add agentws prune

Agents leave their managed worktrees behind, and `agentws rm` takes one path at
a time with no idea whether a branch's work is safely upstream, so clearing an
accumulation by hand risks destroying unmerged commits.

- classify every managed worktree: dirty, PR open, upstream, or unproven
- remove only what is safe; delete the local branch only when work is upstream
- prove "upstream" with merge-base and git cherry, so squash merges count
- match a PR by head.label, which survives the branch deletion a merge does
- dry run by default; --yes applies, --keep-branches spares every branch
- read the Gitea path from origin's URL rather than assuming the owner

internal/agent/client_test.go

@@ -3,6 +3,7 @@ package agent
 import (
 	"encoding/json"
 	"errors"
+	"fmt"
 	"io"
 	"net/http"
 	"net/http/httptest"
@@ -219,6 +220,76 @@ func TestFetchStateFailsOnNon404StatusError(t *testing.T) {
 	}
 }
 
+// Gitea rewrites head.ref to "refs/pull/<n>/head" once the PR's branch is
+// deleted, which merging does in these repos. Matching a branch against
+// head.ref alone therefore finds nothing for every merged PR; head.label keeps
+// the original name.
+func TestPRHeadBranch(t *testing.T) {
+	tests := []struct {
+		name       string
+		ref, label string
+		want       string
+	}{
+		{"merged, branch deleted", "refs/pull/12/head", "benvin/merged", "benvin/merged"},
+		{"open PR", "benvin/open", "benvin/open", "benvin/open"},
+		{"fully qualified ref", "refs/heads/benvin/x", "", "benvin/x"},
+		{"no label falls back to ref", "benvin/y", "", "benvin/y"},
+		{"cross-repo label", "benvin/z", "someone:benvin/z", "benvin/z"},
+		{"nothing usable", "refs/pull/12/head", "", ""},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var pr PullRequest
+			pr.Head.Ref = tt.ref
+			pr.Head.Label = tt.label
+			if got := PRHeadBranch(pr); got != tt.want {
+				t.Errorf("PRHeadBranch(ref=%q,label=%q) = %q, want %q", tt.ref, tt.label, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestListPRsPaginates(t *testing.T) {
+	var pages []string
+	mux := http.NewServeMux()
+	mux.HandleFunc("/api/v1/repos/unkin/repo/pulls", func(w http.ResponseWriter, r *http.Request) {
+		q := r.URL.Query()
+		pages = append(pages, q.Get("page"))
+		if q.Get("state") != "all" {
+			t.Errorf("state = %q, want all", q.Get("state"))
+		}
+		if q.Get("page") == "1" {
+			full := make([]string, 0, prPageSize)
+			for i := 0; i < prPageSize; i++ {
+				full = append(full, fmt.Sprintf(`{"number":%d,"state":"closed","merged":true,"head":{"ref":"refs/pull/%d/head","label":"benvin/b%d"}}`, i+1, i+1, i+1))
+			}
+			_, _ = io.WriteString(w, "["+strings.Join(full, ",")+"]")
+			return
+		}
+		_, _ = io.WriteString(w, `[{"number":99,"state":"open","head":{"ref":"benvin/last","label":"benvin/last"}}]`)
+	})
+	srv := httptest.NewServer(mux)
+	defer srv.Close()
+
+	c := &GiteaClient{BaseURL: srv.URL, HTTP: srv.Client()}
+	prs, err := c.ListPRs("unkin/repo", "all")
+	if err != nil {
+		t.Fatalf("ListPRs: %v", err)
+	}
+	if len(prs) != prPageSize+1 {
+		t.Fatalf("got %d PRs, want %d", len(prs), prPageSize+1)
+	}
+	if len(pages) != 2 || pages[0] != "1" || pages[1] != "2" {
+		t.Errorf("pages requested = %v, want [1 2]", pages)
+	}
+	if got := PRHeadBranch(prs[0]); got != "benvin/b1" {
+		t.Errorf("first PR head branch = %q, want benvin/b1", got)
+	}
+	if !prs[len(prs)-1].IsOpen() {
+		t.Error("last PR should be open")
+	}
+}
+
 func TestGiteaAPIError(t *testing.T) {
 	mux := http.NewServeMux()
 	mux.HandleFunc("/api/v1/repos/unkin/repo/pulls", func(w http.ResponseWriter, r *http.Request) {

internal/agent/git.go

@@ -2,6 +2,7 @@ package agent
 
 import (
 	"bytes"
+	"errors"
 	"fmt"
 	"os"
 	"os/exec"
@@ -67,6 +68,14 @@ func GitFetch(repoDir, remote string, globalArgs ...string) error {
 	return err
 }
 
+// GitFetchPrune runs `git fetch --prune <remote>` in repoDir so remote-tracking
+// refs for branches deleted on the remote (e.g. after a merge) disappear.
+func GitFetchPrune(repoDir, remote string, globalArgs ...string) error {
+	args := append(append([]string{}, globalArgs...), "fetch", "--prune", remote)
+	_, err := runGit(repoDir, args...)
+	return err
+}
+
 // GitRemoteDefaultBranch returns the short name of remote's default branch
 // (e.g. "main") by resolving refs/remotes/<remote>/HEAD.
 func GitRemoteDefaultBranch(repoDir, remote string) (string, error) {
@@ -83,6 +92,64 @@ func GitBranchExists(repoDir, branch string) bool {
 	return err == nil
 }
 
+// GitRemoteURL returns the configured URL for a remote.
+func GitRemoteURL(repoDir, remote string) (string, error) {
+	return runGit(repoDir, "remote", "get-url", remote)
+}
+
+// GitRemoteBranchExists reports whether a remote-tracking ref for branch exists
+// (accurate only after a pruning fetch).
+func GitRemoteBranchExists(repoDir, remote, branch string) bool {
+	_, err := runGit(repoDir, "show-ref", "--verify", "--quiet", "refs/remotes/"+remote+"/"+branch)
+	return err == nil
+}
+
+// GitIsDirty reports whether the checkout at dir has uncommitted or untracked
+// changes.
+func GitIsDirty(dir string) (bool, error) {
+	out, err := runGit(dir, "status", "--porcelain")
+	if err != nil {
+		return false, err
+	}
+	return strings.TrimSpace(out) != "", nil
+}
+
+// GitIsAncestor reports whether ancestor is reachable from descendant.
+func GitIsAncestor(repoDir, ancestor, descendant string) (bool, error) {
+	cmd := exec.Command("git", "merge-base", "--is-ancestor", ancestor, descendant)
+	cmd.Dir = repoDir
+	var stderr bytes.Buffer
+	cmd.Stderr = &stderr
+	if err := cmd.Run(); err != nil {
+		// Exit 1 is the documented "not an ancestor" answer; anything else is a
+		// real failure (bad ref, not a repo).
+		var exitErr *exec.ExitError
+		if errors.As(err, &exitErr) && exitErr.ExitCode() == 1 {
+			return false, nil
+		}
+		return false, fmt.Errorf("git merge-base --is-ancestor %s %s: %w: %s",
+			ancestor, descendant, err, strings.TrimSpace(stderr.String()))
+	}
+	return true, nil
+}
+
+// GitUnmergedCommits counts commits on head whose patch has no equivalent on
+// upstream, using `git cherry` so squash- and rebase-merged work is recognised
+// despite its rewritten SHAs.
+func GitUnmergedCommits(repoDir, upstream, head string) (int, error) {
+	out, err := runGit(repoDir, "cherry", upstream, head)
+	if err != nil {
+		return 0, err
+	}
+	n := 0
+	for _, line := range strings.Split(out, "\n") {
+		if strings.HasPrefix(strings.TrimSpace(line), "+") {
+			n++
+		}
+	}
+	return n, nil
+}
+
 // GitWorktreeAdd adds a worktree at path checked out to branch. When the branch
 // already exists it is reused; otherwise it is created from startPoint.
 func GitWorktreeAdd(repoDir, path, branch, startPoint string) error {

internal/agent/git_test.go

@@ -185,6 +185,134 @@ func TestGitWorktreeLifecycle(t *testing.T) {
 	}
 }
 
+// commit writes a file and commits it, returning the new HEAD sha.
+func commit(t *testing.T, dir, name, content, msg string) string {
+	t.Helper()
+	if err := os.WriteFile(filepath.Join(dir, name), []byte(content), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := runGit(dir, "add", "."); err != nil {
+		t.Fatalf("add: %v", err)
+	}
+	if _, err := runGit(dir, "commit", "-m", msg); err != nil {
+		t.Fatalf("commit: %v", err)
+	}
+	sha, err := runGit(dir, "rev-parse", "HEAD")
+	if err != nil {
+		t.Fatalf("rev-parse: %v", err)
+	}
+	return sha
+}
+
+func TestGitIsAncestor(t *testing.T) {
+	srcDir := newTempRepos(t)
+	base, err := runGit(srcDir, "rev-parse", "HEAD")
+	if err != nil {
+		t.Fatal(err)
+	}
+	tip := commit(t, srcDir, "a.txt", "a\n", "add a")
+
+	if ok, err := GitIsAncestor(srcDir, base, tip); err != nil || !ok {
+		t.Errorf("GitIsAncestor(base, tip) = %v, %v; want true", ok, err)
+	}
+	if ok, err := GitIsAncestor(srcDir, tip, base); err != nil || ok {
+		t.Errorf("GitIsAncestor(tip, base) = %v, %v; want false with no error", ok, err)
+	}
+	if _, err := GitIsAncestor(srcDir, "no-such-ref", tip); err == nil {
+		t.Error("GitIsAncestor with a bogus ref should error, not report false")
+	}
+}
+
+// These repos squash-merge, so merged work keeps its local SHA while the
+// upstream commit is a different one carrying the same patch. `git cherry` must
+// see that as merged even though the SHAs differ.
+func TestGitUnmergedCommitsIgnoresRewrittenSHAs(t *testing.T) {
+	srcDir := newTempRepos(t)
+
+	if _, err := runGit(srcDir, "checkout", "-b", "feature"); err != nil {
+		t.Fatalf("checkout: %v", err)
+	}
+	commit(t, srcDir, "f.txt", "hello\n", "add f")
+
+	n, err := GitUnmergedCommits(srcDir, "origin/main", "HEAD")
+	if err != nil {
+		t.Fatalf("GitUnmergedCommits: %v", err)
+	}
+	if n != 1 {
+		t.Fatalf("unmerged before upstream landing = %d, want 1", n)
+	}
+
+	// Land the same patch upstream under a different SHA.
+	if _, err := runGit(srcDir, "checkout", "main"); err != nil {
+		t.Fatalf("checkout main: %v", err)
+	}
+	commit(t, srcDir, "f.txt", "hello\n", "squashed f")
+	if _, err := runGit(srcDir, "push", "origin", "main"); err != nil {
+		t.Fatalf("push: %v", err)
+	}
+	if err := GitFetchPrune(srcDir, "origin"); err != nil {
+		t.Fatalf("GitFetchPrune: %v", err)
+	}
+
+	if ok, err := GitIsAncestor(srcDir, "feature", "origin/main"); err != nil || ok {
+		t.Fatalf("squash-merged branch must not be an ancestor: %v, %v", ok, err)
+	}
+	n, err = GitUnmergedCommits(srcDir, "origin/main", "feature")
+	if err != nil {
+		t.Fatalf("GitUnmergedCommits: %v", err)
+	}
+	if n != 0 {
+		t.Errorf("unmerged after upstream landing = %d, want 0", n)
+	}
+}
+
+func TestGitIsDirty(t *testing.T) {
+	srcDir := newTempRepos(t)
+	if dirty, err := GitIsDirty(srcDir); err != nil || dirty {
+		t.Fatalf("clean checkout reported dirty=%v, err=%v", dirty, err)
+	}
+	if err := os.WriteFile(filepath.Join(srcDir, "scratch.txt"), []byte("wip\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if dirty, err := GitIsDirty(srcDir); err != nil || !dirty {
+		t.Errorf("untracked file must count as dirty: dirty=%v, err=%v", dirty, err)
+	}
+}
+
+func TestGitRemoteBranchExists(t *testing.T) {
+	srcDir := newTempRepos(t)
+	if !GitRemoteBranchExists(srcDir, "origin", "main") {
+		t.Error("origin/main should exist")
+	}
+	if GitRemoteBranchExists(srcDir, "origin", "benvin/nope") {
+		t.Error("origin/benvin/nope should not exist")
+	}
+
+	if _, err := runGit(srcDir, "checkout", "-b", "benvin/pushed"); err != nil {
+		t.Fatalf("checkout: %v", err)
+	}
+	commit(t, srcDir, "p.txt", "p\n", "add p")
+	if _, err := runGit(srcDir, "push", "origin", "benvin/pushed"); err != nil {
+		t.Fatalf("push: %v", err)
+	}
+	if err := GitFetchPrune(srcDir, "origin"); err != nil {
+		t.Fatalf("GitFetchPrune: %v", err)
+	}
+	if !GitRemoteBranchExists(srcDir, "origin", "benvin/pushed") {
+		t.Error("pushed branch should have a remote-tracking ref")
+	}
+
+	if _, err := runGit(srcDir, "push", "origin", "--delete", "benvin/pushed"); err != nil {
+		t.Fatalf("delete remote branch: %v", err)
+	}
+	if err := GitFetchPrune(srcDir, "origin"); err != nil {
+		t.Fatalf("GitFetchPrune: %v", err)
+	}
+	if GitRemoteBranchExists(srcDir, "origin", "benvin/pushed") {
+		t.Error("a pruning fetch must drop the tracking ref for a deleted remote branch")
+	}
+}
+
 // resolve canonicalizes a path (temp dirs may live behind symlinks like /var).
 func resolve(t *testing.T, p string) string {
 	t.Helper()

internal/agent/gitea.go

@@ -137,10 +137,63 @@ type PullRequest struct {
 	Mergeable bool   `json:"mergeable"`
 	HTMLURL   string `json:"html_url"`
 	Head      struct {
-		Sha string `json:"sha"`
+		Sha   string `json:"sha"`
+		Ref   string `json:"ref"`
+		Label string `json:"label"`
 	} `json:"head"`
 }
 
+// prPageSize is the per-page limit for the pulls listing; maxPRPages caps how
+// far back a listing walks.
+const (
+	prPageSize = 50
+	maxPRPages = 20
+)
+
+// ListPRs lists a repo's pull requests in the given state ("open", "closed" or
+// "all"), following pagination.
+func (c *GiteaClient) ListPRs(repoPath, state string) ([]PullRequest, error) {
+	if state == "" {
+		state = "all"
+	}
+	var all []PullRequest
+	for page := 1; page <= maxPRPages; page++ {
+		var batch []PullRequest
+		path := fmt.Sprintf("/api/v1/repos/%s/pulls?state=%s&limit=%d&page=%d", repoPath, state, prPageSize, page)
+		if err := c.do(http.MethodGet, path, nil, &batch); err != nil {
+			return nil, err
+		}
+		all = append(all, batch...)
+		if len(batch) < prPageSize {
+			break
+		}
+	}
+	return all, nil
+}
+
+// PRHeadBranch returns the branch a PR was opened from. Gitea rewrites head.ref
+// to "refs/pull/<n>/head" once the branch is deleted (which merging does), so
+// head.label — which keeps the original name — is authoritative.
+func PRHeadBranch(pr PullRequest) string {
+	if label := pr.Head.Label; label != "" && !strings.HasPrefix(label, "refs/pull/") {
+		// Cross-repo PRs label as "<owner>:<branch>".
+		if _, branch, ok := strings.Cut(label, ":"); ok {
+			return branch
+		}
+		return label
+	}
+	ref := pr.Head.Ref
+	if strings.HasPrefix(ref, "refs/pull/") {
+		return ""
+	}
+	return strings.TrimPrefix(ref, "refs/heads/")
+}
+
+// IsOpen reports whether a PR is still open (not merged, not closed).
+func (pr PullRequest) IsOpen() bool {
+	return pr.State == "open" && !pr.Merged
+}
+
 // CreatePROptions are the fields for opening a PR.
 type CreatePROptions struct {
 	Base  string `json:"base"`

internal/agent/parse.go

@@ -68,6 +68,52 @@ func ParseDurationFlag(flag, value string) (time.Duration, error) {
 	return d, nil
 }
 
+// RemoteHost returns the host a git remote URL points at, or "" for a local
+// path remote.
+func RemoteHost(remote string) string {
+	s := strings.TrimSpace(remote)
+	if _, after, ok := strings.Cut(s, "://"); ok {
+		host, _, _ := strings.Cut(after, "/")
+		if _, bare, ok := strings.Cut(host, "@"); ok {
+			host = bare
+		}
+		return host
+	}
+	if strings.HasPrefix(s, "/") || strings.HasPrefix(s, ".") {
+		return ""
+	}
+	host, _, ok := strings.Cut(s, ":")
+	if !ok {
+		return ""
+	}
+	if _, bare, ok := strings.Cut(host, "@"); ok {
+		host = bare
+	}
+	return host
+}
+
+// RepoPathFromRemoteURL extracts the "owner/repo" API path from a git remote
+// URL, accepting both https and scp-style ssh forms.
+func RepoPathFromRemoteURL(remote string) (string, error) {
+	s := strings.TrimSuffix(strings.TrimSuffix(strings.TrimSpace(remote), "/"), ".git")
+	switch {
+	case strings.Contains(s, "://"):
+		_, after, _ := strings.Cut(s, "://")
+		_, path, ok := strings.Cut(after, "/")
+		if !ok {
+			return "", fmt.Errorf("remote URL %q has no repo path", remote)
+		}
+		s = path
+	case strings.Contains(s, ":"):
+		_, s, _ = strings.Cut(s, ":")
+	}
+	parts := strings.Split(strings.Trim(s, "/"), "/")
+	if len(parts) < 2 || parts[len(parts)-2] == "" || parts[len(parts)-1] == "" {
+		return "", fmt.Errorf("remote URL %q is not owner/repo shaped", remote)
+	}
+	return parts[len(parts)-2] + "/" + parts[len(parts)-1], nil
+}
+
 // ParseRepo validates and splits an "owner/repo" string.
 func ParseRepo(s string) (owner, repo string, err error) {
 	s = strings.TrimSpace(s)

internal/agent/parse_test.go

@@ -132,3 +132,52 @@ func TestParseDurationFlagErrorMessage(t *testing.T) {
 		}
 	}
 }
+
+// Not every managed repo lives under the default owner, so the API path comes
+// from origin's URL rather than the directory name.
+func TestRepoPathFromRemoteURL(t *testing.T) {
+	tests := []struct {
+		in   string
+		want string
+	}{
+		{"https://git.unkin.net/unkin/agent-tools.git", "unkin/agent-tools"},
+		{"https://git.unkin.net/unkinben/dotfiles.git", "unkinben/dotfiles"},
+		{"https://git.unkin.net/unkin/agent-tools", "unkin/agent-tools"},
+		{"https://user@git.unkin.net/unkin/agent-tools.git", "unkin/agent-tools"},
+		{"ssh://git@git.unkin.net:2222/unkin/agent-tools.git", "unkin/agent-tools"},
+		{"git@git.unkin.net:unkin/agent-tools.git", "unkin/agent-tools"},
+	}
+	for _, tt := range tests {
+		got, err := RepoPathFromRemoteURL(tt.in)
+		if err != nil {
+			t.Errorf("RepoPathFromRemoteURL(%q): %v", tt.in, err)
+			continue
+		}
+		if got != tt.want {
+			t.Errorf("RepoPathFromRemoteURL(%q) = %q, want %q", tt.in, got, tt.want)
+		}
+	}
+	for _, bad := range []string{"", "https://git.unkin.net", "agent-tools"} {
+		if got, err := RepoPathFromRemoteURL(bad); err == nil {
+			t.Errorf("RepoPathFromRemoteURL(%q) = %q, want error", bad, got)
+		}
+	}
+}
+
+func TestRemoteHost(t *testing.T) {
+	tests := []struct {
+		in, want string
+	}{
+		{"https://git.unkin.net/unkin/repo.git", "git.unkin.net"},
+		{"https://user@git.unkin.net/unkin/repo.git", "git.unkin.net"},
+		{"ssh://git@git.unkin.net:2222/unkin/repo.git", "git.unkin.net:2222"},
+		{"git@git.unkin.net:unkin/repo.git", "git.unkin.net"},
+		{"/tmp/fixture/origin.git", ""},
+		{"../other/origin.git", ""},
+	}
+	for _, tt := range tests {
+		if got := RemoteHost(tt.in); got != tt.want {
+			t.Errorf("RemoteHost(%q) = %q, want %q", tt.in, got, tt.want)
+		}
+	}
+}