specrails-desktop 2.29.2 → 2.29.4

package/server/dist/rail-worktree-release.js

@@ -1,8 +1,329 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.durableBranchHeads = durableBranchHeads;
+exports.durableOverlayCleanupEvidence = durableOverlayCleanupEvidence;
+exports.durableSettlementIgnoredPaths = durableSettlementIgnoredPaths;
 exports.releaseRailWorktrees = releaseRailWorktrees;
 const rail_worktrees_store_1 = require("./rail-worktrees-store");
 const worktree_manager_1 = require("./worktree-manager");
+const path = __importStar(require("path"));
+const fs = __importStar(require("fs"));
+const worktree_overlay_1 = require("./worktree-overlay");
+const COMMIT_SHA_RE = /^[0-9a-f]{40,64}$/i;
+/** Collapse per-unit settlement evidence into one unambiguous immutable HEAD per
+ * branch. Conflicting or malformed records intentionally yield no authorization. */
+function durableBranchHeads(records) {
+    const heads = new Map();
+    const conflicted = new Set();
+    for (const record of records) {
+        const sha = record.finalSha?.trim().toLowerCase() ?? '';
+        if (!record.branch || !COMMIT_SHA_RE.test(sha) || conflicted.has(record.branch))
+            continue;
+        const existing = heads.get(record.branch);
+        if (existing && existing !== sha) {
+            heads.delete(record.branch);
+            conflicted.add(record.branch);
+            continue;
+        }
+        heads.set(record.branch, sha);
+    }
+    return heads;
+}
+function safeRelativeOverlayPath(value) {
+    if (process.platform === 'win32' && value.includes('\\'))
+        return null;
+    if (value.split('/').includes('..'))
+        return null;
+    const normalized = path.posix.normalize(value);
+    if (!normalized || normalized === '.' || normalized.startsWith('../') ||
+        path.posix.isAbsolute(normalized) || normalized.includes('\0'))
+        return null;
+    return normalized;
+}
+/** Collapse persisted overlay fingerprints. Conflicting evidence for the same
+ * branch/path grants no exclusion permission. */
+function durableOverlayCleanupEvidence(records) {
+    const byBranch = new Map();
+    const conflicted = new Map();
+    for (const record of records) {
+        if (!record.branch || !Array.isArray(record.overlayCleanupEvidence))
+            continue;
+        const branchEvidence = byBranch.get(record.branch) ?? new Map();
+        const branchConflicts = conflicted.get(record.branch) ?? new Set();
+        for (const value of record.overlayCleanupEvidence) {
+            if (!value || typeof value.path !== 'string' || typeof value.digest !== 'string')
+                continue;
+            if (value.kind !== 'symlink' && value.kind !== 'file' && value.kind !== 'directory')
+                continue;
+            const safe = safeRelativeOverlayPath(value.path);
+            if (!safe || !/^[0-9a-f]{64}$/.test(value.digest) || branchConflicts.has(safe))
+                continue;
+            const normalized = { path: safe, kind: value.kind, digest: value.digest };
+            const existing = branchEvidence.get(safe);
+            if (existing && (existing.kind !== normalized.kind || existing.digest !== normalized.digest)) {
+                branchEvidence.delete(safe);
+                branchConflicts.add(safe);
+                continue;
+            }
+            branchEvidence.set(safe, normalized);
+        }
+        byBranch.set(record.branch, branchEvidence);
+        conflicted.set(record.branch, branchConflicts);
+    }
+    return new Map([...byBranch].map(([branch, values]) => [branch, [...values.values()]]));
+}
+/** Collapse persisted settlement ignored-path snapshots per branch. The same
+ * conservative rules as overlay evidence: malformed paths, a failed capture
+ * (null), or conflicting per-branch snapshots grant NO authorization. */
+function durableSettlementIgnoredPaths(records) {
+    const byBranch = new Map();
+    for (const record of records) {
+        if (!record.branch || record.settlementIgnoredPaths === undefined)
+            continue;
+        const prior = byBranch.get(record.branch);
+        if (prior === null)
+            continue; // already poisoned
+        if (record.settlementIgnoredPaths === null) {
+            byBranch.set(record.branch, null);
+            continue;
+        }
+        if (!Array.isArray(record.settlementIgnoredPaths)) {
+            byBranch.set(record.branch, null);
+            continue;
+        }
+        const safe = [];
+        let valid = true;
+        for (const value of record.settlementIgnoredPaths) {
+            const normalized = typeof value === 'string' ? safeRelativeOverlayPath(value.replace(/\/$/, '')) : null;
+            if (!normalized) {
+                valid = false;
+                break;
+            }
+            safe.push(normalized);
+        }
+        if (!valid) {
+            byBranch.set(record.branch, null);
+            continue;
+        }
+        const sorted = [...new Set(safe)].sort();
+        if (prior === undefined) {
+            byBranch.set(record.branch, sorted);
+            continue;
+        }
+        if (prior.join('\0') !== sorted.join('\0'))
+            byBranch.set(record.branch, null);
+    }
+    return new Map([...byBranch].flatMap(([branch, paths]) => (paths === null ? [] : [[branch, paths]])));
+}
+function coveredBySnapshot(livePath, snapshot) {
+    const live = livePath.replace(/\/$/, '');
+    return snapshot.some((entry) => live === entry || live.startsWith(`${entry}/`));
+}
+async function verifyReleaseEvidence(input, worktree) {
+    const expected = input.expectedHeadByBranch.get(worktree.branch)?.toLowerCase();
+    if (!expected || !COMMIT_SHA_RE.test(expected)) {
+        return { failure: 'no durable settled HEAD is recorded for its branch', overlayEntries: [] };
+    }
+    const overlayEntries = (input.overlayEvidenceByBranch.get(worktree.branch) ?? [])
+        .filter((entry) => (0, worktree_overlay_1.matchesOverlayCleanupEvidence)(worktree.worktree_path, entry));
+    const overlayExcludes = overlayEntries.map((entry) => entry.path);
+    try {
+        const status = await input.git.run([
+            'status', '--porcelain', '--untracked-files=all', '--ignored=matching', '--', '.',
+            ...overlayExcludes.map((entry) => `:(top,exclude,literal)${entry}`),
+        ], worktree.worktree_path);
+        if (status.code !== 0) {
+            if (!pathStillExists(worktree.worktree_path))
+                return { failure: null, overlayEntries: [], gone: true };
+            return { failure: 'Git could not verify worktree cleanliness', overlayEntries: [] };
+        }
+        // Partition: tracked/untracked entries are unconditional dirt (unchanged
+        // strictness); gitignored entries are release-safe ONLY when the immutable
+        // settlement snapshot already contained them — run-created build caches
+        // release cleanly, anything ignored that APPEARED after settlement (a
+        // user-parked file) preserves the worktree exactly as before.
+        const statusLines = status.stdout.split('\n').map((line) => line.trimEnd()).filter(Boolean);
+        const dirtyLines = statusLines.filter((line) => !line.startsWith('!! '));
+        if (dirtyLines.length > 0)
+            return { failure: 'the worktree contains changes made after settlement', overlayEntries: [] };
+        const ignoredPaths = statusLines.filter((line) => line.startsWith('!! ')).map((line) => line.slice(3));
+        if (ignoredPaths.length > 0) {
+            const snapshot = input.settlementIgnoredByBranch?.get(worktree.branch);
+            if (!snapshot) {
+                return { failure: 'the worktree contains ignored paths and no settlement snapshot authorizes them', overlayEntries: [] };
+            }
+            const uncovered = ignoredPaths.filter((livePath) => !coveredBySnapshot(livePath, snapshot));
+            if (uncovered.length > 0) {
+                return { failure: `the worktree contains ignored paths that appeared after settlement (${uncovered.slice(0, 3).join(', ')})`, overlayEntries: [] };
+            }
+        }
+        const [head, branchRef] = await Promise.all([
+            input.git.run(['rev-parse', '--verify', 'HEAD'], worktree.worktree_path),
+            input.git.run(['rev-parse', '--verify', `refs/heads/${worktree.branch}`], input.repoDir),
+        ]);
+        const headSha = head.code === 0 ? head.stdout.trim().toLowerCase() : '';
+        const branchSha = branchRef.code === 0 ? branchRef.stdout.trim().toLowerCase() : '';
+        if (!COMMIT_SHA_RE.test(headSha) || !COMMIT_SHA_RE.test(branchSha)) {
+            return { failure: 'Git could not verify the worktree HEAD and recorded branch ref', overlayEntries: [] };
+        }
+        if (headSha !== expected || branchSha !== expected) {
+            return { failure: `HEAD/ref moved after settlement (expected ${expected.slice(0, 12)})`, overlayEntries: [] };
+        }
+        return { failure: null, overlayEntries };
+    }
+    catch (err) {
+        if (!pathStillExists(worktree.worktree_path))
+            return { failure: null, overlayEntries: [], gone: true };
+        return { failure: `verification failed: ${err instanceof Error ? err.message : String(err)}`, overlayEntries: [] };
+    }
+}
+function pathStillExists(target) {
+    try {
+        fs.lstatSync(target);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function quarantineLocationNotes(entries) {
+    return entries
+        .filter((entry) => pathStillExists(entry.quarantinePath))
+        .map((entry) => `overlay data is preserved at ${entry.quarantinePath}`);
+}
+/** Atomically move fingerprint-matching, untracked overlay roots out of the
+ * worktree. Quarantine is a unique sibling on the same filesystem. It is never
+ * automatically deleted or restored: writes through an already-open fd after
+ * rename remain recoverable, and a concurrently recreated source can never be
+ * overwritten by rollback. */
+async function quarantineVerifiedOverlayEntries(input, worktree, evidence) {
+    const removable = [];
+    for (const entry of evidence) {
+        const target = path.join(worktree.worktree_path, ...entry.path.split('/'));
+        if (!pathStillExists(target))
+            continue;
+        const tracked = await input.git.run(['ls-files', '--error-unmatch', '--', entry.path], worktree.worktree_path);
+        if (tracked.code === 0)
+            continue;
+        if (tracked.code !== 1) {
+            return { failure: `Git could not verify ownership of overlay path ${entry.path}`, entries: [] };
+        }
+        if (!(0, worktree_overlay_1.matchesOverlayCleanupEvidence)(worktree.worktree_path, entry)) {
+            return { failure: `overlay path ${entry.path} changed after cleanup verification`, entries: [] };
+        }
+        removable.push(entry);
+    }
+    const cleanupRoots = [];
+    for (const entry of [...removable].sort((a, b) => a.path.split('/').length - b.path.split('/').length)) {
+        if (cleanupRoots.some((root) => root.kind === 'directory' && entry.path.startsWith(`${root.path}/`)))
+            continue;
+        cleanupRoots.push(entry);
+    }
+    if (cleanupRoots.length === 0)
+        return { failure: null, entries: [] };
+    let quarantineRoot;
+    try {
+        // mkdtemp creates the batch directory atomically beside the worktree. The
+        // ensuing rename therefore remains within one filesystem.
+        quarantineRoot = fs.mkdtempSync(`${worktree.worktree_path}.specrails-overlay-quarantine-`);
+    }
+    catch (err) {
+        return {
+            failure: `could not create overlay quarantine beside ${worktree.worktree_path}: ${err instanceof Error ? err.message : String(err)}`,
+            entries: [],
+        };
+    }
+    try {
+        await input.onSafetyArchive?.(quarantineRoot);
+    }
+    catch (err) {
+        return {
+            failure: `could not record safety archive ${quarantineRoot}: ${err instanceof Error ? err.message : String(err)}`,
+            entries: [],
+        };
+    }
+    const quarantined = [];
+    for (const entry of cleanupRoots) {
+        const sourcePath = path.join(worktree.worktree_path, ...entry.path.split('/'));
+        if (!pathStillExists(sourcePath))
+            continue;
+        if (!(0, worktree_overlay_1.matchesOverlayCleanupEvidenceAtPath)(sourcePath, entry)) {
+            return { failure: `overlay path ${entry.path} changed before quarantine`, entries: quarantined };
+        }
+        const quarantinePath = path.join(quarantineRoot, ...entry.path.split('/'));
+        try {
+            fs.mkdirSync(path.dirname(quarantinePath), { recursive: true });
+            await input.beforeOverlayQuarantine?.(sourcePath);
+            fs.renameSync(sourcePath, quarantinePath);
+        }
+        catch (err) {
+            return {
+                failure: `could not quarantine overlay path ${entry.path}: ${err instanceof Error ? err.message : String(err)}`,
+                entries: quarantined,
+            };
+        }
+        const moved = { sourcePath, quarantinePath, evidence: entry };
+        quarantined.push(moved);
+        try {
+            await input.afterOverlayRename?.(sourcePath, quarantinePath);
+        }
+        catch (err) {
+            return {
+                failure: `overlay post-rename hook failed at ${quarantinePath}: ${err instanceof Error ? err.message : String(err)}`,
+                entries: quarantined,
+            };
+        }
+        if (!(0, worktree_overlay_1.matchesOverlayCleanupEvidenceAtPath)(quarantinePath, entry)) {
+            return {
+                failure: `overlay path ${entry.path} changed during atomic quarantine at ${quarantinePath}`,
+                entries: quarantined,
+            };
+        }
+        try {
+            await input.afterOverlayQuarantine?.(quarantinePath);
+        }
+        catch (err) {
+            return {
+                failure: `overlay quarantine hook failed at ${quarantinePath}: ${err instanceof Error ? err.message : String(err)}`,
+                entries: quarantined,
+            };
+        }
+    }
+    return { failure: null, entries: quarantined };
+}
 /** Remove Specrails-managed linked worktrees while keeping their local branches.
  *  PR deliveries use this once the work has a durable remote branch/PR: the
  *  branch remains available for local checkout, but the internal worktree stops
@@ -15,19 +336,65 @@ async function releaseRailWorktrees(input) {
         const wt = (0, rail_worktrees_store_1.getRailWorktree)(input.db, wtId);
         if (!wt)
             continue;
-        if (wt.merge_state === 'needs-review' && input.allowNeedsReview !== true)
-            continue;
         // Successful removal already terminalized these rows. Re-running `git
         // worktree remove` against their now-missing paths turns ordinary Publish /
         // Poll / Discard follow-ups into false cleanup_incomplete warnings.
         if (wt.merge_state !== 'needs-review' && (0, rail_worktrees_store_1.isTerminalMergeState)(wt.merge_state))
             continue;
+        const evidence = await verifyReleaseEvidence(input, wt);
+        // The mount is already GONE (the user ran `git worktree remove` manually,
+        // or an external prune cleaned it): Git could not even inspect the path
+        // AND the filesystem confirms it is absent. There are no bytes left to
+        // preserve — failing verification forever would permanently block Checkout
+        // on a branch that is actually free. Prune the stale registration
+        // (best-effort; prune only drops entries whose dir is missing) and
+        // terminalize the ledger row honestly.
+        if (evidence.gone) {
+            try {
+                await input.git.run(['worktree', 'prune'], input.repoDir);
+            }
+            catch { /* a leftover registration surfaces at checkout with git's own error */ }
+            (0, rail_worktrees_store_1.updateRailWorktreeState)(input.db, wt.id, state);
+            continue;
+        }
+        if (evidence.failure) {
+            (0, rail_worktrees_store_1.updateRailWorktreeState)(input.db, wt.id, 'needs-review');
+            const warning = `worktree ${wt.worktree_path}: preserved because ${evidence.failure}`;
+            warnings.push(warning);
+            console.warn(`[rail-worktree-release] ${warning}`);
+            continue;
+        }
+        const quarantine = await quarantineVerifiedOverlayEntries(input, wt, evidence.overlayEntries);
+        if (quarantine.failure) {
+            (0, rail_worktrees_store_1.updateRailWorktreeState)(input.db, wt.id, 'needs-review');
+            const warning = `worktree ${wt.worktree_path}: preserved because ${[
+                quarantine.failure,
+                ...quarantineLocationNotes(quarantine.entries),
+            ].join('; ')}`;
+            warnings.push(warning);
+            console.warn(`[rail-worktree-release] ${warning}`);
+            continue;
+        }
+        // Quarantining changes the worktree. Re-prove both cleanliness and HEAD/ref
+        // identity immediately before asking Git for its final non-force guard.
+        const finalEvidence = await verifyReleaseEvidence(input, wt);
+        if (finalEvidence.failure) {
+            (0, rail_worktrees_store_1.updateRailWorktreeState)(input.db, wt.id, 'needs-review');
+            const warning = `worktree ${wt.worktree_path}: preserved because ${[
+                finalEvidence.failure,
+                ...quarantineLocationNotes(quarantine.entries),
+            ].join('; ')}`;
+            warnings.push(warning);
+            console.warn(`[rail-worktree-release] ${warning}`);
+            continue;
+        }
         try {
             await remove(input.git, {
                 repoDir: input.repoDir,
                 worktreePath: wt.worktree_path,
                 branch: wt.branch,
                 deleteBranch: false,
+                force: false,
             });
         }
         catch (err) {
@@ -35,13 +402,18 @@ async function releaseRailWorktrees(input) {
             if (current && current.merge_state !== 'needs-review' && (0, rail_worktrees_store_1.isTerminalMergeState)(current.merge_state)) {
                 continue;
             }
-            const warning = `worktree ${wt.worktree_path}: ${err instanceof Error ? err.message : String(err)}`;
+            (0, rail_worktrees_store_1.updateRailWorktreeState)(input.db, wt.id, 'needs-review');
+            const warning = `worktree ${wt.worktree_path}: ${[
+                err instanceof Error ? err.message : String(err),
+                ...quarantineLocationNotes(quarantine.entries),
+            ].join('; ')}`;
             warnings.push(warning);
             console.warn(`[rail-worktree-release] failed to remove ${warning}`);
             continue;
         }
-        if (!(0, rail_worktrees_store_1.isTerminalMergeState)(wt.merge_state))
+        if (wt.merge_state === 'needs-review' || !(0, rail_worktrees_store_1.isTerminalMergeState)(wt.merge_state)) {
             (0, rail_worktrees_store_1.updateRailWorktreeState)(input.db, wt.id, state);
+        }
     }
     return warnings;
 }