fix: harden backend worktree removal

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: centdix

backend/src/__tests__/git-adapter.test.ts

@@ -6,6 +6,7 @@ import {
   BunGitGateway,
   parseGitWorktreePorcelain,
   readGitWorktreeStatus,
+  removeGitWorktree,
   resolveWorktreeGitDir,
   resolveWorktreeRoot,
 } from "../adapters/git";
@@ -259,3 +260,71 @@ describe("BunGitGateway", () => {
     expect(dirtyStatus.currentCommit).toBe(cleanStatus.currentCommit);
   });
 });
+
+describe("removeGitWorktree", () => {
+  it("cleans up the leftover directory when git already unregistered the worktree", () => {
+    const removedPaths: string[] = [];
+
+    removeGitWorktree(
+      {
+        repoRoot: "/repo",
+        worktreePath: "/repo/__worktrees/feature-a",
+        force: true,
+      },
+      {
+        tryRunGit: () => ({
+          ok: false,
+          stderr: "error: failed to delete '/repo/__worktrees/feature-a': Directory not empty",
+        }),
+        listWorktrees: () => [
+          {
+            path: "/repo",
+            head: "abc123",
+            branch: "main",
+            detached: false,
+            bare: false,
+          },
+        ],
+        removeDirectory: (path) => {
+          removedPaths.push(path);
+        },
+      },
+    );
+
+    expect(removedPaths).toEqual(["/repo/__worktrees/feature-a"]);
+  });
+
+  it("surfaces the git error when the worktree is still registered", () => {
+    expect(() => {
+      removeGitWorktree(
+        {
+          repoRoot: "/repo",
+          worktreePath: "/repo/__worktrees/feature-a",
+          force: true,
+        },
+        {
+          tryRunGit: () => ({
+            ok: false,
+            stderr: "error: failed to delete '/repo/__worktrees/feature-a': Directory not empty",
+          }),
+          listWorktrees: () => [
+            {
+              path: "/repo",
+              head: "abc123",
+              branch: "main",
+              detached: false,
+              bare: false,
+            },
+            {
+              path: "/repo/__worktrees/feature-a",
+              head: "def456",
+              branch: "feature-a",
+              detached: false,
+              bare: false,
+            },
+          ],
+        },
+      );
+    }).toThrow("git worktree remove --force /repo/__worktrees/feature-a failed");
+  });
+});

backend/src/adapters/git.ts

@@ -1,3 +1,4 @@
+import { rmSync } from "node:fs";
 import { resolve } from "node:path";
 
 export interface GitWorktreeEntry {
@@ -33,6 +34,16 @@ export interface GitWorktreeStatus {
   currentCommit: string | null;
 }
 
+export type TryGitCommandResult =
+  | { ok: true; stdout: string }
+  | { ok: false; stderr: string };
+
+export interface RemoveGitWorktreeDeps {
+  tryRunGit?: (args: string[], cwd: string) => TryGitCommandResult;
+  listWorktrees?: (cwd: string) => GitWorktreeEntry[];
+  removeDirectory?: (path: string) => void;
+}
+
 export interface GitGateway {
   resolveWorktreeRoot(cwd: string): string;
   resolveWorktreeGitDir(cwd: string): string;
@@ -60,7 +71,7 @@ function runGit(args: string[], cwd: string): string {
   return new TextDecoder().decode(result.stdout).trim();
 }
 
-function tryRunGit(args: string[], cwd: string): { ok: true; stdout: string } | { ok: false; stderr: string } {
+function tryRunGit(args: string[], cwd: string): TryGitCommandResult {
   const result = Bun.spawnSync(["git", ...args], {
     cwd,
     stdout: "pipe",
@@ -84,6 +95,18 @@ function errorMessage(error: unknown): string {
   return error instanceof Error ? error.message : String(error);
 }
 
+function isRegisteredWorktree(entries: GitWorktreeEntry[], worktreePath: string): boolean {
+  const resolvedPath = resolve(worktreePath);
+  return entries.some((entry) => resolve(entry.path) === resolvedPath);
+}
+
+function removeDirectory(path: string): void {
+  rmSync(path, {
+    recursive: true,
+    force: true,
+  });
+}
+
 function currentCheckoutRef(cwd: string): { ref: string; branch: string | null } {
   const symbolicRef = tryRunGit(["symbolic-ref", "--quiet", "--short", "HEAD"], cwd);
   if (symbolicRef.ok && symbolicRef.stdout.length > 0) {
@@ -180,6 +203,32 @@ export function readGitWorktreeStatus(cwd: string): GitWorktreeStatus {
   };
 }
 
+export function removeGitWorktree(
+  opts: RemoveGitWorktreeOptions,
+  deps: RemoveGitWorktreeDeps = {},
+): void {
+  const args = ["worktree", "remove"];
+  if (opts.force) args.push("--force");
+  args.push(opts.worktreePath);
+
+  const result = (deps.tryRunGit ?? tryRunGit)(args, opts.repoRoot);
+  if (result.ok) {
+    return;
+  }
+
+  const failure = `git ${args.join(" ")} failed: ${result.stderr || "exit 1"}`;
+  const remainingWorktrees = (deps.listWorktrees ?? listGitWorktrees)(opts.repoRoot);
+  if (isRegisteredWorktree(remainingWorktrees, opts.worktreePath)) {
+    throw new Error(failure);
+  }
+
+  try {
+    (deps.removeDirectory ?? removeDirectory)(opts.worktreePath);
+  } catch (error) {
+    throw new Error(`${failure}; cleanup failed: ${errorMessage(error)}`);
+  }
+}
+
 export class BunGitGateway implements GitGateway {
   resolveWorktreeRoot(cwd: string): string {
     return resolveWorktreeRoot(cwd);
@@ -204,10 +253,7 @@ export class BunGitGateway implements GitGateway {
   }
 
   removeWorktree(opts: RemoveGitWorktreeOptions): void {
-    const args = ["worktree", "remove"];
-    if (opts.force) args.push("--force");
-    args.push(opts.worktreePath);
-    runGit(args, opts.repoRoot);
+    removeGitWorktree(opts);
   }
 
   deleteBranch(repoRoot: string, branch: string, force = false): void {

backend/src/server.ts

@@ -57,6 +57,7 @@ const reconciliationService = new ReconciliationService({
   portProbe,
   runtime: projectRuntime,
 });
+const removingBranches = new Set<string>();
 const lifecycleService = new LifecycleService({
   projectRoot: PROJECT_DIR,
   controlBaseUrl: `http://127.0.0.1:${PORT}`,
@@ -184,10 +185,27 @@ function catching(label: string, fn: () => Promise<Response>): Promise<Response>
   });
 }
 
+function ensureBranchNotRemoving(branch: string): void {
+  if (removingBranches.has(branch)) {
+    throw new LifecycleError(`Worktree is being removed: ${branch}`, 409);
+  }
+}
+
+async function withRemovingBranch<T>(branch: string, fn: () => Promise<T>): Promise<T> {
+  ensureBranchNotRemoving(branch);
+  removingBranches.add(branch);
+  try {
+    return await fn();
+  } finally {
+    removingBranches.delete(branch);
+  }
+}
+
 async function resolveTerminalWorktree(branch: string): Promise<{
   worktreeId: string;
   attachTarget: TerminalAttachTarget;
 }> {
+  ensureBranchNotRemoving(branch);
   await reconciliationService.reconcile(PROJECT_DIR);
   const state = projectRuntime.getWorktreeByBranch(branch);
   if (!state) {
@@ -348,13 +366,16 @@ async function apiCreateWorktree(req: Request): Promise<Response> {
 }
 
 async function apiDeleteWorktree(name: string): Promise<Response> {
-  log.info(`[worktree:rm] name=${name}`);
-  await lifecycleService.removeWorktree(name);
-  log.debug(`[worktree:rm] done name=${name}`);
-  return jsonResponse({ ok: true });
+  return withRemovingBranch(name, async () => {
+    log.info(`[worktree:rm] name=${name}`);
+    await lifecycleService.removeWorktree(name);
+    log.debug(`[worktree:rm] done name=${name}`);
+    return jsonResponse({ ok: true });
+  });
 }
 
 async function apiOpenWorktree(name: string): Promise<Response> {
+  ensureBranchNotRemoving(name);
   log.info(`[worktree:open] name=${name}`);
   const result = await lifecycleService.openWorktree(name);
   log.debug(`[worktree:open] done name=${name} worktreeId=${result.worktreeId}`);