fix(cli): rebuild Wave 2 Windows worktree port

[rerdi92]

What changed

• Rebuilt the Wave 2 Windows worktree-quarantine port as the atomic commit 29ea2dd05ee7fa3b8721cde1ed5bc4fe8ab29f6a directly on current upstream main (7651764ce).
• Registered that exact SHA in .github/merge-coverage.json.

Why

The fail-closed merge-coverage guard requires the implementation and its two Windows contract tests to remain in one port commit. The upstream base advanced with paste-history recall, so this update rebuilds the same port on that current base rather than carrying stale history.

Validation

• python -m pytest tests/cli/test_worktree.py tests/cli/test_worktree_security.py --basetemp=C:\hermes-test-temp\wave2-origin-r2 -q
  • 61 passed, 1 skipped
• Manifest JSON parsed and its candidate SHA was checked against git rev-parse HEAD before registration.
• git diff --check

Impact

This preserves the Windows fallback worktree quarantine contract without broadening the merge-coverage allowlist.

[rerdi92]

Maintainer action requested: please approve the fork workflow run for this PR so CI can start.

• Current head: 0affd4d731f8e3b2eecbe0b97efb874ac0c0d112
• Run: https://github.com/NousResearch/hermes-agent/actions/runs/29801775442
• Local validation: 61 passed, 1 skipped for the Wave 2 Windows worktree tests; independent re-review passed.

The run is currently action_required with no jobs, so the merge-coverage/strict result is not yet available.

[teknium1]

Thanks for refreshing the Windows worktree coverage. The dirty-on-exit premise remains valid: current cli.py:2007-2031 checks only unpushed commits before force-removing the worktree, while website/docs/user-guide/configuration.md:710 says dirty trees are kept for recovery.

Problems

• The submitted clean-worktree quarantine policy needs a maintainer decision. Current main deliberately reaps clean trees and, in acbc3abe8b5efe97be599f2b74b3be504e3ebe3b, added all-lane pruning, squash-merge detection, and preserved-work visibility (cli.py:2213-2356). The replacement pruner in this PR does not retain those guarantees.
• GitHub currently reports this head as mergeable=false and rebaseable=false, so it requires a current-main salvage rather than a clean cherry-pick.

Suggested changes

• Keep the focused dirty-exit recovery fix, then apply any approved quarantine policy while retaining current cli.py:2254-2295 squash-merge, cache, and parallel-classification behavior.

Automated hermes-sweeper review.

[GottZ]

This was generated by AI during triage.

Summary

Two open PRs address the same worktree-recovery problem with materially identical diffs: both preserve dirty worktrees on exit and replace clean-tree deletion with quarantine, but their replacement pruner does not retain the current all-worktree, Kanban, squash-equivalence, cache, and parallel-classification behavior. Their Windows tests permit the existing copy fallback without deterministically exercising the symlink-privilege failure path.

Related pull requests

• fix(cli): preserve worktree quarantine on Windows #68252 duplicate — (+468/-187) — n/a: Preserves dirty or unique worktree state and quarantines clean trees, but replaces the current pruner with an older pipeline and adds Windows assertions that do not force the privilege-failure fallback. Despite the keep_open review on fix(cli): preserve worktree quarantine on Windows #68252, its full diff is materially identical to fix(cli): rebuild Wave 2 Windows worktree port #68391 and provides no distinct salvage target.
• fix(cli): rebuild Wave 2 Windows worktree port #68391 related — (+468/-187) — n/a: Contains the same dirty-exit preservation, quarantine policy, lock handling, and Windows test changes as fix(cli): preserve worktree quarantine on Windows #68252. Consistent with its keep_open review, the focused dirty-exit fix is salvageable, but it must be separated from or reworked within the current pruner while retaining the behavior at cli.py:2254-2295 and adding a deterministic Windows privilege-failure test.

Duplicates

#68252 and #68391 contain materially the same +468/-187 changes across the same four files; #68252 is the duplicate of consolidation target #68391.

Suggested consolidation

Keep #68391 open with a salvage path: retain the focused dirty-exit recovery fix, rework any approved quarantine behavior within the current pruner without losing its all-worktree/Kanban, squash-equivalence, cache, and parallel-classification guarantees, and add deterministic Windows fallback coverage. Close #68252 as a duplicate of #68391; this departs from #68252's keep_open review only because the complete diffs show no distinct implementation worth maintaining in a second PR.

Complex graph

flowchart LR
    classDef open fill:#dbeafe,stroke:#1d4ed8,color:#1e3a8a
    classDef merged fill:#dcfce7,stroke:#15803d,color:#14532d
    classDef closed fill:#e5e7eb,stroke:#6b7280,color:#1f2937
    classDef unverified fill:#f3f4f6,stroke:#9ca3af,color:#374151
    classDef best stroke-width:3px,stroke:#b45309
    classDef target stroke-width:3px,stroke:#4338ca
    subgraph Dup68252 ["PRs duplicating each other"]
        P68252["PR #68252 (open)"]
        P68391["PR #68391 (open)"]
    end
    class P68252 open
    class P68391 open
    class P68391 target
    click P68252 "https://github.com/NousResearch/hermes-agent/pull/68252"
    click P68391 "https://github.com/NousResearch/hermes-agent/pull/68391"

Loading

Graph: solid arrow = fixes / best fix, dashed arrow = partial or unverified (see edge label); boxed group = PRs duplicating each other; amber border = best fix; indigo border = target; gray node = closed (state tag in the node label).

Cross-PR triage: Reviewed 2 pull requests and 0 issues in this complex. Each diff was read against this issue; Assessment working set: 76 kB of PR diffs, 3 kB of issue/PR text, <1 kB of discussion (2 comments), 0 verify verdicts. verdicts reflect diff content, not PR titles. Part of an automated triage batch.