fix: haiku_repair stale-ref loop and hardcoded mainline branch (#225)

* fix: haiku_repair stale-ref loop and hardcoded mainline branch

Repair was creating worktrees from stale local refs, reapplying fixes
already on the remote, failing to push non-fast-forward, and reporting
the same issues forever. It also blew up on repos where the remote
default branch isn't main/master.

- Fetch origin upfront in repairAllBranches so origin/HEAD and every
  temp worktree reflect current remote state
- addTempWorktree gains preferRemote flag; repair call sites use
  origin/<branch> so scans see remote truth, not stale local tips
- commitAndPushFromWorktree rebases onto origin/<branch> and retries
  once on non-fast-forward; aborts rebase cleanly on conflict
- getMainlineBranch resolves origin/HEAD via git symbolic-ref first,
  so repos with dev/trunk/etc. as default work correctly
- haiku_review diff base falls back to getMainlineBranch() instead of
  hardcoded "main"

Fixes #206

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: tighten NFF regex and biome format

Review feedback on #225:
- Drop bare "rejected" from non-fast-forward detection so we don't
  rebase on protected-branch rejections or hook failures that also
  print "rejected"
- Biome format fix for the rebase execFileSync call

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: jwaldrip

packages/haiku/src/git-worktree.ts

@@ -37,9 +37,25 @@ export function branchExists(branch: string): boolean {
 	return tryRun(["git", "rev-parse", "--verify", branch]) !== ""
 }
 
-/** Detect the mainline branch (main, master, or git config init.defaultBranch). */
+/** Detect the mainline branch.
+ *  Order of resolution:
+ *    1. `origin/HEAD` symbolic ref — the remote's actual default branch (handles `dev`, `trunk`, etc.)
+ *    2. `main`, `master` as local or remote refs
+ *    3. `git config init.defaultBranch`
+ *    4. `"main"` as a last-resort string (also used in non-git environments).
+ */
 export function getMainlineBranch(): string {
 	if (!isGitRepo()) return "main"
+	const originHead = tryRun([
+		"git",
+		"symbolic-ref",
+		"--short",
+		"refs/remotes/origin/HEAD",
+	])
+	if (originHead) {
+		const m = originHead.match(/^origin\/(.+)$/)
+		if (m) return m[1]
+	}
 	for (const candidate of ["main", "master"]) {
 		if (tryRun(["git", "rev-parse", "--verify", candidate])) return candidate
 		if (tryRun(["git", "rev-parse", "--verify", `origin/${candidate}`]))
@@ -49,6 +65,18 @@ export function getMainlineBranch(): string {
 	return configured || "main"
 }
 
+/** Fetch from origin so subsequent ref lookups and worktree creations see the
+ *  current remote state. Non-fatal — returns false on failure (offline, no remote). */
+export function fetchOrigin(): boolean {
+	if (!isGitRepo()) return false
+	try {
+		execFileSync("git", ["fetch", "--prune", "origin"], { stdio: "pipe" })
+		return true
+	} catch {
+		return false
+	}
+}
+
 /** List all H·AI·K·U intent branches (`haiku/<slug>/main`) — local + remote, deduped.
  *  Returns intent slugs in stable sort order. */
 export function listIntentBranches(): string[] {
@@ -188,19 +216,28 @@ export function isBranchMerged(branch: string, mainline: string): boolean {
 	return false
 }
 
-/** Add a temporary worktree for an existing branch. Returns the worktree path. */
+/** Add a temporary worktree for an existing branch. Returns the worktree path.
+ *  When `preferRemote` is true, resolves to `origin/<branch>` first so the
+ *  worktree reflects the current remote state rather than a stale local ref. */
 export function addTempWorktree(
 	branch: string,
 	label = "haiku-repair",
+	preferRemote = false,
 ): string {
 	if (!isGitRepo()) throw new Error("not a git repo")
 	const path = join(
 		"/tmp",
 		`${label}-${Date.now()}-${Math.floor(Math.random() * 1e6)}`,
 	)
-	// Prefer the local branch if it exists, fall back to origin
-	const localExists = tryRun(["git", "rev-parse", "--verify", branch])
-	const ref = localExists ? branch : `origin/${branch}`
+	const localRef = tryRun(["git", "rev-parse", "--verify", branch])
+	const remoteRef = tryRun(["git", "rev-parse", "--verify", `origin/${branch}`])
+	let ref: string
+	if (preferRemote) {
+		ref = remoteRef ? `origin/${branch}` : localRef ? branch : ""
+	} else {
+		ref = localRef ? branch : remoteRef ? `origin/${branch}` : ""
+	}
+	if (!ref) throw new Error(`branch '${branch}' not found locally or on origin`)
 	run(["git", "worktree", "add", "--detach", path, ref])
 	return path
 }
@@ -242,20 +279,57 @@ export function commitAndPushFromWorktree(
 			pushError: err instanceof Error ? err.message : String(err),
 		}
 	}
-	try {
-		execFileSync(
-			"git",
-			["-C", worktreePath, "push", "origin", `HEAD:refs/heads/${branch}`],
-			{ stdio: "pipe" },
-		)
-		return { committed: true, pushed: true }
-	} catch (err) {
-		return {
-			committed: true,
-			pushed: false,
-			pushError: err instanceof Error ? err.message : String(err),
+	const tryPush = (): { ok: boolean; error?: string } => {
+		try {
+			execFileSync(
+				"git",
+				["-C", worktreePath, "push", "origin", `HEAD:refs/heads/${branch}`],
+				{ stdio: "pipe" },
+			)
+			return { ok: true }
+		} catch (err) {
+			return {
+				ok: false,
+				error: err instanceof Error ? err.message : String(err),
+			}
+		}
+	}
+
+	const first = tryPush()
+	if (first.ok) return { committed: true, pushed: true }
+
+	// Non-fast-forward recovery: fetch + rebase onto origin/<branch>, retry push.
+	// Without this, a stale-ref repair run loops forever — each run re-applies
+	// fixes, push rejects as non-fast-forward, and the worktree's stale view of
+	// the repo keeps reporting issues that are already fixed on the remote. (#206)
+	//
+	// Matching is intentionally narrow: we only recover from genuine NFF errors.
+	// A bare "rejected" would also match protected-branch rejections, pre-receive
+	// hook failures, and permission errors — rebasing on those would be wrong.
+	const isNonFastForward =
+		/non-fast-forward|fetch first|behind the remote/i.test(first.error ?? "")
+	if (isNonFastForward) {
+		tryRun(["git", "-C", worktreePath, "fetch", "origin", branch])
+		try {
+			execFileSync("git", ["-C", worktreePath, "rebase", `origin/${branch}`], {
+				stdio: "pipe",
+			})
+		} catch (err) {
+			tryRun(["git", "-C", worktreePath, "rebase", "--abort"])
+			return {
+				committed: true,
+				pushed: false,
+				pushError: `non-fast-forward; rebase onto origin/${branch} failed: ${
+					err instanceof Error ? err.message : String(err)
+				}`,
+			}
 		}
+		const retry = tryPush()
+		if (retry.ok) return { committed: true, pushed: true }
+		return { committed: true, pushed: false, pushError: retry.error }
 	}
+
+	return { committed: true, pushed: false, pushError: first.error }
 }
 
 /** Detect a PR/MR creation tool (`gh` or `glab`) on PATH. */

packages/haiku/src/state-tools.ts

@@ -20,6 +20,7 @@ import {
 	addTempWorktree,
 	commitAndPushFromWorktree,
 	consolidateStageBranches,
+	fetchOrigin,
 	getCurrentBranch,
 	getMainlineBranch,
 	isBranchMerged,
@@ -1109,6 +1110,12 @@ function repairAllBranches(autoApply: boolean): {
 	mainline: string
 	archivedSummary?: BranchRepairSummary
 } {
+	// Fetch upfront so getMainlineBranch() sees current origin/HEAD and every
+	// worktree created below reflects the latest remote state. Without this,
+	// a stale local ref could cause the repair tool to "fix" issues that were
+	// already fixed on the remote by a previous run, then fail to push with
+	// non-fast-forward, and loop forever. (#206)
+	fetchOrigin()
 	const mainline = getMainlineBranch()
 	const summaries: BranchRepairSummary[] = []
 
@@ -1202,7 +1209,7 @@ function repairAllBranches(autoApply: boolean): {
 			merged: false,
 		}
 		try {
-			worktreePath = addTempWorktree(branch, "haiku-repair")
+			worktreePath = addTempWorktree(branch, "haiku-repair", true)
 		} catch (err) {
 			summary.error = `Failed to create worktree: ${err instanceof Error ? err.message : String(err)}`
 			summaries.push(summary)
@@ -1312,7 +1319,7 @@ function repairArchivedOnMainline(
 
 	let worktreePath = ""
 	try {
-		worktreePath = addTempWorktree(mainline, "haiku-repair-archived")
+		worktreePath = addTempWorktree(mainline, "haiku-repair-archived", true)
 	} catch (err) {
 		// Worktree setup failed — surface a dedicated failure shape so the report
 		// labels this as "Mainline worktree setup failed" rather than "0 archived
@@ -3193,8 +3200,9 @@ export function handleStateTool(
 
 		// ── Review ──
 		case "haiku_review": {
-			// Determine diff base
-			let base = "main"
+			// Determine diff base — prefer the tracked upstream, fall back to the
+			// detected mainline (origin/HEAD-aware), then to a last-resort "main".
+			let base = getMainlineBranch()
 			try {
 				const upstream = spawnSync(
 					"git",
@@ -3205,7 +3213,7 @@ export function handleStateTool(
 					base = upstream.stdout.trim()
 				}
 			} catch {
-				/* fallback to main */
+				/* fallback to detected mainline */
 			}
 
 			// Get diff, stat, and changed files