[funkyshu]

Summary

• An external kill of the prenup process (a CI/editor timeout, a git GUI's "cancel" button, etc.) previously terminated the process via the OS default signal action, skipping every deferred cleanup in runRun/runner.Run — including endStash's git stash pop that restores the clean_worktree stash created by beginStash. That left an orphaned stash the user would only discover later as a confusing conflict.
• Wire SIGINT/SIGTERM to context cancellation via signal.NotifyContext instead. BashExecutor.Run already reacts to context cancellation by sending the in-flight task SIGTERM (falling back to SIGKILL after the configured grace period), so canceling the top-level context now gives runner.Run a chance to return normally and run its deferred stash pop before the process exits. A second SIGINT/SIGTERM still forces immediate termination, per signal.NotifyContext's documented behavior.

Fixes #2.

Test plan

• go build ./...
• go test ./...
• golangci-lint run --max-same-issues 0 ./...
• New unit tests (TestNewRunContext_CanceledOnSIGTERM, TestNewRunContext_CanceledOnSIGINT) send a real signal to the test process and assert the returned context is canceled.
• Ran prenup run (self-hosted) locally to validate the changelog entry and full task suite pass.

Made with Cursor

[funkyshu]

Addressed the code-review findings from the earlier round:

• runner.Run now checks ctx.Err() between tasks and stops attempting anything that hasn't started once the context is canceled, instead of letting every remaining task fail near-instantly with a generic context canceled error. Added Result.Interrupted so callers can tell "cut short by cancellation" apart from "every attempted task genuinely failed"; the run still exits non-zero either way.
• Added an end-to-end regression test (TestContextCancellationSkipsRemainingTasksAndPopsStash) that exercises the actual bug from Autostash safety net isn't signal-safe outside the interactive TUI #2 directly: a real git repo with an unstaged edit, clean_worktree enabled, and a fake Executor that cancels the context mid-run. It asserts the not-yet-started task is never invoked and that the autostash is popped and the unstaged edit is restored once Run returns — the previous unit tests only covered newRunContext's signal-to-cancellation plumbing, not the stash-pop behavior itself.
• Documented the Windows/SIGTERM caveat inline (synthetic value there; os.Interrupt is the one signal os/signal guarantees everywhere) so it doesn't look like an oversight later.

Left as-is (noted but out of scope for this PR): Ctrl-C during the interactive human/TUI selector is handled by Bubble Tea's raw-mode keystroke capture, not OS signal delivery, so this change mainly benefits non-interactive runs (CI/editor-triggered SIGTERM, or Ctrl-C when no TUI has claimed the terminal) — which is the scenario that actually caused the original orphaned-stash report.

[Copilot]

Pull request overview

This PR makes prenup run handle external SIGINT/SIGTERM gracefully by canceling the run context (instead of letting the OS terminate the process), allowing deferred cleanup in runner.Run—notably the clean_worktree stash pop—to reliably execute and avoid orphaned stashes.

Changes:

• Wire SIGINT/SIGTERM into a cancelable run context via signal.NotifyContext in the CLI entrypoint.
• Update runner.Run to stop starting new tasks after cancellation and report remaining tasks as “run interrupted” skips (plus a new Result.Interrupted flag).
• Add unit tests covering signal-driven context cancellation and stash restoration on cancellation, and document the change in CHANGELOG.md.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
internal/cli/run.go	Creates a signal-cancelable context for prenup run via newRunContext().
internal/cli/run_internal_test.go	Adds tests asserting newRunContext() is canceled by SIGTERM/SIGINT.
internal/runner/runner.go	Adds Result.Interrupted and skips not-yet-started tasks when the run context is canceled.
internal/runner/runner_test.go	Adds a regression test ensuring cancellation skips remaining tasks and still pops the autostash.
CHANGELOG.md	Documents the SIGINT/SIGTERM cancellation behavior and improved interruption reporting.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[funkyshu]

Addressed both Copilot review comments (commit 1495640):

• internal/runner/runner.go: corrected the doc comment — the in-flight task at cancellation time isn't guaranteed to fail; it observes ctx via its own exec.CommandContext call and can still finish successfully if the task completes right as the signal arrives (exactly what the regression test does). Only not-yet-started tasks are unconditionally skipped by the loop.
• internal/cli/run.go: dropped the Windows/SIGTERM tangent from newRunContext's comment, since the README already states Windows is explicitly out of scope for prenup — that caveat was irrelevant noise here.

All CI checks are green.