source-control: babysit worktree pruner hard-depends on ghq (undeclared, author-personal repo-layout tool)

[kyle-sexton]

Plugin: source-control · Categories: hardcoded machine/user assumption (1), undeclared prerequisite (2)
Source: work-readiness sweep (read-only audit vs docs/PLUGIN-PHILOSOPHY.md + docs/MIGRATION-PLAYBOOK.md)

Findings

• plugins/source-control/skills/babysit-prs/scripts/prune_babysit_worktrees.py:21 — ALLOWED_EXECUTABLES = ("git", "gh", "ghq")
• :60-74 — repo_path(): run(["ghq", "list", "-p", …]) → fallback git config --get ghq.root then Path(root)/"github.com"/owner/repo → else raise RuntimeError("unable to resolve main checkout for {owner}/{repo}; install ghq or set ghq.root")
• :135 — called from remove_worktree() on every --apply removal

Why it breaks agnosticism

ghq is the author's personal repo-layout tool; a consumer without it gets a hard RuntimeError, and even the ghq.root fallback bakes ghq's <root>/github.com/owner/repo layout. Undeclared prerequisite: README:113-120 claims "Self-contained. Everything runs on git, gh, jq, and Bash scripts" — ghq appears nowhere, violating PLUGIN-PHILOSOPHY's "declare every required CLI at the point of use and in the README" and the graceful-degrade rule. Bites engine-backed (Python) runs — worker/autopilot/engine-backed-safe tiers.

Fix direction

Resolve the main checkout natively from worktree git metadata (git -C <worktree> rev-parse --git-common-dir) — the linked worktree already points at its main repo, making ghq unnecessary. If a ghq path is kept, make it a presence-gated enhancement with the native fallback, declared in README prerequisites.

[kyle-sexton]

This was generated by AI during triage.

Triage → T2 planning complete · confidence: high. Native resolution + removal verified empirically end-to-end on Windows (Git Bash), incl. the load-bearing self-delete edge case. ghq and repo_path confined to one file; patch is single-file. Labeling status: ready.

Drop the ghq hard-dependency; resolve the main checkout natively

Root cause

skills/babysit-prs/scripts/prune_babysit_worktrees.py resolves a PR's main checkout through ghq (ghq list -p …, then a git config --get ghq.root fallback baking in ghq's <root>/github.com/owner/repo layout). Without ghq, --apply removal raises RuntimeError("unable to resolve main checkout … install ghq or set ghq.root"). ghq is the author's personal tool and is undeclared (README claims "Self-contained. Everything runs on git, gh, jq, and Bash scripts"). The info ghq is asked for is already carried by the linked worktree's own git metadata — no external tool needed.

Behavioral contract

• Resolve the main checkout natively from the linked worktree's metadata. No ghq, no ghq.root, no layout assumption.
• --apply removal succeeds on a machine without ghq.
• README's self-contained claim becomes accurate again (ghq removed → no README edit needed here).

Why an external checkout must be resolved (verified)

On Windows, removing a worktree from inside itself fails: git -C <the-worktree> worktree remove <the-worktree> → Permission denied (exit 255) — Windows won't delete a live cwd/target. Running from the main checkout succeeds. So the caller needs a checkout path outside the target — exactly what the main worktree provides.

Exact git command (verified)

git -C <worktree> worktree list --porcelain lists the main working tree first, then linked worktrees. Take the first worktree line — authoritative for the working-tree location (unlike parent-of---git-common-dir, which breaks under --separate-git-dir/bare). Emits forward-slash absolute paths pathlib.Path consumes directly.

Patch (single file: skills/babysit-prs/scripts/prune_babysit_worktrees.py)

1. Drop ghq from the allowlist: ALLOWED_EXECUTABLES = ("git", "gh", "ghq") → ("git", "gh").

2. Replace ghq-based repo_path(owner, repo) with native resolution:

def main_checkout(worktree_path: Path) -> Path:
    """Resolve the repo's main working tree from a linked worktree's own metadata.

    A babysit worktree is a linked worktree (`git worktree add`), so it records
    the path back to its repo. `git worktree list` reports the main working tree
    first -- a checkout OUTSIDE this worktree, which the removal must run from:
    on Windows, removing a worktree whose path is also cwd/target fails with a
    sharing violation. No ghq or layout assumption required.
    """
    proc = run(["git", "-C", str(worktree_path), "worktree", "list", "--porcelain"])
    for line in proc.stdout.splitlines():
        if line.startswith("worktree "):
            return Path(line[len("worktree "):].strip())
    raise RuntimeError(f"unable to resolve main checkout for {worktree_path}")

3. Update the one caller remove_worktree (boundary check hoisted first — validate in-bounds before any git on the target; drop the now-redundant main_repo.exists() guard since git's worktree list only returns real paths):

def remove_worktree(worktree: Worktree, root: Path) -> None:
    resolved = worktree.path.resolve()
    allowed_root = root.resolve()
    if allowed_root not in resolved.parents:
        raise RuntimeError(f"refusing to remove worktree outside babysit root: {resolved}")
    main_repo = main_checkout(worktree.path)
    run(["git", "-C", str(main_repo), "worktree", "remove", str(worktree.path)])

Worktree.owner/.repo remain used elsewhere → no dataclass change.

Edge cases

• Windows self-delete (verified): porcelain main entry is always external to an owner__repo__pr-N linked worktree — the reason to resolve a checkout at all.
• .git file vs dir (verified): linked worktree has a .git file; porcelain unaffected.
• Windows paths (verified): absolute forward-slash paths; Path() consumes directly.
• Bare / --separate-git-dir main (reasoned): porcelain still correct; babysit never uses a bare main checkout, so not hit in practice, degrades correctly.

Acceptance criteria

• On a machine without ghq and no ghq.root, an --apply removal of a merged/closed PR worktree resolves the main checkout and removes successfully (no RuntimeError). (Verified empirically, git-only.)
• ghq no longer appears anywhere in the script; ALLOWED_EXECUTABLES == ("git", "gh").
• Dry run and the boundary guard unchanged.

Notes for the implementer

• Tests: no test for this script ships in the cache (0.9.0); CHANGELOG says tests were relocated/reorganized — a test likely lives in the source repo. If it mocks ghq/references repo_path, the PR must update it too (only item unverifiable from the cache; doesn't lower resolution confidence).
• Diff deviations to flag (so it isn't mistaken for a pure repo_path swap): boundary check hoisted; redundant main_repo.exists() guard dropped.
• ghq NOT kept as enhancement — native resolution is always correct regardless of root layout, fully subsuming the original ghq rationale; keeping it would be dead complexity.
• Deferred (out of scope for source-control: babysit worktree pruner hard-depends on ghq (undeclared, author-personal repo-layout tool) #438): the README "self-contained" bullet lists git/gh/jq/Bash but not Python, though this script is Python (Python 3.11+ is declared elsewhere) — a minor pre-existing doc inconsistency, not fixed here.