@webpieces/pr-gate 0.4.495 → 0.4.497

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webpieces/pr-gate",
-  "version": "0.4.495",
+  "version": "0.4.497",
   "description": "Gated PR system: 3-point squash-merge, merge validation gate, and red/yellow/green PR dashboard. Standalone scripts, no Nx dependency required.",
   "type": "commonjs",
   "main": "./src/index.js",
@@ -25,7 +25,7 @@
     "directory": "packages/tooling/pr-gate"
   },
   "dependencies": {
-    "@webpieces/rules-config": "0.4.495",
+    "@webpieces/rules-config": "0.4.497",
     "@inversifyjs/binding-decorators": "1.1.5",
     "inversify": "7.10.4",
     "reflect-metadata": "0.2.2"

package/src/scripts/commands/cleanup-command.d.ts

@@ -1,6 +1,7 @@
-import { BranchReaper, RepoRootFinder } from '@webpieces/rules-config';
+import { BranchArchiver, BranchReaper, RepoRootFinder } from '@webpieces/rules-config';
 /**
- * wp-cleanup: delete the local branches whose PR is already merged (or that hold no commits).
+ * wp-cleanup: delete the local branches whose PR is already merged (or that hold no commits), then ASK
+ * about the ones that are merely probably-dead.
  *
  * WHY a named command instead of the `git branch -D a b c` the guards used to print: an AI agent
  * reads a raw `-D` as destructive, so it asks permission and stops — which is exactly why branches
@@ -8,15 +9,36 @@ import { BranchReaper, RepoRootFinder } from '@webpieces/rules-config';
  * boring, allowlistable verb whose safety is a property of the command itself rather than of the
  * agent's judgement about a git flag.
  *
- * All the danger lives in the verdicts, not here — see BranchReaper for why every deleted branch is
- * provably dead and recoverable by hash.
+ * WHY IT NOW PROMPTS: sparing silently was the other half of the same problem. Every spared branch
+ * reported the identical `no merged PR found — a human must decide`, so the human could not decide,
+ * so nothing got deleted, so the pile grew until branch-creation-guard refused to make the next branch
+ * and an agent went looking for a config knob to loosen. Shown a real classification with unique-commit
+ * counts, the human in that session answered in five words: "these should all be delete branches".
+ * The prompt is cheap because archiving happens FIRST — a yes costs a tag, not the history.
+ *
+ * All the danger still lives in the verdicts, not here — see BranchReaper for why every AUTOMATICALLY
+ * deleted branch is provably dead and recoverable, and note that nothing in the prompted group is ever
+ * deleted without an explicit typed answer.
  */
 export declare class CleanupCommand {
     private readonly repoRootFinder;
     private readonly branchReaper;
-    constructor(repoRootFinder: RepoRootFinder, branchReaper: BranchReaper);
+    private readonly archiver;
+    constructor(repoRootFinder: RepoRootFinder, branchReaper: BranchReaper, archiver: BranchArchiver);
     run(): Promise<void>;
     private report;
     private reapedLine;
-    private sparedBlock;
+    private promptable;
+    private classifiedBlock;
+    /**
+     * Ask which of the classified branches to delete. Answers: `all`, `none` (default), or a
+     * comma/space-separated list of the numbers shown.
+     *
+     * NON-INTERACTIVE (no TTY — CI, a hook, a piped agent shell) answers NONE and says so. A prompt
+     * nobody can see must never be read as consent, and this is the one place in the tooling where a
+     * deletion is not backed by a proof.
+     */
+    private askWhichToDelete;
+    private pickByNumber;
+    protected question(prompt: string): Promise<string>;
 }

package/src/scripts/commands/cleanup-command.js

@@ -2,11 +2,24 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CleanupCommand = void 0;
 const tslib_1 = require("tslib");
+const readline = tslib_1.__importStar(require("readline"));
 const rules_config_1 = require("@webpieces/rules-config");
 const inversify_1 = require("inversify");
 const SEP = '━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n';
+// One line of human-facing explanation per promptable classification, ordered most-safe first. These
+// replace the single string `no merged PR found — a human must decide`, which covered all three of
+// these situations identically and so told a human nothing they could act on.
+const CLASSIFICATION_HEADINGS = {
+    [rules_config_1.CLASSIFICATION_SUPERSEDED]: 'SUPERSEDED — the PR was closed WITHOUT merging and later PRs have merged since. Near-certainly\n'
+        + '  the abandoned first attempt at work that landed under a different number. Safest group to delete.',
+    [rules_config_1.CLASSIFICATION_CONTENT_IN_MAIN]: 'CONTENT ALREADY IN MAIN — every commit has a patch-equivalent in origin/main (git cherry).\n'
+        + '  The work is not unique to this branch; only the commit objects are.',
+    [rules_config_1.CLASSIFICATION_NEVER_PROPOSED]: 'NEVER PROPOSED — no PR was ever opened, and these commits may be the ONLY copy in existence.\n'
+        + '  Read the unique-commit counts before answering. This is the group to say no to if unsure.',
+};
 /**
- * wp-cleanup: delete the local branches whose PR is already merged (or that hold no commits).
+ * wp-cleanup: delete the local branches whose PR is already merged (or that hold no commits), then ASK
+ * about the ones that are merely probably-dead.
  *
  * WHY a named command instead of the `git branch -D a b c` the guards used to print: an AI agent
  * reads a raw `-D` as destructive, so it asks permission and stops — which is exactly why branches
@@ -14,27 +27,48 @@ const SEP = '━━━━━━━━━━━━━━━━━━━━━━
  * boring, allowlistable verb whose safety is a property of the command itself rather than of the
  * agent's judgement about a git flag.
  *
- * All the danger lives in the verdicts, not here — see BranchReaper for why every deleted branch is
- * provably dead and recoverable by hash.
+ * WHY IT NOW PROMPTS: sparing silently was the other half of the same problem. Every spared branch
+ * reported the identical `no merged PR found — a human must decide`, so the human could not decide,
+ * so nothing got deleted, so the pile grew until branch-creation-guard refused to make the next branch
+ * and an agent went looking for a config knob to loosen. Shown a real classification with unique-commit
+ * counts, the human in that session answered in five words: "these should all be delete branches".
+ * The prompt is cheap because archiving happens FIRST — a yes costs a tag, not the history.
+ *
+ * All the danger still lives in the verdicts, not here — see BranchReaper for why every AUTOMATICALLY
+ * deleted branch is provably dead and recoverable, and note that nothing in the prompted group is ever
+ * deleted without an explicit typed answer.
  */
 let CleanupCommand = class CleanupCommand {
     repoRootFinder;
     branchReaper;
-    constructor(repoRootFinder, branchReaper) {
+    archiver;
+    constructor(repoRootFinder, branchReaper, archiver) {
         this.repoRootFinder = repoRootFinder;
         this.branchReaper = branchReaper;
+        this.archiver = archiver;
     }
-    run() {
+    async run() {
         const repoRoot = this.repoRootFinder.resolveRepoRoot(process.cwd());
+        const retention = (0, rules_config_1.loadAndValidate)(repoRoot).prGate.landPr.branchRetention;
         // No cache argument: wp-cleanup recomputes the verdicts itself. The file on disk is allowed to
         // go stale, and stale evidence is fine for BLOCKING but never for DELETING.
-        const result = this.branchReaper.reap(repoRoot, 'wp-cleanup');
+        const result = this.branchReaper.reap(repoRoot, 'wp-cleanup', null, retention);
         process.stdout.write(this.report(result));
-        return Promise.resolve();
+        const promptable = this.promptable(result.spared);
+        if (promptable.length === 0)
+            return;
+        process.stdout.write(this.classifiedBlock(promptable));
+        const approved = await this.askWhichToDelete(promptable);
+        if (approved.length === 0) {
+            process.stdout.write('\nNothing deleted — the branches above were kept.\n');
+            return;
+        }
+        const second = this.branchReaper.reapApproved(repoRoot, 'wp-cleanup', approved, retention);
+        process.stdout.write(this.report(second));
     }
     report(result) {
         if (result.reaped.length === 0 && result.failed.length === 0) {
-            return '\n✅ Nothing to clean up — no local branch is provably dead.\n' + this.sparedBlock(result.spared);
+            return '\n✅ Nothing to clean up — no local branch is provably dead.\n';
         }
         let out = '\n' + SEP + `🧹 Cleaned up ${String(result.reaped.length)} dead local branch(es)\n` + SEP + '\n';
         for (const entry of result.reaped)
@@ -48,27 +82,95 @@ let CleanupCommand = class CleanupCommand {
         // blindly, and the whole argument for auto-cleanup is that they never have to.
         out += '\nEvery deletion is logged with its pre-delete SHA in .webpieces/hooks/branch-mutations.log —\n'
             + 'recover any of them with the `recover=` command on its line.\n';
-        return out + this.sparedBlock(result.spared);
+        return out;
     }
     reapedLine(entry) {
         const sha = entry.sha !== '' ? ` (was ${entry.sha.slice(0, 8)})` : '';
-        return `  ✓ ${entry.branch}${sha} — ${entry.reason}\n`;
+        // The archive tag is printed inline because it is the ONE thing that makes this delete casually
+        // reversible — a name a human can type, rather than a sha they have to go dig out of a log.
+        const archived = entry.archiveTag !== ''
+            ? `\n      archived → ${entry.archiveTag}   (restore: ${this.archiver.restoreCommand(entry.branch, entry.archiveTag)})`
+            : '';
+        return `  ✓ ${entry.branch}${sha} — ${entry.reason}${archived}\n`;
+    }
+    // The spared branches a human can meaningfully rule on, grouped and ordered most-safe first.
+    // Branches spared for a MECHANICAL reason (checked out in a worktree) are deliberately excluded:
+    // there is no judgement to make, git would simply refuse.
+    promptable(spared) {
+        const out = [];
+        for (const classification of rules_config_1.PROMPTABLE_CLASSIFICATIONS) {
+            for (const entry of spared) {
+                if (entry.classification === classification)
+                    out.push(entry);
+            }
+        }
+        return out;
     }
-    // The branches we refused to touch, with reasons. Silence here would read as "there was nothing
-    // else", when these are precisely the ones only a human can rule on.
-    sparedBlock(spared) {
-        if (spared.length === 0)
-            return '';
-        let out = `\nSpared ${String(spared.length)} branch(es) — a human decides on these:\n`;
-        for (const entry of spared)
-            out += `  • ${entry.branch} — ${entry.reason}\n`;
+    // The classification table: what each group means, and per branch its unique-commit count — the one
+    // number that says whether a yes costs nothing or costs the only copy of somebody's work.
+    classifiedBlock(promptable) {
+        let out = '\n' + SEP + `🤔 ${String(promptable.length)} branch(es) are probably dead — your call\n` + SEP;
+        let current = '';
+        for (let i = 0; i < promptable.length; i += 1) {
+            const entry = promptable[i];
+            if (entry.classification !== current) {
+                current = entry.classification;
+                out += `\n${CLASSIFICATION_HEADINGS[current] ?? current}\n\n`;
+            }
+            const commits = entry.commits >= 0 ? `${String(entry.commits)} unique commit(s)` : 'unique commits unknown';
+            out += `  [${String(i + 1)}] ${entry.branch}\n        ${commits} — ${entry.reason}\n`;
+        }
         return out;
     }
+    /**
+     * Ask which of the classified branches to delete. Answers: `all`, `none` (default), or a
+     * comma/space-separated list of the numbers shown.
+     *
+     * NON-INTERACTIVE (no TTY — CI, a hook, a piped agent shell) answers NONE and says so. A prompt
+     * nobody can see must never be read as consent, and this is the one place in the tooling where a
+     * deletion is not backed by a proof.
+     */
+    async askWhichToDelete(promptable) {
+        if (process.stdin.isTTY !== true) {
+            process.stdout.write('\nNot a terminal — nothing was deleted and nothing was assumed.\n'
+                + 'Run `pnpm wp-cleanup` in an interactive shell to answer, or delete individually.\n');
+            return [];
+        }
+        const answer = (await this.question(`\nDelete which? [all / none / e.g. "1,3"] (default none): `)).trim().toLowerCase();
+        if (answer === '' || answer === 'none' || answer === 'n')
+            return [];
+        if (answer === 'all' || answer === 'a')
+            return promptable;
+        return this.pickByNumber(promptable, answer);
+    }
+    // Parse `1,3` / `1 3` into branches, ignoring anything out of range. An unparseable answer selects
+    // nothing, which is the fail-safe direction for a question about deleting.
+    pickByNumber(promptable, answer) {
+        const out = [];
+        for (const token of answer.split(/[\s,]+/)) {
+            const index = Number(token);
+            if (!Number.isInteger(index) || index < 1 || index > promptable.length)
+                continue;
+            out.push(promptable[index - 1]);
+        }
+        return out;
+    }
+    // Seam: overridden in the spec so the prompt parsing is testable with no terminal.
+    question(prompt) {
+        const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+        return new Promise((resolve) => {
+            rl.question(prompt, (answer) => {
+                rl.close();
+                resolve(answer);
+            });
+        });
+    }
 };
 exports.CleanupCommand = CleanupCommand;
 exports.CleanupCommand = CleanupCommand = tslib_1.__decorate([
     (0, inversify_1.injectable)(inversify_1.bindingScopeValues.Singleton),
     tslib_1.__metadata("design:paramtypes", [rules_config_1.RepoRootFinder,
-        rules_config_1.BranchReaper])
+        rules_config_1.BranchReaper,
+        rules_config_1.BranchArchiver])
 ], CleanupCommand);
 //# sourceMappingURL=cleanup-command.js.map

package/src/scripts/commands/cleanup-command.js.map

@@ -1 +1 @@
-{"version":3,"file":"cleanup-command.js","sourceRoot":"","sources":["../../../../../../../packages/tooling/pr-gate/src/scripts/commands/cleanup-command.ts"],"names":[],"mappings":";;;;AAAA,0DAMiC;AACjC,yCAA2D;AAE3D,MAAM,GAAG,GAAG,0DAA0D,CAAC;AAEvE;;;;;;;;;;;GAWG;AAEI,IAAM,cAAc,GAApB,MAAM,cAAc;IAEF;IACA;IAFrB,YACqB,cAA8B,EAC9B,YAA0B;QAD1B,mBAAc,GAAd,cAAc,CAAgB;QAC9B,iBAAY,GAAZ,YAAY,CAAc;IAC5C,CAAC;IAEJ,GAAG;QACC,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACpE,+FAA+F;QAC/F,4EAA4E;QAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAC9D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1C,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC7B,CAAC;IAEO,MAAM,CAAC,MAAkB;QAC7B,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3D,OAAO,+DAA+D,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC7G,CAAC;QAED,IAAI,GAAG,GAAG,IAAI,GAAG,GAAG,GAAG,iBAAiB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,0BAA0B,GAAG,GAAG,GAAG,IAAI,CAAC;QAC5G,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM;YAAE,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAEjE,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,GAAG,IAAI,SAAS,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,qCAAqC,CAAC;YAClF,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM;gBAAE,GAAG,IAAI,OAAO,KAAK,CAAC,MAAM,MAAM,KAAK,CAAC,KAAK,IAAI,CAAC;QACvF,CAAC;QAED,6FAA6F;QAC7F,+EAA+E;QAC/E,GAAG,IAAI,iGAAiG;cAClG,gEAAgE,CAAC;QACvE,OAAO,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACjD,CAAC;IAEO,UAAU,CAAC,KAAmB;QAClC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,OAAO,OAAO,KAAK,CAAC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,IAAI,CAAC;IAC3D,CAAC;IAED,gGAAgG;IAChG,qEAAqE;IAC7D,WAAW,CAAC,MAAyB;QACzC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACnC,IAAI,GAAG,GAAG,YAAY,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,2CAA2C,CAAC;QACvF,KAAK,MAAM,KAAK,IAAI,MAAM;YAAE,GAAG,IAAI,OAAO,KAAK,CAAC,MAAM,MAAM,KAAK,CAAC,MAAM,IAAI,CAAC;QAC7E,OAAO,GAAG,CAAC;IACf,CAAC;CACJ,CAAA;AAhDY,wCAAc;yBAAd,cAAc;IAD1B,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;6CAGA,6BAAc;QAChB,2BAAY;GAHtC,cAAc,CAgD1B","sourcesContent":["import {\n    BranchReaper,\n    DeletableBranch,\n    ReapResult,\n    ReapedBranch,\n    RepoRootFinder,\n} from '@webpieces/rules-config';\nimport { injectable, bindingScopeValues } from 'inversify';\n\nconst SEP = '━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n';\n\n/**\n * wp-cleanup: delete the local branches whose PR is already merged (or that hold no commits).\n *\n * WHY a named command instead of the `git branch -D a b c` the guards used to print: an AI agent\n * reads a raw `-D` as destructive, so it asks permission and stops — which is exactly why branches\n * piled up despite the tooling knowing precisely which ones were dead. `pnpm wp-cleanup` is one\n * boring, allowlistable verb whose safety is a property of the command itself rather than of the\n * agent's judgement about a git flag.\n *\n * All the danger lives in the verdicts, not here — see BranchReaper for why every deleted branch is\n * provably dead and recoverable by hash.\n */\n@injectable(bindingScopeValues.Singleton)\nexport class CleanupCommand {\n    constructor(\n        private readonly repoRootFinder: RepoRootFinder,\n        private readonly branchReaper: BranchReaper,\n    ) {}\n\n    run(): Promise<void> {\n        const repoRoot = this.repoRootFinder.resolveRepoRoot(process.cwd());\n        // No cache argument: wp-cleanup recomputes the verdicts itself. The file on disk is allowed to\n        // go stale, and stale evidence is fine for BLOCKING but never for DELETING.\n        const result = this.branchReaper.reap(repoRoot, 'wp-cleanup');\n        process.stdout.write(this.report(result));\n        return Promise.resolve();\n    }\n\n    private report(result: ReapResult): string {\n        if (result.reaped.length === 0 && result.failed.length === 0) {\n            return '\\n✅ Nothing to clean up — no local branch is provably dead.\\n' + this.sparedBlock(result.spared);\n        }\n\n        let out = '\\n' + SEP + `🧹 Cleaned up ${String(result.reaped.length)} dead local branch(es)\\n` + SEP + '\\n';\n        for (const entry of result.reaped) out += this.reapedLine(entry);\n\n        if (result.failed.length > 0) {\n            out += `\\n⚠️  ${String(result.failed.length)} branch(es) could not be deleted:\\n`;\n            for (const entry of result.failed) out += `  ✗ ${entry.branch} — ${entry.error}\\n`;\n        }\n\n        // Printed even on success: a deletion the human cannot undo is a deletion they have to trust\n        // blindly, and the whole argument for auto-cleanup is that they never have to.\n        out += '\\nEvery deletion is logged with its pre-delete SHA in .webpieces/hooks/branch-mutations.log —\\n'\n            + 'recover any of them with the `recover=` command on its line.\\n';\n        return out + this.sparedBlock(result.spared);\n    }\n\n    private reapedLine(entry: ReapedBranch): string {\n        const sha = entry.sha !== '' ? ` (was ${entry.sha.slice(0, 8)})` : '';\n        return `  ✓ ${entry.branch}${sha} — ${entry.reason}\\n`;\n    }\n\n    // The branches we refused to touch, with reasons. Silence here would read as \"there was nothing\n    // else\", when these are precisely the ones only a human can rule on.\n    private sparedBlock(spared: DeletableBranch[]): string {\n        if (spared.length === 0) return '';\n        let out = `\\nSpared ${String(spared.length)} branch(es) — a human decides on these:\\n`;\n        for (const entry of spared) out += `  • ${entry.branch} — ${entry.reason}\\n`;\n        return out;\n    }\n}\n"]}
+{"version":3,"file":"cleanup-command.js","sourceRoot":"","sources":["../../../../../../../packages/tooling/pr-gate/src/scripts/commands/cleanup-command.ts"],"names":[],"mappings":";;;;AAAA,2DAAqC;AACrC,0DAYiC;AACjC,yCAA2D;AAE3D,MAAM,GAAG,GAAG,0DAA0D,CAAC;AAEvE,qGAAqG;AACrG,mGAAmG;AACnG,8EAA8E;AAC9E,MAAM,uBAAuB,GAAqC;IAC9D,CAAC,wCAAyB,CAAC,EACvB,kGAAkG;UAChG,qGAAqG;IAC3G,CAAC,6CAA8B,CAAC,EAC5B,8FAA8F;UAC5F,uEAAuE;IAC7E,CAAC,4CAA6B,CAAC,EAC3B,gGAAgG;UAC9F,6FAA6F;CACtG,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;GAoBG;AAEI,IAAM,cAAc,GAApB,MAAM,cAAc;IAEF;IACA;IACA;IAHrB,YACqB,cAA8B,EAC9B,YAA0B,EAC1B,QAAwB;QAFxB,mBAAc,GAAd,cAAc,CAAgB;QAC9B,iBAAY,GAAZ,YAAY,CAAc;QAC1B,aAAQ,GAAR,QAAQ,CAAgB;IAC1C,CAAC;IAEJ,KAAK,CAAC,GAAG;QACL,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACpE,MAAM,SAAS,GAAG,IAAA,8BAAe,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC;QAC1E,+FAA+F;QAC/F,4EAA4E;QAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QAC/E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAE1C,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACpC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;QACzD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC;YAC5E,OAAO;QACX,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC3F,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9C,CAAC;IAEO,MAAM,CAAC,MAAkB;QAC7B,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3D,OAAO,+DAA+D,CAAC;QAC3E,CAAC;QAED,IAAI,GAAG,GAAG,IAAI,GAAG,GAAG,GAAG,iBAAiB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,0BAA0B,GAAG,GAAG,GAAG,IAAI,CAAC;QAC5G,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM;YAAE,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAEjE,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,GAAG,IAAI,SAAS,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,qCAAqC,CAAC;YAClF,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM;gBAAE,GAAG,IAAI,OAAO,KAAK,CAAC,MAAM,MAAM,KAAK,CAAC,KAAK,IAAI,CAAC;QACvF,CAAC;QAED,6FAA6F;QAC7F,+EAA+E;QAC/E,GAAG,IAAI,iGAAiG;cAClG,gEAAgE,CAAC;QACvE,OAAO,GAAG,CAAC;IACf,CAAC;IAEO,UAAU,CAAC,KAAmB;QAClC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,gGAAgG;QAChG,4FAA4F;QAC5F,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,KAAK,EAAE;YACpC,CAAC,CAAC,sBAAsB,KAAK,CAAC,UAAU,gBAAgB,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,GAAG;YACvH,CAAC,CAAC,EAAE,CAAC;QACT,OAAO,OAAO,KAAK,CAAC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,GAAG,QAAQ,IAAI,CAAC;IACtE,CAAC;IAED,6FAA6F;IAC7F,iGAAiG;IACjG,0DAA0D;IAClD,UAAU,CAAC,MAAyB;QACxC,MAAM,GAAG,GAAsB,EAAE,CAAC;QAClC,KAAK,MAAM,cAAc,IAAI,yCAA0B,EAAE,CAAC;YACtD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBACzB,IAAI,KAAK,CAAC,cAAc,KAAK,cAAc;oBAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjE,CAAC;QACL,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED,oGAAoG;IACpG,0FAA0F;IAClF,eAAe,CAAC,UAA6B;QACjD,IAAI,GAAG,GAAG,IAAI,GAAG,GAAG,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,6CAA6C,GAAG,GAAG,CAAC;QAC1G,IAAI,OAAO,GAAG,EAAE,CAAC;QACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5C,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,KAAK,CAAC,cAAc,KAAK,OAAO,EAAE,CAAC;gBACnC,OAAO,GAAG,KAAK,CAAC,cAAc,CAAC;gBAC/B,GAAG,IAAI,KAAK,uBAAuB,CAAC,OAAO,CAAC,IAAI,OAAO,MAAM,CAAC;YAClE,CAAC;YACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,wBAAwB,CAAC;YAC5G,GAAG,IAAI,MAAM,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,MAAM,aAAa,OAAO,MAAM,KAAK,CAAC,MAAM,IAAI,CAAC;QAC1F,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,gBAAgB,CAAC,UAA6B;QACxD,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAChB,mEAAmE;kBACjE,oFAAoF,CACzF,CAAC;YACF,OAAO,EAAE,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,CAC/B,4DAA4D,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACxF,IAAI,MAAM,KAAK,EAAE,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,CAAC;QACpE,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,UAAU,CAAC;QAC1D,OAAO,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;IAED,mGAAmG;IACnG,2EAA2E;IACnE,YAAY,CAAC,UAA6B,EAAE,MAAc;QAC9D,MAAM,GAAG,GAAsB,EAAE,CAAC;QAClC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,UAAU,CAAC,MAAM;gBAAE,SAAS;YACjF,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED,mFAAmF;IACzE,QAAQ,CAAC,MAAc;QAC7B,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACtF,OAAO,IAAI,OAAO,CAAS,CAAC,OAAgC,EAAQ,EAAE;YAClE,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,MAAc,EAAQ,EAAE;gBACzC,EAAE,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,MAAM,CAAC,CAAC;YACpB,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;IACP,CAAC;CACJ,CAAA;AApIY,wCAAc;yBAAd,cAAc;IAD1B,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;6CAGA,6BAAc;QAChB,2BAAY;QAChB,6BAAc;GAJpC,cAAc,CAoI1B","sourcesContent":["import * as readline from 'readline';\nimport {\n    BranchArchiver,\n    BranchReaper,\n    DeletableBranch,\n    ReapResult,\n    ReapedBranch,\n    RepoRootFinder,\n    loadAndValidate,\n    CLASSIFICATION_SUPERSEDED,\n    CLASSIFICATION_CONTENT_IN_MAIN,\n    CLASSIFICATION_NEVER_PROPOSED,\n    PROMPTABLE_CLASSIFICATIONS,\n} from '@webpieces/rules-config';\nimport { injectable, bindingScopeValues } from 'inversify';\n\nconst SEP = '━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n';\n\n// One line of human-facing explanation per promptable classification, ordered most-safe first. These\n// replace the single string `no merged PR found — a human must decide`, which covered all three of\n// these situations identically and so told a human nothing they could act on.\nconst CLASSIFICATION_HEADINGS: Readonly<Record<string, string>> = {\n    [CLASSIFICATION_SUPERSEDED]:\n        'SUPERSEDED — the PR was closed WITHOUT merging and later PRs have merged since. Near-certainly\\n'\n        + '  the abandoned first attempt at work that landed under a different number. Safest group to delete.',\n    [CLASSIFICATION_CONTENT_IN_MAIN]:\n        'CONTENT ALREADY IN MAIN — every commit has a patch-equivalent in origin/main (git cherry).\\n'\n        + '  The work is not unique to this branch; only the commit objects are.',\n    [CLASSIFICATION_NEVER_PROPOSED]:\n        'NEVER PROPOSED — no PR was ever opened, and these commits may be the ONLY copy in existence.\\n'\n        + '  Read the unique-commit counts before answering. This is the group to say no to if unsure.',\n};\n\n/**\n * wp-cleanup: delete the local branches whose PR is already merged (or that hold no commits), then ASK\n * about the ones that are merely probably-dead.\n *\n * WHY a named command instead of the `git branch -D a b c` the guards used to print: an AI agent\n * reads a raw `-D` as destructive, so it asks permission and stops — which is exactly why branches\n * piled up despite the tooling knowing precisely which ones were dead. `pnpm wp-cleanup` is one\n * boring, allowlistable verb whose safety is a property of the command itself rather than of the\n * agent's judgement about a git flag.\n *\n * WHY IT NOW PROMPTS: sparing silently was the other half of the same problem. Every spared branch\n * reported the identical `no merged PR found — a human must decide`, so the human could not decide,\n * so nothing got deleted, so the pile grew until branch-creation-guard refused to make the next branch\n * and an agent went looking for a config knob to loosen. Shown a real classification with unique-commit\n * counts, the human in that session answered in five words: \"these should all be delete branches\".\n * The prompt is cheap because archiving happens FIRST — a yes costs a tag, not the history.\n *\n * All the danger still lives in the verdicts, not here — see BranchReaper for why every AUTOMATICALLY\n * deleted branch is provably dead and recoverable, and note that nothing in the prompted group is ever\n * deleted without an explicit typed answer.\n */\n@injectable(bindingScopeValues.Singleton)\nexport class CleanupCommand {\n    constructor(\n        private readonly repoRootFinder: RepoRootFinder,\n        private readonly branchReaper: BranchReaper,\n        private readonly archiver: BranchArchiver,\n    ) {}\n\n    async run(): Promise<void> {\n        const repoRoot = this.repoRootFinder.resolveRepoRoot(process.cwd());\n        const retention = loadAndValidate(repoRoot).prGate.landPr.branchRetention;\n        // No cache argument: wp-cleanup recomputes the verdicts itself. The file on disk is allowed to\n        // go stale, and stale evidence is fine for BLOCKING but never for DELETING.\n        const result = this.branchReaper.reap(repoRoot, 'wp-cleanup', null, retention);\n        process.stdout.write(this.report(result));\n\n        const promptable = this.promptable(result.spared);\n        if (promptable.length === 0) return;\n        process.stdout.write(this.classifiedBlock(promptable));\n        const approved = await this.askWhichToDelete(promptable);\n        if (approved.length === 0) {\n            process.stdout.write('\\nNothing deleted — the branches above were kept.\\n');\n            return;\n        }\n        const second = this.branchReaper.reapApproved(repoRoot, 'wp-cleanup', approved, retention);\n        process.stdout.write(this.report(second));\n    }\n\n    private report(result: ReapResult): string {\n        if (result.reaped.length === 0 && result.failed.length === 0) {\n            return '\\n✅ Nothing to clean up — no local branch is provably dead.\\n';\n        }\n\n        let out = '\\n' + SEP + `🧹 Cleaned up ${String(result.reaped.length)} dead local branch(es)\\n` + SEP + '\\n';\n        for (const entry of result.reaped) out += this.reapedLine(entry);\n\n        if (result.failed.length > 0) {\n            out += `\\n⚠️  ${String(result.failed.length)} branch(es) could not be deleted:\\n`;\n            for (const entry of result.failed) out += `  ✗ ${entry.branch} — ${entry.error}\\n`;\n        }\n\n        // Printed even on success: a deletion the human cannot undo is a deletion they have to trust\n        // blindly, and the whole argument for auto-cleanup is that they never have to.\n        out += '\\nEvery deletion is logged with its pre-delete SHA in .webpieces/hooks/branch-mutations.log —\\n'\n            + 'recover any of them with the `recover=` command on its line.\\n';\n        return out;\n    }\n\n    private reapedLine(entry: ReapedBranch): string {\n        const sha = entry.sha !== '' ? ` (was ${entry.sha.slice(0, 8)})` : '';\n        // The archive tag is printed inline because it is the ONE thing that makes this delete casually\n        // reversible — a name a human can type, rather than a sha they have to go dig out of a log.\n        const archived = entry.archiveTag !== ''\n            ? `\\n      archived → ${entry.archiveTag}   (restore: ${this.archiver.restoreCommand(entry.branch, entry.archiveTag)})`\n            : '';\n        return `  ✓ ${entry.branch}${sha} — ${entry.reason}${archived}\\n`;\n    }\n\n    // The spared branches a human can meaningfully rule on, grouped and ordered most-safe first.\n    // Branches spared for a MECHANICAL reason (checked out in a worktree) are deliberately excluded:\n    // there is no judgement to make, git would simply refuse.\n    private promptable(spared: DeletableBranch[]): DeletableBranch[] {\n        const out: DeletableBranch[] = [];\n        for (const classification of PROMPTABLE_CLASSIFICATIONS) {\n            for (const entry of spared) {\n                if (entry.classification === classification) out.push(entry);\n            }\n        }\n        return out;\n    }\n\n    // The classification table: what each group means, and per branch its unique-commit count — the one\n    // number that says whether a yes costs nothing or costs the only copy of somebody's work.\n    private classifiedBlock(promptable: DeletableBranch[]): string {\n        let out = '\\n' + SEP + `🤔 ${String(promptable.length)} branch(es) are probably dead — your call\\n` + SEP;\n        let current = '';\n        for (let i = 0; i < promptable.length; i += 1) {\n            const entry = promptable[i];\n            if (entry.classification !== current) {\n                current = entry.classification;\n                out += `\\n${CLASSIFICATION_HEADINGS[current] ?? current}\\n\\n`;\n            }\n            const commits = entry.commits >= 0 ? `${String(entry.commits)} unique commit(s)` : 'unique commits unknown';\n            out += `  [${String(i + 1)}] ${entry.branch}\\n        ${commits} — ${entry.reason}\\n`;\n        }\n        return out;\n    }\n\n    /**\n     * Ask which of the classified branches to delete. Answers: `all`, `none` (default), or a\n     * comma/space-separated list of the numbers shown.\n     *\n     * NON-INTERACTIVE (no TTY — CI, a hook, a piped agent shell) answers NONE and says so. A prompt\n     * nobody can see must never be read as consent, and this is the one place in the tooling where a\n     * deletion is not backed by a proof.\n     */\n    private async askWhichToDelete(promptable: DeletableBranch[]): Promise<DeletableBranch[]> {\n        if (process.stdin.isTTY !== true) {\n            process.stdout.write(\n                '\\nNot a terminal — nothing was deleted and nothing was assumed.\\n'\n                + 'Run `pnpm wp-cleanup` in an interactive shell to answer, or delete individually.\\n',\n            );\n            return [];\n        }\n        const answer = (await this.question(\n            `\\nDelete which? [all / none / e.g. \"1,3\"] (default none): `)).trim().toLowerCase();\n        if (answer === '' || answer === 'none' || answer === 'n') return [];\n        if (answer === 'all' || answer === 'a') return promptable;\n        return this.pickByNumber(promptable, answer);\n    }\n\n    // Parse `1,3` / `1 3` into branches, ignoring anything out of range. An unparseable answer selects\n    // nothing, which is the fail-safe direction for a question about deleting.\n    private pickByNumber(promptable: DeletableBranch[], answer: string): DeletableBranch[] {\n        const out: DeletableBranch[] = [];\n        for (const token of answer.split(/[\\s,]+/)) {\n            const index = Number(token);\n            if (!Number.isInteger(index) || index < 1 || index > promptable.length) continue;\n            out.push(promptable[index - 1]);\n        }\n        return out;\n    }\n\n    // Seam: overridden in the spec so the prompt parsing is testable with no terminal.\n    protected question(prompt: string): Promise<string> {\n        const rl = readline.createInterface({ input: process.stdin, output: process.stdout });\n        return new Promise<string>((resolve: (value: string) => void): void => {\n            rl.question(prompt, (answer: string): void => {\n                rl.close();\n                resolve(answer);\n            });\n        });\n    }\n}\n"]}

package/src/scripts/commands/land-pr-command.d.ts

@@ -1,6 +1,7 @@
-import { RepoRootFinder } from '@webpieces/rules-config';
+import { RepoRootFinder, BranchArchiver } from '@webpieces/rules-config';
 import { AiBranchName } from '../workflow/git-readAiBranchName';
 import { BranchNaming } from '../workflow/branch-naming';
+import { MergeInfoIndex } from '../workflow/merge-info-index';
 import { PrMerger } from '../workflow/pr-merger';
 /**
  * `wp-land-pr`: squash-merge THIS branch's already-posted PR into main with the compact commit body.
@@ -22,7 +23,23 @@ export declare class LandPrCommand {
     private readonly aiBranchName;
     private readonly branchNaming;
     private readonly prMerger;
-    constructor(repoRootFinder: RepoRootFinder, aiBranchName: AiBranchName, branchNaming: BranchNaming, prMerger: PrMerger);
+    private readonly archiver;
+    private readonly mergeInfoIndex;
+    constructor(repoRootFinder: RepoRootFinder, aiBranchName: AiBranchName, branchNaming: BranchNaming, prMerger: PrMerger, archiver: BranchArchiver, mergeInfoIndex: MergeInfoIndex);
     run(): Promise<void>;
+    /**
+     * The landed branch's post-merge bookkeeping, in one place:
+     *  1. ARCHIVE the pre-squash tip as `archive/<date>/<branch>` — the tag makes the original history
+     *     permanently restorable (`git checkout -b <branch> <tag>` gives back the exact objects) while
+     *     costing one ref, so the branch itself no longer has to survive as a `*PreMerge` husk that
+     *     counts toward the branch cap. See BranchArchiver for why a tag beats a patch or the reflog.
+     *  2. PROMOTE `merge-info/staged/<feature>/` to `merge-info/merged/<feature>/` and rebuild
+     *     `index.json`, so `staged/` holds only branches that are still in flight.
+     *
+     * Never throws: the PR is already merged by the time we get here, and failing the command after a
+     * successful merge would report a landed PR as a failure. Problems are reported in the recap.
+     */
+    private archiveAndPromote;
+    private revParse;
     private prNumberAndTitle;
 }

package/src/scripts/commands/land-pr-command.js

@@ -9,6 +9,7 @@ const rules_config_1 = require("@webpieces/rules-config");
 const inversify_1 = require("inversify");
 const git_readAiBranchName_1 = require("../workflow/git-readAiBranchName");
 const branch_naming_1 = require("../workflow/branch-naming");
+const merge_info_index_1 = require("../workflow/merge-info-index");
 const pr_merger_1 = require("../workflow/pr-merger");
 const SEP = '━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n';
 /**
@@ -31,11 +32,15 @@ let LandPrCommand = class LandPrCommand {
     aiBranchName;
     branchNaming;
     prMerger;
-    constructor(repoRootFinder, aiBranchName, branchNaming, prMerger) {
+    archiver;
+    mergeInfoIndex;
+    constructor(repoRootFinder, aiBranchName, branchNaming, prMerger, archiver, mergeInfoIndex) {
         this.repoRootFinder = repoRootFinder;
         this.aiBranchName = aiBranchName;
         this.branchNaming = branchNaming;
         this.prMerger = prMerger;
+        this.archiver = archiver;
+        this.mergeInfoIndex = mergeInfoIndex;
     }
     async run() {
         const repoRoot = this.repoRootFinder.resolveRepoRoot(process.cwd());
@@ -65,15 +70,56 @@ let LandPrCommand = class LandPrCommand {
         // MERGE_MODE_AUTO is passed explicitly: running this command IS the intent to merge, so it is
         // not gated on pr-gate.mergeMode (a NONE repo runs this precisely to land one PR by hand).
         const outcome = this.prMerger.merge(base, `${ref.title} (#${ref.number})`, mergeBodyFile, rules_config_1.MERGE_MODE_AUTO);
-        const policy = (0, rules_config_1.loadAndValidate)(repoRoot).prGate.mergeMode;
+        const config = (0, rules_config_1.loadAndValidate)(repoRoot).prGate;
+        const policy = config.mergeMode;
+        const archived = outcome.merged
+            ? this.archiveAndPromote(repoRoot, base, ref, config.landPr.branchRetention)
+            : '';
         process.stdout.write('\n' + SEP + (outcome.merged ? '✅ Landed\n' : 'ℹ️  Not landed yet\n') + SEP + '\n' +
             `   ${outcome.message}\n` +
+            archived +
             (outcome.merged ? '   Next: `pnpm wp-cleanup` to delete the merged branch.\n' : '') +
             (policy === rules_config_1.MERGE_MODE_AUTO
                 ? ''
                 : `   (pr-gate.mergeMode is ${policy} — wp-finish-upsert-pr will keep leaving PRs for a human.)\n`) +
             '\n');
     }
+    /**
+     * The landed branch's post-merge bookkeeping, in one place:
+     *  1. ARCHIVE the pre-squash tip as `archive/<date>/<branch>` — the tag makes the original history
+     *     permanently restorable (`git checkout -b <branch> <tag>` gives back the exact objects) while
+     *     costing one ref, so the branch itself no longer has to survive as a `*PreMerge` husk that
+     *     counts toward the branch cap. See BranchArchiver for why a tag beats a patch or the reflog.
+     *  2. PROMOTE `merge-info/staged/<feature>/` to `merge-info/merged/<feature>/` and rebuild
+     *     `index.json`, so `staged/` holds only branches that are still in flight.
+     *
+     * Never throws: the PR is already merged by the time we get here, and failing the command after a
+     * successful merge would report a landed PR as a failure. Problems are reported in the recap.
+     */
+    archiveAndPromote(repoRoot, base, ref, retention) {
+        if (retention === rules_config_1.BRANCH_RETENTION_KEEP)
+            return '   Branch retention is "keep" — nothing archived.\n';
+        let line = '';
+        let tag = '';
+        if (retention === rules_config_1.BRANCH_RETENTION_ARCHIVE_TAG) {
+            const archive = this.archiver.archive(repoRoot, base);
+            tag = archive.tag;
+            line = archive.ok
+                ? `   Archived ${base} → ${archive.tag}   (restore: ${this.archiver.restoreCommand(base, archive.tag)})\n`
+                : `   ⚠️  Could not archive ${base}: ${archive.error} — the branch was left alone.\n`;
+        }
+        const feature = this.aiBranchName.getFeatureName();
+        const record = new merge_info_index_1.ArchiveRecord(tag, this.revParse(repoRoot, base), this.revParse(repoRoot, 'origin/main'), Number(ref.number), new Date().toISOString());
+        if (this.mergeInfoIndex.promoteToMerged(repoRoot, feature, record)) {
+            line += `   merge-info: staged/${feature} → merged/${feature} (index.json rebuilt)\n`;
+        }
+        return line;
+    }
+    // Best-effort sha of a ref — '' when it cannot resolve. Recorded in archive.json for provenance.
+    revParse(repoRoot, ref) {
+        const result = (0, child_process_1.spawnSync)('git', ['rev-parse', ref], { cwd: repoRoot, encoding: 'utf8' });
+        return result.status === 0 ? (result.stdout ?? '').trim() : '';
+    }
     // The open PR's number + title for this head branch, or null when there is none. The TITLE comes
     // from the PR itself, not review.json, so the squash subject matches what a reviewer approved even
     // if review.json was edited afterwards.
@@ -93,7 +139,9 @@ exports.LandPrCommand = LandPrCommand = tslib_1.__decorate([
     tslib_1.__metadata("design:paramtypes", [rules_config_1.RepoRootFinder,
         git_readAiBranchName_1.AiBranchName,
         branch_naming_1.BranchNaming,
-        pr_merger_1.PrMerger])
+        pr_merger_1.PrMerger,
+        rules_config_1.BranchArchiver,
+        merge_info_index_1.MergeInfoIndex])
 ], LandPrCommand);
 // The open PR's number + title, as read back from GitHub.
 class PrIdentity {

package/src/scripts/commands/land-pr-command.js.map

@@ -1 +1 @@
-{"version":3,"file":"land-pr-command.js","sourceRoot":"","sources":["../../../../../../../packages/tooling/pr-gate/src/scripts/commands/land-pr-command.ts"],"names":[],"mappings":";;;;AAAA,iDAAoD;AACpD,+CAAyB;AACzB,mDAA6B;AAC7B,0DAAoH;AACpH,yCAA2D;AAC3D,2EAAgE;AAChE,6DAAyD;AACzD,qDAAiD;AAEjD,MAAM,GAAG,GAAG,0DAA0D,CAAC;AAEvE;;;;;;;;;;;;;;GAcG;AAEI,IAAM,aAAa,GAAnB,MAAM,aAAa;IAED;IACA;IACA;IACA;IAJrB,YACqB,cAA8B,EAC9B,YAA0B,EAC1B,YAA0B,EAC1B,QAAkB;QAHlB,mBAAc,GAAd,cAAc,CAAgB;QAC9B,iBAAY,GAAZ,YAAY,CAAc;QAC1B,iBAAY,GAAZ,YAAY,CAAc;QAC1B,aAAQ,GAAR,QAAQ,CAAU;IACpC,CAAC;IAEJ,KAAK,CAAC,GAAG;QACL,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACpE,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,IAAA,wBAAQ,EAAC,2BAA2B,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAClH,MAAM,KAAK,GAAG,IAAA,uBAAQ,EAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,CAAC,CAAC;QACrE,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,sBAAsB,CAAC,CAAC;QAE/D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,4BAAa,CACnB,IAAI,GAAG,GAAG,GAAG,8CAA8C,GAAG,GAAG,GAAG,IAAI;gBACxE,kDAAkD,aAAa,MAAM;gBACrE,wFAAwF;gBACxF,sFAAsF;gBACtF,qCAAqC;gBACrC,sEAAsE;gBACtE,oCAAoC;gBACpC,iFAAiF;gBACjF,gEAAgE,GAAG,GAAG,CACzE,CAAC;QACN,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACf,MAAM,IAAI,4BAAa,CACnB,IAAI,GAAG,GAAG,GAAG,sCAAsC,GAAG,GAAG,GAAG,IAAI;gBAChE,+BAA+B,IAAI,uBAAuB;gBAC1D,uDAAuD,GAAG,GAAG,CAChE,CAAC;QACN,CAAC;QAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,GAAG,GAAG,kBAAkB,GAAG,CAAC,MAAM,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC;QACjF,2FAA2F;QAC3F,0FAA0F;QAC1F,8FAA8F;QAC9F,2FAA2F;QAC3F,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,GAAG,CAAC,KAAK,MAAM,GAAG,CAAC,MAAM,GAAG,EAAE,aAAa,EAAE,8BAAe,CAAC,CAAC;QAE3G,MAAM,MAAM,GAAG,IAAA,8BAAe,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;QAC1D,OAAO,CAAC,MAAM,CAAC,KAAK,CAChB,IAAI,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,GAAG,GAAG,IAAI;YAClF,MAAM,OAAO,CAAC,OAAO,IAAI;YACzB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,2DAA2D,CAAC,CAAC,CAAC,EAAE,CAAC;YACnF,CAAC,MAAM,KAAK,8BAAe;gBACvB,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,4BAA4B,MAAM,8DAA8D,CAAC;YACvG,IAAI,CACP,CAAC;IACN,CAAC;IAED,iGAAiG;IACjG,mGAAmG;IACnG,wCAAwC;IAChC,gBAAgB,CAAC,UAAkB;QACvC,MAAM,MAAM,GAAG,IAAA,yBAAS,EACpB,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,4BAA4B,CAAC,EAChG,EAAE,QAAQ,EAAE,MAAM,EAAE,CACvB,CAAC;QACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACrC,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC;QACzC,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1D,CAAC;CACJ,CAAA;AArEY,sCAAa;wBAAb,aAAa;IADzB,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;6CAGA,6BAAc;QAChB,mCAAY;QACZ,4BAAY;QAChB,oBAAQ;GAL9B,aAAa,CAqEzB;AAED,0DAA0D;AAC1D,MAAM,UAAU;IACZ,MAAM,CAAS;IACf,KAAK,CAAS;IAEd,YAAY,MAAc,EAAE,KAAa;QACrC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACvB,CAAC;CACJ","sourcesContent":["import { execSync, spawnSync } from 'child_process';\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport { prDirFor, InformAiError, RepoRootFinder, MERGE_MODE_AUTO, loadAndValidate } from '@webpieces/rules-config';\nimport { injectable, bindingScopeValues } from 'inversify';\nimport { AiBranchName } from '../workflow/git-readAiBranchName';\nimport { BranchNaming } from '../workflow/branch-naming';\nimport { PrMerger } from '../workflow/pr-merger';\n\nconst SEP = '━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n';\n\n/**\n * `wp-land-pr`: squash-merge THIS branch's already-posted PR into main with the compact commit body.\n *\n * It exists because a merge clicked in the GitHub UI cannot produce that body. A UI merge is limited\n * to the repo's squash_merge_commit_title/message settings, and none of their values yields the\n * shortened risk/flags summary — only an explicit `gh pr merge --subject --body-file` does. So when a\n * merge has to happen outside `wp-finish-upsert-pr` (a mergeMode=NONE repo, or a PR whose checks were\n * still running when finish ran), this is the command that keeps main's history consistent.\n *\n * It deliberately does NOT re-run the build gate or re-render the dashboard: `wp-finish-upsert-pr`\n * already did both and left `merge-commit-body.md` on disk. Landing is a separate, later act, and\n * rebuilding here would mean a second authoritative gate whose result nobody reads. If that file is\n * missing, the honest answer is that finish has not run — so this fails and says so, rather than\n * inventing a body that would not match the PR.\n */\n@injectable(bindingScopeValues.Singleton)\nexport class LandPrCommand {\n    constructor(\n        private readonly repoRootFinder: RepoRootFinder,\n        private readonly aiBranchName: AiBranchName,\n        private readonly branchNaming: BranchNaming,\n        private readonly prMerger: PrMerger,\n    ) {}\n\n    async run(): Promise<void> {\n        const repoRoot = this.repoRootFinder.resolveRepoRoot(process.cwd());\n        const base = this.branchNaming.baseBranchName(execSync('git branch --show-current', { encoding: 'utf8' }).trim());\n        const prDir = prDirFor(repoRoot, this.aiBranchName.getFeatureName());\n        const mergeBodyFile = path.join(prDir, 'merge-commit-body.md');\n\n        if (!fs.existsSync(mergeBodyFile)) {\n            throw new InformAiError(\n                '\\n' + SEP + '❌ Nothing to land — no rendered merge body\\n' + SEP + '\\n' +\n                `Expected the compact squash-commit body at:\\n  ${mergeBodyFile}\\n\\n` +\n                'That file is written by `pnpm wp-finish-upsert-pr`, which is also what posts the PR.\\n' +\n                'Its absence means finish has not run on this branch, so there is no reviewed PR to\\n' +\n                'land. Run the gated flow first:\\n\\n' +\n                '  pnpm wp-start-upsert-pr     # update from main, push, build gate\\n' +\n                '  # write .webpieces/review.json\\n' +\n                '  pnpm wp-finish-upsert-pr    # build gate, dashboard, create/update the PR\\n\\n' +\n                'Then re-run `pnpm wp-land-pr` if the PR still needs landing.\\n' + SEP,\n            );\n        }\n\n        const ref = this.prNumberAndTitle(base);\n        if (ref === null) {\n            throw new InformAiError(\n                '\\n' + SEP + '❌ No open PR found for this branch\\n' + SEP + '\\n' +\n                `No open PR has head branch \"${base}\". Nothing to land.\\n` +\n                'If the PR is already merged, run `pnpm wp-cleanup`.\\n' + SEP,\n            );\n        }\n\n        process.stdout.write('\\n' + SEP + `🚀 Landing PR #${ref.number}\\n` + SEP + '\\n');\n        // Reuse the SAME merge logic wp-finish-upsert-pr uses, so a PR lands identically whichever\n        // command lands it — including the auto-merge fallback when the checks are still running.\n        // MERGE_MODE_AUTO is passed explicitly: running this command IS the intent to merge, so it is\n        // not gated on pr-gate.mergeMode (a NONE repo runs this precisely to land one PR by hand).\n        const outcome = this.prMerger.merge(base, `${ref.title} (#${ref.number})`, mergeBodyFile, MERGE_MODE_AUTO);\n\n        const policy = loadAndValidate(repoRoot).prGate.mergeMode;\n        process.stdout.write(\n            '\\n' + SEP + (outcome.merged ? '✅ Landed\\n' : 'ℹ️  Not landed yet\\n') + SEP + '\\n' +\n            `   ${outcome.message}\\n` +\n            (outcome.merged ? '   Next: `pnpm wp-cleanup` to delete the merged branch.\\n' : '') +\n            (policy === MERGE_MODE_AUTO\n                ? ''\n                : `   (pr-gate.mergeMode is ${policy} — wp-finish-upsert-pr will keep leaving PRs for a human.)\\n`) +\n            '\\n',\n        );\n    }\n\n    // The open PR's number + title for this head branch, or null when there is none. The TITLE comes\n    // from the PR itself, not review.json, so the squash subject matches what a reviewer approved even\n    // if review.json was edited afterwards.\n    private prNumberAndTitle(baseBranch: string): PrIdentity | null {\n        const result = spawnSync(\n            'gh', ['pr', 'view', baseBranch, '--json', 'number,title', '--jq', '\"\\\\(.number)\\\\t\\\\(.title)\"'],\n            { encoding: 'utf8' },\n        );\n        if (result.status !== 0) return null;\n        const parts = (result.stdout ?? '').trim().split('\\t');\n        if ((parts[0] ?? '') === '') return null;\n        return new PrIdentity(parts[0] ?? '', parts[1] ?? '');\n    }\n}\n\n// The open PR's number + title, as read back from GitHub.\nclass PrIdentity {\n    number: string;\n    title: string;\n\n    constructor(number: string, title: string) {\n        this.number = number;\n        this.title = title;\n    }\n}\n"]}
+{"version":3,"file":"land-pr-command.js","sourceRoot":"","sources":["../../../../../../../packages/tooling/pr-gate/src/scripts/commands/land-pr-command.ts"],"names":[],"mappings":";;;;AAAA,iDAAoD;AACpD,+CAAyB;AACzB,mDAA6B;AAC7B,0DAGiC;AACjC,yCAA2D;AAC3D,2EAAgE;AAChE,6DAAyD;AACzD,mEAA6E;AAC7E,qDAAiD;AAEjD,MAAM,GAAG,GAAG,0DAA0D,CAAC;AAEvE;;;;;;;;;;;;;;GAcG;AAEI,IAAM,aAAa,GAAnB,MAAM,aAAa;IAED;IACA;IACA;IACA;IACA;IACA;IANrB,YACqB,cAA8B,EAC9B,YAA0B,EAC1B,YAA0B,EAC1B,QAAkB,EAClB,QAAwB,EACxB,cAA8B;QAL9B,mBAAc,GAAd,cAAc,CAAgB;QAC9B,iBAAY,GAAZ,YAAY,CAAc;QAC1B,iBAAY,GAAZ,YAAY,CAAc;QAC1B,aAAQ,GAAR,QAAQ,CAAU;QAClB,aAAQ,GAAR,QAAQ,CAAgB;QACxB,mBAAc,GAAd,cAAc,CAAgB;IAChD,CAAC;IAEJ,KAAK,CAAC,GAAG;QACL,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACpE,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,IAAA,wBAAQ,EAAC,2BAA2B,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAClH,MAAM,KAAK,GAAG,IAAA,uBAAQ,EAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,CAAC,CAAC;QACrE,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,sBAAsB,CAAC,CAAC;QAE/D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,4BAAa,CACnB,IAAI,GAAG,GAAG,GAAG,8CAA8C,GAAG,GAAG,GAAG,IAAI;gBACxE,kDAAkD,aAAa,MAAM;gBACrE,wFAAwF;gBACxF,sFAAsF;gBACtF,qCAAqC;gBACrC,sEAAsE;gBACtE,oCAAoC;gBACpC,iFAAiF;gBACjF,gEAAgE,GAAG,GAAG,CACzE,CAAC;QACN,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACf,MAAM,IAAI,4BAAa,CACnB,IAAI,GAAG,GAAG,GAAG,sCAAsC,GAAG,GAAG,GAAG,IAAI;gBAChE,+BAA+B,IAAI,uBAAuB;gBAC1D,uDAAuD,GAAG,GAAG,CAChE,CAAC;QACN,CAAC;QAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,GAAG,GAAG,kBAAkB,GAAG,CAAC,MAAM,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC;QACjF,2FAA2F;QAC3F,0FAA0F;QAC1F,8FAA8F;QAC9F,2FAA2F;QAC3F,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,GAAG,CAAC,KAAK,MAAM,GAAG,CAAC,MAAM,GAAG,EAAE,aAAa,EAAE,8BAAe,CAAC,CAAC;QAE3G,MAAM,MAAM,GAAG,IAAA,8BAAe,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;QAChD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC;QAChC,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM;YAC3B,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC;YAC5E,CAAC,CAAC,EAAE,CAAC;QACT,OAAO,CAAC,MAAM,CAAC,KAAK,CAChB,IAAI,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,GAAG,GAAG,IAAI;YAClF,MAAM,OAAO,CAAC,OAAO,IAAI;YACzB,QAAQ;YACR,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,2DAA2D,CAAC,CAAC,CAAC,EAAE,CAAC;YACnF,CAAC,MAAM,KAAK,8BAAe;gBACvB,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,4BAA4B,MAAM,8DAA8D,CAAC;YACvG,IAAI,CACP,CAAC;IACN,CAAC;IAED;;;;;;;;;;;OAWG;IACK,iBAAiB,CAAC,QAAgB,EAAE,IAAY,EAAE,GAAe,EAAE,SAAiB;QACxF,IAAI,SAAS,KAAK,oCAAqB;YAAE,OAAO,qDAAqD,CAAC;QAEtG,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,IAAI,SAAS,KAAK,2CAA4B,EAAE,CAAC;YAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACtD,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;YAClB,IAAI,GAAG,OAAO,CAAC,EAAE;gBACb,CAAC,CAAC,eAAe,IAAI,MAAM,OAAO,CAAC,GAAG,gBAAgB,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK;gBAC1G,CAAC,CAAC,4BAA4B,IAAI,KAAK,OAAO,CAAC,KAAK,iCAAiC,CAAC;QAC9F,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,IAAI,gCAAa,CAC5B,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,EAC1E,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAC/C,CAAC;QACF,IAAI,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;YACjE,IAAI,IAAI,yBAAyB,OAAO,aAAa,OAAO,yBAAyB,CAAC;QAC1F,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,iGAAiG;IACzF,QAAQ,CAAC,QAAgB,EAAE,GAAW;QAC1C,MAAM,MAAM,GAAG,IAAA,yBAAS,EAAC,KAAK,EAAE,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACzF,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,CAAC;IAED,iGAAiG;IACjG,mGAAmG;IACnG,wCAAwC;IAChC,gBAAgB,CAAC,UAAkB;QACvC,MAAM,MAAM,GAAG,IAAA,yBAAS,EACpB,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,4BAA4B,CAAC,EAChG,EAAE,QAAQ,EAAE,MAAM,EAAE,CACvB,CAAC;QACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACrC,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC;QACzC,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1D,CAAC;CACJ,CAAA;AAtHY,sCAAa;wBAAb,aAAa;IADzB,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;6CAGA,6BAAc;QAChB,mCAAY;QACZ,4BAAY;QAChB,oBAAQ;QACR,6BAAc;QACR,iCAAc;GAP1C,aAAa,CAsHzB;AAED,0DAA0D;AAC1D,MAAM,UAAU;IACZ,MAAM,CAAS;IACf,KAAK,CAAS;IAEd,YAAY,MAAc,EAAE,KAAa;QACrC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACvB,CAAC;CACJ","sourcesContent":["import { execSync, spawnSync } from 'child_process';\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport {\n    prDirFor, InformAiError, RepoRootFinder, MERGE_MODE_AUTO, loadAndValidate,\n    BranchArchiver, BRANCH_RETENTION_ARCHIVE_TAG, BRANCH_RETENTION_KEEP,\n} from '@webpieces/rules-config';\nimport { injectable, bindingScopeValues } from 'inversify';\nimport { AiBranchName } from '../workflow/git-readAiBranchName';\nimport { BranchNaming } from '../workflow/branch-naming';\nimport { ArchiveRecord, MergeInfoIndex } from '../workflow/merge-info-index';\nimport { PrMerger } from '../workflow/pr-merger';\n\nconst SEP = '━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n';\n\n/**\n * `wp-land-pr`: squash-merge THIS branch's already-posted PR into main with the compact commit body.\n *\n * It exists because a merge clicked in the GitHub UI cannot produce that body. A UI merge is limited\n * to the repo's squash_merge_commit_title/message settings, and none of their values yields the\n * shortened risk/flags summary — only an explicit `gh pr merge --subject --body-file` does. So when a\n * merge has to happen outside `wp-finish-upsert-pr` (a mergeMode=NONE repo, or a PR whose checks were\n * still running when finish ran), this is the command that keeps main's history consistent.\n *\n * It deliberately does NOT re-run the build gate or re-render the dashboard: `wp-finish-upsert-pr`\n * already did both and left `merge-commit-body.md` on disk. Landing is a separate, later act, and\n * rebuilding here would mean a second authoritative gate whose result nobody reads. If that file is\n * missing, the honest answer is that finish has not run — so this fails and says so, rather than\n * inventing a body that would not match the PR.\n */\n@injectable(bindingScopeValues.Singleton)\nexport class LandPrCommand {\n    constructor(\n        private readonly repoRootFinder: RepoRootFinder,\n        private readonly aiBranchName: AiBranchName,\n        private readonly branchNaming: BranchNaming,\n        private readonly prMerger: PrMerger,\n        private readonly archiver: BranchArchiver,\n        private readonly mergeInfoIndex: MergeInfoIndex,\n    ) {}\n\n    async run(): Promise<void> {\n        const repoRoot = this.repoRootFinder.resolveRepoRoot(process.cwd());\n        const base = this.branchNaming.baseBranchName(execSync('git branch --show-current', { encoding: 'utf8' }).trim());\n        const prDir = prDirFor(repoRoot, this.aiBranchName.getFeatureName());\n        const mergeBodyFile = path.join(prDir, 'merge-commit-body.md');\n\n        if (!fs.existsSync(mergeBodyFile)) {\n            throw new InformAiError(\n                '\\n' + SEP + '❌ Nothing to land — no rendered merge body\\n' + SEP + '\\n' +\n                `Expected the compact squash-commit body at:\\n  ${mergeBodyFile}\\n\\n` +\n                'That file is written by `pnpm wp-finish-upsert-pr`, which is also what posts the PR.\\n' +\n                'Its absence means finish has not run on this branch, so there is no reviewed PR to\\n' +\n                'land. Run the gated flow first:\\n\\n' +\n                '  pnpm wp-start-upsert-pr     # update from main, push, build gate\\n' +\n                '  # write .webpieces/review.json\\n' +\n                '  pnpm wp-finish-upsert-pr    # build gate, dashboard, create/update the PR\\n\\n' +\n                'Then re-run `pnpm wp-land-pr` if the PR still needs landing.\\n' + SEP,\n            );\n        }\n\n        const ref = this.prNumberAndTitle(base);\n        if (ref === null) {\n            throw new InformAiError(\n                '\\n' + SEP + '❌ No open PR found for this branch\\n' + SEP + '\\n' +\n                `No open PR has head branch \"${base}\". Nothing to land.\\n` +\n                'If the PR is already merged, run `pnpm wp-cleanup`.\\n' + SEP,\n            );\n        }\n\n        process.stdout.write('\\n' + SEP + `🚀 Landing PR #${ref.number}\\n` + SEP + '\\n');\n        // Reuse the SAME merge logic wp-finish-upsert-pr uses, so a PR lands identically whichever\n        // command lands it — including the auto-merge fallback when the checks are still running.\n        // MERGE_MODE_AUTO is passed explicitly: running this command IS the intent to merge, so it is\n        // not gated on pr-gate.mergeMode (a NONE repo runs this precisely to land one PR by hand).\n        const outcome = this.prMerger.merge(base, `${ref.title} (#${ref.number})`, mergeBodyFile, MERGE_MODE_AUTO);\n\n        const config = loadAndValidate(repoRoot).prGate;\n        const policy = config.mergeMode;\n        const archived = outcome.merged\n            ? this.archiveAndPromote(repoRoot, base, ref, config.landPr.branchRetention)\n            : '';\n        process.stdout.write(\n            '\\n' + SEP + (outcome.merged ? '✅ Landed\\n' : 'ℹ️  Not landed yet\\n') + SEP + '\\n' +\n            `   ${outcome.message}\\n` +\n            archived +\n            (outcome.merged ? '   Next: `pnpm wp-cleanup` to delete the merged branch.\\n' : '') +\n            (policy === MERGE_MODE_AUTO\n                ? ''\n                : `   (pr-gate.mergeMode is ${policy} — wp-finish-upsert-pr will keep leaving PRs for a human.)\\n`) +\n            '\\n',\n        );\n    }\n\n    /**\n     * The landed branch's post-merge bookkeeping, in one place:\n     *  1. ARCHIVE the pre-squash tip as `archive/<date>/<branch>` — the tag makes the original history\n     *     permanently restorable (`git checkout -b <branch> <tag>` gives back the exact objects) while\n     *     costing one ref, so the branch itself no longer has to survive as a `*PreMerge` husk that\n     *     counts toward the branch cap. See BranchArchiver for why a tag beats a patch or the reflog.\n     *  2. PROMOTE `merge-info/staged/<feature>/` to `merge-info/merged/<feature>/` and rebuild\n     *     `index.json`, so `staged/` holds only branches that are still in flight.\n     *\n     * Never throws: the PR is already merged by the time we get here, and failing the command after a\n     * successful merge would report a landed PR as a failure. Problems are reported in the recap.\n     */\n    private archiveAndPromote(repoRoot: string, base: string, ref: PrIdentity, retention: string): string {\n        if (retention === BRANCH_RETENTION_KEEP) return '   Branch retention is \"keep\" — nothing archived.\\n';\n\n        let line = '';\n        let tag = '';\n        if (retention === BRANCH_RETENTION_ARCHIVE_TAG) {\n            const archive = this.archiver.archive(repoRoot, base);\n            tag = archive.tag;\n            line = archive.ok\n                ? `   Archived ${base} → ${archive.tag}   (restore: ${this.archiver.restoreCommand(base, archive.tag)})\\n`\n                : `   ⚠️  Could not archive ${base}: ${archive.error} — the branch was left alone.\\n`;\n        }\n\n        const feature = this.aiBranchName.getFeatureName();\n        const record = new ArchiveRecord(\n            tag, this.revParse(repoRoot, base), this.revParse(repoRoot, 'origin/main'),\n            Number(ref.number), new Date().toISOString(),\n        );\n        if (this.mergeInfoIndex.promoteToMerged(repoRoot, feature, record)) {\n            line += `   merge-info: staged/${feature} → merged/${feature} (index.json rebuilt)\\n`;\n        }\n        return line;\n    }\n\n    // Best-effort sha of a ref — '' when it cannot resolve. Recorded in archive.json for provenance.\n    private revParse(repoRoot: string, ref: string): string {\n        const result = spawnSync('git', ['rev-parse', ref], { cwd: repoRoot, encoding: 'utf8' });\n        return result.status === 0 ? (result.stdout ?? '').trim() : '';\n    }\n\n    // The open PR's number + title for this head branch, or null when there is none. The TITLE comes\n    // from the PR itself, not review.json, so the squash subject matches what a reviewer approved even\n    // if review.json was edited afterwards.\n    private prNumberAndTitle(baseBranch: string): PrIdentity | null {\n        const result = spawnSync(\n            'gh', ['pr', 'view', baseBranch, '--json', 'number,title', '--jq', '\"\\\\(.number)\\\\t\\\\(.title)\"'],\n            { encoding: 'utf8' },\n        );\n        if (result.status !== 0) return null;\n        const parts = (result.stdout ?? '').trim().split('\\t');\n        if ((parts[0] ?? '') === '') return null;\n        return new PrIdentity(parts[0] ?? '', parts[1] ?? '');\n    }\n}\n\n// The open PR's number + title, as read back from GitHub.\nclass PrIdentity {\n    number: string;\n    title: string;\n\n    constructor(number: string, title: string) {\n        this.number = number;\n        this.title = title;\n    }\n}\n"]}

package/src/scripts/workflow/cleanTmp.js

@@ -51,7 +51,10 @@ let CleanTmp = class CleanTmp {
         process.stdout.write('\n');
         const cutoffMs = CUTOFF_DAYS * 24 * 60 * 60 * 1000;
         const now = Date.now();
-        // `true` => this is the root, which is swept into but never itself removed.
+        // `true` => this is the root, which is swept into but never itself removed. This generic
+        // depth-first sweep needs NO knowledge of the merge-info layout — including the new
+        // staged/<feature> and merged/<feature> split, which sits one level deeper than the old
+        // per-feature dirs. That is precisely why it replaced the per-home special-casing.
         const result = this.sweep(tmpBase, tmpBase, now, cutoffMs, true);
         if (result.files === 0 && result.dirs === 0) {
             process.stdout.write(`  ✅ Nothing older than ${CUTOFF_DAYS} days; no empty directories\n`);

package/src/scripts/workflow/cleanTmp.js.map

@@ -1 +1 @@
-{"version":3,"file":"cleanTmp.js","sourceRoot":"","sources":["../../../../../../../packages/tooling/pr-gate/src/scripts/workflow/cleanTmp.ts"],"names":[],"mappings":";;;;AAAA,+CAAyB;AACzB,mDAA6B;AAC7B,0DAA4E;AAC5E,yCAA2D;AAE3D,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,GAAG,GAAG,0DAA0D,CAAC;AAEvE,oGAAoG;AACpG,MAAM,WAAW;IAEF;IACA;IAFX,YACW,KAAa,EACb,IAAY;QADZ,UAAK,GAAL,KAAK,CAAQ;QACb,SAAI,GAAJ,IAAI,CAAQ;IACpB,CAAC;CACP;AAED;;;;;;;;;;;;GAYG;AAEI,IAAM,QAAQ,GAAd,MAAM,QAAQ;IACY;IAA7B,YAA6B,cAA8B;QAA9B,mBAAc,GAAd,cAAc,CAAgB;IAAG,CAAC;IAE/D,KAAK,CAAC,QAAQ;QACV,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACpE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,gCAAiB,CAAC,CAAC;QAEvD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,OAAO;QACX,CAAC;QAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAC3D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,OAAO,IAAI,CAAC,CAAC;QAC/C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,WAAW,iDAAiD,CAAC,CAAC;QACjG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAE3B,MAAM,QAAQ,GAAG,WAAW,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QACnD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,4EAA4E;QAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAEjE,IAAI,MAAM,CAAC,KAAK,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC1C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,WAAW,+BAA+B,CAAC,CAAC;QAC/F,CAAC;aAAM,CAAC;YACJ,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;YACvD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC;YAChE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,MAAM,CAAC,KAAK,QAAQ,QAAQ,eAAe,MAAM,CAAC,IAAI,UAAU,OAAO,IAAI,CAAC,CAAC;QACpH,CAAC;QAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,qGAAqG;IACrG,qGAAqG;IACrG,4FAA4F;IACpF,KAAK,CAAC,GAAW,EAAE,OAAe,EAAE,GAAW,EAAE,QAAgB,EAAE,MAAe;QACtF,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,IAAI,GAAG,CAAC,CAAC;QAEb,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACvC,2FAA2F;YAC3F,iFAAiF;YACjF,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YACpC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;gBACrB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;gBACnE,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC;gBACtB,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC;YACxB,CAAC;iBAAM,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,IAAI,QAAQ,EAAE,CAAC;gBACxC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAC5E,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBACrC,KAAK,IAAI,CAAC,CAAC;YACf,CAAC;QACL,CAAC;QAED,iFAAiF;QACjF,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;YACxE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAClB,IAAI,IAAI,CAAC,CAAC;QACd,CAAC;QAED,OAAO,IAAI,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACxC,CAAC;CACJ,CAAA;AAxEY,4BAAQ;mBAAR,QAAQ;IADpB,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;6CAEQ,6BAAc;GADlD,QAAQ,CAwEpB","sourcesContent":["import * as fs from 'fs';\nimport * as path from 'path';\nimport { WEBPIECES_TMP_DIR, RepoRootFinder } from '@webpieces/rules-config';\nimport { injectable, bindingScopeValues } from 'inversify';\n\nconst CUTOFF_DAYS = 30;\nconst SEP = '━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n';\n\n// Result of one sweep: how many files were reaped for age, and how many now-empty dirs were pruned.\nclass SweepResult {\n    constructor(\n        public files: number,\n        public dirs: number,\n    ) {}\n}\n\n/**\n * 30-day garbage collection of the whole `.webpieces` tree.\n *\n * Runs at the end of every merge/PR flow (see merge-end.ts). It walks `.webpieces` depth-first and:\n *   1. deletes ANY file whose mtime is older than the cutoff, anywhere in the tree, and\n *   2. removes ANY directory that is left empty afterwards (including dirs that were already empty).\n *\n * The `.webpieces` root itself is never removed. Everything the tooling still needs is rewritten on\n * each run under a fresh mtime (instruct-ai/ docs, the active hooks/ logs, the *-status.json state\n * files), and every writer `mkdirSync(..., { recursive: true })`s its target first — so pruning a\n * stale home dir is harmless; the next write recreates it. Stale per-feature merge-info/pr-review\n * subdirs and the retired legacy flat layout all fall out of this single pass with no special-casing.\n */\n@injectable(bindingScopeValues.Singleton)\nexport class CleanTmp {\n    constructor(private readonly repoRootFinder: RepoRootFinder) {}\n\n    async cleanTmp(): Promise<void> {\n        const repoRoot = this.repoRootFinder.resolveRepoRoot(process.cwd());\n        const tmpBase = path.join(repoRoot, WEBPIECES_TMP_DIR);\n\n        if (!fs.existsSync(tmpBase)) {\n            return;\n        }\n\n        process.stdout.write('\\n');\n        process.stdout.write(SEP);\n        process.stdout.write('🧹 Garbage-Collecting .webpieces\\n');\n        process.stdout.write(SEP);\n        process.stdout.write('\\n');\n        process.stdout.write(`Location: ${tmpBase}\\n`);\n        process.stdout.write(`Retention: ${CUTOFF_DAYS} days (older files reaped; empty dirs pruned)\\n`);\n        process.stdout.write('\\n');\n\n        const cutoffMs = CUTOFF_DAYS * 24 * 60 * 60 * 1000;\n        const now = Date.now();\n\n        // `true` => this is the root, which is swept into but never itself removed.\n        const result = this.sweep(tmpBase, tmpBase, now, cutoffMs, true);\n\n        if (result.files === 0 && result.dirs === 0) {\n            process.stdout.write(`  ✅ Nothing older than ${CUTOFF_DAYS} days; no empty directories\\n`);\n        } else {\n            const fileWord = result.files === 1 ? 'file' : 'files';\n            const dirWord = result.dirs === 1 ? 'directory' : 'directories';\n            process.stdout.write('\\n');\n            process.stdout.write(`  ✅ Reaped ${result.files} old ${fileWord} and pruned ${result.dirs} empty ${dirWord}\\n`);\n        }\n\n        process.stdout.write('\\n');\n        process.stdout.write(SEP);\n        process.stdout.write('\\n');\n    }\n\n    // Depth-first, post-order sweep of `dir` (rooted at `tmpBase`, only used for tidy relative logging).\n    // Files older than the cutoff are deleted; a directory left empty once its children are processed is\n    // pruned — except the root, which is kept even when empty so `.webpieces/` itself survives.\n    private sweep(dir: string, tmpBase: string, now: number, cutoffMs: number, isRoot: boolean): SweepResult {\n        let files = 0;\n        let dirs = 0;\n\n        for (const entry of fs.readdirSync(dir)) {\n            const fullPath = path.join(dir, entry);\n            // lstat, not stat: a symlink is treated as a leaf (aged out like a file), never followed —\n            // so we can never wander outside `.webpieces` or delete a link target elsewhere.\n            const stat = fs.lstatSync(fullPath);\n            if (stat.isDirectory()) {\n                const nested = this.sweep(fullPath, tmpBase, now, cutoffMs, false);\n                files += nested.files;\n                dirs += nested.dirs;\n            } else if (now - stat.mtimeMs >= cutoffMs) {\n                process.stdout.write(`  🗑️  file:  ${path.relative(tmpBase, fullPath)}\\n`);\n                fs.rmSync(fullPath, { force: true });\n                files += 1;\n            }\n        }\n\n        // Post-order: prune this dir if reaping its children (or nothing) left it empty.\n        if (!isRoot && fs.readdirSync(dir).length === 0) {\n            process.stdout.write(`  🗑️  dir:   ${path.relative(tmpBase, dir)}/\\n`);\n            fs.rmdirSync(dir);\n            dirs += 1;\n        }\n\n        return new SweepResult(files, dirs);\n    }\n}\n"]}
+{"version":3,"file":"cleanTmp.js","sourceRoot":"","sources":["../../../../../../../packages/tooling/pr-gate/src/scripts/workflow/cleanTmp.ts"],"names":[],"mappings":";;;;AAAA,+CAAyB;AACzB,mDAA6B;AAC7B,0DAA4E;AAC5E,yCAA2D;AAE3D,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,GAAG,GAAG,0DAA0D,CAAC;AAEvE,oGAAoG;AACpG,MAAM,WAAW;IAEF;IACA;IAFX,YACW,KAAa,EACb,IAAY;QADZ,UAAK,GAAL,KAAK,CAAQ;QACb,SAAI,GAAJ,IAAI,CAAQ;IACpB,CAAC;CACP;AAED;;;;;;;;;;;;GAYG;AAEI,IAAM,QAAQ,GAAd,MAAM,QAAQ;IACY;IAA7B,YAA6B,cAA8B;QAA9B,mBAAc,GAAd,cAAc,CAAgB;IAAG,CAAC;IAE/D,KAAK,CAAC,QAAQ;QACV,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACpE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,gCAAiB,CAAC,CAAC;QAEvD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,OAAO;QACX,CAAC;QAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAC3D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,OAAO,IAAI,CAAC,CAAC;QAC/C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,WAAW,iDAAiD,CAAC,CAAC;QACjG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAE3B,MAAM,QAAQ,GAAG,WAAW,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QACnD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,yFAAyF;QACzF,oFAAoF;QACpF,wFAAwF;QACxF,mFAAmF;QACnF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAEjE,IAAI,MAAM,CAAC,KAAK,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC1C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,WAAW,+BAA+B,CAAC,CAAC;QAC/F,CAAC;aAAM,CAAC;YACJ,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;YACvD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC;YAChE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,MAAM,CAAC,KAAK,QAAQ,QAAQ,eAAe,MAAM,CAAC,IAAI,UAAU,OAAO,IAAI,CAAC,CAAC;QACpH,CAAC;QAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,qGAAqG;IACrG,qGAAqG;IACrG,4FAA4F;IACpF,KAAK,CAAC,GAAW,EAAE,OAAe,EAAE,GAAW,EAAE,QAAgB,EAAE,MAAe;QACtF,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,IAAI,GAAG,CAAC,CAAC;QAEb,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACvC,2FAA2F;YAC3F,iFAAiF;YACjF,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YACpC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;gBACrB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;gBACnE,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC;gBACtB,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC;YACxB,CAAC;iBAAM,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,IAAI,QAAQ,EAAE,CAAC;gBACxC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAC5E,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBACrC,KAAK,IAAI,CAAC,CAAC;YACf,CAAC;QACL,CAAC;QAED,iFAAiF;QACjF,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;YACxE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAClB,IAAI,IAAI,CAAC,CAAC;QACd,CAAC;QAED,OAAO,IAAI,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACxC,CAAC;CACJ,CAAA;AA3EY,4BAAQ;mBAAR,QAAQ;IADpB,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;6CAEQ,6BAAc;GADlD,QAAQ,CA2EpB","sourcesContent":["import * as fs from 'fs';\nimport * as path from 'path';\nimport { WEBPIECES_TMP_DIR, RepoRootFinder } from '@webpieces/rules-config';\nimport { injectable, bindingScopeValues } from 'inversify';\n\nconst CUTOFF_DAYS = 30;\nconst SEP = '━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n';\n\n// Result of one sweep: how many files were reaped for age, and how many now-empty dirs were pruned.\nclass SweepResult {\n    constructor(\n        public files: number,\n        public dirs: number,\n    ) {}\n}\n\n/**\n * 30-day garbage collection of the whole `.webpieces` tree.\n *\n * Runs at the end of every merge/PR flow (see merge-end.ts). It walks `.webpieces` depth-first and:\n *   1. deletes ANY file whose mtime is older than the cutoff, anywhere in the tree, and\n *   2. removes ANY directory that is left empty afterwards (including dirs that were already empty).\n *\n * The `.webpieces` root itself is never removed. Everything the tooling still needs is rewritten on\n * each run under a fresh mtime (instruct-ai/ docs, the active hooks/ logs, the *-status.json state\n * files), and every writer `mkdirSync(..., { recursive: true })`s its target first — so pruning a\n * stale home dir is harmless; the next write recreates it. Stale per-feature merge-info/pr-review\n * subdirs and the retired legacy flat layout all fall out of this single pass with no special-casing.\n */\n@injectable(bindingScopeValues.Singleton)\nexport class CleanTmp {\n    constructor(private readonly repoRootFinder: RepoRootFinder) {}\n\n    async cleanTmp(): Promise<void> {\n        const repoRoot = this.repoRootFinder.resolveRepoRoot(process.cwd());\n        const tmpBase = path.join(repoRoot, WEBPIECES_TMP_DIR);\n\n        if (!fs.existsSync(tmpBase)) {\n            return;\n        }\n\n        process.stdout.write('\\n');\n        process.stdout.write(SEP);\n        process.stdout.write('🧹 Garbage-Collecting .webpieces\\n');\n        process.stdout.write(SEP);\n        process.stdout.write('\\n');\n        process.stdout.write(`Location: ${tmpBase}\\n`);\n        process.stdout.write(`Retention: ${CUTOFF_DAYS} days (older files reaped; empty dirs pruned)\\n`);\n        process.stdout.write('\\n');\n\n        const cutoffMs = CUTOFF_DAYS * 24 * 60 * 60 * 1000;\n        const now = Date.now();\n\n        // `true` => this is the root, which is swept into but never itself removed. This generic\n        // depth-first sweep needs NO knowledge of the merge-info layout — including the new\n        // staged/<feature> and merged/<feature> split, which sits one level deeper than the old\n        // per-feature dirs. That is precisely why it replaced the per-home special-casing.\n        const result = this.sweep(tmpBase, tmpBase, now, cutoffMs, true);\n\n        if (result.files === 0 && result.dirs === 0) {\n            process.stdout.write(`  ✅ Nothing older than ${CUTOFF_DAYS} days; no empty directories\\n`);\n        } else {\n            const fileWord = result.files === 1 ? 'file' : 'files';\n            const dirWord = result.dirs === 1 ? 'directory' : 'directories';\n            process.stdout.write('\\n');\n            process.stdout.write(`  ✅ Reaped ${result.files} old ${fileWord} and pruned ${result.dirs} empty ${dirWord}\\n`);\n        }\n\n        process.stdout.write('\\n');\n        process.stdout.write(SEP);\n        process.stdout.write('\\n');\n    }\n\n    // Depth-first, post-order sweep of `dir` (rooted at `tmpBase`, only used for tidy relative logging).\n    // Files older than the cutoff are deleted; a directory left empty once its children are processed is\n    // pruned — except the root, which is kept even when empty so `.webpieces/` itself survives.\n    private sweep(dir: string, tmpBase: string, now: number, cutoffMs: number, isRoot: boolean): SweepResult {\n        let files = 0;\n        let dirs = 0;\n\n        for (const entry of fs.readdirSync(dir)) {\n            const fullPath = path.join(dir, entry);\n            // lstat, not stat: a symlink is treated as a leaf (aged out like a file), never followed —\n            // so we can never wander outside `.webpieces` or delete a link target elsewhere.\n            const stat = fs.lstatSync(fullPath);\n            if (stat.isDirectory()) {\n                const nested = this.sweep(fullPath, tmpBase, now, cutoffMs, false);\n                files += nested.files;\n                dirs += nested.dirs;\n            } else if (now - stat.mtimeMs >= cutoffMs) {\n                process.stdout.write(`  🗑️  file:  ${path.relative(tmpBase, fullPath)}\\n`);\n                fs.rmSync(fullPath, { force: true });\n                files += 1;\n            }\n        }\n\n        // Post-order: prune this dir if reaping its children (or nothing) left it empty.\n        if (!isRoot && fs.readdirSync(dir).length === 0) {\n            process.stdout.write(`  🗑️  dir:   ${path.relative(tmpBase, dir)}/\\n`);\n            fs.rmdirSync(dir);\n            dirs += 1;\n        }\n\n        return new SweepResult(files, dirs);\n    }\n}\n"]}

package/src/scripts/workflow/merge-info-index.d.ts

@@ -0,0 +1,60 @@
+import { MergeState } from './merge-state';
+/**
+ * `.webpieces/merge-info/index.json` — the one answer to "which merges, across ALL branches, were
+ * 3-point?", which is the actual review question.
+ *
+ * WHY AN INDEX IS REQUIRED and a directory name will not do: a single branch can alternate
+ * clean → 3-point → clean → 3-point across its syncs. So the clean/3-point axis belongs to the MERGE,
+ * not the branch, and cannot be encoded in `merged/<branch>/`. With the index, one jq lists every
+ * 3-point merge in the repo and stays correct for alternating branches:
+ *
+ *   jq -r '.merged | to_entries[] | .key as $b | .value.merges[] |
+ *          select(.threeWay) | "\($b) merge-\(.n)"' .webpieces/merge-info/index.json
+ *
+ * WHY IT IS DERIVED, NOT INCREMENTALLY WRITTEN: every fact in it already exists on disk — `threeWay`
+ * is the presence of `conflicts.md` in the run dir, `conflicts` is that file's list, and the archive
+ * fields come from `archive.json`. Rebuilding by scanning `merged/` makes the index a pure projection
+ * that cannot drift from the directories, and makes a lost or corrupt index self-healing.
+ */
+export declare class MergeRecord {
+    n: number;
+    threeWay: boolean;
+    conflicts: string[];
+    constructor(n: number, threeWay: boolean, conflicts: string[]);
+}
+export declare class ArchiveRecord {
+    archiveTag: string;
+    tipSha: string;
+    baseSha: string;
+    pr: number;
+    mergedAt: string;
+    constructor(archiveTag: string, tipSha: string, baseSha: string, pr: number, mergedAt: string);
+}
+export declare class MergedBranchEntry {
+    pr: number;
+    archiveTag: string;
+    merges: MergeRecord[];
+    constructor(pr: number, archiveTag: string, merges: MergeRecord[]);
+}
+export declare class MergeInfoIndexFile {
+    merged: Record<string, MergedBranchEntry>;
+    constructor(merged: Record<string, MergedBranchEntry>);
+}
+export declare class MergeInfoIndex {
+    private readonly mergeState;
+    constructor(mergeState: MergeState);
+    indexPath(repoRoot: string): string;
+    /**
+     * MOVE a landed feature's whole `staged/<feature>/` tree to `merged/<feature>/`, drop its
+     * `archive.json` in, and rebuild the index. This is what makes `staged/` self-cleaning: it holds
+     * only branches still in flight, instead of growing for the life of the repo.
+     *
+     * Returns false when there was nothing staged to promote (a branch that landed without ever syncing
+     * from main), which is a normal outcome and not an error.
+     */
+    promoteToMerged(repoRoot: string, featureName: string, archive: ArchiveRecord): boolean;
+    /** Rebuild `index.json` by scanning `merged/` from scratch. Pure projection of what is on disk. */
+    rebuildIndex(repoRoot: string): MergeInfoIndexFile;
+    private entryFor;
+    private readArchive;
+}