specrails-desktop 2.29.2 → 2.29.3

package/server/dist/rail-worktree-release.js

@@ -1,8 +1,258 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.durableBranchHeads = durableBranchHeads;
+exports.durableOverlayCleanupEvidence = durableOverlayCleanupEvidence;
 exports.releaseRailWorktrees = releaseRailWorktrees;
 const rail_worktrees_store_1 = require("./rail-worktrees-store");
 const worktree_manager_1 = require("./worktree-manager");
+const path = __importStar(require("path"));
+const fs = __importStar(require("fs"));
+const worktree_overlay_1 = require("./worktree-overlay");
+const COMMIT_SHA_RE = /^[0-9a-f]{40,64}$/i;
+/** Collapse per-unit settlement evidence into one unambiguous immutable HEAD per
+ * branch. Conflicting or malformed records intentionally yield no authorization. */
+function durableBranchHeads(records) {
+    const heads = new Map();
+    const conflicted = new Set();
+    for (const record of records) {
+        const sha = record.finalSha?.trim().toLowerCase() ?? '';
+        if (!record.branch || !COMMIT_SHA_RE.test(sha) || conflicted.has(record.branch))
+            continue;
+        const existing = heads.get(record.branch);
+        if (existing && existing !== sha) {
+            heads.delete(record.branch);
+            conflicted.add(record.branch);
+            continue;
+        }
+        heads.set(record.branch, sha);
+    }
+    return heads;
+}
+function safeRelativeOverlayPath(value) {
+    if (process.platform === 'win32' && value.includes('\\'))
+        return null;
+    if (value.split('/').includes('..'))
+        return null;
+    const normalized = path.posix.normalize(value);
+    if (!normalized || normalized === '.' || normalized.startsWith('../') ||
+        path.posix.isAbsolute(normalized) || normalized.includes('\0'))
+        return null;
+    return normalized;
+}
+/** Collapse persisted overlay fingerprints. Conflicting evidence for the same
+ * branch/path grants no exclusion permission. */
+function durableOverlayCleanupEvidence(records) {
+    const byBranch = new Map();
+    const conflicted = new Map();
+    for (const record of records) {
+        if (!record.branch || !Array.isArray(record.overlayCleanupEvidence))
+            continue;
+        const branchEvidence = byBranch.get(record.branch) ?? new Map();
+        const branchConflicts = conflicted.get(record.branch) ?? new Set();
+        for (const value of record.overlayCleanupEvidence) {
+            if (!value || typeof value.path !== 'string' || typeof value.digest !== 'string')
+                continue;
+            if (value.kind !== 'symlink' && value.kind !== 'file' && value.kind !== 'directory')
+                continue;
+            const safe = safeRelativeOverlayPath(value.path);
+            if (!safe || !/^[0-9a-f]{64}$/.test(value.digest) || branchConflicts.has(safe))
+                continue;
+            const normalized = { path: safe, kind: value.kind, digest: value.digest };
+            const existing = branchEvidence.get(safe);
+            if (existing && (existing.kind !== normalized.kind || existing.digest !== normalized.digest)) {
+                branchEvidence.delete(safe);
+                branchConflicts.add(safe);
+                continue;
+            }
+            branchEvidence.set(safe, normalized);
+        }
+        byBranch.set(record.branch, branchEvidence);
+        conflicted.set(record.branch, branchConflicts);
+    }
+    return new Map([...byBranch].map(([branch, values]) => [branch, [...values.values()]]));
+}
+async function verifyReleaseEvidence(input, worktree) {
+    const expected = input.expectedHeadByBranch.get(worktree.branch)?.toLowerCase();
+    if (!expected || !COMMIT_SHA_RE.test(expected)) {
+        return { failure: 'no durable settled HEAD is recorded for its branch', overlayEntries: [] };
+    }
+    const overlayEntries = (input.overlayEvidenceByBranch.get(worktree.branch) ?? [])
+        .filter((entry) => (0, worktree_overlay_1.matchesOverlayCleanupEvidence)(worktree.worktree_path, entry));
+    const overlayExcludes = overlayEntries.map((entry) => entry.path);
+    try {
+        const status = await input.git.run([
+            'status', '--porcelain', '--untracked-files=all', '--ignored=matching', '--', '.',
+            ...overlayExcludes.map((entry) => `:(top,exclude,literal)${entry}`),
+        ], worktree.worktree_path);
+        if (status.code !== 0)
+            return { failure: 'Git could not verify worktree cleanliness', overlayEntries: [] };
+        if (status.stdout.trim())
+            return { failure: 'the worktree contains changes made after settlement', overlayEntries: [] };
+        const [head, branchRef] = await Promise.all([
+            input.git.run(['rev-parse', '--verify', 'HEAD'], worktree.worktree_path),
+            input.git.run(['rev-parse', '--verify', `refs/heads/${worktree.branch}`], input.repoDir),
+        ]);
+        const headSha = head.code === 0 ? head.stdout.trim().toLowerCase() : '';
+        const branchSha = branchRef.code === 0 ? branchRef.stdout.trim().toLowerCase() : '';
+        if (!COMMIT_SHA_RE.test(headSha) || !COMMIT_SHA_RE.test(branchSha)) {
+            return { failure: 'Git could not verify the worktree HEAD and recorded branch ref', overlayEntries: [] };
+        }
+        if (headSha !== expected || branchSha !== expected) {
+            return { failure: `HEAD/ref moved after settlement (expected ${expected.slice(0, 12)})`, overlayEntries: [] };
+        }
+        return { failure: null, overlayEntries };
+    }
+    catch (err) {
+        return { failure: `verification failed: ${err instanceof Error ? err.message : String(err)}`, overlayEntries: [] };
+    }
+}
+function pathStillExists(target) {
+    try {
+        fs.lstatSync(target);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function quarantineLocationNotes(entries) {
+    return entries
+        .filter((entry) => pathStillExists(entry.quarantinePath))
+        .map((entry) => `overlay data is preserved at ${entry.quarantinePath}`);
+}
+/** Atomically move fingerprint-matching, untracked overlay roots out of the
+ * worktree. Quarantine is a unique sibling on the same filesystem. It is never
+ * automatically deleted or restored: writes through an already-open fd after
+ * rename remain recoverable, and a concurrently recreated source can never be
+ * overwritten by rollback. */
+async function quarantineVerifiedOverlayEntries(input, worktree, evidence) {
+    const removable = [];
+    for (const entry of evidence) {
+        const target = path.join(worktree.worktree_path, ...entry.path.split('/'));
+        if (!pathStillExists(target))
+            continue;
+        const tracked = await input.git.run(['ls-files', '--error-unmatch', '--', entry.path], worktree.worktree_path);
+        if (tracked.code === 0)
+            continue;
+        if (tracked.code !== 1) {
+            return { failure: `Git could not verify ownership of overlay path ${entry.path}`, entries: [] };
+        }
+        if (!(0, worktree_overlay_1.matchesOverlayCleanupEvidence)(worktree.worktree_path, entry)) {
+            return { failure: `overlay path ${entry.path} changed after cleanup verification`, entries: [] };
+        }
+        removable.push(entry);
+    }
+    const cleanupRoots = [];
+    for (const entry of [...removable].sort((a, b) => a.path.split('/').length - b.path.split('/').length)) {
+        if (cleanupRoots.some((root) => root.kind === 'directory' && entry.path.startsWith(`${root.path}/`)))
+            continue;
+        cleanupRoots.push(entry);
+    }
+    if (cleanupRoots.length === 0)
+        return { failure: null, entries: [] };
+    let quarantineRoot;
+    try {
+        // mkdtemp creates the batch directory atomically beside the worktree. The
+        // ensuing rename therefore remains within one filesystem.
+        quarantineRoot = fs.mkdtempSync(`${worktree.worktree_path}.specrails-overlay-quarantine-`);
+    }
+    catch (err) {
+        return {
+            failure: `could not create overlay quarantine beside ${worktree.worktree_path}: ${err instanceof Error ? err.message : String(err)}`,
+            entries: [],
+        };
+    }
+    try {
+        await input.onSafetyArchive?.(quarantineRoot);
+    }
+    catch (err) {
+        return {
+            failure: `could not record safety archive ${quarantineRoot}: ${err instanceof Error ? err.message : String(err)}`,
+            entries: [],
+        };
+    }
+    const quarantined = [];
+    for (const entry of cleanupRoots) {
+        const sourcePath = path.join(worktree.worktree_path, ...entry.path.split('/'));
+        if (!pathStillExists(sourcePath))
+            continue;
+        if (!(0, worktree_overlay_1.matchesOverlayCleanupEvidenceAtPath)(sourcePath, entry)) {
+            return { failure: `overlay path ${entry.path} changed before quarantine`, entries: quarantined };
+        }
+        const quarantinePath = path.join(quarantineRoot, ...entry.path.split('/'));
+        try {
+            fs.mkdirSync(path.dirname(quarantinePath), { recursive: true });
+            await input.beforeOverlayQuarantine?.(sourcePath);
+            fs.renameSync(sourcePath, quarantinePath);
+        }
+        catch (err) {
+            return {
+                failure: `could not quarantine overlay path ${entry.path}: ${err instanceof Error ? err.message : String(err)}`,
+                entries: quarantined,
+            };
+        }
+        const moved = { sourcePath, quarantinePath, evidence: entry };
+        quarantined.push(moved);
+        try {
+            await input.afterOverlayRename?.(sourcePath, quarantinePath);
+        }
+        catch (err) {
+            return {
+                failure: `overlay post-rename hook failed at ${quarantinePath}: ${err instanceof Error ? err.message : String(err)}`,
+                entries: quarantined,
+            };
+        }
+        if (!(0, worktree_overlay_1.matchesOverlayCleanupEvidenceAtPath)(quarantinePath, entry)) {
+            return {
+                failure: `overlay path ${entry.path} changed during atomic quarantine at ${quarantinePath}`,
+                entries: quarantined,
+            };
+        }
+        try {
+            await input.afterOverlayQuarantine?.(quarantinePath);
+        }
+        catch (err) {
+            return {
+                failure: `overlay quarantine hook failed at ${quarantinePath}: ${err instanceof Error ? err.message : String(err)}`,
+                entries: quarantined,
+            };
+        }
+    }
+    return { failure: null, entries: quarantined };
+}
 /** Remove Specrails-managed linked worktrees while keeping their local branches.
  *  PR deliveries use this once the work has a durable remote branch/PR: the
  *  branch remains available for local checkout, but the internal worktree stops
@@ -15,19 +265,50 @@ async function releaseRailWorktrees(input) {
         const wt = (0, rail_worktrees_store_1.getRailWorktree)(input.db, wtId);
         if (!wt)
             continue;
-        if (wt.merge_state === 'needs-review' && input.allowNeedsReview !== true)
-            continue;
         // Successful removal already terminalized these rows. Re-running `git
         // worktree remove` against their now-missing paths turns ordinary Publish /
         // Poll / Discard follow-ups into false cleanup_incomplete warnings.
         if (wt.merge_state !== 'needs-review' && (0, rail_worktrees_store_1.isTerminalMergeState)(wt.merge_state))
             continue;
+        const evidence = await verifyReleaseEvidence(input, wt);
+        if (evidence.failure) {
+            (0, rail_worktrees_store_1.updateRailWorktreeState)(input.db, wt.id, 'needs-review');
+            const warning = `worktree ${wt.worktree_path}: preserved because ${evidence.failure}`;
+            warnings.push(warning);
+            console.warn(`[rail-worktree-release] ${warning}`);
+            continue;
+        }
+        const quarantine = await quarantineVerifiedOverlayEntries(input, wt, evidence.overlayEntries);
+        if (quarantine.failure) {
+            (0, rail_worktrees_store_1.updateRailWorktreeState)(input.db, wt.id, 'needs-review');
+            const warning = `worktree ${wt.worktree_path}: preserved because ${[
+                quarantine.failure,
+                ...quarantineLocationNotes(quarantine.entries),
+            ].join('; ')}`;
+            warnings.push(warning);
+            console.warn(`[rail-worktree-release] ${warning}`);
+            continue;
+        }
+        // Quarantining changes the worktree. Re-prove both cleanliness and HEAD/ref
+        // identity immediately before asking Git for its final non-force guard.
+        const finalEvidence = await verifyReleaseEvidence(input, wt);
+        if (finalEvidence.failure) {
+            (0, rail_worktrees_store_1.updateRailWorktreeState)(input.db, wt.id, 'needs-review');
+            const warning = `worktree ${wt.worktree_path}: preserved because ${[
+                finalEvidence.failure,
+                ...quarantineLocationNotes(quarantine.entries),
+            ].join('; ')}`;
+            warnings.push(warning);
+            console.warn(`[rail-worktree-release] ${warning}`);
+            continue;
+        }
         try {
             await remove(input.git, {
                 repoDir: input.repoDir,
                 worktreePath: wt.worktree_path,
                 branch: wt.branch,
                 deleteBranch: false,
+                force: false,
             });
         }
         catch (err) {
@@ -35,13 +316,18 @@ async function releaseRailWorktrees(input) {
             if (current && current.merge_state !== 'needs-review' && (0, rail_worktrees_store_1.isTerminalMergeState)(current.merge_state)) {
                 continue;
             }
-            const warning = `worktree ${wt.worktree_path}: ${err instanceof Error ? err.message : String(err)}`;
+            (0, rail_worktrees_store_1.updateRailWorktreeState)(input.db, wt.id, 'needs-review');
+            const warning = `worktree ${wt.worktree_path}: ${[
+                err instanceof Error ? err.message : String(err),
+                ...quarantineLocationNotes(quarantine.entries),
+            ].join('; ')}`;
             warnings.push(warning);
             console.warn(`[rail-worktree-release] failed to remove ${warning}`);
             continue;
         }
-        if (!(0, rail_worktrees_store_1.isTerminalMergeState)(wt.merge_state))
+        if (wt.merge_state === 'needs-review' || !(0, rail_worktrees_store_1.isTerminalMergeState)(wt.merge_state)) {
             (0, rail_worktrees_store_1.updateRailWorktreeState)(input.db, wt.id, state);
+        }
     }
     return warnings;
 }

package/server/dist/rails-router.js

@@ -40,12 +40,21 @@ const VALID_REASONING_EFFORTS = new Set(['low', 'medium', 'high']);
 function prDeliveryContinuesTickets(delivery, ticketIds) {
     if (delivery.decision !== 'pr_draft' && delivery.decision !== 'pr_ready')
         return false;
-    if (!delivery.prUrl || !delivery.branch || delivery.prState !== 'pr-created')
+    if (!delivery.prUrl || !delivery.branch || !delivery.deliverySha || delivery.prState !== 'pr-created')
         return false;
     const covered = new Set(delivery.ticketIds);
     const requested = new Set(ticketIds);
     return requested.size > 0 && requested.size === covered.size && [...requested].every((id) => covered.has(id));
 }
+function prDeliveryCheckoutBlock(delivery) {
+    if (delivery.deliveryOutcome === 'blocked') {
+        return 'delivery is blocked and has no safely checkoutable result';
+    }
+    if (!delivery.deliverySha) {
+        return 'delivery has no verified commit available for checkout';
+    }
+    return null;
+}
 function emitPrDeliveryUpdate(c, prDeliveryId) {
     const row = (0, rail_pr_store_1.getPrDelivery)(c.db, prDeliveryId);
     if (!row)
@@ -603,8 +612,10 @@ function createRailsRouter() {
                                         deliveryId: continuablePrDelivery.id,
                                         decision: continuablePrDelivery.decision,
                                         branch: continuablePrDelivery.branch,
+                                        baseBranch: continuablePrDelivery.baseBranch,
                                         prUrl: continuablePrDelivery.prUrl,
                                         prNumber: continuablePrDelivery.prNumber,
+                                        deliverySha: continuablePrDelivery.deliverySha,
                                     },
                                 } : {}),
                             });
@@ -881,7 +892,7 @@ function createRailsRouter() {
     // POST /rails/pr-decision — the ONE decision action (safe-pr-review-flow) both
     // surfaces (dashboard rail row + agent-chat card) call on a rail_pr_deliveries
     // row: create-pr | publish | discard/dismiss | poll/reopen | merge-local |
-    // acknowledge-no-changes, compare-and-set-guarded by
+    // acknowledge-no-changes | recover-and-retry, compare-and-set-guarded by
     // expectedDecision (a raced concurrent answer loses with 409 stale_decision).
     // Replaces the stateless v1 POST /rails/pr-review passthrough. The route only
     // validates and delegates — the action logic lives in rail-pr-decision.ts.
@@ -894,7 +905,7 @@ function createRailsRouter() {
             return;
         }
         if (!(0, rail_pr_decision_1.isPrDecisionAction)(action)) {
-            res.status(400).json({ error: "action must be 'create-pr', 'publish', 'discard', 'dismiss', 'poll-merge', 'reopen', 'merge-local' or 'acknowledge-no-changes'" });
+            res.status(400).json({ error: `action must be one of: ${rail_pr_decision_1.PR_DECISION_ACTIONS.join(', ')}` });
             return;
         }
         if (typeof expectedDecision !== 'string' || !expectedDecision) {
@@ -968,7 +979,21 @@ function createRailsRouter() {
             res.status(404).json({ error: 'Unknown prDeliveryId' });
             return;
         }
+        const active = (0, rail_pr_store_1.getActivePrDeliveryByRail)(c.db, row.rail_index);
+        if (!active || active.id !== row.id) {
+            res.status(409).json({
+                error: 'stale_decision',
+                current: active?.decision ?? null,
+                currentPrDeliveryId: active?.id ?? null,
+            });
+            return;
+        }
         const snap = (0, rail_pr_store_1.toPrDeliverySnapshot)(row);
+        const checkoutBlock = prDeliveryCheckoutBlock(snap);
+        if (checkoutBlock) {
+            res.status(409).json({ error: 'checkout_not_deliverable', detail: checkoutBlock });
+            return;
+        }
         if (!snap.branch || !snap.prUrl) {
             res.status(409).json({ error: 'checkout_unavailable', detail: 'delivery has no PR branch' });
             return;
@@ -976,20 +1001,83 @@ function createRailsRouter() {
         try {
             const outcome = await (0, repo_lock_1.withRepoLock)(c.project.path, async () => {
                 admission.assertCurrent();
+                const current = (0, rail_pr_store_1.getActivePrDeliveryByRail)(c.db, row.rail_index);
+                if (!current || current.id !== row.id) {
+                    return {
+                        ok: false,
+                        status: 409,
+                        error: 'stale_decision',
+                        detail: 'The delivery generation changed before checkout.',
+                    };
+                }
+                const currentSnap = (0, rail_pr_store_1.toPrDeliverySnapshot)(current);
+                const currentCheckoutBlock = prDeliveryCheckoutBlock(currentSnap);
+                if (currentCheckoutBlock) {
+                    return {
+                        ok: false,
+                        status: 409,
+                        error: 'checkout_not_deliverable',
+                        detail: currentCheckoutBlock,
+                    };
+                }
+                if (!currentSnap.branch || !currentSnap.prUrl) {
+                    return {
+                        ok: false,
+                        status: 409,
+                        error: 'checkout_not_deliverable',
+                        detail: 'The current delivery no longer has an attached PR branch.',
+                    };
+                }
+                const cleanliness = await (0, project_git_1.inspectProjectCheckoutCleanliness)(c.project.path);
+                if (!cleanliness.ok) {
+                    return {
+                        ok: false,
+                        status: 409,
+                        error: 'checkout_safety_unknown',
+                        detail: cleanliness.detail,
+                    };
+                }
+                if (!cleanliness.clean) {
+                    return { ok: false, status: 409, error: 'checkout_dirty', detail: 'Working tree has uncommitted changes. Commit or stash them before checkout.' };
+                }
                 const info = await (0, project_git_1.getProjectGitInfo)(c.project.path);
                 if (!info.git) {
                     return { ok: false, status: 409, error: 'checkout_unavailable', detail: 'project is not a git repository' };
                 }
-                if (info.dirty) {
-                    return { ok: false, status: 409, error: 'checkout_dirty', detail: 'Working tree has uncommitted changes. Commit or stash them before checkout.' };
-                }
-                await (0, rail_worktree_release_1.releaseRailWorktrees)({
+                let archived = false;
+                const cleanupWarnings = await (0, rail_worktree_release_1.releaseRailWorktrees)({
                     db: c.db,
                     git: worktree_manager_1.defaultGitRunner,
                     repoDir: c.project.path,
-                    worktreeIds: snap.worktreeIds,
+                    worktreeIds: currentSnap.worktreeIds,
+                    expectedHeadByBranch: (0, rail_worktree_release_1.durableBranchHeads)(currentSnap.branches),
+                    overlayEvidenceByBranch: (0, rail_worktree_release_1.durableOverlayCleanupEvidence)(currentSnap.branches),
+                    onSafetyArchive: (archive) => {
+                        archived = true;
+                        if (!(0, rail_pr_store_1.appendPrDeliverySafetyArchive)(c.db, row.id, archive)) {
+                            throw new Error(`delivery ${row.id} disappeared while recording safety archive ${archive}`);
+                        }
+                    },
                 });
-                const checkedOut = await (0, project_git_1.checkoutProjectReviewBranch)(c.project.path, snap.branch);
+                if (archived) {
+                    const archivedRow = (0, rail_pr_store_1.getPrDelivery)(c.db, row.id);
+                    if (archivedRow) {
+                        const archivedSnap = (0, rail_pr_store_1.toPrDeliverySnapshot)(archivedRow);
+                        c.broadcast((0, rail_pr_store_1.toRailPrStateMessage)(c.project.id, archivedSnap));
+                        if (archivedRow.origin_conversation_id) {
+                            (0, agent_chat_registry_1.getAgentChatManager)()?.updatePrDecisionCard(archivedRow.origin_conversation_id, (0, rail_pr_store_1.toPrDecisionCardEnvelope)(c.project.id, archivedSnap));
+                        }
+                    }
+                }
+                if (cleanupWarnings.length > 0) {
+                    return {
+                        ok: false,
+                        status: 409,
+                        error: 'checkout_unavailable',
+                        detail: cleanupWarnings[0],
+                    };
+                }
+                const checkedOut = await (0, project_git_1.checkoutProjectReviewBranch)(c.project.path, currentSnap.branch, currentSnap.deliverySha);
                 if (!checkedOut.ok) {
                     return { ok: false, status: 409, error: 'checkout_failed', detail: checkedOut.error };
                 }