@ebrindley/build 0.0.0-stage → 1.42.1-rc28

package/dist/chunk-KHFKVQWY.js

@@ -0,0 +1,486 @@
+import {
+  ExitCodeError
+} from "./chunk-Y4ZDDHB6.js";
+import {
+  isYesAnswer
+} from "./chunk-O5X6BKAO.js";
+import {
+  detectSandboxBoundaryAttestation,
+  isSandboxEnabledForProvider,
+  isSandboxEnforcementOperational,
+  resolveSandboxBoundaryPolicy,
+  willSandboxBeActive
+} from "./chunk-B7YRSULE.js";
+import {
+  probeProviderSandboxCapability
+} from "./chunk-3H4MWYIC.js";
+import {
+  getKnownSandboxProviderIds
+} from "./chunk-DP7FKP6W.js";
+import {
+  isSandboxEnforcementSupported,
+  isSandboxSupported
+} from "./chunk-MJ6WNSIX.js";
+import {
+  formatLinuxDesktopConsentFailure,
+  formatLinuxHostClassNote,
+  resolveLinuxHostClass,
+  revokeLinuxHostPolicy,
+  writeLinuxHostPolicy
+} from "./chunk-V2TVPO3X.js";
+import {
+  BUILD_SANDBOX_BOUNDARY_POLICY,
+  readRawEnv
+} from "./chunk-7VRJHTGZ.js";
+
+// src/cli/commands/sandbox.ts
+import os from "os";
+import { Command } from "commander";
+var LINUX_DARWIN_HOST_REFUSAL = "Error: linux host-class declarations are ignored on macOS.\nmacOS write-capable runs require an accepted Seatbelt boundary.";
+var LINUX_DESKTOP_RISK_PARAGRAPH = [
+  "Warning: This Linux host is not Seatbelt-sandboxed.",
+  "",
+  "Provider CLIs Build launches can write anywhere $USER can, including",
+  "$HOME and credential paths (~/.ssh, ~/.config, ~/.build, cloud-token",
+  "stores). Build cannot generate a macOS-Seatbelt-equivalent filesystem",
+  "write boundary on Linux.",
+  "",
+  "If this is a VM, container, or isolated cloud instance:",
+  "  build sandbox trust linux --host isolated",
+  "",
+  "WSL is treated as a desktop."
+].join("\n");
+var WRITE_CAPABLE_ROOTS = /* @__PURE__ */ new Set(["run", "task-exec", "do", "auto", "loop", "sprint", "plan"]);
+var NEVER_PROMPT_ROOTS = /* @__PURE__ */ new Set([
+  "sandbox",
+  "doctor",
+  "provider",
+  "ask",
+  "config",
+  "help",
+  "init",
+  "status"
+]);
+function summarizeCapability(result) {
+  return {
+    capable: result.capable,
+    missingPaths: result.missing.map((entry) => entry.path)
+  };
+}
+function buildProviderStatus(providerId, probe) {
+  const attestation = detectSandboxBoundaryAttestation(providerId, providerId);
+  const capability = probe ? summarizeCapability(
+    probeProviderSandboxCapability(providerId, {
+      includeSharedPaths: false,
+      env: process.env
+    })
+  ) : null;
+  return {
+    providerId,
+    sandboxEnabled: isSandboxEnabledForProvider(providerId, providerId),
+    willBeActive: willSandboxBeActive(providerId, providerId),
+    enforcementOperational: isSandboxEnforcementOperational(providerId, providerId),
+    provenance: attestation.provenance,
+    boundaryEvidence: { ...attestation.evidence },
+    probed: probe,
+    capability
+  };
+}
+function resolveLinuxHostForCli(options = {}) {
+  return resolveLinuxHostClass({
+    ...options.env ? { env: options.env } : {},
+    ...options.stateDir ? { stateDir: options.stateDir } : {}
+  });
+}
+function toSandboxLinuxHostStatus(resolution) {
+  return {
+    hostClass: resolution.hostClass,
+    source: resolution.source,
+    writesAllowed: resolution.writesAllowed,
+    policyVersionCurrent: resolution.policyVersionCurrent,
+    acknowledgedPolicyVersion: resolution.acknowledgedPolicyVersion,
+    hypervisorHint: resolution.evidence.hypervisorHint
+  };
+}
+function formatLinuxHostAck(linuxHost) {
+  if (linuxHost.hostClass === "isolated") return "n/a (isolated)";
+  if (linuxHost.hostClass === "not-applicable") return "n/a";
+  if (linuxHost.acknowledgedPolicyVersion != null) {
+    return String(linuxHost.acknowledgedPolicyVersion);
+  }
+  return "none";
+}
+function buildSandboxStatus(options = {}) {
+  const envValue = readRawEnv(BUILD_SANDBOX_BOUNDARY_POLICY);
+  const effective = resolveSandboxBoundaryPolicy(envValue);
+  const probe = options.probe ?? false;
+  let providerIds = [];
+  if (options.provider) {
+    providerIds = [options.provider.toLowerCase()];
+  } else if (options.all) {
+    providerIds = getKnownSandboxProviderIds();
+  }
+  const linuxHost = toSandboxLinuxHostStatus(
+    resolveLinuxHostForCli({
+      ...options.env ? { env: options.env } : {},
+      ...options.stateDir ? { stateDir: options.stateDir } : {}
+    })
+  );
+  return {
+    platform: os.platform(),
+    sandboxSupported: isSandboxSupported(),
+    enforcementSupported: isSandboxEnforcementSupported(),
+    boundaryPolicy: {
+      effective,
+      envKey: BUILD_SANDBOX_BOUNDARY_POLICY.name,
+      envValue: envValue ?? null
+    },
+    linuxHost,
+    providers: providerIds.map((id) => buildProviderStatus(id, probe)),
+    timestamp: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function printLinuxHostHuman(linuxHost) {
+  console.log(`Host class: ${linuxHost.hostClass} (source=${linuxHost.source})`);
+  console.log(`Writes allowed: ${linuxHost.writesAllowed}`);
+  console.log(`Ack: ${formatLinuxHostAck(linuxHost)}`);
+  console.log(`Policy version: ${linuxHost.policyVersionCurrent}`);
+}
+function printHuman(status, scoped) {
+  console.log(`Platform: ${status.platform}`);
+  console.log(`Sandbox supported: ${status.sandboxSupported}`);
+  console.log(`Enforcement supported: ${status.enforcementSupported}`);
+  printLinuxHostHuman(status.linuxHost);
+  console.log(
+    `Boundary policy: ${status.boundaryPolicy.effective} (${status.boundaryPolicy.envKey}=${status.boundaryPolicy.envValue ?? "unset"})`
+  );
+  if (status.providers.length === 0) {
+    console.log("");
+    console.log("Info: no provider scope. Use --provider <id> or --all for per-provider state.");
+    return;
+  }
+  for (const p of status.providers) {
+    console.log("");
+    console.log(`Provider: ${p.providerId}`);
+    console.log(`  Sandbox enabled: ${p.sandboxEnabled}`);
+    console.log(`  Will be active: ${p.willBeActive}`);
+    console.log(`  Enforcement operational: ${p.enforcementOperational}`);
+    console.log(`  Provenance: ${p.provenance}`);
+    if (!p.capability) {
+      console.log("  Capability: not probed (run with --probe to test writability)");
+    } else {
+      console.log(`  Capability: ${p.capability.capable ? "capable" : "denied"}`);
+      if (!p.capability.capable && p.capability.missingPaths.length > 0) {
+        console.log(`  Missing paths: ${p.capability.missingPaths.join(", ")}`);
+      }
+    }
+  }
+  void scoped;
+}
+function printLinuxHostClassification(resolution, json) {
+  if (json) {
+    console.log(JSON.stringify(resolution, null, 2));
+    if (resolution.hostClass === "desktop-unacked") {
+      throw ExitCodeError.reported(1, formatLinuxDesktopConsentFailure(resolution));
+    }
+    return;
+  }
+  const linuxHost = toSandboxLinuxHostStatus(resolution);
+  console.log(`Platform: ${resolution.platform}`);
+  printLinuxHostHuman(linuxHost);
+  console.log("Evidence:");
+  console.log(`  durableHostClass: ${resolution.evidence.durableHostClass}`);
+  console.log(`  envHostClass: ${resolution.evidence.envHostClass}`);
+  console.log(`  containerAttested: ${resolution.evidence.containerAttested}`);
+  console.log(`  containerOsSignal: ${resolution.evidence.containerOsSignal}`);
+  console.log(`  ciVendor: ${resolution.evidence.ciVendor}`);
+  console.log(`  cloudAgent: ${resolution.evidence.cloudAgent}`);
+  console.log(`  hypervisorHint: ${resolution.evidence.hypervisorHint}`);
+  if (resolution.hostClass === "desktop-unacked") {
+    process.stderr.write(`${LINUX_DESKTOP_RISK_PARAGRAPH}
+`);
+    if (resolution.evidence.hypervisorHint) {
+      process.stderr.write(
+        `
+This host looks like a VM (${resolution.evidence.hypervisorHint}). If it is a dedicated isolated instance, run:
+  build sandbox trust linux --host isolated
+`
+      );
+    }
+    process.stderr.write(`
+${formatLinuxDesktopConsentFailure(resolution)}
+`);
+    throw ExitCodeError.reported(1, formatLinuxDesktopConsentFailure(resolution));
+  }
+  const note = resolution.note ?? formatLinuxHostClassNote(resolution);
+  if (note) {
+    console.log(`Info: ${note}`);
+  }
+}
+function runSandboxClassify(options = {}) {
+  const resolution = resolveLinuxHostForCli(options);
+  printLinuxHostClassification(resolution, options.json === true);
+}
+function refuseDarwinLinuxHostMutation(platform) {
+  if (platform !== "darwin") return;
+  process.stderr.write(`${LINUX_DARWIN_HOST_REFUSAL}
+`);
+  throw ExitCodeError.reported(1, LINUX_DARWIN_HOST_REFUSAL);
+}
+function runSandboxTrustLinux(options) {
+  const platform = options.platform ?? os.platform();
+  const host = options.host?.trim();
+  const ackDesktop = options.ackDesktop === true;
+  const revoke = options.revoke === true;
+  if (host && host !== "isolated") {
+    const message = "Error: --host only accepts isolated.";
+    process.stderr.write(`${message}
+`);
+    throw ExitCodeError.reported(1, message);
+  }
+  if (host === "isolated" && ackDesktop) {
+    const message = "Error: --host isolated and --ack-desktop are mutually exclusive.";
+    process.stderr.write(`${message}
+`);
+    throw ExitCodeError.reported(1, message);
+  }
+  if (revoke && (host === "isolated" || ackDesktop)) {
+    const message = "Error: --revoke cannot be combined with --host or --ack-desktop.";
+    process.stderr.write(`${message}
+`);
+    throw ExitCodeError.reported(1, message);
+  }
+  if (!revoke && host !== "isolated" && !ackDesktop) {
+    const message = "Error: specify --host isolated, --ack-desktop, or --revoke.";
+    process.stderr.write(`${message}
+`);
+    throw ExitCodeError.reported(1, message);
+  }
+  refuseDarwinLinuxHostMutation(platform);
+  const writeInput = {
+    source: "cli",
+    ...options.env ? { env: options.env } : {},
+    ...options.stateDir ? { stateDir: options.stateDir } : {}
+  };
+  if (revoke) {
+    revokeLinuxHostPolicy({
+      ...options.stateDir ? { stateDir: options.stateDir } : {}
+    });
+    console.log("Info: revoked Linux host-class policy for this user state.");
+    return;
+  }
+  if (host === "isolated") {
+    writeLinuxHostPolicy({
+      hostClass: "isolated",
+      ...writeInput
+    });
+    console.log("Info: recorded Linux host class isolated for this user state.");
+    return;
+  }
+  process.stderr.write(`${LINUX_DESKTOP_RISK_PARAGRAPH}
+`);
+  writeLinuxHostPolicy({
+    hostClass: "desktop",
+    ...writeInput
+  });
+  console.log("Info: recorded Linux desktop write consent for this user state.");
+}
+function collectCommandPathNames(command) {
+  const names = [];
+  let current = command;
+  while (current?.parent) {
+    const name = current.name();
+    if (name) names.unshift(name);
+    current = current.parent;
+  }
+  return names;
+}
+function isWriteCapableCommand(commandNames) {
+  const root = commandNames[0];
+  if (!root || NEVER_PROMPT_ROOTS.has(root)) return false;
+  if (!WRITE_CAPABLE_ROOTS.has(root)) return false;
+  if (root === "sprint") return commandNames.includes("run");
+  if (root === "plan") {
+    if (commandNames.includes("execute")) return true;
+    if (commandNames.includes("sprint") && commandNames.includes("run")) return true;
+    return commandNames.length === 1;
+  }
+  return true;
+}
+var NO_TTY_REFUSAL_PATHS = /* @__PURE__ */ new Set([
+  "run",
+  "run task",
+  "run sprint",
+  "run competition",
+  "run fusion",
+  "sprint run",
+  "plan sprint run",
+  "plan backlog execute",
+  "task-exec",
+  "do",
+  "auto"
+]);
+var NO_TTY_REFUSAL_PATHS_WHEN_EXECUTING = /* @__PURE__ */ new Map([
+  // plan approve executes the artifact via Flywheel with --to-sprint (also under
+  // --no-apply, which only skips the merge) or --legacy-direct; otherwise it errors.
+  ["plan approve", (options) => Boolean(options.toSprint || options.legacyDirect)],
+  // flywheel run is a dry-run plan unless --execute is passed.
+  ["run flywheel run", (options) => Boolean(options.execute)]
+]);
+function isPreviewOnlyInvocation(commandPath, options) {
+  if (options.dryRun || options.preflight || options.reviewOnly || options.planOnly) return true;
+  if (commandPath === "task-exec" && options.apply === false) return true;
+  return commandPath === "run" && Boolean(options.workflowFile) && !options.workflowExecute;
+}
+function dispatchesProvidersWithoutPreview(commandNames, commandOptions = {}) {
+  const commandPath = commandNames.join(" ");
+  const executingWhen = NO_TTY_REFUSAL_PATHS_WHEN_EXECUTING.get(commandPath);
+  if (executingWhen) return executingWhen(commandOptions);
+  return NO_TTY_REFUSAL_PATHS.has(commandPath) && !isPreviewOnlyInvocation(commandPath, commandOptions);
+}
+function shouldPromptLinuxDesktopConsent(options) {
+  const platform = options.platform ?? os.platform();
+  if (platform !== "linux") return false;
+  if (options.hostClass !== "desktop-unacked") return false;
+  if (options.isTTY !== true) return false;
+  return isWriteCapableCommand(options.commandNames);
+}
+async function confirmYesNoViaReadline(question) {
+  const readline = await import("readline");
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    const answer = await new Promise((resolve) => {
+      rl.question(question, (value) => resolve(value));
+    });
+    return isYesAnswer(answer);
+  } finally {
+    rl.close();
+  }
+}
+async function maybePromptLinuxDesktopConsent(options) {
+  const platform = options.platform ?? os.platform();
+  const isTTY = options.isTTY ?? Boolean(process.stdin.isTTY === true && process.stdout.isTTY === true);
+  const resolution = resolveLinuxHostForCli({
+    ...options.env ? { env: options.env } : {},
+    ...options.stateDir ? { stateDir: options.stateDir } : {}
+  });
+  if (!shouldPromptLinuxDesktopConsent({
+    commandNames: options.commandNames,
+    hostClass: resolution.hostClass,
+    isTTY,
+    platform
+  })) {
+    if (!isTTY && platform === "linux" && resolution.hostClass === "desktop-unacked" && dispatchesProvidersWithoutPreview(options.commandNames, options.commandOptions)) {
+      const message2 = formatLinuxDesktopConsentFailure(resolution);
+      process.stderr.write(`${message2}
+`);
+      throw ExitCodeError.reported(1, message2);
+    }
+    return;
+  }
+  process.stderr.write(`${LINUX_DESKTOP_RISK_PARAGRAPH}
+`);
+  if (resolution.evidence.hypervisorHint) {
+    process.stderr.write(
+      `
+This host looks like a VM (${resolution.evidence.hypervisorHint}). If it is a dedicated isolated instance, run:
+  build sandbox trust linux --host isolated
+`
+    );
+  }
+  const confirm = options.confirm ?? confirmYesNoViaReadline;
+  const accepted = await confirm("Proceed and remember this consent for this user state? [y/N] ");
+  if (accepted) {
+    writeLinuxHostPolicy({
+      hostClass: "desktop",
+      source: "cli",
+      ...options.env ? { env: options.env } : {},
+      ...options.stateDir ? { stateDir: options.stateDir } : {}
+    });
+    return;
+  }
+  const message = formatLinuxDesktopConsentFailure(resolution);
+  process.stderr.write(`${message}
+`);
+  throw ExitCodeError.reported(1, message);
+}
+async function offerLinuxDesktopTrustIfInteractive(options = {}) {
+  const platform = options.platform ?? os.platform();
+  const isTTY = options.isTTY ?? Boolean(process.stdin.isTTY === true && process.stdout.isTTY === true);
+  if (platform !== "linux" || !isTTY) return "not-needed";
+  const resolution = resolveLinuxHostForCli({
+    ...options.env ? { env: options.env } : {},
+    ...options.stateDir ? { stateDir: options.stateDir } : {}
+  });
+  if (resolution.hostClass !== "desktop-unacked") return "not-needed";
+  console.log("Info: this user state will need write consent before build run.");
+  process.stderr.write(`${LINUX_DESKTOP_RISK_PARAGRAPH}
+`);
+  const confirm = options.confirm ?? confirmYesNoViaReadline;
+  const accepted = await confirm("Record desktop write consent for this user state now? [y/N] ");
+  if (!accepted) {
+    console.log(
+      "Info: skipped. Before build run: build sandbox trust linux --ack-desktop\nIf this is a VM, container, or cloud instance: build sandbox trust linux --host isolated"
+    );
+    return "skipped";
+  }
+  writeLinuxHostPolicy({
+    hostClass: "desktop",
+    source: "cli",
+    ...options.env ? { env: options.env } : {},
+    ...options.stateDir ? { stateDir: options.stateDir } : {}
+  });
+  console.log("Info: recorded Linux desktop write consent for this user state.");
+  return "acked";
+}
+function createSandboxCommand() {
+  const sandbox = new Command("sandbox").description(
+    "Inspect sandbox state and declare Linux host-class write policy"
+  );
+  sandbox.command("status").description("Show resolved sandbox boundary/provenance state (read-only by default)").option("--provider <id>", "Scope to a single provider id").option("--all", "Show all known providers").option("--json", "Output as JSON").option(
+    "--probe",
+    "Run the active write-probe (PERFORMS WRITES: creates+removes a probe file under each provider state dir; reflects live CODEX_HOME/XDG_*)"
+  ).action((options) => {
+    const status = buildSandboxStatus({
+      provider: options.provider,
+      all: options.all,
+      probe: options.probe
+    });
+    if (options.json) {
+      console.log(JSON.stringify(status, null, 2));
+      return;
+    }
+    printHuman(status, Boolean(options.provider));
+  });
+  sandbox.command("classify").description("Dry-run Linux host-class resolution (no writes)").option("--json", "Output as JSON").action((options) => {
+    runSandboxClassify({ json: options.json === true });
+  });
+  const trust = sandbox.command("trust").description("Persist or revoke the user-scoped Linux host-class policy");
+  trust.command("linux").description("Declare this Linux host isolated, acknowledge desktop risk, or revoke").option("--host <class>", "Persist host class (isolated)").option("--ack-desktop", "Print the risk paragraph and persist desktop consent").option("--revoke", "Delete the durable Linux host-class file").action((options) => {
+    runSandboxTrustLinux({
+      host: options.host,
+      ackDesktop: options.ackDesktop === true,
+      revoke: options.revoke === true
+    });
+  });
+  return sandbox;
+}
+
+export {
+  LINUX_DARWIN_HOST_REFUSAL,
+  LINUX_DESKTOP_RISK_PARAGRAPH,
+  resolveLinuxHostForCli,
+  toSandboxLinuxHostStatus,
+  formatLinuxHostAck,
+  buildSandboxStatus,
+  printLinuxHostClassification,
+  runSandboxClassify,
+  runSandboxTrustLinux,
+  collectCommandPathNames,
+  isWriteCapableCommand,
+  shouldPromptLinuxDesktopConsent,
+  maybePromptLinuxDesktopConsent,
+  offerLinuxDesktopTrustIfInteractive,
+  createSandboxCommand
+};
+//# sourceMappingURL=chunk-KHFKVQWY.js.map

package/dist/chunk-KHMEI3DQ.js

@@ -0,0 +1,173 @@
+import {
+  BranchArchiveManager,
+  DEFAULT_BRANCH_HOLD_DAYS,
+  heldBranchDeletableAt
+} from "./chunk-TIKTYUJO.js";
+import {
+  BranchCleanupManager,
+  DEFAULT_BRANCH_CLEANUP_AGE_DAYS
+} from "./chunk-ZVVD2XGV.js";
+import {
+  tryWithCleanupLock
+} from "./chunk-2NMNFUQA.js";
+import {
+  atomicWriteText
+} from "./chunk-RFDVSI4N.js";
+import {
+  execGit
+} from "./chunk-MHLEZQQI.js";
+import {
+  isQuietOutputRequested
+} from "./chunk-XWIZ6B5S.js";
+import {
+  BUILD_DEBUG,
+  BUILD_DISABLE_AUTOMATIC_WORKTREE_CLEANUP,
+  readEnv
+} from "./chunk-7VRJHTGZ.js";
+
+// src/core/cleanup/automatic-branch-cleanup.ts
+import { existsSync } from "fs";
+import { readFile } from "fs/promises";
+import { join } from "path";
+var AUTOMATIC_BRANCH_CLEANUP_INTERVAL_MS = 60 * 60 * 1e3;
+var MAX_BRANCHES_PER_STEP = 50;
+function isPositiveInteger(value) {
+  return typeof value === "number" && Number.isInteger(value) && value >= 1;
+}
+async function readBranchCleanupSettings(cwd) {
+  const settings = {
+    automatic: true,
+    idleDays: DEFAULT_BRANCH_CLEANUP_AGE_DAYS,
+    holdDays: DEFAULT_BRANCH_HOLD_DAYS
+  };
+  try {
+    const { loadAllConfigSources } = await import("./config-loader-RGP634PC.js");
+    const { orderConfigSourcesLowestFirst } = await import("./config-merger-TVUJBZTS.js");
+    for (const source of orderConfigSourcesLowestFirst(await loadAllConfigSources(cwd, {}))) {
+      const branches = source.data?.cleanup?.branches;
+      if (typeof branches?.automatic === "boolean") settings.automatic = branches.automatic;
+      if (isPositiveInteger(branches?.idleDays)) settings.idleDays = branches.idleDays;
+      if (isPositiveInteger(branches?.holdDays)) settings.holdDays = branches.holdDays;
+    }
+  } catch {
+  }
+  return settings;
+}
+function getLastAutomaticBranchCleanupPath(repoRoot) {
+  return join(repoRoot, ".build-project", "tmp", "branch-cleanup-last-pass.json");
+}
+async function readLastAutomaticBranchCleanup(repoRoot) {
+  try {
+    return JSON.parse(await readFile(getLastAutomaticBranchCleanupPath(repoRoot), "utf8"));
+  } catch {
+    return null;
+  }
+}
+async function summarizeHeldBranches(repoRoot, holdDays) {
+  const holder = new BranchArchiveManager(repoRoot);
+  let next;
+  const held = await holder.getArchivedBranches();
+  for (const branch of held) {
+    const heldDate = holder.parseArchiveDate(branch);
+    if (!heldDate) continue;
+    const at = heldBranchDeletableAt(heldDate, holdDays).getTime();
+    next = next === void 0 ? at : Math.min(next, at);
+  }
+  return {
+    count: held.length,
+    holdDays,
+    ...next === void 0 ? {} : { nextDeletionAt: new Date(next).toISOString() }
+  };
+}
+function debugLog(message) {
+  if (readEnv(BUILD_DEBUG).value) console.debug(`[branch-cleanup] ${message}`);
+}
+var NOTICE_NAMES_SHOWN = 3;
+function describeBranches(names) {
+  const shown = names.slice(0, NOTICE_NAMES_SHOWN).join(", ");
+  const more = names.length - NOTICE_NAMES_SHOWN;
+  return more > 0 ? `${shown} and ${more} more` : shown;
+}
+function writeCleanupNotice(pass) {
+  try {
+    if (isQuietOutputRequested()) return;
+    const parts = [];
+    if (pass.moved.length > 0) {
+      const noun = pass.moved.length === 1 ? "branch" : "branches";
+      parts.push(
+        `moved ${pass.moved.length} ${noun} to build/removed/ (${describeBranches(pass.moved)})`
+      );
+    }
+    if (pass.deleted.length > 0) {
+      const noun = pass.deleted.length === 1 ? "held branch" : "held branches";
+      parts.push(`deleted ${pass.deleted.length} ${noun} (${describeBranches(pass.deleted)})`);
+    }
+    if (parts.length > 0) process.stderr.write(`build: automatic cleanup ${parts.join(" and ")}
+`);
+  } catch {
+  }
+}
+async function runAutomaticBranchCleanup(options) {
+  const { repoRoot } = options;
+  try {
+    if (readEnv(BUILD_DISABLE_AUTOMATIC_WORKTREE_CLEANUP).value) return null;
+    if (!existsSync(join(repoRoot, ".build-project"))) return null;
+    const now = options.now ?? Date.now();
+    const lastStart = Date.parse((await readLastAutomaticBranchCleanup(repoRoot))?.ranAt ?? "");
+    const sinceLast = now - lastStart;
+    if (sinceLast >= 0 && sinceLast < AUTOMATIC_BRANCH_CLEANUP_INTERVAL_MS) return null;
+    const inside = await execGit(["rev-parse", "--is-inside-work-tree"], { cwd: repoRoot });
+    if (inside.exitCode !== 0 || inside.stdout.trim() !== "true") return null;
+    const settings = await readBranchCleanupSettings(repoRoot);
+    if (!settings.automatic) return null;
+    return await tryWithCleanupLock(options.lockDir, async () => {
+      const manager = new BranchCleanupManager(repoRoot);
+      const analysis = await manager.analyze({
+        includeBranches: true,
+        toolBranchesOnly: true,
+        minAgeDays: settings.idleDays,
+        maxArchiveCount: MAX_BRANCHES_PER_STEP,
+        now
+      });
+      const moves = await manager.executeMoves(analysis, now);
+      const holder = new BranchArchiveManager(repoRoot);
+      const prune = await holder.executePrune(
+        await holder.analyze({
+          olderThanDays: settings.holdDays,
+          maxPruneCount: MAX_BRANCHES_PER_STEP,
+          now
+        })
+      );
+      const pass = {
+        ranAt: new Date(now).toISOString(),
+        moved: moves.branches.filter((b) => b.action === "archive").map((b) => b.name),
+        deleted: prune.branches.filter((b) => b.action === "prune").map((b) => b.name),
+        errors: [...moves.errors, ...prune.errors]
+      };
+      await atomicWriteText(
+        getLastAutomaticBranchCleanupPath(repoRoot),
+        `${JSON.stringify(pass, null, 2)}
+`
+      );
+      debugLog(
+        `moved ${pass.moved.length}, deleted ${pass.deleted.length}, errors ${pass.errors.length}`
+      );
+      writeCleanupNotice(pass);
+      return pass;
+    });
+  } catch (error) {
+    debugLog(`pass failed: ${error instanceof Error ? error.message : String(error)}`);
+    return null;
+  }
+}
+
+export {
+  AUTOMATIC_BRANCH_CLEANUP_INTERVAL_MS,
+  MAX_BRANCHES_PER_STEP,
+  readBranchCleanupSettings,
+  getLastAutomaticBranchCleanupPath,
+  readLastAutomaticBranchCleanup,
+  summarizeHeldBranches,
+  runAutomaticBranchCleanup
+};
+//# sourceMappingURL=chunk-KHMEI3DQ.js.map