@jeffober/thatch 0.1.46 → 0.1.47

package/docs/plans/worktree-deletion-recovery.md

@@ -0,0 +1,246 @@
+# Plan: survive worktree deletion (repo path cache + cwd fallback)
+
+Status: CONSENSUS (round 5, five fresh-context review rounds). Ready to
+implement.
+
+## Problem
+
+opencode sessions run inside git worktrees (`~/dev/wt-<repo>/<branch>`).
+When the worktree is deleted after its branch merges:
+
+- **Store identity corruption.** `detectRepo` (src/git.ts:78) runs
+  `git remote get-url origin` and `git rev-parse --git-common-dir` with
+  `cwd` set to the session directory. When that directory is deleted, Bun
+  rejects the spawn (ENOENT at chdir; verified empirically), both probes
+  throw, and the final fallback (src/git.ts:105) returns the directory
+  basename -- for a wt worktree, the branch name. That plausible-but-wrong
+  name becomes the project store, and memories silently target a store no
+  future session reads. The `"unknown"` sentinel (which degrades to the
+  global store, src/tool-defs.ts:38) is not reachable on this path: a real
+  deleted-worktree path is never empty, so the `|| "unknown"` at
+  src/git.ts:105 never fires for it. (A degenerate input like `/` does
+  return `"unknown"` today; that case is unaffected by this plan.)
+- **Watcher cwd pinning.** `watch_command_create` captures the project dir
+  at registration (src/tool-defs.ts:1460-1464) and the poll runner spawns
+  `bash -c` there every cycle (src/watchers.ts:440). A deleted cwd makes
+  every poll reject; the watcher spins errors forever.
+
+Only four surfaces pin a cwd for spawning: src/git.ts:82, src/git.ts:92,
+src/git.ts:119 (`listBranches`), and src/watchers.ts:440. The `gh api`
+spawn (src/watchers.ts:318) uses absolute REST paths and no cwd -- it is
+unaffected. Watchers are in-memory only by documented contract
+(src/watchers.ts:19-28).
+
+**Host behavior when the directory is gone (verified in the opencode
+monorepo, packages/opencode/src/project + packages/core/src/project.ts and
+packages/core/src/fs-util.ts):** opencode does not refuse to resume. It
+walks up from the missing directory, finds no `.git`, and boots the global
+project with `worktree = "/"` while still passing the session's original
+(deleted) path as `directory` (packages/opencode/src/plugin/index.ts:153-157).
+Separately, Bun cannot launch at all from a deleted cwd, so per-prompt hook
+processes in that case never run -- they are not a recovery surface. The
+recovery surfaces are: resumed opencode sessions (via `ctx.directory`) and
+any host that spawns from a healthy cwd while passing the deleted path via
+`CLAUDE_PROJECT_DIR` / `CURSOR_PROJECT_DIR` (env has priority at
+src/git.ts:79).
+
+## Design
+
+### 1. `repo_paths` cache table
+
+```sql
+CREATE TABLE IF NOT EXISTS repo_paths (
+  worktree_path TEXT PRIMARY KEY,
+  main_path     TEXT NOT NULL,
+  repo_slug     TEXT NOT NULL,
+  resolved_at   INTEGER NOT NULL
+);
+```
+
+- Follows the existing `CREATE TABLE IF NOT EXISTS` + ad-hoc migration
+  pattern (src/db.ts:89+). Writes use `ON CONFLICT DO UPDATE` upsert
+  (existing idiom, src/db.ts:544).
+- **Key normalization.** The key is `realpathSync(dir)` at write time (the
+  directory exists then). On macOS, `/var/...` and `/private/var/...` are
+  the same directory with different path forms. Reads try the raw path
+  first, then `realpathSync(dirname(dir)) + basename(dir)` for the
+  deleted-directory case.
+- **Cache access is injected, not imported.** src/git.ts stays DB-free.
+  `detectRepo` and the new helpers take an optional cache accessor
+  (`{ get(dir): Row | null; put(row): void }`); callers with a DB in scope
+  pass an adapter over the `repo_paths` table. Where the DB does not exist
+  yet, creation is reordered ahead of detection: src/index.ts:168 vs :171
+  and src/mcp.ts:124 vs :131. Callers without a cache behave as today plus
+  the `"unknown"`-on-deleted-dir fix.
+- **Write trigger.** Only on successful resolution via the remote or
+  common-dir probes -- never from the basename fallback (caching that
+  output would store the exact garbage the cache exists to fix). Writes
+  are read-then-maybe-write: skip when the row already matches.
+  Frequency note: in the opencode plugin, detection runs once at init
+  (src/index.ts:168); the flush-tools hook runs per prompt but only on the
+  Claude Code / Cursor hosts (bin/thatch:973-974, :1006).
+
+### 2. main_path derivation
+
+New helper in src/git.ts, run unconditionally at cache-write time:
+
+```ts
+// resolveMainCheckout(dir): Promise<string | null>
+// Runs `git rev-parse --path-format=absolute --git-common-dir` with cwd=dir.
+// Returns null when git fails or is not a repo.
+```
+
+`--path-format=absolute` makes the output absolute in every live case
+(verified empirically): a linked worktree reports the main checkout's
+absolute `.git`, a root checkout reports its own absolute `.git`. So
+`main_path = dirname(output)` uniformly. A bare repo reports
+`/path/repo.git`, which fails the `endsWith("/.git")` check; the resulting
+nonsense `main_path` fails validation and is handled by the eviction rules
+below -- documented at the write site, not special-cased.
+
+detectRepo's public signature stays `Promise<string>`; a sibling helper
+`resolveMainPath(dir, cache?): Promise<string | null>` reads and validates
+a cache row for consumers that need the path.
+
+### 3. detectRepo recovery for a deleted directory
+
+When both git probes throw:
+
+1. `statSync(dir)` fails (directory gone): consult the cache.
+   - Cache hit, and the cached `main_path` validates (below): return the
+     cached `repo_slug`.
+   - Cache hit with failed validation: return `"unknown"`.
+   - Cache miss: return `"unknown"`, never the basename. This preserves
+     the documented contract -- unidentifiable contexts must be `"unknown"`,
+     never a plausible wrong identity (src/tool-defs.ts:33-41).
+2. Directory exists but is not a git repo: basename fallback unchanged
+   (its legitimate use).
+
+**Validation and eviction rules (definitive-invalidation only).**
+Validation of a cache hit runs, with cwd = cached `main_path`:
+
+1. `statSync(main_path)` -- if it throws (main checkout also gone), the
+   row is KEPT (the checkout may be re-cloned) and this call degrades to
+   `"unknown"`. Transient spawn errors also keep the row. Never evict on
+   an error that might be transient -- a wrongly evicted row permanently
+   downgrades identity, which is worse than the status quo it replaces.
+2. `git rev-parse --git-common-dir` -- a throw here (not a nonzero exit
+   from a live dir) is likewise treated as transient; row kept.
+3. Identity check: `git remote get-url origin` in `main_path` must parse
+   to the cached `repo_slug`. A nonzero exit or unparseable remote on a
+   live directory is DEFINITIVE (the path exists but is not the recorded
+   repo -- re-cloned, replaced, or no longer a repo): evict the row,
+   return `"unknown"`. A thrown spawn error is transient and keeps the
+   row.
+
+**Plugin identity recovery on resume.** The opencode plugin detects
+identity from `ctx.directory` (falling back to `ctx.worktree` when
+absent) instead of `ctx.worktree` alone. This touches the destructure and
+type at src/index.ts:165-168, not just the call. For a resumed session in
+a deleted worktree, the framework hands the plugin the original deleted
+path as `directory` and `"/"` as `worktree`; keying on `directory` lets
+the cache return the true store identity. Tool execution dirs
+(`ctx.projectDir`) continue to use the framework's worktree value.
+
+**CLI consistency.** `bin/thatch` `defaultStore()` (bin/thatch:76-82) lacks
+the `unknown -> global` mapping that the tool layer applies. The mapping is
+added there so all surfaces agree. `detectRepo` consumers that benefit from
+the `"unknown"` change are enumerated for tests: `chatHookLine`
+(bin/thatch:100), `flush-predictions` (bin/thatch:1217), `reminder`
+(bin/thatch:729), `hygiene` (bin/thatch:769).
+
+### 4. Shared cwd fallback at the pinned spawn sites
+
+A helper in src/git.ts:
+
+```ts
+// resolveSpawnCwd(dir, cache?): Promise<string | null>
+// dir if it exists; else the validated cached main_path; else null.
+```
+
+- `listBranches` (src/git.ts:119) uses it directly: valid pinned cwd >
+  cached main checkout > current error behavior. `runWatchedCommand` gets
+  the same fallback via the plugin's runner wrapper (section 5) rather
+  than calling the helper itself. Branch visibility is unaffected by the
+  fallback (worktrees share `refs/heads` and config; only HEAD and the
+  index are per-worktree). For `listBranches` this upgrades a fail-safe
+  (`[]` -> hygiene skips the orphan check) to a correct answer.
+- Inside `detectRepo` itself, the two probes use the same fallback so a
+  deleted worktree with a valid cache recovers without special casing.
+- **Surfacing.** The watcher poll loop logs the fallback once per watcher
+  (a flag, not every cycle -- poll errors already log every cycle at
+  src/watchers.ts:1071-1073 and spam is the existing failure mode). There
+  is no LLM-facing surface at poll time; the notification text is not
+  modified.
+
+### 5. Watcher fallback resolved per poll via the injected runner
+
+The plugin wires a `commandRunner` into the registry
+(src/watchers.ts:234, option declared at :251, currently passed only by
+tests; the plugin will start passing one at src/index.ts:247-279, where db
+is in scope). The plugin's runner is a wrapper that resolves the cwd per
+poll:
+
+```ts
+// plugin scope, where db is available
+const runner = async (command, cwd, timeoutMs) => {
+  const resolved = await resolveSpawnCwd(cwd, cacheAdapter);
+  if (resolved && resolved !== cwd && !loggedFallback.has(cwd)) {
+    console.error(`worktree deleted; watcher falling back to ${resolved}`);
+    loggedFallback.add(cwd); // key on the dead cwd: same once-per-watcher granularity
+  }
+  return runWatchedCommand(command, resolved ?? cwd, timeoutMs);
+};
+```
+
+- Resolution order: explicit `cd` > watcher cwd (if it still exists) >
+  cached main checkout > fail. This is the only mechanism that actually
+  recovers a watcher whose worktree dies mid-watch -- a fallback captured
+  at registration would be the same live path as the cwd and therefore
+  useless, which the previous plan revision got wrong.
+- The registry keeps its no-DB contract with no new options: the cache
+  adapter is closed over in plugin scope, outside the registry.
+- New optional param `cd` (z.string()) on `watch_command_create`,
+  validated at registration: the baseline run (src/watchers.ts:971-985)
+  spawns with it, so a dead path fails registration with the existing
+  friendly error (src/watchers.ts:441-443).
+- `cd` is not persisted to SQLite; watchers are in-memory by contract
+  (src/watchers.ts:19-28). A watcher whose fallback path itself later
+  dies fails its polls -- acceptable under the same lifetime contract.
+- `watch_create` and `watch_branch_create` get no `cd`: they run only gh
+  REST calls with absolute paths (src/watchers.ts:595-607); their only
+  directory-sensitive input is the init-time `ctx.defaultStore`, which
+  step 3 fixes at the source.
+
+## Tests
+
+- `tests/git-integration.test.ts` (real tmp repos, existing scaffolding):
+  `git worktree add` + `rm -rf` the worktree; assert cache-backed slug and
+  main-path recovery; cache miss yields `"unknown"`, not the branch name;
+  existing non-git dir still yields the basename; realpath canonicalization
+  via a symlinked temp path; recycled main_path with a different origin
+  evicts (definitive) and yields `"unknown"`; missing main_path (stat
+  throws) keeps the row and yields `"unknown"`.
+- `tests/watchers.test.ts` (injected `commandRunner` harness, lines 781+):
+  resolution ordering (cd > cwd > captured fallback), fallback logged once,
+  dead cd rejected at registration, watcher registered against a healthy
+  dir whose fallback was captured before deletion keeps polling.
+- `tests/tool-defs.test.ts`: `cd` schema presence and validation; the
+  existing unknown-to-global tests (lines 326, 477) cover the tool side.
+
+## Accepted risks and deferred items
+
+- Rows for dead worktrees accumulate until definitively invalidated;
+  bounded by worktrees ever seen. Optional prune deferred.
+- Poll-time fallback is not surfaced to the LLM mid-poll (console.error
+  once per watcher). The eventual notification reports the condition
+  result, same as today.
+- A fallback watcher runs its command from the main checkout root, so
+  commands using relative paths may observe different state -- potentially
+  a false exit 0 instead of a failure. Strictly better than today's
+  permanent error spin, but a real semantic difference worth knowing.
+- Bare-repo `main_path` is nonsense until first validation evicts it;
+  documented at the write site rather than special-cased.
+- `mkdtemp`/git path-form divergence claim verified in direction (Bun
+  normalizes cwd to the realpath form); the exact tmpdir form difference
+  is covered defensively by the dual read-path anyway.

package/docs/user/README.md

@@ -180,7 +180,7 @@ search` - JSONL output designed for piping to `jq` or `grep`.
 |------|-------------|
 | `thatch_watch_create` | Watch a GitHub PR for events (comments, review comments and replies, thread resolutions, commits, status changes, description edits, CI completions). The plugin polls in the background and prompts the session when a watched event happens. |
 | `thatch_watch_branch_create` | Watch a GitHub branch (typically main) for commit landings, CI check-run completions, and workflow runs, with an optional workflow-name filter. |
-| `thatch_watch_command_create` | Wait on any local condition via a shell command that exits 0 when the wait is over. One-shot: one notification on the first exit 0, then it cancels itself. |
+| `thatch_watch_command_create` | Wait on any local condition via a shell command that exits 0 when the wait is over. One-shot: one notification on the first exit 0, then it cancels itself. Accepts a `cd` path to run somewhere other than the project directory. |
 | `thatch_watch_list` | List this session's active watchers. |
 | `thatch_watch_cancel` | Cancel one of this session's watchers by id. |
 
@@ -325,6 +325,7 @@ response, walkthrough, and workflow skills that support the review pipeline:
 | `thatch-change-walkthrough` | Explains a change to the user as a teaching walkthrough: researches each affected workflow at the merge-base, teaches current behavior, then overlays the modifications with file:line citations. |
 | `thatch-code-walkthrough` | Explains a feature, module, or workflow to the user as a teaching walkthrough with file:line citations. Also used to draft high-level docs for new or undocumented features. |
 | `thatch-coding-workflow` | Plans and executes code changes with a task-list-driven workflow: complexity triage, milestone planning, research before coding, post-coding verification. Pairs with `thatch-code-archaeology` (research first, then plan). |
+| `thatch-plan-refinement` | Refines a plan before it is implemented: a fresh-context reviewer subagent re-checks the plan each round until consensus; deep mode adds specialist lenses (reuse, alternatives, hidden problems, safe-to-modify, intent archaeology). |
 
 ### Writing skills
 

package/docs/user/skills.md

@@ -75,6 +75,7 @@ Skills are split into shared (all hosts) and opencode-only:
 | Skill | Purpose |
 |-------|---------|
 | `thatch-coding-workflow` | Plans and executes code changes with a task-list-driven workflow: complexity triage, milestone planning, research before coding, post-coding verification. Pairs with `thatch-code-archaeology` (research first, then plan). |
+| `thatch-plan-refinement` | Refines a plan before it is implemented: a fresh-context reviewer subagent re-checks the plan each round until consensus; deep mode adds specialist lenses (reuse, alternatives, hidden problems, safe-to-modify, intent archaeology). |
 
 ## Stale skill cleanup
 

package/docs/user/watchers.md

@@ -73,9 +73,14 @@ notification carries the exit code and duration only. The command's
 stdout and stderr are discarded - command output can be external
 content (a curl response, a build log), so it never rides a
 notification. The agent re-runs the command or reads logs itself when
-it acts. The command runs in the project directory as the local user;
+it acts. The command runs in the project directory (or the `cd` path you
+pass to `watch_command_create`) as the local user;
 each run is killed at a 30-second timeout
-(`THATCH_WATCH_COMMAND_TIMEOUT_SECONDS` overrides it).
+(`THATCH_WATCH_COMMAND_TIMEOUT_SECONDS` overrides it). If the project
+directory is a git worktree that gets deleted while a watch is active
+(the branch merged and was cleaned up), the command keeps running from
+the repo's main checkout instead of failing - branch lists and git state
+are shared across worktrees, so the checks stay equivalent.
 
 ## How to use it
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jeffober/thatch",
-  "version": "0.1.46",
+  "version": "0.1.47",
   "description": "Persistent memory for AI coding agents — local embeddings, SQLite stores, zero config. Works with OpenCode (as a plugin), Claude Code (as an MCP server), and Cursor (as an MCP server).",
   "type": "module",
   "main": "src/index.ts",

package/src/db.ts

@@ -8,6 +8,7 @@ import {
 import { BehaviorEngine } from "./behavior";
 import { ChatStore, type ChatHostKind, type ChatWorktreeKind } from "./chat";
 import { PREDICTION_K, PREDICTION_P0, PREDICTION_W_SOFT } from "./scoring-engine";
+import type { RepoPathCache, RepoPathRow } from "./git";
 
 export { cosineSimilarity } from "./vector-math";
 export type { PredictionNudgeItem, MatcherRow, PredictionRow, ScoredPrediction } from "./prediction";
@@ -93,6 +94,20 @@ export class ThatchDB {
       )
     `);
 
+    // Cache mapping worktree directories to their main checkout and repo
+    // identity, recorded by detectRepo while the directory is alive. When the
+    // worktree is deleted (merged and cleaned up), identity recovery and the
+    // watcher cwd fallback read this instead of failing. Never delete the
+    // table on upgrade - the whole point is surviving restarts.
+    this.#db.run(`
+      CREATE TABLE IF NOT EXISTS repo_paths (
+        worktree_path TEXT PRIMARY KEY,
+        main_path     TEXT NOT NULL,
+        repo_slug     TEXT NOT NULL,
+        resolved_at   INTEGER NOT NULL
+      )
+    `);
+
     this.#db.run(`
       CREATE TABLE IF NOT EXISTS entries (
         slug      TEXT NOT NULL,
@@ -993,6 +1008,35 @@ export class ThatchDB {
     return this.#chat.markDelivered(ids);
   }
 
+  // ---------------------------------------------------------------------------
+  // Repo path cache - worktree dir to main checkout + identity, written by
+  // detectRepo while the directory is alive and read after it is deleted.
+  // ---------------------------------------------------------------------------
+
+  repoPathGet(worktreePath: string): RepoPathRow | null {
+    const row = this.#db
+      .query("SELECT worktree_path, main_path, repo_slug FROM repo_paths WHERE worktree_path = ?")
+      .get(worktreePath) as any;
+    if (!row) return null;
+    return { worktreePath: row.worktree_path, mainPath: row.main_path, repoSlug: row.repo_slug };
+  }
+
+  repoPathPut(row: RepoPathRow): void {
+    this.#db.run(
+      `INSERT INTO repo_paths (worktree_path, main_path, repo_slug, resolved_at)
+       VALUES (?, ?, ?, ?)
+       ON CONFLICT(worktree_path) DO UPDATE SET
+         main_path = excluded.main_path,
+         repo_slug = excluded.repo_slug,
+         resolved_at = excluded.resolved_at`,
+      [row.worktreePath, row.mainPath, row.repoSlug, Date.now()],
+    );
+  }
+
+  repoPathEvict(worktreePath: string): void {
+    this.#db.run("DELETE FROM repo_paths WHERE worktree_path = ?", [worktreePath]);
+  }
+
   // ---------------------------------------------------------------------------
   // Hygiene - signals for the session-start heartbeat. Staleness means
   // neither written nor recalled since the cutoff; recall telemetry keeps
@@ -1048,3 +1092,16 @@ export class ThatchDB {
     this.#db.close();
   }
 }
+
+/**
+ * Adapts ThatchDB to the RepoPathCache interface src/git.ts consumes, so
+ * git.ts never imports the database. Callers pass this into detectRepo /
+ * resolveSpawnCwd / listBranches.
+ */
+export function repoPathCache(db: ThatchDB): RepoPathCache {
+  return {
+    get: (p) => db.repoPathGet(p),
+    put: (row) => db.repoPathPut(row),
+    evict: (p) => db.repoPathEvict(p),
+  };
+}

package/src/git.ts

@@ -1,6 +1,6 @@
 import { $ } from "bun";
-import { statSync } from "node:fs";
-import { join } from "node:path";
+import { statSync, realpathSync } from "node:fs";
+import { join, dirname, basename } from "node:path";
 
 /**
  * Classifies the checkout the given directory serves: "worktree" for a
@@ -67,41 +67,219 @@ const URL_PATTERNS: UrlPattern[] = [
   },
 ];
 
+/**
+ * A cached mapping from a worktree directory to its main checkout and repo
+ * identity. Injected into detectRepo and friends so src/git.ts never touches
+ * the database directly (the MCP server resolves identity before it opens
+ * the DB; hooks and tests may have no DB at all).
+ */
+export interface RepoPathRow {
+  worktreePath: string;
+  mainPath: string;
+  repoSlug: string;
+}
+
+export interface RepoPathCache {
+  get(worktreePath: string): RepoPathRow | null;
+  put(row: RepoPathRow): void;
+  evict(worktreePath: string): void;
+}
+
+/**
+ * Path-form candidates for a worktree directory, raw first. On macOS a path
+ * can arrive as `/var/...` while git and spawned children report the same
+ * directory as `/private/var/...`; when the directory itself is deleted (the
+ * recovery case) it cannot be realpathed, so the parent is resolved and the
+ * basename rejoined instead.
+ */
+function canonicalWorktreeKeys(dir: string): string[] {
+  const keys = [dir];
+  try {
+    keys.push(join(realpathSync(dirname(dir)), basename(dir)));
+  } catch {
+    // Parent unresolvable; the raw path is all we have.
+  }
+  return [...new Set(keys)];
+}
+
+function pathExists(dir: string): boolean {
+  try {
+    statSync(dir);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Resolves the main checkout directory for the given live directory:
+ * the parent of the absolute git common dir. `--path-format=absolute` makes
+ * the output uniform - a linked worktree reports the MAIN checkout's .git,
+ * a root checkout reports its own. Returns null outside a git repo, for a
+ * bare repo (the common dir is the bare dir itself - no separate main
+ * checkout), or when the spawn fails (deleted dir).
+ */
+export async function resolveMainCheckout(dir: string): Promise<string | null> {
+  try {
+    const out = await $`git rev-parse --path-format=absolute --git-common-dir`.cwd(dir).quiet();
+    if (out.exitCode !== 0) return null;
+    const d = out.stdout.toString().trim();
+    if (!d.endsWith("/.git")) return null;
+    return d.slice(0, -"/.git".length);
+  } catch {
+    return null;
+  }
+}
+
+/** Verdicts for cache-row validation. "kept" = transient failure, row stays. */
+type RowVerdict = "valid" | "kept" | "evicted";
+
+/**
+ * Validates a cached row against the CURRENT state of its main checkout.
+ * Eviction is definitive-only: a wrongly evicted row permanently downgrades
+ * identity to "unknown", so anything that might be transient (missing main
+ * checkout that could be re-cloned, spawn hiccups) keeps the row and degrades
+ * this one call. A live directory that is no longer the recorded repo
+ * (re-cloned, replaced, no longer a repo) is definitive and evicts - the
+ * identity check is what catches a recycled path returning the old slug.
+ */
+async function validateMainPath(row: RepoPathRow, cache: RepoPathCache): Promise<RowVerdict> {
+  if (!pathExists(row.mainPath)) return "kept";
+
+  try {
+    const rd = await $`git rev-parse --git-common-dir`.cwd(row.mainPath).quiet();
+    if (rd.exitCode !== 0) {
+      cache.evict(row.worktreePath);
+      return "evicted";
+    }
+  } catch {
+    return "kept";
+  }
+
+  try {
+    const remote = await $`git remote get-url origin`.cwd(row.mainPath).quiet();
+    if (remote.exitCode === 0) {
+      const parsed = parseGitUrl(remote.stdout.toString());
+      if (parsed !== row.repoSlug) {
+        cache.evict(row.worktreePath);
+        return "evicted";
+      }
+      return "valid";
+    }
+  } catch {
+    return "kept";
+  }
+
+  // No origin remote: the recorded slug came from the common-dir fallback,
+  // so it must still be the main checkout's own basename.
+  if (basename(row.mainPath) !== row.repoSlug) {
+    cache.evict(row.worktreePath);
+    return "evicted";
+  }
+  return "valid";
+}
+
+/** First cache row for the directory that still validates against its main checkout. */
+async function findValidRow(dir: string, cache: RepoPathCache): Promise<RepoPathRow | null> {
+  for (const key of canonicalWorktreeKeys(dir)) {
+    const row = cache.get(key);
+    if (!row) continue;
+    const verdict = await validateMainPath(row, cache);
+    if (verdict === "valid") return row;
+  }
+  return null;
+}
+
+/**
+ * Records a successful identity resolution. Keyed on the REALPATH of the
+ * directory (it exists now - this is the only moment canonicalization is
+ * possible); read-then-maybe-write skips the row-relevant git spawn when the
+ * cache already agrees. Never called for the basename fallback: caching that
+ * output would store the exact wrong identity this cache exists to fix.
+ */
+async function recordRepoPath(dir: string, slug: string, cache?: RepoPathCache): Promise<void> {
+  if (!cache) return;
+  let canonical: string;
+  try {
+    canonical = realpathSync(dir);
+  } catch {
+    // Directory vanished between resolution and write; nothing to record.
+    return;
+  }
+  const existing = cache.get(canonical);
+  if (existing && existing.repoSlug === slug && pathExists(existing.mainPath)) return;
+  const mainPath = await resolveMainCheckout(dir);
+  // Bare repo (no /.git-suffixed common dir) has no meaningful main
+  // checkout - skip rather than record a nonsense path. Validation would
+  // evict it on first read anyway.
+  if (!mainPath) return;
+  cache.put({ worktreePath: canonical, mainPath, repoSlug: slug });
+}
+
+/**
+ * Resolves the directory commands should spawn in: the given directory when
+ * it exists, else the validated main checkout from the cache (the worktree
+ * was deleted - the merged-and-gone case), else null (caller keeps its
+ * current failure behavior). Worktrees share refs/heads and config with the
+ * main checkout, so git reads are equivalent from either; only HEAD and the
+ * index are per-worktree.
+ */
+export async function resolveSpawnCwd(dir: string, cache?: RepoPathCache): Promise<string | null> {
+  if (pathExists(dir)) return dir;
+  const row = cache ? await findValidRow(dir, cache) : null;
+  return row?.mainPath ?? null;
+}
+
 /**
  * Resolves the canonical repository identity from the given directory.
  *
  * Resolution chain:
  * 1. Parse `owner/repo` from `git remote get-url origin`
- * 2. Fall back to the basename of the git-common-dir (worktree-safe)
+ * 2. Fall back to the basename of the main checkout (resolved from the
+ *    absolute git-common-dir, so this is worktree-safe: the common dir
+ *    lives in the main checkout, not the worktree)
  * 3. Fall back to the directory basename
+ *
+ * When the directory no longer exists (deleted worktree), steps 1-2 spawn
+ * -reject and the cache is consulted for the identity it recorded while the
+ * directory was alive; a miss returns "unknown" rather than a plausible
+ * wrong name, because resolveStore degrades "unknown" to the global store
+ * but a branch-shaped store name silently mis-targets memories.
  */
-export async function detectRepo(cwd?: string): Promise<string> {
+export async function detectRepo(cwd?: string, cache?: RepoPathCache): Promise<string> {
   const dir = cwd ?? process.env.CURSOR_PROJECT_DIR ?? process.env.CLAUDE_PROJECT_DIR ?? process.cwd();
 
   try {
     const remote = await $`git remote get-url origin`.cwd(dir).quiet();
     if (remote.exitCode === 0) {
       const parsed = parseGitUrl(remote.stdout.toString());
-      if (parsed) return parsed;
+      if (parsed) {
+        await recordRepoPath(dir, parsed, cache);
+        return parsed;
+      }
     }
   } catch {
-    // no remote 'origin', or not a git repo
+    // no remote 'origin', spawn failure (deleted dir), or not a git repo
   }
 
   try {
-    const gitDir = await $`git rev-parse --git-common-dir`.cwd(dir).quiet();
-    if (gitDir.exitCode === 0) {
-      // Handle both "/path/to/.git" (absolute) and ".git" (relative,
-      // when cwd is the repo root itself).
-      const d = gitDir.stdout.toString().trim();
-      const parent = d.endsWith("/.git") ? d.slice(0, -5) : (d === ".git" ? "" : d);
-      const name = parent.split("/").pop() || "unknown";
-      if (name !== "unknown") return name;
+    const main = await resolveMainCheckout(dir);
+    if (main) {
+      const name = basename(main);
+      if (name !== "" && name !== "unknown") {
+        await recordRepoPath(dir, name, cache);
+        return name;
+      }
     }
   } catch {
     // not a git repo
   }
 
+  if (!pathExists(dir)) {
+    const row = cache ? await findValidRow(dir, cache) : null;
+    return row?.repoSlug ?? "unknown";
+  }
+
   return dir.split("/").pop() || "unknown";
 }
 
@@ -109,14 +287,17 @@ export async function detectRepo(cwd?: string): Promise<string> {
  * Local branch names in the given directory's repository. Used to detect
  * branch-scoped memories whose branch no longer exists. Returns [] outside
  * a git repo - callers must treat that as "unknown", not "no branches",
- * or every branch-scoped memory would look orphaned.
+ * or every branch-scoped memory would look orphaned. Falls back to the
+ * cached main checkout when the worktree was deleted: refs/heads is shared
+ * across worktrees, so the branch list is identical from either.
  */
-export async function listBranches(cwd: string): Promise<string[]> {
+export async function listBranches(cwd: string, cache?: RepoPathCache): Promise<string[]> {
+  const dir = (await resolveSpawnCwd(cwd, cache)) ?? cwd;
   // The format string is interpolated because Bun's shell parser rejects
   // bare parentheses in template literals.
   const fmt = "%(refname:short)";
   try {
-    const out = await $`git for-each-ref --format=${fmt} refs/heads`.cwd(cwd).quiet();
+    const out = await $`git for-each-ref --format=${fmt} refs/heads`.cwd(dir).quiet();
     if (out.exitCode !== 0) return [];
     return out.stdout.toString().split("\n").map((s) => s.trim()).filter(Boolean);
   } catch {

package/src/hygiene.ts

@@ -1,5 +1,5 @@
 import type { ThatchDB } from "./db";
-import { listBranches } from "./git";
+import { listBranches, type RepoPathCache } from "./git";
 
 const STALE_DAYS = 90;
 
@@ -7,11 +7,15 @@ const STALE_DAYS = 90;
  * Counts that give the agent standing cause to tend the store. Only non-zero
  * signals are reported; a healthy store stays silent. Shared by the opencode
  * plugin's session-start hook and the CLI's `thatch reminder` subcommand.
+ * The optional cache lets listBranches fall back to the cached main checkout
+ * when the worktree was deleted (refs are shared, so the branch list is
+ * identical from either).
  */
 export async function hygieneReport(
   db: ThatchDB,
   repo: string,
   worktree: string,
+  repoCache?: RepoPathCache,
 ): Promise<string | null> {
   const parts: string[] = [];
 
@@ -30,7 +34,7 @@ export async function hygieneReport(
   // branch-scoped memory look orphaned - skip the check in that case.
   const scoped = db.branchesInStore(repo);
   if (scoped.length > 0) {
-    const live = await listBranches(worktree);
+    const live = await listBranches(worktree, repoCache);
     if (live.length > 0) {
       const orphaned = scoped.filter((b) => !live.includes(b));
       const n = db.entryCountForBranches(repo, orphaned);