chore(ai-workflow): tighten agent workflow and worktree tooling (#1107)

* chore(ai-workflow): tighten agent workflow and worktree tooling

* fix(ai-workflow): address review feedback

* fix(ai-workflow): make format hook portable

scripts/agent-hooks/format.sh

@@ -0,0 +1,37 @@
+#!/bin/bash
+
+# afterFileEdit hook: Auto-format files after AI edits them
+# Receives JSON via stdin: {"file_path": "...", "edits": [...]}
+
+input=$(cat)
+if ! command -v jq >/dev/null 2>&1; then
+  exit 0
+fi
+
+file_path=$(printf '%s' "$input" | jq -r '.file_path // empty' 2>/dev/null)
+
+if [ -z "$file_path" ]; then
+  exit 0
+fi
+
+repo_root="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
+cd "$repo_root" || exit 0
+
+case "$file_path" in
+  *.js|*.ts|*.tsx|*.mjs)
+    dir_part="${file_path%/*}"
+    base_name="${file_path##*/}"
+    if [ "$dir_part" = "$file_path" ]; then
+      dir_part="."
+    fi
+
+    resolved_dir="$(cd -P -- "$repo_root/$dir_part" 2>/dev/null && pwd -P)" || exit 0
+    resolved_path="$resolved_dir/$base_name"
+    case "$resolved_path" in
+      "$repo_root"/*) npx oxfmt "$resolved_path" 2>/dev/null || true ;;
+      *) exit 0 ;;
+    esac
+    ;;
+esac
+
+exit 0

scripts/agent-hooks/sync-git-branches.sh

@@ -0,0 +1,115 @@
+#!/bin/bash
+
+# stop hook: prune stale remote refs and remove integrated temporary local branches
+# This is informational - always exits 0
+
+cat > /dev/null
+
+cd "$(git rev-parse --show-toplevel 2>/dev/null || pwd)" || exit 0
+
+if ! git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+  exit 0
+fi
+
+default_branch="$(git symbolic-ref --quiet --short refs/remotes/origin/HEAD 2>/dev/null | sed 's#^origin/##')"
+if [ -z "$default_branch" ]; then
+  default_branch="master"
+fi
+
+current_branch="$(git branch --show-current 2>/dev/null || true)"
+
+branch_looks_temporary() {
+  case "$1" in
+    pr/*|feature/*|fix/*|docs/*|chore/*|codex/pr/*|codex/feature/*|codex/fix/*|codex/docs/*|codex/chore/*) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+branch_is_integrated() {
+  local branch="$1"
+  local cherry_output
+
+  cherry_output="$(git cherry "$default_branch" "$branch" 2>/dev/null || true)"
+  if echo "$cherry_output" | grep -q '^+'; then
+    return 1
+  fi
+
+  return 0
+}
+
+branch_has_live_upstream() {
+  local upstream="$1"
+  [ -n "$upstream" ] && git show-ref --verify --quiet "refs/remotes/$upstream"
+}
+
+merged_pr_number_for_branch() {
+  local branch="$1"
+  local pr_number=""
+
+  if ! command -v gh >/dev/null 2>&1; then
+    return 0
+  fi
+
+  case "$branch" in
+    pr/*)
+      pr_number="${branch#pr/}"
+      ;;
+    codex/pr/*)
+      pr_number="${branch#codex/pr/}"
+      ;;
+  esac
+
+  if [ -n "$pr_number" ]; then
+    gh pr view "$pr_number" --repo bitsocialnet/5chan --json mergedAt --jq 'select(.mergedAt != null) | .mergedAt' >/dev/null 2>&1 || return 0
+    echo "$pr_number"
+    return 0
+  fi
+
+  gh pr list --repo bitsocialnet/5chan --state merged --head "$branch" --json number --jq '.[0].number // empty' 2>/dev/null || true
+}
+
+echo "Syncing git refs and temporary branches..."
+echo ""
+
+echo "=== git config --local fetch.prune true ==="
+git config --local fetch.prune true 2>&1 || true
+echo ""
+
+echo "=== git config --local remote.origin.prune true ==="
+git config --local remote.origin.prune true 2>&1 || true
+echo ""
+
+echo "=== git fetch --prune origin ==="
+git fetch --prune origin 2>&1 || true
+echo ""
+
+while IFS='|' read -r branch upstream; do
+  local_pr_number=""
+
+  [ -z "$branch" ] && continue
+  [ "$branch" = "$current_branch" ] && continue
+  [ "$branch" = "$default_branch" ] && continue
+
+  branch_looks_temporary "$branch" || continue
+  local_pr_number="$(merged_pr_number_for_branch "$branch")"
+
+  if branch_has_live_upstream "$upstream"; then
+    continue
+  fi
+
+  if ! branch_is_integrated "$branch" && [ -z "$local_pr_number" ]; then
+    continue
+  fi
+
+  if [ -n "$local_pr_number" ]; then
+    echo "=== merged PR #$local_pr_number allows deleting $branch ==="
+    echo ""
+  fi
+
+  echo "=== git branch -d $branch ==="
+  git branch -d "$branch" 2>&1 || true
+  echo ""
+done < <(git for-each-ref --format='%(refname:short)|%(upstream:short)' refs/heads)
+
+echo "Git ref sync complete."
+exit 0

scripts/agent-hooks/verify.sh

@@ -0,0 +1,84 @@
+#!/bin/bash
+
+# stop hook: run required repo verification commands for agent-driven changes
+
+set -u
+
+mode="${AGENT_VERIFY_MODE:-strict}"
+
+if [ "${1:-}" = "--advisory" ]; then
+  mode="advisory"
+  shift
+fi
+
+cat > /dev/null
+
+cd "$(git rev-parse --show-toplevel 2>/dev/null || pwd)" || exit 0
+
+cleanup_generated_dir() {
+  local path="$1"
+
+  if ! git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+    return
+  fi
+
+  if git ls-files --error-unmatch "$path" >/dev/null 2>&1; then
+    if git diff --quiet -- "$path"; then
+      return
+    fi
+
+    echo "=== git restore --worktree $path ==="
+    git restore --worktree -- "$path" 2>&1 || true
+    echo ""
+    return
+  fi
+
+  if [ -e "$path" ]; then
+    echo "=== rm -rf $path ==="
+    rm -rf "$path" 2>&1 || true
+    echo ""
+  fi
+}
+
+run_required_check() {
+  local label="$1"
+  shift
+
+  echo "=== $label ==="
+  if "$@" 2>&1; then
+    echo ""
+    return 0
+  fi
+
+  echo ""
+  return 1
+}
+
+echo "Running build, lint, type-check, and security audit..."
+echo ""
+
+failures=0
+
+run_required_check "yarn build" yarn build || failures=1
+run_required_check "yarn lint" yarn lint || failures=1
+run_required_check "yarn type-check" yarn type-check || failures=1
+
+echo "=== yarn audit ==="
+yarn audit 2>&1 || true
+echo ""
+
+cleanup_generated_dir build
+cleanup_generated_dir dist
+
+if [ "$failures" -ne 0 ]; then
+  if [ "$mode" = "advisory" ]; then
+    echo "Verification failed, but AGENT_VERIFY_MODE=advisory so the hook is exiting 0."
+    exit 0
+  fi
+
+  echo "Verification failed."
+  exit 1
+fi
+
+echo "Verification complete."
+exit 0

scripts/agent-hooks/yarn-install.sh

@@ -0,0 +1,20 @@
+#!/bin/bash
+
+# afterFileEdit hook: Run yarn install when package.json is changed
+# Receives JSON via stdin: {"file_path": "...", "edits": [...]}
+
+input=$(cat)
+file_path=$(echo "$input" | grep -o '"file_path"[[:space:]]*:[[:space:]]*"[^"]*"' | sed 's/.*:.*"\([^"]*\)"/\1/')
+
+if [ -z "$file_path" ]; then
+  exit 0
+fi
+
+if [ "$file_path" = "package.json" ]; then
+  repo_root="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
+  cd "$repo_root" || exit 0
+  echo "package.json changed - running yarn install to update yarn.lock..."
+  yarn install
+fi
+
+exit 0