mandrel 2.31.0 → 2.32.0

package/.agents/scripts/lib/bootstrap/ci-workflow-template.js

@@ -1,212 +0,0 @@
-/**
- * bootstrap/ci-workflow-template — Story #1401 (Epic #1386)
- *
- * Renders the stabilized-quality-gates CI workflow YAML that
- * `/agents-bootstrap-github` writes (or refreshes) on a downstream project's
- * `.github/workflows/ci.yml`. Two design rules drive the shape:
- *
- *   1. **Lean on the diff-scoped default.** Story #1394 flipped both gate
- *      CLIs (`check-maintainability.js`, `check-crap.js`) to default
- *      `--changed-since=main`. The template no longer passes `--changed-since`
- *      explicitly on the per-PR job — the default already produces the right
- *      diff scope and an explicit re-statement risks drifting from the
- *      framework default at the next bump. The push-to-main job still passes
- *      `--full-scope` so a self-diff doesn't degrade to "no files in diff".
- *
- *   2. **Pin the baseline read to the PR's base branch via `BASELINE_REF`.**
- *      Inside `/deliver` the close-validation chain sets the same env var
- *      (`close-validation/gates.js` → `BASELINE_REF: origin/<baseBranch>`);
- *      on CI the equivalent surface is the PR's base branch. This is an
- *      ENV VAR, not a CLI flag: `check-baselines.js` resolves it through
- *      `resolveDispatchScope`, and the `--epic-ref` flag this template used
- *      to pass never existed on it — it was left over from the separate
- *      `check-crap.js` / `check-maintainability.js` CLIs that were unified
- *      away, and it named the ref `epic/<base>`, a branch the Story-only
- *      model never creates. When `BASELINE_REF` is empty (push-to-base,
- *      where there is no base to compare against) both gates fall through to
- *      the working-tree baseline, so the expansion is always safe.
- *
- * The renderer is a pure string template so the integration test can assert
- * on its exact shape without instantiating a YAML parser.
- *
- * @module bootstrap/ci-workflow-template
- */
-
-import fs from 'node:fs';
-import path from 'node:path';
-
-/**
- * @typedef {object} CiTemplateOptions
- * @property {string} [nodeVersion='22'] - Node major to install via setup-node.
- * @property {string} [baseRef='main'] - Default base ref the gate CLIs diff
- *   against. Surfaces as the workflow's `BASE_REF` env so the template stays
- *   tunable per consumer.
- * @property {boolean} [includeCrap=true] - Whether to render the CRAP step.
- *   Some downstream projects keep CRAP off until they have coverage wired.
- */
-
-/**
- * Render the CI workflow YAML body. The output is deterministic and safe to
- * write byte-for-byte over an existing template — the bootstrap caller is
- * responsible for diff-aware merging when an operator has hand-edited
- * `ci.yml`.
- *
- * @param {CiTemplateOptions} [opts]
- * @returns {string}
- */
-export function renderCiWorkflow(opts = {}) {
-  const nodeVersion = opts.nodeVersion ?? '22';
-  const baseRef = opts.baseRef ?? 'main';
-  const includeCrap = opts.includeCrap !== false;
-
-  const crapBlock = includeCrap
-    ? `
-      - name: CRAP Check
-        # Diff-scoped via the framework default (Story #1394 flipped
-        # --changed-since to '${baseRef}'). On PRs we let the default win;
-        # on push-to-main we pass --full-scope so a self-diff doesn't
-        # collapse to an empty file set. BASELINE_REF makes the gate read
-        # the baseline at the base branch tip via
-        # baseline-loader.readBaselineAtRef.
-        env:
-          BASELINE_REF: \${{ env.BASELINE_REF }}
-        run: |
-          mkdir -p temp
-          if [[ "\${{ github.event_name }}" == "pull_request" ]]; then
-            npm run crap:check -- --json temp/crap-report.json
-          else
-            npm run crap:check -- --full-scope --json temp/crap-report.json
-          fi
-
-      - name: Upload CRAP Report
-        uses: actions/upload-artifact@v4
-        if: always()
-        with:
-          name: crap-report
-          path: temp/crap-report.json
-`
-    : '';
-
-  return `# Generated by agents-bootstrap-github (Epic #1386 / Story #1401).
-# Re-run /agents-bootstrap-github to refresh this file. Hand edits are
-# preserved by the bootstrap helper when it detects operator changes —
-# inspect the diff before accepting an overwrite.
-name: CI
-
-on:
-  push:
-    branches: [${baseRef}]
-  pull_request:
-    branches: [${baseRef}]
-    types: [opened, synchronize, reopened]
-  workflow_dispatch:
-
-concurrency:
-  group: \${{ github.workflow }}-\${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  validate:
-    name: Validate and Test
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    env:
-      # Story #1120: on a PR the gate CLIs read the canonical baseline at
-      # the BASE branch tip via --baseline-ref (git show), not from the
-      # PR head's working tree — a branch that edited its own baseline
-      # must not be allowed to grade itself against the edit.
-      # Empty on push-to-${baseRef} (there is no base to compare against),
-      # where both gates fall through to the working-tree baseline, so the
-      # env-var expansion is always safe.
-      BASELINE_REF: \${{ github.event_name == 'pull_request' && format('origin/{0}', github.event.pull_request.base.ref) || '' }}
-      BASE_REF: ${baseRef}
-    steps:
-      - name: Checkout Code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '${nodeVersion}'
-          cache: 'npm'
-
-      - name: Install Dependencies
-        run: npm ci --ignore-scripts
-
-      - name: Lint and Format
-        run: |
-          npm run lint
-          npm run format:check
-
-      - name: Maintainability Check
-        # Story #1394 (Epic #1386): the gate CLI defaults --changed-since to
-        # the project's BASE_REF, so PRs no longer pass --changed-since
-        # explicitly. push-to-${baseRef} runs with --full-scope so the
-        # diff-scoped default doesn't degrade to a self-diff (= empty file
-        # set). BASELINE_REF pins the baseline read to the base branch tip.
-        env:
-          BASELINE_REF: \${{ env.BASELINE_REF }}
-        run: |
-          if [[ "\${{ github.event_name }}" == "pull_request" ]]; then
-            npm run maintainability:check
-          else
-            npm run maintainability:check -- --full-scope
-          fi
-
-      - name: Run Tests
-        run: npm test
-${crapBlock}`;
-}
-
-/**
- * Default workflow filename emitted by the bootstrap. Surfaced as a constant
- * so the integration test can assert the bootstrap writes to the canonical
- * path without re-deriving it.
- */
-export const CI_WORKFLOW_RELATIVE_PATH = '.github/workflows/ci.yml';
-
-/**
- * Render the stabilized-quality-gates CI workflow template into a project
- * checkout. Idempotent on the byte level: when `.github/workflows/ci.yml`
- * already matches the rendered template, no write occurs and the action is
- * `unchanged`. When the file is absent the action is `created`. When the
- * file exists with operator-authored differences the helper preserves it
- * and returns `custom-workflow-skip` along with the rendered body so the
- * bootstrap caller (or `/mandrel-update`) can offer a side-by-side diff.
- *
- * Network-free; safe to invoke under tests with a tmp `projectRoot`.
- *
- * Moved from `agents-bootstrap-github.js` to this module so it lives
- * alongside `renderCiWorkflow` and `CI_WORKFLOW_RELATIVE_PATH`
- * (Story #4048 B2 — dead-code deletion from the bootstrap entry point).
- *
- * @param {object} args
- * @param {string} args.projectRoot - Repo root (must contain or accept
- *   `.github/workflows/`).
- * @param {object} [args.template] - Forwarded to `renderCiWorkflow`.
- * @param {boolean} [args.write=true] - When `false`, the helper computes
- *   the would-be action without touching disk. Used by the
- *   bootstrap CLI's dry-run mode.
- * @returns {{ action: 'created'|'unchanged'|'custom-workflow-skip',
- *             path: string, rendered: string }}
- */
-export function ensureCiWorkflow(args) {
-  const projectRoot = args.projectRoot;
-  const rendered = renderCiWorkflow(args.template);
-  const target = path.join(projectRoot, CI_WORKFLOW_RELATIVE_PATH);
-  if (!fs.existsSync(target)) {
-    if (args.write !== false) {
-      fs.mkdirSync(path.dirname(target), { recursive: true });
-      fs.writeFileSync(target, rendered, 'utf8');
-    }
-    return { action: 'created', path: target, rendered };
-  }
-  const existing = fs.readFileSync(target, 'utf8');
-  if (existing === rendered) {
-    return { action: 'unchanged', path: target, rendered };
-  }
-  return { action: 'custom-workflow-skip', path: target, rendered };
-}

package/.agents/scripts/lib/checks/baseline-drift-main-checkout.js

@@ -1,104 +0,0 @@
-/**
- * baseline-drift-main-checkout — refuse-and-print check.
- *
- * Detects the close-validation-main-drift failure mode where `story-close`
- * (or any close-validation step) runs against the **main checkout** while a
- * corresponding worktree exists. The active branch in the main checkout is
- * usually drifted from the Story branch by stale formatting / MI-baseline
- * commits, and the close validation then refuses to merge.
- *
- * Pre-existing epic-branch format drift blocks every story close when the
- * validator hits the main checkout.
- *
- * Surface: `story-close` preflight and the `/diagnose` CLI. Surfaced as a
- * blocker — if the validator is running against the wrong tree, none of the
- * downstream gates are reliable.
- *
- * AutoCorrect is `refuse-and-print`. The fix is for the *operator* to `cd`
- * into the worktree; an auto-fix would mutate the process's cwd, which is
- * a footgun no other check assumes.
- *
- * Detection logic:
- *   1. If headRef is not a story branch (`story-<n>`), the check does not
- *      apply — only story-close runs in this scope, and only against a
- *      story branch. Returns null.
- *   2. If a worktree at `.worktrees/<headRef>/` does NOT exist, the check
- *      cannot say anything — the operator may legitimately be running in
- *      single-tree mode. Returns null.
- *   3. If the active cwd is the worktree path, all good. Returns null.
- *   4. Otherwise the validator is running against a different tree (the
- *      main checkout) while the worktree exists. Returns a blocker with
- *      the `cd <worktree>` recipe.
- */
-
-import path from 'node:path';
-import { isStoryBranch as isFlatStoryBranch } from '../git-utils.js';
-
-const ID = 'baseline-drift-main-checkout';
-
-export default {
-  id: ID,
-  severity: 'blocker',
-  scope: ['story-close', 'diagnose'],
-  autoCorrect: 'refuse-and-print',
-  detect(state) {
-    const headRef = state?.git?.headRef ?? null;
-    if (!headRef || !isStoryBranch(headRef)) return null;
-    const worktreePaths = state?.fs?.worktreePaths ?? [];
-    if (!Array.isArray(worktreePaths) || worktreePaths.length === 0) {
-      return null;
-    }
-    const expected = worktreePaths.find((p) => path.basename(p) === headRef);
-    if (!expected) return null; // worktree for this branch doesn't exist
-    const cwd = state?.cwd ?? '';
-    if (samePath(cwd, expected)) return null; // already in the worktree
-    return {
-      id: ID,
-      severity: 'blocker',
-      scope: state?.scope ?? '',
-      summary: `Close-validation running outside worktree (cwd: ${cwd}, expected: ${expected})`,
-      detail: [
-        `The active branch is ${headRef} and a worktree exists at ${expected},`,
-        `but the current working directory is ${cwd}.`,
-        '',
-        'Close-validation must run inside the Story worktree — the main checkout',
-        'may carry stale formatting or MI-baseline drift that will fail validation',
-        'even when the Story branch is clean.',
-      ].join('\n'),
-      fixCommand: `cd "${expected}"`,
-      autoCorrectable: false,
-    };
-  },
-};
-
-/**
- * Story branches use a flat `story-<n>` shape; the older
- * `story/epic-<id>/<n>` layout no longer applies. Accept both for forward
- * compatibility.
- *
- * @param {string} ref
- * @returns {boolean}
- */
-function isStoryBranch(ref) {
-  return isFlatStoryBranch(ref) || /^story\/epic-\d+\/\d+$/.test(ref);
-}
-
-/**
- * Compare two paths normalized for the platform. Windows is case-insensitive
- * and uses backslashes; POSIX is case-sensitive. We normalize both sides
- * with `path.resolve` so the comparison is stable regardless of trailing
- * separators or `./` prefixes.
- *
- * @param {string} a
- * @param {string} b
- * @returns {boolean}
- */
-function samePath(a, b) {
-  if (!a || !b) return false;
-  const na = path.resolve(a);
-  const nb = path.resolve(b);
-  if (process.platform === 'win32') {
-    return na.toLowerCase() === nb.toLowerCase();
-  }
-  return na === nb;
-}

package/.agents/scripts/lib/checks/push-hook-parity.js

@@ -1,106 +0,0 @@
-/**
- * push-hook-parity — refuse-and-print check.
- *
- * Detects when the pre-push gates (biome check, MI gate) would fail at
- * `git push` time, BEFORE merge commits land. Biome check and the MI
- * gate fire at push time (not lint time), so an apparently-clean commit
- * cascade can still get stuck at the actual push step.
- *
- * Surface: `/diagnose` CLI. The gates execute against HEAD in dry-run
- * mode (no working-tree mutation) and report pass/fail. This check is
- * intentionally scoped to `diagnose` rather than `story-close` because:
- *
- *   - story-close already runs the full validation chain (typecheck,
- *     lint, test, format, MI, coverage, crap) against the worktree. The
- *     gates are part of that chain. Running them twice in preflight is
- *     wasteful.
- *   - /diagnose is the surface where the operator wants a fast pre-push
- *     verdict ("would this commit pass the push hook?"). That's exactly
- *     what this check answers.
- *
- * The gate runs live in `state.js`'s `gates.*` projection so they are
- * memoized by `(scope, cwd)` and the heavy spawn cost is paid at most
- * once per assembly. Tests inject a fake `gates` probe to drive the
- * specific pass/fail scenarios without spawning real binaries.
- *
- * AutoCorrect is `refuse-and-print`. The fix is "run the gate locally
- * and address its findings" — there is no safe auto-fix because we
- * cannot mutate the working tree to satisfy MI baseline regressions
- * without making domain decisions about which file to touch.
- */
-
-const ID = 'push-hook-parity';
-
-export default {
-  id: ID,
-  severity: 'blocker',
-  scope: ['diagnose'],
-  autoCorrect: 'refuse-and-print',
-  detect(state) {
-    const gates = state?.gates ?? {};
-    const biome = gates.biome;
-    const miGate = gates.miGate;
-    // If neither gate ran (state.js was assembled for a scope without
-    // gates.* keys), the check has nothing to say. Returning null avoids
-    // a false positive when the consumer happens to share state across
-    // scopes.
-    if (!biome && !miGate) return null;
-    const failed = [];
-    if (biome && !biome.ok)
-      failed.push({ name: 'biome', output: biome.output });
-    if (miGate && !miGate.ok)
-      failed.push({ name: 'miGate', output: miGate.output });
-    if (failed.length === 0) return null;
-    const failedNames = failed.map((f) => f.name).join(' + ');
-    const detailLines = failed.map(
-      (f) => `  - ${f.name}:\n${indent(f.output ?? '(no output)')}`,
-    );
-    return {
-      id: ID,
-      severity: 'blocker',
-      scope: state?.scope ?? '',
-      summary: `pre-push gate(s) would fail at push time: ${failedNames}`,
-      detail: [
-        'These gates run on `git push`, not on `git commit`, so the working',
-        'tree looks clean but the push will be rejected. Resolve before merging:',
-        '',
-        ...detailLines,
-      ].join('\n'),
-      fixCommand: buildFixCommand(failed.map((f) => f.name)),
-      autoCorrectable: false,
-    };
-  },
-};
-
-/**
- * Build the literal command(s) the operator should run locally to see the
- * same failure the push hook would surface. Each gate has its own canonical
- * invocation; chaining with `&&` lets the operator copy-paste the whole
- * recipe as one line.
- *
- * @param {string[]} gateNames
- * @returns {string}
- */
-function buildFixCommand(gateNames) {
-  const recipes = {
-    biome: 'npx biome check .',
-    miGate: 'npm run check:maintainability',
-  };
-  return gateNames
-    .map((g) => recipes[g] ?? `# unknown gate: ${g}`)
-    .join(' && ');
-}
-
-/**
- * Indent every line of `text` by two spaces so multi-line gate output
- * renders cleanly inside the bullet list in `detail`.
- *
- * @param {string} text
- * @returns {string}
- */
-function indent(text) {
-  return String(text)
-    .split('\n')
-    .map((line) => `    ${line}`)
-    .join('\n');
-}

package/.agents/scripts/lib/checks/windows-coverage-noise-floor.js

@@ -1,92 +0,0 @@
-/**
- * windows-coverage-noise-floor — refuse-and-print warning check.
- *
- * Detects coverage-gate deltas that are within the Windows / Node-22
- * noise floor — i.e., tiny fractional branch-coverage swings that vary
- * run-to-run and would chase the gate to a different file if the
- * operator ratcheted from a flapping CI artifact. The canonical mistake
- * is to fetch a failing run's coverage delta and bump the baseline by
- * that delta, which simply moves the noise floor to another file rather
- * than stabilising the gate.
- *
- * Scope: 'story-close', 'retro'. The check is `warning` severity (not
- * `blocker`) because flapping is informational — the operator decides
- * whether to ratchet, skip, or investigate. Coverage-blocking belongs
- * to a separate baseline-refresh gate.
- *
- * The check is `refuse-and-print`. A `fix()` here would mean either
- * suppressing the flap (which silently lowers signal) or ratcheting
- * (which is the very mistake the check exists to prevent). The
- * fixCommand advises against ratcheting from a flapping artifact.
- *
- * Input shape — the check reads `state.coverage`:
- *   {
- *     branchDelta: number,         // signed fractional delta (e.g. 0.0015 = +0.15%)
- *     noiseFloor?: number,         // optional override; default 0.0025
- *     file?: string,               // optional file the delta is attributed to
- *   }
- *
- * Returns null when `state.coverage` is absent (the assembler does not
- * always populate coverage; absent input is a no-op rather than a
- * failure).
- */
-
-const DEFAULT_NOISE_FLOOR = 0.0025; // 0.25%
-
-const FIX_COMMAND = [
-  '# Do NOT ratchet the coverage baseline from a flapping CI artifact.',
-  '# A delta within the Windows / Node-22 noise floor (< 0.25% by default)',
-  '# is run-to-run jitter, not real coverage loss. Ratcheting in response',
-  '# moves the noise floor to a different file rather than fixing it.',
-  '#',
-  '# Instead: re-run the gate. If the delta persists across multiple runs',
-  '# in the same file, investigate the specific test that flipped — most',
-  '# often a Date.now() / Math.random() leak into the branch decision.',
-  '#',
-  '# If the delta is real but small, capture a fresh baseline-refresh',
-  '# commit deliberately, separate from the failing PR.',
-].join('\n');
-
-export default {
-  id: 'windows-coverage-noise-floor',
-  severity: 'warning',
-  scope: ['story-close', 'retro'],
-  autoCorrect: 'refuse-and-print',
-
-  detect(state) {
-    const cov = state?.coverage;
-    if (!cov || typeof cov !== 'object') return null;
-    if (typeof cov.branchDelta !== 'number' || Number.isNaN(cov.branchDelta)) {
-      return null;
-    }
-    const noiseFloor =
-      typeof cov.noiseFloor === 'number' && cov.noiseFloor > 0
-        ? cov.noiseFloor
-        : DEFAULT_NOISE_FLOOR;
-    const absDelta = Math.abs(cov.branchDelta);
-    // Within (or equal to) the floor → flapping → warning.
-    // Above the floor → real signal → return null and let the actual
-    // coverage gate decide.
-    if (absDelta > noiseFloor) {
-      return null;
-    }
-    const deltaPct = (cov.branchDelta * 100).toFixed(3);
-    const floorPct = (noiseFloor * 100).toFixed(3);
-    const fileNote = cov.file ? ` (file: ${cov.file})` : '';
-    return {
-      id: 'windows-coverage-noise-floor',
-      severity: 'warning',
-      scope: state?.scope ?? 'story-close',
-      summary: `Branch-coverage delta ${deltaPct}% is within the Windows noise floor (${floorPct}%) — likely flap, do not ratchet${fileNote}`,
-      detail: [
-        `branchDelta: ${cov.branchDelta}`,
-        `noiseFloor: ${noiseFloor}`,
-        cov.file ? `attributedFile: ${cov.file}` : null,
-      ]
-        .filter(Boolean)
-        .join('\n'),
-      fixCommand: FIX_COMMAND,
-      autoCorrectable: false,
-    };
-  },
-};

package/.agents/scripts/lib/checks/worktree-bootstrap-env.js

@@ -1,81 +0,0 @@
-/**
- * worktree-bootstrap-env — refuse-and-print check.
- *
- * Detects active worktrees that are missing the `.env` or `.mcp.json`
- * bootstrap files. These files are intentionally untracked in git, so a
- * freshly-created worktree under `.worktrees/<story>/` does not get them
- * unless the orchestration explicitly copies them. When they are missing,
- * tests that read environment variables silently take a different code
- * path.
- *
- * Surface: the `/diagnose` CLI. Surfaced as a
- * warning rather than a blocker — the missing file may be a deliberate
- * choice (e.g. a worktree that doesn't need MCP), but the operator should
- * see the divergence from the main checkout.
- *
- * AutoCorrect is `refuse-and-print`. Copying `.env` between trees is
- * defensible at the orchestration layer (`worktree.bootstrap` step) but
- * not as a self-healing fix — the contents are project-specific and may
- * include secrets the check explicitly never reads.
- *
- * Privacy: this check reads only the bootstrap *status* projection
- * (`fs.worktreeBootstrapStatus`) which records presence per worktree, not
- * file contents. The Finding's `detail` never exposes any env-var value.
- */
-
-const ID = 'worktree-bootstrap-env';
-
-export default {
-  id: ID,
-  severity: 'warning',
-  scope: ['diagnose'],
-  autoCorrect: 'refuse-and-print',
-  detect(state) {
-    const status = state?.fs?.worktreeBootstrapStatus ?? {};
-    const entries = Object.entries(status);
-    if (entries.length === 0) return null;
-    const missing = entries
-      .map(([wtPath, files]) => {
-        const missingFiles = [];
-        if (!files.dotEnv) missingFiles.push('.env');
-        if (!files.dotMcp) missingFiles.push('.mcp.json');
-        return { wtPath, missingFiles };
-      })
-      .filter((entry) => entry.missingFiles.length > 0);
-    if (missing.length === 0) return null;
-    const detailLines = missing.map(
-      (m) => `  - ${m.wtPath}: missing ${m.missingFiles.join(', ')}`,
-    );
-    return {
-      id: ID,
-      severity: 'warning',
-      scope: state?.scope ?? '',
-      summary: `${missing.length} worktree(s) missing bootstrap files (.env / .mcp.json)`,
-      detail: [
-        'Worktrees with missing bootstrap files:',
-        ...detailLines,
-        '',
-        'Tests that read these vars will silently degrade in the affected worktrees.',
-      ].join('\n'),
-      fixCommand: buildFixCommand(missing),
-      autoCorrectable: false,
-    };
-  },
-};
-
-/**
- * Build a copy recipe the operator can run from the main checkout. Each
- * missing file gets its own `cp` line targeting the affected worktree.
- *
- * @param {Array<{wtPath: string, missingFiles: string[]}>} missing
- * @returns {string}
- */
-function buildFixCommand(missing) {
-  const lines = [];
-  for (const { wtPath, missingFiles } of missing) {
-    for (const file of missingFiles) {
-      lines.push(`cp "${file}" "${wtPath}/${file}"`);
-    }
-  }
-  return lines.join(' && ');
-}

package/.agents/scripts/lib/checks/worktree-residue-biome.js

@@ -1,55 +0,0 @@
-/**
- * worktree-residue-biome — refuse-and-print check.
- *
- * Detects partial-reap residue under `.worktrees/` where a previous Story's
- * tree was deleted incompletely and left a nested `biome.json` behind. The
- * root `npm run lint` walks into the orphan tree, hits the nested config,
- * and fails. The close-time biome block is the canonical symptom.
- *
- * Surface: `story-close` preflight, the `/diagnose` CLI, and retro.
- * Surfaced as a blocker so the operator clears the residue
- * with `rm -rf` before close re-runs the validation chain.
- *
- * AutoCorrect is `refuse-and-print`. Recursive deletion under `.worktrees/`
- * is technically blessed by the README, but the residue may include
- * partially-merged work the operator wants to inspect first. We print the
- * exact `rm -rf` recipe rather than running it.
- */
-
-const ID = 'worktree-residue-biome';
-
-export default {
-  id: ID,
-  severity: 'blocker',
-  scope: ['story-close', 'diagnose', 'retro'],
-  autoCorrect: 'refuse-and-print',
-  detect(state) {
-    const orphans = state?.fs?.worktreeBiomeOrphans ?? [];
-    if (!Array.isArray(orphans) || orphans.length === 0) return null;
-    const lines = orphans.map((p) => `  - ${p}`).join('\n');
-    return {
-      id: ID,
-      severity: 'blocker',
-      scope: state?.scope ?? '',
-      summary: `${orphans.length} orphan worktree(s) with nested biome.json — root biome lint will fail`,
-      detail: `Nested biome.json files found under .worktrees/ subdirectories:\n${lines}\n\nThese block root \`npm run lint\` because biome walks into them and resolves the nested config.`,
-      fixCommand: buildFixCommand(orphans),
-      autoCorrectable: false,
-    };
-  },
-};
-
-/**
- * Build the `rm -rf` command(s) the operator should run to clear the
- * residue. Multiple orphans get a single chained command so it can be
- * copy-pasted as one line.
- *
- * @param {string[]} orphans
- * @returns {string}
- */
-function buildFixCommand(orphans) {
-  if (orphans.length === 0) return '';
-  // Each path is already an absolute orphan worktree directory; deleting
-  // the whole directory is the canonical reap recipe.
-  return orphans.map((p) => `rm -rf "${p}"`).join(' && ');
-}