@ccoalm/ccl-skills 0.1.0

package/dist/assets/marketplace/plugins/ccl-skills/skills/worktree-isolation/scripts/worktree-status.sh

@@ -0,0 +1,325 @@
+#!/usr/bin/env bash
+# worktree-status — read-only preflight for repository worktree isolation.
+
+set -u
+
+SLUG=""
+WANTED_BRANCH=""
+BASE_REF=""
+JSON=0
+BASE_EXPLICIT=0
+
+usage() {
+  cat <<'USAGE'
+Usage: worktree-status.sh [--slug <slug>] [--branch <branch>] [--base <ref>] [--json]
+
+Read-only worktree isolation preflight. It prints the current repo state, a
+worktree inventory, and a copyable `git worktree add` command when editing is
+unsafe. It never creates, removes, checks out, or modifies git state.
+
+Exit codes: safe=0, unsafe=1, usage/setup error=2.
+USAGE
+}
+
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --slug)
+      [ "$#" -ge 2 ] || { echo "worktree-status: --slug requires a value" >&2; exit 2; }
+      SLUG="$2"; shift 2 ;;
+    --branch)
+      [ "$#" -ge 2 ] || { echo "worktree-status: --branch requires a value" >&2; exit 2; }
+      WANTED_BRANCH="$2"; shift 2 ;;
+    --base)
+      [ "$#" -ge 2 ] || { echo "worktree-status: --base requires a value" >&2; exit 2; }
+      BASE_REF="$2"; BASE_EXPLICIT=1; shift 2 ;;
+    --json) JSON=1; shift ;;
+    -h|--help) usage; exit 0 ;;
+    --*) echo "worktree-status: unknown flag '$1'" >&2; usage >&2; exit 2 ;;
+    *) echo "worktree-status: unexpected argument '$1'" >&2; usage >&2; exit 2 ;;
+  esac
+done
+
+git rev-parse --git-dir >/dev/null 2>&1 || { echo "worktree-status: not inside a git repo" >&2; exit 2; }
+if [ "$JSON" = 1 ] && ! command -v python3 >/dev/null 2>&1; then
+  echo "worktree-status: --json requires python3 for JSON escaping" >&2
+  exit 2
+fi
+
+canon_dir() { cd "$1" 2>/dev/null && pwd -P; }
+json_escape() { printf '%s' "$1" | python3 -c 'import json,sys; print(json.dumps(sys.stdin.read()))'; }
+# Bash JSON string escaper used when python3 is unavailable. Emits
+# the escaped inner content WITHOUT surrounding quotes; escapes backslash,
+# double quote, tab, CR, and LF so interpolated values stay valid JSON.
+json_string_fallback() {
+  local s=$1
+  s=${s//\\/\\\\}
+  s=${s//\"/\\\"}
+  s=${s//$'\t'/\\t}
+  s=${s//$'\r'/\\r}
+  s=${s//$'\n'/\\n}
+  printf '%s' "$s"
+}
+# ASCII unit separator: a delimiter that cannot appear in worktree paths or
+# branch names, so the worktree inventory survives literal '|' in either field.
+US="$(printf '\037')"
+shell_quote() {
+  printf "'"
+  printf '%s' "$1" | sed "s/'/'\\\\''/g"
+  printf "'"
+}
+slugify() {
+  printf '%s' "$1" | tr '[:upper:]' '[:lower:]' | sed 's#[^a-z0-9._-]#-#g; s#^-*##; s#-*$##; s#--*#-#g'
+}
+branchify() {
+  printf '%s' "$1" | sed 's#[^A-Za-z0-9._/-]#-#g; s#//*#/#g; s#^[-/]*##; s#[-/]*$##; s#\.\.#-#g; s#@{#-#g; s#--*#-#g'
+}
+
+REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null || true)"
+[ -n "$REPO_ROOT" ] || { echo "worktree-status: cannot resolve repo root" >&2; exit 2; }
+REPO_ROOT="$(canon_dir "$REPO_ROOT")"
+GIT_DIR_RAW="$(git rev-parse --git-dir 2>/dev/null || true)"
+GIT_COMMON_RAW="$(git rev-parse --git-common-dir 2>/dev/null || true)"
+GIT_DIR="$(canon_dir "$GIT_DIR_RAW" 2>/dev/null || printf '%s' "$GIT_DIR_RAW")"
+GIT_COMMON_DIR="$(canon_dir "$GIT_COMMON_RAW" 2>/dev/null || printf '%s' "$GIT_COMMON_RAW")"
+PRIMARY_ROOT="$(canon_dir "$(dirname "$GIT_COMMON_DIR")" 2>/dev/null || true)"
+[ -n "$PRIMARY_ROOT" ] || { echo "worktree-status: cannot resolve primary checkout root" >&2; exit 2; }
+BRANCH="$(git symbolic-ref --quiet --short HEAD 2>/dev/null || true)"
+HEAD_REV="$(git rev-parse --short HEAD 2>/dev/null || true)"
+SUPERPROJECT="$(git rev-parse --show-superproject-working-tree 2>/dev/null || true)"
+IS_SUBMODULE=0; [ -n "$SUPERPROJECT" ] && IS_SUBMODULE=1
+IS_DETACHED=0; [ -z "$BRANCH" ] && IS_DETACHED=1
+IS_INDEPENDENT=0; [ "$GIT_DIR" != "$GIT_COMMON_DIR" ] && IS_INDEPENDENT=1
+WORKTREE_ONLY=0; [ -f "$REPO_ROOT/.worktree-only" ] && WORKTREE_ONLY=1
+WORK_DIR_ROOT="$PRIMARY_ROOT/.work"
+WORKTREE_DIR="$WORK_DIR_ROOT/worktrees"
+LANE_DIR="$WORK_DIR_ROOT/lanes"
+IN_WORK_DIR=0
+case "$REPO_ROOT" in
+  "$WORKTREE_DIR"/*) IN_WORK_DIR=1 ;;
+esac
+
+DEFAULT_BRANCH=""
+DEFAULT_CONFIRMED=0
+BASE_CONFIRMED=0
+DEFAULT_SYMREF="$(git symbolic-ref --quiet --short refs/remotes/origin/HEAD 2>/dev/null || true)"
+if [ -n "$DEFAULT_SYMREF" ]; then
+  DEFAULT_BRANCH="${DEFAULT_SYMREF#origin/}"
+  DEFAULT_CONFIRMED=1
+fi
+
+if [ -z "$BASE_REF" ]; then
+  if [ "$DEFAULT_CONFIRMED" = 1 ]; then
+    BASE_REF="origin/$DEFAULT_BRANCH"
+    BASE_CONFIRMED=1
+  elif git rev-parse --verify --quiet "main^{commit}" >/dev/null 2>&1; then
+    BASE_REF="main"
+  elif git rev-parse --verify --quiet "master^{commit}" >/dev/null 2>&1; then
+    BASE_REF="master"
+  fi
+elif [ "$BASE_EXPLICIT" = 1 ]; then
+  BASE_CONFIRMED=1
+fi
+
+if [ -z "$BASE_REF" ]; then
+  BASE_FOUND=0
+else
+  if git rev-parse --verify --quiet "${BASE_REF}^{commit}" >/dev/null 2>&1; then
+    BASE_FOUND=1
+  else
+    BASE_FOUND=0
+  fi
+fi
+
+BASE_SHORT="$BASE_REF"
+case "$BASE_SHORT" in
+  origin/*) BASE_SHORT="${BASE_SHORT#origin/}" ;;
+  refs/heads/*) BASE_SHORT="${BASE_SHORT#refs/heads/}" ;;
+  refs/remotes/origin/*) BASE_SHORT="${BASE_SHORT#refs/remotes/origin/}" ;;
+esac
+
+# Capture git status success separately: swallowing a nonzero exit into an empty
+# string would read as "0 dirty lines" => a false clean => a false SAFE. For a
+# clobber-prevention preflight, undetermined cleanliness must fail CLOSED (unsafe),
+# so track STATUS_OK and require it for SAFE below.
+if STATUS_PORCELAIN="$(git status --porcelain --untracked-files=all 2>/dev/null)"; then
+  STATUS_OK=1
+else
+  STATUS_OK=0
+  STATUS_PORCELAIN=""
+fi
+STATUS_WITH_IGNORED="$(git status --porcelain --untracked-files=all --ignored 2>/dev/null || true)"
+DIRTY_LINES="$(printf '%s\n' "$STATUS_PORCELAIN" | sed '/^$/d' | wc -l | tr -d ' ')"
+UNTRACKED_LINES="$(printf '%s\n' "$STATUS_PORCELAIN" | grep -c '^?? ' || true)"
+IGNORED_LINES="$(printf '%s\n' "$STATUS_WITH_IGNORED" | grep -c '^!! ' || true)"
+TRACKED_DIRTY_LINES=$((DIRTY_LINES - UNTRACKED_LINES))
+[ "$TRACKED_DIRTY_LINES" -lt 0 ] && TRACKED_DIRTY_LINES=0
+
+safe_branch=0
+if [ -n "$BRANCH" ] && [ "$BRANCH" != "$BASE_SHORT" ] && [ "$BRANCH" != "main" ] && [ "$BRANCH" != "master" ]; then
+  safe_branch=1
+fi
+
+SAFE=0
+if [ "$IS_INDEPENDENT" = 1 ] && [ "$safe_branch" = 1 ] && [ "$IS_SUBMODULE" = 0 ] && [ "$IS_DETACHED" = 0 ] && [ "$STATUS_OK" = 1 ] && [ "$DIRTY_LINES" = 0 ] && [ "$BASE_FOUND" = 1 ] && [ "$BASE_CONFIRMED" = 1 ]; then
+  SAFE=1
+fi
+
+REASONS=()
+[ "$IS_INDEPENDENT" = 1 ] || REASONS+=("not an independent worktree")
+[ "$IS_SUBMODULE" = 0 ] || REASONS+=("inside a submodule")
+[ "$IS_DETACHED" = 0 ] || REASONS+=("detached HEAD")
+[ "$safe_branch" = 1 ] || REASONS+=("current branch is empty/default/base")
+[ "$STATUS_OK" = 1 ] || REASONS+=("could not determine worktree cleanliness (git status failed); treating as unsafe")
+[ "$DIRTY_LINES" = 0 ] || REASONS+=("dirty or untracked files present")
+[ "$BASE_FOUND" = 1 ] || REASONS+=("base ref not found; pass --base")
+[ "$BASE_CONFIRMED" = 1 ] || REASONS+=("default/base branch not confirmed; pass --base")
+
+if [ -n "$SLUG" ]; then
+  SUGGEST_SLUG="$(slugify "$SLUG")"
+elif [ -n "$WANTED_BRANCH" ]; then
+  SUGGEST_SLUG="$(slugify "$WANTED_BRANCH")"
+elif [ -n "$BRANCH" ]; then
+  SUGGEST_SLUG="$(slugify "$BRANCH")"
+else
+  SUGGEST_SLUG="worktree-task"
+fi
+[ -n "$SUGGEST_SLUG" ] || SUGGEST_SLUG="worktree-task"
+
+if [ -n "$WANTED_BRANCH" ]; then
+  SUGGEST_BRANCH="$WANTED_BRANCH"
+elif [ "$safe_branch" = 1 ]; then
+  SUGGEST_BRANCH="$BRANCH"
+else
+  SUGGEST_BRANCH="worktree-${SUGGEST_SLUG}"
+fi
+SUGGEST_BRANCH="$(branchify "$SUGGEST_BRANCH")"
+[ -n "$SUGGEST_BRANCH" ] || SUGGEST_BRANCH="worktree-${SUGGEST_SLUG}"
+if ! git check-ref-format --branch "$SUGGEST_BRANCH" >/dev/null 2>&1; then
+  SUGGEST_BRANCH="worktree-${SUGGEST_SLUG}"
+fi
+SUGGEST_PATH="$WORKTREE_DIR/${SUGGEST_SLUG}"
+LANE_METADATA_PATH="$LANE_DIR/${SUGGEST_SLUG}.json"
+if [ -n "$BASE_REF" ]; then
+  SUGGEST_CMD="git worktree add -b $(shell_quote "$SUGGEST_BRANCH") $(shell_quote "$SUGGEST_PATH") $(shell_quote "$BASE_REF")"
+else
+  SUGGEST_CMD="git worktree add -b $(shell_quote "$SUGGEST_BRANCH") $(shell_quote "$SUGGEST_PATH") <base>"
+fi
+if command -v python3 >/dev/null 2>&1; then
+  LANE_METADATA_SNIPPET="$(python3 - "$SUGGEST_SLUG" "$SUGGEST_BRANCH" "$SUGGEST_PATH" "$BASE_REF" <<'PY'
+import json
+import sys
+
+slug, branch, worktree_path, base = sys.argv[1:]
+print(json.dumps({
+    "slug": slug,
+    "branch": branch,
+    "worktree_path": worktree_path,
+    "base": base,
+}, separators=(",", ":")))
+PY
+)"
+else
+  LANE_METADATA_SNIPPET="{\"slug\":\"$(json_string_fallback "$SUGGEST_SLUG")\",\"branch\":\"$(json_string_fallback "$SUGGEST_BRANCH")\",\"worktree_path\":\"$(json_string_fallback "$SUGGEST_PATH")\",\"base\":\"$(json_string_fallback "$BASE_REF")\"}"
+fi
+
+WT_SUMMARY="$(git worktree list --porcelain 2>/dev/null | awk '
+  BEGIN { sep=sprintf("%c", 31) }
+  /^worktree / { if (path != "") print path sep branch sep head sep flags; path=substr($0,10); branch=""; head=""; flags=""; next }
+  /^HEAD / { head=substr($0,6); next }
+  /^branch / { branch=substr($0,19); next }
+  /^detached$/ { flags=flags ",detached"; next }
+  /^bare$/ { flags=flags ",bare"; next }
+  /^locked/ { flags=flags ",locked"; next }
+  END { if (path != "") print path sep branch sep head sep flags }
+')"
+
+if [ "$JSON" = 1 ]; then
+  printf '{\n'
+  printf '  "status": %s,\n' "$(json_escape "$([ "$SAFE" = 1 ] && echo safe || echo unsafe)")"
+  printf '  "repo_root": %s,\n' "$(json_escape "$REPO_ROOT")"
+  printf '  "primary_root": %s,\n' "$(json_escape "$PRIMARY_ROOT")"
+  printf '  "branch": %s,\n' "$(json_escape "$BRANCH")"
+  printf '  "head": %s,\n' "$(json_escape "$HEAD_REV")"
+  printf '  "base": %s,\n' "$(json_escape "$BASE_REF")"
+  printf '  "base_found": %s,\n' "$([ "$BASE_FOUND" = 1 ] && echo true || echo false)"
+  printf '  "base_confirmed": %s,\n' "$([ "$BASE_CONFIRMED" = 1 ] && echo true || echo false)"
+  printf '  "default_branch": %s,\n' "$(json_escape "$DEFAULT_BRANCH")"
+  printf '  "default_confirmed": %s,\n' "$([ "$DEFAULT_CONFIRMED" = 1 ] && echo true || echo false)"
+  printf '  "git_dir": %s,\n' "$(json_escape "$GIT_DIR")"
+  printf '  "git_common_dir": %s,\n' "$(json_escape "$GIT_COMMON_DIR")"
+  printf '  "work_dir_root": %s,\n' "$(json_escape "$WORK_DIR_ROOT")"
+  printf '  "worktree_dir": %s,\n' "$(json_escape "$WORKTREE_DIR")"
+  printf '  "lane_metadata_path": %s,\n' "$(json_escape "$LANE_METADATA_PATH")"
+  printf '  "lane_metadata_snippet": %s,\n' "$(json_escape "$LANE_METADATA_SNIPPET")"
+  printf '  "suggested_worktree_path": %s,\n' "$(json_escape "$SUGGEST_PATH")"
+  printf '  "in_work_dir": %s,\n' "$([ "$IN_WORK_DIR" = 1 ] && echo true || echo false)"
+  printf '  "outside_work_dir_warning": %s,\n' "$([ "$SAFE" = 1 ] && [ "$IN_WORK_DIR" = 0 ] && echo true || echo false)"
+  printf '  "is_submodule": %s,\n' "$([ "$IS_SUBMODULE" = 1 ] && echo true || echo false)"
+  printf '  "is_detached": %s,\n' "$([ "$IS_DETACHED" = 1 ] && echo true || echo false)"
+  printf '  "is_independent_worktree": %s,\n' "$([ "$IS_INDEPENDENT" = 1 ] && echo true || echo false)"
+  printf '  "worktree_only_marker": %s,\n' "$([ "$WORKTREE_ONLY" = 1 ] && echo true || echo false)"
+  printf '  "dirty_count": %s,\n' "$TRACKED_DIRTY_LINES"
+  printf '  "untracked_count": %s,\n' "$UNTRACKED_LINES"
+  printf '  "ignored_count": %s,\n' "$IGNORED_LINES"
+  printf '  "ignored_only_warning": %s,\n' "$([ "$DIRTY_LINES" = 0 ] && [ "$IGNORED_LINES" -gt 0 ] && echo true || echo false)"
+  printf '  "suggested_command": %s,\n' "$(json_escape "$SUGGEST_CMD")"
+  printf '  "reasons": ['
+  first=1
+  set +u
+  for r in "${REASONS[@]}"; do [ "$first" = 1 ] || printf ', '; first=0; printf '%s' "$(json_escape "$r")"; done
+  set -u
+  printf '],\n'
+  printf '  "worktrees": ['
+  first=1
+  while IFS="$US" read -r p b h f; do
+    [ -n "$p" ] || continue
+    [ "$first" = 1 ] || printf ','
+    first=0
+    printf '\n    {"path": %s, "branch": %s, "head": %s, "flags": %s}' "$(json_escape "$p")" "$(json_escape "$b")" "$(json_escape "$h")" "$(json_escape "${f#,}")"
+  done <<EOF
+$WT_SUMMARY
+EOF
+  [ "$first" = 1 ] || printf '\n  '
+  printf ']\n}\n'
+else
+  echo "worktree-status: $([ "$SAFE" = 1 ] && echo SAFE || echo UNSAFE)"
+  echo "repo root: $REPO_ROOT"
+  echo "primary root: $PRIMARY_ROOT"
+  echo "branch: ${BRANCH:-<detached>}  head: ${HEAD_REV:-unknown}"
+  echo "default/base: ${DEFAULT_BRANCH:-unknown} / ${BASE_REF:-<missing>} $([ "$BASE_FOUND" = 1 ] || printf '(base not found)')"
+  echo "git-dir: $GIT_DIR"
+  echo "git-common-dir: $GIT_COMMON_DIR"
+  echo "submodule: $IS_SUBMODULE  detached: $IS_DETACHED  independent-worktree: $IS_INDEPENDENT  .worktree-only: $WORKTREE_ONLY  in-.work: $IN_WORK_DIR"
+  echo ".work convention: worktrees=$WORKTREE_DIR lanes=$LANE_DIR"
+  echo "dirty: tracked=$TRACKED_DIRTY_LINES untracked=$UNTRACKED_LINES ignored=$IGNORED_LINES"
+  if [ "$DIRTY_LINES" = 0 ] && [ "$IGNORED_LINES" -gt 0 ]; then
+    echo "warning: ignored-only files present; this is a warning, not a hard fail for edit preflight"
+  fi
+  if [ "$SAFE" != 1 ]; then
+    echo "unsafe reasons: ${REASONS[*]}"
+    echo "suggested command: $SUGGEST_CMD"
+    echo "suggested worktree path: $SUGGEST_PATH"
+    echo "lane metadata path: $LANE_METADATA_PATH"
+    echo "lane metadata snippet: $LANE_METADATA_SNIPPET"
+  else
+    echo "next: safe to edit in this worktree; still run normal task validation before integration"
+    if [ "$IN_WORK_DIR" = 0 ]; then
+      echo "warning: safe worktree is outside .work/worktrees; use .work/worktrees for new lanes"
+    fi
+    echo "lane metadata path: $LANE_METADATA_PATH"
+  fi
+  echo
+  echo "worktree inventory:"
+  if [ -n "$WT_SUMMARY" ]; then
+    while IFS="$US" read -r p b h f; do
+      [ -n "$p" ] || continue
+      printf '  - %s  branch=%s  head=%s  flags=%s\n' "$p" "${b:-<none>}" "${h:-unknown}" "${f#,}"
+    done <<EOF
+$WT_SUMMARY
+EOF
+  else
+    echo "  <none>"
+  fi
+fi
+
+[ "$SAFE" = 1 ] && exit 0 || exit 1

package/dist/assets/marketplace/plugins/ccl-skills/skills/worktree-isolation/scripts/worktree-sweep.sh

@@ -0,0 +1,245 @@
+#!/usr/bin/env bash
+# worktree-sweep — remove local git worktrees whose branch is already integrated
+# (its tip is an ancestor of an integration ref). Safe by construction:
+#   - DRY-RUN by default; only --apply actually removes anything.
+#   - Removes ONLY a worktree whose branch tip is fully merged into one of the integration
+#     refs (`git merge-base --is-ancestor`). Squash-merged branches are NOT ancestors -> kept.
+#   - The integration target is NOT assumed to be main: when origin/HEAD confirms the
+#     default branch, default-branch targets are kept for manual/platform-MR verification.
+#     Non-default development targets may be passed explicitly (merged into ANY -> sweepable).
+#   - NEVER the main worktree, the repo default branch, a target branch, a bare/detached
+#     worktree, or a worktree with ANY uncommitted/untracked/IGNORED local file (ignored
+#     files block too, because `git worktree remove` without --force still deletes them).
+#     A worktree whose own `git status` FAILS is also kept: empty output from a failed
+#     scan is never read as "clean" (fail closed, same rule as the manual pre-scan).
+#     `git worktree remove` without --force is a second net for tracked/untracked dirt.
+#   - Deletes the local branch with `git branch -d` (never -D). NEVER touches any remote
+#     (remote-branch deletion is a separate, explicit step in the worktree-isolation 收尾 doc).
+#   - `git worktree prune` runs ONLY under --apply (dry-run mutates nothing).
+#
+# Usage:  worktree-sweep.sh [<integration-ref> ...] [--apply] [--include-ignored]
+#   <integration-ref> ...  default: origin/HEAD's branch, else main, else master.
+#                          e.g. `worktree-sweep.sh release/v2 --apply`
+#   --include-ignored      allow removing a worktree whose ONLY local content is ignored
+#                          (regenerable, e.g. node_modules); real dirty/untracked still blocks.
+#                          DESTRUCTIVE: it also deletes gitignored DATA products, so read the
+#                          KEEP reasons before reaching for it. Regenerable output (deps,
+#                          build/test artifacts, caches, logs) is fine to drop; keep anything
+#                          expensive to recompute (long-running intermediates, collected data).
+#
+# Exit: 0 on success (incl. "nothing to do"); 2 on usage/setup error. Per-worktree failures
+# are reported and skipped; they never abort the whole sweep.
+
+set -uo pipefail
+
+APPLY=0
+INCLUDE_IGNORED=0
+TARGETS=()
+EXPLICIT_TARGETS=0
+for a in "$@"; do
+  case "$a" in
+    --apply)           APPLY=1 ;;
+    --include-ignored) INCLUDE_IGNORED=1 ;;
+    -h|--help)         sed -n '2,30p' "$0"; exit 0 ;;
+    --*)               echo "worktree-sweep: unknown flag '$a'" >&2; exit 2 ;;
+    *)                 TARGETS+=("$a"); EXPLICIT_TARGETS=1 ;;
+  esac
+done
+
+git rev-parse --git-dir >/dev/null 2>&1 || { echo "worktree-sweep: not inside a git repo" >&2; exit 2; }
+
+# Confirm repo default branch from origin/HEAD only. If the local symref is absent,
+# try the remote symref; if both fail, default-target safety cannot be proven.
+DEFAULT_CONFIRMED=0
+DEFAULT_BRANCH="$(git symbolic-ref --quiet --short refs/remotes/origin/HEAD 2>/dev/null | sed 's#^origin/##')"
+if [ -n "$DEFAULT_BRANCH" ]; then
+  DEFAULT_CONFIRMED=1
+elif git remote get-url origin >/dev/null 2>&1; then
+  DEFAULT_BRANCH="$(git ls-remote --symref origin HEAD 2>/dev/null | sed -n 's#^ref: refs/heads/\([^[:space:]]*\)[[:space:]]*HEAD$#\1#p' | head -n 1)"
+  [ -n "$DEFAULT_BRANCH" ] && DEFAULT_CONFIRMED=1
+fi
+
+# Default integration ref if none given: repo default branch via confirmed origin/HEAD.
+# Default-branch sweeping is intentionally manual-only, so no-arg invocation exits with a
+# clear message after default detection instead of silently doing nothing.
+if [ "${#TARGETS[@]}" -eq 0 ]; then
+  d="$DEFAULT_BRANCH"
+  [ -n "$d" ] && TARGETS=("$d")
+fi
+[ "${#TARGETS[@]}" -gt 0 ] || { echo "worktree-sweep: cannot determine integration ref; pass one explicitly" >&2; exit 2; }
+for t in "${TARGETS[@]}"; do
+  git rev-parse --verify --quiet "${t}^{commit}" >/dev/null 2>&1 \
+    || { echo "worktree-sweep: integration ref '$t' not found" >&2; exit 2; }
+done
+TARGETS_STR="$(IFS=', '; echo "${TARGETS[*]}")"
+
+DEFAULT_NAMES=()
+[ -n "$DEFAULT_BRANCH" ] && DEFAULT_NAMES+=("$DEFAULT_BRANCH")
+DEFAULT_COMMIT=""
+[ "$DEFAULT_CONFIRMED" = 1 ] && DEFAULT_COMMIT="$(git rev-parse --verify --quiet "refs/remotes/origin/$DEFAULT_BRANCH^{commit}" 2>/dev/null || git rev-parse --verify --quiet "refs/heads/$DEFAULT_BRANCH^{commit}" 2>/dev/null || true)"
+
+# Protected branch names = default branch + each target normalized to a local short name
+# (so `origin/release`, `refs/heads/release`, `release` all protect a worktree on `release`).
+PROTECTED=()
+[ -n "$DEFAULT_BRANCH" ] && PROTECTED+=("$DEFAULT_BRANCH")
+HAS_DEFAULT_TARGET=0
+SWEEP_TARGETS=()
+is_default_name() {
+  [ "${#DEFAULT_NAMES[@]}" -gt 0 ] || return 1
+  local x="$1" d
+  for d in "${DEFAULT_NAMES[@]}"; do [ "$x" = "$d" ] && return 0; done
+  return 1
+}
+for t in "${TARGETS[@]}"; do
+  n="${t#refs/heads/}"; n="${n#refs/remotes/}"; n="${n#origin/}"
+  tt="$(git rev-parse --verify --quiet "${t}^{commit}" 2>/dev/null || true)"
+  if is_default_name "$n" || { [ -n "$DEFAULT_COMMIT" ] && [ -n "$tt" ] && [ "$tt" = "$DEFAULT_COMMIT" ]; }; then
+    HAS_DEFAULT_TARGET=1
+  else
+    SWEEP_TARGETS+=("$t")
+  fi
+  PROTECTED+=("$t" "$n")
+done
+
+if [ "$EXPLICIT_TARGETS" = 0 ] && [ "$HAS_DEFAULT_TARGET" = 1 ]; then
+  echo "worktree-sweep: default target requires platform MR evidence; pass a non-default development target explicitly" >&2
+  exit 2
+fi
+if [ "$DEFAULT_CONFIRMED" = 0 ]; then
+  echo "worktree-sweep: cannot confirm origin/HEAD; refusing ancestor-based sweep" >&2
+  exit 2
+fi
+
+# Main worktree root = parent of the common git dir.
+COMMON="$(git rev-parse --git-common-dir)"
+MAIN_ROOT="$(cd "$COMMON/.." 2>/dev/null && pwd -P)"
+
+# Local state that must block removal. Default: any uncommitted/untracked/IGNORED file
+# (git worktree remove without --force still deletes ignored-only worktrees -> data loss).
+# --include-ignored relaxes this to real dirty/untracked only (ignored files = regenerable).
+# --untracked-files=all forces untracked enumeration regardless of a repo's
+# status.showUntrackedFiles=no config (which would otherwise hide untracked work).
+# FAIL CLOSED on a non-zero `git status`: an unscannable worktree (corrupt index,
+# broken gitdir, unreadable tree) yields EMPTY output, and treating that emptiness
+# as "clean" is exactly the false-negative the manual pre-scan rule forbids
+# ("必须 exit 0；失败按没扫处理"). Unscannable -> local state present -> KEEP.
+# HAS_LOCAL_STATE_REASON carries which of the two it was, for the KEEP line.
+# HAS_LOCAL_STATE_SAMPLE carries a bounded sample of the actual entries, because the
+# cleanup rule asks the operator to grade what is there by RECOMPUTE COST before
+# deciding — a generic "ignored files present" gives them nothing to grade, and they
+# would have to re-run status by hand to find out.
+HAS_LOCAL_STATE_REASON=""
+HAS_LOCAL_STATE_SAMPLE=""
+STATE_SAMPLE_LINES=8
+has_local_state() {
+  local out rc
+  if [ "$INCLUDE_IGNORED" = 1 ]; then
+    out="$(git -C "$1" status --porcelain --untracked-files=all 2>/dev/null)"; rc=$?
+  else
+    out="$(git -C "$1" status --porcelain --untracked-files=all --ignored 2>/dev/null)"; rc=$?
+  fi
+  HAS_LOCAL_STATE_SAMPLE=""
+  if [ "$rc" -ne 0 ]; then
+    HAS_LOCAL_STATE_REASON="unscannable: git status exit $rc — treat as unscanned, inspect manually"
+    return 0
+  fi
+  [ -n "$out" ] || return 1
+  HAS_LOCAL_STATE_REASON="local changes / untracked$([ "$INCLUDE_IGNORED" = 0 ] && printf ' / ignored') files present"
+  local total; total="$(printf '%s\n' "$out" | wc -l | tr -d ' ')"
+  HAS_LOCAL_STATE_SAMPLE="$(printf '%s\n' "$out" | head -n "$STATE_SAMPLE_LINES")"
+  if [ "$total" -gt "$STATE_SAMPLE_LINES" ]; then
+    HAS_LOCAL_STATE_SAMPLE="$HAS_LOCAL_STATE_SAMPLE
+   … $((total - STATE_SAMPLE_LINES)) more"
+  fi
+  return 0
+}
+
+echo "worktree-sweep: integration ref(s) = [$TARGETS_STR]  mode = $([ "$APPLY" = 1 ] && echo APPLY || echo 'DRY-RUN (pass --apply to act)')"
+echo
+
+removed=0; kept=0
+wt=""; br=""; det=0; bare=0
+is_protected_name() { local b="$1" p; for p in "${PROTECTED[@]}"; do [ "$b" = "$p" ] && return 0; done; return 1; }
+# Release-named branches are never auto-deleted, however merged they look: a release branch is
+# kept after merge to tag from, to trace what shipped, and to cut patches off — yet in git
+# topology it is indistinguishable from a finished feature branch, so "merged" does not imply
+# "disposable" here. Name-based on purpose; substring + case-insensitive so release/v2,
+# release-1.2, and hotfix-RELEASE all match. Deleting one is a user-named action, never a sweep.
+# One hardcoded keyword, deliberately not extensible. Three rounds of adversarial review
+# each found a new way a configurable list fails to TRAVEL: an env var protects only the
+# invocation that exported it; `.git/config` is per-clone and a fresh CI clone loses it.
+# Every fix chased vocabulary the script does not own. The keyword lives in this shared
+# script, so it travels wherever the skill is installed — that is the property a delete
+# guard needs. A repo whose release branches are named otherwise (`rc/`, `stabilization/`)
+# is NOT auto-protected here, and that is the deliberate residual: the sweep prints its
+# full KEEP/REMOVE plan for a human before `--apply`, and deleting anything is a
+# user-named action to begin with. Do not re-add a config source without first solving
+# how it reaches a fresh clone.
+is_release_named() {
+  case "$(printf '%s' "$1" | tr '[:upper:]' '[:lower:]')" in *release*) return 0 ;; *) return 1 ;; esac
+}
+# A worktree sitting exactly at an integration ref's tip is on the integration branch itself
+# (not a finished feature ahead of it) -> never remove. A real merged feature (--no-ff) has a
+# tip that is an ANCESTOR of, but != , the target tip, so it is not caught here.
+is_at_target_tip() {
+  local bt; bt="$(git rev-parse --verify --quiet "refs/heads/$1^{commit}" 2>/dev/null)" || return 1
+  [ -n "$bt" ] || return 1
+  local t tt; for t in "${TARGETS[@]}"; do
+    tt="$(git rev-parse --verify --quiet "${t}^{commit}" 2>/dev/null)"
+    [ -n "$tt" ] && [ "$bt" = "$tt" ] && return 0
+  done; return 1
+}
+merged_into_any() {
+  [ "${#SWEEP_TARGETS[@]}" -gt 0 ] || return 1
+  local b="$1" t
+  for t in "${SWEEP_TARGETS[@]}"; do git merge-base --is-ancestor "refs/heads/$b" "$t" 2>/dev/null && return 0; done
+  return 1
+}
+
+sweep_one() {
+  [ -n "$wt" ] || return 0
+  local path="$wt" branch="$br" reason=""
+  HAS_LOCAL_STATE_SAMPLE=""
+  if [ "$bare" = 1 ]; then reason="bare";
+  elif [ "$(cd "$path" 2>/dev/null && pwd -P)" = "$MAIN_ROOT" ]; then reason="main worktree";
+  elif [ "$det" = 1 ] || [ -z "$branch" ]; then reason="detached / no branch";
+  elif is_protected_name "$branch"; then reason="protected branch (default / integration target)";
+  elif is_release_named "$branch"; then reason="release-named branch (never auto-deleted; delete only when the user names it)";
+  elif is_at_target_tip "$branch"; then reason="at an integration ref tip";
+  elif has_local_state "$path"; then reason="$HAS_LOCAL_STATE_REASON";
+  elif [ "${#SWEEP_TARGETS[@]}" -eq 0 ]; then reason="default target requires platform MR evidence; inspect manually";
+  elif ! merged_into_any "$branch"; then reason="not merged into any non-default target of [$TARGETS_STR]";
+  fi
+  if [ -n "$reason" ]; then
+    printf '  KEEP   %-50s [%s]\n' "$path" "$reason"
+    # Show WHAT is there so the recompute-cost call can be made from this output
+    # alone. Without it, --include-ignored is a blind batch-wide waiver.
+    [ -n "$HAS_LOCAL_STATE_SAMPLE" ] && printf '%s\n' "$HAS_LOCAL_STATE_SAMPLE" | sed 's/^/           /'
+    kept=$((kept+1)); return 0
+  fi
+  if [ "$APPLY" = 0 ]; then
+    printf '  WOULD-REMOVE %-44s (branch %s, merged)\n' "$path" "$branch"; removed=$((removed+1)); return 0
+  fi
+  if git worktree remove "$path" 2>/dev/null; then
+    git branch -d "$branch" >/dev/null 2>&1 || true
+    printf '  REMOVED %-49s (branch %s)\n' "$path" "$branch"; removed=$((removed+1))
+  else
+    printf '  KEEP   %-50s [remove refused: dirty/locked — inspect manually]\n' "$path"; kept=$((kept+1))
+  fi
+}
+
+while IFS= read -r line; do
+  case "$line" in
+    "worktree "*) sweep_one; wt="${line#worktree }"; br=""; det=0; bare=0 ;;
+    "branch "*)   br="${line#branch refs/heads/}" ;;
+    "detached")   det=1 ;;
+    "bare")       bare=1 ;;
+  esac
+done < <(git worktree list --porcelain)
+sweep_one  # flush last block
+
+[ "$APPLY" = 1 ] && git worktree prune  # prune only mutates under --apply (dry-run prints only)
+echo
+echo "worktree-sweep: $([ "$APPLY" = 1 ] && echo removed || echo would-remove)=$removed kept=$kept"
+[ "$APPLY" = 0 ] && [ "$removed" -gt 0 ] && echo "worktree-sweep: re-run with --apply to remove the above."
+exit 0