refactor(server): share the no-git-repository checkout-root rewrap (#tech-debt)

[selfcontained]

What

apps/server/src/shared/git/worktree.ts and apps/server/src/shared/github/pr.ts each declared a file-private resolveRepoRoot(cwd, commandRunner). The two were identical 9-line wrappers: try { return await resolveCheckoutRoot(cwd, commandRunner) } catch { throw new <DomainError>("No git repository found for the provided working directory.", 404) }.

This PR adds one exported helper next to resolveCheckoutRoot in shared/git/git-context.ts:

resolveCheckoutRootOrThrow(cwd, commandRunner, ErrorClass)

It deletes both wrappers, plus resolveCurrentCheckoutRoot in worktree.ts. That function did nothing but call worktree.ts's resolveRepoRoot, so it only existed to forward to the deleted wrapper. All four call sites now call the helper directly:

call site	error class	status	message
createGitWorktree	GitWorktreeError	404	same string
cleanupGitWorktree	GitWorktreeError	404	same string
createPr	GitHubPrError	404	same string
getPrStatus	GitHubPrError	404	same string

What the included sites have in common: each one runs git -C <cwd> rev-parse --show-toplevel through the injected runner. Any failure is swallowed and replaced with a new domain error that has status 404 and the message above. The sites differ only in the error class. Both classes have the same (message: string, statusCode = 400) constructor, and shared/mcp/tool-error.ts and agents/manager.ts branch on the class with instanceof, so each call site passes its own class.

Why it's tech debt

• The same rewrap was copied in two files.
• Both copies were file-private functions named resolveRepoRoot that returned the checkout root. That name collides with the exported git-context.ts resolveRepoRoot, which returns the common repo root (via --git-common-dir, with a timeout and fallback). worktree.ts then aliased its copy under the accurate name resolveCurrentCheckoutRoot.
• After this PR, only the exported function is called resolveRepoRoot.

Deliberately left alone

• git-context.ts resolveRepoRoot (exported, about 8 importers): it is a different function, and renaming it has a much wider blast radius.
• worktree.ts resolveCommonRepoRoot: it looks like git-context.ts resolveRepoRoot, but it has no timeout and no fallback, and it throws GitWorktreeError(…, 500). Folding it in would change behavior.
• routes/personas.ts resolveOptionalRepoRoot / resolveOptionalWorktreeRoot: these swallow the failure to null instead of rethrowing, so they have a different result type.

Shape chosen

The helper takes the error constructor, so call sites stay one-liners and the 404 stays next to the message it belongs with. The alternative was an error factory ((message) => new GitHubPrError(message, 404)), which moves the status code to each caller at the cost of a lambda per site. I also considered keeping a thin file-private wrapper per file and rejected it: that would keep 2 wrappers for what is now a 4-line call.

Validation

• pnpm run check passes.
• Added tests for the no-repo path in test/git-worktree.test.ts (create and cleanup) and test/github-pr.test.ts (createPr and getPrStatus). Previously none of the four sites had an assertion on this path. Each test checks the error class, message and 404.
• Identity-preserving: the new tests pass against the original src files (HEAD's git-context/worktree/pr).
• Non-vacuous: 8 defect probes, each reverted afterward, all turned the tests red: 404→400, changed message, plain Error instead of ErrorClass, and swapping the class to Error at each of the 4 call sites one at a time.
• pnpm run test (server with Postgres env, web, browser-extension) and pnpm run test:e2e: all green — server 187 files passed / 1 skipped (3321 tests), web 130 files / 1924 tests, browser-extension 9 files / 60 tests; E2E 198 passed / 12 skipped (1.8m).

Next run

RunJobResult duplication between server and web: apps/server/src/jobs/service.ts:57 vs apps/web/src/hooks/use-jobs.ts:22.

🤖 Generated with Claude Code