@codyswann/lisa 2.195.7 → 2.196.0

package/scripts/cleanup-github-branches.sh

@@ -1,16 +1,19 @@
 #!/bin/bash
 #
-# Cleanup GitHub Stale Branches
+# Cleanup GitHub Merged Branches
 #
-# Deletes remote branches that are:
-#   - NOT protected branches (main, dev, staging)
+# Deletes remote branches that have been MERGED and are safe to remove:
+#   - NOT environment branches (main, dev, staging) or the default branch
 #   - NOT associated with an open pull request
+#   - Provably merged: either a merged PR exists for the branch, or the
+#     branch is fully contained in an environment branch (compare status
+#     "behind"/"identical")
 #
-# This helps keep the repository clean by removing stale feature branches
-# that have been merged or abandoned.
+# Abandoned-but-unmerged branches are reported but never deleted — they may
+# hold real work that was simply never PR'd.
 #
 # Usage:
-#   ./scripts/cleanup-github-branches.sh <owner/repo>
+#   ./scripts/cleanup-github-branches.sh <owner/repo> [--dry-run]
 #
 # Example:
 #   ./scripts/cleanup-github-branches.sh repo-org/repo-name
@@ -23,7 +26,7 @@
 
 set -euo pipefail
 
-# Protected branches that should never be deleted
+# Environment branches that must never be deleted
 PROTECTED_BRANCHES=("main" "dev" "staging")
 
 # Colors for output
@@ -40,32 +43,14 @@ usage() {
   echo "Arguments:"
   echo "  owner/repo    GitHub repository in format 'owner/repo'"
   echo "  --dry-run     Show what would be deleted without actually deleting"
-  echo ""
-  echo "Example:"
-  echo "  $0 repo-org/repo-name"
-  echo "  $0 repo-org/repo-name --dry-run"
   exit 1
 }
 
-log_info() {
-  echo -e "${BLUE}[INFO]${NC} $1"
-}
-
-log_success() {
-  echo -e "${GREEN}[SUCCESS]${NC} $1"
-}
-
-log_warning() {
-  echo -e "${YELLOW}[WARNING]${NC} $1"
-}
-
-log_error() {
-  echo -e "${RED}[ERROR]${NC} $1"
-}
-
-log_dry_run() {
-  echo -e "${CYAN}[DRY-RUN]${NC} Would delete: $1"
-}
+log_info() { echo -e "${BLUE}[INFO]${NC} $1"; }
+log_success() { echo -e "${GREEN}[SUCCESS]${NC} $1"; }
+log_warning() { echo -e "${YELLOW}[WARNING]${NC} $1"; }
+log_error() { echo -e "${RED}[ERROR]${NC} $1"; }
+log_dry_run() { echo -e "${CYAN}[DRY-RUN]${NC} Would delete: $1"; }
 
 is_protected_branch() {
   local branch="$1"
@@ -77,6 +62,30 @@ is_protected_branch() {
   return 1
 }
 
+# A branch is merged when a merged PR exists for it, or its tip is fully
+# contained in an environment branch.
+is_merged_branch() {
+  local branch="$1"
+
+  local merged_pr
+  merged_pr=$(gh pr list --repo "$REPO" --state merged --head "$branch" \
+    --limit 1 --json number --jq 'length' 2>/dev/null || echo 0)
+  if [[ "$merged_pr" -gt 0 ]]; then
+    return 0
+  fi
+
+  for base in "${EXISTING_ENV_BRANCHES[@]}"; do
+    local status
+    status=$(gh api "repos/$REPO/compare/$base...$branch" \
+      --jq '.status' 2>/dev/null || echo "unknown")
+    if [[ "$status" == "behind" || "$status" == "identical" ]]; then
+      return 0
+    fi
+  done
+
+  return 1
+}
+
 # Check arguments
 if [[ $# -lt 1 ]]; then
   usage
@@ -92,7 +101,7 @@ if [[ $# -ge 2 && "$2" == "--dry-run" ]]; then
 fi
 
 # Validate repo format
-if [[ ! "$REPO" =~ ^[a-zA-Z0-9_-]+/[a-zA-Z0-9_-]+$ ]]; then
+if [[ ! "$REPO" =~ ^[a-zA-Z0-9_.-]+/[a-zA-Z0-9_.-]+$ ]]; then
   log_error "Invalid repository format. Expected 'owner/repo', got: $REPO"
   exit 1
 fi
@@ -106,65 +115,86 @@ fi
 log_success "GitHub CLI authenticated"
 echo ""
 
-# Verify repository access
+# Verify repository access + resolve default branch
 log_info "Verifying access to repository: $REPO"
-if ! gh repo view "$REPO" > /dev/null 2>&1; then
+DEFAULT_BRANCH=$(gh repo view "$REPO" --json defaultBranchRef --jq '.defaultBranchRef.name' 2>/dev/null) || {
   log_error "Cannot access repository: $REPO"
-  log_error "Please check the repository name and your permissions."
   exit 1
-fi
-log_success "Repository access confirmed"
+}
+PROTECTED_BRANCHES+=("$DEFAULT_BRANCH")
+log_success "Repository access confirmed (default branch: $DEFAULT_BRANCH)"
 echo ""
 
-# Get branches with open PRs
-log_info "Fetching open pull requests..."
-open_pr_branches=$(gh pr list --repo "$REPO" --state open --json headRefName --jq '.[].headRefName' | sort)
-open_pr_count=$(echo "$open_pr_branches" | grep -c . || true)
-log_info "Found $open_pr_count branches with open PRs"
-
 # Get all remote branches
 log_info "Fetching all remote branches..."
-all_branches=$(gh api "repos/$REPO/branches" --paginate --jq '.[].name' | sort)
+all_branches=$(gh api "repos/$REPO/branches" --paginate --jq '.[].name' | sort -u)
 total_branch_count=$(echo "$all_branches" | grep -c . || true)
 log_info "Found $total_branch_count total branches"
+
+# Environment branches that exist in this repo (containment bases)
+EXISTING_ENV_BRANCHES=()
+for env_branch in main dev staging; do
+  if echo "$all_branches" | grep -qxF "$env_branch"; then
+    EXISTING_ENV_BRANCHES+=("$env_branch")
+  fi
+done
+
+# Get branches with open PRs
+log_info "Fetching open pull requests..."
+open_pr_branches=$(gh pr list --repo "$REPO" --state open --limit 500 --json headRefName --jq '.[].headRefName' | sort -u)
+open_pr_count=$(echo "$open_pr_branches" | grep -c . || true)
+log_info "Found $open_pr_count branches with open PRs"
 echo ""
 
-# Find stale branches (not protected, no open PR)
-log_info "Identifying stale branches..."
-stale_branches=$(comm -23 <(echo "$all_branches") <(echo "$open_pr_branches") | while read -r branch; do
-  if ! is_protected_branch "$branch"; then
-    echo "$branch"
+# Classify branches
+log_info "Classifying branches (merged vs unmerged)..."
+merged_branches=()
+unmerged_branches=()
+
+while IFS= read -r branch; do
+  [[ -z "$branch" ]] && continue
+  if is_protected_branch "$branch"; then
+    continue
+  fi
+  if echo "$open_pr_branches" | grep -qxF "$branch"; then
+    continue
   fi
-done)
+  if is_merged_branch "$branch"; then
+    merged_branches+=("$branch")
+  else
+    unmerged_branches+=("$branch")
+  fi
+done <<< "$all_branches"
 
-stale_count=$(echo "$stale_branches" | grep -c . || true)
+if [[ ${#unmerged_branches[@]} -gt 0 ]]; then
+  log_warning "Skipping ${#unmerged_branches[@]} unmerged branch(es) (may hold unshipped work):"
+  for branch in "${unmerged_branches[@]}"; do
+    echo "  - $branch"
+  done
+  echo ""
+fi
 
-if [[ "$stale_count" -eq 0 || -z "$stale_branches" ]]; then
-  log_success "No stale branches found. Repository is clean!"
+if [[ ${#merged_branches[@]} -eq 0 ]]; then
+  log_success "No merged branches found. Repository is clean!"
   exit 0
 fi
 
-log_warning "Found $stale_count stale branch(es) to delete"
+log_warning "Found ${#merged_branches[@]} merged branch(es) to delete"
 echo ""
 
-# Display stale branches
 echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-echo "Stale branches:"
-echo "$stale_branches" | while read -r branch; do
+echo "Merged branches:"
+for branch in "${merged_branches[@]}"; do
   echo "  - $branch"
 done
 echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
 echo ""
 
-# Delete stale branches
+# Delete merged branches
 deleted_count=0
 failed_count=0
 
-echo "$stale_branches" | while read -r branch; do
-  if [[ -z "$branch" ]]; then
-    continue
-  fi
-
+for branch in "${merged_branches[@]}"; do
   # Safety check - never delete protected branches
   if is_protected_branch "$branch"; then
     log_error "Attempted to delete protected branch: $branch - SKIPPING"
@@ -177,10 +207,10 @@ echo "$stale_branches" | while read -r branch; do
     echo -n "Deleting: $branch ... "
     if gh api -X DELETE "repos/$REPO/git/refs/heads/$branch" > /dev/null 2>&1; then
       echo -e "${GREEN}done${NC}"
-      ((deleted_count++)) || true
+      deleted_count=$((deleted_count + 1))
     else
       echo -e "${RED}failed${NC}"
-      ((failed_count++)) || true
+      failed_count=$((failed_count + 1))
     fi
   fi
 done
@@ -189,14 +219,8 @@ echo ""
 echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
 
 if [[ "$DRY_RUN" == true ]]; then
-  log_info "Dry run complete. $stale_count branch(es) would be deleted."
+  log_info "Dry run complete. ${#merged_branches[@]} branch(es) would be deleted."
 else
+  log_success "Deleted $deleted_count branch(es); $failed_count failed."
   log_success "Branch cleanup complete for $REPO"
-  echo ""
-
-  # Show remaining branches
-  log_info "Remaining branches:"
-  gh api "repos/$REPO/branches" --paginate --jq '.[].name' | sort | while read -r branch; do
-    echo "  - $branch"
-  done
 fi

package/scripts/cleanup-local-merged-branches.sh

@@ -0,0 +1,110 @@
+#!/bin/bash
+#
+# Cleanup Local Merged Branches
+#
+# Deletes local branches that are safe to remove:
+#   - Branches whose upstream was deleted on the remote ("gone" — the usual
+#     aftermath of delete-branch-on-merge), AND
+#   - Branches fully merged into an environment branch (main/dev/staging)
+#
+# Never touches:
+#   - The currently checked-out branch
+#   - Environment branches (main, dev, staging) or the default branch
+#   - Branches checked out in a linked worktree (git refuses; reported)
+#   - Unmerged branches (uses safe `git branch -d`)
+#
+# Usage:
+#   ./scripts/cleanup-local-merged-branches.sh [--dry-run] [repo-path]
+#
+set -euo pipefail
+
+PROTECTED_BRANCHES=("main" "dev" "staging")
+
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+CYAN='\033[0;36m'
+RED='\033[0;31m'
+NC='\033[0m'
+
+log_info() { echo -e "${BLUE}[INFO]${NC} $1"; }
+log_success() { echo -e "${GREEN}[SUCCESS]${NC} $1"; }
+log_warning() { echo -e "${YELLOW}[WARNING]${NC} $1"; }
+log_dry_run() { echo -e "${CYAN}[DRY-RUN]${NC} Would delete: $1"; }
+
+DRY_RUN=false
+REPO_PATH="."
+for arg in "$@"; do
+  case "$arg" in
+    --dry-run) DRY_RUN=true ;;
+    -h|--help) sed -n '2,20p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;;
+    *) REPO_PATH="$arg" ;;
+  esac
+done
+
+cd "$REPO_PATH"
+if ! git rev-parse --git-dir > /dev/null 2>&1; then
+  echo -e "${RED}[ERROR]${NC} Not a git repository: $REPO_PATH" >&2
+  exit 1
+fi
+
+CURRENT_BRANCH=$(git branch --show-current || echo "")
+DEFAULT_BRANCH=$(git symbolic-ref --short refs/remotes/origin/HEAD 2>/dev/null | sed 's#^origin/##' || echo "main")
+PROTECTED_BRANCHES+=("$DEFAULT_BRANCH")
+
+is_protected() {
+  local branch="$1"
+  [[ "$branch" == "$CURRENT_BRANCH" ]] && return 0
+  for protected in "${PROTECTED_BRANCHES[@]}"; do
+    [[ "$branch" == "$protected" ]] && return 0
+  done
+  return 1
+}
+
+log_info "Fetching and pruning remote-tracking references..."
+git fetch --prune --quiet
+
+# Candidates, deduped: gone-upstream branches + branches merged into any
+# environment branch that exists on the remote.
+candidates=$(
+  {
+    git branch --format '%(refname:short) %(upstream:track)' \
+      | awk '$2 == "[gone]" {print $1}'
+    for env_branch in main dev staging; do
+      if git show-ref --verify --quiet "refs/remotes/origin/$env_branch"; then
+        git branch --merged "origin/$env_branch" --format '%(refname:short)'
+      fi
+    done
+  } | sort -u
+)
+
+deleted=0
+kept=0
+while IFS= read -r branch; do
+  [[ -z "$branch" ]] && continue
+  if is_protected "$branch"; then
+    continue
+  fi
+
+  if [[ "$DRY_RUN" == true ]]; then
+    log_dry_run "$branch"
+    deleted=$((deleted + 1))
+    continue
+  fi
+
+  # Safe delete only: -d refuses unmerged branches and worktree checkouts.
+  if git branch -d "$branch" > /dev/null 2>&1; then
+    log_success "Deleted: $branch"
+    deleted=$((deleted + 1))
+  else
+    log_warning "Kept (unmerged or checked out in a worktree): $branch"
+    kept=$((kept + 1))
+  fi
+done <<< "$candidates"
+
+echo ""
+if [[ "$DRY_RUN" == true ]]; then
+  log_info "Dry run complete. $deleted branch(es) would be deleted."
+else
+  log_success "Deleted $deleted branch(es); kept $kept."
+fi

package/scripts/cleanup-worktrees.sh

@@ -0,0 +1,222 @@
+#!/bin/bash
+#
+# cleanup-worktrees.sh — safely remove merged/abandoned linked git worktrees
+# for ONE repository (the repo-level counterpart of a workspace-wide
+# agent-worktree sweep).
+#
+# SAFETY MODEL — a worktree is only removed when ALL of these hold:
+#   1. It is a LINKED worktree (never the main checkout).
+#   2. Its path matches a known agent-worktree location (.claude/worktrees,
+#      ~/.codex/worktrees, .lisa-worktrees, /tmp) OR its branch matches an
+#      agent naming pattern (claude/*, worktree-*, codex/*) OR its branch is
+#      fully merged into an environment branch (main/dev/staging).
+#   3. No modified/staged TRACKED files ("real work" is never deleted).
+#   4. Its HEAD commit is reachable from some remote ref (nothing unpushed).
+#   5. It is older than --min-age-days (default 7) by directory mtime.
+#   Untracked-only dirt (node_modules, .env.local, build output) blocks
+#   removal by default; pass --force-untracked to treat it as junk.
+#
+# DRY-RUN BY DEFAULT. Nothing is deleted until you pass --apply.
+#
+# Usage:
+#   cleanup-worktrees.sh [options] [repo-path]
+#     --apply              actually remove (default: dry-run report)
+#     --force-untracked    also remove worktrees whose only dirt is untracked files
+#     --min-age-days N     minimum age (dir mtime) to touch anything (default 7)
+#     --delete-branches    after removing a worktree, delete its branch when
+#                          its commits are on a remote
+#
+set -uo pipefail
+
+APPLY=0
+FORCE_UNTRACKED=0
+MIN_AGE_DAYS=7
+DELETE_BRANCHES=0
+REPO="."
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --apply) APPLY=1 ;;
+    --force-untracked) FORCE_UNTRACKED=1 ;;
+    --min-age-days)
+      shift
+      if [ $# -eq 0 ]; then
+        echo "ERROR: --min-age-days requires a value" >&2
+        exit 1
+      fi
+      MIN_AGE_DAYS="$1" ;;
+    --delete-branches) DELETE_BRANCHES=1 ;;
+    -h|--help) sed -n '2,30p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;;
+    *) REPO="$1" ;;
+  esac
+  shift
+done
+
+REPO="$(cd "$REPO" && pwd)"
+if ! git -C "$REPO" rev-parse --git-dir > /dev/null 2>&1; then
+  echo "ERROR: not a git repository: $REPO" >&2
+  exit 1
+fi
+
+NOW=$(date +%s)
+MIN_AGE_SECS=$((MIN_AGE_DAYS * 86400))
+REMOVED=0 KEPT_DIRTY=0 KEPT_UNPUSHED=0 KEPT_YOUNG=0 KEPT_UNTRACKED=0 ORPHANS=0 ERRORS=0
+
+log() { printf '%s\n' "$*"; }
+act() { if [ "$APPLY" = 1 ]; then log "REMOVE  $*"; else log "WOULD-REMOVE  $*"; fi; }
+
+is_agent_path() {
+  case "$1" in
+    */.claude/worktrees/*|"$HOME"/.codex/worktrees/*|*/.lisa-worktrees/*|*/.lisa-update-*/*|/tmp/*|/private/tmp/*) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+is_agent_branch() {
+  case "$1" in
+    claude/*|worktree-*|codex/*) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+is_env_branch() {
+  case "$1" in
+    main|dev|staging) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+# Branch is fully merged into an environment branch on the remote.
+branch_is_merged() {
+  local branch="$1" env_branch
+  [ -z "$branch" ] && return 1
+  for env_branch in main dev staging; do
+    if git -C "$REPO" show-ref --verify --quiet "refs/remotes/origin/$env_branch"; then
+      if git -C "$REPO" merge-base --is-ancestor "refs/heads/$branch" "refs/remotes/origin/$env_branch" 2>/dev/null; then
+        return 0
+      fi
+    fi
+  done
+  return 1
+}
+
+head_is_pushed() {
+  local wt="$1" sha
+  sha=$(git -C "$wt" rev-parse HEAD 2>/dev/null) || return 1
+  [ -n "$(git -C "$wt" branch -r --contains "$sha" 2>/dev/null | head -1)" ]
+}
+
+dir_age_ok() {
+  # GNU stat first: on Linux, `stat -f %m` succeeds but prints the MOUNT POINT
+  # (filesystem mode), which would poison the mtime arithmetic. BSD/macOS stat
+  # has no -c, so it falls through to -f %m (mtime there).
+  local mtime
+  mtime=$(stat -c %Y "$1" 2>/dev/null || stat -f %m "$1" 2>/dev/null) || return 1
+  case "$mtime" in
+    ''|*[!0-9]*) return 1 ;;
+  esac
+  [ $((NOW - mtime)) -ge "$MIN_AGE_SECS" ]
+}
+
+process_worktree() {
+  local wt="$1" branch="$2"
+
+  # Never remove a worktree sitting on an environment branch.
+  if [ -n "$branch" ] && is_env_branch "$branch"; then
+    return
+  fi
+
+  # Eligibility gate: agent location, agent branch, or a merged branch.
+  if ! is_agent_path "$wt" && ! is_agent_branch "$branch" && ! branch_is_merged "$branch"; then
+    return
+  fi
+
+  if ! dir_age_ok "$wt"; then
+    KEPT_YOUNG=$((KEPT_YOUNG + 1))
+    log "KEEP (younger than ${MIN_AGE_DAYS}d)  $wt"
+    return
+  fi
+
+  if [ -n "$(git -C "$wt" status --porcelain --untracked-files=no 2>/dev/null)" ]; then
+    KEPT_DIRTY=$((KEPT_DIRTY + 1))
+    log "KEEP (modified tracked files)  $wt"
+    return
+  fi
+
+  if ! head_is_pushed "$wt"; then
+    KEPT_UNPUSHED=$((KEPT_UNPUSHED + 1))
+    log "KEEP (HEAD not on any remote — possible unpushed work)  $wt"
+    return
+  fi
+
+  local force_flag=()
+  if [ -n "$(git -C "$wt" status --porcelain 2>/dev/null)" ]; then
+    if [ "$FORCE_UNTRACKED" = 1 ]; then
+      force_flag=(--force)
+    else
+      KEPT_UNTRACKED=$((KEPT_UNTRACKED + 1))
+      log "KEEP (untracked files only — rerun with --force-untracked)  $wt"
+      return
+    fi
+  fi
+
+  act "$wt  [branch: ${branch:-detached}]"
+  if [ "$APPLY" = 1 ]; then
+    if git -C "$REPO" worktree remove "${force_flag[@]}" "$wt" 2>/dev/null; then
+      REMOVED=$((REMOVED + 1))
+      if [ "$DELETE_BRANCHES" = 1 ] && [ -n "$branch" ] && ! is_env_branch "$branch"; then
+        git -C "$REPO" branch -D "$branch" >/dev/null 2>&1 || true
+      fi
+    else
+      ERRORS=$((ERRORS + 1))
+      log "ERROR removing  $wt"
+    fi
+  else
+    REMOVED=$((REMOVED + 1))
+  fi
+}
+
+log "=== cleanup-worktrees: $([ "$APPLY" = 1 ] && echo APPLY || echo DRY-RUN) (repo: $REPO, min age ${MIN_AGE_DAYS}d) ==="
+
+git -C "$REPO" fetch --prune --quiet 2>/dev/null || true
+git -C "$REPO" worktree prune 2>/dev/null
+
+MAIN_WT=$(git -C "$REPO" worktree list --porcelain | head -1 | sed 's/^worktree //')
+
+wt="" branch="" first=1
+while IFS= read -r line; do
+  case "$line" in
+    worktree\ *)
+      wt="${line#worktree }" branch="" ;;
+    branch\ *)
+      branch="${line#branch refs/heads/}" ;;
+    "")
+      if [ "$first" = 1 ]; then first=0; else
+        [ -d "$wt" ] && [ "$wt" != "$MAIN_WT" ] && process_worktree "$wt" "$branch"
+      fi
+      wt="" ;;
+  esac
+done < <(git -C "$REPO" worktree list --porcelain; echo)
+
+# Orphan directories under .claude/worktrees that git no longer tracks.
+wtroot="$REPO/.claude/worktrees"
+if [ -d "$wtroot" ]; then
+  for d in "$wtroot"/*/; do
+    d=${d%/}
+    [ -d "$d" ] || continue
+    if ! git -C "$REPO" worktree list --porcelain | grep -qF "worktree $d"; then
+      if dir_age_ok "$d"; then
+        ORPHANS=$((ORPHANS + 1))
+        act "(orphan dir, not a registered worktree)  $d"
+        [ "$APPLY" = 1 ] && rm -rf "$d"
+      fi
+    fi
+  done
+fi
+
+log ""
+log "=== summary ==="
+log "removed (or would remove): $REMOVED   orphan dirs: $ORPHANS"
+log "kept: $KEPT_DIRTY modified-tracked, $KEPT_UNPUSHED unpushed, $KEPT_UNTRACKED untracked-only, $KEPT_YOUNG too-young   errors: $ERRORS"
+[ "$APPLY" = 0 ] && log "(dry run — rerun with --apply to delete)"
+exit 0