odoo-workspaces 2.1.0__tar.gz → 2.2.0__tar.gz

{odoo_workspaces-2.1.0 → odoo_workspaces-2.2.0}/AGENTS.md

@@ -12,6 +12,8 @@ src/
 │   │   ├── apply.py         # cmd_apply — make the tree match .ow/config.toml (--only narrows the git work, never the rendering)
 │   │   ├── status.py        # cmd_status + display helpers
 │   │   ├── rebase.py        # cmd_rebase + fact gathering, display, execution
+│   │   ├── pull.py          # cmd_pull + fact gathering, display, execution (fast-forward only)
+│   │   ├── reset.py         # cmd_reset + fact gathering, display, execution (git reset, per repo)
 │   │   ├── prune.py         # cmd_prune
 │   │   ├── rm.py            # cmd_rm — remove a workspace: worktrees, local branches, directory, index entry
 │   │   └── templates.py     # cmd_templates — list/take/diff template files; outdated_templates() used by cmd_apply
@@ -25,6 +27,9 @@ src/
 │   │   ├── paths.py         # ow's locations, resolved from the XDG base directories
 │   │   ├── refs.py          # fetch_workspace_refs
 │   │   ├── rebase_plan.py   # RepoFacts, GitStep, RebasePlan, plan_for (pure)
+│   │   ├── pull_plan.py     # PullFacts, PullPlan, plan_pull (pure)
+│   │   ├── reset_plan.py    # ResetFacts, ResetPlan, plan_reset (pure)
+│   │   ├── askpass.py       # SSH_ASKPASS broker: git children ask ow, ow asks the terminal
 │   │   ├── resolver.py      # resolve_workspace
 │   │   └── templates.py     # file generators, template resolution, application, materialization
 │   └── _static/
@@ -66,9 +71,12 @@ AGENTS.md
   - `index.py` — remembers where workspaces live (for name-based resolution and duplicate-branch checks), without owning the truth — the workspace's own `.ow/config.toml` is that.
   - `display.py` — `console`, `err_console`, `counts`, `print_git_result`.
   - `drift.py` — `DriftResult`, `check_drift`, `warn_if_drifted`. Detect when worktree branch state doesn't match config. Commands call `warn_if_drifted` to display warnings but proceed anyway.
-  - `git.py` — worktree operations: `create_worktree`, `attach_worktree`, `detach_worktree`, `worktree_exists`, `worktree_is_detached`, `get_worktree_branch`, `get_worktree_head`. Bare repo operations: `ensure_bare_repo`, `ensure_ref`. Ref/branch queries: `resolve_spec`, `resolve_spec_local`, `get_all_remote_refs`, `get_remote_ref_for_branch`, `get_remote_url`, `get_upstream`, `set_branch_upstream`, `is_branch_pushed`. Analysis: `rev_parse`, `is_ancestor`, `merge_base`, `count_commits`, `count_new_patches`, `count_unpushed`, `in_progress_operation`, `dirty_files`. Execution: `git`, `git_fetch`, `parallel_per_repo`, `run_cmd`.
+  - `git.py` — worktree operations: `create_worktree`, `attach_worktree`, `detach_worktree`, `worktree_exists`, `worktree_is_detached`, `get_worktree_branch`, `get_worktree_head`. Bare repo operations: `ensure_bare_repo`, `ensure_ref`. Ref/branch queries: `resolve_spec`, `resolve_spec_local`, `get_all_remote_refs`, `get_remote_ref_for_branch`, `get_remote_url`, `get_upstream`, `set_branch_upstream`, `is_branch_pushed`. Analysis: `rev_parse`, `is_ancestor`, `merge_base`, `count_commits`, `count_new_patches`, `count_unpushed`, `count_unbacked_commits`, `in_progress_operation`, `dirty_files`. Execution: `git`, `git_fetch`, `parallel_per_repo`, `run_cmd`.
   - `refs.py` — `fetch_workspace_refs` — three-phase pipeline for fetching workspace refs.
   - `rebase_plan.py` — `RepoFacts`, `GitStep`, `RebasePlan`, `plan_for` — pure analysis functions for rebase planning.
+  - `pull_plan.py` — `PullFacts`, `PullPlan`, `plan_pull` — pure analysis functions for fast-forward planning.
+  - `reset_plan.py` — `ResetFacts`, `ResetPlan`, `plan_reset` — pure analysis functions for reset planning.
+  - `askpass.py` — `broker()`, `child_env()`. Every git child runs in its own session and so has no controlling terminal; ssh therefore falls back to `SSH_ASKPASS`. The broker points it at a generated shim that forwards the prompt over a Unix socket to ow, which still owns the terminal. Prompts are serialised and answers cached per run. Entered once, in `__main__.main()`.
   - `resolver.py` — `resolve_workspace(name=None)` resolves a workspace: an explicit path, an explicit name (looked up via the index), the `OW_WORKSPACE` env var, or a cwd walk-up for `.ow/config.toml`. One rule, four branches, no fallback between them.
   - `templates.py` — `is_odoo_main_repo`, `find_addon_paths`, `build_template_context`, `apply_templates`, `ensure_workspace_materialized`, `available_templates`, `packaged_files`, `resolve_template_files` (local overrides win per file, packaged sibling still reachable via Jinja include/extends).
 
@@ -80,6 +88,8 @@ AGENTS.md
 | `ow apply` | `cmd_apply(config, workspace=None, *, only=None)` | Materialize worktrees + re-render templates |
 | `ow status` | `cmd_status(config, workspace=None)` | Show workspace branch status |
 | `ow rebase` | `cmd_rebase(config, workspace=None, *, only=None, autostash=False, dry_run=False, yes=False)` | Fetch + rebase workspace branches |
+| `ow pull` | `cmd_pull(config, workspace=None, *, only=None, dry_run=False)` | Fetch, then fast-forward each repo — or replay it on its own upstream, `git pull --rebase` style. Never moves a repo off its base ref; that stays `ow rebase` |
+| `ow reset` | `cmd_reset(config, workspace=None, *, only=None, hard=False, fetch=False, dry_run=False, yes=False)` | Put each repo back on the ref it follows — its branch's upstream, or the base ref when there is none. Plain form moves HEAD and leaves the working tree, so nothing on disk is lost; `--hard` discards it too. No fetch unless `-f`; skips a repo that is not on the branch the config names |
 | `ow prune` | `cmd_prune(config)` | Clean up stale worktree references, orphaned branches, dead index entries |
 | `ow rm` | `cmd_rm(name, *, yes=False)` | Remove a workspace: worktrees, local branches, directory, index entry |
 | `ow templates` | `cmd_templates(take=None, show_diff=False)` | List template files with their state, take one, or diff the stale ones |

{odoo_workspaces-2.1.0 → odoo_workspaces-2.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: odoo-workspaces
-Version: 2.1.0
+Version: 2.2.0
 Summary: Odoo workspace manager
 Author-email: Bruno BOI <boi@odoo.com>
 License: MIT

{odoo_workspaces-2.1.0 → odoo_workspaces-2.2.0}/docs/commands.md

@@ -8,6 +8,8 @@
 | `ow apply` | `[workspace]` | Re-render templates and materialize worktrees |
 | `ow status` | `[workspace]`, `-f/--fetch` | Show branch status with behind/ahead counts |
 | `ow rebase` | `[workspace]`, `--only`, `--autostash`, `--dry-run`, `-y/--yes` | Fetch and rebase repos in a workspace |
+| `ow pull` | `[workspace]`, `--only`, `--dry-run` | Fetch and fast-forward repos in a workspace |
+| `ow reset` | `[workspace]`, `--only`, `--hard`, `-f/--fetch`, `--dry-run`, `-y/--yes` | Put repos back on the refs they follow |
 | `ow prune` | `--dry-run`, `-y/--yes` | Clean up stale worktree references, orphaned branches, and dead index entries |
 | `ow rm` | `<name>`, `-y/--yes` | Remove a workspace: worktrees, local branches, directory, and index entry |
 | `ow ls` | — | List every known workspace, its path, and its repos |
@@ -111,6 +113,83 @@ ever pushed: the `git push --force-with-lease` stays yours.
 `--dry-run` fetches refs to show you what would happen, but runs no command that
 touches your worktrees.
 
+## `ow pull`
+
+Brings every repo of a workspace up to date without moving any of them off the
+base branch they are configured on. `ow rebase` is the command that does move
+them.
+
+```sh
+ow pull                                    # every repo of the current workspace
+ow pull parrot --only community            # one repo of a named workspace
+ow pull --dry-run                          # fetch, then print the plan — no worktree touched
+```
+
+Each repo follows its upstream when it has one — its own branch as pushed
+elsewhere — and its base ref otherwise.
+
+- already there: left alone
+- detached: re-detaches onto the fetched ref
+- behind: `git merge --ff-only`, which git refuses if the move would clobber a
+  local modification
+- diverged **from its upstream**: `git rebase <upstream>`, exactly what
+  `git pull --rebase` does — same branch, same base, nobody else's commits
+- diverged **from its base ref**, with no upstream: reported and left alone.
+  Carrying local work over to a moved base needs force-push detection and a
+  replay floor, and is `ow rebase`'s job
+
+A repo is also left alone, and the run exits non-zero, when a git operation is
+already in progress, when a replay would be needed but the worktree is dirty
+(the message names the files), when the worktree is missing, or when the fetch
+failed — moving onto the stale cached ref would look like success.
+
+On conflict during a replay, resolve, `git rebase --continue`, then re-run
+`ow pull --only <alias>`. Nothing is ever pushed.
+
+## `ow reset`
+
+Puts every repo back on the ref it follows — `git reset`, one repo at a time.
+Use it when a workspace has wandered, or when an upstream was force-pushed and
+you want the remote's version of the branch, whatever yours has become.
+
+```sh
+ow reset                                   # every repo of the current workspace
+ow reset parrot --only enterprise          # one repo of a named workspace
+ow reset --hard                            # discard the working tree too
+ow reset --hard -f                         # ... against freshly fetched refs
+ow reset --dry-run                         # print the plan, touch nothing
+```
+
+**The ref each repo is reset to** is the one `git reset @{u}` would have used:
+the branch's upstream — its own copy on a remote — or, for a branch nobody has
+pushed and for a detached repo, the base ref it was cut from. An attached branch
+is never reset onto its base: that would not put the repo back, it would throw
+the whole branch away.
+
+The two forms differ exactly as git's do:
+
+- `ow reset` moves HEAD and leaves the working tree alone. The commits are gone
+  from the branch, but their content is still on disk as unstaged changes —
+  **nothing on disk is lost**.
+- `ow reset --hard` discards the working tree as well. Untracked files are left
+  alone, exactly as `git reset --hard` leaves them; `git clean` is its own
+  command.
+
+No fetch by default: it resets to the refs already in the bare repos, the way
+`git reset origin/master` does. `-f/--fetch` refreshes them first, which is what
+an upstream that was force-pushed needs — otherwise you land on the copy the
+last fetch happened to cache.
+
+The summary counts what each repo loses before anything runs, and flags the
+commits no remote carries — the only ones a reset makes unrecoverable outside
+the reflog. The confirmation defaults to no; `-y/--yes` skips it.
+
+A repo is skipped, and the run exits non-zero, when a git operation is already
+in progress, when the worktree is missing, when its refs will not resolve
+locally, or when it is not on the branch the config names. That last one
+matters: resetting whatever else happens to be checked out would throw away
+work ow was never told about, and realigning is `ow apply`'s job.
+
 ## `ow prune`
 
 Cleans up stale worktree references and orphaned local branches from every bare repo, and drops

{odoo_workspaces-2.1.0 → odoo_workspaces-2.2.0}/src/odoo_workspaces.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: odoo-workspaces
-Version: 2.1.0
+Version: 2.2.0
 Summary: Odoo workspace manager
 Author-email: Bruno BOI <boi@odoo.com>
 License: MIT

{odoo_workspaces-2.1.0 → odoo_workspaces-2.2.0}/src/odoo_workspaces.egg-info/SOURCES.txt

@@ -30,6 +30,7 @@ src/odoo_workspaces.egg-info/top_level.txt
 src/ow/__init__.py
 src/ow/__main__.py
 src/ow/_version.py
+src/ow/askpass.py
 src/ow/_static/services/compose.yml.j2
 src/ow/_static/templates/bwrap/bwrap-claude.j2
 src/ow/_static/templates/bwrap/bwrap-opencode.j2
@@ -51,11 +52,14 @@ src/ow/commands/ls.py
 src/ow/commands/mv.py
 src/ow/commands/open.py
 src/ow/commands/prune.py
+src/ow/commands/pull.py
 src/ow/commands/rebase.py
+src/ow/commands/reset.py
 src/ow/commands/rm.py
 src/ow/commands/shell_init.py
 src/ow/commands/status.py
 src/ow/commands/templates.py
+src/ow/utils/askpass.py
 src/ow/utils/config.py
 src/ow/utils/display.py
 src/ow/utils/drift.py
@@ -63,9 +67,11 @@ src/ow/utils/git.py
 src/ow/utils/index.py
 src/ow/utils/legacy.py
 src/ow/utils/paths.py
+src/ow/utils/pull_plan.py
 src/ow/utils/rebase_plan.py
 src/ow/utils/refs.py
 src/ow/utils/relocate.py
+src/ow/utils/reset_plan.py
 src/ow/utils/resolver.py
 src/ow/utils/templates.py
 src/tests/__init__.py
@@ -82,8 +88,10 @@ src/tests/commands/test_misc_extended.py
 src/tests/commands/test_mv.py
 src/tests/commands/test_open.py
 src/tests/commands/test_prune.py
+src/tests/commands/test_pull.py
 src/tests/commands/test_rebase.py
 src/tests/commands/test_rebase_scenarios.py
+src/tests/commands/test_reset.py
 src/tests/commands/test_rm.py
 src/tests/commands/test_shell_init.py
 src/tests/commands/test_status.py
@@ -91,6 +99,7 @@ src/tests/commands/test_status_extended.py
 src/tests/commands/test_status_extended2.py
 src/tests/commands/test_templates_cmd.py
 src/tests/utils/__init__.py
+src/tests/utils/test_askpass.py
 src/tests/utils/test_config.py
 src/tests/utils/test_display.py
 src/tests/utils/test_drift.py
@@ -102,8 +111,10 @@ src/tests/utils/test_legacy.py
 src/tests/utils/test_misc.py
 src/tests/utils/test_paths.py
 src/tests/utils/test_progress.py
+src/tests/utils/test_pull_plan.py
 src/tests/utils/test_rebase_plan.py
 src/tests/utils/test_refs.py
+src/tests/utils/test_reset_plan.py
 src/tests/utils/test_resolve_template_files.py
 src/tests/utils/test_resolver.py
 src/tests/utils/test_templates.py

{odoo_workspaces-2.1.0 → odoo_workspaces-2.2.0}/src/odoo_workspaces.egg-info/scm_file_list.json

@@ -35,6 +35,7 @@
     "src/ow/_static/templates/vscode/.vscode/settings.json.j2",
     "src/ow/_static/templates/zed/.zed/debug.json.j2",
     "src/ow/_static/templates/zed/.zed/settings.json.j2",
+    "src/ow/askpass.py",
     "src/ow/commands/__init__.py",
     "src/ow/commands/apply.py",
     "src/ow/commands/archive.py",
@@ -44,11 +45,14 @@
     "src/ow/commands/mv.py",
     "src/ow/commands/open.py",
     "src/ow/commands/prune.py",
+    "src/ow/commands/pull.py",
     "src/ow/commands/rebase.py",
+    "src/ow/commands/reset.py",
     "src/ow/commands/rm.py",
     "src/ow/commands/shell_init.py",
     "src/ow/commands/status.py",
     "src/ow/commands/templates.py",
+    "src/ow/utils/askpass.py",
     "src/ow/utils/config.py",
     "src/ow/utils/display.py",
     "src/ow/utils/drift.py",
@@ -56,9 +60,11 @@
     "src/ow/utils/index.py",
     "src/ow/utils/legacy.py",
     "src/ow/utils/paths.py",
+    "src/ow/utils/pull_plan.py",
     "src/ow/utils/rebase_plan.py",
     "src/ow/utils/refs.py",
     "src/ow/utils/relocate.py",
+    "src/ow/utils/reset_plan.py",
     "src/ow/utils/resolver.py",
     "src/ow/utils/templates.py",
     "src/tests/__init__.py",
@@ -72,8 +78,10 @@
     "src/tests/commands/test_mv.py",
     "src/tests/commands/test_open.py",
     "src/tests/commands/test_prune.py",
+    "src/tests/commands/test_pull.py",
     "src/tests/commands/test_rebase.py",
     "src/tests/commands/test_rebase_scenarios.py",
+    "src/tests/commands/test_reset.py",
     "src/tests/commands/test_rm.py",
     "src/tests/commands/test_shell_init.py",
     "src/tests/commands/test_status.py",
@@ -84,6 +92,7 @@
     "src/tests/test_cli.py",
     "src/tests/test_main_extended.py",
     "src/tests/utils/__init__.py",
+    "src/tests/utils/test_askpass.py",
     "src/tests/utils/test_config.py",
     "src/tests/utils/test_display.py",
     "src/tests/utils/test_drift.py",
@@ -95,8 +104,10 @@
     "src/tests/utils/test_misc.py",
     "src/tests/utils/test_paths.py",
     "src/tests/utils/test_progress.py",
+    "src/tests/utils/test_pull_plan.py",
     "src/tests/utils/test_rebase_plan.py",
     "src/tests/utils/test_refs.py",
+    "src/tests/utils/test_reset_plan.py",
     "src/tests/utils/test_resolve_template_files.py",
     "src/tests/utils/test_resolver.py",
     "src/tests/utils/test_templates.py",

odoo_workspaces-2.2.0/src/odoo_workspaces.egg-info/scm_version.json

@@ -0,0 +1,8 @@
+{
+  "tag": "2.2.0",
+  "distance": 0,
+  "node": "g2cc2fc2b1e998c35d547d3da26e3f905919335c1",
+  "dirty": false,
+  "branch": "HEAD",
+  "node_date": "2026-09-11"
+}

{odoo_workspaces-2.1.0 → odoo_workspaces-2.2.0}/src/ow/__main__.py

@@ -14,14 +14,16 @@ from ow.commands import (
     cmd_mv,
     cmd_open,
     cmd_prune,
+    cmd_pull,
     cmd_rebase,
+    cmd_reset,
     cmd_rm,
     cmd_shell_init,
     cmd_status,
     cmd_templates,
     cmd_unarchive,
 )
-from ow.utils import index
+from ow.utils import askpass, index
 from ow.utils.config import Config, load_global_config, parse_branch_spec
 from ow.utils.display import err_console
 from ow.utils.legacy import check_legacy_layout
@@ -220,6 +222,31 @@ def rebase(
     )
 
 
+@app.command()
+def pull(
+    workspace: Optional[str] = typer.Argument(None, help=WORKSPACE_HELP, autocompletion=complete_workspace_name),
+    only: Optional[str] = typer.Option(None, "--only", help="Comma-separated repo aliases to pull (default: all)"),
+    dry_run: bool = typer.Option(False, "--dry-run", help="Show the git commands without running them"),
+) -> None:
+    """Fetch and fast-forward workspace branches."""
+    config = _load_config()
+    cmd_pull(config, workspace=workspace, only=only, dry_run=dry_run)
+
+
+@app.command()
+def reset(
+    workspace: Optional[str] = typer.Argument(None, help=WORKSPACE_HELP, autocompletion=complete_workspace_name),
+    only: Optional[str] = typer.Option(None, "--only", help="Comma-separated repo aliases to reset (default: all)"),
+    hard: bool = typer.Option(False, "--hard", help="Discard the working tree too, not just the commits"),
+    fetch: bool = typer.Option(False, "--fetch", "-f", help="Refresh the refs first, instead of resetting to what is already cached"),
+    dry_run: bool = typer.Option(False, "--dry-run", help="Show the git commands without running them"),
+    yes: bool = typer.Option(False, "--yes", "-y", help="Skip the confirmation prompt"),
+) -> None:
+    """Put workspace repos back on the refs they follow."""
+    config = _load_config()
+    cmd_reset(config, workspace=workspace, only=only, hard=hard, fetch=fetch, dry_run=dry_run, yes=yes)
+
+
 @app.command()
 def ls(
     archived: bool = typer.Option(False, "--archived", help="List archived workspaces instead of active ones"),
@@ -323,7 +350,8 @@ def open_ws(
 
 def main() -> None:
     try:
-        app()
+        with askpass.broker():
+            app()
     except KeyboardInterrupt:
         # 130 is the conventional shell status for SIGINT. The git children
         # are already gone, pool or no pool: each one runs in its own session

{odoo_workspaces-2.1.0 → odoo_workspaces-2.2.0}/src/ow/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '2.1.0'
-__version_tuple__ = version_tuple = (2, 1, 0)
+__version__ = version = '2.2.0'
+__version_tuple__ = version_tuple = (2, 2, 0)
 
-__commit_id__ = commit_id = 'g5f1a5e842'
+__commit_id__ = commit_id = 'g2cc2fc2b1'

odoo_workspaces-2.2.0/src/ow/askpass.py

@@ -0,0 +1,41 @@
+"""SSH_ASKPASS shim: ask the ow process that spawned git, print the answer.
+
+ssh execs this with the prompt as its first argument and reads the secret
+from its stdout. It runs in the git child's session, with no terminal of
+its own, so it forwards the question to the broker in ow — which still has
+one. See ow.utils.askpass.
+"""
+
+import base64
+import os
+import socket
+import sys
+
+
+def main() -> int:
+    sock_path = os.environ.get("OW_ASKPASS_SOCK")
+    if not sock_path:
+        return 1
+
+    prompt = sys.argv[1] if len(sys.argv) > 1 else ""
+    try:
+        with socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as conn:
+            conn.connect(sock_path)
+            conn.sendall(base64.b64encode(prompt.encode("utf-8")) + b"\n")
+            chunks: list[bytes] = []
+            while not chunks or not chunks[-1].endswith(b"\n"):
+                chunk = conn.recv(4096)
+                if not chunk:
+                    break
+                chunks.append(chunk)
+    except OSError:
+        return 1
+
+    payload = b"".join(chunks).strip()
+    answer = base64.b64decode(payload).decode("utf-8", "replace") if payload else ""
+    sys.stdout.write(answer + "\n")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

{odoo_workspaces-2.1.0 → odoo_workspaces-2.2.0}/src/ow/commands/__init__.py

@@ -6,7 +6,9 @@ from ow.commands.ls import cmd_ls
 from ow.commands.mv import cmd_mv
 from ow.commands.open import cmd_open
 from ow.commands.prune import cmd_prune
+from ow.commands.pull import cmd_pull
 from ow.commands.rebase import cmd_rebase
+from ow.commands.reset import cmd_reset
 from ow.commands.rm import cmd_rm
 from ow.commands.shell_init import cmd_shell_init
 from ow.commands.status import cmd_status
@@ -21,7 +23,9 @@ __all__ = [
     "cmd_mv",
     "cmd_open",
     "cmd_prune",
+    "cmd_pull",
     "cmd_rebase",
+    "cmd_reset",
     "cmd_rm",
     "cmd_shell_init",
     "cmd_status",

{odoo_workspaces-2.1.0 → odoo_workspaces-2.2.0}/src/ow/commands/prune.py

@@ -4,7 +4,8 @@ from typing import NamedTuple
 
 from ow.utils.display import confirm, err_console
 from ow.utils import index, paths
-from ow.utils.git import _run, is_branch_pushed, parallel_per_repo
+from ow.utils.config import load_workspace_config
+from ow.utils.git import _run, get_worktree_branch, is_branch_pushed, parallel_per_repo
 
 
 class _PrunePlan(NamedTuple):
@@ -51,7 +52,8 @@ def _survey_worktrees(bare_repo: Path) -> tuple[set[str], list[str]]:
 
     A prunable worktree's branch is deliberately not counted as in use: it
     is about to stop being attached to anything, and the branch pass has to
-    see the repo as it will be, not as it was.
+    see the repo as it will be, not as it was. What keeps that from eating a
+    live workspace's branch is _declared_branches(), not this listing.
     """
     result = _run(
         ["git", "-C", str(bare_repo), "worktree", "list", "--porcelain"],
@@ -60,7 +62,12 @@ def _survey_worktrees(bare_repo: Path) -> tuple[set[str], list[str]]:
     used: set[str] = set()
     stale: list[str] = []
     if result.returncode != 0:
-        return used, stale
+        # Not "nothing is in use": that reading turns every branch in the
+        # repo into an orphan candidate, which is the one direction this
+        # command must never fail in.
+        raise RuntimeError(
+            f"git worktree list failed: {result.stderr.strip() or 'no output'}"
+        )
 
     path: str | None = None
     branch: str | None = None
@@ -92,7 +99,57 @@ def _survey_worktrees(bare_repo: Path) -> tuple[set[str], list[str]]:
     return used, stale
 
 
-def _survey_bare_repo(bare_repo: Path) -> _PrunePlan:
+def _declared_branches() -> tuple[dict[str, set[str]], list[tuple[Path, str]]]:
+    """Per alias, the branches live workspaces own. Plus the configs that would not read.
+
+    git's worktree bookkeeping is not the only truth. A registration that
+    went stale — a directory moved by hand, a mount that was away when the
+    listing ran — makes git call the worktree prunable and its branch
+    unattached, while the workspace is still there and still says in its own
+    .ow/config.toml which branch it works on. Issue #50: prune offered to
+    delete exactly such a branch, and git refused it as in use.
+
+    Both the declared branch and the branch actually checked out are taken:
+    a worktree moved to a branch the config does not name is still work.
+    """
+    declared: dict[str, set[str]] = {}
+    unreadable: list[tuple[Path, str]] = []
+
+    # list_workspaces, not known_workspaces: the latter rewrites the index
+    # as it reads, and --dry-run and a declined confirmation must leave it
+    # exactly as they found it. Dead entries are dropped later, by the index
+    # pass that already owns that job.
+    for ws_dir in index.list_workspaces():
+        try:
+            config_file = ws_dir / ".ow" / "config.toml"
+            if not config_file.is_file():
+                # A dead index entry, not a workspace whose config is broken.
+                continue
+            ws = load_workspace_config(config_file)
+            owned_here: dict[str, set[str]] = {}
+            for alias, spec in ws.repos.items():
+                owned = owned_here.setdefault(alias, set())
+                if spec.local_branch:
+                    # A detached spec owns no branch.
+                    owned.add(spec.local_branch)
+                if (ws_dir / alias).is_dir():
+                    checked_out = get_worktree_branch(ws_dir / alias)
+                    if checked_out:
+                        owned.add(checked_out)
+        except Exception as exc:
+            # Unparseable, unreadable, on a directory that will not even
+            # stat: all the same answer — this workspace's branches cannot
+            # be named, so none of them can be shown to be orphaned.
+            unreadable.append((ws_dir, str(exc)))
+            continue
+
+        for alias, owned in owned_here.items():
+            declared.setdefault(alias, set()).update(owned)
+
+    return declared, unreadable
+
+
+def _survey_bare_repo(bare_repo: Path, protected: frozenset[str] = frozenset()) -> _PrunePlan:
     """Work out what would go from one bare repo, without touching it."""
     used_branches, stale = _survey_worktrees(bare_repo)
 
@@ -117,7 +174,7 @@ def _survey_bare_repo(bare_repo: Path) -> _PrunePlan:
 
     if branch_result.returncode == 0:
         all_branches = {b.strip() for b in branch_result.stdout.splitlines() if b.strip()}
-        for branch in sorted(all_branches - used_branches):
+        for branch in sorted(all_branches - used_branches - protected):
             if branch == head_branch:
                 # Never delete the branch HEAD points at — a dangling HEAD
                 # confuses every subsequent git command and looks like data loss.
@@ -268,14 +325,19 @@ def cmd_prune(*, dry_run: bool = False, yes: bool = False, also_backups: bool =
     leaves everything untouched, the index included.
     """
     dropped = _dead_index_entries()
+    declared, unreadable = _declared_branches()
 
     bare_repos_dir = paths.repos_dir()
-    bare_repos = sorted(bare_repos_dir.glob("*.git")) if bare_repos_dir.exists() else []
+    # Not every *.git under there is an alias: a stray `.git` directory
+    # matches the pattern too, and surveying it fails as "not a repository".
+    bare_repos = sorted(
+        p for p in bare_repos_dir.glob("*.git") if not p.name.startswith(".")
+    ) if bare_repos_dir.exists() else []
     if not bare_repos:
         print("No bare repos found.")
 
     surveyed = parallel_per_repo({
-        repo.stem: (lambda r=repo: _survey_bare_repo(r))
+        repo.stem: (lambda r=repo: _survey_bare_repo(r, frozenset(declared.get(r.stem, ()))))
         for repo in bare_repos
     })
     plans: list[_PrunePlan] = []
@@ -291,6 +353,20 @@ def cmd_prune(*, dry_run: bool = False, yes: bool = False, also_backups: bool =
     for alias, exc in survey_errors.items():
         err_console.print(f"  [{alias}] survey failed: {exc}", markup=False)
 
+    for ws_dir, reason in unreadable:
+        err_console.print(f"  [{ws_dir.name}] unreadable .ow/config.toml: {reason}", markup=False)
+    if unreadable:
+        # Which branches that workspace owns is exactly what could not be
+        # read, so no branch can be shown to be orphaned. The reversible
+        # work — stale worktrees, the index, backups — still happens.
+        err_console.print(
+            "  No branch will be deleted this run: ow cannot tell which branches that workspace owns."
+        )
+        plans = [
+            plan._replace(to_delete=[], kept=[*plan.kept, *plan.to_delete])
+            for plan in plans
+        ]
+
     _display_plan(plans)
     backups = _stale_backups() if also_backups else []
     _display_backups(backups)