Add branch-cleanup slash command

[igerber]

Summary

• Add /branch-cleanup slash command that identifies and deletes local git branches whose PRs have been merged on GitHub

Methodology references (required if estimator / math changes)

• Method name(s): N/A - no methodology changes
• Paper / source link(s): N/A
• Any intentional deviations from the source (and why): N/A

Validation

• Tests added/updated: No test changes (slash command skill file only)
• Backtest / simulation / notebook evidence (if applicable): N/A

Security / privacy

• Confirm no secrets/PII in this PR: Yes

---

Generated with Claude Code

[github-actions]

Overall Assessment: ⚠️ Needs changes

Executive Summary

• P1: git log -1 --format=... -- "<branch>" treats <branch> as a pathspec, so “Last Commit”/“Age” can be empty or wrong; also contradicts the “use -- before branch names” note. (.claude/commands/branch-cleanup.md:L119-L128, .claude/commands/branch-cleanup.md:L249-L251)
• P1: Force-deleting gh-confirmed branches (git branch -D) can drop local-only commits; this is riskier than stated. (.claude/commands/branch-cleanup.md:L176-L188)
• P2: No handling for gh pr list failures/auth errors—command may silently skip candidates instead of falling back to git-only detection. (.claude/commands/branch-cleanup.md:L93-L113)
• No estimator/statistical methodology changes; registry not implicated.

---

Methodology

• No findings. No estimator, math, weighting, variance/SE, or defaults changed; Methodology Registry not implicated.

Code Quality

• Severity: P1 | Impact: git log -1 --format="%s" -- "<branch>" makes <branch> a pathspec (not a revision), so “Last Commit”/“Age” can be empty or wrong; it also conflicts with the later “always use --” note. | Concrete fix: remove -- from git log invocations and update the note to call out git log as an exception (or resolve branch to a commit hash first). (.claude/commands/branch-cleanup.md:L119-L128, .claude/commands/branch-cleanup.md:L249-L251)
• Severity: P1 | Impact: git branch -D for gh-confirmed branches can delete local-only commits that never reached the PR, contradicting “safe” wording and risking data loss. | Concrete fix: attempt git branch -d first and only force-delete on explicit user confirmation/flag (or add a --force option). (.claude/commands/branch-cleanup.md:L176-L188)
• Severity: P2 | Impact: If gh pr list fails (auth/network), the spec doesn’t instruct a fallback, so merged branches may be missed with no warning. | Concrete fix: detect non-zero exit or invalid JSON and fall back to git branch -vv, with a warning. (.claude/commands/branch-cleanup.md:L93-L113)

Performance

• No findings.

Maintainability

• No findings.

Tech Debt

• No findings.

Security

• No findings.

Documentation/Tests

• No findings beyond the doc correctness issues above; no tests are expected for this slash-command spec.

[igerber]

/ai-review

[github-actions]

🔁 AI review rerun (requested by @igerber)

Head SHA: a54aecbfdedab3df75dfd883adb48b463f587efd

---

Overall Assessment

• ⚠️ Needs changes

Executive Summary

• P1: Force-delete path can drop unmerged local commits when a branch name is reused after a merged PR.
• P2: Printing git remote -v may leak embedded credentials/tokens.
• P3: git log ... "<branch>" can mis-handle branch names starting with -.
• No estimator/methodology impact; Methodology Registry not implicated.

Methodology

• No methodology changes in this PR (no estimators, math, weighting, or inference touched).

Code Quality

• Severity: P1 | Impact: A branch that previously had a merged PR but now contains new local commits will be marked “gh‑confirmed merged” and then force‑deleted after -d fails, losing unmerged work. | Concrete fix: Before -D, verify the branch tip matches the merged PR head/merge commit (e.g., fetch mergeCommit or headRefOid via gh pr view and compare), or detect any commits in branch not in the default branch and require per‑branch confirmation/skip; only allow -D when explicitly confirmed or --force is provided. (.claude/commands/branch-cleanup.md:L93-L203)
• Severity: P3 | Impact: Branch names starting with - can be interpreted as options by git log, breaking enrichment and potentially aborting the workflow. | Concrete fix: Use a fully qualified ref that doesn’t start with -, e.g., git log -1 --format="%s" "refs/heads/<branch>" (same for %ar). (.claude/commands/branch-cleanup.md:L130-L138)

Performance

• No issues found.

Maintainability

• No issues found.

Tech Debt

• No issues found.

Security

• Severity: P2 | Impact: git remote -v can expose embedded credentials or tokens in remote URLs to logs/chat output. | Concrete fix: Redact credentials before printing (e.g., mask https://<user>:<token>@...), or avoid printing full URLs and instead list just remote names unless a user explicitly requests details. (.claude/commands/branch-cleanup.md:L31-L39)

Documentation/Tests

• No issues found.

[igerber]

/ai-review

[github-actions]

🔁 AI review rerun (requested by @igerber)

Head SHA: ad53b0f2b86e734d70c167b4f76825662bc3c644

---

Overall Assessment

• ✅ Looks good

Executive Summary

• Doc-only addition of a new /branch-cleanup command specification; no library/estimator code touched. .claude/commands/branch-cleanup.md:L1-L289
• No methodology or identification/variance changes; registry not implicated for this PR.
• Tests not updated (doc-only change).

Methodology

• P3 (Info) | Impact: No estimator/method/assumption changes in diff; methodology registry/docstrings not applicable here. | Fix: None.

Code Quality

• P3 (Info) | Impact: Command spec is internally consistent and scoped to git/gh behaviors. | Fix: None.

Performance

• P3 (Info) | Impact: No runtime/library performance impact; documentation only. | Fix: None.

Maintainability

• P3 (Info) | Impact: Self-contained command file; no cross-module coupling introduced. | Fix: None.

Tech Debt

• P3 (Info) | Impact: No tech-debt signals from this doc-only change. | Fix: None.

Security

• P3 (Info) | Impact: Destructive operations are guarded (-d first; force-delete only with GH confirmation and tip match). .claude/commands/branch-cleanup.md:L167-L266 | Fix: None.

Documentation/Tests

• P3 (Info) | Impact: Documentation change only; tests not required. | Fix: None.