pi-crew 0.9.50 → 0.9.52

package/src/worktree/cleanup.ts

@@ -1,341 +0,0 @@
-import { execFileSync } from "node:child_process";
-import * as fs from "node:fs";
-import * as path from "node:path";
-import { DEFAULT_PATHS } from "../config/defaults.ts";
-import { writeArtifact } from "../state/artifact-store.ts";
-import type { TeamRunManifest } from "../state/types.ts";
-import { WINDOWS_ESSENTIAL_ENV_VARS } from "../utils/env-allowlist.ts";
-import { sanitizeEnvSecrets } from "../utils/env-filter.ts";
-import { logInternalError } from "../utils/internal-error.ts";
-import { projectCrewRoot } from "../utils/paths.ts";
-
-export interface WorktreeCleanupResult {
-	removed: string[];
-	preserved: Array<{ path: string; reason: string }>;
-	artifactPaths: string[];
-	/** Branch names created from dirty worktrees that were committed. */
-	committedBranches: string[];
-}
-
-// SECURITY: PI_* and PI_CREW_* wildcards removed — they could match secret vars like PI_PASSWORD.
-// Git operations do not need PI_CREW_* execution-control vars.
-const GIT_SAFE_ENV = {
-	...sanitizeEnvSecrets(process.env, {
-		allowList: [
-			"PATH",
-			"HOME",
-			"USER",
-			...WINDOWS_ESSENTIAL_ENV_VARS,
-			"SHELL",
-			"TERM",
-			"LANG",
-			"LC_ALL",
-			"LC_COLLATE",
-			"LC_CTYPE",
-			"LC_MESSAGES",
-			"XDG_CONFIG_HOME",
-			"XDG_DATA_HOME",
-			"XDG_CACHE_HOME",
-			"NVM_BIN",
-			"NVM_DIR",
-			"NODE_PATH",
-			"GIT_CONFIG_GLOBAL",
-			"GIT_CONFIG_SYSTEM",
-			"GIT_AUTHOR_NAME",
-			"GIT_AUTHOR_EMAIL",
-			"GIT_COMMITTER_NAME",
-			"GIT_COMMITTER_EMAIL",
-		],
-	}),
-	LANG: "C",
-	LC_ALL: "C",
-};
-
-function sanitizeBranchPart(value: string): string {
-	return (
-		value
-			.toLowerCase()
-			.replace(/[^a-z0-9._/-]+/g, "-")
-			.replace(/^-+|-+$/g, "") || "task"
-	);
-}
-
-function sanitizeFilename(value: string): string {
-	// Strip control chars and newlines for safe artifact filenames
-	return value.slice(0, 200).replace(/[\x00-\x1f\x7f-\x9f\r\n]+/g, " ");
-}
-
-function git(cwd: string, args: string[]): string {
-	try {
-		return execFileSync("git", args, {
-			cwd,
-			encoding: "utf-8",
-			stdio: ["ignore", "pipe", "pipe"],
-			env: GIT_SAFE_ENV,
-			windowsHide: true,
-		}).trim();
-	} catch (error) {
-		const message = error instanceof Error ? error.message : String(error);
-		throw new Error(`git ${args.join(" ")} failed: ${message}`);
-	}
-}
-
-function isDirty(worktreePath: string): boolean | "error" {
-	try {
-		return git(worktreePath, ["status", "--porcelain"]).trim().length > 0;
-	} catch {
-		return "error";
-	}
-}
-
-function captureDiff(worktreePath: string): string {
-	try {
-		return [
-			git(worktreePath, ["status", "--porcelain"]),
-			"",
-			git(worktreePath, ["diff", "--stat"]),
-			"",
-			git(worktreePath, ["diff"]),
-		].join("\n");
-	} catch (error) {
-		const message = error instanceof Error ? error.message : String(error);
-		return `Failed to capture cleanup diff for ${worktreePath}: ${message}`;
-	}
-}
-
-export function cleanupRunWorktrees(
-	manifest: TeamRunManifest,
-	options: { force?: boolean; signal?: AbortSignal } = {},
-): WorktreeCleanupResult {
-	const sanitizedRunId = manifest.runId.replace(/[^a-zA-Z0-9._-]/g, "-").replace(/^-+|-+$/g, "") || "run";
-	const worktreeRoot = path.join(projectCrewRoot(manifest.cwd), DEFAULT_PATHS.state.worktreesSubdir, sanitizedRunId);
-	const result: WorktreeCleanupResult = {
-		removed: [],
-		preserved: [],
-		artifactPaths: [],
-		committedBranches: [],
-	};
-	if (!fs.existsSync(worktreeRoot)) return result;
-
-	// M3 fix: use withFileTypes to avoid race between readdirSync and statSync.
-	// Rely on Dirent.isDirectory() instead of a separate statSync to eliminate TOCTOU window.
-	const withFileTypes = fs.readdirSync(worktreeRoot, { withFileTypes: true });
-	for (const entry of withFileTypes) {
-		if (options.signal?.aborted) break;
-		if (!entry.isDirectory()) continue;
-		// Issue 1 fix: check signal before each git operation to respect abort faster
-		if (options.signal?.aborted) break;
-		const worktreePath = path.join(worktreeRoot, entry.name);
-		if (options.signal?.aborted) break;
-		const dirty = isDirty(worktreePath);
-		const branchName = `pi-crew/${manifest.runId}/${sanitizeBranchPart(entry.name)}`;
-		const safeBranchName = sanitizeBranchPart(entry.name);
-		if (dirty) {
-			// C9: preserve dirty worktrees unless explicitly forced. Previously the
-			// dirty branch ALWAYS ran 'git add -A' + commit + remove, staging every
-			// untracked file (incl. potential secrets/build artifacts) into a
-			// recovery branch without consent. force=true keeps the old behavior.
-			if (!options.force) {
-				const safePreserveName = sanitizeFilename(entry.name);
-				const artifact = writeArtifact(manifest.artifactsRoot, {
-					kind: "diff",
-					relativePath: `cleanup/${safePreserveName}.diff`,
-					content: captureDiff(worktreePath),
-					producer: "worktree-cleanup",
-				});
-				result.artifactPaths.push(artifact.path);
-				result.preserved.push({
-					path: worktreePath,
-					reason: "dirty worktree preserved \u2014 pass force=true to auto-commit and remove",
-				});
-				continue;
-			}
-			// Issue 1 fix: check signal before git operations
-			if (options.signal?.aborted) break;
-			// Commit changes to a branch instead of just preserving the worktree
-			try {
-				// Issue 2 fix: verify status before and after add to ensure atomicity
-				const statusBefore = git(worktreePath, ["status", "--porcelain"]);
-				execFileSync("git", ["add", "-A"], {
-					cwd: worktreePath,
-					encoding: "utf-8",
-					stdio: ["ignore", "pipe", "pipe"],
-					env: GIT_SAFE_ENV,
-					windowsHide: true,
-				});
-				// Verify no unexpected changes were added (only staged the original dirty files)
-				const statusAfterAdd = git(worktreePath, ["status", "--porcelain"]);
-				if (statusAfterAdd !== statusBefore) {
-					// Something changed between our status check and add - abort to avoid including unexpected changes
-					throw new Error("worktree state changed unexpectedly during add; refusing to commit");
-				}
-				// Issue 1 fix: check signal before commit
-				if (options.signal?.aborted) break;
-				let safeDesc = entry.name.slice(0, 200);
-				// SECURITY: Strip any newlines that could be injected via a malicious worktree name
-				// to prevent newline injection in git commit messages
-				if (safeDesc.includes("\n")) {
-					safeDesc = safeDesc.replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]+/g, " ");
-				}
-				execFileSync("git", ["commit", "-m", `pi-crew: ${safeDesc}`], {
-					cwd: worktreePath,
-					encoding: "utf-8",
-					stdio: ["ignore", "pipe", "pipe"],
-					env: GIT_SAFE_ENV,
-					windowsHide: true,
-				});
-				// Issue 1 fix: check signal before branch creation
-				if (options.signal?.aborted) break;
-				// Create branch in the main repo pointing to this worktree's HEAD
-				let branchError: Error | null = null;
-				try {
-					execFileSync("git", ["branch", branchName], {
-						cwd: worktreePath,
-						encoding: "utf-8",
-						stdio: ["ignore", "pipe", "pipe"],
-						env: GIT_SAFE_ENV,
-						windowsHide: true,
-					});
-				} catch (err) {
-					branchError = err instanceof Error ? err : new Error(String(err));
-					// Branch already exists — use timestamp suffix
-					const tsBranch = `${branchName}-${Date.now()}`;
-					try {
-						execFileSync("git", ["branch", tsBranch], {
-							cwd: worktreePath,
-							encoding: "utf-8",
-							stdio: ["ignore", "pipe", "pipe"],
-							env: GIT_SAFE_ENV,
-							windowsHide: true,
-						});
-					} catch (err2) {
-						// Both branch attempts failed — accumulate error for outer catch
-						const err2_msg = err2 instanceof Error ? err2.message : String(err2);
-						throw new Error(
-							`branch creation failed (${branchName} already exists): ${branchError.message}; fallback branch also failed: ${err2_msg}`,
-						);
-					}
-				}
-				result.committedBranches.push(branchName);
-				// Issue 1 fix: check signal before worktree remove
-				if (options.signal?.aborted) break;
-				// Remove the worktree (branch persists).
-				// NOTE: If git worktree remove fails here after the commit succeeded,
-				// the worktree directory remains on disk orphaned from the branch.
-				// The committed changes are safe in the branch and recoverable via:
-				//   git branch -D <branchName>   (to clean up the branch)
-				//   rm -rf <worktreePath>        (to clean up the orphaned directory)
-				const removeArgs = ["worktree", "remove", "--force", worktreePath];
-				// Capture git status before removal since worktree won't exist after successful remove
-				const gitStatusBeforeRemove = git(worktreePath, ["status", "--porcelain"]);
-				try {
-					git(manifest.cwd, removeArgs);
-					result.removed.push(worktreePath);
-				} catch (removeError) {
-					// Commit succeeded but worktree remove failed — directory is orphaned
-					// Issue 1 fix: use fs.rmSync as fallback to clean up orphaned directory
-					try {
-						fs.rmSync(worktreePath, {
-							recursive: true,
-							force: true,
-						});
-						result.removed.push(worktreePath);
-					} catch {
-						result.preserved.push({
-							path: worktreePath,
-							reason: `commit succeeded but worktree remove failed: ${removeError instanceof Error ? removeError.message : String(removeError)}; fs.rmSync fallback also failed`,
-						});
-					}
-					const artifact = writeArtifact(manifest.artifactsRoot, {
-						kind: "metadata",
-						relativePath: `metadata/worktree-branch-${safeBranchName}.json`,
-						content: JSON.stringify(
-							{
-								worktreePath,
-								branch: branchName,
-								committedAt: new Date().toISOString(),
-								mergeCommand: `git merge ${branchName}`,
-								gitStatusAtCommit: gitStatusBeforeRemove,
-							},
-							null,
-							2,
-						),
-						producer: "worktree-cleanup",
-					});
-					result.artifactPaths.push(artifact.path);
-					continue;
-				}
-				const artifact = writeArtifact(manifest.artifactsRoot, {
-					kind: "metadata",
-					relativePath: `metadata/worktree-branch-${safeBranchName}.json`,
-					content: JSON.stringify(
-						{
-							worktreePath,
-							branch: branchName,
-							committedAt: new Date().toISOString(),
-							mergeCommand: `git merge ${branchName}`,
-							gitStatusAtCommit: gitStatusBeforeRemove,
-						},
-						null,
-						2,
-					),
-					producer: "worktree-cleanup",
-				});
-				result.artifactPaths.push(artifact.path);
-			} catch (error) {
-				// Fallback to preserving dirty worktree
-				// FIX: entry is a DirEnt object, must use entry.name
-				const safeFallbackName = sanitizeFilename(entry.name);
-				const artifact = writeArtifact(manifest.artifactsRoot, {
-					kind: "diff",
-					relativePath: `cleanup/${safeFallbackName}.diff`,
-					content: captureDiff(worktreePath),
-					producer: "worktree-cleanup",
-				});
-				result.artifactPaths.push(artifact.path);
-				result.preserved.push({
-					path: worktreePath,
-					reason: `dirty worktree preserved (commit failed: ${error instanceof Error ? error.message : String(error)})`,
-				});
-			}
-			continue;
-		}
-		// Issue 3 fix: sanitize entry.name before using in git commands
-		const safeEntryName = sanitizeBranchPart(entry.name);
-		// Issue 1 fix: check signal before non-dirty worktree remove
-		if (options.signal?.aborted) break;
-		const args = ["worktree", "remove"];
-		if (options.force) args.push("--force");
-		args.push(worktreePath);
-		try {
-			git(manifest.cwd, args);
-			result.removed.push(worktreePath);
-		} catch (error) {
-			const message = error instanceof Error ? error.message : String(error);
-			result.preserved.push({ path: worktreePath, reason: message });
-		}
-	}
-
-	try {
-		// Issue 2 fix: run git worktree prune to clean up any orphaned worktree references
-		// after processing all worktrees. This helps clean up directories left orphaned
-		// when git worktree remove failed after a successful commit.
-		git(manifest.cwd, ["worktree", "prune"]);
-	} catch (error) {
-		// Non-critical cleanup.
-		logInternalError("cleanup.worktreePrune", error instanceof Error ? error : new Error(String(error)));
-	}
-	try {
-		// Issue 1 fix: Use rmdirSync which fails atomically on non-empty directories,
-		// avoiding TOCTOU race between readdirSync check and rmSync removal.
-		// Ignore ENOENT (already removed) and ENOTEMPTY (became non-empty between check and remove).
-		fs.rmdirSync(worktreeRoot);
-	} catch (error) {
-		// Non-critical cleanup. Ignore ENOENT and ENOTEMPTY.
-		const code = (error as NodeJS.ErrnoException).code;
-		if (code !== "ENOENT" && code !== "ENOTEMPTY") {
-			// Optionally log unexpected errors in debug mode
-		}
-	}
-	return result;
-}