fix: move the merge hooks off GraphQL onto REST

Both PostToolUse hooks that fire after `gh pr merge` read GitHub through
`gh pr list` / `gh pr view`, and every `gh pr *` porcelain command goes
through the GraphQL API. That budget is scored in points rather than
requests, and agent sessions here exhaust it routinely, at which point
both hooks fail silently: the cleanup hook stops seeing squash-merged
PRs so every merged worktree leaks, and the release hook never fires its
global-CLI reminder. Both were failing this way when measured.

The REST pulls endpoint answers the same two questions on a separate
budget, so move them there.

Also stop capturing JSON into a shell variable and parsing it. A `gh`
earlier on PATH may be a wrapper that prints a banner to stdout before
exec'ing the real binary, and that text lands inside the capture and
breaks the parse. Asking for one scalar and taking the last line is
immune to it.

The squash-merge path had no test at all, because the harness makes gh a
no-op, so it grew a stub that answers the REST call.

Author: vivek7405

.claude/hooks/cleanup-merged-worktree.sh

@@ -61,9 +61,25 @@ is_merged() {
   if git merge-base --is-ancestor "refs/heads/$br" "$base" 2>/dev/null; then return 0; fi
   # A merged GitHub PR for this head branch (squash merges, which are NOT an
   # ancestor of base). Network; skipped when gh is absent or unauthenticated.
+  #
+  # REST, not `gh pr list`. Every `gh pr *` porcelain command goes through the
+  # GraphQL API, whose budget is scored in POINTS and which agent sessions here
+  # routinely exhaust; when it is spent this lookup returns nothing, the branch
+  # reads as unmerged, and the worktree leaks, which is the exact failure this
+  # hook exists to prevent. The REST pulls endpoint is a separate budget.
+  # `{owner}`/`{repo}` expand from the current repo, and resolve to nothing when
+  # there is no remote (the test harness), so the call fails closed to the
+  # ancestor check above rather than erroring.
+  #
+  # Read the number through `grep -E '^[0-9]+$'` rather than trusting the whole
+  # capture: a `gh` earlier on PATH may be a wrapper that prints a banner to
+  # STDOUT before exec'ing the real binary, which would otherwise land inside
+  # this variable.
   if command -v gh >/dev/null 2>&1; then
     local n
-    n=$(gh pr list --state merged --head "$br" --json number --jq '.[0].number' 2>/dev/null | grep -E '^[0-9]+$' || true)
+    n=$(gh api "repos/{owner}/{repo}/pulls?state=closed&head={owner}:$br&per_page=100" \
+      --jq '[.[] | select(.merged_at != null)] | .[0].number // empty' 2>/dev/null \
+      | grep -E '^[0-9]+$' || true)
     [ -n "$n" ] && return 0
   fi
   return 1

.claude/hooks/release-global-update.sh

@@ -39,16 +39,23 @@ command -v gh >/dev/null 2>&1 || exit 0
 num=$(printf '%s' "$cmd" | grep -oE 'gh pr merge[[:space:]]+#?[0-9]+' | grep -oE '[0-9]+' | head -1)
 if [ -z "$num" ]; then exit 0; fi
 
-info=$(gh pr view "$num" --json headRefName,title 2>/dev/null || true)
-if [ -z "$info" ]; then exit 0; fi
-head=$(printf '%s' "$info" | jq -r '.headRefName // ""' 2>/dev/null || true)
-title=$(printf '%s' "$info" | jq -r '.title // ""' 2>/dev/null || true)
+# REST, not `gh pr view`. Every `gh pr *` porcelain command goes through the
+# GraphQL API, whose budget is scored in POINTS and which agent sessions here
+# routinely exhaust; when it is spent this fetch returns nothing and the reminder
+# silently never fires. The REST pulls endpoint is a separate budget.
+#
+# Ask for the ONE field this hook reads and take the LAST line, rather than
+# capturing JSON and parsing it here. A `gh` earlier on PATH may be a wrapper
+# that prints a banner to STDOUT before exec'ing the real binary; prepended to
+# JSON that breaks the parse outright, while a scalar survives `tail -n1`.
+title=$(gh api "repos/{owner}/{repo}/pulls/$num" --jq '.title // empty' 2>/dev/null | tail -n1)
+if [ -z "$title" ]; then exit 0; fi
 
 # A real release PR carries the canonical "chore: release <pkgs>" title (the
 # release process always titles it exactly that). Match the TITLE, not the
 # branch prefix: a `chore/release-*` branch that is NOT a package release (a hook
 # tweak, a doc change) would otherwise fire a false reminder with nothing to
-# publish. `head` is unused now but kept in the fetch for future signals.
+# publish.
 if ! printf '%s' "$title" | grep -qiE '^chore: release '; then exit 0; fi
 
 read -r -d '' MSG <<'EOF' || true

test/hooks/cleanup-merged-worktree.test.mjs

@@ -13,9 +13,9 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
 import { execFileSync, spawnSync } from 'node:child_process';
-import { mkdtempSync, writeFileSync, existsSync } from 'node:fs';
+import { mkdtempSync, writeFileSync, existsSync, chmodSync } from 'node:fs';
 import { tmpdir } from 'node:os';
-import { join, dirname, resolve } from 'node:path';
+import { join, dirname, resolve, delimiter } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const HOOK = resolve(
@@ -46,14 +46,50 @@ function addWorktree({ git, dir, main }, name, { merged, dirty } = {}) {
   return path;
 }
 
+/**
+ * A fake `gh` on PATH emulating the REST call the hook makes for squash merges,
+ * `gh api "repos/{owner}/{repo}/pulls?...&head={owner}:<branch>&..." --jq ...`.
+ * It prints a PR number when `<branch>` is in `mergedBranches`, and nothing
+ * otherwise. `bannerLine`, when set, is printed to STDOUT first, reproducing a
+ * PATH wrapper (a mise shim does this locally) that would otherwise land inside
+ * the hook's `$(gh ...)` capture.
+ */
+function fakeGhDir(mergedBranches, bannerLine = '') {
+  const dir = mkdtempSync(join(tmpdir(), 'webjs-wtgh-'));
+  const gh = join(dir, 'gh');
+  writeFileSync(
+    gh,
+    [
+      '#!/usr/bin/env bash',
+      bannerLine ? `echo ${JSON.stringify(bannerLine)}` : '',
+      'for a in "$@"; do',
+      '  case "$a" in',
+      '    *head=*)',
+      '      br="${a##*:}"; br="${br%%&*}"',
+      `      for m in ${mergedBranches.map((b) => `'${b}'`).join(' ')}; do`,
+      '        if [ "$br" = "$m" ]; then echo 4242; exit 0; fi',
+      '      done ;;',
+      '  esac',
+      'done',
+      '',
+    ].join('\n'),
+  );
+  chmodSync(gh, 0o755);
+  return dir;
+}
+
 /** Run the hook with a given command, from a given cwd. Returns {code, out}. */
-function runHook(command, cwd) {
+function runHook(command, cwd, { mergedBranches = null, bannerLine = '' } = {}) {
+  // Default: no stub, so the no-remote temp repo makes gh a harmless no-op
+  // regardless of host auth, and only the ancestor-of-base signal fires.
+  const ghDir = mergedBranches ? fakeGhDir(mergedBranches, bannerLine) : null;
+  const env = { ...process.env, GH_NO_UPDATE_NOTIFIER: '1' };
+  if (ghDir) env.PATH = `${ghDir}${delimiter}${process.env.PATH}`;
   const r = spawnSync('bash', [HOOK], {
     cwd,
     input: JSON.stringify({ tool_input: { command } }),
     encoding: 'utf8',
-    // Force the no-remote temp repo to make gh a harmless no-op regardless of host auth.
-    env: { ...process.env, GH_NO_UPDATE_NOTIFIER: '1' },
+    env,
   });
   return { code: r.status, out: (r.stdout || '') + (r.stderr || '') };
 }
@@ -73,6 +109,52 @@ test('removes a merged + clean worktree, keeps dirty and unmerged ones', () => {
   assert.ok(existsSync(repo.main), 'primary checkout is never removed');
 });
 
+// A squash merge leaves the branch NOT an ancestor of base, so the git signal
+// cannot see it and the REST lookup is the only thing that can. This is the path
+// that silently stopped working while it went through GraphQL: an exhausted
+// point budget returned nothing, every squash-merged branch read as unmerged,
+// and its worktree leaked, which is the failure the hook exists to prevent.
+test('removes a squash-merged worktree that git alone cannot see as merged', () => {
+  const repo = makeRepo();
+  const squashed = addWorktree(repo, 'feat-squashed', {});
+  const unmerged = addWorktree(repo, 'feat-really-unmerged', {});
+
+  // Neither branch is an ancestor of main; only `feat-squashed` has a merged PR.
+  const { code } = runHook('gh pr merge 1 --squash', repo.main, {
+    mergedBranches: ['feat-squashed'],
+  });
+
+  assert.equal(code, 0);
+  assert.ok(!existsSync(squashed), 'a squash-merged branch is detected over REST and removed');
+  assert.ok(existsSync(unmerged), 'a branch with no merged PR is still kept');
+});
+
+test('squash-merge detection survives a `gh` wrapper that banners to stdout', () => {
+  const repo = makeRepo();
+  const squashed = addWorktree(repo, 'feat-squashed', {});
+
+  const { code } = runHook('gh pr merge 1 --squash', repo.main, {
+    mergedBranches: ['feat-squashed'],
+    bannerLine: 'mise ~/.config/mise/config.toml tools: gh@2.97.0',
+  });
+
+  assert.equal(code, 0);
+  assert.ok(!existsSync(squashed), 'a stdout banner must not hide the PR number');
+});
+
+test('a banner with no PR number does not make an unmerged branch look merged', () => {
+  const repo = makeRepo();
+  const unmerged = addWorktree(repo, 'feat-unmerged', {});
+
+  const { code } = runHook('gh pr merge 1 --squash', repo.main, {
+    mergedBranches: [],
+    bannerLine: 'mise ~/.config/mise/config.toml tools: gh@2.97.0',
+  });
+
+  assert.equal(code, 0);
+  assert.ok(existsSync(unmerged), 'banner text must never be read as a PR number');
+});
+
 test('does nothing on a command that is not `gh pr merge`', () => {
   const repo = makeRepo();
   const clean = addWorktree(repo, 'feat-merged-clean', { merged: true });

test/hooks/release-global-update.test.mjs

@@ -5,8 +5,16 @@
 // publish lands. A normal PR merge, a non-merge command, and the escape hatch
 // produce no reminder. It never blocks the tool (always exits 0).
 //
-// `gh pr view` is stubbed with a fake `gh` on PATH so the test is offline and
-// deterministic.
+// The hook reads the PR title over the REST pulls endpoint (`gh api`), NOT
+// `gh pr view`, because every `gh pr *` porcelain command spends the GraphQL
+// point budget that agent sessions here exhaust. A fake `gh` on PATH stubs that
+// call so the test is offline and deterministic.
+//
+// The fake also covers a trap the real environment has: a `gh` earlier on PATH
+// may be a WRAPPER that prints a banner to stdout before exec'ing the real
+// binary (a mise shim does exactly this locally). That banner lands inside any
+// `$(gh ...)` capture, so the hook asks for a single scalar and takes the last
+// line instead of capturing JSON and parsing it. `bannerLine` exercises that.
 
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
@@ -21,17 +29,40 @@ const HOOK = resolve(
   '../../.claude/hooks/release-global-update.sh',
 );
 
-/** A fake `gh` on PATH whose `pr view` prints the given headRefName + title. */
-function fakeGhDir(headRefName, title) {
+/**
+ * A fake `gh` on PATH emulating `gh api <endpoint> --jq <expr>`: it reads the
+ * `--jq` expression and prints the matching scalar, the way the real command
+ * does. `bannerLine`, when set, is printed to STDOUT first, reproducing a PATH
+ * wrapper that announces itself before running.
+ */
+function fakeGhDir(headRefName, title, bannerLine = '') {
   const dir = mkdtempSync(join(tmpdir(), 'webjs-relhook-'));
   const gh = join(dir, 'gh');
-  writeFileSync(gh, `#!/usr/bin/env bash\necho '${JSON.stringify({ headRefName, title })}'\n`);
+  writeFileSync(
+    gh,
+    [
+      '#!/usr/bin/env bash',
+      bannerLine ? `echo ${JSON.stringify(bannerLine)}` : '',
+      'expr=""',
+      'prev=""',
+      'for a in "$@"; do',
+      '  if [ "$prev" = "--jq" ]; then expr="$a"; fi',
+      '  prev="$a"',
+      'done',
+      'case "$expr" in',
+      `  *.title*) echo ${JSON.stringify(title)} ;;`,
+      `  *head.ref*) echo ${JSON.stringify(headRefName)} ;;`,
+      '  *) ;;',
+      'esac',
+      '',
+    ].join('\n'),
+  );
   chmodSync(gh, 0o755);
   return dir;
 }
 
-function runHook(command, { headRefName = '', title = '', env = {} } = {}) {
-  const ghDir = fakeGhDir(headRefName, title);
+function runHook(command, { headRefName = '', title = '', bannerLine = '', env = {} } = {}) {
+  const ghDir = fakeGhDir(headRefName, title, bannerLine);
   try {
     const r = spawnSync('bash', [HOOK], {
       input: JSON.stringify({ tool_input: { command } }),
@@ -81,6 +112,26 @@ test('does NOTHING for a chore/release-* branch that is not a package release (t
   assert.doesNotMatch(out, /webjsdev/, 'a chore/release-* branch with a non-release title must not fire');
 });
 
+test('survives a `gh` wrapper that prints a banner to stdout before the payload', () => {
+  const { code, out } = runHook('gh pr merge 839 --squash', {
+    headRefName: 'chore/release-2026-07-08b',
+    title: 'chore: release server 0.8.43',
+    bannerLine: 'mise ~/.config/mise/config.toml tools: gh@2.97.0',
+  });
+  assert.equal(code, 0);
+  assert.match(out, /npm update -g webjsdev/, 'a stdout banner must not swallow the title');
+});
+
+test('a banner alone, with no title, does not fire the reminder', () => {
+  const { code, out } = runHook('gh pr merge 839 --squash', {
+    headRefName: '',
+    title: '',
+    bannerLine: 'mise ~/.config/mise/config.toml tools: gh@2.97.0',
+  });
+  assert.equal(code, 0);
+  assert.doesNotMatch(out, /webjsdev/, 'the banner must never be mistaken for a release title');
+});
+
 test('does NOTHING for a command that is not `gh pr merge`', () => {
   const { out } = runHook('git status', { headRefName: 'chore/release-x', title: 'chore: release x' });
   assert.doesNotMatch(out, /webjsdev/);