fix(runner): only fail a run on denied write tools with a worktree

2026-08-11 08:32:53 +02:00
parent 1acd4c1734
commit 11103d4d3e
2 changed files with 72 additions and 4 deletions
@@ -134,6 +134,60 @@ public sealed class PermissionDenialFailureTests : IDisposable
        }
    }

+    [Fact]
+    public async Task Success_withNonWriteDenial_andNoChanges_stillWaitsForReview()
+    {
+        if (!GitRepoFixture.IsGitAvailable()) { Assert.True(true, "git not available -- skipping"); return; }
+        var repo = new GitRepoFixture(); _repos.Add(repo);
+        var db = new DbFixture(); _dbs.Add(db);
+        var dbFactory = db.CreateFactory();
+        var tempDir = Path.Combine(Path.GetTempPath(), $"cd_permdenial_{Guid.NewGuid():N}");
+        Directory.CreateDirectory(tempDir);
+        var cfg = new WorkerConfig { SandboxRoot = tempDir, LogRoot = tempDir, WorktreeRootStrategy = "sibling" };
+
+        using (var ctx = db.CreateContext())
+        {
+            ctx.Lists.Add(new ListEntity { Id = "l1", Name = "L", WorkingDir = repo.RepoDir, CreatedAt = DateTime.UtcNow });
+            ctx.Tasks.Add(new TaskEntity
+            {
+                Id = "t1", ListId = "l1", Title = "Investigate something", CommitType = "chore",
+                Status = TaskStatus.Idle, CreatedAt = DateTime.UtcNow,
+            });
+            await ctx.SaveChangesAsync();
+        }
+
+        // A research task that legitimately changes nothing and had one non-write tool denied.
+        // "no commit + some denial" must NOT be read as "all edits were blocked".
+        var fake = new FakeClaudeProcess((_, _, _, _, _) => Task.FromResult(new RunResult
+        {
+            ExitCode = 0,
+            ResultMarkdown = "Investigated; no changes needed. One command was not permitted.",
+            PermissionDenials = new[] { "Bash" },
+        }));
+        var state = TaskStateServiceBuilder.Build(dbFactory).State;
+        var wt = new WorktreeManager(new GitService(), dbFactory, cfg, NullLogger<WorktreeManager>.Instance);
+        var runner = new TaskRunner(fake, dbFactory, new HubBroadcaster(new CapturingHubContext()), wt,
+            new ClaudeArgsBuilder(), cfg, NullLogger<TaskRunner>.Instance, state, new TaskRunTokenRegistry(),
+            new AttachmentStore(), new FakeSessionSkillSeeder(), new FakeTranscriptUsageReader());
+
+        try
+        {
+            using (var ctx = db.CreateContext())
+                await runner.RunAsync((await new TaskRepository(ctx).GetByIdAsync("t1"))!, "slot-1", CancellationToken.None);
+
+            using var verify = db.CreateContext();
+            var task = (await new TaskRepository(verify).GetByIdAsync("t1"))!;
+            Assert.Equal(TaskStatus.WaitingForReview, task.Status);
+        }
+        finally
+        {
+            using var ctx = db.CreateContext();
+            var wtRow = await new WorktreeRepository(ctx).GetByTaskIdAsync("t1");
+            if (wtRow is not null) _cleanups.Add((repo.RepoDir, wtRow.Path));
+            try { Directory.Delete(tempDir, true); } catch { }
+        }
+    }
+
    public void Dispose()
    {
        foreach (var (repoDir, wtPath) in _cleanups)