feat(undo): preserve operation records and add debug metadata

Stop deleting operation records after completion/undo/abort. Instead,
finalizeOperationRecord() marks them with completedAt, outcome, and
status: "completed". Records persist in .arbws/operation.json until
the next operation overwrites them, preserving diagnostic information.

Three additions:
- Finalize instead of delete: new completedAt timestamp and outcome
  field ("completed", "aborted", "undone", "force-cleared") on the
  operation record. Only --force still deletes (corrupt records).
- Capture git stderr on failure: truncated to 4000 chars in the
  per-repo errorOutput field for post-mortem debugging.
- GIT_REFLOG_ACTION: set during execution loops so git reflog entries
  are tagged with arb-rebase, arb-undo, etc.
- Include operation record in arb dump per-workspace output.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: henrikje

src/commands/branch-rename.ts

@@ -7,7 +7,7 @@ import {
   type RepoOperationState,
   arbAction,
   assertNoInProgressOperation,
-  deleteOperationRecord,
+  finalizeOperationRecord,
   readInProgressOperation,
   readWorkspaceConfig,
   writeOperationRecord,
@@ -320,7 +320,7 @@ async function runRename(
       branch: newBranch,
       ...(configBase && { base: configBase }),
     });
-    if (existingRecord) deleteOperationRecord(wsDir);
+    if (existingRecord) finalizeOperationRecord(wsDir, "completed");
     success(`Workspace branch set to '${newBranch}' (no repos to rename)`);
     info("Run 'arb attach' to attach repos on the new branch");
     return;
@@ -372,7 +372,7 @@ async function runRename(
     // If continuing and all repos are already renamed, finalize the operation
     if (existingRecord) {
       writeWorkspaceConfig(configFile, { branch: newBranch, ...(configBase && { base: configBase }) });
-      deleteOperationRecord(wsDir);
+      finalizeOperationRecord(wsDir, "completed");
       info("All repos already renamed");
     } else {
       info("Nothing to rename");
@@ -439,35 +439,42 @@ async function runRename(
   let renameOk = 0;
   const failures: string[] = [];
 
-  for (const a of willRename) {
-    inlineStart(a.repo, "renaming");
-    const result = await renameBranch(a.repoDir, oldBranch, newBranch);
-    if (result.exitCode === 0) {
-      // Clear stale tracking left by git branch -m.
-      // Without this, @{upstream} resolves to origin/<oldBranch> and
-      // arb push reports "up to date" instead of pushing the new name.
-      await gitLocal(a.repoDir, "config", "--unset", `branch.${newBranch}.remote`);
-      await gitLocal(a.repoDir, "config", "--unset", `branch.${newBranch}.merge`);
-
-      const postHeadResult = await gitLocal(a.repoDir, "rev-parse", "HEAD");
-      const existing = record.repos[a.repo];
-      if (existing) {
-        record.repos[a.repo] = { ...existing, status: "completed", postHead: postHeadResult.stdout.trim() };
-      }
-      writeOperationRecord(wsDir, record);
+  try {
+    process.env.GIT_REFLOG_ACTION = "arb-branch-rename";
+    for (const a of willRename) {
+      inlineStart(a.repo, "renaming");
+      const result = await renameBranch(a.repoDir, oldBranch, newBranch);
+      if (result.exitCode === 0) {
+        // Clear stale tracking left by git branch -m.
+        // Without this, @{upstream} resolves to origin/<oldBranch> and
+        // arb push reports "up to date" instead of pushing the new name.
+        await gitLocal(a.repoDir, "config", "--unset", `branch.${newBranch}.remote`);
+        await gitLocal(a.repoDir, "config", "--unset", `branch.${newBranch}.merge`);
+
+        const postHeadResult = await gitLocal(a.repoDir, "rev-parse", "HEAD");
+        const existing = record.repos[a.repo];
+        if (existing) {
+          record.repos[a.repo] = { ...existing, status: "completed", postHead: postHeadResult.stdout.trim() };
+        }
+        writeOperationRecord(wsDir, record);
+
+        inlineResult(a.repo, `local branch renamed to ${newBranch}`);
+        renameOk++;
+      } else {
+        const existing = record.repos[a.repo];
+        if (existing) {
+          const errorOutput = result.stderr.trim().slice(0, 4000) || undefined;
+          record.repos[a.repo] = { ...existing, status: "conflicting", errorOutput };
+        }
+        writeOperationRecord(wsDir, record);
 
-      inlineResult(a.repo, `local branch renamed to ${newBranch}`);
-      renameOk++;
-    } else {
-      const existing = record.repos[a.repo];
-      if (existing) {
-        record.repos[a.repo] = { ...existing, status: "conflicting" };
+        inlineResult(a.repo, red("failed"));
+        failures.push(a.repo);
       }
-      writeOperationRecord(wsDir, record);
-
-      inlineResult(a.repo, red("failed"));
-      failures.push(a.repo);
     }
+  } finally {
+    // biome-ignore lint/performance/noDelete: must truly unset env var, not coerce to string
+    delete process.env.GIT_REFLOG_ACTION;
   }
 
   if (failures.length > 0) {
@@ -489,6 +496,7 @@ async function runRename(
   // All local renames succeeded — apply deferred config and mark completed
   writeWorkspaceConfig(configFile, configAfter);
   record.status = "completed";
+  record.completedAt = new Date().toISOString();
   writeOperationRecord(wsDir, record);
 
   // Remote cleanup — only runs after all local renames succeed

src/commands/dump.ts

@@ -1,7 +1,7 @@
 import { readFileSync } from "node:fs";
 import { basename, join } from "node:path";
 import type { Command } from "commander";
-import { type CommandContext, arbAction, readWorkspaceConfig } from "../lib/core";
+import { type CommandContext, arbAction, readOperationRecord, readWorkspaceConfig } from "../lib/core";
 import { getRemoteNames, getRemoteUrl } from "../lib/git";
 import { AnalysisCache, computeFlags, gatherWorkspaceSummary } from "../lib/status";
 import { listRepos, listWorkspaces, readGitdirFromWorktree, workspaceRepoDirs } from "../lib/workspace";
@@ -204,7 +204,14 @@ async function runDump(ctx: CommandContext): Promise<void> {
         dumpErrors.push(`workspace ${ws} config: ${errMsg(err)}`);
       }
 
-      return { branch, base, repos };
+      let operation: object | null = null;
+      try {
+        operation = readOperationRecord(wsDir);
+      } catch (err) {
+        dumpErrors.push(`workspace ${ws} operation: ${errMsg(err)}`);
+      }
+
+      return { branch, base, repos, operation };
     }),
   );
 

src/commands/pull.ts

@@ -267,118 +267,125 @@ export async function runPull(
     }
     writeOperationRecord(wsDir, record);
   };
-  const markConflicting = (repo: string) => {
+  const markConflicting = (repo: string, stderr?: string) => {
     const existing = record.repos[repo];
     if (existing) {
-      record.repos[repo] = { ...existing, status: "conflicting" };
+      const errorOutput = stderr?.trim().slice(0, 4000) || undefined;
+      record.repos[repo] = { ...existing, status: "conflicting", errorOutput };
     }
     writeOperationRecord(wsDir, record);
   };
 
-  for (const a of willPull) {
-    const strategy = a.pullStrategy ?? (a.pullMode === "rebase" ? "rebase-pull" : "merge-pull");
-    inlineStart(a.repo, `pulling (${pullStrategyLabel(strategy)})`);
-    const pullRemote = remotesMap.get(a.repo)?.share;
-    if (!pullRemote) continue;
-
-    if (strategy === "rebase-pull") {
-      const pullArgs = a.needsStash
-        ? ["pull", "--rebase", "--autostash", pullRemote, a.branch]
-        : ["pull", "--rebase", pullRemote, a.branch];
-      const pullResult = await gitNetwork(a.repoDir, pullTimeout, pullArgs);
-      if (pullResult.exitCode === 0) {
-        await markCompleted(a.repo);
-        inlineResult(a.repo, `pulled ${plural(a.behind, "commit")} (${a.pullMode})`);
-        pullOk++;
-      } else {
-        if (isConflictResult(pullResult.stdout, pullResult.stderr)) {
-          markConflicting(a.repo);
-          inlineResult(a.repo, yellow("conflict"));
-          conflicted.push({ assessment: a, stdout: pullResult.stdout, stderr: pullResult.stderr });
+  try {
+    process.env.GIT_REFLOG_ACTION = "arb-pull";
+    for (const a of willPull) {
+      const strategy = a.pullStrategy ?? (a.pullMode === "rebase" ? "rebase-pull" : "merge-pull");
+      inlineStart(a.repo, `pulling (${pullStrategyLabel(strategy)})`);
+      const pullRemote = remotesMap.get(a.repo)?.share;
+      if (!pullRemote) continue;
+
+      if (strategy === "rebase-pull") {
+        const pullArgs = a.needsStash
+          ? ["pull", "--rebase", "--autostash", pullRemote, a.branch]
+          : ["pull", "--rebase", pullRemote, a.branch];
+        const pullResult = await gitNetwork(a.repoDir, pullTimeout, pullArgs);
+        if (pullResult.exitCode === 0) {
+          await markCompleted(a.repo);
+          inlineResult(a.repo, `pulled ${plural(a.behind, "commit")} (${a.pullMode})`);
+          pullOk++;
         } else {
-          inlineResult(a.repo, yellow("failed"));
-          failed.push({
-            assessment: a,
-            exitCode: pullResult.exitCode,
-            stdout: pullResult.stdout,
-            stderr: pullResult.stderr,
-            action: "pull --rebase",
-          });
-        }
-      }
-    } else if (strategy === "safe-reset" || strategy === "forced-reset") {
-      if (a.needsStash) {
-        await gitLocal(a.repoDir, "stash", "push", "-m", "arb: autostash before pull");
-      }
-      const target = a.safeReset?.target ?? `${pullRemote}/${a.branch}`;
-      const resetLabel = strategy === "forced-reset" ? "forced reset" : "safe reset";
-      const resetResult = await gitLocal(a.repoDir, "reset", "--hard", target);
-      if (resetResult.exitCode === 0) {
-        let stashPopOk = true;
-        if (a.needsStash) {
-          const popResult = await gitLocal(a.repoDir, "stash", "pop");
-          if (popResult.exitCode !== 0) {
-            stashPopOk = false;
-            stashPopFailed.push(a);
+          if (isConflictResult(pullResult.stdout, pullResult.stderr)) {
+            markConflicting(a.repo, pullResult.stderr);
+            inlineResult(a.repo, yellow("conflict"));
+            conflicted.push({ assessment: a, stdout: pullResult.stdout, stderr: pullResult.stderr });
+          } else {
+            inlineResult(a.repo, yellow("failed"));
+            failed.push({
+              assessment: a,
+              exitCode: pullResult.exitCode,
+              stdout: pullResult.stdout,
+              stderr: pullResult.stderr,
+              action: "pull --rebase",
+            });
           }
         }
-        await markCompleted(a.repo);
-        let doneMsg = `${resetLabel} to ${target}`;
-        if (!stashPopOk) {
-          doneMsg += ` ${yellow("(stash pop failed)")}`;
-        }
-        inlineResult(a.repo, doneMsg);
-        pullOk++;
-      } else {
-        markConflicting(a.repo);
-        inlineResult(a.repo, yellow("failed"));
-        failed.push({
-          assessment: a,
-          exitCode: resetResult.exitCode,
-          stdout: resetResult.stdout,
-          stderr: resetResult.stderr,
-          action: `reset --hard ${target}`,
-        });
-      }
-    } else {
-      if (a.needsStash) {
-        await gitLocal(a.repoDir, "stash", "push", "-m", "arb: autostash before pull");
-      }
-      const pullResult = await gitNetwork(a.repoDir, pullTimeout, ["pull", "--no-rebase", pullRemote, a.branch]);
-      if (pullResult.exitCode === 0) {
-        let stashPopOk = true;
+      } else if (strategy === "safe-reset" || strategy === "forced-reset") {
         if (a.needsStash) {
-          const popResult = await gitLocal(a.repoDir, "stash", "pop");
-          if (popResult.exitCode !== 0) {
-            stashPopOk = false;
-            stashPopFailed.push(a);
-          }
-        }
-        await markCompleted(a.repo);
-        let doneMsg = `pulled ${plural(a.behind, "commit")} (${a.pullMode})`;
-        if (!stashPopOk) {
-          doneMsg += ` ${yellow("(stash pop failed)")}`;
+          await gitLocal(a.repoDir, "stash", "push", "-m", "arb: autostash before pull");
         }
-        inlineResult(a.repo, doneMsg);
-        pullOk++;
-      } else {
-        if (isConflictResult(pullResult.stdout, pullResult.stderr)) {
-          markConflicting(a.repo);
-          inlineResult(a.repo, yellow("conflict"));
-          conflicted.push({ assessment: a, stdout: pullResult.stdout, stderr: pullResult.stderr });
+        const target = a.safeReset?.target ?? `${pullRemote}/${a.branch}`;
+        const resetLabel = strategy === "forced-reset" ? "forced reset" : "safe reset";
+        const resetResult = await gitLocal(a.repoDir, "reset", "--hard", target);
+        if (resetResult.exitCode === 0) {
+          let stashPopOk = true;
+          if (a.needsStash) {
+            const popResult = await gitLocal(a.repoDir, "stash", "pop");
+            if (popResult.exitCode !== 0) {
+              stashPopOk = false;
+              stashPopFailed.push(a);
+            }
+          }
+          await markCompleted(a.repo);
+          let doneMsg = `${resetLabel} to ${target}`;
+          if (!stashPopOk) {
+            doneMsg += ` ${yellow("(stash pop failed)")}`;
+          }
+          inlineResult(a.repo, doneMsg);
+          pullOk++;
         } else {
-          markConflicting(a.repo);
+          markConflicting(a.repo, resetResult.stderr);
           inlineResult(a.repo, yellow("failed"));
           failed.push({
             assessment: a,
-            exitCode: pullResult.exitCode,
-            stdout: pullResult.stdout,
-            stderr: pullResult.stderr,
-            action: "pull --no-rebase",
+            exitCode: resetResult.exitCode,
+            stdout: resetResult.stdout,
+            stderr: resetResult.stderr,
+            action: `reset --hard ${target}`,
           });
         }
+      } else {
+        if (a.needsStash) {
+          await gitLocal(a.repoDir, "stash", "push", "-m", "arb: autostash before pull");
+        }
+        const pullResult = await gitNetwork(a.repoDir, pullTimeout, ["pull", "--no-rebase", pullRemote, a.branch]);
+        if (pullResult.exitCode === 0) {
+          let stashPopOk = true;
+          if (a.needsStash) {
+            const popResult = await gitLocal(a.repoDir, "stash", "pop");
+            if (popResult.exitCode !== 0) {
+              stashPopOk = false;
+              stashPopFailed.push(a);
+            }
+          }
+          await markCompleted(a.repo);
+          let doneMsg = `pulled ${plural(a.behind, "commit")} (${a.pullMode})`;
+          if (!stashPopOk) {
+            doneMsg += ` ${yellow("(stash pop failed)")}`;
+          }
+          inlineResult(a.repo, doneMsg);
+          pullOk++;
+        } else {
+          if (isConflictResult(pullResult.stdout, pullResult.stderr)) {
+            markConflicting(a.repo, pullResult.stderr);
+            inlineResult(a.repo, yellow("conflict"));
+            conflicted.push({ assessment: a, stdout: pullResult.stdout, stderr: pullResult.stderr });
+          } else {
+            markConflicting(a.repo, pullResult.stderr);
+            inlineResult(a.repo, yellow("failed"));
+            failed.push({
+              assessment: a,
+              exitCode: pullResult.exitCode,
+              stdout: pullResult.stdout,
+              stderr: pullResult.stderr,
+              action: "pull --no-rebase",
+            });
+          }
+        }
       }
     }
+  } finally {
+    // biome-ignore lint/performance/noDelete: must truly unset env var, not coerce to string
+    delete process.env.GIT_REFLOG_ACTION;
   }
 
   // Consolidated conflict report
@@ -405,6 +412,7 @@ export async function runPull(
   // Finalize operation record
   if (conflicted.length === 0 && failed.length === 0) {
     record.status = "completed";
+    record.completedAt = new Date().toISOString();
     writeOperationRecord(wsDir, record);
   } else {
     info("Use 'arb pull --continue' to resume or 'arb pull --abort' to cancel");