@retasc/cli 1.42.1 → 1.43.0

package/CHANGELOG.md

@@ -6,6 +6,50 @@ release commits and the issues they reference.
 
 Dates are the npm publish date. Each entry names the RTSC issue behind it.
 
+## 1.43.0 (2026-09-05)
+
+- **RTSC-799** - `tidy`, `done` and `claim` now work out which branch is this repo's trunk
+  instead of assuming it is called `main`. Until this release `tidy` compared every branch
+  against `origin/main`, a name written into the source with no flag, no config and no way
+  to see it. In a repo whose trunk is `master` that comparison does not fail into view:
+  `git merge-base --is-ancestor` exits 128 for an unreadable ref, the code tested only for
+  0, and so a broken lookup and an honest "not merged" produced the same word. Every branch
+  read `merged: no`, nothing was ever reapable, and because `claim` creates a worktree per
+  issue and only `tidy` removes one, the worktrees accumulated with nothing printed to say
+  why. The team who reported it had thirty of them, built up over months, and could not tell
+  from the outside whether the tool was wrong or their setup was.
+  The trunk now comes from `origin/HEAD`, which is what `git clone` already records and what
+  `git fetch` re-records when it goes stale. Override it per repo with
+  `git config --local retasc.base origin/develop`, or per run with a new `--base` on `tidy`
+  and `done`. Read at `--local` scope on purpose: a plain `git config --get` also sees
+  `~/.gitconfig`, and one machine-wide value would have quietly redefined the trunk in every
+  repo on the box and outranked each repo's own `origin/HEAD`. When the trunk cannot be
+  worked out at all, that is an error naming the ref and every way to set one, because a
+  command that cannot tell what merged means must not go on to report that nothing did.
+  Ancestry now has three answers rather than two. "Git could not tell" is carried through as
+  its own state, prints as `?`, and is never deleted, not even under `--force`: that flag
+  means "unmerged, but I know the work landed elsewhere", which is a judgement about a branch
+  git actually reported on. Every run also prints the trunk it measured against, which is the
+  line that would have turned this into a one-minute diagnosis, and a shallow clone warns,
+  since missing history produces the same uniform "no".
+  Care taken with the sharp edges, because this turns a command that deleted nothing in those
+  repos into one that deletes:
+  - A stale `origin/HEAD`, which outlives the branch it names when a remote renames its trunk
+    and which git before 2.45 never repairs, falls through to the next candidate with a note
+    rather than refusing `claim`, `tidy` and `done` in a repo that is otherwise healthy.
+  - `done` still closes the issue when the trunk cannot be resolved. The control-plane close
+    is the durable half and a CI checkout legitimately has no `origin/HEAD`; the teardown is
+    what needs a trunk, so that is what reports.
+  - The first `--prune` after upgrading asks once before deleting five or more branches, since
+    it may be clearing months of work a team believed this command never touched. Scripts and
+    the MCP auto-reap never see the question, and `--yes` skips it.
+  - `claim` fetches before it proves the base exists, so a just-pushed base still works, and
+    resolves before taking the lease, so a claim is never held for a worktree that cannot be
+    created. It also prints the trunk it branched from.
+  - A bare repository is refused rather than operated on (the old path resolved to its parent
+    directory), a detached HEAD no longer defeats the "that's your current branch" guard, and
+    the watchdog now logs a non-zero exit from an auto-reap instead of swallowing it.
+
 ## 1.42.1 (2026-09-05)
 
 - **RTSC-832** — the model now actually appears. 1.42.0 read it from the SessionStart

package/dist/commands/claim.js

@@ -4,6 +4,7 @@ import { basename, dirname, resolve, sep } from "node:path";
 import { resolveMcpConn, readMcpJson, mcpCall, parseClaimResult, planWorktree, isValidIssueId, normalizeIssueId, resolveIssueRef, } from "../lib/claim.js";
 import { loadConfig } from "../config.js";
 import { clean } from "../lib/text.js";
+import { resolveBase, baseHelp } from "../lib/base.js";
 function git(args, cwd) {
     return spawnSync("git", args, { encoding: "utf8", cwd });
 }
@@ -72,6 +73,7 @@ export async function claimAction(opts) {
     let parentDir = opts.dir;
     let repoName = "repo";
     let inLinkedWorktree = false;
+    let base = "";
     if (makeWorktree) {
         const commonDir = gitOut(["rev-parse", "--git-common-dir"]);
         const gitDir = gitOut(["rev-parse", "--git-dir"]);
@@ -86,6 +88,38 @@ export async function claimAction(opts) {
         const mainCheckout = dirname(resolve(commonDir)); // <main>/.git → <main>
         repoName = basename(mainCheckout);
         parentDir = parentDir ?? dirname(mainCheckout);
+        // RTSC-799: the branch base is discovered from the repo, not assumed to be
+        // `origin/main`. Resolved HERE, before the claim: a lease taken for a worktree
+        // that then can't be created leaves the issue held by an agent with nowhere to
+        // work, and the caller has to hand it back to free it.
+        //
+        // The fetch comes FIRST, and has to. Resolving proves the base resolves to a
+        // commit, and a base that is only on the remote so far (a just-pushed branch, a
+        // --single-branch clone) does not resolve until it has been fetched. Proving
+        // before fetching would refuse claims that worked before this change.
+        if (opts.fetch !== false) {
+            const named = opts.base?.startsWith("origin/") ? opts.base.slice("origin/".length) : null;
+            const f = named ? git(["fetch", "origin", named]) : git(["fetch", "origin"]);
+            if (f.status !== 0)
+                note(`⚠ git fetch failed (${(f.stderr || "").trim().split("\n")[0]}); using local refs.`);
+        }
+        // Same cwd as `tidy` uses (the main checkout), so `claim` and the `tidy` that
+        // later judges the branch can never read a different trunk for the same repo.
+        const gitRun = (args) => {
+            const r = git(args, mainCheckout);
+            return { status: r.status, stdout: r.stdout ?? "" };
+        };
+        const resolved = resolveBase(gitRun, opts.base);
+        if (!resolved.ok) {
+            for (const line of baseHelp(resolved))
+                note(line);
+            note("  Nothing was claimed. Or pass --no-worktree to claim without one.");
+            process.exit(1);
+        }
+        if (resolved.staleOriginHead) {
+            note(`⚠ origin/HEAD still points at ${resolved.staleOriginHead}, which is gone. Branching from ${resolved.ref}.`);
+        }
+        base = resolved.ref;
     }
     // --- claim over MCP ------------------------------------------------------
     let claim;
@@ -170,14 +204,6 @@ export async function claimAction(opts) {
         finish(plan.path, plan.branch, issueId, title, claim.claimToken, opts);
         return;
     }
-    // Best-effort refresh of the base so the worktree starts from current origin.
-    const base = opts.base ?? "origin/main";
-    if (opts.fetch !== false) {
-        const remoteBranch = base.startsWith("origin/") ? base.slice("origin/".length) : null;
-        const f = remoteBranch ? git(["fetch", "origin", remoteBranch]) : git(["fetch", "origin"]);
-        if (f.status !== 0)
-            note(`⚠ git fetch failed (${(f.stderr || "").trim().split("\n")[0]}); using local ${base}.`);
-    }
     const add = git(["worktree", "add", plan.path, "-b", plan.branch, base]);
     if (add.status !== 0) {
         const err = (add.stderr || add.stdout || "").trim().split("\n")[0];
@@ -199,6 +225,9 @@ export async function claimAction(opts) {
     note(`✓ Claimed ${issueId}${title ? ` — ${title}` : ""}`);
     note(`  worktree: ${plan.path}`);
     note(`  branch:   ${plan.branch}`);
+    // Name the trunk here too: `tidy` prints it, and claim is the other command that
+    // acts on it. An unexpected trunk should be visible before the work starts.
+    note(`  from:     ${base}`);
     // RTSC-446: a fresh worktree checks out tracked files only — deps/artifacts are absent.
     note(`  Fresh worktree: only tracked files. Run the repo's usual setup (what docs/CI`);
     note(`  run on a fresh checkout) before your first build or test.`);

package/dist/commands/tidy.js

@@ -4,6 +4,7 @@ import { resolveMcpConn, readMcpJson, mcpCall, isValidIssueId } from "../lib/cla
 import { issueIdFromBranch, classifyBranch, parseWorktreePorcelain, } from "../lib/tidy.js";
 import { confirm, isInteractive } from "../lib/prompt.js";
 import { doneReadback } from "../lib/format.js";
+import { resolveBase, baseHelp, mergedInto, isShallow } from "../lib/base.js";
 // `retasc tidy` / `retasc done` (RTSC-93). The CLI already creates the worktree +
 // branch on claim (commands/claim.ts); this closes the loop — it tears them down
 // when the issue is done, reading status read-only from the control plane and
@@ -20,9 +21,11 @@ function gitOut(args, cwd) {
 function note(msg) {
     process.stderr.write(msg + "\n");
 }
-const BASE = "origin/main";
-/** Resolve the MCP connection + the main checkout, or exit with a clear message. */
-function setup() {
+/** Resolve the MCP connection, the main checkout, and the trunk — or exit with a
+ *  clear message. Every exit here happens BEFORE `done` writes a terminal status:
+ *  closing an issue and only then discovering the teardown can't run is the worse
+ *  of the two failures. */
+function setup(baseOpt) {
     const conn = resolveMcpConn({ mcpJson: readMcpJson() });
     if (!conn.key) {
         note("✗ No Retasc MCP key found. Run `retasc mcp install`, or set RETASC_MCP_KEY.");
@@ -33,11 +36,49 @@ function setup() {
         note("✗ Not inside a git repository.");
         process.exit(1);
     }
+    // In a BARE repo --git-common-dir is `.`, so this would resolve to the bare repo's
+    // PARENT — and every branch delete, worktree remove and `push --delete` below would
+    // then run against whatever repository happens to live there. Refuse instead.
+    if (gitOut(["rev-parse", "--is-bare-repository"]) === "true") {
+        note("✗ This is a bare repository — there are no worktrees or checkouts here to tidy.");
+        process.exit(1);
+    }
     // --git-common-dir always points at the MAIN checkout's .git, even from a linked
     // worktree — so worktree/branch ops always run against the main checkout.
     const mainCheckout = dirname(resolve(commonDir));
-    const currentBranch = gitOut(["rev-parse", "--abbrev-ref", "HEAD"]);
-    return { conn, mainCheckout, currentBranch };
+    // symbolic-ref, not `rev-parse --abbrev-ref`: the latter returns the literal string
+    // "HEAD" when detached, which would then match no branch and silently disarm the
+    // "that's your current branch" guard below.
+    const currentBranch = gitOut(["symbolic-ref", "--quiet", "--short", "HEAD"]);
+    // RTSC-799: the trunk is discovered, not assumed. An unresolvable one is a hard
+    // stop — the alternative it replaces was reporting every branch as unmerged and
+    // reaping nothing, for months, with nothing printed to say why.
+    const run = (args) => {
+        const r = git(args, mainCheckout);
+        return { status: r.status, stdout: r.stdout ?? "" };
+    };
+    // Refresh BEFORE resolving. The prune is what deletes `origin/master` after a remote
+    // rename, so resolving first would bless a ref this very command is about to remove,
+    // and every row would then read "?" against a trunk that no longer exists.
+    git(["fetch", "origin", "--prune"], mainCheckout);
+    const base = resolveBase(run, baseOpt);
+    if (!base.ok) {
+        return { conn, mainCheckout, currentBranch, run, base: null, baseFailure: base };
+    }
+    if (base.staleOriginHead) {
+        note(`⚠ origin/HEAD still points at ${base.staleOriginHead}, which is gone. Using ${base.ref}.`);
+        note(`  \`git remote set-head origin -a\` re-records it.`);
+    }
+    // A shallow clone can be missing the very commits ancestry is read from, which
+    // produces the same uniform "not merged" this command exists to stop believing.
+    // `null` (git couldn't say) warns too: a suppressed warning is the same silence.
+    const shallow = isShallow(run);
+    if (shallow !== false) {
+        note(shallow === true
+            ? `⚠ Shallow clone — merge state against ${base.ref} may be wrong. \`git fetch --unshallow\` for a true answer.`
+            : `⚠ Couldn't tell whether this is a shallow clone; merge state against ${base.ref} may be wrong.`);
+    }
+    return { conn, mainCheckout, currentBranch, run, base: base.ref, baseFailure: null };
 }
 /** Short ref names under a refspec (`origin/` stripped when asked). */
 function refList(mainCheckout, refspec, strip) {
@@ -51,8 +92,6 @@ function refList(mainCheckout, refspec, strip) {
  *  joined with its issue status (read-only) and merged-into-main state. */
 async function scan(ctx, only) {
     const { conn, mainCheckout } = ctx;
-    // Refresh so merged-state + the remote list are current. Best-effort.
-    git(["fetch", "origin", "--prune"], mainCheckout);
     const worktrees = parseWorktreePorcelain(gitOut(["worktree", "list", "--porcelain"], mainCheckout) ?? "");
     const wtByBranch = new Map();
     for (const w of worktrees)
@@ -87,7 +126,11 @@ async function scan(ctx, only) {
         const remote = remoteSet.has(branch);
         // Merged check prefers the remote ref (authoritative); falls back to the local.
         const ref = remote ? `origin/${branch}` : branch;
-        const merged = git(["merge-base", "--is-ancestor", ref, BASE], mainCheckout).status === 0;
+        const merged = mergedInto(ctx.run, ref, ctx.base);
+        // The base already resolved, so an unknown here is the ref itself — say so
+        // rather than letting a "no" in the table stand in for a failed check.
+        if (merged === null)
+            note(`⚠ ${branch}: git couldn't compare ${ref} against ${ctx.base} — treating it as unmerged.`);
         return {
             branch,
             issue,
@@ -100,6 +143,8 @@ async function scan(ctx, only) {
         };
     });
 }
+/** Ask once before a prune this large. See the call site for why. */
+const BULK_CONFIRM_AT = 5;
 const VERDICT_LABEL = {
     reap: "reap",
     orphan: "orphan — review",
@@ -111,7 +156,7 @@ function printTable(rows) {
     note(`  ${"branch".padEnd(w)}  issue      status     merged  verdict`);
     for (const r of rows) {
         note(`  ${r.branch.padEnd(w)}  ${(r.issue ?? "—").padEnd(9)}  ${(r.status ?? "—").padEnd(9)}  ` +
-            `${(r.merged ? "yes" : "no").padEnd(6)}  ${VERDICT_LABEL[r.verdict]}`);
+            `${(r.merged === null ? "?" : r.merged ? "yes" : "no").padEnd(6)}  ${VERDICT_LABEL[r.verdict]}`);
     }
 }
 /** Delete one branch's artifacts (worktree → local branch → remote branch),
@@ -123,13 +168,16 @@ function reap(row, ctx, force) {
         return "skipped";
     }
     // `row.merged` was computed from the REMOTE ref, but we force-delete the LOCAL
-    // branch below. If the local branch carries commits not yet on origin/main
+    // branch below. If the local branch carries commits not yet on the trunk
     // (committed-but-unpushed), skip unless --force — so `branch -D` can't silently
-    // discard them. (--force is the consented escape hatch.)
+    // discard them. (--force is the consented escape hatch.) An unknown answer skips
+    // for the same reason a "no" does: only a proven-landed branch gets deleted.
     if (row.local && !force) {
-        const localOnMain = git(["merge-base", "--is-ancestor", row.branch, BASE], mainCheckout).status === 0;
-        if (!localOnMain) {
-            note(`  · skip ${row.branch} — local branch has commits not on ${BASE} (unpushed?); --force to delete`);
+        const localOnBase = mergedInto(ctx.run, row.branch, ctx.base);
+        if (localOnBase !== true) {
+            note(localOnBase === null
+                ? `  · skip ${row.branch} — couldn't check its local branch against ${ctx.base}`
+                : `  · skip ${row.branch} — local branch has commits not on ${ctx.base} (unpushed?); --force to delete`);
             return "skipped";
         }
     }
@@ -157,7 +205,7 @@ function reap(row, ctx, force) {
             return "failed";
         }
     }
-    // -D is safe here: either the local branch is on origin/main (verified above) or
+    // -D is safe here: either the local branch is on the trunk (verified above) or
     // the user passed --force. `--` guards against any future caller bypassing the
     // issueIdFromBranch filter (the regex already forbids leading-dash names).
     if (row.local) {
@@ -184,12 +232,23 @@ function reap(row, ctx, force) {
  * --force; untracked branches (no matching issue) are never touched.
  */
 export async function tidyAction(opts) {
-    const ctx = setup();
-    const rows = await scan(ctx, opts.only);
+    const ctx = setup(opts.base);
+    // `tidy`'s entire job is merge state, so it has nothing to say without a trunk.
+    // (`done` treats the same failure as non-fatal: its write is the durable half.)
+    if (ctx.base === null) {
+        for (const line of baseHelp(ctx.baseFailure))
+            note(line);
+        process.exit(1);
+    }
+    const resolved = ctx;
+    const rows = await scan(resolved, opts.only);
     if (rows.length === 0) {
         note(opts.only ? `· No branch found for ${opts.only}.` : "· No issue branches (rtsc-NN/…) found.");
         return;
     }
+    // Name the trunk every run. Without it "merged: no" is unfalsifiable from the
+    // outside, which is precisely how RTSC-799 survived for months.
+    note(`· merged is measured against ${resolved.base}`);
     if (opts.json) {
         console.log(JSON.stringify(rows, null, 2));
     }
@@ -198,7 +257,13 @@ export async function tidyAction(opts) {
     }
     const reapable = rows.filter((r) => r.verdict === "reap");
     const orphans = rows.filter((r) => r.verdict === "orphan");
-    const targets = [...reapable, ...(opts.force ? orphans : [])];
+    // --force means "unmerged, but I know the work landed elsewhere" — a judgement about
+    // a branch whose state git DID report. A row git couldn't judge at all is not that,
+    // and deleting it would make this file's own rule ("an unknown can never authorize a
+    // delete") false. Those need the ref fixed, not a bigger hammer.
+    const unknown = orphans.filter((r) => r.merged === null);
+    const forceable = orphans.filter((r) => r.merged !== null);
+    const targets = [...reapable, ...(opts.force ? forceable : [])];
     if (!opts.prune) {
         note("");
         const n = reapable.length;
@@ -211,14 +276,30 @@ export async function tidyAction(opts) {
     }
     if (targets.length === 0) {
         note("");
-        note(orphans.length ? "→ only orphans remain; re-run with --force to delete them." : "→ nothing to reap.");
+        note(forceable.length ? "→ only orphans remain; re-run with --force to delete them." : "→ nothing to reap.");
+        if (unknown.length)
+            note(`→ ${unknown.length} branch(es) git couldn't judge are left alone, even with --force.`);
         return;
     }
+    // The first --prune after upgrading can be enormous: this command was a silent no-op
+    // in every repo whose trunk wasn't `main`, so a team can be sitting on months of
+    // branches it never reaped. Deleting all of them on one keystroke, against a mental
+    // model that says --prune does nothing, is not a fix. Scripts never see this (no TTY),
+    // and the proxy's auto-reap passes --only, so it is always a single branch.
+    if (!opts.only && !opts.yes && isInteractive() && targets.length >= BULK_CONFIRM_AT) {
+        note("");
+        const remotes = targets.filter((t) => t.remote).length;
+        note(`About to delete ${targets.length} branches (${remotes} also on origin) and their worktrees.`);
+        if (!(await confirm("Delete them?"))) {
+            note("· Nothing deleted.");
+            return;
+        }
+    }
     note("");
     let deleted = 0;
     let failed = 0;
     for (const row of targets) {
-        const r = reap(row, ctx, !!opts.force);
+        const r = reap(row, resolved, !!opts.force);
         if (r === "deleted")
             deleted++;
         else if (r === "failed")
@@ -229,10 +310,11 @@ export async function tidyAction(opts) {
         process.exitCode = 1; // let scripts/CI see a partial failure
 }
 /**
- * Is every branch for this issue already on origin/main? null when it has no branch here.
+ * Is every branch for this issue already on the trunk? null when it has no branch here.
  *
- * Pessimistic on purpose: if ANY branch for the issue is unmerged, this says unmerged. The
- * readback exists to stop a close over open work, so the cautious answer is the true one.
+ * Pessimistic on purpose: if ANY branch for the issue is unmerged — or can't be checked —
+ * this says unmerged. The readback exists to stop a close over open work, so the cautious
+ * answer is the true one.
  */
 function issueBranchMerged(ctx, issueId) {
     const locals = refList(ctx.mainCheckout, "refs/heads/");
@@ -241,8 +323,7 @@ function issueBranchMerged(ctx, issueId) {
     const branches = [...new Set([...locals, ...remotes])].filter((b) => issueIdFromBranch(b) === issueId);
     if (branches.length === 0)
         return null;
-    return branches.every((b) => git(["merge-base", "--is-ancestor", remoteSet.has(b) ? `origin/${b}` : b, BASE], ctx.mainCheckout)
-        .status === 0);
+    return branches.every((b) => mergedInto(ctx.run, remoteSet.has(b) ? `origin/${b}` : b, ctx.base) === true);
 }
 /**
  * `retasc done` — the symmetric close to `retasc claim`: mark the current issue
@@ -265,7 +346,7 @@ export async function doneAction(opts) {
     // setup() resolves the MCP key AND the main checkout. Both are needed either way, and
     // failing on a missing repo BEFORE the write beats closing the issue and then finding
     // the teardown can't run.
-    const ctx = setup();
+    const ctx = setup(opts.base);
     // Normalize an explicit --id to the canonical uppercase form so `done --id rtsc-93`
     // matches the uppercased branch ids (and is sent canonically to save_issue).
     const issueId = opts.id
@@ -277,9 +358,8 @@ export async function doneAction(opts) {
         note("✗ Not on a rtsc-NN/ branch — pass --id <RTSC-NN>.");
         process.exit(1);
     }
-    // Refresh before judging merged-state: a stale origin/main reports merged work as
-    // unmerged, which is the warning that teaches people to ignore the warning.
-    git(["fetch", "origin", "--prune"], ctx.mainCheckout);
+    // (setup() already fetched: a stale trunk reports merged work as unmerged, which is
+    // the warning that teaches people to ignore the warning.)
     let issue = null;
     try {
         issue = await mcpCall(ctx.conn, "get_issue", { identifier: issueId });
@@ -289,12 +369,22 @@ export async function doneAction(opts) {
         // below carry the decision with what little is known.
         note(`⚠ Couldn't read ${issueId}: ${String(e?.message ?? e).split("\n")[0]}`);
     }
-    note(doneReadback({ ...(issue ?? {}), id: issueId }, issueBranchMerged(ctx, issueId)));
+    // An unresolvable trunk is NOT fatal here, deliberately. The control-plane close is
+    // the durable half of `done`; the git teardown is local best-effort. Refusing to close
+    // an issue because a checkout has no origin/HEAD — which is exactly what a CI clone
+    // looks like — would break the scripts this command promises to keep working. So say
+    // what couldn't be checked, and let the human decide with that in front of them.
+    if (ctx.base === null) {
+        note(`⚠ Can't tell whether the branch merged: ${ctx.baseFailure.reason}.`);
+        note(`  Closing is still fine; the branch teardown below is what needs a trunk.`);
+    }
+    const resolved = ctx.base === null ? null : ctx;
+    note(doneReadback({ ...(issue ?? {}), id: issueId }, resolved ? issueBranchMerged(resolved, issueId) : null, ctx.base ?? "the trunk"));
     if (opts.dryRun) {
         note("");
         note(`· Dry run: ${issueId} was NOT closed. Below is what the teardown would do.`);
         note("");
-        await tidyAction({ force: opts.force, only: issueId });
+        await tidyAction({ force: opts.force, base: ctx.base ?? undefined, only: issueId });
         return;
     }
     // Already done: go straight to the teardown. Re-sending the write would cost a metered
@@ -321,5 +411,5 @@ export async function doneAction(opts) {
         note(`✓ ${issueId} → done`);
     }
     note("  tidying its branch…");
-    await tidyAction({ prune: true, force: opts.force, only: issueId });
+    await tidyAction({ prune: true, force: opts.force, base: ctx.base ?? undefined, only: issueId });
 }

package/dist/index.js

@@ -703,7 +703,7 @@ function addClaimFlags(cmd) {
     return cmd
         .option("--id <RTSC-NN>", "Claim one specific issue instead of the next unblocked one")
         .option("--all-lanes", "Pull from every lane, including other humans' work (default: only your lane + unassigned)")
-        .option("--base <ref>", "Base ref for the new branch", "origin/main")
+        .option("--base <ref>", "Base ref for the new branch (default: this repo's trunk, from origin/HEAD)")
         .option("--dir <path>", "Parent dir for the worktree (default: beside the main checkout)")
         .option("--no-fetch", "Skip refreshing the base ref from origin first")
         .option("--no-worktree", "Just claim — don't create a worktree")
@@ -731,6 +731,8 @@ program
     .option("--prune", "Delete reapable branches + worktrees (default: dry-run, just report)")
     .option("--force", "Also delete orphans (issue done but branch unmerged)")
     .option("--json", "Emit the reconciled branch table as JSON")
+    .option("--base <ref>", "Trunk to measure merge state against (default: this repo's trunk, from origin/HEAD)")
+    .option("-y, --yes", "Skip the confirmation before a large prune")
     .option("--only <RTSC-NN>", "Scope the sweep to a single issue's branch (used by the MCP auto-reap)")
     .action((opts) => 
 // Normalize --only to the canonical uppercase id so it matches the branch ids
@@ -747,7 +749,8 @@ program
     .command("done")
     .description("Mark the current issue (rtsc-NN/ branch, or --id) done and tear down its worktree+branch.")
     .option("--id <RTSC-NN>", "The issue to close (default: derived from the current branch)")
-    .option("--force", "Tear down even if the branch isn't merged into main yet")
+    .option("--force", "Tear down even if the branch isn't merged into the trunk yet")
+    .option("--base <ref>", "Trunk to measure merge state against (default: this repo's trunk, from origin/HEAD)")
     // RTSC-709: a read before the write. `done` is one word that closes an issue, and it
     // closed one whose PR was still open. --dry-run shows the readback and the teardown plan
     // without touching anything; -y is for the human who already knows (scripts never prompt).

package/dist/lib/base.js

@@ -0,0 +1,222 @@
+// Which ref is this repo's trunk? (RTSC-799)
+//
+// `tidy` and `done` decide whether a branch's work has landed by asking git
+// whether it's an ancestor of the trunk, and `claim` branches from the trunk.
+// All three used to spell that trunk `origin/main`, written into the source with
+// no way to change it. In a repo whose default branch is `master` the comparison
+// doesn't error into view — `merge-base --is-ancestor` exits 128, the caller only
+// tested for 0, and every branch came back "not merged". Nothing was ever
+// reapable, so `claim` kept minting worktrees that nothing ever removed. One
+// customer accumulated thirty of them over months with no error printed once.
+//
+// So two rules live here, and they're the whole point of the file:
+//   1. The trunk is DISCOVERED (origin/HEAD, the same thing `git clone` records),
+//      overridable per-repo, and never assumed.
+//   2. A git failure is never an answer. `merge-base --is-ancestor` has three
+//      outcomes and this module returns three, so "couldn't tell" can't wear the
+//      same face as "no".
+//
+// The decision (`pickBase`) is pure and takes the repo's facts as data, so the
+// precedence order is testable without a git fixture; `resolveBase` is the thin
+// layer that gathers those facts.
+/**
+ * Per-repo override: `git config retasc.base origin/develop`.
+ *
+ * Read at `--local` scope ONLY, and deliberately. A plain `git config --get` also
+ * sees ~/.gitconfig, so one global value would redefine the trunk in every repo on
+ * the machine and outrank each repo's own origin/HEAD — and the trunk is the only
+ * evidence behind `git branch -D` / `git push origin --delete`, which the proxy runs
+ * unattended on every terminal close. A machine-wide answer to a per-repo question
+ * is not a default, it is a footgun.
+ */
+export const BASE_CONFIG_KEY = "retasc.base";
+/**
+ * Choose the trunk from what the repo already knows, most explicit first:
+ * `--base` → `git config retasc.base` → `origin/HEAD` → the one of
+ * `origin/{main,master}` that exists → for a repo with no remote, the one of
+ * `main`/`master` that exists.
+ *
+ * Ambiguity is a failure, never a guess. A repo carrying BOTH `origin/main` and
+ * `origin/master` with no `origin/HEAD` to break the tie gets an error naming the
+ * two, because picking the wrong one here doesn't misreport one row — it silently
+ * reclassifies every branch in the repo.
+ */
+export function pickBase(i) {
+    // Only ABSENT skips. An empty `--base "$UNSET_VAR"` must not quietly become
+    // "discover one for me" and then measure deletions against a trunk the caller
+    // never named — the sibling rule claim.ts already spells out for issue ids.
+    if (i.explicit != null && i.explicit.trim() === "") {
+        return { ok: false, reason: "--base was given an empty value" };
+    }
+    if (i.configured != null && i.configured.trim() === "") {
+        return { ok: false, reason: `git config ${BASE_CONFIG_KEY} is set to an empty value` };
+    }
+    if (i.explicit)
+        return { ok: true, ref: i.explicit, source: "flag" };
+    if (i.configured)
+        return { ok: true, ref: i.configured, source: "config" };
+    if (i.originHead)
+        return { ok: true, ref: i.originHead, source: "origin-head" };
+    if (i.hasOrigin) {
+        if (i.remoteCandidates.length === 1) {
+            return { ok: true, ref: i.remoteCandidates[0], source: "remote-default" };
+        }
+        if (i.remoteCandidates.length > 1) {
+            return {
+                ok: false,
+                reason: `origin has both ${i.remoteCandidates.join(" and ")}, and no origin/HEAD to say which is the trunk`,
+            };
+        }
+        return {
+            ok: false,
+            reason: "origin has no recorded default branch (no origin/HEAD), and neither origin/main nor origin/master exists",
+        };
+    }
+    if (i.localCandidates.length === 1) {
+        return { ok: true, ref: i.localCandidates[0], source: "local-default" };
+    }
+    if (i.localCandidates.length > 1) {
+        return { ok: false, reason: `this repo has no origin remote, and both ${i.localCandidates.join(" and ")} exist locally` };
+    }
+    return { ok: false, reason: "this repo has no origin remote, and neither main nor master exists locally" };
+}
+/**
+ * Read the repo and pick its trunk, then PROVE the pick resolves to a commit.
+ *
+ * The proof matters as much as the pick: a `--base` for a ref that isn't there would
+ * otherwise fail later as "nothing is merged", the exact silence this exists to end.
+ * `tried` carries the ref that didn't resolve so the caller can name it.
+ */
+export function resolveBase(run, explicit) {
+    const out = (args) => {
+        const r = run(args);
+        return r.status === 0 ? (r.stdout ?? "").trim() : null;
+    };
+    const resolves = (ref) => run(["rev-parse", "--verify", "--quiet", `${ref}^{commit}`]).status === 0;
+    /** What the repo's own refs say, or null when `git remote` couldn't be read. */
+    const discover = () => {
+        // One for-each-ref for all four candidates. Full refnames, not short ones: a
+        // local branch literally named `origin/main` would otherwise read as the remote.
+        const refs = (out([
+            "for-each-ref",
+            "--format=%(refname)",
+            "refs/remotes/origin/main",
+            "refs/remotes/origin/master",
+            "refs/heads/main",
+            "refs/heads/master",
+        ]) ?? "")
+            .split("\n")
+            .map((r) => r.trim())
+            .filter(Boolean);
+        // A FAILED `git remote` must not read as "no origin". That would route the pick to
+        // the local candidates and hand back a local `main`/`master` as the trunk that
+        // REMOTE branch deletion is then measured against. No remotes at all is exit 0 with
+        // empty output, so the two are distinguishable — keep them distinguished.
+        const remotes = out(["remote"]);
+        if (remotes === null)
+            return null;
+        return {
+            hasOrigin: remotes.split("\n").some((r) => r.trim() === "origin"),
+            remoteCandidates: ["main", "master"]
+                .filter((b) => refs.includes(`refs/remotes/origin/${b}`))
+                .map((b) => `origin/${b}`),
+            localCandidates: ["main", "master"].filter((b) => refs.includes(`refs/heads/${b}`)),
+        };
+    };
+    // --get-all, not --get: with two values `--get` silently returns the last one. The
+    // trunk is the evidence behind a delete, so an ambiguous answer is no answer.
+    const configured = explicit ? null : out(["config", "--local", "--get-all", BASE_CONFIG_KEY]);
+    if (configured !== null && configured.split("\n").filter((l) => l.trim()).length > 1) {
+        return { ok: false, reason: `git config ${BASE_CONFIG_KEY} has more than one value`, tried: null };
+    }
+    const originHead = explicit || configured ? null : out(["symbolic-ref", "--quiet", "--short", "refs/remotes/origin/HEAD"]);
+    // Only inspect the repo's refs when nothing more explicit answered. Beyond being
+    // cheaper, it means a repo whose `git remote` is unreadable still works when the
+    // caller named the trunk outright.
+    let inputs;
+    if (explicit != null || configured != null || originHead) {
+        inputs = { explicit, configured, originHead, hasOrigin: false, remoteCandidates: [], localCandidates: [] };
+    }
+    else {
+        const found = discover();
+        if (!found)
+            return { ok: false, reason: "git couldn't list this repo's remotes", tried: null };
+        inputs = found;
+    }
+    const pick = pickBase(inputs);
+    if (!pick.ok)
+        return { ok: false, reason: pick.reason, tried: null };
+    if (resolves(pick.ref))
+        return { ok: true, ref: pick.ref, source: pick.source };
+    // An INFERRED pick that doesn't resolve falls through; an explicit one does not.
+    // `origin/HEAD` outlives the branch it names: rename the trunk on the remote and the
+    // symref still reports the deleted `origin/master`, and git older than 2.45 never
+    // repairs it on fetch. Hard-failing there would refuse `claim`, `tidy` AND `done` in a
+    // repo that is otherwise perfectly healthy, which is a worse outage than the silence
+    // this file exists to end. A ref the CALLER named is different: they asked for that one,
+    // so a typo gets reported rather than quietly worked around.
+    if (pick.source === "origin-head") {
+        const found = discover();
+        const second = found ? pickBase(found) : { ok: false, reason: "" };
+        if (second.ok && resolves(second.ref)) {
+            return { ok: true, ref: second.ref, source: second.source, staleOriginHead: pick.ref };
+        }
+    }
+    return { ok: false, reason: `${pick.ref} (${sourceLabel(pick.source)}) doesn't resolve to a commit`, tried: pick.ref };
+}
+function sourceLabel(s) {
+    return s === "flag"
+        ? "from --base"
+        : s === "config"
+            ? `from git config ${BASE_CONFIG_KEY}`
+            : s === "origin-head"
+                ? "from origin/HEAD"
+                : s === "remote-default"
+                    ? "the only default-looking branch on origin"
+                    : "the only default-looking local branch";
+}
+/**
+ * The lines to print when the trunk can't be resolved. Every one of them is a
+ * command the reader can run, because the alternative this replaces was a table
+ * of confident falsehoods and no way to tell it was lying.
+ */
+export function baseHelp(result) {
+    return [
+        `✗ Can't tell which branch is this repo's trunk: ${result.reason}.`,
+        `  Merge state is measured against it, so without one every branch would read as unmerged.`,
+        `  Fix it with any of:`,
+        `    retasc <command> --base origin/<trunk>`,
+        `    git config --local ${BASE_CONFIG_KEY} origin/<trunk>   (per-repo, remembered)`,
+        `    git remote set-head origin -a                 (records origin/HEAD from the remote)`,
+    ];
+}
+/**
+ * Is `ref` an ancestor of `base`? THREE outcomes, on purpose:
+ * true / false / null for "git couldn't answer".
+ *
+ * `merge-base --is-ancestor` exits 0 for yes, 1 for no, and 128 for an error
+ * (missing ref, unreadable object, a shallow clone that's missing the history).
+ * Collapsing 128 into `false` is the RTSC-799 bug in one character, so the
+ * unknown is carried out of here as its own value and can never be reaped.
+ */
+export function mergedInto(run, ref, base) {
+    const r = run(["merge-base", "--is-ancestor", ref, base]);
+    if (r.status === 0)
+        return true;
+    if (r.status === 1)
+        return false;
+    return null;
+}
+/**
+ * Is the repo a shallow clone, where ancestry answers can't be trusted?
+ * `null` when git couldn't say — same rule as `mergedInto`, and for the same reason:
+ * this module's whole job is to stop a failed check from reading as a clean answer,
+ * and a suppressed warning is exactly the silence RTSC-799 was made of.
+ */
+export function isShallow(run) {
+    const r = run(["rev-parse", "--is-shallow-repository"]);
+    if (r.status !== 0)
+        return null;
+    const out = (r.stdout ?? "").trim();
+    return out === "true" ? true : out === "false" ? false : null;
+}

package/dist/lib/format.js

@@ -308,14 +308,16 @@ function time(ms) {
  * front of it: it closed RTSC-706 while that PR was open and unreviewed, printed a tick,
  * and moved on to offering branch deletion. This is the sentence that would have caught it.
  */
-export function doneReadback(i, merged) {
+export function doneReadback(i, merged, base) {
     const rows = [
         ["Issue", `${clean(i.id ?? "—")}  ${clean(i.title ?? "")}`.trimEnd()],
         ["Status", `${clean(i.status ?? "—")} → done`],
     ];
     if (i.assignee)
         rows.push(["Assignee", memberRef(i.assignee)]);
+    // `base` is the trunk `done` actually measured against (RTSC-799) — naming it is
+    // the difference between a reader trusting this line and being able to check it.
     if (merged !== null)
-        rows.push(["Branch", merged ? "merged into origin/main" : "NOT merged into origin/main"]);
+        rows.push(["Branch", merged ? `merged into ${base}` : `NOT merged into ${base}`]);
     return labelled(rows);
 }

package/dist/lib/tidy.js

@@ -19,20 +19,24 @@ export function issueIdFromBranch(branch) {
 }
 /**
  * Decide what to do with a branch from the join of issue status (control plane)
- * and merged-into-main (execution plane):
- *   - done/canceled + merged   → reap     (safe to delete; work is on main)
+ * and merged-into-the-trunk (execution plane):
+ *   - done/canceled + merged   → reap     (safe to delete; work is on the trunk)
  *   - done/canceled + unmerged → orphan   (review — work may have landed elsewhere)
  *   - todo/doing/blocked       → active   (keep — work in progress)
  *   - no matching issue        → untracked (report only — never auto-delete)
  * `status` is null when no issue maps to the branch (off-convention name, or the
  * issue wasn't found).
+ *
+ * `merged` is null when git couldn't answer (RTSC-799). Only an explicit `true`
+ * reaps: "couldn't tell" must never authorize a delete, and it lands in the same
+ * needs-a-human bucket as a genuinely unmerged branch.
  */
 export function classifyBranch(opts) {
     const { status, merged } = opts;
     if (status === null)
         return "untracked";
     if (status === "done" || status === "canceled")
-        return merged ? "reap" : "orphan";
+        return merged === true ? "reap" : "orphan";
     return "active";
 }
 /**

package/dist/proxy.js

@@ -160,7 +160,14 @@ function runReap(issueId) {
             log(`reap of ${issueId} couldn't start: ${String(e?.message ?? e)}`);
             finish();
         });
-        child.on("exit", finish);
+        // Log a non-zero exit. `tidy` refuses to guess when it can't work out the repo's
+        // trunk (RTSC-799), and a reap that fails every time must not look exactly like a
+        // reap that worked — the whole bug was a teardown failing in silence.
+        child.on("exit", (code) => {
+            if (code)
+                log(`reap of ${issueId} exited ${code} — see its output above`);
+            finish();
+        });
         child.unref?.(); // a pending reap must not keep the proxy alive
     });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@retasc/cli",
-  "version": "1.42.1",
+  "version": "1.43.0",
   "description": "Retasc CLI — the issue tracker AI agents pull work from. Sign in with GitHub or Google, create projects, mint agent API keys, and wire your agent to the Retasc MCP server in one command.",
   "type": "module",
   "bin": {