brainclaw 1.12.0 → 1.13.0

package/dist/core/worktree.js

@@ -582,6 +582,16 @@ export function createWorktree(mainWorktreePath, branchName, options = {}) {
     if (fs.existsSync(mainGitignorePath)) {
         fs.copyFileSync(mainGitignorePath, targetGitignorePath);
     }
+    // trp#926 — record the RESOLVED base ref SHA at creation time. base_ref is
+    // usually "HEAD" or a branch name, both of which drift after creation and
+    // are useless for later "how many commits did the worker add?" comparisons.
+    // The resolved SHA is the stable anchor: `${base_ref_sha}..HEAD` on the lane
+    // deterministically counts the worker's contribution even as master advances.
+    // Best-effort — an unresolvable base_ref simply omits the field.
+    const baseRefSha = (() => {
+        const rev = runGit(['rev-parse', baseRef], mainWorktreePath);
+        return rev.ok ? rev.stdout.trim() : undefined;
+    })();
     // Write brainclaw metadata sidecar inside the worktree
     const meta = {
         session_id: options.sessionId,
@@ -590,6 +600,7 @@ export function createWorktree(mainWorktreePath, branchName, options = {}) {
         created_at: new Date().toISOString(),
         main_worktree_path: mainWorktreePath,
         base_ref: baseRef,
+        ...(baseRefSha ? { base_ref_sha: baseRefSha } : {}),
         reset_existing_branch: options.resetExistingBranch === true,
         git_advice: 'git add ONLY specific files, NEVER git add -A.',
         // pln#523: surface any shared-path link failures (e.g. node_modules junction
@@ -827,25 +838,63 @@ export function safeRemoveWorktreeDir(dirPath) {
     catch { /* best effort */ }
 }
 /**
- * pln#498 — Detach top-level symlinks/junctions from a worktree before any
- * recursive removal. On Windows, `git worktree remove` performs its own
- * recursive rm and historically (git ≤ 2.38) followed NTFS junctions into
- * the main repo, wiping `node_modules`. Unlinking the junction entries
- * first leaves git only regular files/dirs to walk.
+ * Depth cap for detachWorktreeJunctions' recursive walk. 8 covers realistic
+ * monorepo trees (apps/<pkg>/packages/<pkg>/node_modules, pnpm nested links)
+ * while keeping the walk bounded on pathological structures. Hitting the cap
+ * is a hard failure: continuing to `git worktree remove` after an incomplete
+ * scan would re-open the junction-follow wipe class. .git is skipped outright
+ * — it never contains user junctions and can be very deep.
+ */
+const JUNCTION_SCAN_MAX_DEPTH = 8;
+/**
+ * pln#498 + trp#926 (2026-07-03 incident) — Detach ALL symlinks/junctions from
+ * a worktree before any recursive removal. On Windows, `git worktree remove`
+ * performs its own recursive rm and historically (git ≤ 2.38) followed NTFS
+ * junctions into the main repo, wiping `node_modules`. Unlinking every
+ * junction entry first leaves git only regular files/dirs to walk.
  *
- * Only top-level entries are inspected — that's where shared paths are
- * symlinked at worktree birth (see createWorktree.trySymlinkSharedPath).
+ * Historically this only inspected top-level entries — that covered the
+ * classic single-stack shared `node_modules` case but MISSED:
+ *   - monorepo per-package junctions created by pln#523
+ *     (apps/<pkg>/node_modules, packages/<pkg>/node_modules);
+ *   - operator- or worker-created manual junctions at nested paths.
+ * The 2026-07-03 incident (node_modules racine rasé via the auto-junction)
+ * was a recurrence of the pln#498 class, extended one level of nesting.
+ *
+ * The recursion NEVER descends into a symlink (lstat + unlink at the entry
+ * itself), so it cannot follow a junction into the main repo. `.git/` is
+ * skipped entirely — git manages its own state and it never holds user
+ * junctions. Depth is capped defensively at JUNCTION_SCAN_MAX_DEPTH; hitting
+ * the cap aborts removal rather than silently leaving deeper links in place.
  */
 export function detachWorktreeJunctions(worktreePath) {
+    if (!fs.existsSync(worktreePath))
+        return;
+    const failures = [];
+    detachJunctionsRecursively(worktreePath, 0, failures);
+    if (failures.length > 0) {
+        throw new Error(`could not safely detach worktree junctions: ${failures.join('; ')}`);
+    }
+}
+function detachJunctionsRecursively(dir, depth, failures) {
+    if (depth > JUNCTION_SCAN_MAX_DEPTH) {
+        failures.push(`scan depth exceeded at ${dir}`);
+        return;
+    }
     let entries;
     try {
-        entries = fs.readdirSync(worktreePath, { withFileTypes: true });
+        entries = fs.readdirSync(dir, { withFileTypes: true });
     }
-    catch {
-        return; // worktree already gone or unreadable
+    catch (err) {
+        failures.push(`could not read ${dir}: ${err.message}`);
+        return;
     }
     for (const entry of entries) {
-        const child = path.join(worktreePath, entry.name);
+        // `.git` is a file (linked worktree pointer) at the worktree root or a
+        // real dir in the main repo — either way, do not walk it.
+        if (entry.name === '.git')
+            continue;
+        const child = path.join(dir, entry.name);
         let stat;
         try {
             stat = fs.lstatSync(child);
@@ -853,16 +902,24 @@ export function detachWorktreeJunctions(worktreePath) {
         catch {
             continue;
         }
-        if (!stat.isSymbolicLink())
-            continue;
-        try {
-            fs.unlinkSync(child);
-        }
-        catch {
+        if (stat.isSymbolicLink()) {
+            // Unlink the junction. Do NOT descend into it (that would follow the
+            // link back into the main repo — the exact class we're preventing).
             try {
-                fs.rmdirSync(child);
+                fs.unlinkSync(child);
             }
-            catch { /* best effort */ }
+            catch (unlinkErr) {
+                try {
+                    fs.rmdirSync(child);
+                }
+                catch (rmdirErr) {
+                    failures.push(`could not detach link ${child}: unlink=${unlinkErr.message}; rmdir=${rmdirErr.message}`);
+                }
+            }
+            continue;
+        }
+        if (stat.isDirectory()) {
+            detachJunctionsRecursively(child, depth + 1, failures);
         }
     }
 }
@@ -924,6 +981,57 @@ export function worktreeHasOnlyBirthNoise(statusZStdout) {
             || isSystemDirtyPath(norm);
     });
 }
+/**
+ * trp#926 (squash-aware GC) — True when every commit on `branch` that is not
+ * an ancestor of `baseRef` has a patch-equivalent commit ALREADY on `baseRef`.
+ *
+ * `git branch --merged HEAD` and `merge-base --is-ancestor` are ancestry-only:
+ * a squash-merge on GitHub creates a NEW commit on master whose ancestry does
+ * not include the lane commits, so an ancestry probe returns "not merged" and
+ * the GC keeps the worktree forever. `git cherry <base> <branch>` uses
+ * patch-id equivalence — the same signal GitHub itself uses to say "this PR is
+ * merged". Output is one line per commit in `base..branch`:
+ *   `+ <sha>` = patch NOT yet on base (a real un-integrated commit)
+ *   `- <sha>` = patch already on base (via squash / cherry-pick / rebase)
+ * The branch is "merged by content" iff there are no `+` lines. An empty
+ * output (no commits ahead of base) is also merged.
+ *
+ * Returns `false` on any git failure — a probe that cannot prove merged must
+ * NEVER lie "yes" and cause a keep-me worktree to be GC'd. Callers combine
+ * this with ancestry ('git branch --merged') so both signals contribute.
+ */
+export function isBranchMergedByContent(mainWorktreePath, branchName, baseRef = 'HEAD') {
+    const cherry = runGit(['cherry', baseRef, branchName], mainWorktreePath);
+    if (!cherry.ok)
+        return false;
+    const lines = cherry.stdout.split(/\r?\n/).map((l) => l.trim()).filter(Boolean);
+    if (lines.length === 0)
+        return true; // no commits ahead of base → fully merged
+    // A `+` line means "patch not on base" — one is enough to disqualify.
+    if (!lines.some((l) => l.startsWith('+ ')))
+        return true;
+    // Multi-commit squash merges often do not produce per-commit patch-id
+    // matches: the squash commit's aggregate patch differs from each individual
+    // branch commit. As a second, still content-only signal, compare the final
+    // content of files changed by the branch. If every branch-touched path now
+    // matches baseRef, removing the worktree cannot drop unique file content.
+    const mergeBase = runGit(['merge-base', baseRef, branchName], mainWorktreePath);
+    if (!mergeBase.ok || !mergeBase.stdout.trim())
+        return false;
+    const changed = runGit(['diff', '--name-only', '-z', mergeBase.stdout.trim(), branchName], mainWorktreePath);
+    if (!changed.ok)
+        return false;
+    const paths = changed.stdout.split('\0').filter(Boolean);
+    if (paths.length === 0)
+        return true;
+    for (let i = 0; i < paths.length; i += 100) {
+        const chunk = paths.slice(i, i + 100);
+        const diff = runGit(['diff', '--quiet', branchName, baseRef, '--', ...chunk], mainWorktreePath);
+        if (!diff.ok)
+            return false;
+    }
+    return true;
+}
 /**
  * Removes worktrees whose branch has been fully merged into the current branch
  * (typically master/main after a merge). Also removes brainclaw-managed
@@ -931,6 +1039,12 @@ export function worktreeHasOnlyBirthNoise(statusZStdout) {
  * (orphan dirs left behind by force-deleted branches).
  *
  * Safe by default: skips worktrees with uncommitted changes unless `force` is set.
+ *
+ * trp#926 — Merged detection is a UNION of two signals:
+ *   - ancestry (`git branch --merged HEAD`): catches fast-forward / merge-commit;
+ *   - content (`git cherry HEAD <branch>`, patch-id): catches squash merges,
+ *     which is GitHub's default merge strategy on this repo and previously left
+ *     every squashed lane un-GC-able forever.
  */
 export function cleanMergedWorktrees(mainWorktreePath, options = {}) {
     const result = { removed: [], skipped: [], pruned: false };
@@ -949,7 +1063,12 @@ export function cleanMergedWorktrees(mainWorktreePath, options = {}) {
     for (const wt of worktrees) {
         if (wt.is_main)
             continue;
-        const isMerged = mergedBranches.has(wt.branch);
+        // trp#926 — a lane's branch is "merged" if EITHER git says its commits are
+        // ancestors of HEAD (fast-forward / merge-commit) OR every commit's patch
+        // is already on HEAD (squash-merge, catching GitHub's default strategy).
+        // Without the content probe, squashed lanes accumulate forever.
+        const isMerged = mergedBranches.has(wt.branch)
+            || isBranchMergedByContent(mainWorktreePath, wt.branch, 'HEAD');
         if (!isMerged) {
             continue;
         }
@@ -1054,9 +1173,14 @@ export function gcWorktreeIfHarvested(mainWorktreePath, worktreePath, options =
         }
         const ancestor = runGit(['merge-base', '--is-ancestor', laneHead.stdout.trim(), mainHead.stdout.trim()], mainWorktreePath);
         // exit 0 = ancestor (safe). Non-zero = not an ancestor OR a git error — both
-        // mean "cannot prove integrated", so keep.
-        if (!ancestor.ok)
+        // mean "cannot prove integrated via ancestry". trp#926 — fall back to the
+        // content probe (patch-id): a squash-merged lane is not an ancestor but is
+        // fully integrated, and previously the GC kept it forever. Ancestry OR
+        // content, either signal is enough; a failed content probe still keeps the
+        // worktree (isBranchMergedByContent returns false on git failure).
+        if (!ancestor.ok && branch && !isBranchMergedByContent(mainWorktreePath, branch, mainHead.stdout.trim())) {
             return out(false, 'lane branch has un-integrated commits (or unverifiable)', branch);
+        }
     }
     try {
         removeWorktree(mainWorktreePath, worktreePath, { force: true });

package/dist/facts.js

@@ -1,8 +1,8 @@
 // Generated by scripts/emit-site-facts.mjs at build time. Do not edit manually.
-// Source: brainclaw v1.12.0 on 2026-06-27T13:47:04.254Z
+// Source: brainclaw v1.13.0 on 2026-07-04T20:40:39.712Z
 export const FACTS = {
-  "version": "1.12.0",
-  "generated_at": "2026-06-27T13:47:04.254Z",
+  "version": "1.13.0",
+  "generated_at": "2026-07-04T20:40:39.712Z",
   "tools": {
     "count": 67,
     "published_count": 66,
@@ -469,6 +469,39 @@ export const FACTS = {
         "max_concurrent_tasks": 1
       }
     ]
+  },
+  "bench": {
+    "schema": "brainclaw.bench.v1",
+    "generated_at": "2026-07-04T20:40:37.627Z",
+    "node_version": "v24.18.0",
+    "platform": "linux-x64",
+    "repeats": 3,
+    "scenarios": [
+      {
+        "name": "cold_onboard",
+        "volume": "empty",
+        "description": "fresh machine → init → first useful context. Baseline for time-to-first-value.",
+        "duration_ms_median": 78,
+        "payload_chars_median": 1650,
+        "payload_tokens_est_median": 413
+      },
+      {
+        "name": "warm_work",
+        "volume": "medium",
+        "description": "bclaw_work consult over a real-shaped store (~200 plans / 500 handoffs / 450 claims).",
+        "duration_ms_median": 130,
+        "payload_chars_median": 2626,
+        "payload_tokens_est_median": 657
+      },
+      {
+        "name": "first_edit",
+        "volume": "medium",
+        "description": "code_find + code_brief on the fresh-agent path (missing index, first touch).",
+        "duration_ms_median": 8,
+        "payload_chars_median": 442,
+        "payload_tokens_est_median": 111
+      }
+    ]
   }
 }
 export default FACTS

package/dist/facts.json

@@ -1,6 +1,6 @@
 {
-  "version": "1.12.0",
-  "generated_at": "2026-06-27T13:47:04.254Z",
+  "version": "1.13.0",
+  "generated_at": "2026-07-04T20:40:39.712Z",
   "tools": {
     "count": 67,
     "published_count": 66,
@@ -467,5 +467,38 @@
         "max_concurrent_tasks": 1
       }
     ]
+  },
+  "bench": {
+    "schema": "brainclaw.bench.v1",
+    "generated_at": "2026-07-04T20:40:37.627Z",
+    "node_version": "v24.18.0",
+    "platform": "linux-x64",
+    "repeats": 3,
+    "scenarios": [
+      {
+        "name": "cold_onboard",
+        "volume": "empty",
+        "description": "fresh machine → init → first useful context. Baseline for time-to-first-value.",
+        "duration_ms_median": 78,
+        "payload_chars_median": 1650,
+        "payload_tokens_est_median": 413
+      },
+      {
+        "name": "warm_work",
+        "volume": "medium",
+        "description": "bclaw_work consult over a real-shaped store (~200 plans / 500 handoffs / 450 claims).",
+        "duration_ms_median": 130,
+        "payload_chars_median": 2626,
+        "payload_tokens_est_median": 657
+      },
+      {
+        "name": "first_edit",
+        "volume": "medium",
+        "description": "code_find + code_brief on the fresh-agent path (missing index, first touch).",
+        "duration_ms_median": 8,
+        "payload_chars_median": 442,
+        "payload_tokens_est_median": 111
+      }
+    ]
   }
 }

package/docs/mcp-schema-changelog.md

@@ -122,8 +122,13 @@ will still succeed. A follow-up PR will strip the dead handler code.
   changelog records the published MCP surface fingerprint. When a tool
   name, tier, category, or input schema changes, the test fails until
   this section is updated.
-- MCP public surface fingerprint: `sha256:188d2eba8828e4fe`
-  (updated 2026-06-24 for 1.11.0: `bclaw_move` added (pln#595) AND a `cascade`
+- MCP public surface fingerprint: `sha256:2b0dfbd62acd71b7`
+  (updated 2026-07-04 for trp#928: explicit `coordinator_override` boolean added
+  to `bclaw_release_claim` and `bclaw_transition` input schemas — the coordinator
+  path to release/stale a non-owned claim is now opt-in and audited rather than
+  auto-derived from trust level. Additive: no tool added, removed, or renamed; no
+  required argument changed. Previous: `sha256:188d2eba8828e4fe`
+  updated 2026-06-24 for 1.11.0: `bclaw_move` added (pln#595) AND a `cascade`
   boolean added to `bclaw_code_refresh` / `bclaw_code_status` (DGX Finding 2).
   Additive: one new tool; nothing removed or renamed; no required argument changed.
   Supersedes the per-branch interim hashes sha256:dffcc868ae90e013 and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brainclaw",
-  "version": "1.12.0",
+  "version": "1.13.0",
   "description": "Shared project memory for humans and coding agents.",
   "type": "module",
   "repository": {
@@ -42,8 +42,8 @@
     "clean:dist-test": "node scripts/clean-build.mjs dist-test",
     "build": "npm run build:cli && node scripts/build-vsix.mjs --optional",
     "build:cli": "npm run clean:dist && tsc && node scripts/copy-default-profiles.mjs && node scripts/copy-code-map-wasm.mjs",
-    "build:release": "npm run build:cli && node scripts/emit-site-facts.mjs && node scripts/build-vsix.mjs",
-    "emit:facts": "npm run build:cli && node scripts/emit-site-facts.mjs",
+    "build:release": "npm run emit:facts && node scripts/build-vsix.mjs",
+    "emit:facts": "npm run bench && node scripts/emit-site-facts.mjs",
     "dev": "npm run clean:dist && tsc && node scripts/copy-default-profiles.mjs && node dist/cli.js",
     "dev:mcp": "tsc && node scripts/copy-default-profiles.mjs",
     "build:mcp-schemas": "npm run clean:dist && tsc && node scripts/build-mcp-schemas.mjs",
@@ -60,6 +60,8 @@
     "test:cross": "npm run build:test && node scripts/test-cross.mjs default",
     "test:coverage": "npm run build:test && c8 --all --src dist-test/src --reporter=text-summary --reporter=lcov --exclude=dist-test/tests/** --exclude=dist-test/scripts/** node scripts/run-tests.mjs default",
     "test:coverage:check": "npm run build:test && c8 --all --check-coverage --lines 55 --functions 60 --branches 65 --statements 55 --src dist-test/src --reporter=text-summary --exclude=dist-test/tests/** --exclude=dist-test/scripts/** node scripts/run-tests.mjs default",
+    "bench": "npm run build:test && node scripts/bench.mjs",
+    "bench:check": "node scripts/bench-check.mjs",
     "prepublishOnly": "npm run build:release && npm run pack:check"
   },
   "keywords": [
@@ -79,7 +81,7 @@
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
-    "@types/node": "^25.9.3",
+    "@types/node": "^26.0.1",
     "ajv": "^8.20.0",
     "c8": "^11.0.0",
     "eslint": "^10.5.0",