@indigoai-us/hq-cli 5.314.0 → 5.316.0

package/assets/scaffold/core/scripts/detect-stale-review-base.sh

@@ -0,0 +1,199 @@
+#!/usr/bin/env bash
+# detect-stale-review-base.sh — find remote-tracking refs in the HQ root that
+# have fallen so far behind local HEAD that a diff/review tool will pick one as
+# its comparison base and try to review the entire tree.
+#
+# Background: HQ autosaves one commit per edited file (.claude/hooks/hq-autocommit.sh)
+# and is never pushed to a remote (policy hq-root-never-push-remote). An HQ root
+# that is itself a git repo with a remote attached therefore accumulates local
+# commits the remote-tracking ref never receives. The gap only grows.
+#
+# Review tools that auto-select a base branch resolve it from refs/remotes/*.
+# Once the gap is large enough that base is effectively "the empty tree", so the
+# review payload becomes the whole repository instead of the working delta. The
+# observed failure (2026-07-28) was a Codex desktop git worker taking SIGTRAP on
+# a 108,434-path / 29.2 MB payload built against a remote-tracking ref 22,881
+# commits behind local main, retried until the app reached 5.5 GB RSS.
+#
+# Codex exposes no configuration for the review base — `review_model` only picks
+# the reviewing model, and `auto_review` governs the approval-reviewer subagent,
+# not code review. `codex review --base` is per-invocation and does not reach the
+# desktop app's automatic review. Removing the stale ref is therefore the only
+# lever available on the HQ side: with nothing stale to resolve, there is no
+# whole-tree base to pick.
+#
+# Modes:
+#   (default)  human-readable report; exit 0.
+#   --json     machine-readable JSON array; exit 0.
+#   --check    exit 0 if clean, 1 if any stale base exists (advisory gate).
+#   --fix      delete the offending remote-tracking refs; print each action.
+#
+# --fix deletes ONLY refs under refs/remotes/. It never touches refs/heads/,
+# never removes a configured remote, never fetches, and never pushes. The
+# deletion is recoverable: `git fetch <remote>` recreates the ref (and, on an HQ
+# root, recreates this condition — HQ roots are not meant to be fetched).
+#
+# Thresholds (override with flags or env):
+#   --max-paths N    changed paths tolerated vs. a base   (default 5000)
+#   --max-commits N  commits ahead tolerated vs. a base   (default 1000)
+# A ref is stale when EITHER threshold is exceeded. Path count is the primary
+# signal: it is what determines the review payload size.
+
+set -euo pipefail
+
+MODE="report"
+MAX_PATHS="${HQ_REVIEW_BASE_MAX_PATHS:-5000}"
+MAX_COMMITS="${HQ_REVIEW_BASE_MAX_COMMITS:-1000}"
+ROOT_OVERRIDE=""
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --json)        MODE="json"; shift ;;
+    --check)       MODE="check"; shift ;;
+    --fix)         MODE="fix"; shift ;;
+    --max-paths)   MAX_PATHS="${2:?--max-paths needs a value}"; shift 2 ;;
+    --max-commits) MAX_COMMITS="${2:?--max-commits needs a value}"; shift 2 ;;
+    --root)        ROOT_OVERRIDE="${2:?--root needs a value}"; shift 2 ;;
+    -h|--help)     sed -n '2,41p' "$0"; exit 0 ;;
+    *)
+      printf 'detect-stale-review-base: unknown argument: %s\n' "$1" >&2
+      printf 'usage: %s [--json|--check|--fix] [--max-paths N] [--max-commits N] [--root PATH]\n' "$0" >&2
+      exit 2 ;;
+  esac
+done
+
+case "$MAX_PATHS" in ''|*[!0-9]*)
+  echo "detect-stale-review-base: --max-paths must be a non-negative integer" >&2; exit 2 ;;
+esac
+case "$MAX_COMMITS" in ''|*[!0-9]*)
+  echo "detect-stale-review-base: --max-commits must be a non-negative integer" >&2; exit 2 ;;
+esac
+
+# Resolve HQ root: explicit flag wins, then env, then the tree this script ships in.
+# Physical paths (pwd -P) so the nesting guard below cannot be dodged through a
+# symlink to a clone.
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+HQ_ROOT="${ROOT_OVERRIDE:-${HQ_ROOT:-${CLAUDE_PROJECT_DIR:-$(cd "$SCRIPT_DIR/../.." && pwd -P)}}}"
+
+if [ ! -d "$HQ_ROOT" ]; then
+  echo "detect-stale-review-base: no such directory: $HQ_ROOT" >&2
+  exit 2
+fi
+HQ_ROOT="$(cd "$HQ_ROOT" && pwd -P)"
+
+emit_clean() {
+  case "$MODE" in
+    json)  echo "[]" ;;
+    check) : ;;
+    fix)   printf 'detect-stale-review-base: nothing to fix (%s)\n' "$1" ;;
+    *)     printf 'detect-stale-review-base: clean (%s)\n' "$1" ;;
+  esac
+  exit 0
+}
+
+# Only ever operate on an HQ root. This guard is what keeps the tool away from
+# repos/ working clones, where a remote-tracking ref far behind local HEAD is
+# ordinary and its refs must never be deleted.
+if [ ! -f "$HQ_ROOT/core/core.yaml" ]; then
+  echo "detect-stale-review-base: $HQ_ROOT is not an HQ root (no core/core.yaml)" >&2
+  exit 2
+fi
+
+# A repos/ clone of hq-core is itself HQ-root-shaped — core/core.yaml ships in
+# the repo, so the check above cannot tell it from a real install. What does
+# distinguish a working clone is position: clones and worktree checkouts live
+# NESTED inside another HQ root (repos/, workspace/worktrees/), while a real HQ
+# root never does. Refuse any candidate with an HQ-root-shaped ancestor rather
+# than trusting the caller.
+ANCESTOR="$(dirname "$HQ_ROOT")"
+while [ -n "$ANCESTOR" ] && [ "$ANCESTOR" != "/" ] && [ "$ANCESTOR" != "." ]; do
+  if [ -f "$ANCESTOR/core/core.yaml" ]; then
+    echo "detect-stale-review-base: $HQ_ROOT is nested inside the HQ root $ANCESTOR — refusing. Working clones and worktree checkouts keep their remote-tracking refs; this tool only repairs a top-level HQ install." >&2
+    exit 2
+  fi
+  ANCESTOR="$(dirname "$ANCESTOR")"
+done
+
+if [ "$(git -C "$HQ_ROOT" rev-parse --show-toplevel 2>/dev/null || true)" != "$HQ_ROOT" ]; then
+  emit_clean "HQ root is not a git repository — no review base to go stale"
+fi
+
+if ! git -C "$HQ_ROOT" rev-parse --verify -q HEAD >/dev/null 2>&1; then
+  emit_clean "HQ root has no commits yet"
+fi
+
+REFS="$(git -C "$HQ_ROOT" for-each-ref --format='%(refname)' refs/remotes 2>/dev/null || true)"
+if [ -z "$REFS" ]; then
+  emit_clean "no remote-tracking refs in the HQ root"
+fi
+
+STALE_REFS=""
+STALE_JSON=""
+STALE_COUNT=0
+
+while IFS= read -r ref; do
+  [ -n "$ref" ] || continue
+  # Symbolic refs (refs/remotes/<remote>/HEAD) resolve to a ref already covered.
+  if git -C "$HQ_ROOT" symbolic-ref -q "$ref" >/dev/null 2>&1; then
+    continue
+  fi
+
+  commits="$(git -C "$HQ_ROOT" rev-list --count "$ref..HEAD" 2>/dev/null || true)"
+  [ -n "$commits" ] || continue
+
+  # Three-dot: paths changed since the merge base — what a review of
+  # "HEAD against this base" would actually carry. This is the expensive probe
+  # on exactly the repos this tool exists for (it IS the whole-tree diff), so
+  # skip it when the commit gap alone already proves staleness and the mode
+  # does not display counts. --json always measures both.
+  paths=""
+  if [ "$commits" -le "$MAX_COMMITS" ] || [ "$MODE" = "json" ]; then
+    paths="$(git -C "$HQ_ROOT" diff --name-only "$ref...HEAD" 2>/dev/null | wc -l | tr -d ' ')"
+    [ -n "$paths" ] || paths=0
+  fi
+
+  if [ "$commits" -le "$MAX_COMMITS" ] && [ "$paths" -le "$MAX_PATHS" ]; then
+    continue
+  fi
+
+  STALE_COUNT=$((STALE_COUNT + 1))
+  STALE_REFS="${STALE_REFS}${ref}"$'\n'
+  if [ "$MODE" = "json" ]; then
+    [ -z "$STALE_JSON" ] || STALE_JSON="${STALE_JSON},"
+    STALE_JSON="${STALE_JSON}{\"ref\":\"${ref}\",\"commits_ahead\":${commits},\"changed_paths\":${paths}}"
+  fi
+done <<EOF
+$REFS
+EOF
+
+if [ "$STALE_COUNT" -eq 0 ]; then
+  emit_clean "every remote-tracking ref is within ${MAX_PATHS} paths / ${MAX_COMMITS} commits of HEAD"
+fi
+
+case "$MODE" in
+  json)
+    printf '[%s]\n' "$STALE_JSON"
+    ;;
+  check)
+    printf 'detect-stale-review-base: %s stale review base(s) in %s\n' "$STALE_COUNT" "$HQ_ROOT" >&2
+    exit 1
+    ;;
+  fix)
+    printf '%s' "$STALE_REFS" | while IFS= read -r ref; do
+      [ -n "$ref" ] || continue
+      git -C "$HQ_ROOT" update-ref -d "$ref"
+      printf 'detect-stale-review-base: deleted %s\n' "$ref"
+    done
+    printf 'detect-stale-review-base: removed %s stale review base(s). A later `git fetch` in the HQ root recreates them — HQ roots are not meant to be fetched (policy hq-root-never-push-remote).\n' "$STALE_COUNT"
+    ;;
+  *)
+    printf 'detect-stale-review-base: %s stale review base(s) in %s\n\n' "$STALE_COUNT" "$HQ_ROOT"
+    printf '%s' "$STALE_REFS" | while IFS= read -r ref; do
+      [ -n "$ref" ] || continue
+      c="$(git -C "$HQ_ROOT" rev-list --count "$ref..HEAD" 2>/dev/null || echo '?')"
+      p="$(git -C "$HQ_ROOT" diff --name-only "$ref...HEAD" 2>/dev/null | wc -l | tr -d ' ')"
+      printf '  %s — HEAD is %s commits ahead, %s changed paths\n' "$ref" "$c" "$p"
+    done
+    printf '\nA review tool that auto-selects a base will pick one of these and build a\nwhole-tree payload from it. Remove them with:\n\n  bash core/scripts/detect-stale-review-base.sh --fix\n'
+    ;;
+esac

package/assets/scaffold/core/scripts/eval-trigger.sh

@@ -0,0 +1,193 @@
+#!/bin/bash
+# eval-trigger.sh — evaluate a policy `when:` boolean expression against a fact set.
+#
+# Usage:
+#   eval-trigger.sh "<expr>" "<space-separated facts>"
+#   eval-trigger.sh --check < "<id>\t<expr>" lines   → "<id>\tok|malformed"
+#
+# Expression grammar (tiny boolean algebra over open identifiers):
+#   expr   := or
+#   or     := and ( '||' and )*
+#   and    := not ( '&&' not )*
+#   not    := '!' not | atom
+#   atom   := '(' or ')' | identifier
+#   identifier := [A-Za-z0-9_./][A-Za-z0-9_./-]*
+#                 Letters, digits, _ . / - . May start with `.` or `/`, so a
+#                 filename (`.mcp.json`, `settings.json`) or a slash-command
+#                 (`/brainstorm`) is a single literal token. Operators
+#                 (`&& || ! ( )`) and whitespace are the only delimiters.
+#
+# Tokens are OPEN — no vocabulary. Identifiers are compared with the fact set
+# case-insensitively; absent or misspelled identifiers are FALSE.
+#
+# Exit codes:
+#   0 — expression is TRUE  given the facts
+#   1 — expression is FALSE given the facts
+#   2 — expression is empty / malformed / unsafe  → caller should FAIL OPEN
+#
+# Safety: each identifier is substituted with 1/0 by fact membership, then the
+# result must contain ONLY `0 1 & | ! ( )` and spaces. Anything else (quotes,
+# backticks, `$`, letters left over, etc.) yields exit 2 — the expression is
+# never eval'd by a shell, only by awk's own boolean operators. Dots, slashes,
+# and dashes are part of the identifier charset, so they are consumed by the
+# substitution and never survive to the gate; quotes/backticks/$ still do, and
+# still fail open.
+
+set -euo pipefail
+
+# --check: batch SYNTAX mode. Reads `<id><TAB><expr>` lines on stdin and prints
+# `<id><TAB>ok` or `<id><TAB>malformed`, one line per input. Validity does not
+# depend on the fact set — every identifier substitutes to 0 — so this is the
+# same parse the single-expression mode runs, just without a process per
+# expression. Callers linting a whole tree use this; there is deliberately no
+# second implementation of the grammar to drift from.
+if [ "${1-}" = "--check" ]; then
+  awk -F'\t' '
+    function skip() { while (substr(E, pos, 1) ~ /[ \t]/) pos++ }
+    function parseOr(  v) {
+      v = parseAnd(); skip()
+      while (valid && substr(E, pos, 2) == "||") {
+        pos += 2
+        rhs = parseAnd()
+        v = (v || rhs)
+        skip()
+      }
+      return v
+    }
+    function parseAnd(  v) {
+      v = parseNot(); skip()
+      while (valid && substr(E, pos, 2) == "&&") {
+        pos += 2
+        rhs = parseNot()
+        v = (v && rhs)
+        skip()
+      }
+      return v
+    }
+    function parseNot(  c) {
+      skip(); c = substr(E, pos, 1)
+      if (c == "!") { pos++; return (parseNot() ? 0 : 1) }
+      return parseAtom()
+    }
+    function parseAtom(  v, c) {
+      skip(); c = substr(E, pos, 1)
+      if (c == "(") {
+        pos++; v = parseOr(); skip()
+        if (substr(E, pos, 1) != ")") { valid = 0; return 0 }
+        pos++; return v
+      }
+      if (c == "0" || c == "1") { pos++; return (c == "1") ? 1 : 0 }
+      valid = 0; return 0
+    }
+    function check(expr,   e, s, out, tok) {
+      e = expr; gsub(/[ \t]/, "", e)
+      if (e == "") return 0
+      s = expr; out = ""
+      while (match(s, "[A-Za-z0-9_./][A-Za-z0-9_./-]*")) {
+        tok = substr(s, RSTART, RLENGTH)
+        out = out substr(s, 1, RSTART - 1) "0"
+        s = substr(s, RSTART + RLENGTH)
+      }
+      out = out s
+      if (out ~ /[^01&|!() \t]/) return 0
+      E = out; pos = 1; valid = 1
+      parseOr()
+      skip()
+      if (!valid || pos <= length(E)) return 0 # trailing garbage / bad atom
+      return 1
+    }
+    # The first tab separates the caller id from the expression. Rejoin any
+    # remaining fields so tabs inside an expression retain their documented
+    # whitespace meaning instead of being silently discarded by the awk field
+    # separator.
+    {
+      expr = $2
+      for (field = 3; field <= NF; field++) expr = expr "\t" $field
+      print $1 "\t" (check(expr) ? "ok" : "malformed")
+    }
+  '
+  exit 0
+fi
+
+EXPR="${1-}"
+FACTS="${2-}"
+
+# Empty expression → nothing to evaluate; caller fails open.
+case "$EXPR" in
+  ''|*[!\ ]*) : ;;  # has at least one non-space char → continue
+esac
+# (the case above is a readability no-op; the real empty check is in awk)
+
+awk -v expr="$EXPR" -v facts="$FACTS" '
+function skip() { while (substr(E, pos, 1) ~ /[ \t]/) pos++ }
+function parseOr(  v) {
+  v = parseAnd(); skip()
+  while (valid && substr(E, pos, 2) == "||") {
+    pos += 2
+    rhs = parseAnd()
+    v = (v || rhs)
+    skip()
+  }
+  return v
+}
+function parseAnd(  v) {
+  v = parseNot(); skip()
+  while (valid && substr(E, pos, 2) == "&&") {
+    pos += 2
+    rhs = parseNot()
+    v = (v && rhs)
+    skip()
+  }
+  return v
+}
+function parseNot(  c) {
+  skip(); c = substr(E, pos, 1)
+  if (c == "!") { pos++; return (parseNot() ? 0 : 1) }
+  return parseAtom()
+}
+function parseAtom(  v, c) {
+  skip(); c = substr(E, pos, 1)
+  if (c == "(") {
+    pos++; v = parseOr(); skip()
+    if (substr(E, pos, 1) != ")") { valid = 0; return 0 }
+    pos++; return v
+  }
+  if (c == "0" || c == "1") { pos++; return (c == "1") ? 1 : 0 }
+  valid = 0; return 0
+}
+BEGIN {
+  # empty / whitespace-only expression → fail open
+  e = expr; gsub(/[ \t]/, "", e)
+  if (e == "") exit 2
+
+  # build fact membership set
+  n = split(facts, fa, /[ ,]+/)
+  for (i = 1; i <= n; i++) if (fa[i] != "") have[fa[i]] = 1
+
+  # substitute identifiers -> 1/0 by membership
+  s = expr; out = ""
+  while (match(s, "[A-Za-z0-9_./][A-Za-z0-9_./-]*")) {
+    tok = substr(s, RSTART, RLENGTH)
+    out = out substr(s, 1, RSTART - 1) ((tolower(tok) in have) ? "1" : "0")
+    s = substr(s, RSTART + RLENGTH)
+  }
+  out = out s
+
+  # safety gate: only 0 1 & | ! ( ) and spaces may remain
+  if (out ~ /[^01&|!() \t]/) exit 2
+
+  # evaluate
+  E = out; pos = 1; valid = 1
+  v = parseOr()
+
+  # The parse must consume the WHOLE expression. Recursive descent stops at the
+  # first token it cannot continue from, so `merge || pull request` would parse
+  # as `merge || pull` and silently discard everything after the bare space —
+  # the policy then fires (or fails to) on a prefix nobody authored. Leftover
+  # input means the expression is malformed, not shorter.
+  skip()
+  if (!valid || pos <= length(E)) exit 2
+
+  exit (v ? 0 : 1)
+}
+'

package/assets/scaffold/core/scripts/git-pack-extension-check.sh

@@ -0,0 +1,164 @@
+#!/usr/bin/env bash
+# hq-core: public
+# git-pack-extension-check.sh — find pack files that have lost their extension.
+#
+# A git packfile set is three files sharing one basename:
+#
+#   pack-<sha>.pack   the objects           (magic "PACK")
+#   pack-<sha>.idx    the index into them   (magic "\377tOc")
+#   pack-<sha>.rev    reverse index         (magic "RIDX")
+#
+# Git pairs them BY EXTENSION. Strip the extension off any one of them and git
+# stops seeing the set entirely: the objects are still on disk, byte for byte,
+# but they become unreachable. The repo then fails in a way that reads like
+# catastrophic history loss rather than a filename problem:
+#
+#   fatal: unable to read tree (<sha>)
+#   error: bad tree object HEAD
+#   error: refs/heads/<branch>: invalid sha1 pointer <sha>
+#
+# `git fsck` reports the objects as missing and `git gc` cannot help, because
+# nothing is actually corrupt — the bytes are intact and the repair is a
+# rename. That mismatch between how it presents and what it is makes this
+# failure expensive to diagnose from the error text alone, which is why this
+# check exists as a deterministic probe.
+#
+# Git never writes an extensionless `pack-*` file, so finding one is
+# unambiguous. Observed in the wild on a macOS HQ root where a folder-level
+# sync/backup agent had been walking the tree; the mechanism that drops the
+# extension is not established.
+#
+# Usage:
+#   git-pack-extension-check.sh [--root <path>] [--fix] [--quiet]
+#
+#   --root <path>   Repository to check (default: current directory).
+#   --fix           Rename each orphan back to the extension its magic bytes
+#                   prove it should carry. Without this the script only
+#                   reports.
+#   --quiet         Suppress the healthy-case line; findings still print.
+#
+# Exit codes:
+#   0  healthy, or every orphan was repaired under --fix
+#   1  usage error, or the root is not a git repository
+#   2  orphans found and left in place (report-only, or unrepairable)
+#
+# The repair is a rename and nothing else. It never deletes, never rewrites
+# file contents, never touches refs or the index, and refuses to overwrite an
+# existing target. A file whose magic bytes are not a known pack signature is
+# reported and left alone — this script will not guess.
+
+set -uo pipefail
+
+ROOT="."
+FIX=0
+QUIET=0
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --root)
+      [[ $# -ge 2 ]] || { echo "git-pack-extension-check: --root needs a path" >&2; exit 1; }
+      ROOT="$2"; shift 2 ;;
+    --fix)   FIX=1; shift ;;
+    --quiet) QUIET=1; shift ;;
+    -h|--help)
+      sed -n '2,50p' "$0" | sed 's/^# \{0,1\}//'
+      exit 0 ;;
+    *)
+      echo "git-pack-extension-check: unknown argument '$1'" >&2
+      exit 1 ;;
+  esac
+done
+
+if [[ ! -d "$ROOT" ]]; then
+  echo "git-pack-extension-check: not a directory: $ROOT" >&2
+  exit 1
+fi
+
+# Packs live in the COMMON git dir, not the per-worktree one — a linked
+# worktree shares the main object store, so checking either resolves to the
+# same place. `--path-format=absolute` needs git 2.31+; the fallback keeps
+# this working on older hosts by resolving the (possibly relative) path
+# against the repo root itself.
+GIT_COMMON="$(git -C "$ROOT" rev-parse --path-format=absolute --git-common-dir 2>/dev/null || true)"
+if [[ -z "$GIT_COMMON" ]]; then
+  GIT_COMMON="$(git -C "$ROOT" rev-parse --git-common-dir 2>/dev/null || true)"
+  if [[ -z "$GIT_COMMON" ]]; then
+    echo "git-pack-extension-check: not a git repository: $ROOT" >&2
+    exit 1
+  fi
+  if [[ "$GIT_COMMON" != /* ]]; then
+    GIT_COMMON="$(cd "$ROOT" && cd "$GIT_COMMON" 2>/dev/null && pwd || true)"
+  fi
+fi
+
+PACK_DIR="$GIT_COMMON/objects/pack"
+if [[ ! -d "$PACK_DIR" ]]; then
+  [[ "$QUIET" == "1" ]] || echo "git-pack-extension-check: no pack directory, nothing to check"
+  exit 0
+fi
+
+# The magic bytes are read with `od` rather than compared as shell strings:
+# a packfile is binary and its first bytes can include NUL, which a shell
+# variable cannot hold.
+magic_of() {
+  od -A n -t x1 -N 4 "$1" 2>/dev/null | tr -d ' \n'
+}
+
+FOUND=0
+REPAIRED=0
+UNREPAIRED=0
+
+# NUL-delimited: a mangled filename is exactly the case where a newline in a
+# name would split the list and corrupt the scan.
+while IFS= read -r -d '' orphan; do
+  base="$(basename "$orphan")"
+  hex="$(magic_of "$orphan")"
+  case "$hex" in
+    5041434b) ext="pack" ;;   # "PACK"
+    ff744f63) ext="idx"  ;;   # "\377tOc"
+    52494458) ext="rev"  ;;   # "RIDX"
+    *)        ext="" ;;
+  esac
+
+  FOUND=$((FOUND + 1))
+
+  if [[ -z "$ext" ]]; then
+    echo "git-pack-extension-check: FOUND $base — extensionless, but its magic bytes (${hex:-empty}) are not a pack/idx/rev signature; leaving it alone" >&2
+    UNREPAIRED=$((UNREPAIRED + 1))
+    continue
+  fi
+
+  target="$orphan.$ext"
+  if [[ -e "$target" ]]; then
+    echo "git-pack-extension-check: FOUND $base — should be $base.$ext, but that file already exists; resolve by hand" >&2
+    UNREPAIRED=$((UNREPAIRED + 1))
+    continue
+  fi
+
+  if [[ "$FIX" != "1" ]]; then
+    echo "git-pack-extension-check: FOUND $base — lost its .$ext extension; git cannot see this pack set. Re-run with --fix to rename it." >&2
+    UNREPAIRED=$((UNREPAIRED + 1))
+    continue
+  fi
+
+  if mv -n "$orphan" "$target" 2>/dev/null && [[ -e "$target" && ! -e "$orphan" ]]; then
+    echo "git-pack-extension-check: REPAIRED $base -> $base.$ext"
+    REPAIRED=$((REPAIRED + 1))
+  else
+    echo "git-pack-extension-check: FAILED to rename $base -> $base.$ext" >&2
+    UNREPAIRED=$((UNREPAIRED + 1))
+  fi
+done < <(find "$PACK_DIR" -maxdepth 1 -type f -name 'pack-*' ! -name '*.*' -print0 2>/dev/null)
+
+if [[ "$FOUND" -eq 0 ]]; then
+  [[ "$QUIET" == "1" ]] || echo "git-pack-extension-check: ok — no extensionless pack files in $PACK_DIR"
+  exit 0
+fi
+
+if [[ "$UNREPAIRED" -gt 0 ]]; then
+  echo "git-pack-extension-check: ${FOUND} orphan(s), ${REPAIRED} repaired, ${UNREPAIRED} still broken" >&2
+  exit 2
+fi
+
+echo "git-pack-extension-check: ${REPAIRED} pack file(s) repaired — re-run 'git fsck' to confirm"
+exit 0