Repository navigation
Conversation
Record a durable SQLite lease identity on create and release it without deleting the row on remove, so the same owner/repo/job/branch can be reattached at the original start commit. Foreign, moved, concurrently checked-out, and otherwise unproven branches stay fail-closed with residual evidence and no automatic rollback. Closes #141 Refs #124 Co-authored-by: Raul Cardenas Montoya <montoyaraul34@gmail.com>
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 33 minutes. View limit detailsLimit details: You’ve used the included review currently available. Review configuration: ⚙️ Run configuration
📒 Files selected for processing (4)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![codescene-access[bot]](https://avatars.githubusercontent.com/in/3755875?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
![amazon-q-developer[bot]](https://avatars.githubusercontent.com/in/1220912?s=60&v=4){kind=small}
There was a problem hiding this comment.
This PR implements verified worktree reclaim with comprehensive ownership checks and durable lease tracking. The implementation is well-designed with strong security guarantees:
Key Strengths:
- SQLite-backed lease store provides durable ownership identity across create/remove/reclaim cycles
- Multi-layered ownership verification (lease identity, branch commit, worktree registration, upstream checks)
- Fail-closed policy rejects unproven branches (foreign jobs, moved commits, concurrent checkouts)
- Extensive test coverage validates the happy path and all rejection scenarios
- Sandbox protections prevent symlink escapes and path traversal
Implementation Quality:
- Proper separation of concerns between
LeaseStore(persistence) andWorktreeManager(orchestration) - Clear enum-based state machine (
CreateMode::Fresh/Reclaim/AlreadyPresent) - Comprehensive error reporting with residual state inspection
- No automatic cleanup of ambiguous state (correct fail-safe behavior)
The code correctly implements the load-bearing #141 requirement for Claude Code WorktreeCreate to reuse verified worktrees without aborting session setup. No blocking issues found.
You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.
Up to standards ✅🟢 Issues
|
| Metric | Results |
|---|---|
| Complexity | 4 |
| Duplication | 4 |
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
Reject nested tracking refs such as origin/evil/{branch}, report residual
identity on unexpected-upstream failures, and set a SQLite busy timeout
plus WAL so concurrent reclaim does not fail open or abort without evidence.
Refs #141
Co-authored-by: Raul Cardenas Montoya <montoyaraul34@gmail.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
🤖 CodeAnt AI — Review Status
|
Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
codeant-ai
Bot
added
the
size:XXL
![codeant-ai[bot]](https://avatars.githubusercontent.com/in/646884?s=60&v=4){kind=small}
CodeAnt Nitpicks2 code suggestions1. Opening a bare filename attempts to create directory
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: fbf8c5b42b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…ove path Unrecognized/corrupted lease modes now surface as Error::LeaseStore instead of decaying to a reclaimable Unassigned lease: LeaseMode::parse returns Result and lease_from_row maps the failure to a rusqlite conversion error so the existing query_lease wrapping converts it. WorktreeManager::remove canonicalizes the incoming path up front (nearest existing ancestor for gone leaves) and enforces sandbox containment before any lease release, including the non-existent-path fast path. The lease release, git remove arg, and parent cleanup all use the canonical spelling grant stored, and stale git worktree registrations for in-sandbox gone worktrees are pruned before release so a later reclaim is not blocked.
…ease store resume_upstream_mismatch now checks the upstream COMMIT relationship after the ref-name check: reclaim is rejected when the published branch is behind or divergent from its configured upstream and allowed only when equal or strictly ahead by job-owned commits (AGENTS.md). It compares against the local remote-tracking state via git merge-base --is-ancestor and never fetches inside core, so tests use local repos. create_with_request grants the Fresh-create lease only after git worktree add -b wins the ref, so a job that loses the race (or whose add fails) leaves no ownership-proving lease. Reclaim/AlreadyPresent still grant before mutation since they require an already-proven lease. WorktreeManager opens the writable SQLite lease store lazily via a new leases() accessor, so worktree list and prune no longer require (or create) a writable lease store. lease_store() now returns Result. prove_resume is unchanged; its CodeScene complexity is an accepted code-health biomarker rather than a behavior bug. Adds tests for behind/divergent/ahead/equal upstream reclaim, the race-loser and failed-fresh no-lease invariants, and list/prune not creating leases.db.
|
🤖 Review skipped: Repository Owner rate limit exceeded. Free accounts are limited to 3 reviews per 4 hours across all repositories. Upgrade to a paid plan for unlimited reviews. |
Bot comments addressedchatgpt-codex-connector (6 inline) — all FIXED
codeant-ai
codescene-access (2 biomarkers)
Not actioned (correct)
Verification (Linux)
|
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d7bbfe81e7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Resolve conflicts by keeping Phase 1 hook/install modules and PR-import worktree paths from main while preserving #141 reclaim diagnostics, lease-store hardening (WAL, busy timeout, fail-closed mode parse), isolated lease path beside custom worktree bases, and combined CLI/integration tests. Co-authored-by: Raul Cardenas Montoya <montoyaraul34@gmail.com>
codeant-ai
Bot
added
size:L
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
Integrate RM-1725 README/AGENTS collaboration-first docs and owner allowlist CLI tests with #141 reclaim coverage. worktree.rs and lease.rs auto-merged cleanly. Co-authored-by: Raul Cardenas Montoya <montoyaraul34@gmail.com>
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
Amp-Thread-ID: https://ampcode.com/threads/T-01a1014a-4857-70cd-9baf-7f02a1acdd6a Co-authored-by: Raul Cardenas Montoya <montoyaraul34@gmail.com>
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c504062e8e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Amp-Thread-ID: https://ampcode.com/threads/T-01a1014a-4857-70cd-9baf-7f02a1acdd6a Co-authored-by: Raul Cardenas Montoya <montoyaraul34@gmail.com>
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
Co-authored-by: Raul Cardenas Montoya <montoyaraul34@gmail.com> Amp-Thread-ID: https://ampcode.com/threads/T-01a1014a-4857-70cd-9baf-7f02a1acdd6a
There was a problem hiding this comment.
Gates Failed
(1 hotspot with Lines of Code in a Single File, Low Cohesion, Complex Method, Complex Conditional, Large Method)
(1 file with Low Cohesion)
(1 file with Lines of Code in a Single File, Complex Method, Complex Conditional, Large Method)
Our agent can fix these. Install it.
Gates Passed
Reason for failure
| Prevent hotspot decline | Violations | Code Health Impact | |
|---|---|---|---|
| worktree.rs | 5 rules in this hotspot | 9.69 → 6.93 | Suppress |
| Enforce critical code health rules | Violations | Code Health Impact | |
|---|---|---|---|
| worktree.rs | 1 critical rule | 9.69 → 6.93 | Suppress |
| Enforce advisory code health rules | Violations | Code Health Impact | |
|---|---|---|---|
| worktree.rs | 4 advisory rules | 9.69 → 6.93 | Suppress |
Quality Gate Profile: Pay Down Tech Debt
Install CodeScene MCP: safeguard and uplift AI-generated code. Catch issues early with our IDE extension and CLI tool.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 38b8bb8f64
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| add_worktree(&request, &worktree_path, CommitId(&start_commit), false)?; | ||
| leases.grant(grant)?; |
There was a problem hiding this comment.
If git worktree add -b succeeds but the following SQLite grant fails—for example because a concurrent registration wins the lease, the busy timeout expires, or storage errors—the command returns an error after leaving a live worktree and branch with no durable ownership row. A retry then rejects that branch because prove_resume cannot find lease evidence, while status also cannot report its writer; use an exclusive provisional grant or otherwise reconcile a failed post-add grant without leaving untracked ownership.
AGENTS.md reference: AGENTS.md:L138-L141
Useful? React with 👍 / 👎.
| Command::new(env!("CARGO_BIN_EXE_writ")) | ||
| .env("WRIT_WORKTREE_BASE", root.join("worktrees")) | ||
| .args(["--json", "worktree", "remove", path.to_str().unwrap()]) |
There was a problem hiding this comment.
writ_create sets WRIT_LEASE_PATH to <root>/leases.db, but this helper sets only the worktree base; now that the default lease path is explicitly independent of WRIT_WORKTREE_BASE, the remove subprocess opens a different database. Consequently the reclaim test passes while the original row remains WRITER_LOCKED—reclaim accepts that mode—so it does not test the intended release transition and may also create or touch the developer's default state database.
AGENTS.md reference: AGENTS.md:L138-L140
Useful? React with 👍 / 👎.
| fn lease_repo_matches(lease: &Lease, repo_root: &Path) -> bool { | ||
| canonicalize_for_tools(Path::new(&lease.repo)) | ||
| .ok() | ||
| .zip(canonicalize_for_tools(repo_root).ok()) | ||
| .is_some_and(|(stored, requested)| stored == requested) |
There was a problem hiding this comment.
The new comparison treats the canonical working-tree root as the repository identity, but CheckoutRegistry::register stores the canonical --git-common-dir in the same lease.repo field. Thus a lease written by the canonical register/hook path never matches a managed-create request for that same repository (/repo/.git versus /repo): same-job reclaim is rejected, while an absent branch owned by a registered foreign job can be misclassified as fresh. Store and compare the Git common directory consistently across both lease writers.
AGENTS.md reference: AGENTS.md:L138-L140
Useful? React with 👍 / 👎.
4 participants
User description
Summary
Merged latest
origin/main(b490786) into the RM-831 / #141 reclaim branch.Conflict classification
AGENTS.mdcreate/removestill carry #141 lease identity for reclaim.README.mdcrates/writ/tests/worktree_cli.rsWRIT_ALLOWED_OWNERS/--allowed-ownerstests.crates/writ-core/src/worktree.rs,lease.rs, …Complicating factors (intent, not merge markers)
These landed on
mainwhile this PR still extends deprecated managed lifecycle — product tension to track, not unresolved git conflicts:worktree registerare canonical;create/remove/pruneare deprecated. This PR still hardens reclaim on the deprecated path (needed until callers migrate).git mergeof peer work into an assigned branch is now allowed in policy; orthogonal to reclaim but changes the safety story in docs.worktree.rsalongside reclaim logic (auto-merge succeeded; behavior should stay covered by existing + porcelain tests).add -b, stricter upstream ancestry, canonical remove paths.Verification
cargo fmt --allcargo clippy --workspace --all-targets -- -D warningscargo test --workspace— 257 passedLinear Issue: RM-831
Summary by cubic
Makes the create → remove → reclaim cycle durable so hooks can reattach a verified worktree instead of aborting session setup (RM-831).
worktree createrecords a SQLite lease identity;worktree removereleases the lease without deleting the row, and a later create for the same owner/repo/job/branch succeeds only when the lease and live Git checks still prove ownership. Both the worktree base and lease store paths are canonicalized so reclaim identity never crosses sandboxes.Fail-closed guarantees
WORKTREE_RESUME_UNPROVENand reportbranch_refandownership_evidence.git worktree add -bwins the ref.release_if_currentonly releases the exact lease generation observed so a refreshed or regranted lease stays untouched.listandprunenever create it; commit equality alone is never ownership proof, and residual Git state is left with no automatic rollback.Written for commit 38b8bb8. Summary will update on new commits.
CodeAnt-AI Description
Safely reclaim previously released worktrees and isolate lease records
What Changed
Impact
✅ Reliable owned-branch reclaim✅ No destructive cleanup of foreign branches✅ Isolated test and operator worktree state💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.