Merge pull request 'Name the cause when a watch stops on an auth failure' (#18) from benvin/watchpr-auth-failure into main

Reviewed-on: #18

.pre-commit-config.yaml

@@ -13,10 +13,11 @@ repos:
     rev: v0.5.1
     hooks:
       - id: go-fmt
-      - id: go-unit-tests
 
-  # go-vet at the module level (dnephin's go-vet runs at repo root, which has no
-  # .go files here since both tools live under cmd/). The CI pre-commit image
+  # go vet and go test at the module level (dnephin's run at repo root, which has
+  # no .go files here since both tools live under cmd/, and its go-unit-tests
+  # caps every package at 30s and re-runs the whole module once per file batch —
+  # the git-fixture tests outgrew both). The CI pre-commit image
   # (almalinux9-gobuilder) has go installed.
   - repo: local
     hooks:
@@ -26,3 +27,9 @@ repos:
         language: system
         types: [go]
         pass_filenames: false
+      - id: go-test-mod
+        name: go test (module)
+        entry: go test ./...
+        language: system
+        types: [go]
+        pass_filenames: false

AGENTS.md

@@ -8,9 +8,10 @@ from Vault, so actions are attributed to the agent rather than to whoever runs
 the tool. Setting `AGENT_LOGIN` selects a different agent identity, so a service
 like repospawner can run these tools as itself.
 
-- **`agentpr`** — create pull requests and post PR comments as `unkin-agent`
-  (fixes the "tea posts as Ben" attribution problem). Subcommands:
-  `pr create`, `pr comment`, `whoami`.
+- **`agentpr`** — create and edit pull requests and issues, and post comments on
+  either, as `unkin-agent` (fixes the "tea posts as Ben" attribution problem).
+  Subcommands: `pr create`, `pr comment`, `pr edit`, `issue create`,
+  `issue comment`, `issue edit`, `whoami`.
 - **`watchpr`** — poll one or more PRs and exit when a tracked PR changes
   meaningfully: it merges/closes, gets a new non-agent comment, its CI fails,
   or it loses mergeability. Benign transitions (CI pending→success, the agent's
@@ -28,7 +29,7 @@ parsing, watch-state comparison, git worktree helpers).
 ## Structure
 
 ```
-cmd/agentpr/main.go      # agentpr CLI (pr create / pr comment / whoami)
+cmd/agentpr/main.go      # agentpr CLI (pr + issue create/comment/edit, whoami)
 cmd/watchpr/main.go      # watchpr CLI (poll + meaningful-change exit)
 cmd/agentws/main.go      # agentws CLI (new / list / rm / clean / token / credential)
 cmd/agentws/prune.go     # agentws prune (classify worktrees, remove the safe ones)
@@ -36,7 +37,7 @@ cmd/agentvault/main.go   # agentvault CLI (seed-outpost / seed-oauth)
 internal/agent/          # shared plumbing:
   token.go               #   env config + in-process Gitea-token cache
   vault.go               #   AppRole login + read the gitea creds path
-  gitea.go               #   Gitea REST client (PR create/get, comments, status, whoami)
+  gitea.go               #   Gitea REST client (PR/issue create/edit/get, comments, status, whoami)
   parse.go               #   owner/repo#N and owner/repo parsing
   watch.go               #   PRState snapshot + MeaningfulChange comparison
   git.go                 #   git worktree/clone/fetch helpers (os/exec, no go-git)
@@ -129,8 +130,8 @@ make test           # go test -v -race ./...
 
 `internal/agent` covers PR-ref parsing, the `MeaningfulChange` table (benign vs
 alerting transitions), request-body construction, and the Vault+Gitea client
-against `httptest` servers (fake AppRole login + gitea creds + PR create /
-comment / whoami / status). No live Vault/Gitea access is required for tests.
+against `httptest` servers (fake AppRole login + gitea creds + PR/issue create
++ edit / comment / whoami / status). No live Vault/Gitea access is required for tests.
 
 ## agentvault seed-outpost
 
@@ -175,11 +176,22 @@ wrapped per stage (login / read denied / write denied) via `ErrVaultDenied`.
 ## Gotchas
 
 - `watchpr` exits 0 with no output changes on `--once` (just prints state).
-- Gitea tokens expire in ~1h, shorter than a watch: the client re-mints once on a
-  401/403 and replays the request. If the fresh token is rejected too, `watchpr`
-  exits non-zero rather than polling blind.
+- Gitea tokens expire in ~1h, shorter than a watch: the client re-mints once when
+  the credential it sent was rejected and replays the request. If the fresh token
+  is rejected too, `watchpr` exits non-zero rather than polling blind.
+- A 401/403 is classified before anything is re-minted, because only one of the
+  three cases is a stale token: `ErrNoCredential` (the request carried no token —
+  anonymous access to something not public), `IsPermissionDenied` (a 403 whose
+  body names no credential, so the identity is simply not allowed) and
+  `IsCredentialRejected` (any 401, or a 403 mentioning a token/scope/sign-in,
+  which is what Gitea returns for a token missing a scope). Only the last
+  re-mints; the others abort immediately, since a fresh token cannot fix them and
+  blaming one hides the real cause. `IsAuthError` stays "any 401/403" — all three
+  end a watch.
 - `watchpr` polls anonymously when no token can be minted (public repos work
-  fine); only a real 401/403 reaches for Vault.
+  fine); an anonymous run never reaches for Vault, on any status code.
+- A re-mint that hands back an empty token is an error: replaying with it would
+  drop the Authorization header and silently continue as an anonymous watcher.
 - The token cache is process-wide (mutex-guarded); `RefreshGiteaToken` replaces
   it. Tests call the unexported `fetchGiteaToken` to avoid the cache.
 - `agentvault` never puts a secret in an error string: Vault decode failures and
@@ -197,5 +209,17 @@ wrapped per stage (login / read denied / write denied) via `ErrVaultDenied`.
   the worktree goes and the branch stays. `origin/<branch>` is only evidence when
   this run's pruning fetch succeeded; a failed fetch leaves stale tracking refs,
   so those verdicts fall back to keeping the branch.
+- `agentws prune` discovers worktrees from the worktree root *and* from
+  `git worktree list` on each source checkout, merging the two so git's own
+  `locked`/`prunable` flags reach entries the directory scan already found.
+  Removing a worktree is only safe because the local branch keeps its commits, so
+  the cases with no branch to fall back on are kept: a detached HEAD carrying
+  commits on no remote, a locked checkout, or one with a sequencer operation
+  half-finished (`rebase-merge`, `MERGE_HEAD`, `CHERRY_PICK_HEAD`, …). A directory
+  whose backing repo is gone is deleted outright, but only ever inside the
+  worktree root.
 - CI "combined status" comes from `/commits/{sha}/status`; an empty head SHA
   yields an empty state without an API call.
+- Gitea backs every PR with an issue of the same number and serves comments from
+  `/issues/{n}/comments`, so `agentpr pr comment` and `agentpr issue comment`
+  are one implementation under two flag names (`--pr` / `--issue`).

README.md

@@ -6,7 +6,8 @@ token from Vault, so automated PRs, comments and pushes are attributed to the
 agent — not to whoever happens to run the command. Set `AGENT_LOGIN` to act as a
 different agent identity.
 
-- **`agentpr`** — create pull requests and post PR comments as the agent user.
+- **`agentpr`** — create and edit pull requests and issues, and post comments on
+  either, as the agent user.
 - **`watchpr`** — poll one or more PRs and exit when one changes in a way worth
   acting on.
 - **`agentws`** — manage per-branch git worktrees for `unkin-agent`, cloning
@@ -50,6 +51,23 @@ agentpr pr create --repo unkin/argocd-apps \
 # Comment on a PR
 agentpr pr comment --repo unkin/argocd-apps --pr 42 --body "Rebased, CI green."
 
+# Edit a PR's title and/or body; an omitted flag is left unchanged
+agentpr pr edit --repo unkin/argocd-apps --pr 42 --body "Adds the ServiceAccount ..."
+agentpr pr edit --repo unkin/argocd-apps --pr 42 --title "Add woodpecker SA"
+# prints: #<number> <html_url>
+
+# File an issue (--body optional)
+agentpr issue create --repo unkin/argocd-apps \
+  --title "Woodpecker SA missing" --body "The pipeline fails with ..."
+# prints: #<number> <html_url>
+
+# Comment on an issue (the same Gitea endpoint `pr comment` posts to)
+agentpr issue comment --repo unkin/argocd-apps --issue 43 --body "Fixed in #44."
+
+# Edit an issue's title and/or body; an omitted flag is left unchanged
+agentpr issue edit --repo unkin/argocd-apps --issue 43 --body "The pipeline fails with ..."
+# prints: #<number> <html_url>
+
 agentpr --version
 agentpr --help
 ```
@@ -81,6 +99,25 @@ watchpr --once --json unkin/argocd-apps#42
 On a meaningful change `watchpr` prints the reason and the PR's current state,
 then exits 0. Use `--json` for machine-readable output.
 
+### Exit behaviour
+
+A watcher that sees nothing must not look healthy, so every terminal failure
+exits non-zero naming its cause:
+
+| Cause | Message |
+|---|---|
+| the token was rejected and a fresh one was too | `gitea rejected the token and re-minting did not recover it` |
+| authenticated but not allowed (Gitea 403, no token named) | `gitea denied access to <login>` |
+| polling anonymously and the PR is not public | `gitea requires authentication and no token could be minted` |
+| the PR lookup 404s (repo deleted, renamed, made private) | `PR no longer visible` |
+
+Gitea tokens expire in ~1h, far shorter than a watch, so a rejected token is
+re-minted once and the request replayed; only a failure that survives that
+re-mint ends the watch. Anonymous polling of a public repo is unaffected — with
+no token there is nothing to reject and Vault is never reached for one.
+Transient failures (5xx, network errors, rate limiting) are warned about and
+retried, and give up after 20 consecutive failures of the same PR.
+
 ## agentws
 
 `agentws` gives an agent an isolated git worktree per branch without disturbing
@@ -91,10 +128,10 @@ checkout too; the worktrees themselves live under the **worktree root**
 
 ```bash
 # Clone unkin/argocd-apps into ~/src/prodenv if missing, then add a worktree for
-# a new branch off the remote default branch. Prints the worktree path.
+# the branch. Prints the worktree path.
 agentws new argocd-apps --branch benvin/my-change
 
-# Branch off a specific base instead of the remote default
+# Branch off a specific base instead of the remote default (new branches only)
 agentws new argocd-apps --branch benvin/hotfix --from release-1.2
 
 # List managed worktrees (repo, branch, path)
@@ -104,8 +141,10 @@ agentws list
 agentws rm benvin/my-change
 agentws rm ~/.cache/agentws/argocd-apps__benvin-my-change --delete-branch
 
-# Classify every managed worktree; dry run unless --yes is given
+# Classify every worktree found; dry run unless --yes is given
 agentws prune
+agentws prune --json
+agentws prune --no-fetch
 agentws prune --yes
 agentws prune --yes --keep-branches
 
@@ -116,18 +155,42 @@ agentws clean
 agentws token
 ```
 
+`agentws new` fetches first, then takes one of two paths and names the one it
+took on its last output line. A branch that **already exists on origin** is
+checked out at `origin/<branch>` and set to track it, so the worktree starts on
+the branch's own commits (`branch <b> (tracking origin/<b> at <sha>)`); a local
+branch left from an earlier run is fast-forwarded onto it. A branch origin does
+**not** have is created from `--from`, or from the remote's default branch when
+`--from` is absent (`branch <b> (new, from origin/<base>)`) — the default is read
+from `origin/HEAD`, so a repo on `master` forks from `master`. `--from` is
+ignored, with a note, when the branch is already on origin.
+
+The one case the worktree does not land on `origin/<branch>` is a local branch
+carrying commits origin has never seen. Those commits exist nowhere else, so the
+checkout is left on them and the output says how many.
+
 ### prune
 
-`agentws prune` decides, per worktree, whether its work is safely upstream:
+`agentws prune` finds worktrees two ways and merges the results: the managed
+directories under the worktree root, and `git worktree list` on every source
+checkout — so hand-made worktrees, stale registrations whose directory is gone,
+and leftover directories whose source repo was deleted all show up too.
+
+It then decides, per worktree, whether its work is safely upstream:
 
 | Signal (first match wins) | Verdict |
 |---|---|
-| uncommitted or untracked changes | keep |
+| working tree gone (registration only) | prune the registration |
+| backing repo gone | delete the leftover directory |
+| locked by `git worktree lock` | keep |
+| rebase, merge, cherry-pick, revert or bisect in progress | keep |
+| uncommitted, staged or untracked changes | keep |
 | branch has an open PR | keep |
 | tip contained in `origin/<default>` | remove worktree + local branch |
 | every commit patch-equivalent to one in `origin/<default>`'s history | remove worktree + local branch |
 | PR merged **and** HEAD contained in the PR's head commit (or in a verified `origin/<branch>`) | remove worktree + local branch |
 | PR closed **and** HEAD contained in a verified `origin/<branch>` | remove worktree + local branch |
+| detached HEAD carrying commits on no remote | keep |
 | anything else | remove worktree, keep the branch |
 
 A branch is deleted only where git proves its commits survive elsewhere. PR
@@ -155,7 +218,32 @@ hits the pagination cap is reported rather than read as "no PR". Matching a
 branch to its PR uses `head.label`, since Gitea rewrites `head.ref` to
 `refs/pull/<n>/head` once the branch is deleted on merge.
 
-`--keep-branches` removes worktrees only, and its verdicts print as `remove`.
+The last row is safe only because the local branch keeps the commits, so the
+reason names the branch it is relying on. A detached HEAD has no such branch, so
+unique commits there are kept instead.
+
+Output is a table (`REPO BRANCH PATH VERDICT REASON`) with every verdict's reason
+spelled out, or `--json` for scripting. Neither form needs a terminal.
+
+| Flag | Effect |
+|---|---|
+| `--yes` | apply the plan; without it nothing is touched |
+| `--keep-branches` | remove worktrees only; verdicts print as `remove` |
+| `--no-fetch` | judge against the refs already on disk, for offline use |
+| `--json` | emit the report as JSON on stdout, notes on stderr |
+| `--include-unmanaged` | also remove worktrees outside the worktree root |
+| `--include-keep` | dangerous: also remove worktrees classified `keep`, destroying uncommitted and in-progress work |
+
+Without `--include-unmanaged` a hand-made worktree is reported and then skipped,
+naming the flag that would remove it. `--include-keep` is the only way past a
+`keep`. It leaves the branch, so committed work outlives the worktree, but
+`git worktree remove --force` discards a dirty working tree and a paused
+rebase's sequencer state without a word, and no branch was carrying those.
+
+A directory under the worktree root is deleted outright only when its git dir
+and the repo's shared `.git` are both proven absent by `stat`. When git merely
+fails to answer for a checkout, the verdict is `keep` with the error as its
+reason: an unread state is never a dead one.
 
 ### Auth / credential-helper design
 

cmd/agentpr/main.go

@@ -5,6 +5,10 @@
 //
 //	agentpr pr create --repo owner/repo --base main --head feature --title T --body B
 //	agentpr pr comment --repo owner/repo --pr 12 --body "..."
+//	agentpr pr edit --repo owner/repo --pr 12 --title T --body B
+//	agentpr issue create --repo owner/repo --title T --body B
+//	agentpr issue comment --repo owner/repo --issue 12 --body "..."
+//	agentpr issue edit --repo owner/repo --issue 12 --title T --body B
 //	agentpr whoami
 package main
 
@@ -33,14 +37,14 @@ func main() {
 func newRootCmd() *cobra.Command {
 	root := &cobra.Command{
 		Use:          "agentpr",
-		Short:        "Manage Gitea PRs and comments as an agent user.",
-		Long:         "agentpr manages Gitea pull requests and comments as an agent user, using a\nGitea token minted from Vault (AppRole login + gitea/creds/<AGENT_LOGIN>).\nSet AGENT_LOGIN to act as another agent identity, or GITEA_CREDS_PATH to name\nthe Vault creds path outright.",
+		Short:        "Manage Gitea PRs, issues and comments as an agent user.",
+		Long:         "agentpr manages Gitea pull requests, issues and comments as an agent user,\nusing a Gitea token minted from Vault (AppRole login + gitea/creds/<AGENT_LOGIN>).\nSet AGENT_LOGIN to act as another agent identity, or GITEA_CREDS_PATH to name\nthe Vault creds path outright.",
 		Version:      version,
 		SilenceUsage: true,
 	}
 	root.SetVersionTemplate("{{.Version}}\n")
 
-	root.AddCommand(newPRCmd(), newWhoamiCmd(), newVersionCmd())
+	root.AddCommand(newPRCmd(), newIssueCmd(), newWhoamiCmd(), newVersionCmd())
 	return root
 }
 
@@ -56,9 +60,18 @@ func client() (*agent.GiteaClient, error) {
 func newPRCmd() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "pr",
-		Short: "Create PRs and post PR comments",
+		Short: "Create and edit PRs, and post PR comments",
 	}
-	cmd.AddCommand(newPRCreateCmd(), newPRCommentCmd())
+	cmd.AddCommand(newPRCreateCmd(), newCommentCmd("pr", "PR", "Post a comment on a pull request"), newPREditCmd())
+	return cmd
+}
+
+func newIssueCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "issue",
+		Short: "File and edit issues, and post issue comments",
+	}
+	cmd.AddCommand(newIssueCreateCmd(), newCommentCmd("issue", "issue", "Post a comment on an issue"), newIssueEditCmd())
 	return cmd
 }
 
@@ -103,12 +116,56 @@ func newPRCreateCmd() *cobra.Command {
 	return cmd
 }
 
-func newPRCommentCmd() *cobra.Command {
+// newCommentCmd builds a comment command whose number flag is named numFlag.
+// Gitea backs every PR with an issue of the same number and serves comments
+// from the issue endpoint, so `pr comment` and `issue comment` are one command
+// under two flag names rather than two implementations that could drift.
+func newCommentCmd(numFlag, noun, short string) *cobra.Command {
 	var repo, body string
-	var pr int
+	var number int
 	cmd := &cobra.Command{
 		Use:          "comment",
-		Short:        "Post a comment on a pull request",
+		Short:        short,
+		SilenceUsage: true,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			owner, name, err := agent.ParseRepo(repo)
+			if err != nil {
+				return err
+			}
+			if number <= 0 {
+				return fmt.Errorf("--%s must be a positive %s number", numFlag, noun)
+			}
+			if body == "" {
+				return fmt.Errorf("--body is required")
+			}
+			c, err := client()
+			if err != nil {
+				return err
+			}
+			cm, err := c.CreateComment(owner+"/"+name, number, body)
+			if err != nil {
+				return err
+			}
+			fmt.Printf("comment %d posted on %s/%s#%d\n", cm.ID, owner, name, number)
+			return nil
+		},
+	}
+	f := cmd.Flags()
+	f.StringVar(&repo, "repo", "", "Repository as owner/repo (required)")
+	f.IntVar(&number, numFlag, 0, noun+" number (required)")
+	f.StringVar(&body, "body", "", "Comment body (required)")
+	_ = cmd.MarkFlagRequired("repo")
+	_ = cmd.MarkFlagRequired(numFlag)
+	_ = cmd.MarkFlagRequired("body")
+	return cmd
+}
+
+func newPREditCmd() *cobra.Command {
+	var repo, title, body string
+	var pr int
+	cmd := &cobra.Command{
+		Use:          "edit",
+		Short:        "Edit a pull request's title and/or body",
 		SilenceUsage: true,
 		RunE: func(cmd *cobra.Command, args []string) error {
 			owner, name, err := agent.ParseRepo(repo)
@@ -118,28 +175,129 @@ func newPRCommentCmd() *cobra.Command {
 			if pr <= 0 {
 				return fmt.Errorf("--pr must be a positive PR number")
 			}
-			if body == "" {
-				return fmt.Errorf("--body is required")
+			opts, err := editOptions(cmd, title, body)
+			if err != nil {
+				return err
 			}
 			c, err := client()
 			if err != nil {
 				return err
 			}
-			cm, err := c.CreateComment(owner+"/"+name, pr, body)
+			updated, err := c.EditPR(owner+"/"+name, pr, opts)
 			if err != nil {
 				return err
 			}
-			fmt.Printf("comment %d posted on %s/%s#%d\n", cm.ID, owner, name, pr)
+			fmt.Printf("#%d %s\n", updated.Number, updated.HTMLURL)
 			return nil
 		},
 	}
 	f := cmd.Flags()
 	f.StringVar(&repo, "repo", "", "Repository as owner/repo (required)")
 	f.IntVar(&pr, "pr", 0, "PR number (required)")
-	f.StringVar(&body, "body", "", "Comment body (required)")
+	f.StringVar(&title, "title", "", "New PR title (unchanged when omitted)")
+	f.StringVar(&body, "body", "", "New PR body (unchanged when omitted)")
 	_ = cmd.MarkFlagRequired("repo")
 	_ = cmd.MarkFlagRequired("pr")
-	_ = cmd.MarkFlagRequired("body")
+	return cmd
+}
+
+// editOptions turns the --title/--body flags actually given into an edit
+// payload. Only the flags present are sent: omitting --title must leave the
+// title as it is, not blank it.
+func editOptions(cmd *cobra.Command, title, body string) (agent.EditOptions, error) {
+	var opts agent.EditOptions
+	if cmd.Flags().Changed("title") {
+		// Gitea ignores an empty title, so sending one would report success
+		// while changing nothing.
+		if title == "" {
+			return opts, fmt.Errorf("--title cannot be empty: a title can be set but not cleared")
+		}
+		opts.Title = &title
+	}
+	if cmd.Flags().Changed("body") {
+		opts.Body = &body
+	}
+	if opts.Title == nil && opts.Body == nil {
+		return opts, fmt.Errorf("at least one of --title or --body is required")
+	}
+	return opts, nil
+}
+
+func newIssueCreateCmd() *cobra.Command {
+	var repo, title, body string
+	cmd := &cobra.Command{
+		Use:          "create",
+		Short:        "File an issue",
+		SilenceUsage: true,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			owner, name, err := agent.ParseRepo(repo)
+			if err != nil {
+				return err
+			}
+			if title == "" {
+				return fmt.Errorf("--title is required")
+			}
+			c, err := client()
+			if err != nil {
+				return err
+			}
+			issue, err := c.CreateIssue(owner+"/"+name, agent.CreateIssueOptions{
+				Title: title,
+				Body:  body,
+			})
+			if err != nil {
+				return err
+			}
+			fmt.Printf("#%d %s\n", issue.Number, issue.HTMLURL)
+			return nil
+		},
+	}
+	f := cmd.Flags()
+	f.StringVar(&repo, "repo", "", "Repository as owner/repo (required)")
+	f.StringVar(&title, "title", "", "Issue title (required)")
+	f.StringVar(&body, "body", "", "Issue body")
+	_ = cmd.MarkFlagRequired("repo")
+	return cmd
+}
+
+func newIssueEditCmd() *cobra.Command {
+	var repo, title, body string
+	var issue int
+	cmd := &cobra.Command{
+		Use:          "edit",
+		Short:        "Edit an issue's title and/or body",
+		SilenceUsage: true,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			owner, name, err := agent.ParseRepo(repo)
+			if err != nil {
+				return err
+			}
+			if issue <= 0 {
+				return fmt.Errorf("--issue must be a positive issue number")
+			}
+			opts, err := editOptions(cmd, title, body)
+			if err != nil {
+				return err
+			}
+			c, err := client()
+			if err != nil {
+				return err
+			}
+			updated, err := c.EditIssue(owner+"/"+name, issue, opts)
+			if err != nil {
+				return err
+			}
+			fmt.Printf("#%d %s\n", updated.Number, updated.HTMLURL)
+			return nil
+		},
+	}
+	f := cmd.Flags()
+	f.StringVar(&repo, "repo", "", "Repository as owner/repo (required)")
+	f.IntVar(&issue, "issue", 0, "Issue number (required)")
+	f.StringVar(&title, "title", "", "New issue title (unchanged when omitted)")
+	f.StringVar(&body, "body", "", "New issue body (unchanged when omitted)")
+	_ = cmd.MarkFlagRequired("repo")
+	_ = cmd.MarkFlagRequired("issue")
 	return cmd
 }
 

cmd/agentpr/main_test.go

@@ -2,7 +2,10 @@ package main
 
 import (
 	"io"
+	"strings"
 	"testing"
+
+	"github.com/spf13/cobra"
 )
 
 // A malformed --repo must fail the command (so main exits non-zero). ParseRepo
@@ -16,3 +19,133 @@ func TestExecuteBadRepoErrors(t *testing.T) {
 		t.Fatal("Execute() = nil, want error for a malformed --repo")
 	}
 }
+
+// `pr edit` with neither --title nor --body has nothing to send; it must fail
+// with a usage error before any Vault/Gitea call, so this stays hermetic.
+func TestPREditRequiresTitleOrBody(t *testing.T) {
+	cmd := newRootCmd()
+	cmd.SetArgs([]string{"pr", "edit", "--repo", "unkin/repo", "--pr", "7"})
+	cmd.SetOut(io.Discard)
+	cmd.SetErr(io.Discard)
+	err := cmd.Execute()
+	if err == nil {
+		t.Fatal("Execute() = nil, want an error when neither --title nor --body is given")
+	}
+	if !strings.Contains(err.Error(), "--title or --body") {
+		t.Errorf("error = %q, want it to name the missing flags", err)
+	}
+}
+
+// Gitea silently ignores an empty title, so `pr edit --title ""` would report
+// success while changing nothing; it must fail before any Vault/Gitea call.
+func TestPREditRejectsEmptyTitle(t *testing.T) {
+	cmd := newRootCmd()
+	cmd.SetArgs([]string{"pr", "edit", "--repo", "unkin/repo", "--pr", "7", "--title", ""})
+	cmd.SetOut(io.Discard)
+	cmd.SetErr(io.Discard)
+	err := cmd.Execute()
+	if err == nil {
+		t.Fatal("Execute() = nil, want an error for an empty --title")
+	}
+	if !strings.Contains(err.Error(), "--title cannot be empty") {
+		t.Errorf("error = %q, want it to reject the empty title", err)
+	}
+}
+
+// execute runs the command tree with args, discarding output, so tests assert
+// on the error alone. Every case here fails before any Vault/Gitea call.
+func execute(args ...string) error {
+	cmd := newRootCmd()
+	cmd.SetArgs(args)
+	cmd.SetOut(io.Discard)
+	cmd.SetErr(io.Discard)
+	return cmd.Execute()
+}
+
+// An issue needs a title; Gitea rejects an empty one, so the command must too.
+func TestIssueCreateRequiresTitle(t *testing.T) {
+	err := execute("issue", "create", "--repo", "unkin/repo", "--body", "b")
+	if err == nil {
+		t.Fatal("Execute() = nil, want an error when --title is missing")
+	}
+	if !strings.Contains(err.Error(), "--title is required") {
+		t.Errorf("error = %q, want it to name the missing flag", err)
+	}
+}
+
+// --repo is required, and cobra must reject its absence before anything reaches
+// for a token.
+func TestIssueCreateRequiresRepo(t *testing.T) {
+	err := execute("issue", "create", "--title", "t")
+	if err == nil {
+		t.Fatal("Execute() = nil, want an error when --repo is missing")
+	}
+	if !strings.Contains(err.Error(), "repo") {
+		t.Errorf("error = %q, want it to name the missing flag", err)
+	}
+}
+
+func TestIssueCreateBadRepoErrors(t *testing.T) {
+	if err := execute("issue", "create", "--repo", "not-a-repo", "--title", "t"); err == nil {
+		t.Fatal("Execute() = nil, want error for a malformed --repo")
+	}
+}
+
+// `issue comment` addresses the issue by --issue, not --pr, and needs it.
+func TestIssueCommentRequiresIssueNumber(t *testing.T) {
+	err := execute("issue", "comment", "--repo", "unkin/repo", "--body", "hi")
+	if err == nil {
+		t.Fatal("Execute() = nil, want an error when --issue is missing")
+	}
+	if !strings.Contains(err.Error(), "issue") {
+		t.Errorf("error = %q, want it to name the missing --issue flag", err)
+	}
+}
+
+func TestIssueEditRequiresTitleOrBody(t *testing.T) {
+	err := execute("issue", "edit", "--repo", "unkin/repo", "--issue", "12")
+	if err == nil {
+		t.Fatal("Execute() = nil, want an error when neither --title nor --body is given")
+	}
+	if !strings.Contains(err.Error(), "--title or --body") {
+		t.Errorf("error = %q, want it to name the missing flags", err)
+	}
+}
+
+func TestIssueEditRejectsEmptyTitle(t *testing.T) {
+	err := execute("issue", "edit", "--repo", "unkin/repo", "--issue", "12", "--title", "")
+	if err == nil {
+		t.Fatal("Execute() = nil, want an error for an empty --title")
+	}
+	if !strings.Contains(err.Error(), "--title cannot be empty") {
+		t.Errorf("error = %q, want it to reject the empty title", err)
+	}
+}
+
+// PRs and issues share Gitea's comment endpoint, so both comment commands are
+// built from one constructor: they must stay identical apart from the flag
+// naming the number.
+func TestCommentCommandsStayInStep(t *testing.T) {
+	find := func(group string) *cobra.Command {
+		t.Helper()
+		cmd, _, err := newRootCmd().Find([]string{group, "comment"})
+		if err != nil || cmd.Name() != "comment" {
+			t.Fatalf("%s comment not found: %v", group, err)
+		}
+		return cmd
+	}
+	has := func(cmd *cobra.Command, name string) bool { return cmd.Flags().Lookup(name) != nil }
+
+	prCmd, issueCmd := find("pr"), find("issue")
+	for _, name := range []string{"repo", "body"} {
+		if !has(prCmd, name) || !has(issueCmd, name) {
+			t.Errorf("--%s missing: pr=%t issue=%t", name, has(prCmd, name), has(issueCmd, name))
+		}
+	}
+	if !has(prCmd, "pr") || has(prCmd, "issue") {
+		t.Error("pr comment must take --pr and only --pr")
+	}
+	if !has(issueCmd, "issue") || has(issueCmd, "pr") {
+		t.Error("issue comment must take --issue and only --issue")
+	}
+}

cmd/agentws/main.go

@@ -13,7 +13,8 @@
 //	agentws new <repo> [--branch benvin/<name>] [--from <base-branch>]
 //	agentws list
 //	agentws rm <path-or-branch> [--delete-branch]
-//	agentws prune [--yes] [--keep-branches]
+//	agentws prune [--yes] [--keep-branches] [--no-fetch] [--json]
+//	              [--include-unmanaged] [--include-keep]
 //	agentws clean
 //	agentws token
 //	agentws credential get   # git credential-helper protocol on stdin
@@ -25,6 +26,7 @@ import (
 	"io"
 	"os"
 	"path/filepath"
+	"sort"
 	"strings"
 
 	"git.unkin.net/unkin/agent-tools/internal/agent"
@@ -159,13 +161,24 @@ func newNewCmd() *cobra.Command {
 				return err
 			}
 
-			// c. Base branch: --from or the remote default.
+			// c. A branch origin already has is work in progress and must be
+			//    checked out as it stands; only a branch origin does not have is
+			//    forked from a base.
+			onRemote := agent.GitRemoteBranchExists(srcDir, "origin", branch)
+			startPoint := "origin/" + branch
 			base := from
-			if base == "" {
-				base, err = agent.GitRemoteDefaultBranch(srcDir, "origin")
-				if err != nil {
-					return err
+			if onRemote {
+				if from != "" {
+					_, _ = fmt.Fprintf(cmd.OutOrStdout(), "note: --from %s ignored, origin/%s already exists\n", from, branch)
 				}
+			} else {
+				if base == "" {
+					base, err = agent.GitRemoteDefaultBranch(srcDir, "origin")
+					if err != nil {
+						return err
+					}
+				}
+				startPoint = "origin/" + base
 			}
 
 			// d. Create the worktree FROM the source checkout so the branch is
@@ -174,7 +187,7 @@ func newNewCmd() *cobra.Command {
 			if _, statErr := os.Stat(wtPath); statErr == nil {
 				return fmt.Errorf("worktree already exists at %s", wtPath)
 			}
-			if err := agent.GitWorktreeAdd(srcDir, wtPath, branch, "origin/"+base); err != nil {
+			if err := agent.GitWorktreeAdd(srcDir, wtPath, branch, startPoint); err != nil {
 				return err
 			}
 
@@ -197,9 +210,19 @@ func newNewCmd() *cobra.Command {
 				return err
 			}
 
-			// f. Report the worktree path and branch.
+			// f. A local branch left from an earlier run may sit behind origin,
+			//    so reusing it is not enough on its own.
+			summary := fmt.Sprintf("branch %s (new, from origin/%s)", branch, base)
+			if onRemote {
+				summary, err = alignToRemote(cmd.OutOrStdout(), wtPath, branch)
+				if err != nil {
+					return err
+				}
+			}
+
+			// g. Report the worktree path and which of the two paths was taken.
 			_, _ = fmt.Fprintf(cmd.OutOrStdout(), "%s\n", wtPath)
-			_, _ = fmt.Fprintf(cmd.OutOrStdout(), "branch %s (from origin/%s)\n", branch, base)
+			_, _ = fmt.Fprintf(cmd.OutOrStdout(), "%s\n", summary)
 			return nil
 		},
 	}
@@ -210,6 +233,47 @@ func newNewCmd() *cobra.Command {
 	return cmd
 }
 
+// alignToRemote puts the worktree on origin/<branch> and reports what that took.
+// A reused local branch can be stale, and a fast-forward is the only move that
+// adds no commit and drops none; a local branch carrying commits origin does not
+// have is left where it stands, because those commits exist nowhere else.
+func alignToRemote(out io.Writer, wtPath, branch string) (string, error) {
+	remoteRef := "origin/" + branch
+	want, err := agent.GitRevParse(wtPath, remoteRef)
+	if err != nil {
+		return "", err
+	}
+	head, err := agent.GitRevParse(wtPath, "HEAD")
+	if err != nil {
+		return "", err
+	}
+	if head != want {
+		ahead, err := agent.GitAheadCount(wtPath, remoteRef, "HEAD")
+		if err != nil {
+			return "", err
+		}
+		if ahead > 0 {
+			return fmt.Sprintf("branch %s (local, %s not on %s, left at %s)",
+				branch, commitCount(ahead), remoteRef, shortSHA(head)), nil
+		}
+		if err := agent.GitMergeFFOnly(wtPath, remoteRef); err != nil {
+			return "", err
+		}
+		_, _ = fmt.Fprintf(out, "fast-forwarded stale %s to %s\n", branch, remoteRef)
+	}
+	if err := agent.GitSetUpstream(wtPath, branch, remoteRef); err != nil {
+		return "", err
+	}
+	return fmt.Sprintf("branch %s (tracking %s at %s)", branch, remoteRef, shortSHA(want)), nil
+}
+
+func shortSHA(sha string) string {
+	if len(sha) > 7 {
+		return sha[:7]
+	}
+	return sha
+}
+
 // --- list -----------------------------------------------------------------
 
 func newListCmd() *cobra.Command {
@@ -228,7 +292,14 @@ func newListCmd() *cobra.Command {
 				return nil
 			}
 			for _, w := range managed {
-				_, _ = fmt.Fprintf(out, "%s\t%s\t%s\n", w.repo, w.branch, w.path)
+				branch := w.branch
+				switch {
+				case w.orphan:
+					branch = "(orphan)"
+				case w.inspectErr != nil:
+					branch = "(unreadable)"
+				}
+				_, _ = fmt.Fprintf(out, "%s\t%s\t%s\n", w.repo, branch, w.path)
 			}
 			return nil
 		},
@@ -241,10 +312,31 @@ type managedWt struct {
 	branch string
 	path   string
 	srcDir string
+	// managed is false for worktrees found via `git worktree list` that live
+	// outside the worktree root, i.e. somebody made them by hand.
+	managed bool
+	// detached is true when the worktree has no branch to fall back on, so its
+	// commits die with the checkout.
+	detached bool
+	// locked records git's own "do not remove me" marker.
+	locked bool
+	// missing is a registration whose working tree is gone: nothing to inspect,
+	// nothing to lose.
+	missing bool
+	// orphan is a directory under the worktree root whose backing git dir is
+	// proven gone, so no git state can be read from it ever again.
+	orphan bool
+	// inspectErr is set when git refused to answer for a checkout and the reason
+	// was not a proven-absent backing repo. The state is unknown, never removable.
+	inspectErr error
 }
 
 // managedWorktrees scans the worktree root and resolves each entry's repo and
 // branch from git so branch names are accurate (not the sanitized dir name).
+// Directories whose backing repo is proven gone are returned as orphans rather
+// than dropped, so callers can see (and clean up) the leftovers; a directory git
+// merely failed to answer for is returned with its error instead, because an
+// unread state must never be mistaken for a dead one.
 func managedWorktrees() ([]managedWt, error) {
 	wr, err := worktreeRoot()
 	if err != nil {
@@ -263,24 +355,238 @@ func managedWorktrees() ([]managedWt, error) {
 			continue
 		}
 		path := filepath.Join(wr, e.Name())
-		branch, err := agent.GitCurrentBranch(path)
-		if err != nil {
-			continue // not a git worktree; skip
+		if _, err := os.Stat(filepath.Join(path, ".git")); err != nil {
+			continue // not a worktree checkout at all
 		}
-		srcDir, err := agent.SourceRepoDir(path)
-		if err != nil {
+		branch, branchErr := agent.GitCurrentBranch(path)
+		srcDir, srcErr := agent.SourceRepoDir(path)
+		if branchErr != nil || srcErr != nil {
+			entry := managedWt{repo: repoFromDirName(e.Name()), path: path, managed: true}
+			if gone, err := backingRepoGone(path); err == nil && gone {
+				entry.orphan = true
+			} else if branchErr != nil {
+				entry.inspectErr = branchErr
+			} else {
+				entry.inspectErr = srcErr
+			}
+			out = append(out, entry)
 			continue
 		}
 		out = append(out, managedWt{
-			repo:   filepath.Base(srcDir),
-			branch: branch,
-			path:   path,
-			srcDir: srcDir,
+			repo:     filepath.Base(srcDir),
+			branch:   branch,
+			path:     path,
+			srcDir:   srcDir,
+			managed:  true,
+			detached: branch == "HEAD",
 		})
 	}
 	return out, nil
 }
 
+// backingRepoGone proves, by stat alone, that a worktree directory's backing
+// repo no longer exists: its .git file names a git dir that is absent, and the
+// repo's shared .git the git dir lived in is absent too. Only that pair licenses
+// deleting the directory. Every other outcome — an unreadable .git file, a git
+// dir still on disk, a stat that failed for any reason other than "not there",
+// or a mere lost registration in a repo that is still present — reports false,
+// so a transient or unexplained failure can never be read as "safe to delete".
+func backingRepoGone(path string) (bool, error) {
+	dot := filepath.Join(path, ".git")
+	info, err := os.Lstat(dot)
+	if err != nil {
+		return false, err
+	}
+	if info.IsDir() {
+		return false, nil // a standalone checkout, not a linked worktree
+	}
+	data, err := os.ReadFile(dot)
+	if err != nil {
+		return false, err
+	}
+	rest, ok := strings.CutPrefix(strings.TrimSpace(string(data)), "gitdir:")
+	if !ok {
+		return false, fmt.Errorf("%s: not a worktree gitdir pointer", dot)
+	}
+	gitDir := strings.TrimSpace(rest)
+	if gitDir == "" {
+		return false, fmt.Errorf("%s: empty gitdir", dot)
+	}
+	if !filepath.IsAbs(gitDir) {
+		gitDir = filepath.Join(path, gitDir)
+	}
+	// The git dir is "<repo>/.git/worktrees/<name>"; both it and the shared .git
+	// it sits in must be absent before the repo counts as gone.
+	for _, dir := range []string{gitDir, filepath.Dir(filepath.Dir(gitDir))} {
+		if _, err := os.Stat(dir); err == nil {
+			return false, nil
+		} else if !os.IsNotExist(err) {
+			return false, err
+		}
+	}
+	return true, nil
+}
+
+// repoFromDirName recovers the repo name from the "<repo>__<branch>" layout used
+// under the worktree root, for entries git can no longer answer for.
+func repoFromDirName(name string) string {
+	if repo, _, ok := strings.Cut(name, "__"); ok {
+		return repo
+	}
+	return name
+}
+
+// allWorktrees is every worktree prune should consider: the managed ones under
+// the worktree root, plus whatever `git worktree list` reports for the repos
+// they belong to and for every checkout in the source root. The second source
+// finds hand-made worktrees and stale registrations whose directory is gone, and
+// carries git's own locked/prunable flags onto the entries the first source
+// already found.
+func allWorktrees() ([]managedWt, error) {
+	managed, err := managedWorktrees()
+	if err != nil {
+		return nil, err
+	}
+	wr, err := worktreeRoot()
+	if err != nil {
+		return nil, err
+	}
+
+	out := make([]managedWt, 0, len(managed))
+	index := map[string]int{}
+	for _, w := range managed {
+		index[resolvePath(w.path)] = len(out)
+		out = append(out, w)
+	}
+
+	for _, srcDir := range sourceRepos(managed) {
+		wts, err := agent.GitWorktreeList(srcDir)
+		if err != nil {
+			continue // not a repo any more, or unreadable; managed entries still stand
+		}
+		for _, wt := range wts {
+			if wt.Bare || sameDir(wt.Path, srcDir) {
+				continue
+			}
+			_, statErr := os.Stat(wt.Path)
+			entry := managedWt{
+				repo:     filepath.Base(srcDir),
+				branch:   worktreeBranch(wt),
+				path:     wt.Path,
+				srcDir:   srcDir,
+				managed:  underRoot(wt.Path, wr),
+				detached: wt.Detached,
+				locked:   wt.Locked,
+				missing:  wt.Prunable != "" || os.IsNotExist(statErr),
+			}
+			key := resolvePath(wt.Path)
+			if i, ok := index[key]; ok {
+				// Keep the managed scan's own view, but adopt the flags only git knows.
+				out[i].locked = entry.locked
+				out[i].missing = out[i].missing || entry.missing
+				out[i].detached = out[i].detached || entry.detached
+				continue
+			}
+			index[key] = len(out)
+			out = append(out, entry)
+		}
+	}
+	sort.Slice(out, func(i, j int) bool {
+		if out[i].repo != out[j].repo {
+			return out[i].repo < out[j].repo
+		}
+		return out[i].path < out[j].path
+	})
+	return out, nil
+}
+
+// resolvePath is a path key that matches however git spells the same directory.
+func resolvePath(path string) string {
+	if p, err := filepath.EvalSymlinks(path); err == nil {
+		return p
+	}
+	return filepath.Clean(path)
+}
+
+// worktreeBranch names a worktree's branch, reporting a detached checkout as
+// "HEAD" so it reads the same as GitCurrentBranch does.
+func worktreeBranch(wt agent.Worktree) string {
+	if wt.Branch != "" {
+		return wt.Branch
+	}
+	return "HEAD"
+}
+
+// sourceRepos is every repo to enumerate worktrees from: the ones the managed
+// worktrees point back at, plus every git checkout directly under the source
+// root (so a repo with only hand-made worktrees is still covered). Each is
+// normalised to its main checkout, because a directory in the source root may
+// itself be a linked worktree — enumerating from there would report the repo's
+// real checkout as a removable worktree of itself.
+func sourceRepos(managed []managedWt) []string {
+	seen := map[string]bool{}
+	var dirs []string
+	add := func(dir string) {
+		if dir == "" {
+			return
+		}
+		if main, err := agent.SourceRepoDir(dir); err == nil {
+			dir = main
+		}
+		key := resolvePath(dir)
+		if seen[key] {
+			return
+		}
+		seen[key] = true
+		dirs = append(dirs, dir)
+	}
+	for _, w := range managed {
+		add(w.srcDir)
+	}
+	if sr, err := srcRoot(); err == nil {
+		if entries, err := os.ReadDir(sr); err == nil {
+			for _, e := range entries {
+				if !e.IsDir() {
+					continue
+				}
+				dir := filepath.Join(sr, e.Name())
+				if _, err := os.Stat(filepath.Join(dir, ".git")); err == nil {
+					add(dir)
+				}
+			}
+		}
+	}
+	sort.Strings(dirs)
+	return dirs
+}
+
+// sameDir compares two paths after resolving symlinks, because git reports
+// worktree paths fully resolved while our own paths may not be.
+func sameDir(a, b string) bool {
+	if a == b {
+		return true
+	}
+	ra, errA := filepath.EvalSymlinks(a)
+	rb, errB := filepath.EvalSymlinks(b)
+	return errA == nil && errB == nil && ra == rb
+}
+
+// underRoot reports whether path sits inside root, comparing resolved paths
+// because git hands back worktree paths with symlinks already resolved.
+func underRoot(path, root string) bool {
+	if r, err := filepath.EvalSymlinks(root); err == nil {
+		root = r
+	}
+	if p, err := filepath.EvalSymlinks(path); err == nil {
+		path = p
+	}
+	rel, err := filepath.Rel(root, path)
+	if err != nil {
+		return false
+	}
+	return rel != ".." && !strings.HasPrefix(rel, ".."+string(filepath.Separator))
+}
+
 // --- rm -------------------------------------------------------------------
 
 func newRmCmd() *cobra.Command {
@@ -312,7 +618,7 @@ func resolveWorktree(target string) (managedWt, error) {
 	}
 	abs, _ := filepath.Abs(target)
 	for _, w := range managed {
-		if w.path == target || w.path == abs || w.branch == target {
+		if w.path == target || w.path == abs || (w.branch != "" && w.branch == target) {
 			return w, nil
 		}
 	}
@@ -323,6 +629,18 @@ func resolveWorktree(target string) (managedWt, error) {
 // forceBranch overrides git's unmerged-branch guard, so only a caller that
 // proved the commits survive elsewhere may set it.
 func removeWorktree(out io.Writer, wt managedWt, deleteBranch, forceBranch bool) error {
+	switch {
+	case wt.inspectErr != nil:
+		// No srcDir to act through and no idea what is in there; --include-keep
+		// must not turn that into a delete.
+		return fmt.Errorf("refusing to remove %s: git state unreadable: %w", wt.path, wt.inspectErr)
+	case wt.orphan:
+		return removeOrphanDir(out, wt)
+	case wt.missing:
+		// The working tree is already gone; only the registration is left.
+		_, _ = fmt.Fprintf(out, "pruned stale registration %s\n", wt.path)
+		return agent.GitWorktreePrune(wt.srcDir)
+	}
 	if err := agent.GitWorktreeRemove(wt.srcDir, wt.path, true); err != nil {
 		return err
 	}
@@ -340,6 +658,24 @@ func removeWorktree(out io.Writer, wt managedWt, deleteBranch, forceBranch bool)
 	return agent.GitWorktreePrune(wt.srcDir)
 }
 
+// removeOrphanDir deletes a worktree directory whose backing repo is gone. git
+// cannot act on it, so this is a plain delete — confined to the worktree root so
+// a bad path can never reach a real checkout.
+func removeOrphanDir(out io.Writer, wt managedWt) error {
+	wr, err := worktreeRoot()
+	if err != nil {
+		return err
+	}
+	if !underRoot(wt.path, wr) || sameDir(wt.path, wr) {
+		return fmt.Errorf("refusing to delete %s: not inside the worktree root %s", wt.path, wr)
+	}
+	if err := os.RemoveAll(wt.path); err != nil {
+		return err
+	}
+	_, _ = fmt.Fprintf(out, "deleted orphaned worktree directory %s\n", wt.path)
+	return nil
+}
+
 // deleteLocalBranch tries the guarded delete first so git refuses to drop
 // unmerged commits on its own; force is a fallback, never the first attempt.
 func deleteLocalBranch(wt managedWt, force bool) error {

cmd/agentws/new_test.go

@@ -0,0 +1,192 @@
+package main
+
+import (
+	"bytes"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"git.unkin.net/unkin/agent-tools/internal/agent"
+)
+
+// newFixtureOn builds the same origin/source/worktree-root layout as the prune
+// fixture but with a chosen default branch, so `new` can be tested against a
+// repo whose default is not "main".
+func newFixtureOn(t *testing.T, defBranch string) *fixture {
+	t.Helper()
+	root := t.TempDir()
+	f := &fixture{
+		root:   root,
+		bare:   filepath.Join(root, "origin.git"),
+		srcDir: filepath.Join(root, "src", "repo"),
+		wtRoot: filepath.Join(root, "worktrees"),
+	}
+	git(t, root, "init", "--bare", "-b", defBranch, f.bare)
+
+	seed := filepath.Join(root, "seed")
+	git(t, root, "init", "-b", defBranch, seed)
+	identity(t, seed)
+	writeCommit(t, seed, "README.md", "hi\n", "init")
+	git(t, seed, "remote", "add", "origin", f.bare)
+	git(t, seed, "push", "-u", "origin", defBranch)
+
+	git(t, root, "clone", f.bare, f.srcDir)
+	identity(t, f.srcDir)
+
+	t.Setenv("AGENTWS_ROOT", f.wtRoot)
+	t.Setenv("AGENTWS_SRC_ROOT", filepath.Join(root, "src"))
+	t.Setenv("AGENTWS_OWNER", "unkin")
+	return f
+}
+
+// runNew invokes `agentws new repo --branch <branch>` and returns its output.
+func runNew(t *testing.T, branch string, extra ...string) string {
+	t.Helper()
+	var out bytes.Buffer
+	cmd := newRootCmd()
+	cmd.SetArgs(append([]string{"new", "repo", "--branch", branch}, extra...))
+	cmd.SetOut(&out)
+	cmd.SetErr(&out)
+	if err := cmd.Execute(); err != nil {
+		t.Fatalf("new %s: %v (output %q)", branch, err, out.String())
+	}
+	return out.String()
+}
+
+// pushBranch creates branch on origin carrying one commit and returns its SHA.
+func pushBranch(t *testing.T, f *fixture, branch, file, content string) string {
+	t.Helper()
+	seed := filepath.Join(f.root, "seed")
+	git(t, seed, "checkout", "-b", branch)
+	writeCommit(t, seed, file, content, "work on "+branch)
+	git(t, seed, "push", "origin", branch)
+	return git(t, seed, "rev-parse", "HEAD")
+}
+
+func wtPathFor(f *fixture, branch string) string {
+	return filepath.Join(f.wtRoot, agent.WorktreeDirName("repo", branch))
+}
+
+// The regression: a branch that already exists on origin must be checked out at
+// origin's tip, not forked from the default branch.
+func TestNewChecksOutExistingRemoteBranch(t *testing.T) {
+	f := newFixtureOn(t, "main")
+	want := pushBranch(t, f, "benvin/existing", "a.txt", "a\n")
+
+	out := runNew(t, "benvin/existing")
+
+	path := wtPathFor(f, "benvin/existing")
+	if got := git(t, path, "rev-parse", "HEAD"); got != want {
+		t.Errorf("worktree HEAD = %s, want origin/benvin/existing %s", got, want)
+	}
+	if upstream := git(t, path, "rev-parse", "--abbrev-ref", "HEAD@{upstream}"); upstream != "origin/benvin/existing" {
+		t.Errorf("upstream = %q, want origin/benvin/existing", upstream)
+	}
+	if !contains(out, "tracking origin/benvin/existing") {
+		t.Errorf("output %q does not say the remote branch was checked out", out)
+	}
+}
+
+// A branch origin does not have is still forked from the default branch, and the
+// output must say so rather than leaving the caller to guess.
+func TestNewForksBranchMissingFromRemote(t *testing.T) {
+	f := newFixtureOn(t, "main")
+	want := git(t, f.srcDir, "rev-parse", "origin/main")
+
+	out := runNew(t, "benvin/fresh")
+
+	path := wtPathFor(f, "benvin/fresh")
+	if got := git(t, path, "rev-parse", "HEAD"); got != want {
+		t.Errorf("worktree HEAD = %s, want origin/main %s", got, want)
+	}
+	if !contains(out, "branch benvin/fresh (new, from origin/main)") {
+		t.Errorf("output %q does not report a new branch", out)
+	}
+}
+
+// The base is the remote's own default branch, so a repo defaulting to master
+// forks from master.
+func TestNewForksFromMasterDefaultBranch(t *testing.T) {
+	f := newFixtureOn(t, "master")
+	want := git(t, f.srcDir, "rev-parse", "origin/master")
+
+	out := runNew(t, "benvin/on-master")
+
+	path := wtPathFor(f, "benvin/on-master")
+	if got := git(t, path, "rev-parse", "HEAD"); got != want {
+		t.Errorf("worktree HEAD = %s, want origin/master %s", got, want)
+	}
+	if !contains(out, "from origin/master") {
+		t.Errorf("output %q does not name origin/master as the base", out)
+	}
+}
+
+// An existing remote branch beats --from: the flag is ignored and the caller is
+// told, rather than the branch being silently re-forked.
+func TestNewIgnoresFromWhenBranchIsOnRemote(t *testing.T) {
+	f := newFixtureOn(t, "main")
+	want := pushBranch(t, f, "benvin/with-from", "a.txt", "a\n")
+
+	out := runNew(t, "benvin/with-from", "--from", "main")
+
+	path := wtPathFor(f, "benvin/with-from")
+	if got := git(t, path, "rev-parse", "HEAD"); got != want {
+		t.Errorf("worktree HEAD = %s, want origin/benvin/with-from %s", got, want)
+	}
+	if !contains(out, "--from main ignored") {
+		t.Errorf("output %q does not report the ignored --from", out)
+	}
+}
+
+// A local branch left behind by an earlier run must not pin the worktree to a
+// commit origin has moved past.
+func TestNewFastForwardsStaleLocalBranch(t *testing.T) {
+	f := newFixtureOn(t, "main")
+	stale := pushBranch(t, f, "benvin/stale", "a.txt", "a\n")
+	git(t, f.srcDir, "fetch", "origin")
+	git(t, f.srcDir, "branch", "benvin/stale", "origin/benvin/stale")
+
+	seed := filepath.Join(f.root, "seed")
+	writeCommit(t, seed, "b.txt", "b\n", "more work")
+	git(t, seed, "push", "origin", "benvin/stale")
+	want := git(t, seed, "rev-parse", "HEAD")
+	if want == stale {
+		t.Fatal("fixture did not move origin/benvin/stale on")
+	}
+
+	out := runNew(t, "benvin/stale")
+
+	path := wtPathFor(f, "benvin/stale")
+	if got := git(t, path, "rev-parse", "HEAD"); got != want {
+		t.Errorf("worktree HEAD = %s, want origin/benvin/stale %s", got, want)
+	}
+	if !contains(out, "fast-forwarded stale benvin/stale") {
+		t.Errorf("output %q does not report the fast-forward", out)
+	}
+}
+
+// A local branch carrying commits origin does not have keeps them: they exist
+// nowhere else, so the worktree stays put and the output says so.
+func TestNewKeepsLocalCommitsAheadOfRemote(t *testing.T) {
+	f := newFixtureOn(t, "main")
+	pushBranch(t, f, "benvin/ahead", "a.txt", "a\n")
+	git(t, f.srcDir, "fetch", "origin")
+	git(t, f.srcDir, "checkout", "-b", "benvin/ahead", "origin/benvin/ahead")
+	writeCommit(t, f.srcDir, "local.txt", "local\n", "local only")
+	want := git(t, f.srcDir, "rev-parse", "HEAD")
+	git(t, f.srcDir, "checkout", "main")
+
+	out := runNew(t, "benvin/ahead")
+
+	path := wtPathFor(f, "benvin/ahead")
+	if got := git(t, path, "rev-parse", "HEAD"); got != want {
+		t.Errorf("worktree HEAD = %s, want the local tip %s", got, want)
+	}
+	if !contains(out, "1 commit not on origin/benvin/ahead") {
+		t.Errorf("output %q does not report the unpushed commit", out)
+	}
+}
+
+func contains(haystack, needle string) bool {
+	return strings.Contains(haystack, needle)
+}

cmd/agentws/prune.go

@@ -1,11 +1,15 @@
 package main
 
 import (
+	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
+	"os"
 	"path/filepath"
 	"sort"
+	"strings"
+	"text/tabwriter"
 
 	"git.unkin.net/unkin/agent-tools/internal/agent"
 
@@ -43,22 +47,49 @@ type repoCtx struct {
 	// fetched records that this run's pruning fetch succeeded; without it an
 	// origin/<branch> ref may be stale and due for deletion, so it proves nothing.
 	fetched bool
+	// unfetched explains why, so a verdict can say which it was.
+	unfetched string
+}
+
+// pruneOpts is the knob set runPrune is driven by.
+type pruneOpts struct {
+	apply            bool
+	keepBranches     bool
+	noFetch          bool
+	jsonOut          bool
+	includeKeep      bool
+	includeUnmanaged bool
+}
+
+// reportEntry is the --json shape: one object per worktree, mirroring the table.
+type reportEntry struct {
+	Repo    string `json:"repo"`
+	Branch  string `json:"branch"`
+	Path    string `json:"path"`
+	Verdict string `json:"verdict"`
+	Reason  string `json:"reason"`
+	Managed bool   `json:"managed"`
+	Applied bool   `json:"applied"`
 }
 
 func newPruneCmd() *cobra.Command {
-	var apply, keepBranches bool
+	var opts pruneOpts
 	cmd := &cobra.Command{
 		Use:          "prune",
-		Short:        "Classify managed worktrees and remove the ones whose work is safely upstream",
-		Long:         "prune inspects every managed worktree, classifies it against git and its Gitea\npull request, and removes the ones whose work is provably upstream. It is a dry\nrun unless --yes is given.",
+		Short:        "Classify worktrees and remove the ones whose work is safely upstream",
+		Long:         "prune inspects every worktree it can find — the managed ones under the worktree\nroot plus whatever `git worktree list` reports for the source checkouts — and\nclassifies each against git and its Gitea pull request. It reports and changes\nnothing unless --yes is given.",
 		SilenceUsage: true,
 		RunE: func(cmd *cobra.Command, args []string) error {
-			return runPrune(cmd.OutOrStdout(), pruneClient(), apply, keepBranches)
+			return runPrune(cmd.OutOrStdout(), cmd.ErrOrStderr(), pruneClient(), opts)
 		},
 	}
 	f := cmd.Flags()
-	f.BoolVar(&apply, "yes", false, "Actually remove worktrees (default is a dry run)")
-	f.BoolVar(&keepBranches, "keep-branches", false, "Never delete a local branch, whatever the classification")
+	f.BoolVar(&opts.apply, "yes", false, "Actually remove worktrees (default is a dry run)")
+	f.BoolVar(&opts.keepBranches, "keep-branches", false, "Never delete a local branch, whatever the classification")
+	f.BoolVar(&opts.noFetch, "no-fetch", false, "Do not fetch; judge against the refs already on disk")
+	f.BoolVar(&opts.jsonOut, "json", false, "Emit JSON instead of a table")
+	f.BoolVar(&opts.includeKeep, "include-keep", false, "Dangerous: also remove worktrees classified keep (needs --yes). Destroys uncommitted changes and paused rebase/merge state, which no branch is carrying; only the branch itself survives")
+	f.BoolVar(&opts.includeUnmanaged, "include-unmanaged", false, "Also remove worktrees that live outside the worktree root")
 	return cmd
 }
 
@@ -72,58 +103,153 @@ func pruneClient() prLister {
 	return agent.NewGiteaClient(tok)
 }
 
-func runPrune(out io.Writer, prs prLister, apply, keepBranches bool) error {
-	managed, err := managedWorktrees()
+func runPrune(out, errOut io.Writer, prs prLister, opts pruneOpts) error {
+	// In JSON mode stdout carries the document alone, so notes go to stderr.
+	notes := out
+	if opts.jsonOut {
+		notes = errOut
+	}
+
+	worktrees, err := allWorktrees()
 	if err != nil {
 		return err
 	}
-	if len(managed) == 0 {
+	if len(worktrees) == 0 {
+		if opts.jsonOut {
+			_, _ = fmt.Fprintln(out, "[]")
+			return nil
+		}
 		_, _ = fmt.Fprintln(out, "no managed worktrees")
 		return nil
 	}
 
-	byRepo := map[string][]managedWt{}
-	for _, w := range managed {
-		byRepo[w.srcDir] = append(byRepo[w.srcDir], w)
+	results := classifyAll(notes, prs, worktrees, opts)
+	if err := report(out, results, opts); err != nil {
+		return err
 	}
+	if !opts.apply {
+		if !opts.jsonOut {
+			_, _ = fmt.Fprintln(out, "dry run: nothing removed (pass --yes to apply)")
+		}
+		return nil
+	}
+	return applyPrune(notes, results, opts)
+}
+
+// classifyAll groups worktrees by source repo so each repo is fetched and its
+// PRs listed once, then classifies every worktree against that repo's state.
+func classifyAll(notes io.Writer, prs prLister, worktrees []managedWt, opts pruneOpts) []pruneResult {
+	byRepo := map[string][]managedWt{}
+	var results []pruneResult
+	for _, w := range worktrees {
+		switch {
+		case w.inspectErr != nil:
+			// Unknown is not gone: a checkout git refused to answer for keeps.
+			results = append(results, pruneResult{wt: w, verdict: verdictKeep, reason: "inspection failed: " + oneLine(w.inspectErr.Error())})
+		case w.orphan:
+			results = append(results, pruneResult{wt: w, verdict: verdictRemove, reason: "backing repo gone, no git state to read"})
+		default:
+			byRepo[w.srcDir] = append(byRepo[w.srcDir], w)
+		}
+	}
+
 	srcDirs := make([]string, 0, len(byRepo))
 	for dir := range byRepo {
 		srcDirs = append(srcDirs, dir)
 	}
 	sort.Strings(srcDirs)
 
-	var results []pruneResult
 	for _, srcDir := range srcDirs {
-		ctx, err := newRepoCtx(out, prs, srcDir)
+		ctx, err := newRepoCtx(notes, prs, srcDir, opts.noFetch)
 		if err != nil {
 			for _, w := range byRepo[srcDir] {
-				results = append(results, pruneResult{wt: w, verdict: verdictKeep, reason: "repo state unknown: " + err.Error()})
+				results = append(results, pruneResult{wt: w, verdict: verdictKeep, reason: "repo state unknown: " + oneLine(err.Error())})
 			}
 			continue
 		}
 		for _, w := range byRepo[srcDir] {
 			res, err := classify(w, ctx)
 			if err != nil {
-				res = pruneResult{wt: w, verdict: verdictKeep, reason: "inspection failed: " + err.Error()}
+				res = pruneResult{wt: w, verdict: verdictKeep, reason: "inspection failed: " + oneLine(err.Error())}
 			}
 			results = append(results, res)
 		}
 	}
+	sort.SliceStable(results, func(i, j int) bool {
+		if results[i].wt.repo != results[j].wt.repo {
+			return results[i].wt.repo < results[j].wt.repo
+		}
+		return results[i].wt.path < results[j].wt.path
+	})
+	return results
+}
 
+// report writes the classification as a table or as JSON.
+func report(out io.Writer, results []pruneResult, opts pruneOpts) error {
+	if opts.jsonOut {
+		entries := make([]reportEntry, 0, len(results))
+		for _, r := range results {
+			entries = append(entries, reportEntry{
+				Repo:    r.wt.repo,
+				Branch:  r.wt.branch,
+				Path:    r.wt.path,
+				Verdict: plannedVerdict(r, opts),
+				Reason:  r.reason,
+				Managed: r.wt.managed,
+				Applied: opts.apply && willRemove(r, opts),
+			})
+		}
+		enc := json.NewEncoder(out)
+		enc.SetIndent("", "  ")
+		return enc.Encode(entries)
+	}
+
+	// Padded with spaces only, so the table reads the same with or without a TTY.
+	tw := tabwriter.NewWriter(out, 0, 0, 2, ' ', 0)
+	_, _ = fmt.Fprintln(tw, "REPO\tBRANCH\tPATH\tVERDICT\tREASON")
 	for _, r := range results {
-		_, _ = fmt.Fprintf(out, "%-44s %-34s %-14s %s\n", filepath.Base(r.wt.path), r.wt.branch, plannedVerdict(r, keepBranches), r.reason)
-	}
-	if !apply {
-		_, _ = fmt.Fprintln(out, "dry run: nothing removed (pass --yes to apply)")
-		return nil
+		_, _ = fmt.Fprintf(tw, "%s\t%s\t%s\t%s\t%s\n",
+			dash(r.wt.repo), dash(r.wt.branch), abbrevHome(r.wt.path), plannedVerdict(r, opts), r.reason)
 	}
+	return tw.Flush()
+}
 
+// oneLine flattens a git error onto a single line so one row stays one row.
+func oneLine(s string) string {
+	return strings.Join(strings.Fields(s), " ")
+}
+
+func dash(s string) string {
+	if s == "" {
+		return "-"
+	}
+	return s
+}
+
+// abbrevHome shortens $HOME to ~ so paths do not dominate the table.
+func abbrevHome(path string) string {
+	home, err := os.UserHomeDir()
+	if err != nil || home == "" || !strings.HasPrefix(path, home+string(filepath.Separator)) {
+		return path
+	}
+	return "~" + path[len(home):]
+}
+
+// applyPrune performs the removals the classification authorised, reporting each
+// one and collecting failures so one bad worktree does not stop the rest.
+func applyPrune(out io.Writer, results []pruneResult, opts pruneOpts) error {
 	var errs []error
 	for _, r := range results {
-		if r.verdict == verdictKeep {
+		if !willRemove(r, opts) {
+			if !r.wt.managed && r.verdict != verdictKeep {
+				_, _ = fmt.Fprintf(out, "skipped %s: outside the worktree root (pass --include-unmanaged)\n", r.wt.path)
+			}
 			continue
 		}
-		deleteBranch := r.verdict == verdictRemoveBranch && !keepBranches
+		if r.verdict == verdictKeep {
+			_, _ = fmt.Fprintf(out, "warn: removing %s despite %q (--include-keep)\n", r.wt.path, r.reason)
+		}
+		deleteBranch := plannedVerdict(r, opts) == verdictRemoveBranch
 		if err := removeWorktree(out, r.wt, deleteBranch, r.proven); err != nil {
 			errs = append(errs, fmt.Errorf("%s: %w", r.wt.path, err))
 		}
@@ -131,23 +257,44 @@ func runPrune(out io.Writer, prs prLister, apply, keepBranches bool) error {
 	return errors.Join(errs...)
 }
 
-// plannedVerdict is what will actually happen, so --keep-branches does not
-// print a branch deletion it will not perform.
-func plannedVerdict(r pruneResult, keepBranches bool) string {
-	if keepBranches && r.verdict == verdictRemoveBranch {
+// willRemove is the single gate on destruction: a keep verdict needs
+// --include-keep, and a worktree outside the worktree root needs
+// --include-unmanaged.
+func willRemove(r pruneResult, opts pruneOpts) bool {
+	if !r.wt.managed && !opts.includeUnmanaged {
+		return false
+	}
+	if r.verdict == verdictKeep {
+		return opts.includeKeep
+	}
+	return true
+}
+
+// plannedVerdict is what will actually happen, so no flag prints an action it
+// will not perform. A detached HEAD has no branch to delete, and a keep forced
+// through with --include-keep never takes its branch with it.
+func plannedVerdict(r pruneResult, opts pruneOpts) string {
+	if r.verdict != verdictRemoveBranch {
+		return r.verdict
+	}
+	if opts.keepBranches || r.wt.detached {
 		return verdictRemove
 	}
-	return r.verdict
+	return verdictRemoveBranch
 }
 
 // newRepoCtx refreshes a source repo and collects the signals prune classifies
-// against. A failed fetch or an unreachable Gitea is reported and tolerated:
-// the signals that hold offline still work, and the rest are recorded as
-// unverified.
-func newRepoCtx(out io.Writer, prs prLister, srcDir string) (repoCtx, error) {
+// against. A failed or skipped fetch and an unreachable Gitea are reported and
+// tolerated: the signals that hold offline still work, and the rest are recorded
+// as unverified.
+func newRepoCtx(out io.Writer, prs prLister, srcDir string, noFetch bool) (repoCtx, error) {
 	ctx := repoCtx{srcDir: srcDir, prs: map[string]agent.PullRequest{}}
 	repo := filepath.Base(srcDir)
-	if err := agent.GitFetchPrune(srcDir, "origin", credentialHelperArgs()...); err != nil {
+	if noFetch {
+		ctx.unfetched = "fetch skipped"
+		_, _ = fmt.Fprintf(out, "warn: fetch %s skipped (--no-fetch, remote state unverified)\n", repo)
+	} else if err := agent.GitFetchPrune(srcDir, "origin", credentialHelperArgs()...); err != nil {
+		ctx.unfetched = "fetch failed"
 		_, _ = fmt.Fprintf(out, "warn: fetch %s: %v (remote state unverified)\n", repo, err)
 	} else {
 		ctx.fetched = true
@@ -225,14 +372,33 @@ func headContainedIn(dir, ref string) bool {
 	return err == nil && ok
 }
 
-// classify applies the prune precedence: dirty and open-PR worktrees are kept,
-// provably-upstream work loses its branch too, and anything unproven keeps its
-// branch so no commits become unreachable. A PR's state alone never authorises
-// deleting a branch — git must confirm HEAD is contained in what merged or in
-// what origin still holds, and origin's refs only count when this run's pruning
-// fetch refreshed them.
+// classify applies the prune precedence. Removal must never destroy state that
+// exists nowhere else: a vanished working tree is the one case with nothing to
+// lose, a locked or mid-rebase checkout holds sequencer state git itself refuses
+// to discard, and a dirty checkout or a detached HEAD with unique commits holds
+// work no branch is carrying. Past those guards, provably-upstream work loses its
+// branch too, and anything unproven keeps its branch so no commit becomes
+// unreachable. A PR's state alone never authorises deleting a branch — git must
+// confirm HEAD is contained in what merged or in what origin still holds, and
+// origin's refs only count when this run's pruning fetch refreshed them.
 func classify(wt managedWt, ctx repoCtx) (pruneResult, error) {
 	res := pruneResult{wt: wt}
+	if wt.missing {
+		res.verdict, res.reason = verdictRemove, "working tree gone, stale registration only"
+		return res, nil
+	}
+	if wt.locked {
+		res.verdict, res.reason = verdictKeep, "locked"
+		return res, nil
+	}
+	op, err := agent.GitInProgressOp(wt.path)
+	if err != nil {
+		return res, err
+	}
+	if op != "" {
+		res.verdict, res.reason = verdictKeep, op+" in progress"
+		return res, nil
+	}
 	dirty, err := agent.GitIsDirty(wt.path)
 	if err != nil {
 		return res, err
@@ -267,6 +433,15 @@ func classify(wt managedWt, ctx repoCtx) (pruneResult, error) {
 		return res, nil
 	}
 
+	local, err := agent.GitCommitsNotOnRemotes(wt.path)
+	if err != nil {
+		return res, err
+	}
+	if wt.detached && local > 0 {
+		res.verdict, res.reason = verdictKeep, fmt.Sprintf("detached HEAD carrying %s on no remote", commitCount(local))
+		return res, nil
+	}
+
 	remote := "origin/" + wt.branch
 	onOrigin := hasPR && ctx.fetched && agent.GitRemoteBranchExists(ctx.srcDir, "origin", wt.branch)
 	switch {
@@ -275,7 +450,7 @@ func classify(wt managedWt, ctx repoCtx) (pruneResult, error) {
 	case hasPR && pr.Merged && onOrigin && headContainedIn(wt.path, remote):
 		res.verdict, res.reason, res.proven = verdictRemoveBranch, fmt.Sprintf("PR merged #%d, HEAD contained in %s", pr.Number, remote), true
 	case hasPR && pr.Merged && !ctx.fetched:
-		res.verdict, res.reason = verdictRemove, fmt.Sprintf("PR merged #%d, fetch failed so %s is unverified", pr.Number, remote)
+		res.verdict, res.reason = verdictRemove, fmt.Sprintf("PR merged #%d, %s so %s is unverified", pr.Number, ctx.unfetched, remote)
 	case hasPR && pr.Merged:
 		res.verdict, res.reason = verdictRemove, fmt.Sprintf("PR merged #%d, local commits not in the merged head", pr.Number)
 	case hasPR && onOrigin && headContainedIn(wt.path, remote):
@@ -283,7 +458,7 @@ func classify(wt managedWt, ctx repoCtx) (pruneResult, error) {
 	case hasPR && onOrigin:
 		res.verdict, res.reason = verdictRemove, fmt.Sprintf("PR closed #%d, local commits not on %s", pr.Number, remote)
 	case hasPR && !ctx.fetched:
-		res.verdict, res.reason = verdictRemove, fmt.Sprintf("PR closed #%d, fetch failed so %s is unverified", pr.Number, remote)
+		res.verdict, res.reason = verdictRemove, fmt.Sprintf("PR closed #%d, %s so %s is unverified", pr.Number, ctx.unfetched, remote)
 	case hasPR:
 		res.verdict, res.reason = verdictRemove, fmt.Sprintf("PR closed #%d, branch gone", pr.Number)
 	case ctx.prsKnown:
@@ -291,5 +466,15 @@ func classify(wt managedWt, ctx repoCtx) (pruneResult, error) {
 	default:
 		res.verdict, res.reason = verdictRemove, "PR state unknown"
 	}
+	if res.verdict == verdictRemove && local > 0 {
+		res.reason += fmt.Sprintf(", %s on no remote so branch %s is kept", commitCount(local), wt.branch)
+	}
 	return res, nil
 }
+
+func commitCount(n int) string {
+	if n == 1 {
+		return "1 commit"
+	}
+	return fmt.Sprintf("%d commits", n)
+}

cmd/agentws/prune_test.go

@@ -166,17 +166,22 @@ func closedPR(number int, branch string) map[string]any {
 
 func run(t *testing.T, prs prLister, apply, keepBranches bool) string {
 	t.Helper()
-	var out bytes.Buffer
-	if err := runPrune(&out, prs, apply, keepBranches); err != nil {
-		t.Fatalf("runPrune: %v\n%s", err, out.String())
+	return runOpts(t, prs, pruneOpts{apply: apply, keepBranches: keepBranches})
+}
+
+func runOpts(t *testing.T, prs prLister, opts pruneOpts) string {
+	t.Helper()
+	var out, errOut bytes.Buffer
+	if err := runPrune(&out, &errOut, prs, opts); err != nil {
+		t.Fatalf("runPrune: %v\n%s%s", err, out.String(), errOut.String())
 	}
-	return out.String()
+	return out.String() + errOut.String()
 }
 
 func lineFor(t *testing.T, out, branch string) string {
 	t.Helper()
 	for _, line := range strings.Split(out, "\n") {
-		if strings.Contains(line, " "+branch+" ") {
+		if fields := strings.Fields(line); len(fields) > 1 && fields[1] == branch {
 			return line
 		}
 	}
@@ -184,11 +189,12 @@ func lineFor(t *testing.T, out, branch string) string {
 	return ""
 }
 
+// assertVerdict reads the table row for a branch: REPO BRANCH PATH VERDICT REASON.
 func assertVerdict(t *testing.T, out, branch, verdict, reason string) {
 	t.Helper()
 	line := lineFor(t, out, branch)
 	fields := strings.Fields(line)
-	if len(fields) < 3 || fields[2] != verdict {
+	if len(fields) < 4 || fields[3] != verdict {
 		t.Errorf("branch %s: verdict line %q, want verdict %q", branch, line, verdict)
 	}
 	if reason != "" && !strings.Contains(line, reason) {
@@ -559,12 +565,12 @@ func (f *fixture) breakRemote(t *testing.T) {
 // classification and the removals it authorised happen regardless.
 func applyUnreachable(t *testing.T, prs prLister) string {
 	t.Helper()
-	var out bytes.Buffer
-	err := runPrune(&out, prs, true, false)
+	var out, errOut bytes.Buffer
+	err := runPrune(&out, &errOut, prs, pruneOpts{apply: true})
 	if err == nil {
 		t.Fatalf("expected the refresh fetch to fail against a missing remote:\n%s", out.String())
 	}
-	return out.String()
+	return out.String() + errOut.String()
 }
 
 // staleFixture builds a repo where origin/<branch> covers HEAD for a closed and
@@ -685,3 +691,433 @@ func TestRepoPathFollowsOrigin(t *testing.T) {
 		t.Errorf("repoPath for a local remote = %q, want unkin/dotfiles", got)
 	}
 }
+
+// --- discovery beyond the worktree root -----------------------------------
+
+// gitAllow runs git and returns its combined output without failing the test,
+// for commands that are expected to stop mid-way (e.g. an interrupted rebase).
+func gitAllow(t *testing.T, dir string, args ...string) string {
+	t.Helper()
+	cmd := exec.Command("git", args...)
+	cmd.Dir = dir
+	out, _ := cmd.CombinedOutput()
+	return strings.TrimSpace(string(out))
+}
+
+// addManualWorktree creates a worktree outside the worktree root, the way a
+// person would by hand, so only `git worktree list` can find it.
+func (f *fixture) addManualWorktree(t *testing.T, branch string) string {
+	t.Helper()
+	path := filepath.Join(f.root, "manual", agent.SanitizeBranch(branch))
+	git(t, f.srcDir, "worktree", "add", path, "-b", branch, "origin/main")
+	identity(t, path)
+	return path
+}
+
+// A hand-made worktree outside the worktree root is still classified, but the
+// default run refuses to remove it: that needs --include-unmanaged.
+func TestPruneReportsUnmanagedWorktreeButKeepsIt(t *testing.T) {
+	f := newFixture(t)
+	manual := f.addManualWorktree(t, "benvin/by-hand")
+
+	srv := fakeGitea(t)
+	out := runOpts(t, client(srv), pruneOpts{apply: true})
+	assertVerdict(t, out, "benvin/by-hand", verdictRemoveBranch, "contained in origin/main")
+	if !strings.Contains(out, "--include-unmanaged") {
+		t.Errorf("output should name the flag that would remove it:\n%s", out)
+	}
+	if !exists(manual) {
+		t.Error("an unmanaged worktree must survive without --include-unmanaged")
+	}
+	if !agent.GitBranchExists(f.srcDir, "benvin/by-hand") {
+		t.Error("an unmanaged worktree's branch must survive too")
+	}
+}
+
+func TestPruneRemovesUnmanagedWorktreeWithFlag(t *testing.T) {
+	f := newFixture(t)
+	manual := f.addManualWorktree(t, "benvin/by-hand")
+
+	srv := fakeGitea(t)
+	out := runOpts(t, client(srv), pruneOpts{apply: true, includeUnmanaged: true})
+	assertVerdict(t, out, "benvin/by-hand", verdictRemoveBranch, "contained in origin/main")
+	if exists(manual) {
+		t.Error("--include-unmanaged should have removed the worktree")
+	}
+}
+
+// --include-unmanaged only lifts the location gate. A keep verdict is a separate
+// gate, so a dirty hand-made worktree still needs --include-keep to be touched.
+func TestPruneIncludeUnmanagedStillObeysKeep(t *testing.T) {
+	f := newFixture(t)
+	manual := f.addManualWorktree(t, "benvin/by-hand")
+	if err := os.WriteFile(filepath.Join(manual, "scratch.txt"), []byte("wip\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	srv := fakeGitea(t)
+	out := runOpts(t, client(srv), pruneOpts{apply: true, includeUnmanaged: true})
+	assertVerdict(t, out, "benvin/by-hand", verdictKeep, "dirty")
+	if !exists(filepath.Join(manual, "scratch.txt")) {
+		t.Error("--include-unmanaged must not remove a worktree classified keep")
+	}
+}
+
+// A worktree whose directory was deleted leaves only a registration behind:
+// there is nothing to lose, so it is prunable outright.
+func TestPruneStaleRegistrationWithMissingDirectory(t *testing.T) {
+	f := newFixture(t)
+	wt := f.addWorktree(t, "benvin/vanished")
+	writeCommit(t, wt, "v.txt", "v\n", "work")
+	if err := os.RemoveAll(wt); err != nil {
+		t.Fatal(err)
+	}
+
+	srv := fakeGitea(t)
+	out := runOpts(t, client(srv), pruneOpts{apply: true})
+	assertVerdict(t, out, "benvin/vanished", verdictRemove, "working tree gone")
+
+	wts, err := agent.GitWorktreeList(f.srcDir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, w := range wts {
+		if w.Path == wt {
+			t.Errorf("registration for %s should have been pruned: %+v", wt, w)
+		}
+	}
+	if !agent.GitBranchExists(f.srcDir, "benvin/vanished") {
+		t.Error("pruning a registration must not delete the branch")
+	}
+}
+
+// A directory under the worktree root whose backing repo is gone cannot be
+// inspected by git at all, so prune deletes the leftover directory.
+func TestPruneOrphanedDirectoryWhenRepoIsGone(t *testing.T) {
+	f := newFixture(t)
+	other := filepath.Join(f.root, "src", "other")
+	git(t, filepath.Join(f.root, "src"), "clone", f.bare, other)
+	identity(t, other)
+	orphan := filepath.Join(f.wtRoot, agent.WorktreeDirName("other", "benvin/orphaned"))
+	git(t, other, "worktree", "add", orphan, "-b", "benvin/orphaned", "origin/main")
+	if err := os.RemoveAll(other); err != nil {
+		t.Fatal(err)
+	}
+
+	srv := fakeGitea(t)
+	out := runOpts(t, client(srv), pruneOpts{apply: true})
+	assertVerdict(t, out, "-", verdictRemove, "backing repo gone")
+	if exists(orphan) {
+		t.Error("an orphaned worktree directory should have been deleted")
+	}
+}
+
+// addForeignWorktree clones a second repo under the source root and gives it a
+// worktree under the worktree root, so it can be broken without touching the
+// fixture's own repo. It returns the clone and the worktree path.
+func (f *fixture) addForeignWorktree(t *testing.T, repo, branch string) (string, string) {
+	t.Helper()
+	src := filepath.Join(f.root, "src", repo)
+	git(t, filepath.Join(f.root, "src"), "clone", f.bare, src)
+	identity(t, src)
+	wt := filepath.Join(f.wtRoot, agent.WorktreeDirName(repo, branch))
+	git(t, src, "worktree", "add", wt, "-b", branch, "origin/main")
+	return src, wt
+}
+
+// The regression this guards: git failing for a reason that is not "the backing
+// repo is gone" used to be read as orphan, and orphan deletes the directory
+// outright. Here the git dir is still on disk — only its commondir pointer is
+// broken, as a half-written or momentarily unreachable repo would be — so the
+// verdict must be keep and the directory must survive a --yes run.
+func TestPruneKeepsWorktreeWhenGitFailsButRepoExists(t *testing.T) {
+	f := newFixture(t)
+	src, wt := f.addForeignWorktree(t, "other", "benvin/unreadable")
+	writeCommit(t, wt, "u.txt", "u\n", "work")
+	gitDir, err := agent.GitDir(wt)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Remove(filepath.Join(gitDir, "commondir")); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := agent.GitCurrentBranch(wt); err == nil {
+		t.Fatal("fixture did not break git in the worktree")
+	}
+	if !exists(gitDir) || !exists(filepath.Join(src, ".git")) {
+		t.Fatal("fixture removed the backing repo; it must still be present")
+	}
+
+	srv := fakeGitea(t)
+	out := runOpts(t, client(srv), pruneOpts{apply: true})
+	assertVerdict(t, out, "-", verdictKeep, "inspection failed")
+	if !exists(wt) {
+		t.Error("a worktree git could not be read must not be deleted")
+	}
+}
+
+// The same rule one step further in: the registration is gone but the repo is
+// not, so the directory is still recoverable and must not be deleted.
+func TestPruneKeepsWorktreeWhenOnlyRegistrationIsGone(t *testing.T) {
+	f := newFixture(t)
+	src, wt := f.addForeignWorktree(t, "other", "benvin/deregistered")
+	gitDir, err := agent.GitDir(wt)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := os.RemoveAll(gitDir); err != nil {
+		t.Fatal(err)
+	}
+	if !exists(filepath.Join(src, ".git")) {
+		t.Fatal("fixture removed the backing repo; it must still be present")
+	}
+
+	srv := fakeGitea(t)
+	out := runOpts(t, client(srv), pruneOpts{apply: true})
+	assertVerdict(t, out, "-", verdictKeep, "inspection failed")
+	if !exists(wt) {
+		t.Error("a worktree whose repo still exists must not be deleted")
+	}
+}
+
+// --include-keep overrides a keep, but it must not become a second route to the
+// deletion finding #1 closed: with no readable git state there is nothing to
+// remove through, so the removal fails loudly and the directory stays.
+func TestPruneIncludeKeepDoesNotDeleteUnreadableWorktree(t *testing.T) {
+	f := newFixture(t)
+	_, wt := f.addForeignWorktree(t, "other", "benvin/forced")
+	gitDir, err := agent.GitDir(wt)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Remove(filepath.Join(gitDir, "commondir")); err != nil {
+		t.Fatal(err)
+	}
+
+	var out, errOut bytes.Buffer
+	err = runPrune(&out, &errOut, client(fakeGitea(t)), pruneOpts{apply: true, includeKeep: true})
+	if err == nil {
+		t.Error("forcing removal of an unreadable worktree should fail, not succeed silently")
+	}
+	if !exists(wt) {
+		t.Error("--include-keep must not delete a worktree whose git state is unknown")
+	}
+}
+
+// --- safety signals -------------------------------------------------------
+
+// An interrupted rebase holds sequencer state that exists nowhere else, and it
+// detaches HEAD while it runs, so it must outrank every other signal.
+func TestPruneKeepsInterruptedRebase(t *testing.T) {
+	f := newFixture(t)
+	wt := f.addWorktree(t, "benvin/rebasing")
+	writeCommit(t, wt, "r.txt", "r\n", "work")
+	gitAllow(t, wt, "rebase", "--exec", "false", "origin/main")
+	if op, err := agent.GitInProgressOp(wt); err != nil || op != "rebase" {
+		t.Fatalf("fixture did not leave a rebase in progress: op=%q err=%v", op, err)
+	}
+
+	srv := fakeGitea(t)
+	out := runOpts(t, client(srv), pruneOpts{apply: true})
+	assertVerdict(t, out, "HEAD", verdictKeep, "rebase in progress")
+	if !exists(wt) {
+		t.Error("a worktree mid-rebase must not be removed")
+	}
+}
+
+// A half-finished cherry-pick is the same case with a branch still checked out,
+// so the sequencer check has to run before the dirty check can mask it.
+func TestPruneKeepsInterruptedCherryPick(t *testing.T) {
+	f := newFixture(t)
+	wt := f.addWorktree(t, "benvin/picking")
+	gitDir, err := agent.GitDir(wt)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(gitDir, "CHERRY_PICK_HEAD"), []byte(git(t, wt, "rev-parse", "HEAD")+"\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	srv := fakeGitea(t)
+	out := runOpts(t, client(srv), pruneOpts{apply: true})
+	assertVerdict(t, out, "benvin/picking", verdictKeep, "cherry-pick in progress")
+	if !exists(wt) {
+		t.Error("a worktree mid-cherry-pick must not be removed")
+	}
+}
+
+// A detached HEAD has no branch to carry its commits, so unique work there is
+// unrecoverable once the worktree goes.
+func TestPruneKeepsDetachedHeadWithUniqueCommits(t *testing.T) {
+	f := newFixture(t)
+	wt := f.addWorktree(t, "benvin/detaching")
+	writeCommit(t, wt, "d.txt", "d\n", "work")
+	git(t, wt, "checkout", "--detach")
+	git(t, f.srcDir, "branch", "-D", "benvin/detaching")
+
+	srv := fakeGitea(t)
+	out := runOpts(t, client(srv), pruneOpts{apply: true})
+	assertVerdict(t, out, "HEAD", verdictKeep, "detached HEAD carrying 1 commit on no remote")
+	if !exists(wt) {
+		t.Error("a detached worktree with unique commits must not be removed")
+	}
+}
+
+// A detached HEAD whose commit is already upstream is safe to drop, but there is
+// no branch to delete, so the verdict must not promise one.
+func TestPruneDetachedHeadContainedUpstream(t *testing.T) {
+	f := newFixture(t)
+	wt := f.addWorktree(t, "benvin/detached-clean")
+	git(t, wt, "checkout", "--detach")
+	git(t, f.srcDir, "branch", "-D", "benvin/detached-clean")
+
+	srv := fakeGitea(t)
+	out := runOpts(t, client(srv), pruneOpts{apply: true})
+	assertVerdict(t, out, "HEAD", verdictRemove, "contained in origin/main")
+	if strings.Contains(out, verdictRemoveBranch) {
+		t.Errorf("a detached worktree has no branch to delete:\n%s", out)
+	}
+	if exists(wt) {
+		t.Error("a detached worktree contained upstream should have been removed")
+	}
+}
+
+// git refuses to drop a locked worktree, and so does prune.
+func TestPruneKeepsLockedWorktree(t *testing.T) {
+	f := newFixture(t)
+	wt := f.addWorktree(t, "benvin/locked")
+	git(t, f.srcDir, "worktree", "lock", wt)
+
+	srv := fakeGitea(t)
+	out := runOpts(t, client(srv), pruneOpts{apply: true})
+	assertVerdict(t, out, "benvin/locked", verdictKeep, "locked")
+	if !exists(wt) {
+		t.Error("a locked worktree must not be removed")
+	}
+}
+
+// Unproven work is only safe to abandon because the branch keeps it, so the
+// reason has to say so rather than leaving the operator to guess.
+func TestPruneReasonNamesRetainedBranch(t *testing.T) {
+	f := newFixture(t)
+	wt := f.addWorktree(t, "benvin/unpushed")
+	writeCommit(t, wt, "u.txt", "u\n", "work")
+
+	srv := fakeGitea(t)
+	out := runOpts(t, client(srv), pruneOpts{})
+	assertVerdict(t, out, "benvin/unpushed", verdictRemove, "1 commit on no remote so branch benvin/unpushed is kept")
+	if !exists(wt) {
+		t.Error("a dry run must not remove anything")
+	}
+}
+
+// --- flags ----------------------------------------------------------------
+
+// --include-keep is the only way past a keep verdict, and even then the branch
+// stays, so the commits survive the worktree.
+func TestPruneIncludeKeepRemovesDirtyWorktreeButNotItsBranch(t *testing.T) {
+	f := newFixture(t)
+	wt := f.addWorktree(t, "benvin/dirty")
+	writeCommit(t, wt, "d.txt", "d\n", "work")
+	if err := os.WriteFile(filepath.Join(wt, "wip.txt"), []byte("wip\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	srv := fakeGitea(t)
+	out := runOpts(t, client(srv), pruneOpts{apply: true, includeKeep: true})
+	assertVerdict(t, out, "benvin/dirty", verdictKeep, "dirty")
+	if !strings.Contains(out, "--include-keep") {
+		t.Errorf("forcing a keep should warn it is doing so:\n%s", out)
+	}
+	if exists(wt) {
+		t.Error("--include-keep should have removed the dirty worktree")
+	}
+	if !agent.GitBranchExists(f.srcDir, "benvin/dirty") {
+		t.Error("--include-keep must never delete a branch")
+	}
+}
+
+// --no-fetch means origin's refs are whatever is already on disk, so a tracking
+// ref cannot prove the work survives: the branch is kept.
+func TestPruneNoFetchDistrustsTrackingRefs(t *testing.T) {
+	f, srv, closed, _ := staleFixture(t, true)
+
+	out := runOpts(t, client(srv), pruneOpts{apply: true, noFetch: true})
+	if !strings.Contains(out, "--no-fetch") {
+		t.Errorf("output should record that the fetch was skipped:\n%s", out)
+	}
+	assertVerdict(t, out, "benvin/stale-closed", verdictRemove, "is unverified")
+	if exists(closed) {
+		t.Error("worktree should have been removed")
+	}
+	if !agent.GitBranchExists(f.srcDir, "benvin/stale-closed") {
+		t.Error("an unverified tracking ref must not authorise deleting the branch")
+	}
+}
+
+// --json puts the machine-readable document on stdout alone, with the same
+// verdicts the table shows.
+func TestPruneJSONOutput(t *testing.T) {
+	f := newFixture(t)
+	contained := f.addWorktree(t, "benvin/contained")
+	dirty := f.addWorktree(t, "benvin/dirty")
+	if err := os.WriteFile(filepath.Join(dirty, "wip.txt"), []byte("wip\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	srv := fakeGitea(t)
+	var out, errOut bytes.Buffer
+	if err := runPrune(&out, &errOut, client(srv), pruneOpts{jsonOut: true}); err != nil {
+		t.Fatalf("runPrune: %v", err)
+	}
+	var entries []reportEntry
+	if err := json.Unmarshal(out.Bytes(), &entries); err != nil {
+		t.Fatalf("stdout is not JSON (%v): %s", err, out.String())
+	}
+	byBranch := map[string]reportEntry{}
+	for _, e := range entries {
+		byBranch[e.Branch] = e
+	}
+	if got := byBranch["benvin/contained"]; got.Verdict != verdictRemoveBranch || got.Path != contained || !got.Managed || got.Applied {
+		t.Errorf("contained entry = %+v", got)
+	}
+	if got := byBranch["benvin/dirty"]; got.Verdict != verdictKeep || got.Reason != "dirty" {
+		t.Errorf("dirty entry = %+v", got)
+	}
+	if !exists(contained) {
+		t.Error("a --json dry run must not remove anything")
+	}
+	_ = f
+}
+
+// A directory in the source root can itself be a linked worktree. Enumerating
+// from there lists the repo's real checkout, which must never be offered up for
+// removal — discovery normalises each candidate to its main checkout instead.
+func TestPruneNeverOffersAMainCheckout(t *testing.T) {
+	f := newFixture(t)
+	sibling := filepath.Join(f.root, "src", "repo-sibling")
+	git(t, f.srcDir, "worktree", "add", sibling, "-b", "benvin/sibling", "origin/main")
+	identity(t, sibling)
+
+	srv := fakeGitea(t)
+	out := runOpts(t, client(srv), pruneOpts{})
+	for _, line := range strings.Split(out, "\n") {
+		if fields := strings.Fields(line); len(fields) > 2 && fields[2] == f.srcDir {
+			t.Errorf("main checkout %s must not be classified: %q", f.srcDir, line)
+		}
+	}
+	assertVerdict(t, out, "benvin/sibling", verdictRemoveBranch, "contained in origin/main")
+	if strings.Contains(out, "\tmain\t") || lineForBranch(out, "main") != "" {
+		t.Errorf("the default branch's own checkout must not appear:\n%s", out)
+	}
+}
+
+// lineForBranch is lineFor without the fatal, for asserting a row is absent.
+func lineForBranch(out, branch string) string {
+	for _, line := range strings.Split(out, "\n") {
+		if fields := strings.Fields(line); len(fields) > 1 && fields[1] == branch {
+			return line
+		}
+	}
+	return ""
+}

cmd/watchpr/main.go

@@ -105,7 +105,7 @@ func runOnce(c *agent.GiteaClient, refs []agent.PRRef, jsonMode bool) error {
 	for _, ref := range refs {
 		st, err := agent.FetchState(c, ref, login)
 		if err != nil {
-			return err
+			return describeFailure(err)
 		}
 		states = append(states, st)
 	}
@@ -137,18 +137,30 @@ func runWatch(c *agent.GiteaClient, refs []agent.PRRef, interval time.Duration,
 
 	res, err := agent.Watch(c, refs, login, ticker.C, onBaseline, onError)
 	if err != nil {
-		if agent.IsAuthError(err) {
-			return fmt.Errorf("gitea authentication failed after re-minting the token, watch aborted: %w", err)
-		}
-		if agent.IsPRGone(err) {
-			return fmt.Errorf("PR no longer visible (repo deleted, renamed, or made private), watch aborted: %w", err)
-		}
-		return err
+		return describeFailure(err)
 	}
 	report(res.Ref.String(), res.Reason, res.State, jsonMode)
 	return nil
 }
 
+// describeFailure names the cause of a terminal failure so a watcher that stops
+// says why. An anonymous rejection, a permission boundary and a token that
+// outlived its Vault lease are three different problems and only the last is
+// fixed by a fresh token.
+func describeFailure(err error) error {
+	switch {
+	case agent.IsNoCredential(err):
+		return fmt.Errorf("gitea requires authentication and no token could be minted, aborted: %w", err)
+	case agent.IsPermissionDenied(err):
+		return fmt.Errorf("gitea denied access to %s (a fresh token will not help), aborted: %w", agent.AgentLogin(), err)
+	case agent.IsAuthError(err):
+		return fmt.Errorf("gitea rejected the token and re-minting did not recover it, aborted: %w", err)
+	case agent.IsPRGone(err):
+		return fmt.Errorf("PR no longer visible (repo deleted, renamed, or made private), aborted: %w", err)
+	}
+	return err
+}
+
 // report emits the change that ended the watch.
 func report(key, reason string, st agent.PRState, jsonMode bool) {
 	if jsonMode {

cmd/watchpr/main_test.go

@@ -1,11 +1,15 @@
 package main
 
 import (
+	"errors"
+	"fmt"
 	"io"
 	"net/http"
 	"net/http/httptest"
 	"strings"
 	"testing"
+
+	"git.unkin.net/unkin/agent-tools/internal/agent"
 )
 
 // A bad PR reference must fail the command (so main exits non-zero) rather than
@@ -105,3 +109,76 @@ func TestExecuteBadIntervalErrors(t *testing.T) {
 		}
 	}
 }
+
+// failingVault serves an AppRole login that never issues a token, so the
+// command falls back to anonymous polling exactly as it does when Vault is
+// unreachable.
+func failingVault(t *testing.T) *httptest.Server {
+	t.Helper()
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusForbidden)
+	}))
+	t.Cleanup(srv.Close)
+	return srv
+}
+
+// An anonymous run against a repo that is not public must exit non-zero saying
+// no token was available — not claim a token expired, and not keep going.
+func TestOnceAnonymousRejectionNamesTheMissingToken(t *testing.T) {
+	vault := failingVault(t)
+
+	requests := 0
+	gitea := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		requests++
+		w.WriteHeader(http.StatusUnauthorized)
+		_, _ = io.WriteString(w, `{"message":"invalid username, password or token"}`)
+	}))
+	defer gitea.Close()
+
+	t.Setenv("VAULT_ADDR", vault.URL)
+	t.Setenv("GITEA_URL", gitea.URL)
+
+	cmd := newRootCmd()
+	cmd.SetArgs([]string{"--once", "unkin/repo#7"})
+	cmd.SetOut(io.Discard)
+	cmd.SetErr(io.Discard)
+	err := cmd.Execute()
+	if err == nil {
+		t.Fatal("Execute() = nil, want a non-zero exit when the poll is rejected")
+	}
+	if !strings.Contains(err.Error(), "no token could be minted") {
+		t.Errorf("Execute() error = %q, want it to name the missing token", err)
+	}
+	if requests != 1 {
+		t.Errorf("gitea requests = %d, want 1 (no replay without a credential)", requests)
+	}
+}
+
+// describeFailure must tell the four terminal causes apart: each one sends the
+// reader somewhere different, and a watcher that stops without saying why is
+// the failure this names.
+func TestDescribeFailureNamesTheCause(t *testing.T) {
+	rejected := &agent.APIError{Method: "GET", Path: "/p", StatusCode: 401, Body: `{"message":"invalid username, password or token"}`}
+	forbidden := &agent.APIError{Method: "GET", Path: "/p", StatusCode: 403, Body: `{"message":"Forbidden"}`}
+	tests := []struct {
+		name string
+		err  error
+		want string
+	}{
+		{"anonymous", fmt.Errorf("%w: %w", agent.ErrNoCredential, rejected), "no token could be minted"},
+		{"permission boundary", error(forbidden), "denied access"},
+		{"rejected token", error(rejected), "re-minting did not recover it"},
+		{"other", errors.New("dial tcp: timeout"), "dial tcp: timeout"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := describeFailure(tt.err)
+			if got == nil || !strings.Contains(got.Error(), tt.want) {
+				t.Errorf("describeFailure = %v, want it to mention %q", got, tt.want)
+			}
+			if !errors.Is(got, tt.err) {
+				t.Errorf("describeFailure dropped the underlying error %v", tt.err)
+			}
+		})
+	}
+}

internal/agent/client_test.go

@@ -9,6 +9,7 @@ import (
 	"net/http/httptest"
 	"strings"
 	"testing"
+	"time"
 )
 
 // fakeVault serves the AppRole login and the gitea creds secret at credsPath
@@ -98,6 +99,80 @@ func TestCreatePRRequestBody(t *testing.T) {
 	}
 }
 
+// An edit must send only the fields it was given: Gitea overwrites whatever
+// key it receives, so an omitted --title arriving as "" would blank the title.
+func TestEditPRSendsOnlySuppliedFields(t *testing.T) {
+	title, body, empty := "new title", "new body", ""
+	tests := []struct {
+		name string
+		opts EditOptions
+		want map[string]any
+	}{
+		{"body only", EditOptions{Body: &body}, map[string]any{"body": "new body"}},
+		{"title only", EditOptions{Title: &title}, map[string]any{"title": "new title"}},
+		{"both", EditOptions{Title: &title, Body: &body}, map[string]any{"title": "new title", "body": "new body"}},
+		{"explicit empty body is sent", EditOptions{Body: &empty}, map[string]any{"body": ""}},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var gotBody map[string]any
+			var gotMethod, gotPath string
+			mux := http.NewServeMux()
+			mux.HandleFunc("/api/v1/repos/unkin/repo/pulls/7", func(w http.ResponseWriter, r *http.Request) {
+				gotMethod, gotPath = r.Method, r.URL.Path
+				_ = json.NewDecoder(r.Body).Decode(&gotBody)
+				_, _ = io.WriteString(w, `{"number":7,"title":"new title","html_url":"https://git.unkin.net/unkin/repo/pulls/7"}`)
+			})
+			srv := httptest.NewServer(mux)
+			defer srv.Close()
+
+			c := &GiteaClient{BaseURL: srv.URL, Token: "gitea-abc", HTTP: srv.Client()}
+			pr, err := c.EditPR("unkin/repo", 7, tt.opts)
+			if err != nil {
+				t.Fatalf("EditPR: %v", err)
+			}
+			if gotMethod != http.MethodPatch {
+				t.Errorf("method = %s, want PATCH", gotMethod)
+			}
+			if gotPath != "/api/v1/repos/unkin/repo/pulls/7" {
+				t.Errorf("path = %q", gotPath)
+			}
+			if len(gotBody) != len(tt.want) {
+				t.Errorf("payload = %v, want exactly the supplied fields %v", gotBody, tt.want)
+			}
+			for k, v := range tt.want {
+				if gotBody[k] != v {
+					t.Errorf("payload[%q] = %v, want %v", k, gotBody[k], v)
+				}
+			}
+			if pr.Number != 7 || pr.HTMLURL == "" {
+				t.Errorf("parsed PR = %+v", pr)
+			}
+		})
+	}
+}
+
+// A non-2xx must surface the API's own message rather than a bare status.
+func TestEditPRAPIError(t *testing.T) {
+	mux := http.NewServeMux()
+	mux.HandleFunc("/api/v1/repos/unkin/repo/pulls/7", func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusNotFound)
+		_, _ = io.WriteString(w, `{"message":"not found","url":"https://git.unkin.net/api/swagger","errors":null}`)
+	})
+	srv := httptest.NewServer(mux)
+	defer srv.Close()
+
+	title := "new title"
+	c := &GiteaClient{BaseURL: srv.URL, Token: "t", HTTP: srv.Client()}
+	_, err := c.EditPR("unkin/repo", 7, EditOptions{Title: &title})
+	if err == nil {
+		t.Fatal("expected error on 404")
+	}
+	if !strings.Contains(err.Error(), `"message":"not found"`) {
+		t.Errorf("error %q should carry the API message", err)
+	}
+}
+
 func TestCreateComment(t *testing.T) {
 	var gotBody map[string]string
 	mux := http.NewServeMux()
@@ -544,3 +619,330 @@ func TestAnonymousPollingNeverMints(t *testing.T) {
 		t.Errorf("sent %d Authorization headers, want none", authHeaders)
 	}
 }
+
+// Anonymous access to something that is not public is not a stale credential:
+// nothing was sent to be rejected, so the client must not burn a Vault mint on
+// every poll, and the error must say a token was missing rather than expired.
+func TestAnonymousAuthFailureNeverMints(t *testing.T) {
+	requests := 0
+	mux := http.NewServeMux()
+	mux.HandleFunc("/api/v1/repos/unkin/repo/pulls/7", func(w http.ResponseWriter, r *http.Request) {
+		requests++
+		w.WriteHeader(http.StatusUnauthorized)
+		_, _ = io.WriteString(w, `{"message":"invalid username, password or token"}`)
+	})
+	srv := httptest.NewServer(mux)
+	defer srv.Close()
+
+	refreshes := 0
+	c := &GiteaClient{BaseURL: srv.URL, HTTP: srv.Client(),
+		Refresh: func() (string, error) { refreshes++; return "fresh", nil }}
+
+	_, err := c.GetPR("unkin/repo", 7)
+	if err == nil {
+		t.Fatal("expected an error on an anonymous 401")
+	}
+	if !IsNoCredential(err) {
+		t.Errorf("IsNoCredential(%v) = false, want true", err)
+	}
+	if !IsAuthError(err) {
+		t.Errorf("IsAuthError(%v) = false; an anonymous rejection still ends a watch", err)
+	}
+	if refreshes != 0 {
+		t.Errorf("refreshes = %d, want 0 (nothing was rejected)", refreshes)
+	}
+	if requests != 1 {
+		t.Errorf("requests = %d, want 1 (no replay)", requests)
+	}
+}
+
+// Gitea's bare "Forbidden" is a permission boundary, not an expired token. A
+// re-mint cannot grant a permission the identity lacks, so the client must not
+// spend one, and the failure must not be reported as an auth expiry.
+func TestPermissionDeniedIsNotRemintedOrRetried(t *testing.T) {
+	requests := 0
+	mux := http.NewServeMux()
+	mux.HandleFunc("/api/v1/repos/unkin/repo/pulls/7", func(w http.ResponseWriter, r *http.Request) {
+		requests++
+		w.WriteHeader(http.StatusForbidden)
+		_, _ = io.WriteString(w, `{"errors":null,"message":"Forbidden","url":"https://git.unkin.net/api/swagger"}`)
+	})
+	srv := httptest.NewServer(mux)
+	defer srv.Close()
+
+	refreshes := 0
+	c := &GiteaClient{BaseURL: srv.URL, Token: "t", HTTP: srv.Client(),
+		Refresh: func() (string, error) { refreshes++; return "fresh", nil }}
+
+	_, err := c.GetPR("unkin/repo", 7)
+	if err == nil {
+		t.Fatal("expected an error on a 403")
+	}
+	if !IsPermissionDenied(err) {
+		t.Errorf("IsPermissionDenied(%v) = false, want true", err)
+	}
+	if IsCredentialRejected(err) {
+		t.Errorf("a bare Forbidden must not read as a rejected credential")
+	}
+	if refreshes != 0 || requests != 1 {
+		t.Errorf("refreshes = %d, requests = %d, want 0 and 1", refreshes, requests)
+	}
+}
+
+// A 403 that names the token is a credential problem after all (Gitea reports a
+// missing scope this way), so it keeps the re-mint-and-replay path.
+func TestScopeForbiddenIsRemintedAndRetried(t *testing.T) {
+	var seen []string
+	mux := http.NewServeMux()
+	mux.HandleFunc("/api/v1/repos/unkin/repo/pulls/7", func(w http.ResponseWriter, r *http.Request) {
+		tok := strings.TrimPrefix(r.Header.Get("Authorization"), "token ")
+		seen = append(seen, tok)
+		if tok != "fresh" {
+			w.WriteHeader(http.StatusForbidden)
+			_, _ = io.WriteString(w, `{"message":"token does not have at least one of required scope(s): [read:repository]"}`)
+			return
+		}
+		_, _ = io.WriteString(w, `{"number":7,"state":"open","mergeable":true,"head":{"sha":"cafebabe"}}`)
+	})
+	srv := httptest.NewServer(mux)
+	defer srv.Close()
+
+	refreshes := 0
+	c := &GiteaClient{BaseURL: srv.URL, Token: "stale", HTTP: srv.Client(),
+		Refresh: func() (string, error) { refreshes++; return "fresh", nil }}
+
+	pr, err := c.GetPR("unkin/repo", 7)
+	if err != nil {
+		t.Fatalf("GetPR after re-mint: %v", err)
+	}
+	if pr.Number != 7 || refreshes != 1 {
+		t.Errorf("PR = %+v, refreshes = %d, want PR 7 and 1 re-mint", pr, refreshes)
+	}
+	if len(seen) != 2 || seen[1] != "fresh" {
+		t.Errorf("tokens seen = %v, want [stale fresh]", seen)
+	}
+}
+
+// A re-mint that hands back an empty token must fail loudly. Replaying with it
+// would drop the Authorization header, and on a public repo that anonymous
+// replay succeeds — the watch would carry on having quietly lost its identity.
+func TestEmptyRemintedTokenFailsInsteadOfGoingAnonymous(t *testing.T) {
+	var seen []string
+	mux := http.NewServeMux()
+	mux.HandleFunc("/api/v1/repos/unkin/repo/pulls/7", func(w http.ResponseWriter, r *http.Request) {
+		tok := strings.TrimPrefix(r.Header.Get("Authorization"), "token ")
+		seen = append(seen, tok)
+		if tok == "stale" {
+			w.WriteHeader(http.StatusUnauthorized)
+			_, _ = io.WriteString(w, `{"message":"invalid username, password or token"}`)
+			return
+		}
+		_, _ = io.WriteString(w, `{"number":7,"state":"open","mergeable":true,"head":{"sha":"cafebabe"}}`)
+	})
+	srv := httptest.NewServer(mux)
+	defer srv.Close()
+
+	c := &GiteaClient{BaseURL: srv.URL, Token: "stale", HTTP: srv.Client(),
+		Refresh: func() (string, error) { return "", nil }}
+
+	_, err := c.GetPR("unkin/repo", 7)
+	if err == nil {
+		t.Fatal("an empty re-minted token must be an error, not an anonymous retry")
+	}
+	if !IsAuthError(err) {
+		t.Errorf("IsAuthError(%v) = false, want true", err)
+	}
+	if len(seen) != 1 {
+		t.Errorf("requests = %d, want 1 (no anonymous replay)", len(seen))
+	}
+}
+
+// The real-world rotation case end to end: the watch runs happily for several
+// polls, then the Vault lease expires and Gitea rejects every token, the fresh
+// one included. Watch must end with a named auth failure instead of polling on.
+func TestWatchAbortsWhenTokenExpiresMidWatch(t *testing.T) {
+	polls := 0
+	mux := http.NewServeMux()
+	mux.HandleFunc("/api/v1/repos/unkin/repo/pulls/7", func(w http.ResponseWriter, r *http.Request) {
+		polls++
+		if polls > 3 {
+			w.WriteHeader(http.StatusUnauthorized)
+			_, _ = io.WriteString(w, `{"message":"invalid username, password or token"}`)
+			return
+		}
+		_, _ = io.WriteString(w, `{"number":7,"state":"open","mergeable":true,"head":{"sha":"cafebabe"}}`)
+	})
+	mux.HandleFunc("/api/v1/repos/unkin/repo/commits/cafebabe/status", func(w http.ResponseWriter, r *http.Request) {
+		_, _ = io.WriteString(w, `{"state":"success"}`)
+	})
+	mux.HandleFunc("/api/v1/repos/unkin/repo/issues/7/comments", func(w http.ResponseWriter, r *http.Request) {
+		_, _ = io.WriteString(w, `[]`)
+	})
+	srv := httptest.NewServer(mux)
+	defer srv.Close()
+
+	refreshes := 0
+	c := &GiteaClient{BaseURL: srv.URL, Token: "t1", HTTP: srv.Client(),
+		Refresh: func() (string, error) { refreshes++; return "t2", nil }}
+
+	ref := PRRef{Owner: "unkin", Repo: "repo", Number: 7}
+	ticks := make(chan time.Time, 5)
+	for i := 0; i < 5; i++ {
+		ticks <- time.Now()
+	}
+	close(ticks)
+
+	warned := 0
+	_, err := Watch(c, []PRRef{ref}, "unkin-agent", ticks, nil, func(PRRef, error) { warned++ })
+	if err == nil {
+		t.Fatal("Watch returned nil: an expired token must end the watch, not be polled past")
+	}
+	if !IsAuthError(err) {
+		t.Errorf("Watch error = %v, want an auth error", err)
+	}
+	if IsNoCredential(err) {
+		t.Errorf("a rejected token must not be reported as a missing one: %v", err)
+	}
+	if refreshes != 1 {
+		t.Errorf("refreshes = %d, want 1", refreshes)
+	}
+	if warned != 0 {
+		t.Errorf("auth failure logged as a warning %d time(s); it must abort", warned)
+	}
+}
+
+func TestCreateIssueRequestBody(t *testing.T) {
+	var gotPath, gotMethod, gotAuth string
+	var gotBody CreateIssueOptions
+	mux := http.NewServeMux()
+	mux.HandleFunc("/api/v1/repos/unkin/repo/issues", func(w http.ResponseWriter, r *http.Request) {
+		gotPath, gotMethod = r.URL.Path, r.Method
+		gotAuth = r.Header.Get("Authorization")
+		_ = json.NewDecoder(r.Body).Decode(&gotBody)
+		_, _ = io.WriteString(w, `{"number":12,"state":"open","title":"T","html_url":"https://git.unkin.net/unkin/repo/issues/12"}`)
+	})
+	srv := httptest.NewServer(mux)
+	defer srv.Close()
+
+	c := &GiteaClient{BaseURL: srv.URL, Token: "gitea-abc", HTTP: srv.Client()}
+	issue, err := c.CreateIssue("unkin/repo", CreateIssueOptions{Title: "T", Body: "B"})
+	if err != nil {
+		t.Fatalf("CreateIssue: %v", err)
+	}
+	if gotMethod != http.MethodPost || gotPath != "/api/v1/repos/unkin/repo/issues" {
+		t.Errorf("request = %s %s, want POST /api/v1/repos/unkin/repo/issues", gotMethod, gotPath)
+	}
+	if gotAuth != "token gitea-abc" {
+		t.Errorf("auth header = %q, want 'token gitea-abc'", gotAuth)
+	}
+	if gotBody.Title != "T" || gotBody.Body != "B" {
+		t.Errorf("request body = %+v", gotBody)
+	}
+	if issue.Number != 12 || issue.HTMLURL != "https://git.unkin.net/unkin/repo/issues/12" {
+		t.Errorf("parsed issue = %+v", issue)
+	}
+}
+
+// Filing against a repo that does not exist (or that the token may not see)
+// gets Gitea's 404, which must surface as a not-found error carrying the API's
+// own message rather than a bare status.
+func TestCreateIssueRepoNotFound(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusNotFound)
+		_, _ = io.WriteString(w, `{"errors":null,"message":"user redirect does not exist [name: ghost]","url":"https://git.unkin.net/api/swagger"}`)
+	}))
+	defer srv.Close()
+
+	c := &GiteaClient{BaseURL: srv.URL, Token: "t", HTTP: srv.Client()}
+	_, err := c.CreateIssue("ghost/repo", CreateIssueOptions{Title: "T"})
+	if err == nil {
+		t.Fatal("expected error for a repo that does not exist")
+	}
+	if !IsNotFound(err) {
+		t.Errorf("IsNotFound(%v) = false, want true", err)
+	}
+	if !strings.Contains(err.Error(), "user redirect does not exist") {
+		t.Errorf("error %q should carry the API message", err)
+	}
+}
+
+// Any other non-2xx is a plain API failure: reported, not retried, and not
+// mistaken for a missing repo.
+func TestCreateIssueAPIError(t *testing.T) {
+	requests := 0
+	mux := http.NewServeMux()
+	mux.HandleFunc("/api/v1/repos/unkin/repo/issues", func(w http.ResponseWriter, r *http.Request) {
+		requests++
+		w.WriteHeader(http.StatusUnprocessableEntity)
+		_, _ = io.WriteString(w, `{"errors":null,"message":"Validation Error: title is empty","url":"https://git.unkin.net/api/swagger"}`)
+	})
+	srv := httptest.NewServer(mux)
+	defer srv.Close()
+
+	c := &GiteaClient{BaseURL: srv.URL, Token: "t", HTTP: srv.Client()}
+	_, err := c.CreateIssue("unkin/repo", CreateIssueOptions{Title: "T"})
+	if err == nil {
+		t.Fatal("expected error on 422")
+	}
+	if IsNotFound(err) {
+		t.Errorf("a 422 must not read as not-found: %v", err)
+	}
+	if !strings.Contains(err.Error(), "Validation Error") {
+		t.Errorf("error %q should carry the API message", err)
+	}
+	if requests != 1 {
+		t.Errorf("requests = %d, want 1 (a 422 is not retried)", requests)
+	}
+}
+
+// An issue edit sends only the fields it was given, for the same reason a PR
+// edit does: Gitea overwrites whatever key it receives.
+func TestEditIssueSendsOnlySuppliedFields(t *testing.T) {
+	title, body := "new title", "new body"
+	tests := []struct {
+		name string
+		opts EditOptions
+		want map[string]any
+	}{
+		{"body only", EditOptions{Body: &body}, map[string]any{"body": "new body"}},
+		{"title only", EditOptions{Title: &title}, map[string]any{"title": "new title"}},
+		{"both", EditOptions{Title: &title, Body: &body}, map[string]any{"title": "new title", "body": "new body"}},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var gotBody map[string]any
+			var gotMethod, gotPath string
+			mux := http.NewServeMux()
+			mux.HandleFunc("/api/v1/repos/unkin/repo/issues/12", func(w http.ResponseWriter, r *http.Request) {
+				gotMethod, gotPath = r.Method, r.URL.Path
+				_ = json.NewDecoder(r.Body).Decode(&gotBody)
+				_, _ = io.WriteString(w, `{"number":12,"title":"new title","html_url":"https://git.unkin.net/unkin/repo/issues/12"}`)
+			})
+			srv := httptest.NewServer(mux)
+			defer srv.Close()
+
+			c := &GiteaClient{BaseURL: srv.URL, Token: "t", HTTP: srv.Client()}
+			issue, err := c.EditIssue("unkin/repo", 12, tt.opts)
+			if err != nil {
+				t.Fatalf("EditIssue: %v", err)
+			}
+			if gotMethod != http.MethodPatch {
+				t.Errorf("method = %s, want PATCH", gotMethod)
+			}
+			if gotPath != "/api/v1/repos/unkin/repo/issues/12" {
+				t.Errorf("path = %q", gotPath)
+			}
+			if len(gotBody) != len(tt.want) {
+				t.Errorf("payload = %v, want exactly the supplied fields %v", gotBody, tt.want)
+			}
+			for k, v := range tt.want {
+				if gotBody[k] != v {
+					t.Errorf("payload[%q] = %v, want %v", k, gotBody[k], v)
+				}
+			}
+			if issue.Number != 12 || issue.HTMLURL == "" {
+				t.Errorf("parsed issue = %+v", issue)
+			}
+		})
+	}
+}

internal/agent/git.go

@@ -7,6 +7,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"strconv"
 	"strings"
 )
 
@@ -25,6 +26,10 @@ type Worktree struct {
 	Branch   string // short branch name ("" when detached or bare)
 	Bare     bool
 	Detached bool
+	Locked   bool
+	// Prunable is git's own reason a registration is stale (e.g. "gitdir file
+	// points to non-existent location"); empty when the worktree is intact.
+	Prunable string
 }
 
 // runGit runs git with args, using dir as the working directory (empty = the
@@ -104,6 +109,37 @@ func GitRemoteBranchExists(repoDir, remote, branch string) bool {
 	return err == nil
 }
 
+// GitRevParse resolves ref to a full object id in repoDir.
+func GitRevParse(repoDir, ref string) (string, error) {
+	return runGit(repoDir, "rev-parse", ref)
+}
+
+// GitAheadCount counts commits reachable from head that upstream does not hold.
+func GitAheadCount(repoDir, upstream, head string) (int, error) {
+	out, err := runGit(repoDir, "rev-list", "--count", upstream+".."+head)
+	if err != nil {
+		return 0, err
+	}
+	n, err := strconv.Atoi(strings.TrimSpace(out))
+	if err != nil {
+		return 0, fmt.Errorf("parse rev-list count %q: %w", out, err)
+	}
+	return n, nil
+}
+
+// GitMergeFFOnly advances the branch checked out at dir to ref, failing rather
+// than writing a merge commit when the move is not a fast-forward.
+func GitMergeFFOnly(dir, ref string) error {
+	_, err := runGit(dir, "merge", "--ff-only", ref)
+	return err
+}
+
+// GitSetUpstream points branch at the remote-tracking ref upstream.
+func GitSetUpstream(repoDir, branch, upstream string) error {
+	_, err := runGit(repoDir, "branch", "--set-upstream-to="+upstream, branch)
+	return err
+}
+
 // GitIsDirty reports whether the checkout at dir has uncommitted or untracked
 // changes.
 func GitIsDirty(dir string) (bool, error) {
@@ -114,6 +150,54 @@ func GitIsDirty(dir string) (bool, error) {
 	return strings.TrimSpace(out) != "", nil
 }
 
+// GitDir returns the absolute path to the git directory backing the checkout at
+// dir (per-worktree, unlike GitCommonDir).
+func GitDir(dir string) (string, error) {
+	return runGit(dir, "rev-parse", "--path-format=absolute", "--git-dir")
+}
+
+// inProgressMarkers maps a sentinel inside the git dir to the operation it means
+// is half-finished. Such a checkout holds state that lives nowhere else.
+var inProgressMarkers = []struct{ path, op string }{
+	{"rebase-merge", "rebase"},
+	{"rebase-apply", "rebase"},
+	{"MERGE_HEAD", "merge"},
+	{"CHERRY_PICK_HEAD", "cherry-pick"},
+	{"REVERT_HEAD", "revert"},
+	{"BISECT_LOG", "bisect"},
+}
+
+// GitInProgressOp names the sequencer operation underway in the checkout at dir,
+// or "" when none is.
+func GitInProgressOp(dir string) (string, error) {
+	gitDir, err := GitDir(dir)
+	if err != nil {
+		return "", err
+	}
+	for _, m := range inProgressMarkers {
+		if _, err := os.Stat(filepath.Join(gitDir, m.path)); err == nil {
+			return m.op, nil
+		} else if !os.IsNotExist(err) {
+			return "", err
+		}
+	}
+	return "", nil
+}
+
+// GitCommitsNotOnRemotes counts commits reachable from HEAD that no
+// remote-tracking ref holds, i.e. work that exists only in this checkout.
+func GitCommitsNotOnRemotes(dir string) (int, error) {
+	out, err := runGit(dir, "rev-list", "--count", "HEAD", "--not", "--remotes")
+	if err != nil {
+		return 0, err
+	}
+	n, err := strconv.Atoi(strings.TrimSpace(out))
+	if err != nil {
+		return 0, fmt.Errorf("parse rev-list count %q: %w", out, err)
+	}
+	return n, nil
+}
+
 // GitIsAncestor reports whether ancestor is reachable from descendant.
 func GitIsAncestor(repoDir, ancestor, descendant string) (bool, error) {
 	cmd := exec.Command("git", "merge-base", "--is-ancestor", ancestor, descendant)
@@ -277,6 +361,18 @@ func ParseWorktreeList(out string) []Worktree {
 			if cur != nil {
 				cur.Detached = true
 			}
+		case "locked":
+			if cur != nil {
+				cur.Locked = true
+			}
+		case "prunable":
+			if cur != nil {
+				// git omits the reason when it has none, so record the flag itself.
+				cur.Prunable = val
+				if cur.Prunable == "" {
+					cur.Prunable = "prunable"
+				}
+			}
 		}
 	}
 	flush()

internal/agent/git_test.go

@@ -42,10 +42,20 @@ branch refs/heads/benvin/foo
 worktree /home/ben/.cache/agentws/repo__detached
 HEAD 3333333333333333333333333333333333333333
 detached
+
+worktree /home/ben/.cache/agentws/repo__gone
+HEAD 4444444444444444444444444444444444444444
+branch refs/heads/benvin/gone
+prunable gitdir file points to non-existent location
+
+worktree /home/ben/.cache/agentws/repo__held
+HEAD 5555555555555555555555555555555555555555
+branch refs/heads/benvin/held
+locked
 `
 	wts := ParseWorktreeList(out)
-	if len(wts) != 3 {
-		t.Fatalf("got %d worktrees, want 3: %+v", len(wts), wts)
+	if len(wts) != 5 {
+		t.Fatalf("got %d worktrees, want 5: %+v", len(wts), wts)
 	}
 	if wts[0].Branch != "main" || wts[0].Path != "/home/ben/src/prodenv/repo" {
 		t.Errorf("wt[0] = %+v", wts[0])
@@ -56,6 +66,104 @@ detached
 	if !wts[2].Detached || wts[2].Branch != "" {
 		t.Errorf("wt[2] = %+v, want detached with empty branch", wts[2])
 	}
+	if wts[3].Prunable != "gitdir file points to non-existent location" {
+		t.Errorf("wt[3].Prunable = %q", wts[3].Prunable)
+	}
+	if !wts[4].Locked || wts[4].Prunable != "" {
+		t.Errorf("wt[4] = %+v, want locked and not prunable", wts[4])
+	}
+}
+
+// A bare "prunable" with no reason still has to read as prunable.
+func TestParseWorktreeListPrunableWithoutReason(t *testing.T) {
+	wts := ParseWorktreeList("worktree /tmp/wt\nHEAD 1111111111111111111111111111111111111111\ndetached\nprunable\n")
+	if len(wts) != 1 || wts[0].Prunable == "" {
+		t.Errorf("ParseWorktreeList = %+v, want one prunable worktree", wts)
+	}
+}
+
+func TestGitInProgressOp(t *testing.T) {
+	srcDir := newTempRepos(t)
+	gitDir, err := GitDir(srcDir)
+	if err != nil {
+		t.Fatalf("GitDir: %v", err)
+	}
+	if op, err := GitInProgressOp(srcDir); err != nil || op != "" {
+		t.Fatalf("clean checkout: op = %q, err = %v", op, err)
+	}
+
+	tests := []struct {
+		marker string
+		dir    bool
+		want   string
+	}{
+		{"MERGE_HEAD", false, "merge"},
+		{"CHERRY_PICK_HEAD", false, "cherry-pick"},
+		{"REVERT_HEAD", false, "revert"},
+		{"BISECT_LOG", false, "bisect"},
+		{"rebase-merge", true, "rebase"},
+		{"rebase-apply", true, "rebase"},
+	}
+	for _, tt := range tests {
+		path := filepath.Join(gitDir, tt.marker)
+		if tt.dir {
+			if err := os.Mkdir(path, 0o755); err != nil {
+				t.Fatal(err)
+			}
+		} else if err := os.WriteFile(path, []byte("x\n"), 0o644); err != nil {
+			t.Fatal(err)
+		}
+		op, err := GitInProgressOp(srcDir)
+		if err != nil || op != tt.want {
+			t.Errorf("%s: op = %q, err = %v; want %q", tt.marker, op, err, tt.want)
+		}
+		if err := os.RemoveAll(path); err != nil {
+			t.Fatal(err)
+		}
+	}
+}
+
+// Commits that reached a remote-tracking ref are not unique local work; commits
+// made after the push are.
+func TestGitCommitsNotOnRemotes(t *testing.T) {
+	srcDir := newTempRepos(t)
+	if n, err := GitCommitsNotOnRemotes(srcDir); err != nil || n != 0 {
+		t.Fatalf("freshly cloned main: n = %d, err = %v; want 0", n, err)
+	}
+
+	if _, err := runGit(srcDir, "checkout", "-b", "benvin/x"); err != nil {
+		t.Fatal(err)
+	}
+	commitFile(t, srcDir, "a.txt", "a\n", "local a")
+	commitFile(t, srcDir, "b.txt", "b\n", "local b")
+	if n, err := GitCommitsNotOnRemotes(srcDir); err != nil || n != 2 {
+		t.Fatalf("two unpushed commits: n = %d, err = %v; want 2", n, err)
+	}
+
+	if _, err := runGit(srcDir, "push", "origin", "benvin/x"); err != nil {
+		t.Fatal(err)
+	}
+	if n, err := GitCommitsNotOnRemotes(srcDir); err != nil || n != 0 {
+		t.Fatalf("after push: n = %d, err = %v; want 0", n, err)
+	}
+
+	commitFile(t, srcDir, "c.txt", "c\n", "local c")
+	if n, err := GitCommitsNotOnRemotes(srcDir); err != nil || n != 1 {
+		t.Fatalf("one commit past the push: n = %d, err = %v; want 1", n, err)
+	}
+}
+
+func commitFile(t *testing.T, dir, name, content, msg string) {
+	t.Helper()
+	if err := os.WriteFile(filepath.Join(dir, name), []byte(content), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := runGit(dir, "add", "."); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := runGit(dir, "commit", "-m", msg); err != nil {
+		t.Fatal(err)
+	}
 }
 
 // gitSeed sets a repo-local identity so commits work without global config.

internal/agent/gitea.go

@@ -32,14 +32,61 @@ func IsNotFound(err error) bool {
 	return errors.As(err, &apiErr) && apiErr.StatusCode == http.StatusNotFound
 }
 
-// IsAuthError reports whether err is a Gitea 401/403: the token is expired or
-// unauthorised, which retrying the same request cannot fix.
+// IsAuthError reports whether err is a Gitea 401/403. Both end a watch: neither
+// a rejected credential nor a permission boundary clears itself on a retry.
 func IsAuthError(err error) bool {
 	var apiErr *APIError
 	return errors.As(err, &apiErr) &&
 		(apiErr.StatusCode == http.StatusUnauthorized || apiErr.StatusCode == http.StatusForbidden)
 }
 
+// ErrNoCredential marks a 401/403 on a request that carried no token at all.
+// Anonymous polling of a public repo is supported, so this is not a rejected
+// credential: the resource simply is not public and no token was available.
+var ErrNoCredential = errors.New("gitea requires authentication and no token was available")
+
+// IsNoCredential reports whether err is an auth failure on an anonymous request.
+func IsNoCredential(err error) bool {
+	return errors.Is(err, ErrNoCredential)
+}
+
+// credentialHints are the fragments Gitea puts in a 403 body when the
+// credential itself is at fault ("token does not have at least one of required
+// scope(s)", "sign in required") rather than the identity's permissions, whose
+// body is a bare "Forbidden".
+var credentialHints = []string{"token", "sign in", "credential"}
+
+// IsCredentialRejected reports whether err means the credential that was sent
+// was refused, which a freshly minted token may fix. A 401 always qualifies.
+// Gitea 403s both for a token missing a scope and for an identity that may not
+// do this at all, so for a 403 the response body decides.
+func IsCredentialRejected(err error) bool {
+	var apiErr *APIError
+	if !errors.As(err, &apiErr) {
+		return false
+	}
+	switch apiErr.StatusCode {
+	case http.StatusUnauthorized:
+		return true
+	case http.StatusForbidden:
+		body := strings.ToLower(apiErr.Body)
+		for _, hint := range credentialHints {
+			if strings.Contains(body, hint) {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+// IsPermissionDenied reports a 403 that names no credential problem: the
+// identity is authenticated but not allowed, so re-minting cannot help.
+func IsPermissionDenied(err error) bool {
+	var apiErr *APIError
+	return errors.As(err, &apiErr) &&
+		apiErr.StatusCode == http.StatusForbidden && !IsCredentialRejected(err)
+}
+
 // GiteaClient talks to the Gitea REST API as the agent user.
 type GiteaClient struct {
 	BaseURL string
@@ -56,8 +103,10 @@ func NewGiteaClient(token string) *GiteaClient {
 	return &GiteaClient{BaseURL: GiteaURL(), Token: token, HTTP: httpClient, Refresh: RefreshGiteaToken}
 }
 
-// do sends the request and, if the token was rejected, re-mints it once and
-// replays the request with the fresh token.
+// do sends the request and, if the credential it carried was rejected, re-mints
+// the token once and replays the request. Anonymous requests and permission
+// denials are returned as they are: neither is fixed by a fresh token, and
+// re-minting on them would report a stale token as the cause of something else.
 func (c *GiteaClient) do(method, path string, body any, out any) error {
 	var payload []byte
 	if body != nil {
@@ -67,14 +116,24 @@ func (c *GiteaClient) do(method, path string, body any, out any) error {
 		}
 		payload = b
 	}
+	anonymous := c.Token == ""
 	err := c.attempt(method, path, payload, out)
-	if !IsAuthError(err) || c.Refresh == nil {
+	if !IsAuthError(err) {
+		return err
+	}
+	if anonymous {
+		return fmt.Errorf("%w: %w", ErrNoCredential, err)
+	}
+	if !IsCredentialRejected(err) || c.Refresh == nil {
 		return err
 	}
 	token, refreshErr := c.Refresh()
 	if refreshErr != nil {
 		return fmt.Errorf("%w; re-minting token: %v", err, refreshErr)
 	}
+	if token == "" {
+		return fmt.Errorf("%w; re-minting token yielded an empty token", err)
+	}
 	c.Token = token
 	return c.attempt(method, path, payload, out)
 }
@@ -214,6 +273,25 @@ func (c *GiteaClient) CreatePR(repoPath string, opts CreatePROptions) (PullReque
 	return pr, err
 }
 
+// EditOptions are the fields an edit may change, for a pull request or an
+// issue alike. Pointers so an unset field is omitted from the payload
+// entirely, leaving that field as it is. The two fields are not symmetric:
+// Gitea only applies a title when it is non-empty, so Title can be set but
+// never cleared and a "" title is a silent no-op, while a pointer to "" Body
+// really does blank the body.
+type EditOptions struct {
+	Title *string `json:"title,omitempty"`
+	Body  *string `json:"body,omitempty"`
+}
+
+// EditPR updates a pull request's title and/or body
+// (PATCH /api/v1/repos/{owner}/{repo}/pulls/{index}).
+func (c *GiteaClient) EditPR(repoPath string, number int, opts EditOptions) (PullRequest, error) {
+	var pr PullRequest
+	err := c.do(http.MethodPatch, fmt.Sprintf("/api/v1/repos/%s/pulls/%d", repoPath, number), opts, &pr)
+	return pr, err
+}
+
 // GetPR fetches a single pull request.
 func (c *GiteaClient) GetPR(repoPath string, number int) (PullRequest, error) {
 	var pr PullRequest
@@ -221,6 +299,36 @@ func (c *GiteaClient) GetPR(repoPath string, number int) (PullRequest, error) {
 	return pr, err
 }
 
+// Issue is the subset of Gitea's issue object we track. Gitea numbers issues
+// and pull requests in one sequence, so Number is comparable to a PR number.
+type Issue struct {
+	Number  int    `json:"number"`
+	State   string `json:"state"`
+	Title   string `json:"title"`
+	HTMLURL string `json:"html_url"`
+}
+
+// CreateIssueOptions are the fields for filing an issue.
+type CreateIssueOptions struct {
+	Title string `json:"title"`
+	Body  string `json:"body"`
+}
+
+// CreateIssue files an issue (POST /api/v1/repos/{owner}/{repo}/issues).
+func (c *GiteaClient) CreateIssue(repoPath string, opts CreateIssueOptions) (Issue, error) {
+	var issue Issue
+	err := c.do(http.MethodPost, "/api/v1/repos/"+repoPath+"/issues", opts, &issue)
+	return issue, err
+}
+
+// EditIssue updates an issue's title and/or body
+// (PATCH /api/v1/repos/{owner}/{repo}/issues/{index}).
+func (c *GiteaClient) EditIssue(repoPath string, number int, opts EditOptions) (Issue, error) {
+	var issue Issue
+	err := c.do(http.MethodPatch, fmt.Sprintf("/api/v1/repos/%s/issues/%d", repoPath, number), opts, &issue)
+	return issue, err
+}
+
 // Comment is the subset of an issue comment we track.
 type Comment struct {
 	ID   int64  `json:"id"`
@@ -228,8 +336,10 @@ type Comment struct {
 	Body string `json:"body"`
 }
 
-// CreateComment posts a comment on the PR's issue thread
-// (POST /api/v1/repos/{owner}/{repo}/issues/{n}/comments).
+// CreateComment posts a comment on an issue thread
+// (POST /api/v1/repos/{owner}/{repo}/issues/{n}/comments). Gitea backs a pull
+// request with an issue of the same number, so this is the single path for
+// both.
 func (c *GiteaClient) CreateComment(repoPath string, number int, body string) (Comment, error) {
 	var cm Comment
 	payload := map[string]string{"body": body}