff", "--name-only", input.baseRef],
+            ["git", ...exemption, "-C", input.worktree, "diff", "--name-only", input.baseRef],
             {},
           );
           if (diverged.code === 0) {
@@ -203,7 +300,7 @@ export async function probeRunLane(
       }
     }
     const diff = await exec(
-      ["git", "-C", input.worktree, "diff", "--name-only", `${input.baseRef}...HEAD`],
+      ["git", ...exemption, "-C", input.worktree, "diff", "--name-only", `${input.baseRef}...HEAD`],
       {},
     );
     if (diff.code === 0) addDiff(diff.stdout, "branch");
@@ -311,91 +408,101 @@ export async function pushRunBranch(
   const ref = `refs/heads/${run.branch}`;
   const tracked = `refs/remotes/origin/${run.branch}`;
   const env = credentialedEnv();
+  // The run repository is worker-owned (#798): the direct read below carries
+  // the exact-path exemption on the command line, and the local-path fetch's
+  // source (upload-pack) needs it as a scoped global config for the one call
+  // (#816). Both are exact per-run entries, never a wildcard, and the scoped
+  // file dies with the call.
+  const scoped = scopedSafeDirectoryEnv(run.runRepoPath);
 
-  // Copy the run's branch into the mirror, fast-forward only.
-  const fetched = await exec(["git", "-C", mirror, "fetch", "--no-tags", run.runRepoPath, `${ref}:${ref}`], { env });
+  try {
+    // Copy the run's branch into the mirror, fast-forward only.
+    const fetched = await exec(["git", ...runRepoSafeDirectoryExemption(run.runRepoPath), "-C", mirror, "fetch", "--no-tags", run.runRepoPath, `${ref}:${ref}`], { env: scoped.env });
+
+    // The proposed head is read from the run repo itself: when the copy above
+    // was refused, the mirror's copy of the branch is exactly the stale one.
+    const proposedRun = await exec(["git", ...runRepoSafeDirectoryExemption(run.runRepoPath), "-C", run.runRepoPath, "rev-parse", ref], { env: scoped.env });
+    if (proposedRun.code !== 0) {
+      return { ok: false, stderr: scrubUserinfo(proposedRun.stderr.trim() || `git rev-parse ${ref} exited ${String(proposedRun.code)}`) };
+    }
+    const proposed = proposedRun.stdout.trim();
+
+    // Reconcile with the live remote before enforcing anything: the ancestry
+    // that decides a fast-forward is the live remote's, not the mirror's copy's
+    // (see the docstring above). ls-remote answers "is the branch published at
+    // all" and "what does GitHub hold" in one call.
+    const liveListed = await exec(["git", "-C", mirror, "ls-remote", "origin", ref], { env });
+    if (liveListed.code !== 0) {
+      return { ok: false, stderr: scrubUserinfo(liveListed.stderr.trim() || `git ls-remote origin ${ref} exited ${String(liveListed.code)}`) };
+    }
+    const live = liveListed.stdout
+      .split("\n")
+      .map((line) => line.trimEnd())
+      .find((line) => line.endsWith(`\t${ref}`))
+      ?.split(/\s+/, 1)[0];
+
+    if (live !== undefined && live !== proposed) {
+      // The branch is published and the run proposes something different. Pull
+      // the live branch's history into the mirror once (which also keeps the
+      // tracked ref a reattach reads fresh), then prove the fast-forward.
+      const reconciled = await exec(["git", "-C", mirror, "fetch", "--no-tags", "origin", `+${ref}:${tracked}`], { env });
+      if (reconciled.code !== 0) {
+        return { ok: false, stderr: scrubUserinfo(reconciled.stderr.trim() || reconciled.stdout.trim() || `git fetch origin exited ${String(reconciled.code)}`) };
+      }
 
-  // The proposed head is read from the run repo itself: when the copy above
-  // was refused, the mirror's copy of the branch is exactly the stale one.
-  const proposedRun = await exec(["git", "-C", run.runRepoPath, "rev-parse", ref], { env });
-  if (proposedRun.code !== 0) {
-    return { ok: false, stderr: scrubUserinfo(proposedRun.stderr.trim() || `git rev-parse ${ref} exited ${String(proposedRun.code)}`) };
-  }
-  const proposed = proposedRun.stdout.trim();
-
-  // Reconcile with the live remote before enforcing anything: the ancestry
-  // that decides a fast-forward is the live remote's, not the mirror's copy's
-  // (see the docstring above). ls-remote answers "is the branch published at
-  // all" and "what does GitHub hold" in one call.
-  const liveListed = await exec(["git", "-C", mirror, "ls-remote", "origin", ref], { env });
-  if (liveListed.code !== 0) {
-    return { ok: false, stderr: scrubUserinfo(liveListed.stderr.trim() || `git ls-remote origin ${ref} exited ${String(liveListed.code)}`) };
-  }
-  const live = liveListed.stdout
-    .split("\n")
-    .map((line) => line.trimEnd())
-    .find((line) => line.endsWith(`\t${ref}`))
-    ?.split(/\s+/, 1)[0];
-
-  if (live !== undefined && live !== proposed) {
-    // The branch is published and the run proposes something different. Pull
-    // the live branch's history into the mirror once (which also keeps the
-    // tracked ref a reattach reads fresh), then prove the fast-forward.
-    const reconciled = await exec(["git", "-C", mirror, "fetch", "--no-tags", "origin", `+${ref}:${tracked}`], { env });
-    if (reconciled.code !== 0) {
-      return { ok: false, stderr: scrubUserinfo(reconciled.stderr.trim() || reconciled.stdout.trim() || `git fetch origin exited ${String(reconciled.code)}`) };
+      const isAncestor = await exec(["git", "-C", mirror, "merge-base", "--is-ancestor", live, proposed], { env });
+      if (isAncestor.code === 128) {
+        // git could not perform the check at all (an object it was asked to
+        // resolve is missing, not merely unrelated). That is a failed
+        // verification, not a divergence verdict: refuse with git's own words,
+        // still naming both SHAs so the report carries the mismatch.
+        return {
+          ok: false,
+          stderr: scrubUserinfo(
+            isAncestor.stderr.trim() ||
+              isAncestor.stdout.trim() ||
+              `git merge-base --is-ancestor ${live} ${proposed} exited ${String(isAncestor.code)}`,
+          ),
+        };
+      }
+      if (isAncestor.code !== 0) {
+        // A real divergence: no fast-forward exists, and the mirror is left
+        // exactly where it was. Both SHAs are named so the mismatch is
+        // diagnosable instead of a bare "non-fast-forward".
+        return {
+          ok: false,
+          stderr:
+            `refusing non-fast-forward push of ${run.branch}: the live remote tip ${live} is not an ancestor of ` +
+            `the proposed head ${proposed}. Fetch the live branch and rebase or merge it before pushing again.`,
+        };
+      }
     }
 
-    const isAncestor = await exec(["git", "-C", mirror, "merge-base", "--is-ancestor", live, proposed], { env });
-    if (isAncestor.code === 128) {
-      // git could not perform the check at all (an object it was asked to
-      // resolve is missing, not merely unrelated). That is a failed
-      // verification, not a divergence verdict: refuse with git's own words,
-      // still naming both SHAs so the report carries the mismatch.
-      return {
-        ok: false,
-        stderr: scrubUserinfo(
-          isAncestor.stderr.trim() ||
-            isAncestor.stdout.trim() ||
-            `git merge-base --is-ancestor ${live} ${proposed} exited ${String(isAncestor.code)}`,
-        ),
-      };
+    if (fetched.code !== 0 && live === undefined) {
+      // The mirror refused the plain copy and there is no published branch to
+      // validate the run's head against: a rewritten branch that was never
+      // published must not rewrite the mirror either. Refuse with git's words.
+      return { ok: false, stderr: scrubUserinfo(fetched.stderr.trim() || fetched.stdout.trim() || `git fetch exited ${String(fetched.code)}`) };
     }
-    if (isAncestor.code !== 0) {
-      // A real divergence: no fast-forward exists, and the mirror is left
-      // exactly where it was. Both SHAs are named so the mismatch is
-      // diagnosable instead of a bare "non-fast-forward".
-      return {
-        ok: false,
-        stderr:
-          `refusing non-fast-forward push of ${run.branch}: the live remote tip ${live} is not an ancestor of ` +
-          `the proposed head ${proposed}. Fetch the live branch and rebase or merge it before pushing again.`,
-      };
+    if (fetched.code !== 0) {
+      // The proposed head is a legitimate fast-forward over the live remote (it
+      // equals the live head or the ancestor test above passed), so the only
+      // thing the plain copy refused on was the mirror's own stale copy.
+      // Refresh it; the push below still re-checks against the live remote.
+      const refreshed = await exec(["git", ...runRepoSafeDirectoryExemption(run.runRepoPath), "-C", mirror, "fetch", "--no-tags", run.runRepoPath, `+${ref}:${ref}`], { env: scoped.env });
+      if (refreshed.code !== 0) {
+        return { ok: false, stderr: scrubUserinfo(refreshed.stderr.trim() || refreshed.stdout.trim() || `git fetch exited ${String(refreshed.code)}`) };
+      }
     }
-  }
 
-  if (fetched.code !== 0 && live === undefined) {
-    // The mirror refused the plain copy and there is no published branch to
-    // validate the run's head against: a rewritten branch that was never
-    // published must not rewrite the mirror either. Refuse with git's words.
-    return { ok: false, stderr: scrubUserinfo(fetched.stderr.trim() || fetched.stdout.trim() || `git fetch exited ${String(fetched.code)}`) };
-  }
-  if (fetched.code !== 0) {
-    // The proposed head is a legitimate fast-forward over the live remote (it
-    // equals the live head or the ancestor test above passed), so the only
-    // thing the plain copy refused on was the mirror's own stale copy.
-    // Refresh it; the push below still re-checks against the live remote.
-    const refreshed = await exec(["git", "-C", mirror, "fetch", "--no-tags", run.runRepoPath, `+${ref}:${ref}`], { env });
-    if (refreshed.code !== 0) {
-      return { ok: false, stderr: scrubUserinfo(refreshed.stderr.trim() || refreshed.stdout.trim() || `git fetch exited ${String(refreshed.code)}`) };
+    const pushed = await exec(["git", "-C", mirror, "push", "origin", `${ref}:${ref}`], { env });
+    if (pushed.code !== 0) {
+      return { ok: false, stderr: scrubUserinfo(pushed.stderr.trim() || pushed.stdout.trim() || `git push exited ${String(pushed.code)}`) };
     }
+    return { ok: true, sha: proposed };
+  } finally {
+    scoped.close();
   }
-
-  const pushed = await exec(["git", "-C", mirror, "push", "origin", `${ref}:${ref}`], { env });
-  if (pushed.code !== 0) {
-    return { ok: false, stderr: scrubUserinfo(pushed.stderr.trim() || pushed.stdout.trim() || `git push exited ${String(pushed.code)}`) };
-  }
-  return { ok: true, sha: proposed };
 }
 
 /**