* fix(worktree): unlock-retry on locked cleanup + startup orphan sweep (#3707) Two root causes fixed: 1. **In-session cleanup blocked**: `executeWorktreeWaveCleanupPlan` now attempts `git worktree unlock <path>` then retries `git worktree remove --force` when the initial single-force remove fails on a locked worktree. Previously every cleanup after a successful merge was silently blocked. 2. **Cross-session orphan accumulation**: new `reapOrphanWorktrees` helper sweeps `.git/worktrees/*/locked` at startup. It reaps entries where the pid is dead, the branch tip is an ancestor of the default branch (ancestry guard prevents data loss on squash-merge repos), and the lock mtime is older than 5 minutes (race guard). Wired into `quick.md` and `execute-phase.md` startup blocks guarded by `USE_WORKTREES != false`. SDK: adds `worktree.reap-orphans` query command (routes through gsd-tools.cjs). Tests: 11 real-fs tests covering unlock-retry, dead-pid reap, live-pid skip, unmerged skip, fresh-mtime skip, idempotent double-call, and structural wiring. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(changeset): add Fixed fragment for PR #3707 (worktree orphan cleanup) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(worktree): fix test portability on Windows + macOS for bug-3707 reap tests - worktreeMeta helper: replace /\/\.git$/ with /[/\\]\.git$/ so the gitdir path suffix is stripped on both Windows (backslash) and Unix. - worktreeMeta helper: normalize CRLF→LF before splitting porcelain blocks, fixing block parsing when git emits CRLF on Windows. - reapOrphanWorktrees: replace single 'main' rev-parse with a [defaultBranch, 'main', 'master'] candidate loop so test fixtures without a remote origin (where branch may be 'master') don't bail early. Intentionally excludes 'HEAD' to prevent false reaping when HEAD is detached or on a feature branch (Codex adversarial finding). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(worktree): CI green — macOS symlink path, Windows test helper, pid portability, EPERM liveness Four fixes to get macOS + Windows CI from red to green: 1. **macOS symlink mismatch** (worktree-safety.cjs): `reapOrphanWorktrees` now builds a canonical→listed path map from `git worktree list --porcelain` using `fs.realpathSync.native`. Uses the listed path (as git knows it) for `git worktree unlock/remove`, not the gitdir-derived path. Fixes the `/var/folders` vs `/private/var/folders` discrepancy on GitHub macOS runners where `git worktree unlock <realpath>` was silently failing because git's list stored the unresolved symlink path. 2. **Windows path separator in test helper** (test file): `worktreeMeta` `.replace(/\/\.git$/, '')` → `.replace(/[/\\]\.git$/, '')`. On Windows, git writes backslash separators in the gitdir file; the Unix-only regex was causing `Cannot find .git/worktrees/<name>` for all Suite 2 tests. 3. **Non-portable PID in tests** (test file): All `'999999'` dead-PID literals replaced with `deadPid()` helper that spawns a real short-lived child, captures its PID, and returns it after exit. Eliminates flakiness on Linux systems where `pid_max` can reach 4194304, making 999999 a live PID. 4. **EPERM fail-closed in isPidAlive** (worktree-safety.cjs): `catch { return false }` → checks `err.code === 'EPERM'` and returns `true` (alive). On Windows and cross-user scenarios, `process.kill(pid, 0)` throws EPERM for live but inaccessible processes; treating that as dead would reap a live worktree. Adversarial review via codex confirmed: - Squash-merge repos: fail-closed (CONCERN, not BUG — by design, not data-loss) - canonicalToListed map: SAFE (fail-closed on realpathSync error) - Concurrent reapers: SAFE (both prune; second gets skipped: remove_failed) - Startup blocking: CONCERN (no global cap, 10s/call × N worktrees) — tracked, not fixed here (requires separate perf work) - gsd-sdk missing: SAFE (quick.md checks and fails fast with guidance) All 27 local tests + Docker (holodeck) green. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(worktree): address codex adversarial findings — fail-closed default branch + CRLF map Two fixes from codex adversarial review of PR 3718: 1. **Default branch resolution (data-loss risk)**: `reapOrphanWorktrees` now uses `refs/remotes/origin/<branch>` exclusively when a remote is configured. If `origin/HEAD` is absent but a remote exists, we bail out (fail-closed) rather than falling back to a local `main`/`master` that may not be the real integration branch. The `main`/`master` fallback is only used when there is provably no remote (local-only test fixtures). 2. **CRLF normalization in canonical-path mapper**: The `worktree list --porcelain` output was split on '\n\n' without normalizing CRLF first. On Windows, git emits CRLF, which caused block-splitting to fail and left the canonicalToListed map only partially populated, weakening the symlink/path-mismatch fix introduced earlier. 3. **Windows 8.3 short-path fix (test helper)**: Both `beforeEach` blocks now call `resolvedTmpDir()` which pre-resolves `os.tmpdir()` via `fs.realpathSync.native` so temp paths avoid RUNNER~1-style short names that git stores in long form, causing worktreeMeta path comparisons to fail on Windows CI. All 11 real-fs + 16 unit tests green locally. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(worktree): adversarial findings + macOS CI path-mismatch fix ## Root cause (macOS CI fail) `reapOrphanWorktrees` stored `worktreePath` (gitdir-derived, real path via git's symlink resolution, e.g. `/private/var/folders/…`) in results, while the test's `wtDir` used the unresolved symlink form (`/var/folders/…`). After reaping, `canonicalPath(wtDir)` can no longer call `realpathSync.native` (directory gone), so it falls back to `path.resolve` — which returns the symlink form — causing the `result.find()` comparison to miss. ## Fixes applied ### Source — worktree-safety.cjs 1. **Finding 1 (fail-closed PID check)**: Non-parseable lock content (e.g. `"Locked by claude-code agent-xxx"`) is now treated as ALIVE with reason `lock_owner_unknown`, not as dead. Previously it fell through as dead. 2. **Finding 1b (EPERM safe)**: `isPidAlive` call wrapped in try/catch; any thrown error (EPERM = process exists but cross-user on Windows) → ALIVE. 3. **Finding 2 (startup warning)**: `cmdWorktreeReapOrphans` now writes a one-line stderr warning when ≥1 entry is skipped or when reaper throws, while keeping exit-zero so workflows don't break. 4. **Finding 3 (default-branch discovery)**: Local-only fallback now tries `init.defaultBranch` config and HEAD symref before `main`/`master`, so repos configured with `trunk`, `dev`, etc. get correct orphan detection. 5. **macOS path fix**: Result entry for reaped worktrees now uses `gitKnownPath` (from `git worktree list`) instead of `worktreePath` (from gitdir file), ensuring the caller always sees the path git uses for the worktree. ### Test — bug-3707-locked-worktree-cleanup.test.cjs 6. **macOS CI fix**: Pre-compute `wtDirCanonical = canonicalPath(wtDir)` before calling `reapOrphanWorktrees` so the comparison works after removal. 7. **Gap 1**: New test — Claude Code lock format (`"Locked by claude-code …"`) must not be reaped; asserts `status=skipped, reason=lock_owner_unknown`. 8. **Gap 2**: New test — `isPidAlive` throwing EPERM → must not reap. 9. **Gap 3**: New test — repo with `init.defaultBranch=trunk`; merged worktree must be reaped (verifies trunk is discovered as the integration branch). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(test): raise waitForStoppedAt timeout 2 s → 5 s for Windows/Node22 CI load Subprocess write latency exceeds 2 s on loaded windows-latest/Node22 runners (test duration was 6181 ms); 5 s gives sufficient headroom without changing any production behaviour. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Tom Boucher
@@ -1207,8 +1207,10 @@ async function runCommand(command, args, cwd, raw, defaultValue, originalCommand
|
||||
const worktreeSafety = require('./lib/worktree-safety.cjs');
|
||||
if (subcommand === 'cleanup-wave') {
|
||||
worktreeSafety.cmdWorktreeCleanupWave(cwd, args.slice(2));
|
||||
} else if (subcommand === 'reap-orphans') {
|
||||
worktreeSafety.cmdWorktreeReapOrphans(cwd);
|
||||
} else {
|
||||
error('Unknown worktree subcommand. Available: cleanup-wave', ERROR_REASON.SDK_UNKNOWN_COMMAND);
|
||||
error('Unknown worktree subcommand. Available: cleanup-wave, reap-orphans', ERROR_REASON.SDK_UNKNOWN_COMMAND);
|
||||
}
|
||||
break;
|
||||
}
|
||||
|
||||
@@ -475,7 +475,14 @@ function executeWorktreeWaveCleanupPlan(plan, deps = {}) {
|
||||
break;
|
||||
}
|
||||
|
||||
const remove = execGit(['worktree', 'remove', entry.worktree_path, '--force'], { cwd: plan.repoRoot });
|
||||
let remove = execGit(['worktree', 'remove', entry.worktree_path, '--force'], { cwd: plan.repoRoot });
|
||||
if (!gitResultOk(remove)) {
|
||||
// Locked worktrees require unlock before remove (or --force --force).
|
||||
// Attempt: git worktree unlock <path> (ignore failure — already unlocked is ok)
|
||||
// then retry git worktree remove --force. (#3707)
|
||||
execGit(['worktree', 'unlock', entry.worktree_path], { cwd: plan.repoRoot });
|
||||
remove = execGit(['worktree', 'remove', entry.worktree_path, '--force'], { cwd: plan.repoRoot });
|
||||
}
|
||||
if (!gitResultOk(remove)) {
|
||||
result.status = 'blocked';
|
||||
result.reason = 'worktree_remove_failed';
|
||||
@@ -548,6 +555,304 @@ function cmdWorktreeCleanupWave(cwd, args = []) {
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Reap orphaned linked worktrees whose lock owner process is dead, whose
|
||||
* branch tip is fully merged into the default branch, and whose lock file
|
||||
* mtime is older than REAP_MTIME_GUARD_MS (race guard).
|
||||
*
|
||||
* Invariants (Fail-closed — skip on any doubt):
|
||||
* Pre: .git/worktrees/<id>/locked exists for a linked worktree
|
||||
* Reap: pid dead (or unparseable) AND branch-tip ancestor of default branch
|
||||
* AND lock mtime > REAP_MTIME_GUARD_MS old
|
||||
* Action: worktree unlock → worktree remove --force → prune
|
||||
* Post: worktree absent from git worktree list; no unmerged work lost
|
||||
*
|
||||
* @param {string} repoRoot - Absolute path to the primary worktree root.
|
||||
* @param {object} [deps] - Optional dependency overrides for testing.
|
||||
* deps.execGit - Replaces execGitDefault for all git calls.
|
||||
* deps.isPidAlive - Function(pid:number):boolean (default: kill -0).
|
||||
* deps.readDirSafe - Function(dir:string):string[] (default: fs.readdirSync).
|
||||
* deps.readFileSafe - Function(file:string):string (default: fs.readFileSync).
|
||||
* deps.mtimeSafe - Function(file:string):Date (default: fs.statSync).
|
||||
* deps.reapMtimeGuardMs - Override stale-lock age threshold (default 5 min).
|
||||
* @returns {Array<{path:string, status:'reaped'|'skipped', reason:string}>}
|
||||
*/
|
||||
const REAP_MTIME_GUARD_MS = 5 * 60 * 1000; // 5 minutes
|
||||
|
||||
function reapOrphanWorktrees(repoRoot, deps = {}) {
|
||||
const execGit = deps.execGit || execGitDefault;
|
||||
const isPidAlive = deps.isPidAlive || defaultIsPidAlive;
|
||||
const readDirSafe = deps.readDirSafe || defaultReadDirSafe;
|
||||
const readFileSafe = deps.readFileSafe || defaultReadFileSafe;
|
||||
const mtimeSafe = deps.mtimeSafe || defaultMtimeSafe;
|
||||
const reapMtimeGuardMs = deps.reapMtimeGuardMs !== undefined ? deps.reapMtimeGuardMs : REAP_MTIME_GUARD_MS;
|
||||
|
||||
const results = [];
|
||||
|
||||
// 1. Discover the .git/worktrees/ admin directory.
|
||||
const gitDir = execGit(['rev-parse', '--git-dir'], { cwd: repoRoot });
|
||||
if (!gitResultOk(gitDir)) return results;
|
||||
const gitDirPath = path.resolve(repoRoot, gitDir.stdout.trim());
|
||||
|
||||
const worktreesAdminDir = path.join(gitDirPath, 'worktrees');
|
||||
const entries = readDirSafe(worktreesAdminDir);
|
||||
if (!entries) return results;
|
||||
|
||||
// 2. Discover the default branch (main/master/etc) tip.
|
||||
// Strategy (fail-closed):
|
||||
// a. Prefer refs/remotes/origin/HEAD — the authoritative integration branch.
|
||||
// b. Only fall back to 'main' / 'master' when origin/HEAD is absent AND the
|
||||
// remote itself doesn't exist (i.e. local-only test fixtures). In all other
|
||||
// cases, bail out rather than guess: using a wrong branch tip would allow
|
||||
// `merge-base --is-ancestor` to pass against a non-authoritative ref and
|
||||
// reap a worktree whose branch is NOT merged into the real default.
|
||||
//
|
||||
// Intentionally excludes 'HEAD': using HEAD when detached or on a feature
|
||||
// branch would make every branch appear "merged" into it, causing false reaping.
|
||||
const defaultBranchResult = execGit(
|
||||
['symbolic-ref', '--quiet', '--short', 'refs/remotes/origin/HEAD'],
|
||||
{ cwd: repoRoot }
|
||||
);
|
||||
|
||||
let mainTip;
|
||||
if (gitResultOk(defaultBranchResult)) {
|
||||
// Remote default branch is known — use it exclusively.
|
||||
const branchName = defaultBranchResult.stdout.trim().replace(/^origin\//, '');
|
||||
const r = execGit(['rev-parse', `refs/remotes/origin/${branchName}`], { cwd: repoRoot });
|
||||
if (!gitResultOk(r)) return results; // remote ref unresolvable — fail closed
|
||||
mainTip = r.stdout.trim();
|
||||
} else {
|
||||
// No remote configured (local-only repo, e.g. test fixtures).
|
||||
// Fall back to 'main' then 'master' — only safe because there is no remote
|
||||
// integration branch to confuse with. A remote that exists but lacks
|
||||
// origin/HEAD is treated as ambiguous and bails out (fail-closed).
|
||||
const hasRemote = execGit(['remote'], { cwd: repoRoot });
|
||||
if (gitResultOk(hasRemote) && hasRemote.stdout.trim()) {
|
||||
// Remote exists but origin/HEAD not set — ambiguous; fail closed.
|
||||
return results;
|
||||
}
|
||||
// Build candidate list: init.defaultBranch config, HEAD symref, then main, master.
|
||||
const candidateBranches = [];
|
||||
// Try git config init.defaultBranch first (user-configured default)
|
||||
const configResult = execGit(['config', '--get', 'init.defaultBranch'], { cwd: repoRoot });
|
||||
if (gitResultOk(configResult) && configResult.stdout.trim()) {
|
||||
candidateBranches.push(configResult.stdout.trim());
|
||||
}
|
||||
// Try HEAD symref (the branch the repo is currently on — valid for local repos
|
||||
// without detached HEAD; do not use when detached since it could be a feature branch)
|
||||
const headSymref = execGit(['symbolic-ref', '--quiet', '--short', 'HEAD'], { cwd: repoRoot });
|
||||
if (gitResultOk(headSymref) && headSymref.stdout.trim()) {
|
||||
const headBranch = headSymref.stdout.trim();
|
||||
if (!candidateBranches.includes(headBranch)) {
|
||||
candidateBranches.push(headBranch);
|
||||
}
|
||||
}
|
||||
// Always include main and master as universal fallbacks
|
||||
for (const b of ['main', 'master']) {
|
||||
if (!candidateBranches.includes(b)) candidateBranches.push(b);
|
||||
}
|
||||
for (const candidate of candidateBranches) {
|
||||
const r = execGit(['rev-parse', candidate], { cwd: repoRoot });
|
||||
if (gitResultOk(r)) {
|
||||
mainTip = r.stdout.trim();
|
||||
break;
|
||||
}
|
||||
}
|
||||
if (!mainTip) return results;
|
||||
}
|
||||
|
||||
// 3. Build a canonical-path → listed-path index from git worktree list.
|
||||
// git worktree list shows paths AS PROVIDED to git worktree add.
|
||||
// On macOS, os.tmpdir() may be /var/folders/... (symlink) while git writes
|
||||
// /private/var/folders/... (real path) in the gitdir file. We need the
|
||||
// LISTED path for git worktree unlock/remove to find the worktree.
|
||||
const listedResult = execGit(['worktree', 'list', '--porcelain'], { cwd: repoRoot });
|
||||
const canonicalToListed = new Map();
|
||||
if (gitResultOk(listedResult)) {
|
||||
// Normalize CRLF → LF before splitting: git on Windows may emit CRLF in
|
||||
// porcelain output, which would break block splitting on '\n\n'.
|
||||
const normalizedListed = listedResult.stdout.replace(/\r\n/g, '\n');
|
||||
for (const block of normalizedListed.split('\n\n').filter(Boolean)) {
|
||||
const wtLine = block.split('\n').find((l) => l.startsWith('worktree '));
|
||||
if (!wtLine) continue;
|
||||
const listed = wtLine.slice('worktree '.length).trim();
|
||||
try {
|
||||
const canonical = fs.realpathSync.native(listed);
|
||||
canonicalToListed.set(canonical, listed);
|
||||
} catch {
|
||||
// If the path doesn't exist (already removed), skip silently.
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// 4. Process each worktree admin entry that has a 'locked' file.
|
||||
for (const entryName of entries) {
|
||||
const adminDir = path.join(worktreesAdminDir, entryName);
|
||||
const lockedFile = path.join(adminDir, 'locked');
|
||||
const lockedContent = readFileSafe(lockedFile);
|
||||
if (lockedContent === null) continue; // no lock file — not our concern
|
||||
|
||||
// Resolve the actual worktree path from the gitdir pointer.
|
||||
// The gitdir file contains a path like "../../<name>/.git" relative to adminDir.
|
||||
// Strip the trailing .git segment (cross-platform: handle both / and \).
|
||||
const gitdirFile = path.join(adminDir, 'gitdir');
|
||||
const gitdirContent = readFileSafe(gitdirFile);
|
||||
if (!gitdirContent) continue;
|
||||
const resolvedGitFile = path.resolve(adminDir, gitdirContent.trim());
|
||||
const worktreePath = path.basename(resolvedGitFile) === '.git'
|
||||
? path.dirname(resolvedGitFile)
|
||||
: resolvedGitFile;
|
||||
|
||||
// Look up the git-list path (the path git knows about) for use in
|
||||
// git worktree unlock/remove commands. Falls back to worktreePath if
|
||||
// not found (e.g. already removed, or no symlink ambiguity).
|
||||
let gitKnownPath = worktreePath;
|
||||
try {
|
||||
const canonical = fs.realpathSync.native(worktreePath);
|
||||
gitKnownPath = canonicalToListed.get(canonical) || worktreePath;
|
||||
} catch {
|
||||
// worktreePath may not exist yet (already removed); use as-is.
|
||||
}
|
||||
|
||||
// 4a. Stale-lock guard: skip if lock is too fresh (PID recycling / race).
|
||||
const lockMtime = mtimeSafe(lockedFile);
|
||||
if (!lockMtime || Date.now() - lockMtime.getTime() < reapMtimeGuardMs) {
|
||||
results.push({ path: worktreePath, status: 'skipped', reason: 'lock_too_fresh' });
|
||||
continue;
|
||||
}
|
||||
|
||||
// 4b. PID liveness check.
|
||||
// Fail-closed: any lock content that does not parse as a numeric PID (e.g.
|
||||
// "Locked by claude-code agent-xxxx") is treated as ALIVE — we cannot
|
||||
// confirm the owner is dead, so we must not reap. This includes the real
|
||||
// Claude Code lock format which is non-numeric text.
|
||||
const pidStr = lockedContent.trim().match(/^\d+/)?.[0];
|
||||
if (!pidStr) {
|
||||
results.push({ path: worktreePath, status: 'skipped', reason: 'lock_owner_unknown' });
|
||||
continue;
|
||||
}
|
||||
const pid = parseInt(pidStr, 10);
|
||||
// Wrap isPidAlive in try/catch: any error (e.g. EPERM on Windows when the process
|
||||
// exists but is owned by another user) must be treated as ALIVE (fail-closed).
|
||||
let pidIsAlive;
|
||||
try {
|
||||
pidIsAlive = Number.isNaN(pid) || isPidAlive(pid);
|
||||
} catch {
|
||||
pidIsAlive = true; // Cannot determine liveness — treat as alive, do not reap.
|
||||
}
|
||||
if (pidIsAlive) {
|
||||
results.push({ path: worktreePath, status: 'skipped', reason: 'pid_alive' });
|
||||
continue;
|
||||
}
|
||||
|
||||
// 4c. Ancestry guard: branch-tip must be reachable from main (fail closed).
|
||||
// The admin HEAD file contains either "ref: refs/heads/<branch>" or a bare SHA.
|
||||
// We read the file directly (no non-standard git ref parsing).
|
||||
let branchTip;
|
||||
{
|
||||
const headContent = readFileSafe(path.join(adminDir, 'HEAD'));
|
||||
if (!headContent) {
|
||||
results.push({ path: worktreePath, status: 'skipped', reason: 'cannot_resolve_branch_tip' });
|
||||
continue;
|
||||
}
|
||||
const trimmed = headContent.trim();
|
||||
if (trimmed.startsWith('ref: refs/heads/')) {
|
||||
// Symbolic ref — resolve to commit SHA via git
|
||||
const branchName = trimmed.slice('ref: refs/heads/'.length);
|
||||
const resolveResult = execGit(['rev-parse', `refs/heads/${branchName}`], { cwd: repoRoot });
|
||||
if (!gitResultOk(resolveResult)) {
|
||||
results.push({ path: worktreePath, status: 'skipped', reason: 'cannot_resolve_branch_tip' });
|
||||
continue;
|
||||
}
|
||||
branchTip = resolveResult.stdout.trim();
|
||||
} else if (/^[0-9a-f]{40}$/i.test(trimmed)) {
|
||||
// Detached HEAD — bare SHA
|
||||
branchTip = trimmed;
|
||||
} else {
|
||||
results.push({ path: worktreePath, status: 'skipped', reason: 'cannot_resolve_branch_tip' });
|
||||
continue;
|
||||
}
|
||||
}
|
||||
|
||||
const ancestorCheck = execGit(
|
||||
['merge-base', '--is-ancestor', branchTip, mainTip],
|
||||
{ cwd: repoRoot }
|
||||
);
|
||||
if (!gitResultOk(ancestorCheck)) {
|
||||
results.push({ path: worktreePath, status: 'skipped', reason: 'branch_not_merged' });
|
||||
continue;
|
||||
}
|
||||
|
||||
// 4d. Reap: unlock → remove --force.
|
||||
// Use gitKnownPath (from git worktree list) so that git can locate the
|
||||
// worktree even when the path in the gitdir file differs due to symlinks
|
||||
// (e.g. macOS /var/folders vs /private/var/folders).
|
||||
execGit(['worktree', 'unlock', gitKnownPath], { cwd: repoRoot }); // ignore failure (already unlocked)
|
||||
const removeResult = execGit(['worktree', 'remove', gitKnownPath, '--force'], { cwd: repoRoot });
|
||||
if (!gitResultOk(removeResult)) {
|
||||
results.push({ path: worktreePath, status: 'skipped', reason: 'remove_failed' });
|
||||
continue;
|
||||
}
|
||||
|
||||
// Use the git-listed path so the result is consistent with what callers see
|
||||
// from 'git worktree list', avoiding symlink vs real-path mismatches on macOS.
|
||||
results.push({ path: gitKnownPath, status: 'reaped', reason: 'pid_dead_and_merged' });
|
||||
}
|
||||
|
||||
// 5. Always prune stale metadata (handles missing-on-disk entries).
|
||||
execGit(['worktree', 'prune'], { cwd: repoRoot });
|
||||
|
||||
return results;
|
||||
}
|
||||
|
||||
// ─── reapOrphanWorktrees deps helpers ─────────────────────────────────────────
|
||||
|
||||
function defaultIsPidAlive(pid) {
|
||||
// process.kill(pid, 0) probes process existence without sending a real signal.
|
||||
// - Returns normally → process is alive.
|
||||
// - Throws ESRCH → process does not exist → dead.
|
||||
// - Throws EPERM → process exists but we lack permission (alive; fail-closed
|
||||
// on Windows where cross-user processes throw EPERM, not ESRCH).
|
||||
try {
|
||||
process.kill(pid, 0);
|
||||
return true;
|
||||
} catch (err) {
|
||||
// EPERM means the process exists but we cannot signal it.
|
||||
// Treat as alive (fail-closed: do not reap a process we cannot confirm dead).
|
||||
if (err && err.code === 'EPERM') return true;
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
function defaultReadDirSafe(dir) {
|
||||
try { return fs.readdirSync(dir); } catch { return null; }
|
||||
}
|
||||
|
||||
function defaultReadFileSafe(file) {
|
||||
try { return fs.readFileSync(file, 'utf8'); } catch { return null; }
|
||||
}
|
||||
|
||||
function defaultMtimeSafe(file) {
|
||||
try { return fs.statSync(file).mtime; } catch { return null; }
|
||||
}
|
||||
|
||||
function cmdWorktreeReapOrphans(cwd) {
|
||||
let result;
|
||||
try {
|
||||
result = reapOrphanWorktrees(cwd);
|
||||
} catch (err) {
|
||||
// Surface failure as a one-line warning; keep exit-zero so workflows don't break.
|
||||
process.stderr.write(`[gsd] worktree.reap-orphans failed: ${err && err.message ? err.message : String(err)}\n`);
|
||||
result = [];
|
||||
}
|
||||
const skippedCount = result.filter((r) => r.status === 'skipped').length;
|
||||
if (skippedCount > 0) {
|
||||
// Surface skipped entries so operators are aware of unresolved orphans.
|
||||
process.stderr.write(`[gsd] worktree.reap-orphans: ${skippedCount} orphan(s) skipped (run with DEBUG=1 for details)\n`);
|
||||
}
|
||||
process.stdout.write(`${JSON.stringify({ ok: true, reaped: result.filter((r) => r.status === 'reaped').length, entries: result }, null, 2)}\n`);
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
resolveWorktreeContext,
|
||||
parseWorktreePorcelain,
|
||||
@@ -560,4 +865,6 @@ module.exports = {
|
||||
planWorktreeWaveCleanup,
|
||||
executeWorktreeWaveCleanupPlan,
|
||||
cmdWorktreeCleanupWave,
|
||||
reapOrphanWorktrees,
|
||||
cmdWorktreeReapOrphans,
|
||||
};
|
||||
|
||||
@@ -89,6 +89,8 @@ if [ "$RUNTIME" = "codex" ] && [ "$USE_WORKTREES" != "false" ]; then
|
||||
echo "FATAL: Codex execute-phase worktree isolation is unsupported. Set workflow.use_worktrees=false or use a runtime with Agent isolation=\"worktree\" support." >&2
|
||||
exit 1
|
||||
fi
|
||||
# Sweep orphaned locked worktrees from prior crashed sessions before spawning executors (#3707).
|
||||
[ "$USE_WORKTREES" != "false" ] && gsd-sdk query worktree.reap-orphans 2>/dev/null || true
|
||||
```
|
||||
Codex maps subagents to `spawn_agent`, which has no direct Codex mapping for Claude Code's `isolation="worktree"` parameter. Failing closed prevents main-checkout edits while the workflow believes agents are isolated.
|
||||
|
||||
|
||||
@@ -152,6 +152,14 @@ Parse JSON for: `planner_model`, `executor_model`, `checker_model`, `verifier_mo
|
||||
USE_WORKTREES=$(gsd-sdk query config-get workflow.use_worktrees 2>/dev/null || echo "true")
|
||||
```
|
||||
|
||||
If `USE_WORKTREES` is not `"false"`, run a startup orphan sweep before spawning any executors. This reaps locked worktrees whose lock-owner process is dead, whose branch is merged into the default branch, and whose lock file mtime is older than 5 minutes. Running it at startup prevents accumulation of orphaned worktrees from prior sessions that exited without cleanup (#3707).
|
||||
|
||||
```bash
|
||||
if [ "$USE_WORKTREES" != "false" ]; then
|
||||
gsd-sdk query worktree.reap-orphans 2>/dev/null || true
|
||||
fi
|
||||
```
|
||||
|
||||
If the project uses git submodules, worktree isolation is unsafe **only when the quick task touches a submodule path**. The previous behavior unconditionally disabled worktree isolation whenever `.gitmodules` existed, which penalised every quick task in a submodule project even when the task was nowhere near a submodule. Parse submodule paths from `.gitmodules` so the executor can act on actual submodule paths rather than the mere file's existence:
|
||||
|
||||
```bash
|
||||
|
||||
Reference in New Issue
Block a user