brainclaw 1.12.0 → 1.14.0

package/dist/core/worktree.js

@@ -229,6 +229,45 @@ function runGit(args, cwd, timeoutMs = GIT_QUERY_TIMEOUT_MS) {
         stderr: result.stderr ?? '',
     };
 }
+/**
+ * Resolve the real git worktree root for `cwd` (pln#614). On an IN-TREE project
+ * — a project dir that sits inside a larger repo (monorepo), where the git root
+ * is an ancestor, not the project dir itself — `git worktree add` MUST run from
+ * the true toplevel, and the per-project worktree hash MUST be derived from it.
+ *
+ * The bug (trp_28025248, cross-machine dogfooding 1.13.0): the assign/review
+ * claim path passed the project cwd straight to createWorktree, so `git worktree
+ * add` ran from the project dir and — with an empty `.git` left by the embedded
+ * init — failed with "not a git repository", while the ideation path (which
+ * resolved the toplevel) worked. resolveGitToplevel makes both paths agree.
+ *
+ * Falls back to the input cwd when `git rev-parse` cannot resolve a toplevel
+ * (not a repo, git absent) so non-git callers and tests keep their behaviour.
+ */
+export function resolveGitToplevel(cwd) {
+    // Codex review of PR #49 (HIGH): a stale/empty `.git` INSIDE the project dir
+    // (left by the embedded init — the exact leazzy case) makes `git rev-parse
+    // --show-toplevel` FAIL at that level instead of discovering the parent repo:
+    // git stops at the invalid gitdir. A plain fallback-to-cwd would then still
+    // run from the project dir and hash the subdir — the bug unfixed. So on
+    // failure we walk UP and retry from each ancestor, skipping past the invalid
+    // nested gitdir until a real toplevel is found; only a truly non-git tree
+    // falls back to the input cwd.
+    let dir = path.resolve(cwd);
+    for (let depth = 0; depth < 64; depth += 1) {
+        const result = runGit(['rev-parse', '--show-toplevel'], dir);
+        if (result.ok) {
+            const top = result.stdout.trim();
+            if (top)
+                return path.resolve(top);
+        }
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            break; // filesystem root — not inside any repo
+        dir = parent;
+    }
+    return cwd;
+}
 /**
  * Returns true if the given path is a bare git repository.
  * Bare repos have no working tree, so worktree add is not applicable.
@@ -444,6 +483,12 @@ export function findWorktreePathForBranch(worktrees, branchName) {
  * Returns the absolute path to the newly created worktree.
  */
 export function createWorktree(mainWorktreePath, branchName, options = {}) {
+    // pln#614: resolve the true git toplevel first, so an in-tree project (project
+    // dir ≠ git root) creates its worktree from the real repo root — `git worktree
+    // add` runs there, and the per-project worktree hash (resolveWorktreePath) is
+    // derived from it, matching the ideation path. All git commands + the hash
+    // below use this resolved root rather than the raw project cwd.
+    mainWorktreePath = resolveGitToplevel(mainWorktreePath);
     const symlinkWarnings = [];
     const trySymlinkSharedPath = (entryName) => {
         const sourcePath = path.join(mainWorktreePath, entryName);
@@ -582,6 +627,16 @@ export function createWorktree(mainWorktreePath, branchName, options = {}) {
     if (fs.existsSync(mainGitignorePath)) {
         fs.copyFileSync(mainGitignorePath, targetGitignorePath);
     }
+    // trp#926 — record the RESOLVED base ref SHA at creation time. base_ref is
+    // usually "HEAD" or a branch name, both of which drift after creation and
+    // are useless for later "how many commits did the worker add?" comparisons.
+    // The resolved SHA is the stable anchor: `${base_ref_sha}..HEAD` on the lane
+    // deterministically counts the worker's contribution even as master advances.
+    // Best-effort — an unresolvable base_ref simply omits the field.
+    const baseRefSha = (() => {
+        const rev = runGit(['rev-parse', baseRef], mainWorktreePath);
+        return rev.ok ? rev.stdout.trim() : undefined;
+    })();
     // Write brainclaw metadata sidecar inside the worktree
     const meta = {
         session_id: options.sessionId,
@@ -590,6 +645,7 @@ export function createWorktree(mainWorktreePath, branchName, options = {}) {
         created_at: new Date().toISOString(),
         main_worktree_path: mainWorktreePath,
         base_ref: baseRef,
+        ...(baseRefSha ? { base_ref_sha: baseRefSha } : {}),
         reset_existing_branch: options.resetExistingBranch === true,
         git_advice: 'git add ONLY specific files, NEVER git add -A.',
         // pln#523: surface any shared-path link failures (e.g. node_modules junction
@@ -827,25 +883,63 @@ export function safeRemoveWorktreeDir(dirPath) {
     catch { /* best effort */ }
 }
 /**
- * pln#498 — Detach top-level symlinks/junctions from a worktree before any
- * recursive removal. On Windows, `git worktree remove` performs its own
- * recursive rm and historically (git ≤ 2.38) followed NTFS junctions into
- * the main repo, wiping `node_modules`. Unlinking the junction entries
- * first leaves git only regular files/dirs to walk.
+ * Depth cap for detachWorktreeJunctions' recursive walk. 8 covers realistic
+ * monorepo trees (apps/<pkg>/packages/<pkg>/node_modules, pnpm nested links)
+ * while keeping the walk bounded on pathological structures. Hitting the cap
+ * is a hard failure: continuing to `git worktree remove` after an incomplete
+ * scan would re-open the junction-follow wipe class. .git is skipped outright
+ * — it never contains user junctions and can be very deep.
+ */
+const JUNCTION_SCAN_MAX_DEPTH = 8;
+/**
+ * pln#498 + trp#926 (2026-07-03 incident) — Detach ALL symlinks/junctions from
+ * a worktree before any recursive removal. On Windows, `git worktree remove`
+ * performs its own recursive rm and historically (git ≤ 2.38) followed NTFS
+ * junctions into the main repo, wiping `node_modules`. Unlinking every
+ * junction entry first leaves git only regular files/dirs to walk.
+ *
+ * Historically this only inspected top-level entries — that covered the
+ * classic single-stack shared `node_modules` case but MISSED:
+ *   - monorepo per-package junctions created by pln#523
+ *     (apps/<pkg>/node_modules, packages/<pkg>/node_modules);
+ *   - operator- or worker-created manual junctions at nested paths.
+ * The 2026-07-03 incident (node_modules racine rasé via the auto-junction)
+ * was a recurrence of the pln#498 class, extended one level of nesting.
  *
- * Only top-level entries are inspected — that's where shared paths are
- * symlinked at worktree birth (see createWorktree.trySymlinkSharedPath).
+ * The recursion NEVER descends into a symlink (lstat + unlink at the entry
+ * itself), so it cannot follow a junction into the main repo. `.git/` is
+ * skipped entirely — git manages its own state and it never holds user
+ * junctions. Depth is capped defensively at JUNCTION_SCAN_MAX_DEPTH; hitting
+ * the cap aborts removal rather than silently leaving deeper links in place.
  */
 export function detachWorktreeJunctions(worktreePath) {
+    if (!fs.existsSync(worktreePath))
+        return;
+    const failures = [];
+    detachJunctionsRecursively(worktreePath, 0, failures);
+    if (failures.length > 0) {
+        throw new Error(`could not safely detach worktree junctions: ${failures.join('; ')}`);
+    }
+}
+function detachJunctionsRecursively(dir, depth, failures) {
+    if (depth > JUNCTION_SCAN_MAX_DEPTH) {
+        failures.push(`scan depth exceeded at ${dir}`);
+        return;
+    }
     let entries;
     try {
-        entries = fs.readdirSync(worktreePath, { withFileTypes: true });
+        entries = fs.readdirSync(dir, { withFileTypes: true });
     }
-    catch {
-        return; // worktree already gone or unreadable
+    catch (err) {
+        failures.push(`could not read ${dir}: ${err.message}`);
+        return;
     }
     for (const entry of entries) {
-        const child = path.join(worktreePath, entry.name);
+        // `.git` is a file (linked worktree pointer) at the worktree root or a
+        // real dir in the main repo — either way, do not walk it.
+        if (entry.name === '.git')
+            continue;
+        const child = path.join(dir, entry.name);
         let stat;
         try {
             stat = fs.lstatSync(child);
@@ -853,16 +947,24 @@ export function detachWorktreeJunctions(worktreePath) {
         catch {
             continue;
         }
-        if (!stat.isSymbolicLink())
-            continue;
-        try {
-            fs.unlinkSync(child);
-        }
-        catch {
+        if (stat.isSymbolicLink()) {
+            // Unlink the junction. Do NOT descend into it (that would follow the
+            // link back into the main repo — the exact class we're preventing).
             try {
-                fs.rmdirSync(child);
+                fs.unlinkSync(child);
             }
-            catch { /* best effort */ }
+            catch (unlinkErr) {
+                try {
+                    fs.rmdirSync(child);
+                }
+                catch (rmdirErr) {
+                    failures.push(`could not detach link ${child}: unlink=${unlinkErr.message}; rmdir=${rmdirErr.message}`);
+                }
+            }
+            continue;
+        }
+        if (stat.isDirectory()) {
+            detachJunctionsRecursively(child, depth + 1, failures);
         }
     }
 }
@@ -924,6 +1026,57 @@ export function worktreeHasOnlyBirthNoise(statusZStdout) {
             || isSystemDirtyPath(norm);
     });
 }
+/**
+ * trp#926 (squash-aware GC) — True when every commit on `branch` that is not
+ * an ancestor of `baseRef` has a patch-equivalent commit ALREADY on `baseRef`.
+ *
+ * `git branch --merged HEAD` and `merge-base --is-ancestor` are ancestry-only:
+ * a squash-merge on GitHub creates a NEW commit on master whose ancestry does
+ * not include the lane commits, so an ancestry probe returns "not merged" and
+ * the GC keeps the worktree forever. `git cherry <base> <branch>` uses
+ * patch-id equivalence — the same signal GitHub itself uses to say "this PR is
+ * merged". Output is one line per commit in `base..branch`:
+ *   `+ <sha>` = patch NOT yet on base (a real un-integrated commit)
+ *   `- <sha>` = patch already on base (via squash / cherry-pick / rebase)
+ * The branch is "merged by content" iff there are no `+` lines. An empty
+ * output (no commits ahead of base) is also merged.
+ *
+ * Returns `false` on any git failure — a probe that cannot prove merged must
+ * NEVER lie "yes" and cause a keep-me worktree to be GC'd. Callers combine
+ * this with ancestry ('git branch --merged') so both signals contribute.
+ */
+export function isBranchMergedByContent(mainWorktreePath, branchName, baseRef = 'HEAD') {
+    const cherry = runGit(['cherry', baseRef, branchName], mainWorktreePath);
+    if (!cherry.ok)
+        return false;
+    const lines = cherry.stdout.split(/\r?\n/).map((l) => l.trim()).filter(Boolean);
+    if (lines.length === 0)
+        return true; // no commits ahead of base → fully merged
+    // A `+` line means "patch not on base" — one is enough to disqualify.
+    if (!lines.some((l) => l.startsWith('+ ')))
+        return true;
+    // Multi-commit squash merges often do not produce per-commit patch-id
+    // matches: the squash commit's aggregate patch differs from each individual
+    // branch commit. As a second, still content-only signal, compare the final
+    // content of files changed by the branch. If every branch-touched path now
+    // matches baseRef, removing the worktree cannot drop unique file content.
+    const mergeBase = runGit(['merge-base', baseRef, branchName], mainWorktreePath);
+    if (!mergeBase.ok || !mergeBase.stdout.trim())
+        return false;
+    const changed = runGit(['diff', '--name-only', '-z', mergeBase.stdout.trim(), branchName], mainWorktreePath);
+    if (!changed.ok)
+        return false;
+    const paths = changed.stdout.split('\0').filter(Boolean);
+    if (paths.length === 0)
+        return true;
+    for (let i = 0; i < paths.length; i += 100) {
+        const chunk = paths.slice(i, i + 100);
+        const diff = runGit(['diff', '--quiet', branchName, baseRef, '--', ...chunk], mainWorktreePath);
+        if (!diff.ok)
+            return false;
+    }
+    return true;
+}
 /**
  * Removes worktrees whose branch has been fully merged into the current branch
  * (typically master/main after a merge). Also removes brainclaw-managed
@@ -931,9 +1084,19 @@ export function worktreeHasOnlyBirthNoise(statusZStdout) {
  * (orphan dirs left behind by force-deleted branches).
  *
  * Safe by default: skips worktrees with uncommitted changes unless `force` is set.
+ *
+ * trp#926 — Merged detection is a UNION of two signals:
+ *   - ancestry (`git branch --merged HEAD`): catches fast-forward / merge-commit;
+ *   - content (`git cherry HEAD <branch>`, patch-id): catches squash merges,
+ *     which is GitHub's default merge strategy on this repo and previously left
+ *     every squashed lane un-GC-able forever.
  */
 export function cleanMergedWorktrees(mainWorktreePath, options = {}) {
     const result = { removed: [], skipped: [], pruned: false };
+    // pln#614: resolve the toplevel so an in-tree project scans the same
+    // per-project worktree hash createWorktree wrote under (and runs git from the
+    // real repo root).
+    mainWorktreePath = resolveGitToplevel(mainWorktreePath);
     // First prune stale git worktree admin entries
     pruneWorktrees(mainWorktreePath);
     result.pruned = true;
@@ -949,7 +1112,12 @@ export function cleanMergedWorktrees(mainWorktreePath, options = {}) {
     for (const wt of worktrees) {
         if (wt.is_main)
             continue;
-        const isMerged = mergedBranches.has(wt.branch);
+        // trp#926 — a lane's branch is "merged" if EITHER git says its commits are
+        // ancestors of HEAD (fast-forward / merge-commit) OR every commit's patch
+        // is already on HEAD (squash-merge, catching GitHub's default strategy).
+        // Without the content probe, squashed lanes accumulate forever.
+        const isMerged = mergedBranches.has(wt.branch)
+            || isBranchMergedByContent(mainWorktreePath, wt.branch, 'HEAD');
         if (!isMerged) {
             continue;
         }
@@ -1028,6 +1196,9 @@ export function gcWorktreeIfHarvested(mainWorktreePath, worktreePath, options =
     });
     if (!worktreePath || !fs.existsSync(worktreePath))
         return out(false, 'already gone');
+    // pln#614: the merge-base / patch-id probes below run from the main repo — an
+    // in-tree project dir (empty .git) would fail them; resolve the real toplevel.
+    mainWorktreePath = resolveGitToplevel(mainWorktreePath);
     if (workerLooksAlive(worktreePath, options.livenessWindowMs ?? WORKTREE_GC_LIVENESS_WINDOW_MS)) {
         return out(false, 'worker still active (recent heartbeat)');
     }
@@ -1054,9 +1225,14 @@ export function gcWorktreeIfHarvested(mainWorktreePath, worktreePath, options =
         }
         const ancestor = runGit(['merge-base', '--is-ancestor', laneHead.stdout.trim(), mainHead.stdout.trim()], mainWorktreePath);
         // exit 0 = ancestor (safe). Non-zero = not an ancestor OR a git error — both
-        // mean "cannot prove integrated", so keep.
-        if (!ancestor.ok)
+        // mean "cannot prove integrated via ancestry". trp#926 — fall back to the
+        // content probe (patch-id): a squash-merged lane is not an ancestor but is
+        // fully integrated, and previously the GC kept it forever. Ancestry OR
+        // content, either signal is enough; a failed content probe still keeps the
+        // worktree (isBranchMergedByContent returns false on git failure).
+        if (!ancestor.ok && branch && !isBranchMergedByContent(mainWorktreePath, branch, mainHead.stdout.trim())) {
             return out(false, 'lane branch has un-integrated commits (or unverifiable)', branch);
+        }
     }
     try {
         removeWorktree(mainWorktreePath, worktreePath, { force: true });

package/dist/facts.js

@@ -1,8 +1,8 @@
 // Generated by scripts/emit-site-facts.mjs at build time. Do not edit manually.
-// Source: brainclaw v1.12.0 on 2026-06-27T13:47:04.254Z
+// Source: brainclaw v1.14.0 on 2026-07-05T13:38:40.276Z
 export const FACTS = {
-  "version": "1.12.0",
-  "generated_at": "2026-06-27T13:47:04.254Z",
+  "version": "1.14.0",
+  "generated_at": "2026-07-05T13:38:40.276Z",
   "tools": {
     "count": 67,
     "published_count": 66,
@@ -469,6 +469,39 @@ export const FACTS = {
         "max_concurrent_tasks": 1
       }
     ]
+  },
+  "bench": {
+    "schema": "brainclaw.bench.v1",
+    "generated_at": "2026-07-05T13:38:38.216Z",
+    "node_version": "v24.18.0",
+    "platform": "linux-x64",
+    "repeats": 3,
+    "scenarios": [
+      {
+        "name": "cold_onboard",
+        "volume": "empty",
+        "description": "fresh machine → init → first useful context. Baseline for time-to-first-value.",
+        "duration_ms_median": 72,
+        "payload_chars_median": 1650,
+        "payload_tokens_est_median": 413
+      },
+      {
+        "name": "warm_work",
+        "volume": "medium",
+        "description": "bclaw_work consult over a real-shaped store (~200 plans / 500 handoffs / 450 claims).",
+        "duration_ms_median": 126,
+        "payload_chars_median": 2626,
+        "payload_tokens_est_median": 657
+      },
+      {
+        "name": "first_edit",
+        "volume": "medium",
+        "description": "code_find + code_brief on the fresh-agent path (missing index, first touch).",
+        "duration_ms_median": 8,
+        "payload_chars_median": 442,
+        "payload_tokens_est_median": 111
+      }
+    ]
   }
 }
 export default FACTS

package/dist/facts.json

@@ -1,6 +1,6 @@
 {
-  "version": "1.12.0",
-  "generated_at": "2026-06-27T13:47:04.254Z",
+  "version": "1.14.0",
+  "generated_at": "2026-07-05T13:38:40.276Z",
   "tools": {
     "count": 67,
     "published_count": 66,
@@ -467,5 +467,38 @@
         "max_concurrent_tasks": 1
       }
     ]
+  },
+  "bench": {
+    "schema": "brainclaw.bench.v1",
+    "generated_at": "2026-07-05T13:38:38.216Z",
+    "node_version": "v24.18.0",
+    "platform": "linux-x64",
+    "repeats": 3,
+    "scenarios": [
+      {
+        "name": "cold_onboard",
+        "volume": "empty",
+        "description": "fresh machine → init → first useful context. Baseline for time-to-first-value.",
+        "duration_ms_median": 72,
+        "payload_chars_median": 1650,
+        "payload_tokens_est_median": 413
+      },
+      {
+        "name": "warm_work",
+        "volume": "medium",
+        "description": "bclaw_work consult over a real-shaped store (~200 plans / 500 handoffs / 450 claims).",
+        "duration_ms_median": 126,
+        "payload_chars_median": 2626,
+        "payload_tokens_est_median": 657
+      },
+      {
+        "name": "first_edit",
+        "volume": "medium",
+        "description": "code_find + code_brief on the fresh-agent path (missing index, first touch).",
+        "duration_ms_median": 8,
+        "payload_chars_median": 442,
+        "payload_tokens_est_median": 111
+      }
+    ]
   }
 }