@dylanpiercey/work 0.0.222 → 0.1.0

package/scripts/migrate.mjs

@@ -1,824 +0,0 @@
-#!/usr/bin/env node
-// migrate.mjs — one-shot cleanups for changes between versions, run by
-// `work setup` and `work migrate` (update.sh) so the runtime stays free of
-// legacy handling.
-import crypto from "node:crypto";
-import { execFileSync } from "node:child_process";
-import fs from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import { DatabaseSync } from "node:sqlite";
-import { dialHost } from "../lib/setup/listen.mjs";
-
-const dataDir =
-  process.env.WORK_DATA_DIR ||
-  path.join(
-    process.env.XDG_DATA_HOME || path.join(os.homedir(), ".local", "share"),
-    "work",
-  );
-const dbPath = path.join(dataDir, "work.db");
-
-// Machine repairs that need no db come first: a fresh install, or one whose
-// data dir this environment does not name, stops at the check below.
-
-// `gh auth setup-git` bakes the absolute path of the gh binary into
-// ~/.gitconfig, and git runs that string literally rather than looking gh up
-// on PATH. Where gh came from a version manager that path dies on the next gh
-// upgrade, and every https push fails with "could not read Username" — a
-// break with no visible cause, since `gh` itself still works. Repoint any
-// helper naming a gh that no longer exists at the launcher on PATH.
-{
-  const versioned = /\/(installs|Cellar|versions|toolchains)\//;
-  const git = (args) => execFileSync("git", args, { encoding: "utf8" }).trim();
-  try {
-    let gh = "";
-    try {
-      // Quietly: with no gh there is nothing to repair, and this runs on
-      // every setup, fresh installs included.
-      gh = execFileSync("which", ["gh"], {
-        encoding: "utf8",
-        stdio: ["ignore", "pipe", "ignore"],
-      }).trim();
-    } catch {}
-    if (gh && !versioned.test(gh)) {
-      let lines = [];
-      try {
-        lines = git([
-          "config",
-          "--global",
-          "--get-regexp",
-          String.raw`^credential\..*\.helper$`,
-        ])
-          .split("\n")
-          .filter(Boolean);
-      } catch {} // no such entries — nothing to repair
-      let fixed = 0;
-      for (const line of lines) {
-        const sp = line.indexOf(" ");
-        const [key, value] = [line.slice(0, sp), line.slice(sp + 1)];
-        const bin = /^!(\S+) auth git-credential$/.exec(value)?.[1];
-        if (!bin || bin === gh || fs.existsSync(bin)) continue;
-        git([
-          "config",
-          "--global",
-          "--replace-all",
-          key,
-          `!${gh} auth git-credential`,
-          "auth git-credential",
-        ]);
-        fixed++;
-      }
-      if (fixed)
-        console.log(
-          `==> migrate: repaired ${fixed} stale gh credential helper(s)`,
-        );
-    }
-  } catch {}
-}
-
-// Grok's hook registry ($GROK_HOME/hooks-paths) names work's hook file by
-// absolute path. A line left by a data dir since moved or removed (a
-// scratch server's temp dir, an uninstall) names nothing, and Grok's
-// sandbox refuses to start while one does. The app drops them as it
-// registers; this reaches machines that stopped launching Grok. Keep in
-// sync with registerHooks in src/agents/grok/index.ts.
-{
-  try {
-    const registry = path.join(
-      process.env.GROK_HOME || path.join(os.homedir(), ".grok"),
-      "hooks-paths",
-    );
-    const current = fs.readFileSync(registry, "utf8");
-    const lines = current.split("\n");
-    const kept = lines.filter((line) => {
-      const target = line.trim();
-      return !target.endsWith("/grok-hooks.json") || fs.existsSync(target);
-    });
-    if (kept.length !== lines.length) {
-      fs.writeFileSync(registry, kept.join("\n"));
-      console.log(
-        `==> migrate: dropped ${lines.length - kept.length} stale Grok hook registry line(s)`,
-      );
-    }
-  } catch {} // no registry — nothing to clean
-}
-
-if (!fs.existsSync(dbPath)) process.exit(0);
-const db = new DatabaseSync(dbPath, { readOnly: true });
-
-/** A write connection that waits out the running server's transactions, as
- * db.ts does: setup and update.sh migrate while the old server still runs,
- * and a lock thrown here would end the script before every later sweep. */
-function writer() {
-  const wr = new DatabaseSync(dbPath);
-  wr.exec("PRAGMA busy_timeout = 5000");
-  return wr;
-}
-
-// Pre-scrape versions wrote agent hook files into every workspace
-// (identified by their agent-state callback); state now comes from
-// terminal scraping and launch flags, so sweep them out.
-const LEGACY_HOOK_FILES = [
-  ".claude/settings.json",
-  ".codex/hooks.json",
-  ".cursor/hooks.json",
-  ".cursor/hooks/work-working.sh",
-  ".cursor/hooks/work-done.sh",
-  ".github/hooks/work-agent-state.json",
-];
-
-let removed = 0;
-for (const { path: wsPath } of db
-  .prepare("SELECT path FROM workspaces")
-  .all()) {
-  for (const rel of LEGACY_HOOK_FILES) {
-    const file = path.join(wsPath, rel);
-    try {
-      const text = fs.readFileSync(file, "utf8");
-      if (
-        !text.includes("/api/agent-state") &&
-        !text.includes(".cursor/hooks/work-")
-      ) {
-        continue;
-      }
-      fs.rmSync(file);
-      removed++;
-      // Prune now-empty dirs the old version created.
-      for (
-        let dir = path.dirname(file);
-        dir !== wsPath && !fs.readdirSync(dir).length;
-        dir = path.dirname(dir)
-      ) {
-        fs.rmdirSync(dir);
-      }
-    } catch {}
-  }
-}
-if (removed) console.log(`==> migrate: removed ${removed} legacy hook file(s)`);
-
-// A workspace's AGENTS.md is only rewritten when its repos change, so
-// existing ones never learn that the stash is shared between worktrees of
-// the same bare cache. Splice the bullet in ahead of the push one (keep in
-// sync with writeAgentsMd in src/server/workspaces.ts).
-const STASH_BULLET =
-  "- **No `git stash`:** every workspace using a repo shares one stash stack, so\n" +
-  "  a pop can take another workspace's work. Commit WIP to your branch instead.\n";
-let noted = 0;
-for (const { path: wsPath } of db
-  .prepare("SELECT path FROM workspaces")
-  .all()) {
-  const file = path.join(wsPath, "AGENTS.md");
-  try {
-    const text = fs.readFileSync(file, "utf8");
-    const at = text.indexOf("- **Push:**");
-    if (at < 0 || text.includes("git stash")) continue;
-    fs.writeFileSync(file, text.slice(0, at) + STASH_BULLET + text.slice(at));
-    noted++;
-  } catch {}
-}
-if (noted)
-  console.log(`==> migrate: noted the shared stash in ${noted} AGENTS.md`);
-
-// The review is commit-to-commit by default; fold that into the stash
-// bullet rather than appending another one. Keep in sync with writeAgentsMd.
-const OLD_STASH_END = "Commit WIP to your branch instead.";
-const NEW_STASH_END =
-  "Commit as you go — uncommitted work isn't part of the review.";
-let restated = 0;
-for (const { path: wsPath } of db
-  .prepare("SELECT path FROM workspaces")
-  .all()) {
-  const file = path.join(wsPath, "AGENTS.md");
-  try {
-    const text = fs.readFileSync(file, "utf8");
-    if (!text.includes(OLD_STASH_END)) continue;
-    fs.writeFileSync(file, text.replace(OLD_STASH_END, NEW_STASH_END));
-    restated++;
-  } catch {}
-}
-if (restated)
-  console.log(
-    `==> migrate: restated the stash bullet in ${restated} AGENTS.md`,
-  );
-
-// Same rewrite-on-create-only problem: existing AGENTS.md never learn to
-// rebase after a squash-merge. Keep in sync with writeAgentsMd.
-const REBASE_BULLET =
-  "- **Rebase after merge:** when `origin/<base>` (or a stacked parent) moves,\n" +
-  "  rebase onto it. A squash-merge does not move the fork point, so the review\n" +
-  "  keeps showing landed work until you do.\n";
-let rebased = 0;
-for (const { path: wsPath } of db
-  .prepare("SELECT path FROM workspaces")
-  .all()) {
-  const file = path.join(wsPath, "AGENTS.md");
-  try {
-    const text = fs.readFileSync(file, "utf8");
-    const at = text.indexOf("- **PRs:**");
-    if (at < 0 || text.includes("Rebase after merge")) continue;
-    fs.writeFileSync(file, text.slice(0, at) + REBASE_BULLET + text.slice(at));
-    rebased++;
-  } catch {}
-}
-if (rebased)
-  console.log(`==> migrate: noted rebase-after-merge in ${rebased} AGENTS.md`);
-
-// Branch rules: stay on the workspace branch; reset it after it lands;
-// topic lanes only when that branch must stay open. Replaces both the
-// original "cut a lane per PR" parallel text and the later "need more
-// than one? stack" wording. Keep in sync with writeAgentsMd.
-let restatedBranches = 0;
-for (const { path: wsPath } of db
-  .prepare("SELECT path FROM workspaces")
-  .all()) {
-  const file = path.join(wsPath, "AGENTS.md");
-  try {
-    let text = fs.readFileSync(file, "utf8");
-    const found = text.match(/Workspace branch: \*\*`([^`]+)`\*\*/);
-    if (!found || text.includes("must stay unmerged")) continue;
-    const branch = found[1];
-    const branches =
-      `- **Branches:** stay on \`${branch}\` and keep pushing it — one open PR, more\n` +
-      `  commits. After it lands, \`git fetch\` and reset \`${branch}\` to\n` +
-      `  \`origin/<base>\` so the next change reuses this branch. Do not cut a\n` +
-      `  \`${branch}-<topic>\` just to start the next piece of work.\n` +
-      `  A topic lane is only for when \`${branch}\` must stay unmerged (a larger\n` +
-      `  change) and you need a second PR on top of it. Then push every repo's\n` +
-      `  workspace branch first, cut from the parent —\n` +
-      `  \`git switch -c ${branch}-<topic> origin/${branch}\` — and keep the prefix.\n` +
-      `  Only two levels: never \`${branch}-a-b\`. Tooling finds PRs by that prefix,\n` +
-      `  so a branch named anything else is invisible: never invent one.\n`;
-    const rebase =
-      `- **Rebase after merge:** when \`${branch}\` is still open and \`origin/<base>\`\n` +
-      "  moves, rebase onto it — a squash-merge does not move the fork point, so the\n" +
-      "  review keeps showing landed work until you do. On a topic lane, rebase onto\n" +
-      `  \`${branch}\` when the parent moves; after the parent merges: \`git fetch\n` +
-      "  --prune`, rebase onto `origin/<base>`, and retarget (`gh pr edit --base\n" +
-      "  <base>`).\n";
-    const prs =
-      "- **PRs:** the description covers only what is in the diff — a few sentences on\n" +
-      "  what changed and why. No verification logs or file-by-file detail. A topic\n" +
-      `  lane's PR is \`gh pr create --base ${branch}\` — GitHub will otherwise target\n` +
-      "  the repo default, and the local review will disagree with the files tab.\n";
-    const next = text
-      .replace(/- \*\*Branches:\*\*[\s\S]*?never invent one.\n/, branches)
-      .replace(/- \*\*PRs:\*\*[\s\S]*?file-by-file detail\.\n/, prs);
-    const withRebase = next.includes("- **Rebase after merge:**")
-      ? next.replace(
-          /- \*\*Rebase after merge:\*\*[\s\S]*?(?:until you do|<base>`\)\.)\n/,
-          rebase,
-        )
-      : next;
-    if (withRebase === text) continue;
-    fs.writeFileSync(file, withRebase);
-    restatedBranches++;
-  } catch {}
-}
-if (restatedBranches) {
-  console.log(
-    `==> migrate: restated branch rules in ${restatedBranches} AGENTS.md`,
-  );
-}
-
-// Topic lanes come in two kinds: stacked on the workspace branch, or
-// independent, cut from the base (a separate fix that lands on its own).
-// Existing AGENTS.md only describe stacked lanes, whose PR targets the
-// workspace branch. Keep in sync with writeAgentsMd.
-let twoLaneKinds = 0;
-for (const { path: wsPath } of db
-  .prepare("SELECT path FROM workspaces")
-  .all()) {
-  const file = path.join(wsPath, "AGENTS.md");
-  try {
-    const text = fs.readFileSync(file, "utf8");
-    const found = text.match(/Workspace branch: \*\*`([^`]+)`\*\*/);
-    if (!found || text.includes("**Independent**")) continue;
-    const branch = found[1];
-    const lanes =
-      "  A topic lane is a second change beside it, and is one of two kinds.\n" +
-      `  **Stacked**: it needs \`${branch}\`, which must stay unmerged (a larger\n` +
-      "  change). Push every repo's workspace branch first, then cut from it\n" +
-      `  (\`git switch -c ${branch}-<topic> origin/${branch}\`).\n` +
-      "  **Independent**: it stands on its own and can land before or without\n" +
-      `  \`${branch}\` (a separate fix found along the way). Cut from the base\n` +
-      `  (\`git switch -c ${branch}-<topic> origin/<base>\`).\n` +
-      "  Keep the prefix either way: tooling finds branches by it and tells the\n" +
-      "  two kinds apart from their history, so a branch named anything else is\n" +
-      `  invisible: never invent one. Only two levels: never \`${branch}-a-b\`.\n`;
-    const rebaseLanes =
-      "An independent lane\n" +
-      "  rebases onto `origin/<base>` the same way. A stacked lane rebases onto\n" +
-      `  \`${branch}\` when the parent moves; after the parent merges: \`git fetch\n` +
-      "  --prune`, rebase onto `origin/<base>`, and retarget (`gh pr edit --base\n" +
-      "  <base>`).\n";
-    const prLanes =
-      "A stacked\n" +
-      `  lane's PR is \`gh pr create --base ${branch}\`: GitHub would otherwise\n` +
-      "  target the repo default, and the local review would disagree with the\n" +
-      "  files tab. An independent lane's PR targets the base, GitHub's default.\n";
-    const next = text
-      // The lane sentences of the branch bullet, up to its last line.
-      .replace(
-        /  A topic lane is only for when[\s\S]*?never invent one\.\n/,
-        lanes,
-      )
-      .replace(
-        /On a topic lane, rebase onto\n[\s\S]*?<base>`\)\.\n/,
-        rebaseLanes,
-      )
-      .replace(
-        /A topic\n  lane's PR is `gh pr create --base [^`]+`[\s\S]*?files tab\.\n/,
-        prLanes,
-      );
-    if (next === text) continue;
-    fs.writeFileSync(file, next);
-    twoLaneKinds++;
-  } catch {}
-}
-if (twoLaneKinds) {
-  console.log(
-    `==> migrate: described independent lanes in ${twoLaneKinds} AGENTS.md`,
-  );
-}
-
-// Default review base/algorithm changed (workspace branch vs origin/<base>,
-// containment empty-check, then commit-to-commit). Existing comments and
-// viewed flags are keyed only by path+line, so they would silently
-// re-anchor. Wipe once — this script runs on every update. db.ts sets the
-// flag on a db it creates, which has no such comments to wipe.
-{
-  const wr = writer();
-  try {
-    const FLAG = "review-cleared-diff-v2";
-    const seen = wr.prepare("SELECT 1 FROM settings WHERE key = ?").get(FLAG);
-    if (!seen) {
-      const comments = wr.prepare("DELETE FROM review_comments").run();
-      const viewed = wr.prepare("DELETE FROM review_viewed").run();
-      wr.prepare("INSERT INTO settings (key, value) VALUES (?, '1')").run(FLAG);
-      if (comments.changes || viewed.changes) {
-        console.log(
-          `==> migrate: cleared ${comments.changes} review comment(s) and ${viewed.changes} viewed flag(s)`,
-        );
-      }
-    }
-  } finally {
-    wr.close();
-  }
-}
-
-// The review flagged what moved since the reviewer's last visit, from a
-// head per section kept in `review.seen:<ws>`. Viewed marks replace it
-// (review_marks, src/server/viewed.ts): each head becomes a visit to its
-// section's branch, which the server turns into per-file marks at that
-// head when it next shows the section (a PR's under `#<number>`, the
-// only name its section had). The working-tree hashes beside the heads
-// name no branch's change and go. So does the table of the flags the
-// sweep above cleared, which nothing reads.
-{
-  const wr = writer();
-  try {
-    // Keep in sync with src/server/db.ts: the server running this update
-    // may predate the table.
-    wr.exec(`CREATE TABLE IF NOT EXISTS review_marks (
-      workspace_id TEXT NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
-      worktree TEXT NOT NULL,
-      branch TEXT NOT NULL,
-      path TEXT NOT NULL,
-      fingerprint TEXT NOT NULL,
-      PRIMARY KEY (workspace_id, worktree, branch, path)
-    )`);
-    const insert = wr.prepare(
-      "INSERT OR IGNORE INTO review_marks (workspace_id, worktree, branch, path, fingerprint) VALUES (?, ?, ?, '', ?)",
-    );
-    let visits = 0;
-    for (const { key, value } of wr
-      .prepare("SELECT key, value FROM settings WHERE key GLOB 'review.seen:*'")
-      .all()) {
-      const id = key.slice("review.seen:".length);
-      const ws = wr
-        .prepare("SELECT branch FROM workspaces WHERE id = ?")
-        .get(id);
-      let heads = {};
-      try {
-        heads = JSON.parse(value)?.heads ?? {};
-      } catch {}
-      for (const [section, head] of Object.entries(ws ? heads : {})) {
-        // `worktree`, `worktree@topic` or `worktree#pr`.
-        const m = /^([^@#]+)(?:@(.+)|#(\d+))?$/.exec(section);
-        if (!m || typeof head !== "string" || !/^[0-9a-f]{40,64}$/.test(head))
-          continue;
-        const branch = m[2]
-          ? `${ws.branch}-${m[2]}`
-          : m[3]
-            ? `#${m[3]}`
-            : ws.branch;
-        insert.run(id, m[1], branch, `seen:${head}`);
-        visits++;
-      }
-      wr.prepare("DELETE FROM settings WHERE key = ?").run(key);
-    }
-    if (visits)
-      console.log(
-        `==> migrate: carried ${visits} review visit(s) over to Viewed marks`,
-      );
-    wr.exec("DROP TABLE IF EXISTS review_viewed");
-  } finally {
-    wr.close();
-  }
-}
-
-// Backfill the push-signal hook into bare caches that predate it (new
-// caches get it from ensureBare — keep this script in sync with
-// src/server/repo-events.ts).
-const workRoot = process.env.WORK_ROOT || path.join(os.homedir(), "work");
-const gitHost = "github.com";
-const appPort = Number(process.env.WORK_APP_PORT || 7171);
-// Same token file the server uses (src/server/hook-token.ts) — hooks ride
-// the public port and the endpoint refuses pings without it. dataDir is
-// declared at the top of this script.
-const tokenFile = path.join(dataDir, "hook-token");
-let hookTokenValue = "";
-try {
-  hookTokenValue = fs.readFileSync(tokenFile, "utf8").trim();
-} catch {}
-if (!hookTokenValue) {
-  hookTokenValue = crypto.randomBytes(16).toString("hex");
-  fs.mkdirSync(dataDir, { recursive: true });
-  fs.writeFileSync(tokenFile, `${hookTokenValue}\n`, { mode: 0o600 });
-}
-const cacheHost = path.join(workRoot, ".cache", gitHost);
-let hooked = 0;
-try {
-  for (const owner of fs.readdirSync(cacheHost)) {
-    const ownerDir = path.join(cacheHost, owner);
-    for (const repoDir of fs.readdirSync(ownerDir)) {
-      if (!repoDir.endsWith(".git")) continue;
-      const fullName = `${owner}/${repoDir.slice(0, -4)}`;
-      const script =
-        `#!/bin/sh\n` +
-        `# installed by work: signals ref updates to the app server.\n` +
-        `[ "$1" = "committed" ] || exit 0\n` +
-        `refs=$(cat)\n` +
-        `case "$refs" in *"refs/remotes/origin/"*) ;; *) exit 0 ;; esac\n` +
-        `printf '%s\\n' "$refs" | curl -sf -m 2 -X POST --data-binary @- "http://${dialHost(process.env.WORK_LISTEN)}:${appPort}` +
-        `/api/repo-pushed?repo=${encodeURIComponent(fullName)}&token=${hookTokenValue}" >/dev/null 2>&1 &\n` +
-        `exit 0\n`;
-      const file = path.join(
-        ownerDir,
-        repoDir,
-        "hooks",
-        "reference-transaction",
-      );
-      try {
-        if (fs.readFileSync(file, "utf8") === script) continue;
-      } catch {}
-      try {
-        fs.mkdirSync(path.dirname(file), { recursive: true });
-        fs.writeFileSync(file, script, { mode: 0o755 });
-        hooked++;
-      } catch {}
-    }
-  }
-} catch {}
-if (hooked)
-  console.log(`==> migrate: installed push hook in ${hooked} cache repo(s)`);
-
-// Lane branches used to accumulate in the bare caches: nothing deleted one
-// when its PR finished, only removing the repo or the whole workspace did,
-// and a long-lived workspace here reached 66 of them against a single live
-// branch. The app now prunes a lane when its merged PR is dismissed (see
-// pruneLaneBranch in src/server/workspaces.ts), which only reaches lanes
-// finished from here on — so sweep the backlog once, with the same guards.
-// Best-effort: without gh, a token, or the network this does nothing.
-const laneWorkspaces = db
-  .prepare("SELECT id, branch FROM workspaces")
-  .all()
-  .map((w) => ({ ...w, repos: [] }));
-for (const row of db
-  .prepare("SELECT workspace_id, full_name FROM repos")
-  .all()) {
-  laneWorkspaces
-    .find((w) => w.id === row.workspace_id)
-    ?.repos.push(row.full_name);
-}
-const ownsRef = (ref, prefix) => ref === prefix || ref.startsWith(`${prefix}-`);
-const gitIn = (dir, args) =>
-  execFileSync("git", ["-C", dir, ...args], {
-    encoding: "utf8",
-    stdio: ["ignore", "pipe", "ignore"],
-  });
-
-// Candidate lanes: owned by a workspace branch, not the branch itself, not
-// claimed by another workspace whose branch extends this one's prefix, and
-// not checked out in a worktree.
-const candidates = [];
-for (const ws of laneWorkspaces) {
-  const others = laneWorkspaces
-    .filter((w) => w.id !== ws.id)
-    .map((w) => w.branch);
-  for (const fullName of ws.repos) {
-    const bare = path.join(cacheHost, `${fullName}.git`);
-    let refs, checkedOut;
-    try {
-      refs = gitIn(bare, [
-        "for-each-ref",
-        "--format=%(refname:short) %(objectname)",
-        "refs/heads/",
-      ])
-        .split("\n")
-        .filter(Boolean)
-        .map((line) => line.split(" "));
-      checkedOut = new Set(
-        gitIn(bare, ["worktree", "list", "--porcelain"])
-          .split("\n")
-          .filter((l) => l.startsWith("branch refs/heads/"))
-          .map((l) => l.slice("branch refs/heads/".length)),
-      );
-    } catch {
-      continue;
-    }
-    for (const [lane, oid] of refs) {
-      if (lane === ws.branch || !ownsRef(lane, ws.branch)) continue;
-      if (others.some((b) => ownsRef(lane, b)) || checkedOut.has(lane))
-        continue;
-      candidates.push({ bare, fullName, lane, oid });
-    }
-  }
-}
-
-let pruned = 0;
-for (let i = 0; i < candidates.length; i += 40) {
-  const chunk = candidates.slice(i, i + 40);
-  // One aliased query per chunk rather than a request per lane.
-  const query =
-    "query {" +
-    chunk
-      .map(({ fullName, lane }, n) => {
-        const [owner, name] = fullName.split("/");
-        return (
-          `l${n}: repository(owner: ${JSON.stringify(owner)}, name: ${JSON.stringify(name)}) {` +
-          ` pullRequests(headRefName: ${JSON.stringify(lane)}, first: 5) {` +
-          " nodes { state headRefOid } } }"
-        );
-      })
-      .join(" ") +
-    "}";
-  let data;
-  try {
-    data = JSON.parse(
-      execFileSync("gh", ["api", "graphql", "-f", `query=${query}`], {
-        encoding: "utf8",
-        stdio: ["ignore", "pipe", "ignore"],
-      }),
-    ).data;
-  } catch {
-    break;
-  }
-  chunk.forEach((c, n) => {
-    const nodes = data?.[`l${n}`]?.pullRequests?.nodes;
-    if (!nodes?.length || nodes.some((p) => p.state === "OPEN")) return;
-    // The lane has to still be sitting on the finished PR's head: anything
-    // further along is work that PR never carried, and deleting it here
-    // would be the only copy.
-    if (!nodes.some((p) => p.state !== "OPEN" && p.headRefOid === c.oid))
-      return;
-    try {
-      gitIn(c.bare, ["branch", "-D", c.lane]);
-      pruned++;
-    } catch {}
-  });
-}
-if (pruned)
-  console.log(`==> migrate: pruned ${pruned} finished lane branch(es)`);
-
-// Caches made with `git clone --bare` (every cache before init+fetch in
-// ensureBare) copied each remote branch into refs/heads, so a cache carries
-// every branch anyone ever pushed as a local head of its own. Drop the
-// mirrors: a head that no worktree checks out, no workspace here owns,
-// and that still sits exactly on its origin counterpart — the last guard
-// keeps anything with local-only commits, whoever made it.
-const ownedPrefixes = db
-  .prepare("SELECT branch FROM workspaces")
-  .all()
-  .map((w) => w.branch);
-let mirrors = 0;
-try {
-  const cacheRoot = path.join(workRoot, ".cache");
-  for (const host of fs.readdirSync(cacheRoot)) {
-    const hostDir = path.join(cacheRoot, host);
-    if (!fs.statSync(hostDir).isDirectory()) continue;
-    for (const owner of fs.readdirSync(hostDir)) {
-      const ownerDir = path.join(hostDir, owner);
-      if (!fs.statSync(ownerDir).isDirectory()) continue;
-      for (const repoDir of fs.readdirSync(ownerDir)) {
-        if (!repoDir.endsWith(".git")) continue;
-        const bare = path.join(ownerDir, repoDir);
-        let heads, remotes, checkedOut;
-        try {
-          const refLines = (glob) =>
-            gitIn(bare, [
-              "for-each-ref",
-              "--format=%(refname) %(objectname)",
-              glob,
-            ])
-              .split("\n")
-              .filter(Boolean)
-              .map((l) => l.split(" "));
-          heads = refLines("refs/heads/");
-          remotes = new Map(
-            refLines("refs/remotes/origin/").map(([ref, oid]) => [
-              ref.slice("refs/remotes/origin/".length),
-              oid,
-            ]),
-          );
-          checkedOut = new Set(
-            gitIn(bare, ["worktree", "list", "--porcelain"])
-              .split("\n")
-              .filter((l) => l.startsWith("branch refs/heads/"))
-              .map((l) => l.slice("branch refs/heads/".length)),
-          );
-        } catch {
-          continue;
-        }
-        for (const [ref, oid] of heads) {
-          const name = ref.slice("refs/heads/".length);
-          if (checkedOut.has(name)) continue;
-          if (ownedPrefixes.some((b) => ownsRef(name, b))) continue;
-          if (remotes.get(name) !== oid) continue;
-          try {
-            gitIn(bare, ["branch", "-D", name]);
-            mirrors++;
-          } catch {}
-        }
-      }
-    }
-  }
-} catch {}
-if (mirrors)
-  console.log(`==> migrate: dropped ${mirrors} mirrored remote branch(es)`);
-
-// Existing AGENTS.md never learn about the `work` CLI read commands. Keep in
-// sync with writeAgentsMd.
-const WORK_CLI_BULLET =
-  "- **Ask `work` for facts:** the `work` CLI answers from the same data as\n" +
-  "  the app: `work workspace` (this workspace: repos, base branches, open PRs,\n" +
-  "  sessions, running procs/ports), `work repos`, `work procs`,\n" +
-  "  `work workspaces`, `work doctor` (installed tools / agents / GitHub\n" +
-  "  sign-in), `work usage` (agent plan quotas). Add `--json` for machine\n" +
-  "  output. Prefer these over guessing from the filesystem or calling GitHub.\n";
-let cliNoted = 0;
-for (const { path: wsPath } of db
-  .prepare("SELECT path FROM workspaces")
-  .all()) {
-  const file = path.join(wsPath, "AGENTS.md");
-  try {
-    const text = fs.readFileSync(file, "utf8");
-    if (text.includes("Ask `work` for facts")) continue;
-    fs.writeFileSync(file, text.trimEnd() + "\n" + WORK_CLI_BULLET);
-    cliNoted++;
-  } catch {}
-}
-if (cliNoted)
-  console.log(`==> migrate: pointed ${cliNoted} AGENTS.md at the work CLI`);
-
-// Existing AGENTS.md never learn that a repo's own agents file is required
-// reading. Splice it in after the repo list (ahead of the stash bullet), so
-// it sits with the repos it is about. Keep in sync with writeAgentsMd.
-const REPO_AGENTS_BULLET =
-  "- **Repo agents files:** you **MUST** read a repo's `AGENTS.md` (or\n" +
-  "  `CLAUDE.md`) before doing any work in it. It is not loaded for you.\n";
-let repoNoted = 0;
-for (const { path: wsPath } of db
-  .prepare("SELECT path FROM workspaces")
-  .all()) {
-  const file = path.join(wsPath, "AGENTS.md");
-  try {
-    const text = fs.readFileSync(file, "utf8");
-    const at = text.indexOf("- **No `git stash`:**");
-    if (at < 0 || text.includes("**Repo agents files:**")) continue;
-    fs.writeFileSync(
-      file,
-      text.slice(0, at) + REPO_AGENTS_BULLET + text.slice(at),
-    );
-    repoNoted++;
-  } catch {}
-}
-if (repoNoted)
-  console.log(
-    `==> migrate: required repo agents files in ${repoNoted} AGENTS.md`,
-  );
-
-// Per-workspace UI prefs were never swept on delete; they ride every SSR
-// document via allPrefs(). Prune orphans once — runtime delete handles new ones.
-{
-  const wr = writer();
-  try {
-    const live = new Set(
-      wr
-        .prepare("SELECT id FROM workspaces")
-        .all()
-        .map((r) => r.id),
-    );
-    // Kept equal to WORKSPACE_PREFS in src/server/settings.ts, a .ts file
-    // this plain script cannot import.
-    const prefixes = [
-      "tab",
-      "diff-filter",
-      "diff-folded",
-      "diff-collapsed",
-      "diff-focus",
-      "diff-pos",
-      "files-recent",
-    ].map((name) => `ui.${name}:`);
-    let pruned = 0;
-    for (const prefix of prefixes) {
-      for (const { key } of wr
-        .prepare("SELECT key FROM settings WHERE key GLOB ?")
-        .all(prefix + "*")) {
-        if (live.has(key.slice(prefix.length))) continue;
-        wr.prepare("DELETE FROM settings WHERE key = ?").run(key);
-        pruned++;
-      }
-    }
-    if (pruned)
-      console.log(`==> migrate: pruned ${pruned} orphaned ui pref(s)`);
-  } finally {
-    wr.close();
-  }
-}
-
-// The review's two-way toggle (`ui.diff-uncommitted`) became the three-way
-// `diff-scope` pref, and nothing reads the old row: drop it, since it rides
-// every SSR prefs payload. Not folded into the scope: that would switch
-// long-time users to uncommitted changes without their asking.
-{
-  const wr = writer();
-  try {
-    const dropped = wr
-      .prepare(
-        "DELETE FROM settings WHERE key IN ('ui.diff-uncommitted', 'diff-uncommitted')",
-      )
-      .run();
-    if (dropped.changes)
-      console.log("==> migrate: dropped the old diff-uncommitted pref");
-  } finally {
-    wr.close();
-  }
-}
-
-// The terminal's two text sizes were one JSON pref (`term-font`), which a
-// device rewrote whole from a stale copy when it set its own size. Split
-// it into the per-device prefs once (keep in sync with termFontPref in
-// src/client/prefs.ts).
-{
-  const wr = writer();
-  try {
-    const legacy = wr
-      .prepare("SELECT value FROM settings WHERE key = 'ui.term-font'")
-      .get();
-    if (legacy) {
-      let sizes = {};
-      try {
-        sizes = JSON.parse(legacy.value) ?? {};
-      } catch {}
-      for (const [field, key] of [
-        ["desktop", "ui.term-font-desktop"],
-        ["touch", "ui.term-font-touch"],
-      ]) {
-        if (!Number.isInteger(sizes[field])) continue;
-        wr.prepare(
-          "INSERT OR IGNORE INTO settings (key, value) VALUES (?, ?)",
-        ).run(key, String(sizes[field]));
-      }
-      wr.prepare("DELETE FROM settings WHERE key = 'ui.term-font'").run();
-      console.log("==> migrate: split term-font into per-device prefs");
-    }
-  } finally {
-    wr.close();
-  }
-}
-
-// The phone pad's pref was once a bare list of the keys after the pad's
-// own nine. It is `{ base, extra }` now, and a change to one key
-// (src/client/pref-change.ts) finds no `extra` in a list, so it would
-// start the pad afresh. Wrap such a list once.
-{
-  const wr = writer();
-  try {
-    const row = wr
-      .prepare("SELECT value FROM settings WHERE key = 'ui.phone-keys'")
-      .get();
-    let keys;
-    try {
-      keys = row && JSON.parse(row.value);
-    } catch {}
-    if (Array.isArray(keys)) {
-      wr.prepare(
-        "UPDATE settings SET value = ? WHERE key = 'ui.phone-keys'",
-      ).run(JSON.stringify({ base: [], extra: keys }));
-      console.log("==> migrate: moved the phone pad's keys into its new shape");
-    }
-  } finally {
-    wr.close();
-  }
-}