[chhoumann]

Why

The worktree audit should never call a worktree safe to prune while it holds unmerged work or an open PR. Two lookups let it. A local branch or tag named origin/main won git's short-name lookup over refs/remotes/origin/main, so the MERGED check read unmerged work as merged. And gh lists a branch's PRs newest first, so a newer closed or merged PR hid an older open one. Both were found and fixed in Michael Denyer's pstack-claude, #423 and #424, in its JavaScript audit. This makes the same fixes in our bash fork.

What changed

• worktree-audit.sh reads a base that starts with a remote's name, and origin/<branch> in the REMOTE column, by their refs/remotes/ names. A -b that names a local ref, such as -b main, works as before. The branch name comes from the full refs/heads/ ref, so a tag with the same name no longer hides the branch's PR.
• For each branch it takes the first PR record whose state is open or draft, else the first record, on both the gh and the Origin path.
• Seven tests in tests/worktree-audit.test.mjs, six of which fail on main. Release 2.2.8 with the fork's why, CHANGES.md, the stamped manifests, and the README's tag example.

Scope

• The review found the -b upstream/main case and the tag named like the branch. Both are the same short-name lookup, so they are fixed here. The REMOTE fix does not change the bucket.
• Not fixed: the audit asks for at most 1,000 PRs, so an open PR older than the author's 1,000 newest in the repo goes unread. It needs a second query.
• Lauren's upstream script has all three lookups. Proposing the fix there is a follow-up.

Verification

• Repro with the real script in a throwaway repo, one unpushed commit on worktree branch topic. On main, git branch origin/main topic or git tag origin/main topic turns the row from no review into YES safe, also with -b origin/main. With this branch it stays no review. A real merge with a stale origin/main tag still reads YES safe.
• Repro with a stub gh on PATH listing #12 closed then #11 open for topic, and the same records from a stub Origin CLI. On main the row reads #12/closed safe. With this branch it reads #11/open hold-open-pr on both paths.
• bun tools/generate.mjs --check, GIT_CONFIG_GLOBAL=/dev/null bun test tests/ --timeout 30000 (561 pass, 0 fail), the sync dry-run for each component at c742dd6, shellcheck on the script, and markdownlint on the changed Markdown all pass.
• Review by codex/gpt-6-astra at reasoningEffort=xhigh found three high issues. Two are fixed above with tests that failed first. The third is the PR limit in Scope.

---

Note

Low Risk
Bash audit tooling only; changes make prune recommendations more conservative and are covered by new tests, with no auth or runtime workflow impact.

Overview
Release 2.2.8 fixes three cases where worktree-audit.sh could mark a worktree safe while it still had unmerged work or an open PR.

The merge and remote columns now resolve bases like origin/main and origin/<branch> through explicit refs/remotes/ names so a local branch or tag with the same shorthand no longer wins over the remote-tracking ref. Branch names for PR lookup come from the full refs/heads/ name so a tag with the same name cannot blank the PR column. When PRs are listed newest-first, the script picks the first open or draft record for the branch instead of the newest row overall.

Seven tests in tests/worktree-audit.test.mjs cover these scenarios; version stamps and changelog/README examples move to 2.2.8.

^{Reviewed by Cursor Bugbot for commit e5ad5c7. Bugbot is set up for automated code reviews on this repo. Configure here.}