fix(repo-hygiene): finish the #3346 clean-skill ladder and make the #3852 guard prose decision-neutral - #5319
Merged
Merged
Conversation
…ard prose Refs #3346 - clean SKILL: git-prune, git-tree-reset, remove-path and tree-batch apply steps carry the CLEAN_GUARD_ACK prefix - git-tree-reset context: hook interaction states that --apply is blocked without the prefix - drop the duplicated argument list, point at the action router - note that preflight facts are as of the dry-run and planned bytes may exceed removed bytes Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EugXnFddtpHcY5gTuyEirB
…ecision Refs #3852 Refs #3346 - guard header, clean SKILL, README: say the guard does not match `git branch -D`/`-d` or `git push --delete` as of 2026-09-29 and that whether it should is open on #3852, replacing the settled-gap wording - drop unsourced claims (remote deletion not a sanctioned path, permission-flow gating, undefined paid slice); keep a claim/basis/as-of/recheck record - header: coverage is whatever is_destructive() lists; record the --apply and forced worktree remove additions with their own record - allowed-tools-pairing test header: drop the false "matches none of these six scripts" - destructive-guard.test.sh: retitle the allow-loop label only; is_destructive() and all assertions unchanged Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EugXnFddtpHcY5gTuyEirB
…prefix Refs #3346 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EugXnFddtpHcY5gTuyEirB
…e, point off-default clones at /repo-fleet-hygiene:sync The branch audit reports the checkout path of a WORKTREE branch on a `Worktree:` line, leaving the nine-column tip capture unchanged. The git action invokes `/source-control:worktree cleanup --dry-run` for those branches, lets it own removal, and re-audits. A clone blocked by being off the default branch is fixed by `/repo-fleet-hygiene:sync`, presented as a command, not invoked. Refs #3346 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EugXnFddtpHcY5gTuyEirB
`clean-batch.sh --tier scan` runs the unchanged scan.sh per selected repo with the shared repo resolution and skip list, prints a per-repo `Outcome: scanned`, and closes with `Summary: repos=N planned=0 bytes=K` (K the summed `Total reclaimable`). It writes no plan; `--apply` and `--batch-plan` with it are usage errors. resolve-clean-action.sh gains `scan-batch`, `scan-fleet`, and `inventory-batch`; the router, SKILL.md, clean-batch.md, and evals follow. Refs #3346 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EugXnFddtpHcY5gTuyEirB
git-branch-audit.sh and git-stash-audit.sh take clean-batch's repo selection (--repo, --repos-from, --skip, --skip-from) through lib/batch-common.sh. Each repo prints as a `Repo: <path>` block; linked worktrees sharing a git common dir are audited once, a skipped, unresolvable, or failing repo is reported without stopping the rest, and `FleetSummary:` closes the run with exit 0. --capture-file with more than one repo is a usage error; each repo writes its own capture. With no selection flag the output is unchanged. Deletion is not batched: git-branch-delete.sh resolves the repo from the working directory and refuses a capture whose `# common_dir:` is another repo's, so the docs say to run it from inside the audited repo. SKILL.md, the branch-cleanup and clean-batch context, and the README follow; the manual StashStore dedup step is now built in. Refs #3346 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EugXnFddtpHcY5gTuyEirB
Refs #3346 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EugXnFddtpHcY5gTuyEirB
…anch git-branch-audit.sh spawned about six git processes per branch (tip, upstream, commits ahead and behind, commits absent from origin/<default>, loss count). It now reads them together: - one for-each-ref carries each branch's tip, upstream and ahead/behind summary - one `rev-list --parents --stdin --not origin/<default>` and one `... --not --remotes --tags` give the commits absent from origin/<default> and the LOSSY loss count for every tip (clean_unreached_counts), the number `git rev-list --count <tip> --not <rev>...` prints per tip; other local branches still do not count as "elsewhere" - one read of the worktree porcelain gives every WORKTREE branch's path A branch whose record cannot be trusted (a short name ambiguous with a tag or remote, a `[gone]` upstream whose ref exists, an unrecognized ahead/behind summary) and any pass that fails take the previous per-branch commands, so a verdict never depends on which path answered. The LossCommit listing stays one `git log` per LOSSY branch: a shared walk can order commits differently when dates tie or skew. On a 242-branch fixture the audit went from 1404 to 110 git calls, of which 83 are the per-LOSSY-branch listings; stdout and the tip capture are identical. The suite holds the bulk facts equal to the per-branch reads on every fixture, bounds the calls outside the listings independent of the branch count, and checks a failed pass gives the same report. Refs #3346 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EugXnFddtpHcY5gTuyEirB
Refs #3346 Refs #3852 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EugXnFddtpHcY5gTuyEirB
Contributor
|
PR body contract — issue linkage This PR body conforms to the issue-linkage contract. Nothing to do. |
…aside Refs #3346 Refs #3852 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EugXnFddtpHcY5gTuyEirB
…bash lookup Every hook row runs `node hooks/exec-bash.mjs`, and Claude Code's native binary neither ships nor uses Node, so without it the destructive guard does not launch. The README gains a Requirements section, `setup check` gains a node row probed through Bash, and its bash lookup names the PATH step the launcher gains in #5309. Refs #3708 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EugXnFddtpHcY5gTuyEirB
…nd invocation docs Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EugXnFddtpHcY5gTuyEirB
kyle-sexton
marked this pull request as ready for review
September 29, 2026 16:04
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Contributor
|
Claude finished @kyle-sexton's task in 2m 21s —— View job Security review (
|
Contributor
|
Claude finished @kyle-sexton's task in 5m 38s —— View job Review in progress
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2ae4d21ee1
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Add the four-part verification record (claim, basis, as-of, recheck) for the statement that Claude Code's native binary neither ships nor uses Node. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
|
Claude finished @kyle-sexton's task in 3m 27s —— View job Reviewing PR #5319
|
Contributor
|
Claude finished @kyle-sexton's task in 2m 9s —— View job Security review (
|
kyle-sexton
added a commit
that referenced
this pull request
Sep 30, 2026
…he clean skill (#5364) Closes #3852 ## Summary The clean skill's destructive guard now matches bare `git branch -D/-d/--delete` and remote-branch deletion (`git push --delete`, `git push -d`, `git push origin :ref`, `git push origin +:ref`). This implements the owner decision on #3852 (Option A): the guard stays a best-effort net, the `CLEAN_GUARD_ACK` path lifts the block, the `--apply` coverage from #5130 is ratified, and the host-permission interaction stays as documented. ## Fix - `destructive-guard.sh`: `is_destructive()` matches a `git branch` delete-flag cluster or `--delete`, and `git push` with `--delete`, a `-d` cluster, or a `:`- or `+:`-prefixed refspec. A quoted delete flag (`"--delete"`, `"-d"`) matches too. `git branch -a/-r/-vv/--list/--show-current`, `git push origin main`, `HEAD:refs/heads/x` and `--dry-run`/`-n` deletes stay allowed; a fused `-o<value>` push option is not read as a dry-run. Known gap, in line with the best-effort net: a separate `-o -n` (push option value `-n`) reads as a dry-run and is allowed. `git-branch-delete.sh` deletes with `git update-ref -d`, so the confirmed flow is unaffected. - The global-option prefix (`gopt`) now also accepts flag-only options (`-p`, `-P`, `--no-pager`) beside `-C <path>`, `-c <cfg>` and `--opt=value`. Every git pattern shares it, so `git --no-pager clean -fd` and the other existing `clean`, `reset --hard`, `checkout --`, `stash drop`/`clear` and `worktree remove` forms are now blocked after those options too. The CHANGELOG records this. - `destructive-guard.test.sh`: the four spellings pinned as allowed now block; added block, allow and ack (Bash and PowerShell) cases, including flag-only globals, `+:ref`, quoted flags and `-o` push options. - Guard header, `SKILL.md` frontmatter and body, README, and `allowed-tools-pairing.test.sh` state the new coverage together, with no claim beyond what the guard provides: the ack prefix is described as the documented way to run a bare `git branch -D`, not the only way (`git --work-tree <path> branch -D x`, an alias, or disabling the guard also run it). - `repo-hygiene` 0.14.0 (above main's 0.13.0) with a CHANGELOG entry. ## Verification - `bash plugins/repo-hygiene/skills/clean/scripts/destructive-guard.test.sh`: All 219 checks passed. - `bash plugins/repo-hygiene/scripts/allowed-tools-pairing.test.sh`: passed. - All 17 repo-hygiene `*.test.sh` suites pass, including `git-branch-delete.test.sh`. - `scripts/check-changelog-parity.sh --check --check-order`: passed after merging `main` (0.14.0 above 0.13.0). - `scripts/validate-plugins.sh`: all manifests and the catalog validated. - Not run: `skill-quality:check` on `skills/clean`. ## Related - Parent audit: #3346 (finding D1). - Earlier PRs: #4966, #5130, #5319. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refs: #3346
Refs: #3852
Refs: #3708
Summary
Finishes the
/repo-hygiene:cleanladder for #3346 (read-only scan tier, cross-repo branch and stash audits, bulk fact reads, WORKTREE branches handed to/source-control:worktree, off-default clones pointed at/repo-fleet-hygiene:sync) and makes the branch-deletion guard prose for #3852 decision-neutral: it states current coverage and the open question without recording a decision. Declares Node.js as arepo-hygieneprerequisite (#3708). Releasesrepo-hygiene0.11.0.Fix
clean-batch.sh --tier scan, plus read-onlygit-branch-audit.sh/git-stash-audit.shacross repos; branch deletion is never batched.git-branch-audit.shreads branch facts in bulk instead of per branch (1404 to 110 git calls on a 242-branch fixture).setup checkand the README declare Node.js as a prerequisite (cross-group request fromhook-launcher, check-hook-exec-form: no gate-legal way to name Git Bash on Windows, which blocks every bash exec-form row #3708): every hook row runsnode hooks/exec-bash.mjsand Claude Code's native binary does not ship Node.setup checkgains anoderow probed through Bash, and its bash lookup names thePATHstep. Extends the 0.11.0 CHANGELOG entry; no second bump.plugin.json0.10.57 to 0.11.0 with one CHANGELOG entry. The fix plan left the version to shipping; this branch bumps it because the added features are semver-minor, and shipping may re-cut it. One in-place edit to a released entry, declared per the changelog policy: the 0.10.55clean-batch.shpreflight bullet was reflowed (whitespace only).repo-fleet-hygiene) and its reserved open question; repo-hygiene:clean: decide whether the destructive guard should cover branch and remote-branch deletion #3852 needs the owner's answer; check-hook-exec-form: no gate-legal way to name Git Bash on Windows, which blocks every bash exec-form row #3708 is fixed forward in the hook-launcher PR.Verification
plugins/repo-hygiene*.test.shpass on the branch merged with current origin/main.scripts/validate-plugins.shpasses.scripts/check-changelog-parity.sh --check --check-order,--check-bump origin/mainand--check-preserved origin/mainpass..sh;scripts/check-changed-skills.sh origin/mainreported 0 failed before the merge.SKILL.mdandclean/reference/invocation-forms.md;scripts/check-shell-portability.sh origin/mainclean.Related
Audit findings for #3346 and #3852 in
.work/audit/REPORT.md(3b partial delivery for both, 3d decide-fresh for #3852).Cross-group requests:
repo-fleet-hygiene(sent): G2 from repo-hygiene:clean 0.10.11 — audit: destructive guard gaps, PowerShell matcher bypass, silent 200-PR truncation #3346 (remote-branch analysis) belongs there and waits on the owner's scope answer; keep/repo-fleet-hygiene:syncand/repo-fleet-hygiene:auditnames stable, sincecleannow points at them.hook-launcher(sent):clean's guard registration keeps the exec-form argv contract (script path first, stdin passes through, exit 2 blocks); a frontmatter change needed inrepo-hygienegoes to this group as a request.hook-launcher(applied, received): the setup bash-lookup sentence and the node declaration land here. The bashPATHsearch itself ships in fix(hooks): resolve bash from PATH in the exec-form launcher and name the hook when it cannot run #5309, so the sentence is accurate once that merges. The destructive-guard frontmatter row is unchanged; whether it gains a fail-closed flag stays owner question Q2 on check-hook-exec-form: no gate-legal way to name Git Bash on Windows, which blocks every bash exec-form row #3708.🤖 Generated with Claude Code
https://claude.ai/code/session_01EugXnFddtpHcY5gTuyEirB