ctrlrelay 0.11.2__tar.gz → 0.11.3__tar.gz

{ctrlrelay-0.11.2 → ctrlrelay-0.11.3}/CHANGELOG.md

@@ -7,6 +7,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.11.3] - 2026-09-12
+
+### Fixed
+
+- **A force-pushed default branch fails the fetch again.** v0.11.2
+  tolerated every non-fast-forward rejection so a rebased Dependabot
+  branch would stop aborting sweeps. That also covered the default
+  branch, which sessions are cut from: after a force-push to `main` on
+  GitHub, the bare repo would keep its old `main` and every session
+  would run on a tree origin no longer has, with only a log line to show
+  for it. A rejection of the default branch now raises
+  `default branch diverged from origin`; other branches are still
+  tolerated. Closes #120.
+
 ## [0.11.2] - 2026-09-10
 
 ### Fixed
@@ -1644,7 +1658,8 @@ pipeline).
   per-phase implementation plans (Phase 0 through Phase 4).
 - `docs/Claude_Code_Project_Guide.md` — project development guide.
 
-[Unreleased]: https://github.com/AInvirion/ctrlrelay/compare/v0.11.2...HEAD
+[Unreleased]: https://github.com/AInvirion/ctrlrelay/compare/v0.11.3...HEAD
+[0.11.3]: https://github.com/AInvirion/ctrlrelay/compare/v0.11.2...v0.11.3
 [0.11.2]: https://github.com/AInvirion/ctrlrelay/compare/v0.11.1...v0.11.2
 [0.11.1]: https://github.com/AInvirion/ctrlrelay/compare/v0.11.0...v0.11.1
 [0.11.0]: https://github.com/AInvirion/ctrlrelay/compare/v0.10.0...v0.11.0

{ctrlrelay-0.11.2 → ctrlrelay-0.11.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: ctrlrelay
-Version: 0.11.2
+Version: 0.11.3
 Summary: Local-first orchestrator for headless coding agents across multiple GitHub repos
 Project-URL: Homepage, https://github.com/AInvirion/ctrlrelay
 Project-URL: Documentation, https://ainvirion.github.io/ctrlrelay/

{ctrlrelay-0.11.2 → ctrlrelay-0.11.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "ctrlrelay"
-version = "0.11.2"
+version = "0.11.3"
 description = "Local-first orchestrator for headless coding agents across multiple GitHub repos"
 readme = "README.md"
 requires-python = ">=3.12"

{ctrlrelay-0.11.2 → ctrlrelay-0.11.3}/src/ctrlrelay/core/worktree.py

@@ -122,6 +122,7 @@ class WorktreeManager:
         cwd: Path | None = None,
         timeout: int | None = None,
         tolerate_non_fast_forward: bool = False,
+        protected_refs: frozenset[str] = frozenset(),
     ) -> str:
         """Run git command and return stdout. `timeout` overrides self.timeout
         for one call — useful for cheap probes that shouldn't inherit the full
@@ -131,6 +132,11 @@ class WorktreeManager:
         refspec: git exits 1 when it declines to rewind a diverged local
         branch, even though every other ref updated. See
         :func:`_rejections_are_only_non_fast_forward`.
+
+        ``protected_refs`` names branches whose rejection is never
+        tolerated. A declined rewind of the default branch means local
+        and origin have diverged there, and every worktree cut from it
+        would run against a tree origin no longer has.
         """
         cmd = ["git", *args]
         effective_timeout = timeout if timeout is not None else self.timeout
@@ -186,6 +192,13 @@ class WorktreeManager:
             )
             if not declined:
                 raise WorktreeError(f"git failed: {err}")
+            stuck = sorted(set(declined) & protected_refs)
+            if stuck:
+                raise WorktreeError(
+                    f"git failed: default branch diverged from origin "
+                    f"({', '.join(stuck)}); refusing to use a stale tree: "
+                    f"{err}"
+                )
             log_event(
                 _logger,
                 "worktree.fetch.non_fast_forward",
@@ -864,10 +877,22 @@ class WorktreeManager:
           Git exits 1 on a declined rewind even when every other ref
           applied, and that exit code was aborting the whole session
           for a branch it had correctly protected.
+
+        The default branch is the exception: a rejection there still
+        raises. Sessions are cut from it, so tolerating that one would
+        swap a loud failure for work done quietly on a stale tree —
+        e.g. after a force-push to ``main`` on GitHub.
         """
         bare_path = self._get_bare_repo_path(repo)
 
         if bare_path.exists():
+            try:
+                default_branch = await self.get_default_branch(repo)
+            except WorktreeError:
+                # A bare repo with no symbolic HEAD cannot name a default
+                # branch to protect. create_worktree fails on the same
+                # lookup, so the stale-tree risk never reaches a session.
+                default_branch = ""
             await self._run_git(
                 "fetch", "--prune", "origin",
                 _BOT_BRANCH_REFSPEC,
@@ -875,6 +900,10 @@ class WorktreeManager:
                 cwd=bare_path,
                 timeout=_GIT_TRANSFER_TIMEOUT_SECONDS,
                 tolerate_non_fast_forward=True,
+                protected_refs=(
+                    frozenset({default_branch}) if default_branch
+                    else frozenset()
+                ),
             )
         else:
             await self._run_git(

{ctrlrelay-0.11.2 → ctrlrelay-0.11.3}/tests/test_worktree.py

@@ -79,12 +79,14 @@ class TestWorktreeManager:
             mock_git.return_value = ""
             await manager.ensure_bare_repo("owner/repo")
 
-        assert mock_git.await_count == 1
+        # symbolic-ref (default-branch lookup), then the fetch.
+        assert mock_git.await_count == 2
+        assert mock_git.await_args_list[0].args[0] == "symbolic-ref"
         args = mock_git.await_args.args
         # Must be a fetch, not --all, with the explicit refspec.
         assert args[0] == "fetch"
         assert "origin" in args
-        # Non-force refspec on purpose: codex P1 — a force fetch
+        # Non-force refspec on purpose: a force fetch
         # would destroy unpushed local commits in the dev pipeline's
         # branch-reuse flow. Fast-forward-only fixes the stale-
         # default-branch case while leaving divergent dev branches
@@ -1597,7 +1599,10 @@ class TestGitTimeoutIsDiagnosable:
         wt._get_bare_repo_path("owner/repo").mkdir(parents=True, exist_ok=True)
         wt._run_git.reset_mock()
         await wt.ensure_bare_repo("owner/repo")
-        fetch_kwargs = wt._run_git.await_args_list[0].kwargs
+        fetch_kwargs = next(
+            c.kwargs for c in wt._run_git.await_args_list
+            if c.args and c.args[0] == "fetch"
+        )
         assert fetch_kwargs["timeout"] == _GIT_TRANSFER_TIMEOUT_SECONDS
 
 
@@ -1726,6 +1731,47 @@ class TestFetchSurvivesRewrittenBranches:
             await wt.ensure_bare_repo("owner/repo")
 
 
+    @pytest.mark.asyncio
+    async def test_force_pushed_default_branch_still_raises(
+        self, tmp_path: Path
+    ) -> None:
+        """Sessions are cut from the default branch. If origin rewrote it,
+        tolerating the rejection would run every session on a tree origin
+        no longer has — quietly, instead of loudly."""
+        import subprocess
+
+        from ctrlrelay.core.worktree import WorktreeError, WorktreeManager
+
+        origin, bare = self._build_repos(tmp_path)
+
+        # Rewrite main on origin, and give the bare clone its own commit
+        # on main so the two have diverged.
+        self._git("checkout", "-q", "main", cwd=origin)
+        (origin / "f").write_text("rewritten\n")
+        self._git("commit", "-qam", "x", cwd=origin)
+        self._git("commit", "-q", "--amend", "-m", "force-pushed main",
+                  cwd=origin)
+        tree = self._git("rev-parse", "refs/heads/main^{tree}",
+                         cwd=bare).strip()
+        sha = self._git("commit-tree", tree, "-p", "refs/heads/main",
+                        "-m", "local main", cwd=bare).strip()
+        self._git("update-ref", "refs/heads/main", sha, cwd=bare)
+
+        wt = WorktreeManager(
+            worktrees_dir=tmp_path / "wt", bare_repos_dir=tmp_path / "repos",
+        )
+        target = wt._get_bare_repo_path("owner/repo")
+        target.parent.mkdir(parents=True, exist_ok=True)
+        bare.rename(target)
+        subprocess.run(
+            ["git", "remote", "set-url", "origin", str(origin)],
+            cwd=target, check=True,
+        )
+
+        with pytest.raises(WorktreeError, match="default branch diverged"):
+            await wt.ensure_bare_repo("owner/repo")
+
+
 class TestNonFastForwardClassifier:
     """`_rejections_are_only_non_fast_forward` decides whether a
     non-zero `git fetch` is the refspec doing its job or a real