wave-code 1.6.2 → 1.6.4

package/src/utils/worktree.ts

@@ -1,8 +1,7 @@
-import { execFile } from "node:child_process";
-import { promisify } from "node:util";
 import * as path from "node:path";
 import * as fs from "node:fs";
 import {
+  execFileAsyncHidden,
   getDefaultRemoteBranch,
   getGitMainRepoRoot,
   performPostCreationSetup,
@@ -10,13 +9,22 @@ import {
   hasWorktreeCreateHook,
   executeWorktreeCreateHook,
   executeWorktreeRemoveHook,
+  EPHEMERAL_WORKTREE_PREFIX,
+  // The worktree delete core, shared with the SDK's own removal (ExitWorktree,
+  // subagent isolation, the startup sweep) so the two entry points cannot drift
+  // apart again — they used to be independent implementations, one git-first.
+  describeRemovalFailure,
+  describeWorktreeRemovalOutcome,
+  describeWorktreeResidue,
+  finishWorktreeRemoval,
+  prepareWorktreeRemoval,
+  removeWorktreeContents,
 } from "wave-agent-sdk";
 import { logger } from "./logger.js";
 
 // Never use execFileSync here: the shared `wave --stdio` process handles all
 // desktop sessions, so a synchronous git call (especially a multi-second
 // recursive worktree delete or a network fetch) freezes every session.
-const execFileAsync = promisify(execFile);
 
 export interface WorktreeSession {
   name: string;
@@ -64,6 +72,14 @@ export function validateWorktreeSlug(name: string): void {
       `Invalid worktree name: "${name}" must be ${MAX_WORKTREE_SLUG_LENGTH} characters or fewer (got ${name.length})`,
     );
   }
+  // `sa-` belongs to wave's own ephemeral worktrees (subagent isolation), which
+  // the startup sweep deletes once they go stale — a user's worktree must never
+  // live in that namespace.
+  if (name.split("/")[0].startsWith(EPHEMERAL_WORKTREE_PREFIX)) {
+    throw new Error(
+      `Invalid worktree name: "${name}" must not start with "${EPHEMERAL_WORKTREE_PREFIX}" (reserved for wave-managed temporary worktrees)`,
+    );
+  }
   for (const segment of name.split("/")) {
     if (segment === "." || segment === "..") {
       throw new Error(
@@ -91,10 +107,14 @@ export function validateWorktreeSlug(name: string): void {
  */
 export async function listWorktrees(cwd: string): Promise<string[]> {
   try {
-    const { stdout } = await execFileAsync(
+    const { stdout } = await execFileAsyncHidden(
       "git",
       ["worktree", "list", "--porcelain"],
-      { cwd },
+      // Explicit for type determinism, not a fix: `execFile` already defaults
+      // `encoding` to 'utf8', so omitting it would also yield a string. Naming
+      // it picks the `{ stdout: string }` overload of `execFileAsyncHidden`
+      // instead of leaving the reader to know that default.
+      { cwd, encoding: "utf8" },
     );
 
     const worktreePaths = stdout
@@ -204,7 +224,7 @@ async function createWorktreeInternal(
 
   try {
     // Create worktree and branch
-    await execFileAsync(
+    await execFileAsyncHidden(
       "git",
       ["worktree", "add", "-b", branchName, worktreePath, resolvedBaseBranch],
       {
@@ -227,7 +247,7 @@ async function createWorktreeInternal(
     if (stderr.includes("already exists")) {
       // If branch already exists, try to add worktree without -b
       try {
-        await execFileAsync(
+        await execFileAsyncHidden(
           "git",
           ["worktree", "add", worktreePath, branchName],
           {
@@ -257,10 +277,10 @@ async function createWorktreeInternal(
       // Base branch not fetched yet — try fetching then retrying
       const branchNameOnly = resolvedBaseBranch.split("/").pop()!;
       try {
-        await execFileAsync("git", ["fetch", "origin", branchNameOnly], {
+        await execFileAsyncHidden("git", ["fetch", "origin", branchNameOnly], {
           cwd: repoRoot,
         });
-        await execFileAsync(
+        await execFileAsyncHidden(
           "git",
           [
             "worktree",
@@ -286,7 +306,7 @@ async function createWorktreeInternal(
       } catch {
         // Fetch or retry failed — fall back to HEAD
         try {
-          await execFileAsync(
+          await execFileAsyncHidden(
             "git",
             ["worktree", "add", "-b", branchName, worktreePath, "HEAD"],
             {
@@ -315,26 +335,6 @@ async function createWorktreeInternal(
   }
 }
 
-/**
- * On Windows, prefix an absolute path with the extended-length marker (`\\?\`)
- * so recursive removal bypasses the 260-char MAX_PATH limit. POSIX paths are
- * returned unchanged.
- */
-function toExtendedLengthPath(worktreePath: string): string {
-  if (process.platform !== "win32") {
-    return worktreePath;
-  }
-  const absolute = path.win32.resolve(worktreePath);
-  if (absolute.startsWith("\\\\?\\")) {
-    return absolute;
-  }
-  if (absolute.startsWith("\\\\")) {
-    // UNC path: \\server\share -> \\?\UNC\server\share
-    return `\\\\?\\UNC\\${absolute.slice(2)}`;
-  }
-  return `\\\\?\\${absolute}`;
-}
-
 /** First line of a captured stderr/message, trimmed and length-capped. */
 function firstLine(text: string | undefined, max = 200): string {
   if (!text) return "";
@@ -343,9 +343,13 @@ function firstLine(text: string | undefined, max = 200): string {
 }
 
 /**
- * Summarise why `git worktree remove` failed. execFile rejections carry the
- * exit code and the child's stderr; without them a removal failure is
- * indistinguishable from a MAX_PATH refusal, a locking process, or a git error.
+ * Summarise why a git command failed. execFile rejections carry the exit code
+ * and the child's stderr; without them a failure is indistinguishable from a
+ * missing git, a locked index, or a plain git error.
+ *
+ * Only `git worktree prune` can fail here now — git no longer performs the
+ * delete itself (see `removeWorktree`), so there is no `worktree remove`
+ * stderr left to explain.
  */
 function describeGitFailure(error: unknown): string {
   const e = error as {
@@ -363,41 +367,8 @@ function describeGitFailure(error: unknown): string {
   return parts.join(" ");
 }
 
-/** Summarise why the `fs.rmSync` fallback failed (code + offending path). */
-function describeFsFailure(error: unknown): string {
-  const e = error as {
-    code?: string;
-    syscall?: string;
-    path?: string;
-    message?: string;
-  };
-  const parts: string[] = [];
-  if (e.code) parts.push(`code=${e.code}`);
-  if (e.syscall) parts.push(`syscall=${e.syscall}`);
-  if (e.path) parts.push(`at=${e.path}`);
-  if (parts.length === 0) parts.push(`message=${firstLine(e.message)}`);
-  return parts.join(" ");
-}
-
 /**
- * Delete the worktree directory with `fs.rmSync`, returning the error when it
- * fails (null on success). Node removes directory symlinks/junctions properly,
- * which is exactly where git gives up on Windows.
- */
-function rmWorktreeDirWithFs(worktreePath: string): unknown | null {
-  try {
-    fs.rmSync(toExtendedLengthPath(worktreePath), {
-      recursive: true,
-      force: true,
-    });
-    return null;
-  } catch (error) {
-    return error;
-  }
-}
-
-/**
- * Waits between `fs.rmSync` attempts on the worktree directory. Mutable so
+ * Waits between content-delete attempts on the worktree directory. Mutable so
  * tests can zero them out.
  *
  * The first attempt still runs immediately; these only spread the retries.
@@ -407,6 +378,11 @@ function rmWorktreeDirWithFs(worktreePath: string): unknown | null {
  * the OS let go (issue #2763: the same `rm -rf` succeeds a few seconds later by
  * hand). Three attempts over ~0.9s covers the release lag without turning a
  * genuinely locked directory into a multi-second stall.
+ *
+ * These cover the content delete only. Once the `.git` pointer is gone there is
+ * nothing left worth retrying — an empty directory's removal either works at
+ * once or is blocked by something a wait will not fix — and a retry there would
+ * reopen exactly the window this ordering exists to close.
  */
 export const worktreeRemoveRetry = { delaysMs: [300, 600] };
 
@@ -415,40 +391,30 @@ function sleep(ms: number): Promise<void> {
 }
 
 /**
- * `rmWorktreeDirWithFs` with the short retry above. Returns null once the
- * directory is gone (or the deletion reported success), the last error
- * otherwise. Existence is deliberately not probed here: the caller already
- * decides "did it actually go" from the filesystem, and an extra stat per
- * attempt would only make that harder to reason about.
+ * The shared `removeWorktreeContents` with the short retry above. Returns null
+ * once every entry except `.git` is gone, the last error otherwise. Existence is
+ * deliberately not probed here: the caller already decides "did it actually go"
+ * from the filesystem, and an extra stat per attempt would only make that harder
+ * to reason about.
+ *
+ * The retry lives here rather than in the shared core because how long to wait
+ * for a just-exited process is this entry point's call — the SDK's synchronous
+ * caller deletes once. It wraps this one call and no other: the `.git` unlink
+ * and the shell delete happen after it, and retrying them makes no sense once
+ * the pointer is gone.
  */
-async function rmWorktreeDirWithRetries(
+async function rmWorktreeContentsWithRetries(
   worktreePath: string,
 ): Promise<unknown | null> {
-  let error = rmWorktreeDirWithFs(worktreePath);
+  let error = removeWorktreeContents(worktreePath);
   for (const delayMs of worktreeRemoveRetry.delaysMs) {
     if (!error) return null;
     await sleep(delayMs);
-    error = rmWorktreeDirWithFs(worktreePath);
+    error = removeWorktreeContents(worktreePath);
   }
   return error;
 }
 
-/**
- * Describe what is still on disk after a failed removal. Without this a
- * failure log cannot distinguish "directory already gone" from "the whole
- * checkout is still sitting there".
- */
-function probeResidue(worktreePath: string): string {
-  try {
-    if (!fs.existsSync(worktreePath)) return "none";
-    const entries = fs.readdirSync(worktreePath) as string[];
-    const head = entries.slice(0, 5).join(",");
-    return `${entries.length}[${head}${entries.length > 5 ? ",…" : ""}]`;
-  } catch (error) {
-    return `unknown(${(error as { code?: string }).code ?? "error"})`;
-  }
-}
-
 export interface WorktreeChanges {
   /** Uncommitted (tracked-modified or untracked) files in the worktree. */
   files: number;
@@ -634,10 +600,14 @@ export async function getWorktreeChanges(
 ): Promise<WorktreeChanges | null> {
   let files: number;
   try {
-    const { stdout } = await execFileAsync("git", ["status", "--porcelain"], {
-      cwd: worktreePath,
-      encoding: "utf8",
-    });
+    const { stdout } = await execFileAsyncHidden(
+      "git",
+      ["status", "--porcelain"],
+      {
+        cwd: worktreePath,
+        encoding: "utf8",
+      },
+    );
     files = stdout.split("\n").filter((line) => line.trim().length > 0).length;
   } catch {
     return null;
@@ -646,7 +616,7 @@ export async function getWorktreeChanges(
   let commits = 0;
   try {
     const base = baseBranch ?? getDefaultRemoteBranch(worktreePath);
-    const { stdout } = await execFileAsync(
+    const { stdout } = await execFileAsyncHidden(
       "git",
       ["rev-list", "--count", `${base}..HEAD`],
       { cwd: worktreePath, encoding: "utf8" },
@@ -667,20 +637,55 @@ export async function getWorktreeChanges(
  *   or `worktreeCreationBranch`) — never the branch that directory happens to
  *   have checked out, which an in-session `git checkout` can change.
  *
- * Removal is best-effort: `git worktree remove --force` deletes the worktree
- * metadata before the working directory, and on Windows its recursive deletion
- * is MAX_PATH-limited — deep paths (e.g. node_modules) can fail with "Filename
- * too long", leaving an orphan directory. When git fails we fall back to
- * fs.rmSync with an extended-length path (bypasses MAX_PATH) and prune stale
- * metadata. The fallback retries a couple of times (`worktreeRemoveRetry`): a
- * directory locked by a process that is only now exiting — the usual Windows
- * case — becomes deletable a moment later. Failures are logged; when the
- * directory still survives, its branch is deliberately kept so the leftover
- * checkout stays reachable through git.
+ * The order is inverted relative to "let git delete it" — git performs no part
+ * of the delete at all — but the `.git` pointer is deliberately *not* first:
+ *
+ *   1. the checks git used to make (main working tree / lock / points back);
+ *   2. read the pointer's bytes;
+ *   3. Windows only: clear the reparse points;
+ *   4. delete every entry under the worktree except the root `.git`  ← retried;
+ *   5. unlink the root `.git`;
+ *   6. remove the now-empty directory;
+ *   7. only if 6 failed: write the pointer back;
+ *   8. `git worktree prune`, then `git branch -D`.
+ *
+ * git's exit code is not trustworthy for this job. `git worktree remove`
+ * deletes the metadata before the working directory, and on Windows it cannot
+ * recurse over the junctions pnpm's node_modules is made of — it deletes the
+ * files, leaves the skeleton behind and still exits 0; the opposite also
+ * happens (it deregisters, then fails to delete). Either way the directory and
+ * git's records end up disagreeing, which is the "residue + branch still there
+ * + worktree no longer registered" report. So git no longer deletes: the
+ * contents go first with the pointer still in place (the long, failure-prone
+ * step), then the pointer is unlinked, then the empty shell is removed with
+ * `fs.rmSync` on an extended-length path (bypasses MAX_PATH), and `prune` ties
+ * up the registration afterwards.
+ *
+ * Steps 4 and 5 are in that order because step 4 is the one that takes seconds
+ * and the one that fails on a held file. While it runs git still registers the
+ * worktree, so a process killed there leaves something `git worktree prune` and
+ * the next removal both find. A failed step 4 or 5 leaves the pointer untouched
+ * and nothing is written back; only a failed step 6 needs the bytes restored.
+ *
+ * The checks git used to make — is this the main working tree, is it
+ * `git worktree lock`ed, does its `.git` really point into this repo — plus the
+ * pointer handling and the delete come from the shared core
+ * (`worktreeRemoval.ts`, exported by `wave-agent-sdk`), which is also what the
+ * SDK's own removal uses (ExitWorktree, subagent isolation, the startup sweep).
+ * One delete core, two calling conventions; they used to be independent
+ * implementations and drifted. What stays here is this package's half: git
+ * calls are async (a synchronous spawn would freeze every session the shared
+ * `wave --stdio` process serves), the *content* delete retries
+ * (`worktreeRemoveRetry`) because Windows releases a just-exited process's
+ * directory handle asynchronously, and the answer is "is the directory gone"
+ * rather than nothing.
  *
  * Returns whether the directory is actually gone (not whether the removal was
  * attempted) — a caller that reports the outcome to a user must print it rather
  * than assume success, because every failure mode above is silent by design.
+ * A refusal (locked, `.git` not pointing into this repo, main working tree) is
+ * the same answer as a failed delete: `false`, with the directory and its
+ * branch untouched.
  *
  * The branch is deleted only when `repoRoot` actually has it (`branchExists`),
  * so a name inferred from the path — which no longer depends on how the two
@@ -715,76 +720,117 @@ export async function removeWorktree(
   }
 
   const repoRoot = session.repoRoot;
+  const worktreePath = session.path;
 
-  // Remove worktree
-  try {
-    await execFileAsync(
-      "git",
-      ["worktree", "remove", "--force", session.path],
-      {
-        cwd: repoRoot,
-      },
+  // Steps 1–3 — the checks git used to make, the Windows reparse-point pass and
+  // the pointer read — all in the shared core, so this path and the SDK's cannot
+  // diverge.
+  const prepared = prepareWorktreeRemoval({ worktreePath, repoRoot });
+
+  if (prepared.status === "refused") {
+    // Nothing was deleted and the directory is still there, so this is a
+    // `false` answer to "is the directory gone" — not a throw.
+    logger.warn(
+      `Removal refused: path=${worktreePath} refusal=${prepared.reason} — ${prepared.message}`,
     );
-    // git exits 0 even when it did not delete the directory: on Windows it
-    // cannot remove directory symlinks/junctions, which is exactly what pnpm's
-    // node_modules is made of — so it deletes the files, leaves the skeleton
-    // behind and still reports success. Trust the filesystem, not the exit code.
-    if (fs.existsSync(session.path)) {
+    return false;
+  }
+
+  if (prepared.status === "prepared") {
+    if (prepared.leftover) {
+      // No pointer: a previous cleanup already took it, so git does not know
+      // this directory any more — it is just files.
       logger.warn(
-        `git worktree remove reported success but the directory survived: ` +
-          `path=${session.path} residue=${probeResidue(session.path)} — ` +
-          `deleting with fs.rmSync instead`,
+        `Worktree .git pointer already gone — deleting the directory as a ` +
+          `plain leftover: path=${worktreePath}`,
       );
-      const rmError = await rmWorktreeDirWithRetries(session.path);
-      if (rmError) {
-        logger.error(
-          `Failed to remove worktree or branch: path=${session.path} ` +
-            `stage=fs(after git success) ${describeFsFailure(rmError)} ` +
-            `residue=${probeResidue(session.path)}`,
-          rmError,
-        );
-      }
     }
-  } catch (error: unknown) {
-    logger.warn(
-      `git worktree remove failed, falling back to fs.rmSync: ${describeGitFailure(error)}`,
-      error,
-    );
-    const rmError = await rmWorktreeDirWithRetries(session.path);
-    if (rmError) {
-      // Removal failures are best-effort, so this line is often the only trace
-      // of an orphaned worktree directory: record which stage failed, why, and
-      // whether anything was left behind.
-      logger.error(
-        `Failed to remove worktree or branch: path=${session.path} stage=fs ` +
-          `${describeFsFailure(rmError)} residue=${probeResidue(session.path)} ` +
-          `git(${describeGitFailure(error)})`,
-        rmError,
+    if (prepared.reparsePointsUnlinked > 0) {
+      logger.info(
+        `Unlinked ${prepared.reparsePointsUnlinked} reparse point(s) before ` +
+          `removing the worktree: path=${worktreePath}`,
       );
     }
-    // git removes worktree metadata before the working directory; prune any
-    // leftovers in case git failed before deleting them.
-    try {
-      await execFileAsync("git", ["worktree", "prune"], {
-        cwd: repoRoot,
+
+    // Step 4, retried — the only retried step, and the only one that runs while
+    // git still registers the worktree. Failing here or at the unlink below
+    // leaves the pointer untouched, so nothing is written back: the directory
+    // and git's records still agree, which is the state this ordering buys.
+    const contentError = await rmWorktreeContentsWithRetries(worktreePath);
+    if (contentError) {
+      const errno = (contentError as NodeJS.ErrnoException | undefined)?.code;
+      logger.error(
+        `Failed to remove the worktree's contents — its .git is still in ` +
+          `place, so git keeps it registered: path=${worktreePath} ` +
+          `stage=contents` +
+          (typeof errno === "string" ? ` code=${errno}` : "") +
+          ` ${describeRemovalFailure(contentError, prepared.reparsePointUnremovable)} ` +
+          `gitPointerIntact=true residue=${describeWorktreeResidue(worktreePath)}`,
+        contentError,
+      );
+    } else {
+      // Steps 5–7: unlink the pointer, remove the shell, and write the pointer
+      // back only if that last step failed. The restore has to happen after the
+      // retries above, never between them; and the pointer must not go back
+      // when the unlink itself failed, since it was never removed.
+      const finish = finishWorktreeRemoval({
+        worktreePath,
+        pointer: prepared.pointer,
+        reparsePointUnremovable: prepared.reparsePointUnremovable,
       });
-    } catch {
-      // Ignore errors pruning stale metadata
+
+      if (finish.status === "pointer-stuck") {
+        // Deleting the directory while git still registers it would leave the
+        // dangling entry this design exists to prevent. The shared tail below
+        // reports the surviving directory and returns false.
+        logger.error(
+          `Failed to remove worktree or branch: path=${worktreePath} ` +
+            `stage=unlink(.git) ${finish.reason} gitPointerIntact=true ` +
+            `residue=${describeWorktreeResidue(worktreePath)}`,
+        );
+      } else if (finish.status === "shell-stuck") {
+        // The raw errno next to the translated sentence: the sentence says what
+        // to do about it, the code is what a bug report or a search matches.
+        const errno = (finish.error as NodeJS.ErrnoException | undefined)?.code;
+        // Both failures are reported, and neither masks the other: the pointer
+        // went back byte for byte (so git still knows about the directory that
+        // survived) and the reason says what is holding it.
+        logger.error(
+          `Failed to remove worktree directory: path=${worktreePath} stage=fs` +
+            (typeof errno === "string" ? ` code=${errno}` : "") +
+            ` ${finish.reason} ` +
+            `gitPointerRestored=${finish.pointerRestored}` +
+            (finish.restoreError === null
+              ? ""
+              : ` restoreError=${firstLine((finish.restoreError as Error)?.message)}`) +
+            ` residue=${describeWorktreeResidue(worktreePath)}`,
+          finish.error,
+        );
+      }
     }
   }
 
   // The directory, not any exit code, decides whether the removal happened. A
   // surviving directory means its checkout (and any uncommitted work in it) is
   // still on disk, and the branch is the only ref still leading back to it.
-  if (fs.existsSync(session.path)) {
+  if (fs.existsSync(worktreePath)) {
     logger.warn(
       `Worktree directory survived removal — keeping ` +
         `${session.branch || "its branches"} so the leftover checkout stays ` +
-        `reachable: path=${session.path} residue=${probeResidue(session.path)}`,
+        `reachable: path=${worktreePath} residue=${describeWorktreeResidue(worktreePath)}`,
     );
     return false;
   }
 
+  // git's registration deliberately outlives the directory — that is what let
+  // the content delete be recoverable — so this is the step that drops it, and
+  // it has to run before `branch -D`, which git refuses for a branch a
+  // registered worktree still has checked out. It runs only once the directory
+  // is really gone: pruning while the worktree is still on disk would be a
+  // no-op at best and would deregister a directory a refusal (or a stuck
+  // pointer) deliberately left registered.
+  await pruneWorktreeRegistration(repoRoot, worktreePath);
+
   // Delete the worktree's own branch. Branches the user checked out inside the
   // worktree are never touched — they may hold commits that are not reachable
   // from anywhere else (aligned with Claude Code). That is why `session.branch`
@@ -793,7 +839,7 @@ export async function removeWorktree(
   // that must survive. An unknown branch deletes nothing at all.
   if (!session.branch) {
     logger.warn(
-      `No branch recorded for the worktree at ${session.path} — keeping every ` +
+      `No branch recorded for the worktree at ${worktreePath} — keeping every ` +
         `branch rather than deleting the one it had checked out`,
     );
     return true;
@@ -806,13 +852,13 @@ export async function removeWorktree(
   if (!(await branchExists(repoRoot, session.branch))) {
     logger.warn(
       `No branch ${session.branch} in ${repoRoot} — keeping every branch ` +
-        `(the worktree at ${session.path} was not created on it, or it is ` +
+        `(the worktree at ${worktreePath} was not created on it, or it is ` +
         `already gone)`,
     );
     return true;
   }
   try {
-    await execFileAsync("git", ["branch", "-D", session.branch], {
+    await execFileAsyncHidden("git", ["branch", "-D", session.branch], {
       cwd: repoRoot,
     });
   } catch {
@@ -822,29 +868,52 @@ export async function removeWorktree(
 }
 
 /**
- * What to tell the user when `removeWorktree` returned `false`: where the
- * directory still is, which branch was kept for it (removal keeps that ref so
- * the leftover checkout stays reachable through git), and the two commands that
- * finish the job by hand.
+ * Drop git's record of a worktree that is no longer on disk.
+ *
+ * `git worktree prune` removes administrative dirs whose worktree has
+ * disappeared — exactly the state this removal leaves behind on purpose (see
+ * `removeWorktree`). A failure only warns: the directory is already gone by
+ * then, so all that is left is a stale entry a later `prune` will drop.
+ */
+async function pruneWorktreeRegistration(
+  repoRoot: string,
+  worktreePath: string,
+): Promise<void> {
+  try {
+    await execFileAsyncHidden("git", ["worktree", "prune"], {
+      cwd: repoRoot,
+    });
+  } catch (error) {
+    logger.warn(
+      `git worktree prune failed after removing a worktree: ` +
+        `path=${worktreePath} ${describeGitFailure(error)}`,
+      error,
+    );
+  }
+}
+
+/**
+ * What to tell the user when `removeWorktree` returned `false`.
  *
- * Single-sourced because every CLI entry point that removes a worktree used to
- * print a flat "Done." whether or not anything was deleted — TUI exit, `-p`, and
- * `wave daemon destroy --remove-worktree` (issue #2763). One wording, one place.
+ * The text itself lives in the shared core
+ * (`describeWorktreeRemovalOutcome`), because `false` does not only mean "the
+ * delete failed": the removal is also refused outright for a `git worktree
+ * lock`ed worktree, a directory that is its own repository, and the main
+ * working tree. Only the first case should be answered with `rm -rf`, and this
+ * signature has no room for the reason — the core therefore probes the
+ * directory instead. Keeping the wrapper means the four callers (TUI exit,
+ * `-p` twice, `wave daemon destroy --remove-worktree`) do not change.
  */
 export function describeWorktreeSurvival(worktree: {
   path: string;
   branch: string;
   repoRoot: string;
 }): string {
-  const branch = worktree.branch ? `branch ${worktree.branch}` : "every branch";
-  return (
-    `Worktree directory survived at ${worktree.path}; kept ${branch} so the ` +
-    `leftover checkout stays reachable\n` +
-    `Clean up manually: rm -rf ${worktree.path}` +
-    (worktree.branch
-      ? ` && git -C ${worktree.repoRoot} branch -D ${worktree.branch}`
-      : "")
-  );
+  return describeWorktreeRemovalOutcome({
+    worktreePath: worktree.path,
+    repoRoot: worktree.repoRoot,
+    branch: worktree.branch,
+  });
 }
 
 /**
@@ -859,7 +928,7 @@ async function branchExists(
   branch: string,
 ): Promise<boolean> {
   try {
-    const { stdout } = await execFileAsync(
+    const { stdout } = await execFileAsyncHidden(
       "git",
       ["branch", "--list", "--format=%(refname:short)", branch],
       { cwd: repoRoot, encoding: "utf8" },