fix(apply): propagate read errors, auto-open repo, dedupe adapter base (#6)

Three robustness fixes for the apply pipeline:

1. Silent read errors on state/target files treated 'file absent' as
   'file empty' and fast-forward-overwrote user edits. Add
   common.ReadExistingFile that returns (nil,nil) only on
   os.IsNotExist; other I/O errors propagate. Use it from apply.Run
   and from every adapter's Render (claudecode, crush, kilo,
   opencode, goose, zed).

2. apply.Run required callers to pre-construct *gitx.Repo; passing
   nil silently skipped the commit. Run now auto-opens a repo from
   Bundle.Root, gracefully no-ops when the root is not a git repo,
   and uses a new gitx.HasStagedChanges() check to skip the no-op
   'nothing to commit' that triggered the original silent-skip.

3. Each of 7 adapter packages re-implemented the same 25-line
   Option/WithHome/New constructor. Hoist into adapter.Base +
   adapter.BaseOption + NewBase. Each adapter embeds *Base and
   reduces to a 9-line constructor. Public New(WithHome(h)) API
   preserved; a.home becomes a.Home.

Tests:
  - apply: 5 new (propagates-read-error, auto-opens-repo,
    no-repo-skips-commit, skips-no-op-commit, commit-message-counts)
  - gitx: 2 new (HasStagedChanges empty/after-add)
  - adapter/common: 3 new (ReadExistingFile missing/content/perm)
  - adapter: 4 new (NewBase default/WithHome/order/typed)
  - existing adapter tests unchanged — verify a.Home still honoured.

internal/adapter/base.go

@@ -0,0 +1,29 @@
+package adapter
+
+import "github.com/lukaszraczylo/harness-sync/internal/adapter/common"
+
+// Base holds the cross-adapter defaults (currently just the home directory
+// used to compute target paths). Embed it in each adapter struct to inherit
+// the WithHome/New constructor pattern without re-implementing it.
+type Base struct {
+	Home string
+}
+
+// BaseOption configures a Base. Returned by WithHome and consumed by NewBase.
+type BaseOption func(*Base)
+
+// WithHome overrides the home directory used for target paths. Defaults to
+// common.DefaultHome() (current $HOME) when no option is supplied.
+func WithHome(h string) BaseOption {
+	return func(b *Base) { b.Home = h }
+}
+
+// NewBase returns a Base populated from opts, with Home defaulting to the
+// current user's home directory.
+func NewBase(opts ...BaseOption) *Base {
+	b := &Base{Home: common.DefaultHome()}
+	for _, o := range opts {
+		o(b)
+	}
+	return b
+}

internal/adapter/base_test.go

@@ -0,0 +1,46 @@
+package adapter_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/lukaszraczylo/harness-sync/internal/adapter"
+)
+
+func TestNewBaseDefaultsHomeFromEnv(t *testing.T) {
+	b := adapter.NewBase()
+	// DefaultHome returns either $HOME or "". We only assert that the
+	// helper does not panic and that Home is a string (Go zero value is "").
+	// Environment-dependence: skip if HOME is unset (CI minimal envs).
+	if b.Home == "" {
+		t.Skip("HOME unset in test env; cannot verify default")
+	}
+	assert.NotEmpty(t, b.Home)
+}
+
+func TestNewBaseWithHomeOverrides(t *testing.T) {
+	b := adapter.NewBase(adapter.WithHome("/custom/home/path"))
+	assert.Equal(t, "/custom/home/path", b.Home)
+}
+
+func TestNewBaseOptionsApplyInOrder(t *testing.T) {
+	// Last write wins — covers the basic Apply loop in NewBase.
+	b := adapter.NewBase(
+		adapter.WithHome("/first"),
+		adapter.WithHome("/second"),
+	)
+	assert.Equal(t, "/second", b.Home)
+}
+
+func TestBaseOptionTypedCorrectly(t *testing.T) {
+	// adapter.BaseOption is the public type; WithHome must return it.
+	opt := adapter.WithHome("/x")
+	require.NotNil(t, opt)
+
+	// Apply it manually to confirm signature.
+	var b adapter.Base
+	opt(&b)
+	assert.Equal(t, "/x", b.Home)
+}

internal/adapter/common/io.go

@@ -29,6 +29,19 @@ func ReadIfExists(path string) (string, error) {
 	return ReadIfExistsFS(fsx.OS(), path)
 }
 
+// ReadExistingFile returns the file body or (nil, nil) when missing.
+// Other errors (permission denied, I/O failure) are returned verbatim so
+// read-modify-write callers can distinguish a fresh first-run state from a
+// broken read. Treating every error as "file is empty" silently overwrites
+// the user's on-disk edits during apply.
+func ReadExistingFile(path string) ([]byte, error) {
+	b, err := os.ReadFile(path) //nolint:gosec // caller-controlled path
+	if err != nil && os.IsNotExist(err) {
+		return nil, nil
+	}
+	return b, err
+}
+
 // DirExistsFS reports whether path is an existing directory on fs.
 func DirExistsFS(fs fsx.FS, path string) bool {
 	info, err := fs.Stat(path)

internal/adapter/common/io_existing_test.go

@@ -0,0 +1,64 @@
+package common_test
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/lukaszraczylo/harness-sync/internal/adapter/common"
+)
+
+// ReadExistingFile: missing file returns (nil, nil). Permission errors and
+// other I/O failures must NOT be silently swallowed — those would let
+// read-modify-write code clobber the user's on-disk state.
+
+func TestReadExistingFileMissing(t *testing.T) {
+	got, err := common.ReadExistingFile(filepath.Join(t.TempDir(), "absent"))
+	require.NoError(t, err)
+	assert.Nil(t, got)
+}
+
+func TestReadExistingFileContent(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "ok.txt")
+	require.NoError(t, os.WriteFile(path, []byte("body\n"), 0o600))
+
+	got, err := common.ReadExistingFile(path)
+	require.NoError(t, err)
+	assert.Equal(t, []byte("body\n"), got)
+}
+
+func TestReadExistingFilePropagatesError(t *testing.T) {
+	// Create a directory the OS will refuse us read access to.
+	if os.Geteuid() == 0 {
+		t.Skip("running as root; cannot test permission denial")
+	}
+	dir := t.TempDir()
+	require.NoError(t, os.Mkdir(filepath.Join(dir, "locked"), 0o000))
+	t.Cleanup(func() { _ = os.Chmod(filepath.Join(dir, "locked"), 0o755) })
+
+	_, err := common.ReadExistingFile(filepath.Join(dir, "locked", "file"))
+	require.Error(t, err)
+	assert.False(t, os.IsNotExist(err), "permission denied must not be reported as not-exist")
+	assert.True(t, errors.Is(err, os.ErrPermission) || isPermission(err),
+		"expected permission error, got %v", err)
+}
+
+func isPermission(err error) bool {
+	// Some platforms wrap the error in *os.PathError. Check the string too
+	// for portability — it's a coarse signal but adequate here.
+	return err != nil && (contains(err.Error(), "permission") || contains(err.Error(), "access denied"))
+}
+
+func contains(s, sub string) bool {
+	for i := 0; i+len(sub) <= len(s); i++ {
+		if s[i:i+len(sub)] == sub {
+			return true
+		}
+	}
+	return false
+}