holt 0.3.0

holt 0.3.0 — measured, and fixed where the measurement hurt

Know what your agents made, and don't lose any of it. You ran a dozen agents overnight; holt
tells you what each worktree actually produced, which ones collide, which are safe to delete, and
it stops an agent deleting work that exists nowhere else.

0.2.0 could act. 0.3.0 is the first release that has been scored — against an oracle proven to
share no code with holt — and then fixed where the score was bad.

Install

npm install -g https://github.com/Raed2180416/holt/releases/download/v0.3.0/holt.tgz

One command — no clone, no build. This release is built, installed and driven against a real
repository on Linux, macOS and Windows by CI before the file is attached, and the same smoke
test now runs on every commit rather than only at release time. holt.tgz is a stable name, so
this URL keeps working; the versioned holt-0.3.0.tgz is attached alongside it.

holt is not on the npm registry yet — npm install -g holt 404s — so this URL is the install.

Then, in any repository with worktrees:

holt integrate       # wire every agent you use — the whole setup
holt auto            # locks what would be lost; tells you what needs a decision

Measured for the first time

50 languages, 900 worktrees, 18,000 labelled claims, scored against an independent oracle that
shares no code with holt — the independence is proven, not asserted, by a static import-graph
walk, a runtime module-resolution hook, and a probe that proves the hook actually fires
(independence-check.mjs; full detail and reproduction command in BENCHMARKS.md §9):

question	precision	recall
disposable	1.00	1.00
conflict	1.00	0.96
duplicate	0.75	1.00
refuse	1.00	1.00
unique	1.00	1.00

False "safe to delete": 0 of 900, reproduced across four independent runs. duplicate's
precision and conflict's recall are the two numbers here below 1.00 on purpose — see "Known
limits" below and BENCHMARKS.md §§8–9 for exactly which cases they are and why closing
duplicate further would mean overriding holt's own correct, hand-verified answer.

Recall on disposable was 0.40 when first measured, and that is the headline fix of this
release: holt was refusing 60% of the work it exists to do. Perfect precision at 0.40 recall is not
a safe tool — it is one that answers "I cannot be sure" to most of its own question.

What's new

• holt auto — the autopilot. Does everything that cannot lose data by itself (locks what is
  at risk, releases locks no longer justified) and hands the destructive half over with the
  evidence and the exact command. It never deletes.
• holt discard <path> — the escape hatch. Captures content to a verified ref first, then
  removes it, so the guard stays on and the loss does not. A tracked file is reverted rather than
  deleted. Journalled, with the restore command printed.
• Redundancy-aware disposal — a worktree whose content a living sibling also holds is now
  correctly disposable. clean --apply re-verifies before each removal, so a redundant set drains
  to exactly one survivor; gate refuses it, because the rm -rf a script runs after gate never
  looks again.
• The guard speaks Windows — Remove-Item, rd /s /q, del /f /q, Move-Item,
  Clear-Content and Set-Content are classified exactly as their POSIX equivalents.
• Shell indirection is never a silent allow — $(echo rm), a variable-supplied verb and eval
  return ask; sh -c "…" and node -e "…" are read and given a real verdict.
• Cursor blocks deterministically, and ten hosts that claimed MCP now actually get a config —
  including OpenAI Codex CLI, which needed holt's first TOML writer.
• Static analysis — 20,749 lines shipped with no type checking; now gated by a ratchet that can
  go down and never up.
• A rewritten site with a real light mode and a picture of what you actually get.

Fixed

Seven ways holt could report work as "safe to delete" when it existed nowhere else — each
reproduced end to end with git fsck confirming the loss, each now covered by a test that was
watched failing first: vendor/, logs/ and tmp/ treated as generated; git stash unmodeled;
rescue reporting verified:true for a submodule it captured nothing from; discard following a
symlink into another file's work; and node -e "require('fs').rmSync(…)" silently allowed.

Also: a rename/rename conflict reported as "no collisions"; gitignored .env.local files
manufacturing false HIGH collisions; an O(N²) merge-tree storm; and a ctags argv injection where a
file named -L could leak the contents of files outside the batch.

Known limits

• Very large repositories are slow with symbols on — the Linux kernel takes ~16 minutes.
  --no-symbols is fast and answers a weaker question.
• A duplicate verdict is symbol-identity based: two workstreams that each declare a function with
  the same name can read as duplicates even when their bodies differ. Measured precision is
  0.75 on the benchmark corpus, and every false positive traces to the one case bench50 plants
  on purpose, once per language — the same symbol name and body declared in a second file with
  different surrounding content — which is a real, deliberately unresolvable disagreement between a
  symbol-identity answer and a content-identity oracle, not an unexamined miss (BENCHMARKS.md §8
  has the full breakdown, the fix that did land for a different false-positive class, and why
  this specific number does not move further). holt duplicates --deep adds token-level clone
  detection (jscpd) for the same question asked a different way.
• conflict recall is 0.96 (2 of 50 planted conflict pairs missed) rather than 1.00. Both
  misses are holt collisions --json --all not surfacing a pair git merge-tree says collides;
  which 2 of the 50 repositories miss has moved between scoring runs taken minutes apart during
  active work on this exact code path — reported as an open, moving defect with the specific
  repositories named (BENCHMARKS.md §9), not smoothed into a single number that looks more settled
  than it is.