@miller-tech/uap 1.165.0 → 1.169.0

package/dist/cli/worktree.js

@@ -1,11 +1,40 @@
 import chalk from 'chalk';
 import ora from 'ora';
 import { cpSync, existsSync, readdirSync, mkdirSync } from 'fs';
-import { join } from 'path';
+import { join, dirname, resolve, sep } from 'path';
 import { simpleGit } from 'simple-git';
 import Database from 'better-sqlite3';
-import { execSync } from 'child_process';
+import { execSync, execFileSync } from 'child_process';
+/** Commits behind the integration ref at which a worktree reads as abandoned. */
+export const STALE_BEHIND_LIMIT = 200;
 let worktreeDb = null;
+/**
+ * The MAIN checkout — where .worktrees/ and the shared coordination DB live.
+ * git-common-dir resolves it even when called from inside a linked worktree.
+ */
+async function mainRootOf(git) {
+    try {
+        const common = (await git.raw(['rev-parse', '--path-format=absolute', '--git-common-dir'])).trim();
+        if (common)
+            return dirname(common);
+    }
+    catch {
+        // older git without --path-format, or not a repo
+    }
+    try {
+        // NOT --show-toplevel: inside a linked worktree that returns the WORKTREE's
+        // root, which has no agents/ dir — silently disabling liveness in exactly the
+        // case this helper exists for. The relative form of --git-common-dir has
+        // existed since git 2.5 and still points at the MAIN .git.
+        const rel = (await git.raw(['rev-parse', '--git-common-dir'])).trim();
+        if (rel)
+            return dirname(resolve(process.cwd(), rel));
+    }
+    catch {
+        // not a repo
+    }
+    return process.cwd();
+}
 function getWorktreeDb(cwd) {
     if (worktreeDb)
         return worktreeDb;
@@ -53,7 +82,13 @@ export async function worktreeCommand(action, options = {}) {
     }
     switch (action) {
         case 'create':
-            await createWorktree(cwd, git, options.slug, options.from);
+            await createWorktree(cwd, git, options.slug, options.from, options.noFetch);
+            break;
+        case 'sync':
+            await syncWorktree(cwd, git, { id: options.id, all: options.all });
+            break;
+        case 'hygiene':
+            await worktreeHygiene(cwd, git, { brief: options.brief });
             break;
         case 'list':
             await listWorktrees(cwd, git);
@@ -79,7 +114,7 @@ export async function worktreeCommand(action, options = {}) {
             break;
     }
 }
-async function createWorktree(cwd, git, slug, baseBranch) {
+async function createWorktree(cwd, git, slug, baseBranch, noFetch) {
     const spinner = ora('Creating worktree...').start();
     try {
         // Get next ID atomically from DB
@@ -88,11 +123,23 @@ async function createWorktree(cwd, git, slug, baseBranch) {
         const worktreeName = `${paddedId}-${slug}`;
         const branchName = `feature/${worktreeName}`;
         const worktreePath = join(cwd, '.worktrees', worktreeName);
-        // Get current branch (base)
+        // FRESH-BASE GATE. A worktree used to be cut from whatever the main checkout
+        // happened to have at HEAD — so if local master was stale (or the operator was
+        // parked on some unrelated branch), the agent started N commits behind and every
+        // file it touched was at risk of silently reverting work that had already landed.
+        // Observed live: a worktree created while local master was 1 behind origin was
+        // born stale, and the oldest worktrees in this repo drifted to 1241 commits behind.
+        // Base on the REMOTE tip by default; --from still wins for deliberate stacking.
         spinner.text = 'Resolving base branch...';
-        const currentBranch = await git.revparse(['--abbrev-ref', 'HEAD']);
-        let branchBase = currentBranch.trim();
+        let branchBase;
         if (baseBranch) {
+            // Explicit base: fetch it first so `--from origin/x` (and a local ref that
+            // tracks it) resolves to the current remote tip rather than a stale copy.
+            // Strip the remote prefix — `git fetch origin origin/x` is not a valid
+            // refspec, so it failed silently and left the stale local ref in place.
+            if (!noFetch) {
+                await fetchQuietly(git, baseBranch.replace(/^origin\//, ''));
+            }
             try {
                 await git.revparse([baseBranch]);
                 branchBase = baseBranch;
@@ -102,6 +149,9 @@ async function createWorktree(cwd, git, slug, baseBranch) {
                 process.exit(1);
             }
         }
+        else {
+            branchBase = await resolveFreshBase(git, { noFetch, spinner });
+        }
         // Create worktree with new branch
         spinner.text = `Creating branch ${branchName}...`;
         await git.raw(['worktree', 'add', '-b', branchName, worktreePath, branchBase]);
@@ -140,7 +190,8 @@ async function createWorktree(cwd, git, slug, baseBranch) {
     `).run(slug, branchName, worktreePath);
         spinner.succeed(`Created worktree: ${worktreeName}`);
         console.log(chalk.dim(`  Branch: ${branchName}`));
-        console.log(chalk.dim(`  Path: ${worktreePath}`));
+        console.log(chalk.dim(`  Base:   ${branchBase}`));
+        console.log(chalk.dim(`  Path:   ${worktreePath}`));
         console.log('');
         console.log(chalk.bold('Next steps:'));
         console.log(`  cd .worktrees/${worktreeName}`);
@@ -275,17 +326,418 @@ function ensurePrNumber(worktreePath) {
     }
 }
 async function syncBranchWithMaster(worktreeGit, branch) {
-    await worktreeGit.fetch(['origin', 'master']);
-    const behindRaw = await worktreeGit.raw(['rev-list', '--count', `${branch}..origin/master`]);
+    const base = await resolveIntegrationRef(worktreeGit);
+    await fetchQuietly(worktreeGit, base.replace(/^origin\//, ''));
+    const behindRaw = await worktreeGit.raw(['rev-list', '--count', `${branch}..${base}`]);
     const behind = parseRevListCount(behindRaw);
     if (behind === 0) {
         return;
     }
     try {
-        await worktreeGit.raw(['merge', '--no-edit', 'origin/master']);
+        await worktreeGit.raw(['merge', '--no-edit', base]);
+    }
+    catch {
+        throw new Error(`Worktree branch is behind ${base} and automatic sync failed. Resolve merge conflicts in the worktree, then rerun the command.`);
+    }
+}
+/** Best-effort fetch — never fails the caller (offline, no remote, auth prompt). */
+async function fetchQuietly(git, ref) {
+    try {
+        await git.fetch(ref ? ['origin', ref] : ['origin']);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Name of the repo's integration branch, without the remote prefix.
+ * Prefers origin/HEAD (what the remote itself calls default), then the usual
+ * suspects, then the current local branch. Hard-coding "master" broke every
+ * main-branch repo that installed UAP.
+ */
+export async function resolveDefaultBranch(git) {
+    try {
+        const head = await git.raw(['symbolic-ref', '--quiet', 'refs/remotes/origin/HEAD']);
+        const name = head.trim().replace('refs/remotes/origin/', '');
+        if (name)
+            return name;
+    }
+    catch {
+        // origin/HEAD not set (common on clones made with --single-branch) — fall through.
+    }
+    for (const candidate of ['master', 'main']) {
+        try {
+            await git.revparse([`refs/remotes/origin/${candidate}`]);
+            return candidate;
+        }
+        catch {
+            // not present — try the next one
+        }
+    }
+    try {
+        return (await git.revparse(['--abbrev-ref', 'HEAD'])).trim();
+    }
+    catch {
+        return 'master';
+    }
+}
+/** Fully-qualified ref to integrate against: `origin/<default>` when the remote has it. */
+export async function resolveIntegrationRef(git) {
+    const branch = await resolveDefaultBranch(git);
+    try {
+        await git.revparse([`refs/remotes/origin/${branch}`]);
+        return `origin/${branch}`;
+    }
+    catch {
+        return branch;
+    }
+}
+/**
+ * The ref a new worktree should be cut from: the freshly-fetched remote tip.
+ * Falls back to the local branch when there is no reachable remote, so this
+ * still works offline and in never-pushed repos.
+ */
+async function resolveFreshBase(git, opts = {}) {
+    const defaultBranch = await resolveDefaultBranch(git);
+    if (!opts.noFetch) {
+        if (opts.spinner)
+            opts.spinner.text = `Fetching origin/${defaultBranch}...`;
+        await fetchQuietly(git, defaultBranch);
+    }
+    try {
+        await git.revparse([`refs/remotes/origin/${defaultBranch}`]);
+        return `origin/${defaultBranch}`;
+    }
+    catch {
+        // No remote-tracking ref (offline first-run, local-only repo): use the local
+        // branch if it exists, else whatever HEAD is. Never fail worktree creation.
+    }
+    try {
+        await git.revparse([defaultBranch]);
+        return defaultBranch;
+    }
+    catch {
+        return 'HEAD';
+    }
+}
+/**
+ * Branches a LIVE agent is currently announcing work on.
+ *
+ * Git metadata alone cannot tell "abandoned" from "someone is working here this
+ * second": both look like an old branch with uncommitted files. That ambiguity is
+ * not academic — a worktree in this repo was read as abandoned WIP and merged
+ * forward while its owning agent was mid-session, because the drift report only
+ * ever consulted git. The coordination DB knows the difference; join against it.
+ *
+ * Liveness uses the same heartbeat window as coordinate-file.sh so "live" means
+ * one thing across the system. Fail-open: an unreadable DB marks nothing active.
+ */
+export function liveAgentBranches(mainRoot) {
+    // Validate like coordinate-file.sh does, or the same env var means "120s" to
+    // the hook and "protection off" to us: parseInt('-1') is truthy, and a
+    // negative window matches no rows.
+    const raw = Number.parseInt(process.env.UAP_COORD_LIVE_SECONDS ?? '', 10);
+    const windowSeconds = Number.isFinite(raw) && raw > 0 ? raw : 120;
+    const branches = new Set();
+    const dbPath = join(mainRoot, 'agents', 'data', 'coordination', 'coordination.db');
+    if (!existsSync(dbPath))
+        return { branches, readable: true }; // genuinely no coordination: idle
+    let db = null;
+    try {
+        db = new Database(dbPath, { readonly: true, fileMustExist: true });
+        // Readers rarely block in WAL, but SQLITE_BUSY is likeliest exactly when
+        // agents ARE live — the moment a fail-open would be most wrong.
+        db.pragma('busy_timeout = 10000');
+        // UNION the two writers. An agent that has registered and is heartbeating
+        // but has no OPEN announcement — just started, only reading, or its
+        // announcements were completed at session end — is still live.
+        const rows = db
+            .prepare(`SELECT DISTINCT branch FROM (
+           SELECT wa.worktree_branch AS branch
+             FROM work_announcements wa
+             LEFT JOIN agent_registry ar ON ar.id = wa.agent_id
+            WHERE wa.completed_at IS NULL
+              AND wa.worktree_branch IS NOT NULL
+              AND COALESCE(ar.status, 'active') = 'active'
+              AND (strftime('%s','now')
+                   - strftime('%s', COALESCE(ar.last_heartbeat, wa.announced_at))) < :win
+           UNION
+           SELECT ar2.worktree_branch AS branch
+             FROM agent_registry ar2
+            WHERE ar2.status = 'active'
+              AND ar2.worktree_branch IS NOT NULL
+              AND (strftime('%s','now') - strftime('%s', ar2.last_heartbeat)) < :win
+         )`)
+            .all({ win: windowSeconds });
+        for (const r of rows)
+            if (r.branch)
+                branches.add(r.branch);
+        return { branches, readable: true };
+    }
+    catch {
+        // Could not read it. Say so — do not let "unknown" masquerade as "idle".
+        return { branches, readable: false };
+    }
+    finally {
+        try {
+            db?.close();
+        }
+        catch {
+            /* ignore */
+        }
+    }
+}
+/**
+ * Measure one worktree's drift against the integration ref. Never throws.
+ *
+ * Kept to ONE git process on the common path. The first version spent four
+ * (`rev-parse`, two `rev-list`, `status`) which, across this repo's 152
+ * worktrees, ran ~600 sequential git invocations — comfortably past the 15s
+ * budget the session banner allows, so the advisory was always killed before it
+ * printed while still costing the full 15 seconds.
+ *
+ * @param branch pre-resolved from `git worktree list --porcelain`, which already
+ *   reports it — re-asking per worktree was a free process we were paying for.
+ * @param withDirty `git status` is by far the most expensive call (it stats the
+ *   whole tree). Only worth it for worktrees that already look interesting.
+ */
+export async function measureDrift(worktreePath, integrationRef, branch, withDirty = true) {
+    try {
+        const wtGit = simpleGit(worktreePath);
+        const resolved = branch ?? (await wtGit.revparse(['--abbrev-ref', 'HEAD'])).trim();
+        // One symmetric-difference call replaces two rev-lists. Note the THREE dots:
+        // `--left-right --count a...b` emits "<behind>\t<ahead>" relative to the merge base.
+        const raw = await wtGit.raw([
+            'rev-list',
+            '--left-right',
+            '--count',
+            `${integrationRef}...HEAD`,
+        ]);
+        const [behindRaw, aheadRaw] = raw.trim().split(/\s+/);
+        const behind = parseRevListCount(behindRaw ?? '0');
+        const ahead = parseRevListCount(aheadRaw ?? '0');
+        let dirty = 0;
+        if (withDirty) {
+            const status = await wtGit.status();
+            // status.files is the authoritative entry list; summing the category arrays
+            // double-counts, because a staged-and-modified file appears in both.
+            dirty = status.files.length;
+        }
+        const name = worktreePath.split('.worktrees/')[1] || worktreePath;
+        return { name, path: worktreePath, branch: resolved, behind, ahead, dirty };
+    }
+    catch {
+        return null;
+    }
+}
+/** All linked worktrees under .worktrees/, with their branches. */
+async function listWorktreeRefs(git) {
+    try {
+        const raw = await git.raw(['worktree', 'list', '--porcelain']);
+        const refs = [];
+        let current = null;
+        for (const line of raw.split('\n')) {
+            if (line.startsWith('worktree ')) {
+                current = line.replace('worktree ', '').trim();
+            }
+            else if (line.startsWith('branch ') && current) {
+                if (current.includes('.worktrees')) {
+                    refs.push({ path: current, branch: line.replace('branch refs/heads/', '').trim() });
+                }
+                current = null;
+            }
+        }
+        return refs;
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Run an async mapper over items with bounded concurrency.
+ * Unbounded would spawn 152×N git processes at once and thrash the machine;
+ * sequential leaves the CPU idle while each git process does IO.
+ */
+async function mapLimit(items, limit, fn) {
+    const out = new Array(items.length);
+    let next = 0;
+    const workers = Array.from({ length: Math.max(1, Math.min(limit, items.length)) }, async () => {
+        while (next < items.length) {
+            const i = next++;
+            out[i] = await fn(items[i]);
+        }
+    });
+    await Promise.all(workers);
+    return out;
+}
+/**
+ * `uap worktree sync` — pull the integration branch into a worktree MID-FLIGHT.
+ * The old flow only synced at `finish`, which is the most expensive possible
+ * moment to discover a conflict. This makes re-basing cheap and routine.
+ */
+async function syncWorktree(cwd, git, opts = {}) {
+    const integrationRef = await resolveIntegrationRef(git);
+    const spinner = ora(`Syncing with ${integrationRef}...`).start();
+    let targets;
+    if (opts.all) {
+        targets = (await listWorktreeRefs(git)).map((r) => r.path);
+    }
+    else if (opts.id) {
+        const found = findWorktreeById(cwd, opts.id);
+        if (!found) {
+            spinner.fail(`Worktree with ID ${opts.id} not found`);
+            return;
+        }
+        targets = [found];
+    }
+    else {
+        // Default: the worktree we are standing in.
+        targets = [cwd];
+    }
+    await fetchQuietly(git, integrationRef.replace(/^origin\//, ''));
+    spinner.stop();
+    let synced = 0;
+    let conflicted = 0;
+    let already = 0;
+    let skipped = 0;
+    // Probe concurrently, then merge serially: merges mutate working trees and
+    // their output should stay readable and attributable.
+    const drifts = await mapLimit(targets, 8, (t) => measureDrift(t, integrationRef));
+    for (const drift of drifts) {
+        if (!drift)
+            continue;
+        if (drift.behind === 0) {
+            already++;
+            continue;
+        }
+        // Merging into a dirty tree aborts with "local changes would be overwritten",
+        // which the old code reported as a CONFLICT — misleading, and with --all it
+        // would say that about every dirty worktree in the repo.
+        if (drift.dirty > 0) {
+            skipped++;
+            console.log(chalk.yellow(`  ⏭  ${drift.name}: ${drift.dirty} uncommitted change(s) — commit or stash first ` +
+                `(${drift.behind} behind)`));
+            continue;
+        }
+        const wtGit = simpleGit(drift.path);
+        try {
+            await wtGit.raw(['merge', '--no-edit', integrationRef]);
+            synced++;
+            console.log(chalk.green(`  ✔ ${drift.name}: merged ${drift.behind} commit(s) from ${integrationRef}`));
+        }
+        catch {
+            conflicted++;
+            console.log(chalk.red(`  ✖ ${drift.name}: CONFLICT merging ${integrationRef} ` +
+                `(${drift.behind} behind). Resolve in ${drift.path}, then commit.`));
+        }
+    }
+    console.log('');
+    console.log(chalk.bold(`Sync: ${synced} updated, ${already} already current, ` +
+        `${skipped} skipped (dirty), ${conflicted} need manual resolution`));
+    if (conflicted > 0) {
+        process.exitCode = 1;
+    }
+}
+/**
+ * `uap worktree hygiene` — surface drift and at-risk work across ALL worktrees.
+ * Silent accumulation is how work gets lost: a branch nobody re-synced for a
+ * thousand commits will either conflict violently or be quietly abandoned.
+ */
+async function worktreeHygiene(_cwd, git, opts = {}) {
+    const integrationRef = await resolveIntegrationRef(git);
+    // Refresh the remote tip first: measuring against a stale origin/master
+    // under-reports drift, which is precisely what this report exists to catch.
+    await fetchQuietly(git, integrationRef.replace(/^origin\//, ''));
+    const refs = await listWorktreeRefs(git);
+    // Two passes so `git status` — the expensive call — runs only where it can
+    // change the verdict. Everything else needs one git process per worktree.
+    const cheap = await mapLimit(refs, 8, (r) => measureDrift(r.path, integrationRef, r.branch, false));
+    const measured = await mapLimit(cheap.filter((d) => d !== null), 8, async (d) => (d.ahead > 0 ? ((await measureDrift(d.path, integrationRef, d.branch, true)) ?? d) : d));
+    // Mark the worktrees someone is actually working in, so "old" is never read as
+    // "abandoned". A live worktree must never be offered up for pruning.
+    const live = liveAgentBranches(await mainRootOf(git)).branches;
+    const drifts = measured.map((d) => ({ ...d, active: live.has(d.branch) }));
+    const atRisk = drifts.filter((d) => d.ahead > 0 || d.dirty > 0);
+    const summary = summarizeHygiene(drifts, integrationRef);
+    if (opts.brief) {
+        if (summary)
+            console.log(summary);
+        return;
+    }
+    console.log(chalk.bold(`\n🧹 Worktree hygiene (vs ${integrationRef})\n`));
+    if (drifts.length === 0) {
+        console.log(chalk.dim('No linked worktrees.'));
+        return;
+    }
+    drifts.sort((a, b) => b.behind - a.behind);
+    console.log('| Worktree | Behind | Ahead | Dirty | Status |');
+    console.log('|----------|--------|-------|-------|--------|');
+    for (const d of drifts) {
+        // ACTIVE outranks every other label: an old, drifted, dirty worktree with a
+        // live agent in it is not stale work, it is work in progress.
+        const status = d.active
+            ? chalk.cyan('ACTIVE — agent working here')
+            : d.ahead > 0 || d.dirty > 0
+                ? chalk.yellow('UNMERGED WORK')
+                : d.behind > STALE_BEHIND_LIMIT
+                    ? chalk.red('STALE — safe to prune')
+                    : chalk.dim('clean');
+        console.log(`| ${d.name} | ${d.behind} | ${d.ahead} | ${d.dirty} | ${status} |`);
+    }
+    console.log('');
+    if (summary)
+        console.log(summary);
+    if (atRisk.length > 0) {
+        console.log(chalk.dim('  Reconcile with: uap worktree sync --id <id>   then   uap worktree pr <id>'));
+        console.log(chalk.dim('  Abandon with:  uap worktree cleanup <id>'));
+    }
+    console.log(chalk.dim('  Bulk prune merged//stale worktrees: uap worktree prune --older-than 30'));
+    console.log('');
+}
+/**
+ * One-line advisory for session-start. Returns '' when nothing needs attention,
+ * so the caller can stay silent on a healthy repo.
+ */
+export function summarizeHygiene(drifts, integrationRef) {
+    if (drifts.length === 0)
+        return '';
+    // Active worktrees are excluded from BOTH risk counts: they are neither
+    // abandoned nor at risk, they are being worked on. Counting them as drift is
+    // how a live worktree gets mistaken for salvage.
+    const idle = drifts.filter((d) => !d.active);
+    const active = drifts.filter((d) => d.active);
+    const atRisk = idle.filter((d) => d.ahead > 0 || d.dirty > 0);
+    const stale = idle.filter((d) => d.behind > STALE_BEHIND_LIMIT);
+    if (atRisk.length === 0 && stale.length === 0 && active.length === 0)
+        return '';
+    const parts = [];
+    if (atRisk.length > 0) {
+        parts.push(`${atRisk.length} worktree(s) hold unmerged or uncommitted work`);
+    }
+    if (stale.length > 0) {
+        parts.push(`${stale.length} are >${STALE_BEHIND_LIMIT} commits behind ${integrationRef}`);
+    }
+    if (active.length > 0) {
+        parts.push(`${active.length} have a LIVE agent working in them (do not reclaim)`);
+    }
+    if (parts.length === 0)
+        return '';
+    const ranked = idle.length > 0 ? idle : drifts;
+    const worst = ranked.reduce((a, b) => (b.behind > a.behind ? b : a));
+    return (`⚠️  Worktree drift: ${parts.join('; ')} ` +
+        `(worst: ${worst.name} at ${worst.behind} behind). Run \`uap worktree hygiene\`.`);
+}
+/** Resolve a worktree directory from its numeric ID. */
+function findWorktreeById(cwd, id) {
+    try {
+        const worktreesDir = join(cwd, '.worktrees');
+        const entries = readdirSync(worktreesDir);
+        const match = entries.find((e) => e.startsWith(`${id.padStart(3, '0')}-`));
+        return match ? join(worktreesDir, match) : null;
     }
     catch {
-        throw new Error('Worktree branch is behind origin/master and automatic sync failed. Resolve merge conflicts in the worktree, then rerun the command.');
+        return null;
     }
 }
 export function parseRevListCount(output) {
@@ -485,21 +937,101 @@ async function pruneStaleWorktrees(cwd, options) {
     const { rmSync } = await import('fs');
     const db = getWorktreeDb(cwd);
     const days = options.olderThan;
-    const cutoff = Date.now() - days * 24 * 60 * 60 * 1000;
-    // List stale worktrees (status='cleaned' or older than threshold)
+    // created_at is stored in SECONDS (`strftime('%s','now')`). Comparing it to a
+    // MILLISECOND cutoff made `created_at < cutoff` true for every row that will
+    // ever exist, so `--older-than` filtered nothing: a worktree created a minute
+    // ago was always a prune candidate. Verified against this repo's registry —
+    // 117/117 rows selected even at `--older-than 3650`. Compare in one unit.
+    const cutoffSeconds = Math.floor(Date.now() / 1000) - days * 24 * 60 * 60;
     const stale = db.prepare(`
-    SELECT id, slug, worktree_path, created_at, status
+    SELECT id, slug, branch_name, worktree_path, created_at, status
     FROM worktrees
     WHERE created_at < ?
-  `).all(cutoff);
+  `).all(cutoffSeconds);
     if (stale.length === 0) {
         console.log(chalk.green(`No worktrees older than ${days} days found`));
         return;
     }
+    // NEVER reclaim a worktree an agent is live in. Age is not abandonment: a
+    // month-old worktree can have someone working in it right now, and prune
+    // deletes the directory — uncommitted work included. This is the one place in
+    // the system where getting "stale" wrong is unrecoverable.
+    const liveness = liveAgentBranches(await mainRootOf(simpleGit(cwd)));
+    if (!liveness.readable) {
+        // FAIL CLOSED. An empty set means both "nobody is live" and "I could not
+        // tell" — and the consequence of guessing wrong here is rm -rf of somebody's
+        // uncommitted work. Refuse rather than assume the repo is idle.
+        console.log(chalk.red('Refusing to prune: the coordination DB could not be read, so live agents cannot be ruled out.'));
+        console.log(chalk.dim('  Re-run with --force to prune anyway.'));
+        if (!options.force)
+            return;
+    }
+    const liveBranches = liveness.branches;
+    // Containment: only ever delete inside <cwd>/.worktrees/. worktree_path comes
+    // from a registry under .uap/, which is exempt from the worktree write guard —
+    // so a planted row must not be able to aim rmSync at the main checkout.
+    const worktreesRoot = resolve(cwd, '.worktrees');
+    const protectedRows = [];
+    const outOfScope = [];
+    const prunable = stale.filter((row) => {
+        const abs = resolve(row.worktree_path);
+        if (abs !== worktreesRoot && !abs.startsWith(worktreesRoot + sep)) {
+            outOfScope.push(row);
+            return false;
+        }
+        // Prefer the branch the registry recorded; only consult git if it is absent.
+        // Strip GIT_* from the child env: git resolves GIT_DIR before cwd, so an
+        // ambient value makes every worktree report the SAME branch — which would
+        // mark every live worktree prunable in one shot. (This repo has hit GIT_DIR
+        // poisoning before; see the enforcers' _clean_env.)
+        let branch = row.branch_name ?? '';
+        if (!branch) {
+            try {
+                const env = { ...process.env };
+                for (const k of ['GIT_DIR', 'GIT_WORK_TREE', 'GIT_COMMON_DIR', 'GIT_INDEX_FILE', 'GIT_PREFIX']) {
+                    delete env[k];
+                }
+                branch = execFileSync('git', ['rev-parse', '--abbrev-ref', 'HEAD'], {
+                    cwd: row.worktree_path,
+                    encoding: 'utf-8',
+                    stdio: ['ignore', 'pipe', 'ignore'],
+                    timeout: 10_000,
+                    env,
+                }).trim();
+            }
+            catch {
+                // Cannot determine the branch => cannot prove it is idle => protect it.
+                protectedRows.push(row);
+                return false;
+            }
+        }
+        if (branch && liveBranches.has(branch)) {
+            protectedRows.push(row);
+            return false;
+        }
+        return true;
+    });
+    if (outOfScope.length > 0) {
+        console.log(chalk.red(`Refusing ${outOfScope.length} registry row(s) whose path is outside ${worktreesRoot}: ` +
+            `${outOfScope.map((r) => r.worktree_path).join(', ')}`));
+    }
+    if (protectedRows.length > 0) {
+        console.log(chalk.cyan(`Skipping ${protectedRows.length} worktree(s) with a LIVE agent working in them: ` +
+            `${protectedRows.map((r) => r.slug).join(', ')}`));
+    }
+    if (prunable.length === 0) {
+        console.log(chalk.green('Nothing prunable — every candidate has a live agent in it.'));
+        return;
+    }
+    stale.length = 0;
+    stale.push(...prunable);
     console.log(chalk.bold(`Found ${stale.length} stale worktree(s) older than ${days} days:`));
     console.log('');
     for (const wt of stale) {
-        const age = Math.floor((Date.now() - wt.created_at) / (1000 * 60 * 60 * 24));
+        // created_at is SECONDS; dividing a seconds-vs-milliseconds difference by a
+        // day in ms printed every worktree as ~20,600 days old — the visible symptom
+        // of the cutoff bug fixed above.
+        const age = Math.floor((Date.now() / 1000 - wt.created_at) / (60 * 60 * 24));
         const statusColor = wt.status === 'cleaned' ? chalk.yellow : chalk.dim;
         console.log(`  ${wt.id}: ${wt.slug} (${age} days old) - ${statusColor(wt.status)}`);
     }
@@ -516,24 +1048,26 @@ async function pruneStaleWorktrees(cwd, options) {
             return;
         }
     }
-    // Prune
+    // DRY RUN: report and return BEFORE touching anything. This check used to sit
+    // AFTER the delete loop, so `--dry-run` deleted every directory and then
+    // printed "[DRY RUN] Would prune" — and because dryRun also skipped the
+    // confirmation prompt, it did so without asking. The flag documented as
+    // "Preview without making changes" was the most destructive way to invoke it.
+    if (options.dryRun) {
+        console.log(chalk.yellow(`[DRY RUN] Would prune ${stale.length} worktree(s) and remove ` +
+            `${stale.filter((wt) => existsSync(wt.worktree_path)).length} directory(ies). Nothing was changed.`));
+        return;
+    }
     let pruned = 0;
     let directoriesRemoved = 0;
     for (const wt of stale) {
-        // Remove from DB
         db.prepare('DELETE FROM worktrees WHERE id = ?').run(wt.id);
         pruned++;
-        // Remove directory
         if (existsSync(wt.worktree_path)) {
             rmSync(wt.worktree_path, { recursive: true, force: true });
             directoriesRemoved++;
         }
     }
-    if (options.dryRun) {
-        console.log(chalk.yellow(`[DRY RUN] Would prune ${pruned} worktree(s), remove ${directoriesRemoved} directory(ies)`));
-    }
-    else {
-        console.log(chalk.green(`Pruned ${pruned} worktree(s), removed ${directoriesRemoved} directory(ies)`));
-    }
+    console.log(chalk.green(`Pruned ${pruned} worktree(s), removed ${directoriesRemoved} directory(ies)`));
 }
 //# sourceMappingURL=worktree.js.map