kenaz 0.3.22 → 0.3.24

package/core/.claude/hooks/_user-scope.js

@@ -19,5 +19,5 @@ if (!hookFile) process.exit(0);
 const projectDir = process.env.CLAUDE_PROJECT_DIR || process.cwd();
 if (fs.existsSync(path.join(projectDir, '.claude', 'hooks', hookFile))) process.exit(0);
 
-const res = spawnSync(process.execPath, [path.join(__dirname, hookFile), ...args], { stdio: 'inherit' });
+const res = spawnSync(process.execPath, [path.join(__dirname, hookFile), ...args], { windowsHide: true, stdio: 'inherit' });
 process.exit(res.status == null ? 0 : res.status);

package/core/.claude/hooks/core-resolve.js

@@ -221,7 +221,7 @@ if (require.main === module) {
   if (!result) process.exit(0); // silent -- non-blocking hook
 
   try {
-    execFileSync("node", [result.resolved, ...result.args], { stdio: "inherit" });
+    execFileSync("node", [result.resolved, ...result.args], { stdio: "inherit", windowsHide: true });
   } catch {
     // Hook errors should not block
   }

package/core/.claude/hooks/worktree-create.js

@@ -99,7 +99,7 @@ function readStdin() {
  * a no-op (GEN-009). We do NOT write to any git config file here.
  */
 function git(repo, args) {
-  return execFileSync('git', ['-C', repo, '-c', 'core.longpaths=true', ...args], {
+  return execFileSync('git', ['-C', repo, '-c', 'core.longpaths=true', ...args], { windowsHide: true,
     stdio: ['ignore', 'pipe', 'pipe'],
   }).toString().trim();
 }
@@ -107,7 +107,7 @@ function git(repo, args) {
 function isGitRepo(dir) {
   if (!dir) return false;
   try {
-    return execFileSync('git', ['-C', dir, 'rev-parse', '--is-inside-work-tree'], {
+    return execFileSync('git', ['-C', dir, 'rev-parse', '--is-inside-work-tree'], { windowsHide: true,
       stdio: ['ignore', 'pipe', 'ignore'],
     }).toString().trim() === 'true';
   } catch { return false; }
@@ -334,7 +334,7 @@ function isLandedProgressNote(repo, relPath) {
 function classifyWorktreeDirt(worktreeDir, noisePaths, repo) {
   const raw = execFileSync('git', ['-C', worktreeDir, '-c', 'core.longpaths=true',
     '-c', 'core.quotePath=false', 'status', '--porcelain'],
-    { stdio: ['ignore', 'pipe', 'pipe'] }).toString();
+    { windowsHide: true, stdio: ['ignore', 'pipe', 'pipe'] }).toString();
   const real = [];
   const noise = [];
   for (const line of raw.split('\n')) {
@@ -491,7 +491,8 @@ function gcStaleWorktrees(repo, keepPath, opts) {
       // Windows recurses through junctions on delete and would empty the MAIN
       // checkout's node_modules (measured; see unlinkNodeModulesLinks). This
       // also covers pre-TASK_1844 worktrees where agents hand-built junctions.
-      unlinkNodeModulesLinks(p);
+      const unl = unlinkNodeModulesLinks(p);
+      if (unl.failed.length) { diag(name + ' KEPT — cannot unlink: ' + unl.failed.slice(0, 3).join(', ')); continue; }
       // Lock-resilient removal: try git remove --force, fall back to fs.rmSync
       // with retries, then prune. If still locked -> log to stderr (observable)
       // but never throw (GC must remain non-blocking).
@@ -635,18 +636,18 @@ function findNodeModulesParents(repo) {
 function ensureWorktreeIgnores(worktreePath, relPath) {
   try {
     execFileSync('git', ['-C', worktreePath, 'check-ignore', '-q', '--', relPath],
-      { stdio: ['ignore', 'ignore', 'ignore'] });
+      { windowsHide: true, stdio: ['ignore', 'ignore', 'ignore'] });
     return; // exit 0 → already ignored (repo .gitignore covers it)
   } catch { /* not ignored → add per-worktree exclude */ }
   const gp = execFileSync('git', ['-C', worktreePath, 'rev-parse', '--git-path', 'info/exclude'],
-    { stdio: ['ignore', 'pipe', 'pipe'] }).toString().trim();
+    { windowsHide: true, stdio: ['ignore', 'pipe', 'pipe'] }).toString().trim();
   const excludeFile = path.isAbsolute(gp) ? gp : path.resolve(worktreePath, gp);
   fs.mkdirSync(path.dirname(excludeFile), { recursive: true });
   fs.appendFileSync(excludeFile, '/' + relPath + '/\n');
 }
 
 /**
- * Unlink node_modules junctions/symlinks inside `root` (a worktree about to be
+ * Unlink EVERY junction/symlink (any name, any depth) inside `root` (a worktree about to be
  * removed). MUST run before any `git worktree remove`: Git for Windows RECURSES
  * THROUGH junctions when deleting and EMPTIES THE LINK TARGET — measured
  * 2026-08-13 (TASK_1844 control test): a junction into the source repo's
@@ -657,27 +658,8 @@ function ensureWorktreeIgnores(worktreePath, relPath) {
  * left for the normal removal path. Best-effort: never throws.
  */
 function unlinkNodeModulesLinks(root) {
-  const walk = (dir, depth) => {
-    let entries;
-    try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { return; }
-    for (const ent of entries) {
-      const p = path.join(dir, ent.name);
-      if (ent.name === 'node_modules') {
-        try {
-          if (fs.lstatSync(p).isSymbolicLink()) {
-            try { fs.unlinkSync(p); } catch { fs.rmdirSync(p); }
-          }
-        } catch { /* best-effort */ }
-        continue;
-      }
-      let isDir = false;
-      try { const st = fs.lstatSync(p); isDir = st.isDirectory() && !st.isSymbolicLink(); }
-      catch { continue; }
-      if (!isDir || NODE_MODULES_SCAN_PRUNE.has(ent.name)) continue;
-      if (depth + 1 <= NODE_MODULES_SCAN_DEPTH) walk(p, depth + 1);
-    }
-  };
-  walk(root, 0);
+  // TASK_2485: ONE implementation (lstat walk, every link, any name/depth) lives in worktree-reclaim.js.
+  return require('../../.formation/tools/worktree-reclaim.js').unlinkAllLinks(root); // {removed, failed}
 }
 
 /**
@@ -797,7 +779,7 @@ function main() {
     const taken = (b) => {
       try {
         execFileSync('git', ['-C', repo, 'rev-parse', '--verify', '--quiet', 'refs/heads/' + b],
-          { stdio: ['ignore', 'pipe', 'ignore'] });
+          { windowsHide: true, stdio: ['ignore', 'pipe', 'ignore'] });
         return true;
       } catch { return false; }
     };

package/core/.claude/hooks/worktree-remove.js

@@ -25,7 +25,7 @@ function readStdin() {
 
 function gitTry(repo, args) {
   try {
-    execFileSync('git', ['-C', repo, ...args], { stdio: ['ignore', 'ignore', 'ignore'] });
+    execFileSync('git', ['-C', repo, ...args], { windowsHide: true, stdio: ['ignore', 'ignore', 'ignore'] });
     return true;
   } catch { return false; }
 }
@@ -33,7 +33,7 @@ function gitTry(repo, args) {
 function gitTopLevel(dir) {
   try {
     return execFileSync('git', ['-C', dir, 'rev-parse', '--show-toplevel'],
-      { stdio: ['ignore', 'pipe', 'ignore'] }).toString().trim();
+      { windowsHide: true, stdio: ['ignore', 'pipe', 'ignore'] }).toString().trim();
   } catch { return null; }
 }
 
@@ -51,47 +51,21 @@ function gitTopLevel(dir) {
 // falsified by the control test above — keep this note so nobody re-litigates
 // it in either direction without re-measuring.)
 //
-// DUPLICATED from worktree-create.js ON PURPOSE — do not "deduplicate" via
-// require('./worktree-create.js'): this hook is wired as `node -e
-// "require(...)"`, so inside a required worktree-create.js
-// require.main === undefined, which its entry dispatch treats as "I am the
-// WorktreeCreate hook" → it would consume our stdin JSON and CREATE a spurious
-// worktree in the middle of a remove.
-const NM_SCAN_DEPTH = 3;
-const NM_SCAN_PRUNE = new Set([
-  '.git', 'node_modules', '.next', 'target', 'dist', 'build', 'out',
-  'vendor', 'worktrees', '.kenaz-worktrees',
-]);
-
+// TASK_2485: the unlink walk is shared (worktree-reclaim.js unlinkAllLinks): every
+// symlink/junction at any depth, because git recurses through ALL of them. Do not
+// require('./worktree-create.js') here: this hook is wired as `node -e "require(...)"`,
+// so inside a required worktree-create.js require.main === undefined, which its entry
+// dispatch treats as "I am the WorktreeCreate hook" and would CREATE a worktree.
 function unlinkNodeModulesLinks(root) {
-  const walk = (dir, depth) => {
-    let entries;
-    try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { return; }
-    for (const ent of entries) {
-      const p = path.join(dir, ent.name);
-      if (ent.name === 'node_modules') {
-        try {
-          if (fs.lstatSync(p).isSymbolicLink()) {
-            try { fs.unlinkSync(p); } catch { fs.rmdirSync(p); }
-          }
-        } catch { /* best-effort */ }
-        continue;
-      }
-      let isDir = false;
-      try { const st = fs.lstatSync(p); isDir = st.isDirectory() && !st.isSymbolicLink(); }
-      catch { continue; }
-      if (!isDir || NM_SCAN_PRUNE.has(ent.name)) continue;
-      if (depth + 1 <= NM_SCAN_DEPTH) walk(p, depth + 1);
-    }
-  };
-  try { walk(root, 0); } catch { /* best-effort */ }
+  try { return require('../../.formation/tools/worktree-reclaim.js').unlinkAllLinks(root); }
+  catch { return { removed: [], failed: ['(unlink helper unavailable)'] }; }
 }
 
 /** Find the branch checked out in `worktreePath` via `git worktree list --porcelain`. */
 function worktreeBranch(repo, worktreePath) {
   try {
     const out = execFileSync('git', ['-C', repo, 'worktree', 'list', '--porcelain'],
-      { stdio: ['ignore', 'pipe', 'ignore'] }).toString();
+      { windowsHide: true, stdio: ['ignore', 'pipe', 'ignore'] }).toString();
     const want = path.resolve(worktreePath).replace(/\\/g, '/').toLowerCase();
     let curPath = null;
     for (const line of out.split(/\r?\n/)) {
@@ -132,7 +106,7 @@ function main() {
   let repo = null;
   try {
     const common = execFileSync('git', ['-C', worktreePath, 'rev-parse', '--git-common-dir'],
-      { stdio: ['ignore', 'pipe', 'ignore'] }).toString().trim();
+      { windowsHide: true, stdio: ['ignore', 'pipe', 'ignore'] }).toString().trim();
     if (common) {
       const commonAbs = path.resolve(worktreePath, common); // handles relative or absolute
       if (path.basename(commonAbs) === '.git') repo = path.dirname(commonAbs);
@@ -164,7 +138,7 @@ function main() {
     // TASK_1844: MUST unlink node_modules junctions before the git removal —
     // Git for Windows traverses junctions on delete (measured; see header
     // comment above unlinkNodeModulesLinks). fs.rmSync below is safe as-is.
-    unlinkNodeModulesLinks(worktreePath);
+    if (unlinkNodeModulesLinks(worktreePath).failed.length) process.exit(0); // refuse: a surviving link would be traversed
     gitTry(repo, ['worktree', 'remove', '--force', worktreePath]);
     gitTry(repo, ['worktree', 'prune']);
     if (branch) gitTry(repo, ['branch', '-D', branch]);

package/core/.collaboration/core/reconcile.js

@@ -192,4 +192,19 @@ function externalLanding(repo, card, opts) {
   return wts.some((w) => w.branch && names.has(String(w.branch).replace(/^refs\/heads\//, ''))) ? null : a;
 }
 
-module.exports = { reconcile, assessCard, landedAssessment, externalLanding, countLanded };
+/**
+ * TASK_2467: validate a hand-supplied landing sha. Returns {sha, baseRef, landed_into}; throws unless <sha>
+ * resolves to a commit that is an ancestor of the base ref (origin/main, else local main).
+ */
+function verifyLandedSha(repo, sha, { remote = 'origin', base = 'main' } = {}) {
+  if (!/^[0-9a-fA-F]{7,64}$/.test(String(sha))) throw new Error(`--landed-sha: '${sha}' is not a commit sha`);
+  const baseRef = resolveBaseRef(repo, remote, base);
+  if (!baseRef) throw new Error(`--landed-sha: no ${remote}/${base} or ${base} ref to verify against`);
+  let full;
+  try { full = git(repo, ['rev-parse', '--verify', '--quiet', `${sha}^{commit}`]); } catch { throw new Error(`--landed-sha: commit ${sha} not found`); }
+  const into = baseRef.replace(/^refs\/(heads|remotes)\//, '');
+  if (!gitOk(repo, ['merge-base', '--is-ancestor', full, baseRef])) throw new Error(`--landed-sha: ${full.slice(0, 10)} is not an ancestor of ${into}`);
+  return { landing_sha: full, landed_into: into };
+}
+
+module.exports = { verifyLandedSha, reconcile, assessCard, landedAssessment, externalLanding, countLanded };

package/core/.collaboration/core/task-2467-lifecycle.test.js

@@ -0,0 +1,63 @@
+// TASK_2467 -- update --status rejected; complete --landed-sha from any open state; list shows archived.
+// Real CLI in a temp git project. TASK_API=<path> runs the same checks against another task-api.js (control).
+// Usage: node .collaboration/core/task-2467-lifecycle.test.js
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const cp = require('child_process');
+const API = process.env.TASK_API || path.join(__dirname, 'task-api.js');
+const SB = fs.mkdtempSync(path.join(os.tmpdir(), 't2467_'));
+const git = (...a) => cp.execFileSync('git', a, { cwd: SB, encoding: 'utf8', windowsHide: true, stdio: ['ignore', 'pipe', 'pipe'] }).trim();
+const cli = (...a) => { const r = cp.spawnSync(process.execPath, [API, ...a, '--project-path', SB], { cwd: SB, encoding: 'utf8', windowsHide: true }); return { code: r.status, out: (r.stdout || '') + (r.stderr || '') }; };
+let pass = 0, fail = 0;
+const check = (n, c, d) => { console.log((c ? 'PASS' : 'FAIL') + ' | ' + n + (c ? '' : ' | ' + d)); c ? pass++ : fail++; };
+const T = (...p) => path.join(SB, '.kenaz', 'tasks', ...p);
+const dirOf = (id) => ['backlog', 'active', 'done', 'blocked', 'archived'].find(d => fs.existsSync(T(d)) && fs.readdirSync(T(d)).some(f => f.startsWith(id + '_')));
+const card = (id, dir) => { fs.mkdirSync(T(dir), { recursive: true }); fs.writeFileSync(T(dir, `${id}_t.yaml`), `id: ${id}\ntitle: t\npriority: P2\nstatus: ${dir === 'active' ? 'in_progress' : 'pending'}\n`); };
+
+try {
+  git('init', '-q', '-b', 'main'); git('config', 'user.email', 't@e.com'); git('config', 'user.name', 't');
+  fs.writeFileSync(path.join(SB, 'a.txt'), '1'); git('add', 'a.txt'); git('commit', '-q', '-m', 'base');
+  fs.writeFileSync(path.join(SB, 'b.txt'), '2'); git('add', 'b.txt'); git('commit', '-q', '-m', 'landed');
+  const sha = git('rev-parse', 'HEAD');
+  git('checkout', '-q', '-b', 'side'); fs.writeFileSync(path.join(SB, 'c.txt'), '3'); git('add', 'c.txt'); git('commit', '-q', '-m', 'off-base');
+  const offSha = git('rev-parse', 'HEAD'); git('checkout', '-q', 'main');
+  for (const [id, d] of [['TASK_1', 'backlog'], ['TASK_2', 'blocked'], ['TASK_3', 'active'], ['TASK_4', 'backlog'], ['TASK_5', 'backlog']]) card(id, d);
+
+  // 1) update --status
+  let r = cli('update', 'TASK_5', '--status', 'done', '--priority', 'P1');
+  check('1 update --status (with other fields) exits non-zero', r.code !== 0, r.out);
+  check('1 error names move/complete', /move|complete/.test(r.out), r.out);
+  check('1 card unchanged', dirOf('TASK_5') === 'backlog' && !/priority: P1/.test(fs.readFileSync(T('backlog', 'TASK_5_t.yaml'), 'utf8')), r.out);
+  r = cli('update', 'TASK_5', '--status', 'done');
+  check('1 update --status alone exits non-zero naming move/complete', r.code !== 0 && /move|complete/.test(r.out), r.out);
+  r = cli('update', 'TASK_5', '--status=done', '--priority', 'P1');
+  check('1 update --status=done form is refused too', r.code !== 0 && !/priority: P1/.test(fs.readFileSync(T('backlog', 'TASK_5_t.yaml'), 'utf8')), r.out);
+
+  // 2) complete --landed-sha
+  r = cli('complete', 'TASK_4', '--landed-sha', offSha);
+  check('2 sha not on base refused, card unchanged', r.code !== 0 && dirOf('TASK_4') === 'backlog', r.out);
+  r = cli('complete', 'TASK_4', '--landed-sha', 'zzzz');
+  check('2 garbage sha refused', r.code !== 0 && dirOf('TASK_4') === 'backlog', r.out);
+  card('TASK_6', 'cancel');
+  r = cli('complete', 'TASK_6', '--landed-sha', sha);
+  check('2 a cancelled card is not closed by --landed-sha', r.code !== 0 && fs.existsSync(T('cancel', 'TASK_6_t.yaml')), r.out);
+  for (const id of ['TASK_1', 'TASK_2', 'TASK_3']) {
+    r = id === 'TASK_2' ? cli('complete', id, `--landed-sha=${sha}`) : cli('complete', id, '--landed-sha', sha);
+    check(`2 ${id} -> done in one command`, r.code === 0 && dirOf(id) === 'done', r.out);
+  }
+  const y = dirOf('TASK_1') === 'done' ? fs.readFileSync(T('done', 'TASK_1_t.yaml'), 'utf8') : '';
+  check('2 records external landing fields', /integration: external/.test(y) && y.includes(sha), y);
+
+  // 3) list shows archived
+  card('TASK_90', 'archived'); card('TASK_91', 'archived');
+  r = cli('list');
+  const tot = /\((\d+) total\)/.exec(r.out);
+  check('3 list summary has archived count; total includes it', /archived: 2 \(hidden; --include-archived\)/.test(r.out) && tot && tot[1] === '8', r.out);
+  r = cli('list', '--all');
+  check('3 list --all summary has archived count', /archived: 2 \(hidden; --include-archived\)/.test(r.out), r.out);
+  r = cli('list', '--include-archived');
+  check('3 --include-archived shows archived, no hidden note', /archived: 2/.test(r.out) && !/hidden/.test(r.out), r.out);
+} finally { try { fs.rmSync(SB, { recursive: true, force: true }); } catch (e) { /* best effort */ } }
+console.log(`\n${pass} passed, ${fail} failed`);
+process.exit(fail ? 1 : 0);

package/core/.collaboration/core/task-api.js

@@ -2080,8 +2080,15 @@ class TaskAPI {
       throw await this._missingTaskError(taskId);
     }
 
+    // TASK_2467: card finished outside the dispatch flow (plumbing merge, no card branch): verify the sha
+    // is on the base, then close from backlog/active/blocked in one step (no post-complete).
+    if (options.landedSha) {
+      if (!['backlog', 'active', 'blocked'].includes(task._status_dir)) throw new Error(`--landed-sha closes a backlog/active/blocked card; ${taskId} is in ${task._status_dir}`);
+      options = { ...options, external: require('./reconcile').verifyLandedSha(this._resolveProjectRoot(), options.landedSha), skipPostComplete: true };
+    }
+
     // TASK_2233: backlog → done is not an allowed transition; say what to do instead
-    if (task.status === 'backlog' || task.status === 'pending' || task._status_dir === 'backlog') {
+    if (!options.landedSha && (task.status === 'backlog' || task.status === 'pending' || task._status_dir === 'backlog')) {
       throw new Error(`無法從 backlog 直接完成 ${taskId}: move it to active first (node task-api.js move ${taskId} active), then complete.`);
     }
 
@@ -2119,7 +2126,7 @@ class TaskAPI {
 
     const postCompleteRuns = !options.skipPostComplete;
     let postCompleteSummary = null;
-    const result = await this.moveTask(taskId, 'done', updatedTask);
+    const result = await this.moveTask(taskId, 'done', updatedTask, options.landedSha ? { skipValidation: true } : {});
 
     try {
       this._autoPopThoughtsForCompletedTask(taskId, now);
@@ -2516,7 +2523,7 @@ Commands:
     預設為整組取代（會回顯被移除的既有項目）；加 --append 改為追加到既有項目之後（與既有重複的項目會略過並回顯）
   node task-api.js pull TASK_ID                 匯入共享 room 的唯讀 replica 為本機卡片（標記 origin_node；TASK_2421）
   node task-api.js claim TASK_ID
-  node task-api.js complete TASK_ID [--actual-hours HOURS]
+  node task-api.js complete TASK_ID [--actual-hours HOURS] [--landed-sha SHA]   --landed-sha: work already on main (no card branch); closes from backlog/active/blocked in one step
   node task-api.js reconcile [--remote origin] [--base main] [--apply] [--worktrees]   關閉分支已併入 base 的 active 任務（預設 dry-run）
   node task-api.js move TASK_ID STATUS [--force]
   node task-api.js delete TASK_ID              (僅限 backlog 狀態)
@@ -2683,7 +2690,12 @@ Create 選項:
             }
           }
           const totalCount = Object.values(dirCounts).reduce((a, b) => a + b, 0);
-          if (totalCount === 0) emitEmptyListDiagnostics(api.tasksDir); // TASK_1778
+          // TASK_2467: archived/ is not scanned without --include-archived; count it instead of hiding it
+          let archivedHidden = 0;
+          if (!includeArchived) {
+            try { archivedHidden = (await fs.readdir(path.join(api.tasksDir, 'archived'))).filter(n => n.startsWith('TASK_')).length; } catch { /* absent */ }
+          }
+          if (totalCount + archivedHidden === 0) emitEmptyListDiagnostics(api.tasksDir); // TASK_1778
 
           // Load tasks: full _scanDir for small dirs, fast path for large dirs
           const grouped = {};
@@ -2747,10 +2759,11 @@ Create 選項:
               'done': 'done', 'cancel': 'cancel', 'archived': 'archived'
             };
 
-            const statusSummary = statusOrder
+            let statusSummary = statusOrder
               .map(s => `${statusLabels[s]}: ${dirCounts[s] || 0}`)
               .join(' | ');
-            console.log(`任務統計 (${totalCount} total)`);
+            if (!includeArchived) statusSummary += ` | archived: ${archivedHidden} (hidden; --include-archived)`;
+            console.log(`任務統計 (${totalCount + archivedHidden} total)`);
             console.log(`  ${statusSummary}`);
 
             const formatTask = (t) => {
@@ -2818,9 +2831,15 @@ Create 選項:
               const dir = CONFIG.STATUS_MAP[oldStatus] || oldStatus;
               byDir[dir] = (byDir[dir] || 0) + count;
             }
+            // TASK_2467: getStatistics folds hidden archived/ files into completed; split them back out
+            let archivedHidden = 0;
+            if (!showArchived) {
+              try { archivedHidden = (await fs.readdir(path.join(api.tasksDir, 'archived'))).filter(n => n.startsWith('TASK_')).length; } catch { /* absent */ }
+              byDir.done = Math.max(0, (byDir.done || 0) - archivedHidden);
+            }
             const statusSummary = statusOrder
               .map(s => `${statusLabels[s]}: ${byDir[s] || 0}`)
-              .join(' | ');
+              .join(' | ') + (showArchived ? '' : ` | archived: ${archivedHidden} (hidden; --include-archived)`);
             console.log(`任務統計 (${stats.total} total)`);
             console.log(`  ${statusSummary}`);
 
@@ -3076,6 +3095,12 @@ Create 選項:
         if (args.includes('--skip-post-complete')) {
           options.skipPostComplete = true;
         }
+        const landedIdx = args.findIndex(a => a === '--landed-sha' || a.startsWith('--landed-sha='));
+        if (landedIdx >= 0) {
+          const v = args[landedIdx].includes('=') ? args[landedIdx].slice('--landed-sha='.length) : args[landedIdx + 1];
+          if (!v || v.startsWith('--')) { console.error('❌ --landed-sha: requires a commit sha'); process.exit(1); }
+          options.landedSha = v;
+        }
         // TASK_2420: runtime/config tasks with no branch — git merge/verify reported as skipped
         if (args.includes('--no-source')) {
           options.noSource = true;
@@ -3431,6 +3456,11 @@ Create 選項:
             process.exit(1);
           }
         }
+        // TASK_2467: status is not an update field; never accept it silently.
+        if (args.some(a => a === '--status' || a.startsWith('--status='))) {
+          console.error(`❌ update 不接受 --status（不會變更狀態）。請用: move ${taskId} <backlog|active|blocked|cancel|done> 或 complete ${taskId}`);
+          process.exit(1);
+        }
         const title = getArg('--title'); if (title) updates.title = title;
         // Clearable text fields: '' is a legitimate value, so gate on presence (!== null).
         const desc = getArg('--description'); if (desc !== null) updates.description = desc;

package/core/.formation/bifrost/launch.js

@@ -315,7 +315,7 @@ let stopPush = () => {};
 
 function killTree(child) {
   try {
-    if (process.platform === 'win32' && child.pid) execFileSync('taskkill', ['/PID', String(child.pid), '/T', '/F'], { stdio: 'ignore' }); // own child PID only
+    if (process.platform === 'win32' && child.pid) execFileSync('taskkill', ['/PID', String(child.pid), '/T', '/F'], { windowsHide: true, stdio: 'ignore' }); // own child PID only
     else child.kill('SIGTERM');
   } catch { /* already gone */ }
 }

package/core/.formation/tools/dispatch-detail/worktree-subagent-mode.md

@@ -15,7 +15,12 @@ waiting for a green build. The commit command (built by
 paths (`.kenaz/sessions`, `.kenaz/specialist`, `.formation/.dispatch-branch`,
 `.formation/analytics`) — never hand-type `git add -A` to replace it, and
 never delete the worktree yourself even after committing; the main thread
-owns worktree lifecycle.
+owns worktree lifecycle. When the main thread (or an agent told to clean up)
+must remove one, the only safe command is
+`node <core>/.formation/tools/worktree-reclaim.js remove <path>`: dispatch
+worktrees hold junctions into the main repo (node_modules, workspace links),
+and on Windows `git worktree remove --force` follows every one of them and
+empties the target (TASK_2485).
 
 ## Why "sending a message ends execution" is a hard rule
 

package/core/.formation/tools/kenaz-stats.js

@@ -75,7 +75,7 @@ function peerStats({ roots, now, days }) {
 }
 
 function git(cwd, ...args) {
-  return execFileSync('git', args, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 64 << 20 });
+  return execFileSync('git', args, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 64 << 20, windowsHide: true });
 }
 /** Commits of the repo (all refs): [{sha, parents, t, subject, firstParent, onHead}] newest first; null when not a git repo. */
 function readCommits(repo, sinceMs, untilMs) {

package/core/.formation/tools/post-complete/git-merge.js

@@ -2592,7 +2592,7 @@ Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>"`, { cwd: worktreePath }
         if (baseRef && fs.existsSync(checkScript)) {
           const gateProc = spawnSync(process.execPath, [
             checkScript, '--base', baseRef, '--head', taskBranch, '--repo', projectRoot, '--json',
-          ], { encoding: 'utf8' });
+          ], { windowsHide: true, encoding: 'utf8' });
           let gate = null;
           try { gate = JSON.parse((gateProc.stdout || '').trim() || '{}'); } catch { gate = null; }
           if (gate && Array.isArray(gate.blocks) && gate.blocks.length > 0) {

package/core/.formation/tools/prompt.js

@@ -187,7 +187,7 @@ function buildSubagentPrompt(skillDef, taskInput, taskData, options = {}) {
   lines.push('Before editing, grep the callers, tests and fixtures your change reaches; fix what it breaks. Least code that completes the card: reuse existing helpers, no unrequested abstraction, option or duplicate implementation.');
   lines.push('Run the tests the card names (narrow, not the full suite); say what you did not verify.');
   // The worktree branches off the project's current branch; user projects are not always on `main`.
-  const sizeBase = (require('child_process').spawnSync('git', ['rev-parse', '--abbrev-ref', 'HEAD'], { cwd: options.projectPath || process.cwd(), encoding: 'utf8' }).stdout || '').trim() || 'main';
+  const sizeBase = (require('child_process').spawnSync('git', ['rev-parse', '--abbrev-ref', 'HEAD'], { cwd: options.projectPath || process.cwd(), encoding: 'utf8', windowsHide: true }).stdout || '').trim() || 'main';
   const sizeCorePath = options.corePath || resolveCorePath(options.projectPath) || path.resolve(__dirname, '..', '..');
   lines.push(`Before reporting run \`node ${sizeCorePath}/dev/scripts/check-file-size.js --base ${sizeBase} --head HEAD\`; if it BLOCKs, split by responsibility (module / component / hook) first.`);
   const onBlocked = skillDef.collaboration && skillDef.collaboration.on_blocked;

package/core/.formation/tools/utils.js

@@ -63,10 +63,9 @@ function linkNodeModulesBestEffort(projectRoot, worktreePath) {
  * target (the main checkout's node_modules). Never throws.
  */
 function unlinkNodeModulesBestEffort(worktreePath) {
-  const hook = _loadWorktreeCreateHook();
-  if (!hook || typeof hook.unlinkNodeModulesLinks !== 'function') return;
-  try { hook.unlinkNodeModulesLinks(worktreePath); }
-  catch (e) { console.warn(`   ⚠️  node_modules unlink failed: ${(e && e.message) || 'unknown'}`); }
+  // TASK_2485: unlinks EVERY link (any name/depth); returns {removed, failed}. failed != [] => do not remove.
+  try { return require('./worktree-reclaim').unlinkAllLinks(worktreePath); }
+  catch (e) { console.warn(`   ⚠️  link unlink failed: ${(e && e.message) || 'unknown'}`); return { removed: [], failed: ['(unlink helper unavailable)'] }; }
 }
 
 /**
@@ -848,7 +847,8 @@ function removeWorktree(projectRoot, worktreePath, maxRetries = 3) {
   // TASK_1844/TASK_2030: MUST run before any `git worktree remove` -- Git for
   // Windows recurses through a node_modules junction/symlink on removal and
   // empties the link target (the main checkout's node_modules).
-  unlinkNodeModulesBestEffort(worktreePath);
+  const unl = unlinkNodeModulesBestEffort(worktreePath);
+  if (unl.failed.length) { console.warn(`   ⚠️  not removing ${worktreePath}: link(s) survive unlink: ${unl.failed.slice(0, 3).join(', ')}`); return false; }
   for (let i = 0; i < maxRetries; i++) {
     try {
       execSync(`git worktree remove --force "${worktreePath}"`, {

package/core/.formation/tools/worktree-reclaim.js

@@ -73,6 +73,66 @@ function walkTree(root) {
   return { size, newest, links, managedLinks };
 }
 
+/**
+ * TASK_2485: unlink EVERY symlink/junction under `root` (any name, any depth, also inside a real
+ * node_modules). lstat walk: a link is removed as a link and never entered. Measured on Windows:
+ * `git worktree remove --force` traverses every junction and empties its target (the main repo's
+ * node_modules, backend/.env, tracked files); fs.rmSync, Git Bash rm -rf and cmd rmdir /s do not.
+ * @returns {{removed:string[], failed:string[]}} paths relative to root
+ */
+function unlinkAllLinks(root) {
+  const removed = []; const failed = [];
+  const stack = [root];
+  while (stack.length) {
+    const dir = stack.pop();
+    let names;
+    try { names = fs.readdirSync(dir); } catch { continue; }
+    for (const name of names) {
+      const p = path.join(dir, name);
+      let st;
+      try { st = fs.lstatSync(p); } catch { continue; }
+      const rel = path.relative(root, p).replace(/\\/g, '/');
+      if (st.isSymbolicLink()) {
+        try { fs.unlinkSync(p); } catch { try { fs.rmdirSync(p); } catch { failed.push(rel); continue; } }
+        removed.push(rel);
+      } else if (st.isDirectory()) stack.push(p);
+    }
+  }
+  return { removed, failed };
+}
+
+/**
+ * The one safe removal: unlink all links, re-scan, then remove (git worktree remove --force when
+ * registered, fs.rmSync for orphan dirs). Refuses (ok:false) when a link survives or the path is
+ * not a worktree of this repo / under .formation/worktrees or .claude/worktrees.
+ * @returns {{ok:boolean, registered:boolean, unlinked:string[], reason?:string}}
+ */
+function safeRemoveWorktree(repo, target) {
+  const abs = path.resolve(target);
+  const { main, worktrees } = listRegisteredWorktrees(repo);
+  const registered = worktrees.some((w) => norm(w.path) === norm(abs));
+  const inside = (...dir) => { const rel = path.relative(path.join(repo, ...dir), abs); return !!rel && !rel.startsWith('..') && !path.isAbsolute(rel); };
+  const res = { ok: false, registered, unlinked: [] };
+  if (norm(abs) === norm(main.path)) return { ...res, reason: 'is the main checkout' };
+  if (!registered && !inside('.formation', 'worktrees') && !inside('.claude', 'worktrees')) return { ...res, reason: 'not a registered worktree and not under .formation/worktrees or .claude/worktrees' };
+  if (!fs.existsSync(abs) && !registered) return { ...res, ok: true, reason: 'already gone' };
+  const first = unlinkAllLinks(abs);
+  res.unlinked = first.removed;
+  const again = unlinkAllLinks(abs);
+  if (first.failed.length || again.removed.length || again.failed.length) {
+    return { ...res, reason: `cannot unlink: ${[...first.failed, ...again.removed, ...again.failed].slice(0, 5).join(', ')}` };
+  }
+  const rm = () => fs.rmSync(abs, { recursive: true, force: true, maxRetries: 3 });
+  try {
+    if (registered) {
+      try { git(main.path, ['worktree', 'remove', '--force', abs]); } catch { if (fs.existsSync(abs)) rm(); }
+    } else rm();
+  } catch (e) { return { ...res, reason: `remove failed: ${String(e.message).split('\n')[0]}` }; }
+  try { git(main.path, ['worktree', 'prune']); } catch { /* non-fatal */ }
+  const gone = !fs.existsSync(abs);
+  return { ...res, ok: gone, reason: gone ? undefined : 'directory still present (locked file?)' };
+}
+
 /** Uncommitted content beyond telemetry. Compares content (CRLF-only changes do not count). */
 function dirtyContent(wt) {
   const dirty = [];
@@ -177,7 +237,7 @@ function removeWorktree(repo, w, opts = {}) {
   const { main } = listRegisteredWorktrees(repo);
   // Drop dispatch's own node_modules links first: `git worktree remove` would
   // traverse a junction and empty its target (the main checkout's node_modules).
-  (opts.unlinkManaged || require('./utils').unlinkNodeModulesBestEffort)(w.path);
+  (opts.unlinkManaged || unlinkAllLinks)(w.path);
   const left = walkTree(w.path);
   if (left.links.length || left.managedLinks.length) {
     log(`KEPT ${w.path}: links still present after unlink: ${[...left.links, ...left.managedLinks].slice(0, 3).join(', ')}`);
@@ -256,4 +316,15 @@ function formatReport(evald) {
   ].join('\n')).join('\n') || '(no worktrees)';
 }
 
-module.exports = { evaluateWorktrees, ensureWorktreeSpace, reclaimAllEligible, listRegisteredWorktrees, formatReport, DEFAULT_MIN_IDLE_MS };
+// CLI for agents: node worktree-reclaim.js remove <path>   (never raw `git worktree remove` / rm -rf)
+if (require.main === module) {
+  const target = process.argv[2] === 'remove' ? process.argv[3] : null;
+  if (!target) { process.stderr.write('usage: node worktree-reclaim.js remove <worktree-or-orphan-dir>\n'); process.exit(2); }
+  let repo;
+  try { repo = path.dirname(git(process.cwd(), ['rev-parse', '--path-format=absolute', '--git-common-dir']).trim()); } catch { process.stderr.write('run from inside the repo\n'); process.exit(2); }
+  const r = safeRemoveWorktree(repo, target);
+  process.stdout.write(`${r.ok ? 'REMOVED' : 'REFUSED'} ${path.resolve(target)}${r.unlinked.length ? ` (unlinked ${r.unlinked.length} link(s): ${r.unlinked.slice(0, 5).join(', ')})` : ''}${r.reason ? ` - ${r.reason}` : ''}\n`);
+  process.exit(r.ok ? 0 : 1);
+}
+
+module.exports = { unlinkAllLinks, safeRemoveWorktree, evaluateWorktrees, ensureWorktreeSpace, reclaimAllEligible, listRegisteredWorktrees, formatReport, DEFAULT_MIN_IDLE_MS };