fix(kanban): base new worktree branches on origin/HEAD, not parked local HEAD (#68201)

[yuvrajlaptop2008-byte]

Closes #68201

If the primary checkout is left parked on an unmerged feature branch, every kanban worker worktree created during that window inherited that branch's commits, contaminating worker PRs with unrelated files (and tripping the wrapper's write-guard into a false scope violation).

This resolves the remote default branch (origin/HEAD) when available and falls back to HEAD otherwise, mirroring the desktop app's git-worktree-ops.ts defaultBranch().

Tested: added regression tests in tests/hermes_cli/test_kanban_db.py (real temp git repo; asserts the new branch is based on origin/main and does NOT descend from a parked feature branch).

[alt-glitch]

This was generated by AI during triage.

Related: #61626 and #67760 also repair Kanban task-worktree base selection. This patch uses cached origin/HEAD; #61626 fetches a fresh remote tip and #67760 resolves the live remote default. Please consolidate/select the desired behavior.

[teknium1]

Thanks for targeting the centralized Kanban worktree creation path; current main still branches new task worktrees from local HEAD at hermes_cli/kanban_db.py:6356-6359.

Problems

• The proposed resolver only reads cached origin/HEAD. It does not fetch, so it can still branch from a stale remote-tracking commit. The existing interactive path fetches the selected remote branch before returning it (cli.py:1527-1530), and its regression test requires the remote-only commit (tests/cli/test_worktree_sync_base.py:99-108).
• If the cached origin/HEAD is absent, the helper returns parked local HEAD, recreating the contamination condition. The added tests create that cache explicitly, so neither an absent cache nor a moved remote default is covered.

Suggested changes

• Consolidate the remote-default/base-freshness contract with #61626 and #67760 before salvaging this patch.
• Add real local-remote coverage for a remote advanced after clone and for an absent or stale cached origin/HEAD.

Automated hermes-sweeper review.

[teknium1]

origin/HEAD here is only a local cached symref, and _git_default_base() never fetches. A clone can therefore avoid the parked feature branch but still branch from a stale remote-tracking commit; an absent cached symref falls back to the parked HEAD. Please consolidate on a fresh remote-default contract and add coverage where the remote advances after clone.

[GottZ]

This was generated by AI during triage.

Summary

One PR, #68278, directly addresses #68201. Its diff changes Kanban worktree creation to prefer cached origin/HEAD over a parked local HEAD and tests that contamination path, but it neither fetches an advanced remote tip nor avoids the parked-HEAD fallback when the cached symref is absent.

Related pull requests

• fix(kanban): base new worktree branches on origin/HEAD, not parked local HEAD (#68201) #68278 best fix — (+108/-1) — n/a: The diff adds _git_default_base(), uses its result when creating new worktree branches, and proves that a configured origin/HEAD excludes commits from a parked feature branch. The contributor COMMENTED keep_open review identifies the concrete salvage work: resolve a fresh remote default and add local/remote coverage for an advanced remote and absent or stale origin/HEAD.

Duplicates

#68278 substantially overlaps #61626 and #67760 on Kanban task-worktree base selection, while the discussion records different freshness and remote-default semantics that must be consolidated before treating either alternative as a duplicate.

Suggested consolidation

Keep #68278 open with a salvage path, consistent with the visible keep_open review: consolidate on a fresh remote-default contract with #61626 and #67760, then add tests for a remote advanced after clone and for absent or stale origin/HEAD. Do not close #61626 or #67760 as duplicates until the selected implementation incorporates the required freshness behavior and coverage.

Complex graph

flowchart LR
    classDef open fill:#dbeafe,stroke:#1d4ed8,color:#1e3a8a
    classDef merged fill:#dcfce7,stroke:#15803d,color:#14532d
    classDef closed fill:#e5e7eb,stroke:#6b7280,color:#1f2937
    classDef unverified fill:#f3f4f6,stroke:#9ca3af,color:#374151
    classDef best stroke-width:3px,stroke:#b45309
    classDef target stroke-width:3px,stroke:#4338ca
    I68201(["issue #68201 (open)"])
    P68278["PR #68278 (open)"]
    P68278 -->|best fix| I68201
    class I68201 open
    class P68278 open
    class P68278 best
    class P68278 target
    click I68201 "https://github.com/NousResearch/hermes-agent/issues/68201"
    click P68278 "https://github.com/NousResearch/hermes-agent/pull/68278"

Loading

Graph: solid arrow = fixes / best fix, dashed arrow = partial or unverified (see edge label); boxed group = PRs duplicating each other; amber border = best fix; indigo border = target; gray node = closed (state tag in the node label).

Cross-PR triage: Reviewed 1 pull request and 1 issue in this complex. Each diff was read against this issue; Assessment working set: 6 kB of PR diffs, 3 kB of issue/PR text, 2 kB of discussion (4 comments), 3 verify verdicts. verdicts reflect diff content, not PR titles. Part of an automated triage batch.