gitnexus 1.6.12-rc.10 → 1.6.12-rc.11

package/dist/cli/analyze-config.d.ts

@@ -41,8 +41,8 @@ export declare class GitNexusRcError extends Error {
 }
 /**
  * Validate a user-supplied branch name (from CLI or `.gitnexusrc`). Returns the
- * trimmed name or throws {@link GitNexusRcError}. Rules live in
- * `core/git-ref.ts`; this wrapper keeps the CLI / `.gitnexusrc` error type.
+ * trimmed name or throws {@link GitNexusRcError}. Conservative but accepts the
+ * shapes real branches use (`feature/foo-bar`, `release/1.2`, `develop`).
  */
 export declare function validateBranchName(value: string, source: string): string;
 /**

package/dist/cli/analyze-config.js

@@ -30,10 +30,11 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { readRepoControlFile } from '../config/repo-control-file.js';
-import { InvalidBranchError, validateBranchName as validateBranchNameCore, } from '../core/git-ref.js';
 export const GITNEXUS_RC_FILENAME = '.gitnexusrc';
 /** Final fallback when no branch is configured or detectable. */
 export const DEFAULT_BRANCH_FALLBACK = 'main';
+/** Git refs longer than this are almost certainly a mistake / injection attempt. */
+const BRANCH_MAX_LENGTH = 255;
 /**
  * Thrown for any `.gitnexusrc` problem (missing-file is NOT an error — it
  * returns `undefined`). The message is user-facing and names the file so the
@@ -125,19 +126,41 @@ const assertNoHiddenChars = (value, source) => {
 };
 /**
  * Validate a user-supplied branch name (from CLI or `.gitnexusrc`). Returns the
- * trimmed name or throws {@link GitNexusRcError}. Rules live in
- * `core/git-ref.ts`; this wrapper keeps the CLI / `.gitnexusrc` error type.
+ * trimmed name or throws {@link GitNexusRcError}. Conservative but accepts the
+ * shapes real branches use (`feature/foo-bar`, `release/1.2`, `develop`).
  */
 export function validateBranchName(value, source) {
-    try {
-        return validateBranchNameCore(value, source);
+    const trimmed = value.trim();
+    if (!trimmed) {
+        throw new GitNexusRcError(`${source}: branch name must not be empty.`);
     }
-    catch (err) {
-        if (err instanceof InvalidBranchError) {
-            throw new GitNexusRcError(err.message);
-        }
-        throw err;
+    if (trimmed.length > BRANCH_MAX_LENGTH) {
+        throw new GitNexusRcError(`${source}: branch name is too long (max ${BRANCH_MAX_LENGTH}).`);
+    }
+    assertNoHiddenChars(trimmed, source);
+    if (/\s/.test(trimmed)) {
+        throw new GitNexusRcError(`${source}: branch name must not contain whitespace.`);
+    }
+    // git ref-name rules (subset): reject characters git itself forbids in refs.
+    if (/[~^:?*[\\]/.test(trimmed)) {
+        throw new GitNexusRcError(`${source}: branch name contains characters not allowed in a git ref (~ ^ : ? * [ \\).`);
+    }
+    if (trimmed.startsWith('-')) {
+        throw new GitNexusRcError(`${source}: branch name must not start with "-".`);
+    }
+    if (trimmed.includes('..')) {
+        throw new GitNexusRcError(`${source}: branch name must not contain "..".`);
+    }
+    // Git permits a backtick in a ref, but the branch is embedded inside a
+    // Markdown inline-code span in the generated AGENTS.md/CLAUDE.md regression
+    // example, where a backtick would close the span early and let the rest of
+    // the template render as instruction text. Reject it at this single
+    // chokepoint so all three tiers (CLI flag, .gitnexusrc, auto-detect via
+    // sanitizeDetectedBranch) are covered (#1996 tri-review P1).
+    if (trimmed.includes('`')) {
+        throw new GitNexusRcError(`${source}: branch name must not contain a backtick (it would break the generated Markdown).`);
     }
+    return trimmed;
 }
 /**
  * Best-effort validation for an auto-detected branch (from git). Never throws —

package/dist/server/analyze-job.d.ts

@@ -53,13 +53,6 @@ export interface AnalyzeJob {
     repoUrl?: string;
     repoPath?: string;
     repoName?: string;
-    /**
-     * Index-branch selector this job was started with, part of the job's dedup
-     * identity. A repo is not "the same repo" for reuse purposes when a different
-     * branch was asked for — reusing across branches would hand the caller a 202
-     * for a job indexing something else.
-     */
-    branch?: string;
     progress: AnalyzeJobProgress;
     error?: string;
     /** Set only when a terminal `failed` job still persisted usable work. */
@@ -77,21 +70,10 @@ export declare class JobManager {
     private emitter;
     private cleanupTimer;
     constructor();
-    /**
-     * Create a new job, or return the existing active job for the same repo AND
-     * the same branch.
-     *
-     * Branch is part of the identity deliberately. Deduping on repo alone would
-     * return the in-flight job for branch A to a caller that asked for branch B,
-     * and that caller would read the resulting 202/`complete` as "B is indexed"
-     * — the same silent wrong-branch outcome that made `branch` worth honoring in
-     * the first place. Falling through instead lets the single-slot guard below
-     * reject the request outright, which is a truthful answer.
-     */
+    /** Create a new job, or return existing active job for the same repo. */
     createJob(params: {
         repoUrl?: string;
         repoPath?: string;
-        branch?: string;
     }): AnalyzeJob;
     getJob(id: string): AnalyzeJob | undefined;
     /** Return a snapshot of all tracked jobs for inspection. */

package/dist/server/analyze-job.js

@@ -34,24 +34,14 @@ export class JobManager {
     constructor() {
         this.cleanupTimer = setInterval(() => this.cleanup(), CLEANUP_INTERVAL_MS);
     }
-    /**
-     * Create a new job, or return the existing active job for the same repo AND
-     * the same branch.
-     *
-     * Branch is part of the identity deliberately. Deduping on repo alone would
-     * return the in-flight job for branch A to a caller that asked for branch B,
-     * and that caller would read the resulting 202/`complete` as "B is indexed"
-     * — the same silent wrong-branch outcome that made `branch` worth honoring in
-     * the first place. Falling through instead lets the single-slot guard below
-     * reject the request outright, which is a truthful answer.
-     */
+    /** Create a new job, or return existing active job for the same repo. */
     createJob(params) {
-        // Dedup: return existing active job for the same repo (by URL or path) and branch
+        // Dedup: return existing active job for the same repo (by URL or path)
         for (const job of this.jobs.values()) {
             if (!this.isTerminal(job.status)) {
                 const isSameRepo = (params.repoUrl && job.repoUrl === params.repoUrl) ||
                     (params.repoPath && job.repoPath === params.repoPath);
-                if (isSameRepo && job.branch === params.branch) {
+                if (isSameRepo) {
                     return job;
                 }
             }
@@ -67,7 +57,6 @@ export class JobManager {
             status: 'queued',
             repoUrl: params.repoUrl,
             repoPath: params.repoPath,
-            branch: params.branch,
             progress: { phase: 'queued', percent: 0, message: 'Waiting to start...' },
             startedAt: Date.now(),
             retryCount: 0,

package/dist/server/analyze-launch.d.ts

@@ -31,20 +31,6 @@ export interface LaunchOptions {
     springActuatorPath?: string;
     asyncApiSpecPath?: string;
     registryName?: string;
-    /**
-     * Index-branch selector, forwarded to `AnalyzeOptions.branch`.
-     *
-     * Setting it does not by itself mean a `branches/<slug>/` sub-directory:
-     * `resolveBranchPlacement` (storage/branch-index.ts) keeps the run on the flat
-     * slot when that slot has no recorded owner, or when its owner already IS this
-     * label. Only a label that differs from the flat slot's owner gets its own
-     * sub-directory.
-     *
-     * The caller is responsible for having the branch checked out —
-     * `resolveWriteTarget` in core refuses a label that disagrees with the working
-     * tree, which is what keeps one branch's content out of another's slot (#2106).
-     */
-    branch?: string;
 }
 export declare function createLaunchAnalysisWorker(deps: LaunchDeps): (job: {
     id: string;

package/dist/server/analyze-launch.js

@@ -15,7 +15,6 @@ import { fork } from 'child_process';
 import { fileURLToPath, pathToFileURL } from 'url';
 import { createRequire } from 'node:module';
 import { canonicalizePath, getStoragePath, INDEX_METADATA_FILE, listRegisteredRepos, registryPathEquals, } from '../storage/repo-manager.js';
-import { BRANCHES_DIR, branchSlug } from '../storage/branch-index.js';
 import { logger } from '../core/logger.js';
 import { autoHeapCapMb } from '../core/ingestion/utils/effective-ram.js';
 import { isTerminalJobStatus } from './analyze-job.js';
@@ -33,6 +32,17 @@ const MAX_WORKER_RETRIES = 2;
  */
 const FINALIZE_SETTLE_TIMEOUT_MS = 60_000;
 const FINALIZE_SETTLE_POLL_MS = 200;
+/**
+ * Resolve once the analyzed repo's index is settled at `storagePath`: the
+ * LadybugDB file and metadata both exist AND were (re)written by THIS job
+ * (mtime >= jobStartMs — bare existence is not enough, a re-analysis leaves
+ * the previous index in place while it works), and no transient WAL/shadow/
+ * checkpoint sidecars remain (the worker's native close has finished).
+ *
+ * Never rejects. Timing out logs and proceeds (pre-gate behavior) rather
+ * than failing a job whose analysis genuinely succeeded — e.g. a no-op
+ * non-force analyze legitimately rewrites nothing.
+ */
 /**
  * Look up the analyzed repo's registered storage path. The request's
  * user-provided path is used only as a comparison key; the filesystem probes
@@ -46,36 +56,7 @@ const registeredStoragePath = async (targetPath) => {
     const entry = entries.find((e) => registryPathEquals(canonicalizePath(e.path), target));
     return entry?.storagePath ?? null;
 };
-/**
- * Resolve the directory this run's index actually landed in.
- *
- * `registerRepo` always records the FLAT `.gitnexus` as `entry.storagePath`,
- * but a pinned `--branch` run whose label differs from the flat slot's owner
- * writes `lbug`/`gitnexus.json` under `branches/<slug>/` instead. Probing the
- * flat path for such a run watches files it never rewrote, so the gate below
- * would spin to its timeout on a perfectly successful analysis (#3199 review).
- *
- * `isPrimaryBranch` is the worker's own report of `!placement.branch`, so this
- * follows the placement core actually chose rather than recomputing it here
- * (the flat slot's recorded owner can be adopted mid-run, which would make a
- * recomputation race the thing it is trying to observe).
- */
-const settleDirFor = (registryStoragePath, branch, isPrimaryBranch) => branch && isPrimaryBranch === false
-    ? path.join(registryStoragePath, BRANCHES_DIR, branchSlug(branch))
-    : registryStoragePath;
-/**
- * Resolve once the analyzed repo's index is settled at `storagePath`: the
- * LadybugDB file and metadata both exist AND were (re)written by THIS job
- * (mtime >= jobStartMs — bare existence is not enough, a re-analysis leaves
- * the previous index in place while it works), and no transient WAL/shadow/
- * checkpoint sidecars remain (the worker's native close has finished).
- *
- * Never rejects. Timing out logs and proceeds (pre-gate behavior) rather
- * than failing a job whose analysis genuinely succeeded. The `alreadyUpToDate`
- * fast path never rewrites `lbug` (see `run-analyze.ts`) and skips this wait
- * at the `complete` handler so it does not hold the analyze slot for 60s.
- */
-const waitForSettledIndex = async (targetPath, jobStartMs, branch, isPrimaryBranch) => {
+const waitForSettledIndex = async (targetPath, jobStartMs) => {
     const settled = (storagePath) => {
         try {
             const lbugStat = statSync(path.join(storagePath, 'lbug'));
@@ -93,7 +74,7 @@ const waitForSettledIndex = async (targetPath, jobStartMs, branch, isPrimaryBran
         // Re-resolved each round: the worker registers the repo as part of the
         // finalization this gate is waiting out.
         const storagePath = await registeredStoragePath(targetPath);
-        if (storagePath && settled(settleDirFor(storagePath, branch, isPrimaryBranch)))
+        if (storagePath && settled(storagePath))
             return;
         if (Date.now() > deadline) {
             logger.warn({ targetPath }, 'analyze finalization not visible after timeout; completing job anyway');
@@ -140,13 +121,6 @@ export function createLaunchAnalysisWorker(deps) {
             });
             // Capture stderr for crash diagnostics
             let stderrChunks = '';
-            // A terminal IPC message (`complete`/`error`) means the worker finished
-            // and is now winding down — it calls process.exit(0) ~500ms later. The
-            // job is deliberately still non-terminal at that point because the
-            // finalization gate is running, so without this flag the exit handler
-            // below reads that clean exit as a crash and retries a SUCCESSFUL
-            // analysis, three times, before failing it (#3199 review).
-            let terminalIpcSeen = false;
             child.stderr?.on('data', (chunk) => {
                 stderrChunks += chunk.toString();
                 if (stderrChunks.length > 4096)
@@ -160,8 +134,6 @@ export function createLaunchAnalysisWorker(deps) {
                 const current = jobManager.getJob(job.id);
                 if (!current || isTerminalJobStatus(current.status))
                     return;
-                if (msg.type === 'complete' || msg.type === 'error')
-                    terminalIpcSeen = true;
                 if (msg.type === 'progress') {
                     jobManager.updateJob(job.id, {
                         status: 'analyzing',
@@ -179,16 +151,7 @@ export function createLaunchAnalysisWorker(deps) {
                     // below true in practice: the repo is actually queryable when the
                     // client receives the SSE complete event, and an index this run knows
                     // to be incomplete is never published at all.
-                    //
-                    // alreadyUpToDate never opens LadybugDB and never rewrites `lbug`
-                    // (run-analyze.ts early-return; CLI notes the same). The mtime gate
-                    // would spin the full 60s and hold the single global analyze slot.
-                    // ftsRepairedOnly DOES rewrite `lbug` (initLbug + createSearchFTSIndexes)
-                    // so it still waits.
-                    const settle = msg.result.alreadyUpToDate
-                        ? Promise.resolve()
-                        : waitForSettledIndex(targetPath, jobStartMs, opts.branch, msg.result.isPrimaryBranch);
-                    settle
+                    waitForSettledIndex(targetPath, jobStartMs)
                         .then(() => closeDbHandle())
                         .catch(() => { }) // best-effort: eviction failure must not fail the job
                         .then(() => {
@@ -280,13 +243,6 @@ export function createLaunchAnalysisWorker(deps) {
                 const j = jobManager.getJob(job.id);
                 if (!j || isTerminalJobStatus(j.status))
                     return;
-                // The worker already reported a terminal outcome; this exit is it
-                // winding down, not dying. The job is still non-terminal only because
-                // the finalization gate above has not resolved yet, and that gate owns
-                // the outcome — retrying here would fork a second worker over a
-                // finished, successful analysis.
-                if (terminalIpcSeen)
-                    return;
                 // Worker crashed — attempt retry if under the limit
                 if (j.retryCount < MAX_WORKER_RETRIES) {
                     j.retryCount++;
@@ -327,7 +283,6 @@ export function createLaunchAnalysisWorker(deps) {
                     ...(opts.springActuatorPath ? { springActuatorPath: opts.springActuatorPath } : {}),
                     ...(opts.asyncApiSpecPath ? { asyncApiSpecPath: opts.asyncApiSpecPath } : {}),
                     ...(opts.registryName ? { registryName: opts.registryName } : {}),
-                    ...(opts.branch ? { branch: opts.branch } : {}),
                 },
             });
         };

package/dist/server/analyze-worker-ipc.d.ts

@@ -43,13 +43,12 @@ import type { AnalyzeResult } from '../core/run-analyze.js';
  * ones (e.g. `isPrimaryBranch?`), so an optional non-serializable field could be
  * advertised by the type yet silently dropped by the runtime allowlist.
  *
- * `isPrimaryBranch` IS on the wire, under exactly the rule this comment used to
- * cite for excluding it: a server-side consumer now needs it. `analyze-launch.ts`
- * settles the index the run actually wrote, and only the worker knows whether
- * core chose the flat slot or a `branches/<slug>/` sub-slot. It is a boolean, so
- * it is JSON-safe by construction.
+ * `isPrimaryBranch` is intentionally excluded: the parent (`api.ts`) reads only
+ * `repoName`, and nothing consumes `isPrimaryBranch` across this fork (its CLI
+ * consumer calls `runFullAnalysis` in-process). Add a field here only when a
+ * server-side IPC consumer actually needs it — and only if it is JSON-safe.
  */
-export type AnalyzeResultIpc = Pick<AnalyzeResult, 'repoName' | 'repoPath' | 'stats' | 'alreadyUpToDate' | 'ftsRepairedOnly' | 'ftsSkipped' | 'graphWriteCollapsed' | 'isPrimaryBranch'>;
+export type AnalyzeResultIpc = Pick<AnalyzeResult, 'repoName' | 'repoPath' | 'stats' | 'alreadyUpToDate' | 'ftsRepairedOnly' | 'ftsSkipped' | 'graphWriteCollapsed'>;
 /**
  * Project an `AnalyzeResult` down to the JSON-safe fields the parent consumes,
  * dropping `pipelineResult` (the live `KnowledgeGraph`) and any other field not

package/dist/server/analyze-worker-ipc.js

@@ -16,9 +16,5 @@ export function projectAnalyzeResultForIpc(result) {
         // outcome the CLI does; without it the worker reports a clean `complete`
         // for a run whose edges are mostly missing.
         graphWriteCollapsed: result.graphWriteCollapsed,
-        // Tells the parent which slot this run wrote — the flat `.gitnexus` or a
-        // `branches/<slug>/` sub-slot — so its finalization gate watches the files
-        // this job actually rewrote (#3199 review).
-        isPrimaryBranch: result.isPrimaryBranch,
     };
 }

package/dist/server/api.js

@@ -29,12 +29,8 @@ import { measurePersistedEmbeddingCount, persistedEmbeddingCountOrUndefined, } f
 import { assertString, BadRequestError, createRouteLimiter } from './validation.js';
 import { parseGrepQuery, GREP_TIME_BUDGET_MS } from './grep-params.js';
 import { runGrepScanInWorker } from './grep-scan.js';
-import { analyzeCloneOptions, extractWebRepoName, getCloneDir, cloneOrPull, warnIfInsecureAzureConfig, GITHUB_TOKEN_HOSTS, } from './git-clone.js';
+import { extractWebRepoName, getCloneDir, cloneOrPull, warnIfInsecureAzureConfig, GITHUB_TOKEN_HOSTS, } from './git-clone.js';
 import { createAnalyzeUploadHandler } from './analyze-upload.js';
-// Shared with the CLI's `--branch` (via the analyze-config wrapper) so both
-// entry points accept the same refs. Imported from core — not cli/ — so
-// createServer does not close a cycle with cli/serve.ts.
-import { InvalidBranchError, validateBranchName } from '../core/git-ref.js';
 import { assertServeAuthForPublicOrigin, createPublicOriginMatcher, createWriteOriginGuard, logOriginPolicy, PUBLIC_ORIGIN_ENV, resolveTrustProxy, TRUST_PROXY_ENV, warnIfRateLimitKeysCollapse, } from './middleware.js';
 import { createLaunchAnalysisWorker } from './analyze-launch.js';
 import { UPLOAD_ROOT } from './upload-paths.js';
@@ -1268,7 +1264,7 @@ export const createServer = async (port, host = '127.0.0.1') => {
     // POST /api/analyze — start a new analysis job
     app.post('/api/analyze', createRouteLimiter({ limit: 10 }), requireTrustedOrigin, async (req, res) => {
         try {
-            const { url: repoUrl, path: repoLocalPath, force, embeddings, dropEmbeddings, springActuatorPath, asyncApiSpecPath, token: repoToken, branch: repoBranch, } = req.body;
+            const { url: repoUrl, path: repoLocalPath, force, embeddings, dropEmbeddings, springActuatorPath, asyncApiSpecPath, token: repoToken, } = req.body;
             // Input type validation
             if (repoUrl !== undefined && typeof repoUrl !== 'string') {
                 res.status(400).json({ error: '"url" must be a string' });
@@ -1292,27 +1288,6 @@ export const createServer = async (port, host = '127.0.0.1') => {
                 res.status(400).json({ error: 'Provide "url" (git URL) or "path" (local path)' });
                 return;
             }
-            // Branch: optional index-branch selector, validated with the same rules
-            // as the CLI's `--branch` so both entry points accept the same refs.
-            // Rejecting here (rather than letting the clone fail) keeps a malformed
-            // ref from ever reaching `git`.
-            if (repoBranch !== undefined && typeof repoBranch !== 'string') {
-                res.status(400).json({ error: '"branch" must be a string' });
-                return;
-            }
-            let analyzeBranch;
-            if (repoBranch !== undefined) {
-                try {
-                    analyzeBranch = validateBranchName(repoBranch, '"branch"');
-                }
-                catch (err) {
-                    if (err instanceof InvalidBranchError) {
-                        res.status(400).json({ error: err.message });
-                        return;
-                    }
-                    throw err;
-                }
-            }
             // Token: optional, restricted charset to prevent header smuggling
             // (CRLF), bound length, and bound to github.com (see validateAnalyzeToken).
             const tokenError = validateAnalyzeToken(repoToken, repoUrl);
@@ -1336,11 +1311,7 @@ export const createServer = async (port, host = '127.0.0.1') => {
                 res.status(400).json({ error: '"path" must be an absolute path' });
                 return;
             }
-            const job = jobManager.createJob({
-                repoUrl,
-                repoPath: repoLocalPath,
-                branch: analyzeBranch,
-            });
+            const job = jobManager.createJob({ repoUrl, repoPath: repoLocalPath });
             // If job was already running (dedup), just return its id. The token is
             // not part of the dedup identity and is never stored on the job, so a
             // token on THIS request had no effect — the existing job already
@@ -1366,21 +1337,17 @@ export const createServer = async (port, host = '127.0.0.1') => {
                     // Clone if URL provided
                     if (repoUrl && !repoLocalPath) {
                         const repoName = extractWebRepoName(repoUrl);
-                        // Branch-pinned runs get their own clone dir, so they never share
-                        // a working tree with the unpinned one (see getCloneDir).
-                        targetPath = getCloneDir(repoName, analyzeBranch);
+                        targetPath = getCloneDir(repoName);
                         jobManager.updateJob(job.id, {
                             status: 'cloning',
-                            // url+branch: same value as registryName (dir basename), not
-                            // the extractWebRepoName stem used only as getCloneDir's first arg.
-                            repoName: analyzeBranch ? path.basename(targetPath) : repoName,
+                            repoName,
                             progress: { phase: 'cloning', percent: 0, message: `Cloning ${repoUrl}...` },
                         });
                         await cloneOrPull(repoUrl, targetPath, (progress) => {
                             jobManager.updateJob(job.id, {
                                 progress: { phase: progress.phase, percent: 5, message: progress.message },
                             });
-                        }, analyzeCloneOptions(repoToken, analyzeBranch));
+                        }, repoToken ? { token: repoToken } : undefined);
                     }
                     if (!targetPath) {
                         throw new Error('No target path resolved');
@@ -1391,20 +1358,6 @@ export const createServer = async (port, host = '127.0.0.1') => {
                         dropEmbeddings,
                         springActuatorPath,
                         asyncApiSpecPath,
-                        branch: analyzeBranch,
-                        // Both clone dirs share an `origin`, so the name `registerRepo`
-                        // infers from the remote would be identical and the second one
-                        // would fail with RegistryNameCollisionError. Register the pinned
-                        // clone under its directory name instead: unique per branch, and
-                        // it re-derives through getCloneDir for DELETE /api/repo.
-                        //
-                        // Gated on the SAME condition as the clone above: when a caller
-                        // supplies both `url` and `path` nothing is cloned, and renaming
-                        // the operator's own local repo after its directory would be a
-                        // surprise unrelated to branch pinning.
-                        ...(analyzeBranch && repoUrl && !repoLocalPath
-                            ? { registryName: path.basename(targetPath) }
-                            : {}),
                     });
                 }
                 catch (err) {

package/dist/server/git-clone.d.ts

@@ -25,25 +25,12 @@ export declare function extractRepoName(url: string): string;
  * `extractRepoName()` strict for internal/security-sensitive callers.
  */
 export declare function extractWebRepoName(url: string): string;
-/** Get the clone target directory for a repo name, optionally pinned to a branch. */
-export declare function getCloneDir(repoName: string, branch?: string): string;
+/** Get the clone target directory for a repo name. */
+export declare function getCloneDir(repoName: string): string;
 export interface CloneProgress {
     phase: 'cloning' | 'pulling';
     message: string;
 }
-/**
- * Build the `cloneOrPull` options for an `/api/analyze` request.
- *
- * Extracted from the route so the token/branch combination is unit-testable.
- * Inline, the branch-only case was the one nothing asserted: every existing
- * test still passed if `branch` were dropped whenever no token was supplied —
- * i.e. silently cloning the default branch for every public URL, which is the
- * exact behavior #3198 is about (#3199 review).
- *
- * Returns `undefined` rather than `{}` when neither is set, because that is
- * what `cloneOrPull` treats as "no options" at its own call sites.
- */
-export declare function analyzeCloneOptions(token?: string, branch?: string): Pick<CloneOrPullOptions, 'token' | 'branch'> | undefined;
 export interface CloneOrPullOptions {
     token?: string;
     allowedCloneRoot?: string;
@@ -132,29 +119,9 @@ export declare function getRemoteOriginUrl(cwd: string, timeoutMs?: number): Pro
 export declare function assertRemoteMatchesRequestedUrl(targetDir: string, requestedUrl: string, timeoutMs?: number): Promise<void>;
 /**
  * Clone or pull a git repository.
- *
- * If targetDir doesn't exist: git clone --depth 1, adding `--branch <branch>`
- * when one is requested.
- *
- * If targetDir exists with .git, its remote.origin is verified against the
- * requested URL first, and then the branch decides the update:
- *   - no `options.branch`: git pull --ff-only, which updates the current
- *     branch in place via its configured upstream. Nothing moves, so no
- *     dirty-tree check applies.
- *   - a `options.branch` that is ALREADY the current named branch: restore
- *     GitNexus overlays, then fetch via
- *     `+refs/heads/<branch>:refs/remotes/origin/<branch>` and
- *     `checkout -B <branch> origin/<branch>` (shallow clones cannot
- *     `merge --ff-only` across a 2+ commit move). Never a raw
- *     `origin <branch>` pull refspec. No porcelain refuse.
- *   - a detached HEAD whose SHA already matches the requested ref (tag /
- *     SHA pin): restore overlays only. Do not fetch/merge — a same-named
- *     branch could otherwise fast-forward the pin past the tag.
- *   - a `options.branch` that DIFFERS from the current pin: fetch that ref,
- *     then `checkout -B <branch> origin/<branch>` — so the requested branch,
- *     not the one already checked out, is what ends up in the working tree.
- *     This is the switching case, and it refuses a dirty tree unless
- *     `overwriteLocalChanges` is set.
+ * If targetDir doesn't exist: git clone --depth 1
+ * If targetDir exists with .git: git pull --ff-only (after verifying the
+ * existing clone's remote.origin matches the requested URL).
  *
  * Security:
  *   - targetDir must resolve inside CLONE_ROOT (~/.gitnexus/repos/). The

package/dist/server/git-clone.js

@@ -10,7 +10,6 @@ import fs from 'fs/promises';
 import os from 'node:os';
 import { logger } from '../core/logger.js';
 import { getGlobalDir } from '../storage/repo-manager.js';
-import { branchSlug } from '../storage/branch-index.js';
 import { sanitizeRepoName, stripUrlCredentials } from '../storage/git.js';
 import { validateGitUrl } from '../core/net/url-guard.js';
 import { assertDirectoryOwnerAndPermissions, quarantineAutoSyncPartial, } from '../core/auto-sync/path-security.js';
@@ -75,83 +74,14 @@ export function extractWebRepoName(url) {
     }
     return safeName;
 }
-/**
- * Longest single path component the supported filesystems accept (ext4, APFS,
- * NTFS all cap at 255). Compared against `.length`, which equals the byte
- * count here because every name this guards is ASCII by construction
- * (REPO_NAME_PATTERN and sanitizeRepoName both restrict to `[a-zA-Z0-9._-]`).
- */
-const MAX_PATH_COMPONENT_BYTES = 255;
-/**
- * `branchSlug` for a clone-directory name, trimmed to fit one path component.
- *
- * `validateBranchName` allows a ref up to 255 characters and `branchSlug`
- * appends `-` plus 8 hash characters, so `<repo>__<slug>` can reach 267 — past
- * the filesystem limit, and the clone would then fail to create its target
- * directory (#3199 review).
- *
- * Only the READABLE half is trimmed; the 8-character hash is always kept, and
- * it is a digest of the full ref, so two long branches that share a prefix
- * still get different directories. The slug is not trimmed inside
- * `branchSlug` itself because the per-branch *index* slots already use those
- * names on disk — shortening them there would orphan existing indexes.
- */
-const boundedBranchSegment = (repoName, branch) => {
-    const slug = branchSlug(branch);
-    if (`${repoName}__${slug}`.length <= MAX_PATH_COMPONENT_BYTES)
-        return slug;
-    const hash = slug.slice(slug.lastIndexOf('-')); // "-" + 8 hex
-    const budget = MAX_PATH_COMPONENT_BYTES - repoName.length - '__'.length - hash.length;
-    // A repo name long enough to leave no budget falls through to the caller's
-    // length check, which rejects it rather than building an unusable path.
-    return `${slug.slice(0, Math.max(0, budget))}${hash}`;
-};
-/** Get the clone target directory for a repo name, optionally pinned to a branch. */
-export function getCloneDir(repoName, branch) {
+/** Get the clone target directory for a repo name. */
+export function getCloneDir(repoName) {
     // Re-validate at the boundary even though extractRepoName already checked —
     // callers may pass a repoName from another source (test fixtures, scripts).
     if (!repoName || repoName === '.' || repoName === '..' || !REPO_NAME_PATTERN.test(repoName)) {
         throw new Error('Invalid repository name');
     }
-    // A branch-pinned analyze gets its OWN working tree.
-    //
-    // Sharing one checkout per repo made `branch` unusable in practice: the tree
-    // is dirty after any analyze (generated AGENTS.md / CLAUDE.md / .claude/), so
-    // a pinned request hit `cloneOrPull`'s porcelain refusal; and a later request
-    // that OMITTED `branch` would pull whatever branch the last pin left checked
-    // out and index it as the default (#3199 review). Separate directories remove
-    // both, because the two requests no longer share a tree.
-    //
-    // `branchSlug` is the same helper the per-branch index slots use, so the two
-    // layouts agree on how a ref becomes a path segment. It emits only
-    // `[a-zA-Z0-9._-]`, so the composed name still satisfies REPO_NAME_PATTERN and
-    // round-trips through this function — which is how DELETE /api/repo re-derives
-    // the directory from the registry name.
-    const dirName = branch ? `${repoName}__${boundedBranchSegment(repoName, branch)}` : repoName;
-    if (!REPO_NAME_PATTERN.test(dirName) || dirName.length > MAX_PATH_COMPONENT_BYTES) {
-        throw new Error('Invalid repository name');
-    }
-    return path.join(CLONE_ROOT, dirName);
-}
-/**
- * Build the `cloneOrPull` options for an `/api/analyze` request.
- *
- * Extracted from the route so the token/branch combination is unit-testable.
- * Inline, the branch-only case was the one nothing asserted: every existing
- * test still passed if `branch` were dropped whenever no token was supplied —
- * i.e. silently cloning the default branch for every public URL, which is the
- * exact behavior #3198 is about (#3199 review).
- *
- * Returns `undefined` rather than `{}` when neither is set, because that is
- * what `cloneOrPull` treats as "no options" at its own call sites.
- */
-export function analyzeCloneOptions(token, branch) {
-    if (!token && !branch)
-        return undefined;
-    return {
-        ...(token ? { token } : {}),
-        ...(branch ? { branch } : {}),
-    };
+    return path.join(CLONE_ROOT, repoName);
 }
 /**
  * Build the `git clone` argument list for a given URL and target directory.
@@ -318,110 +248,11 @@ export async function assertRemoteMatchesRequestedUrl(targetDir, requestedUrl, t
             `not the requested URL ${stripUrlCredentials(requestedUrl)}`);
     }
 }
-/**
- * Fetch refspec that updates `origin/<branch>` from `refs/heads/<branch>`.
- *
- * The leading `+` is git's dest-update prefix (`+refs/heads/*:refs/remotes/origin/*`
- * is what `git clone` writes into `.git/config`). Without it, `fetch --depth 1`
- * refuses to move `origin/<branch>` when the shallow history cannot prove a
- * fast-forward — so a same-branch re-index stays stuck on the old tip.
- *
- * The user string is interpolated inside `refs/heads/…`, never as a raw pull
- * dest. A branch named `+develop` becomes `+refs/heads/+develop:…`, not a
- * force-update of `develop`.
- */
-function branchFetchRefspec(branch) {
-    return `+refs/heads/${branch}:refs/remotes/origin/${branch}`;
-}
-/** Overlays `analyze` writes into a clone; they must not block a same-ref update. */
-const GITNEXUS_GENERATED_OVERLAYS = ['./AGENTS.md', './CLAUDE.md', './.claude'];
-/**
- * Restore only GitNexus-generated overlays so a same-ref update is not
- * blocked by analyze dirt. Path-limited and root-anchored (`./`): tracked
- * files are checked out from HEAD; untracked overlays (including gitignored
- * ones — `AGENTS.md` / `.claude/` are commonly ignored) are `git clean -fdx`'d.
- * A slash-free `AGENTS.md` would also hit `docs/AGENTS.md`. Never a
- * whole-clone `git clean --force -d`.
- */
-async function restoreGitNexusGeneratedOverlays(runGitImpl, cwd, gitOpts) {
-    for (const overlay of GITNEXUS_GENERATED_OVERLAYS) {
-        const listed = (await runGitImpl(['ls-files', '--', overlay], cwd, gitOpts)).trim();
-        if (!listed)
-            continue;
-        await runGitImpl(['checkout', 'HEAD', '--', overlay], cwd, gitOpts);
-    }
-    // Path-limited: untracked analyze output still blocks checkout when the
-    // incoming tree has the same path, and otherwise leaves a dirty tree to
-    // index. `-x` is required because these overlays are often gitignored.
-    // Never a whole-clone `git clean --force -d`.
-    await runGitImpl(['clean', '-fdx', '--', ...GITNEXUS_GENERATED_OVERLAYS], cwd, gitOpts);
-}
-/**
- * True when the working tree is already at the requested pin: either HEAD is
- * that named branch, or HEAD is detached at the same SHA as `branch` /
- * `origin/<branch>`. A missing ref falls through to the switch path.
- */
-async function matchRequestedRef(runGitImpl, cwd, branch, gitOpts) {
-    const abbrev = (await runGitImpl(['rev-parse', '--abbrev-ref', 'HEAD'], cwd, gitOpts)).trim();
-    if (abbrev === branch)
-        return 'branch';
-    // Detached HEAD reports `HEAD`; compare SHAs so a tag/SHA pin is not a switch.
-    if (abbrev !== 'HEAD')
-        return undefined;
-    let headSha;
-    try {
-        headSha = (await runGitImpl(['rev-parse', 'HEAD'], cwd, gitOpts)).trim();
-    }
-    catch {
-        return undefined;
-    }
-    for (const candidate of [branch, `origin/${branch}`]) {
-        try {
-            // Peel annotated tags (`v1.0` is a tag object; HEAD is the commit).
-            const requestedSha = (await runGitImpl(['rev-parse', `${candidate}^{commit}`], cwd, gitOpts)).trim();
-            if (requestedSha && requestedSha === headSha)
-                return 'sha';
-        }
-        catch {
-            // Ref missing — try origin/<branch>, then the switch path.
-        }
-    }
-    return undefined;
-}
-async function fetchAndCheckoutRequestedBranch(runGitImpl, cwd, branch, gitOpts) {
-    // Analyze clones are `--depth 1`. `merge --ff-only` cannot walk O→N when
-    // the remote moved 2+ commits (the merge-base is not in the shallow
-    // history). `checkout -B` points the local branch at the fetched tip —
-    // same as the switch path, no ancestry walk. No `--force`: leftover
-    // non-overlay dirt still refuses.
-    await runGitImpl(['fetch', '--depth', '1', 'origin', branchFetchRefspec(branch)], cwd, gitOpts);
-    await runGitImpl(['checkout', '-B', branch, `origin/${branch}`], cwd, gitOpts);
-}
 /**
  * Clone or pull a git repository.
- *
- * If targetDir doesn't exist: git clone --depth 1, adding `--branch <branch>`
- * when one is requested.
- *
- * If targetDir exists with .git, its remote.origin is verified against the
- * requested URL first, and then the branch decides the update:
- *   - no `options.branch`: git pull --ff-only, which updates the current
- *     branch in place via its configured upstream. Nothing moves, so no
- *     dirty-tree check applies.
- *   - a `options.branch` that is ALREADY the current named branch: restore
- *     GitNexus overlays, then fetch via
- *     `+refs/heads/<branch>:refs/remotes/origin/<branch>` and
- *     `checkout -B <branch> origin/<branch>` (shallow clones cannot
- *     `merge --ff-only` across a 2+ commit move). Never a raw
- *     `origin <branch>` pull refspec. No porcelain refuse.
- *   - a detached HEAD whose SHA already matches the requested ref (tag /
- *     SHA pin): restore overlays only. Do not fetch/merge — a same-named
- *     branch could otherwise fast-forward the pin past the tag.
- *   - a `options.branch` that DIFFERS from the current pin: fetch that ref,
- *     then `checkout -B <branch> origin/<branch>` — so the requested branch,
- *     not the one already checked out, is what ends up in the working tree.
- *     This is the switching case, and it refuses a dirty tree unless
- *     `overwriteLocalChanges` is set.
+ * If targetDir doesn't exist: git clone --depth 1
+ * If targetDir exists with .git: git pull --ff-only (after verifying the
+ * existing clone's remote.origin matches the requested URL).
  *
  * Security:
  *   - targetDir must resolve inside CLONE_ROOT (~/.gitnexus/repos/). The
@@ -490,47 +321,39 @@ export async function cloneOrPull(url, targetDir, onProgress, options) {
         await assertRemoteMatchesRequestedUrl(safeTarget, url, options?.timeoutMs);
         onProgress?.({ phase: 'pulling', message: 'Pulling latest changes...' });
         const runGitImpl = options?.runGitForTest ?? runGit;
-        const gitOpts = {
-            token: options?.token,
-            url,
-            timeoutMs: options?.timeoutMs,
-        };
-        // Already at the requested pin? Then there is no switch to make, so do
-        // not take the checkout path below — that would run the porcelain check
-        // against a tree ANALYZE ITSELF dirtied (it writes AGENTS.md / CLAUDE.md /
-        // .claude/ into the clone), which made a pinned RE-index impossible: the
-        // first pin succeeded and every later one failed asking for
-        // `overwrite_local_changes`, a flag this route deliberately does not pass
-        // because it would `git clean --force -d` the directory (#3199 review).
-        //
-        // "Already there" is a named-branch match OR a detached HEAD whose SHA
-        // equals `branch` / `origin/<branch>` (tag / SHA pin). A missing ref
-        // falls through to the switch path, which still refuses a dirty tree.
-        //
-        // Same-named-branch update uses the heads/ → remotes/ fetch refspec plus
-        // `checkout -B <branch> origin/<branch>`, never `pull origin <user-string>`
-        // (a leading `+` would otherwise be a force-fetch). Only
-        // `remote.origin.url` is verified above; `branch.<name>.remote` /
-        // `.merge` are not, so an implicit-upstream pull can update a different
-        // ref while the job still carries this branch (#3199 review).
-        const requestedRefMatch = options?.branch
-            ? await matchRequestedRef(runGitImpl, safeTarget, options.branch, gitOpts)
-            : undefined;
-        if (options?.branch && !requestedRefMatch) {
+        if (options?.branch) {
             if (!options.overwriteLocalChanges) {
-                const status = await runGitImpl(['status', '--porcelain'], safeTarget, gitOpts);
+                const status = await runGitImpl(['status', '--porcelain'], safeTarget, {
+                    token: options?.token,
+                    url,
+                    timeoutMs: options?.timeoutMs,
+                });
                 if (status.trim()) {
                     throw new Error(`Refusing to update ${safeTarget}: local changes detected. Set overwrite_local_changes: true to overwrite them.`);
                 }
             }
-            await runGitImpl(['fetch', '--depth', '1', 'origin', branchFetchRefspec(options.branch)], safeTarget, gitOpts);
+            await runGitImpl([
+                'fetch',
+                '--depth',
+                '1',
+                'origin',
+                `refs/heads/${options.branch}:refs/remotes/origin/${options.branch}`,
+            ], safeTarget, {
+                token: options?.token,
+                url,
+                timeoutMs: options?.timeoutMs,
+            });
             await runGitImpl([
                 'checkout',
                 ...(options.overwriteLocalChanges ? ['--force'] : []),
                 '-B',
                 options.branch,
                 `origin/${options.branch}`,
-            ], safeTarget, gitOpts);
+            ], safeTarget, {
+                token: options?.token,
+                url,
+                timeoutMs: options?.timeoutMs,
+            });
             if (options.overwriteLocalChanges) {
                 // `checkout --force` rewrites tracked files only, so untracked sources
                 // left by an operator or an earlier branch survive and then get indexed
@@ -538,20 +361,19 @@ export async function cloneOrPull(url, targetDir, onProgress, options) {
                 // ignored paths must survive, and `-e /.gitnexus` is belt-and-braces
                 // because `.git/info/exclude` is skipped on a read-only storage mount
                 // and a freshly cloned repo may not have been analyzed yet at all.
-                await runGitImpl(['clean', '--force', '-d', '-e', '/.gitnexus'], safeTarget, gitOpts);
+                await runGitImpl(['clean', '--force', '-d', '-e', '/.gitnexus'], safeTarget, {
+                    token: options?.token,
+                    url,
+                    timeoutMs: options?.timeoutMs,
+                });
             }
         }
-        else if (options?.branch && requestedRefMatch === 'branch') {
-            await restoreGitNexusGeneratedOverlays(runGitImpl, safeTarget, gitOpts);
-            await fetchAndCheckoutRequestedBranch(runGitImpl, safeTarget, options.branch, gitOpts);
-        }
-        else if (options?.branch && requestedRefMatch === 'sha') {
-            // Tag / SHA pin: already at the requested commit. Fetching
-            // `refs/heads/<name>` would follow a same-named branch past the pin.
-            await restoreGitNexusGeneratedOverlays(runGitImpl, safeTarget, gitOpts);
-        }
         else {
-            await runGitImpl(['pull', '--ff-only'], safeTarget, gitOpts);
+            await runGitImpl(['pull', '--ff-only'], safeTarget, {
+                token: options?.token,
+                url,
+                timeoutMs: options?.timeoutMs,
+            });
         }
     }
     else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gitnexus",
-  "version": "1.6.12-rc.10",
+  "version": "1.6.12-rc.11",
   "description": "Graph-powered code intelligence for AI agents. Index any codebase, query via MCP or CLI.",
   "author": "Abhigyan Patwari",
   "license": "PolyForm-Noncommercial-1.0.0",

package/dist/core/git-ref.d.ts

@@ -1,22 +0,0 @@
-/**
- * Git ref-name validation used by both the CLI and the HTTP analyze route.
- *
- * Lives in `core/` so `server/api.ts` does not import `cli/analyze-config`
- * (that import closed a cli → server → cli cycle: `cli/serve.ts` already
- * imports `createServer`). The CLI keeps a thin wrapper that rethrows
- * {@link InvalidBranchError} as `GitNexusRcError`.
- */
-/**
- * Thrown when a user-supplied branch name fails {@link validateBranchName}.
- * Callers at a product boundary map this to their own error type (CLI:
- * `GitNexusRcError`; HTTP: 400).
- */
-export declare class InvalidBranchError extends Error {
-    constructor(message: string);
-}
-/**
- * Validate a user-supplied branch name. Returns the trimmed name or throws
- * {@link InvalidBranchError}. Conservative but accepts the shapes real
- * branches use (`feature/foo-bar`, `release/1.2`, `develop`).
- */
-export declare function validateBranchName(value: string, source: string): string;

package/dist/core/git-ref.js

@@ -1,114 +0,0 @@
-/**
- * Git ref-name validation used by both the CLI and the HTTP analyze route.
- *
- * Lives in `core/` so `server/api.ts` does not import `cli/analyze-config`
- * (that import closed a cli → server → cli cycle: `cli/serve.ts` already
- * imports `createServer`). The CLI keeps a thin wrapper that rethrows
- * {@link InvalidBranchError} as `GitNexusRcError`.
- */
-/** Git refs longer than this are almost certainly a mistake / injection attempt. */
-const BRANCH_MAX_LENGTH = 255;
-/**
- * Thrown when a user-supplied branch name fails {@link validateBranchName}.
- * Callers at a product boundary map this to their own error type (CLI:
- * `GitNexusRcError`; HTTP: 400).
- */
-export class InvalidBranchError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = 'InvalidBranchError';
-    }
-}
-/**
- * Reject control characters and hidden / bidirectional Unicode in a string
- * value. These have no legitimate place in a branch name and would otherwise
- * let a committed config or HTTP body smuggle invisible controls into
- * generated AGENTS.md / CLAUDE.md content.
- */
-const isHiddenOrControl = (codePoint) => codePoint < 0x20 ||
-    codePoint === 0x7f ||
-    (codePoint >= 0x200b && codePoint <= 0x200f) || // zero-width + LRM/RLM
-    (codePoint >= 0x202a && codePoint <= 0x202e) || // bidi embeddings/overrides
-    (codePoint >= 0x2060 && codePoint <= 0x2064) || // word-joiner + invisible math
-    (codePoint >= 0x2066 && codePoint <= 0x206f) || // bidi isolates + deprecated
-    codePoint === 0xfeff; // BOM / zero-width no-break space
-const assertNoHiddenChars = (value, source) => {
-    for (const ch of value) {
-        const cp = ch.codePointAt(0);
-        if (cp !== undefined && isHiddenOrControl(cp)) {
-            throw new InvalidBranchError(`${source}: value contains control or hidden/bidirectional characters, which are not allowed.`);
-        }
-    }
-};
-/**
- * Validate a user-supplied branch name. Returns the trimmed name or throws
- * {@link InvalidBranchError}. Conservative but accepts the shapes real
- * branches use (`feature/foo-bar`, `release/1.2`, `develop`).
- */
-export function validateBranchName(value, source) {
-    const trimmed = value.trim();
-    if (!trimmed) {
-        throw new InvalidBranchError(`${source}: branch name must not be empty.`);
-    }
-    if (trimmed.length > BRANCH_MAX_LENGTH) {
-        throw new InvalidBranchError(`${source}: branch name is too long (max ${BRANCH_MAX_LENGTH}).`);
-    }
-    assertNoHiddenChars(trimmed, source);
-    if (/\s/.test(trimmed)) {
-        throw new InvalidBranchError(`${source}: branch name must not contain whitespace.`);
-    }
-    // git ref-name rules (subset): reject characters git itself forbids in refs.
-    if (/[~^:?*[\\]/.test(trimmed)) {
-        throw new InvalidBranchError(`${source}: branch name contains characters not allowed in a git ref (~ ^ : ? * [ \\).`);
-    }
-    if (trimmed.startsWith('-')) {
-        throw new InvalidBranchError(`${source}: branch name must not start with "-".`);
-    }
-    // Force-refspec prefix (`git fetch origin +main` / `+refs/heads/main:…`).
-    // Rejected here so neither the CLI nor HTTP can pass a force-update refspec
-    // through as a "branch" (#3199 review, defense in depth).
-    if (trimmed.startsWith('+')) {
-        throw new InvalidBranchError(`${source}: branch name must not start with "+".`);
-    }
-    // The symbolic ref HEAD (case-sensitive). A repo can have a branch named
-    // `head`; git itself treats only `HEAD` as the current-commit alias.
-    if (trimmed === 'HEAD') {
-        throw new InvalidBranchError(`${source}: branch name must not be "HEAD".`);
-    }
-    if (trimmed.includes('..')) {
-        throw new InvalidBranchError(`${source}: branch name must not contain "..".`);
-    }
-    // The remaining `git check-ref-format` rules. Without these the validator
-    // accepted refs git itself refuses (`feature.lock`, `/feature`, `feature/`,
-    // `feature//next`, `@`, `.hidden`), so the failure surfaced later from the
-    // git subprocess instead of here. No real branch can violate them — git
-    // could not have created one — so nothing that works today starts failing.
-    if (trimmed.endsWith('.lock') || trimmed.split('/').some((part) => part.endsWith('.lock'))) {
-        throw new InvalidBranchError(`${source}: branch name must not end with ".lock".`);
-    }
-    if (trimmed.startsWith('/') || trimmed.endsWith('/')) {
-        throw new InvalidBranchError(`${source}: branch name must not start or end with "/".`);
-    }
-    if (trimmed.includes('//')) {
-        throw new InvalidBranchError(`${source}: branch name must not contain consecutive slashes.`);
-    }
-    if (trimmed === '@') {
-        throw new InvalidBranchError(`${source}: branch name must not be the single character "@".`);
-    }
-    if (trimmed.includes('@{')) {
-        throw new InvalidBranchError(`${source}: branch name must not contain "@{".`);
-    }
-    if (trimmed.endsWith('.') || trimmed.split('/').some((part) => part.startsWith('.'))) {
-        throw new InvalidBranchError(`${source}: branch name must not end with "." or have a path component starting with ".".`);
-    }
-    // Git permits a backtick in a ref, but the branch is embedded inside a
-    // Markdown inline-code span in the generated AGENTS.md/CLAUDE.md regression
-    // example, where a backtick would close the span early and let the rest of
-    // the template render as instruction text. Reject it at this single
-    // chokepoint so all three tiers (CLI flag, .gitnexusrc, auto-detect via
-    // sanitizeDetectedBranch) are covered (#1996 tri-review P1).
-    if (trimmed.includes('`')) {
-        throw new InvalidBranchError(`${source}: branch name must not contain a backtick (it would break the generated Markdown).`);
-    }
-    return trimmed;
-}