Add workspace-wide cleanup: workspace cleanup CLI and /iflow-cleanup all (#392)

.cursor/rules/issueflow-rules.mdc

@@ -194,7 +194,7 @@ The full slash-command lifecycle is:
 4. **`/iflow-pause`** *(optional)* — park work mid-stream: update status, move the issue group to `02-partly-solved-issues`, optional WIP commit.
 5. **`/iflow-close`** — tests, optional `uv version --bump`, **changelog/`HISTORY.md` update (in the PR commit)**, status update, commit, push, PR. Does not delete branches. Never offer a HISTORY/CHANGELOG update after close finishes or after merge; use `nohistory` only to skip intentionally. (A draft opened earlier via `/iflow-build` early PR does not skip the close HISTORY step.)
 
-6. **`/iflow-cleanup`** — post-merge: switch to default, `git pull --ff-only`, `git fetch --prune`, `git branch -d` on reachable local branches under a single consolidated confirm. If ff-only fails, classify with `issue-flow agent default-sync` (never rebase / force-push / push default to skip CI). Squash-landed branches (which `-d` always refuses) need `git branch -D`, offered only behind a **second** confirm that lists tip SHAs; branches with unique work are never deleted. Trailing `include GitHub` (or similar) adds a remote-branch audit with a further confirm for optional remote deletes / findings issue.
+6. **`/iflow-cleanup`** — post-merge: switch to default, `git pull --ff-only`, `git fetch --prune`, `git branch -d` on reachable local branches under a single consolidated confirm. If ff-only fails, classify with `issue-flow agent default-sync` (never rebase / force-push / push default to skip CI). Squash-landed branches (which `-d` always refuses) need `git branch -D`, offered only behind a **second** confirm that lists tip SHAs; branches with unique work are never deleted. Trailing `include GitHub` (or similar) adds a remote-branch audit with a further confirm for optional remote deletes / findings issue. Trailing `all` runs it for every scaffolded workspace member with the confirms consolidated per phase (`issue-flow workspace cleanup`).
 
 
 `/iflow-yolo` chains `capture → plan → build → close yolo` for small, low-risk issues with up-front safeguards (clean tree, passing tests, single consolidated confirm). Its close step is hands-off: changelog decided without a prompt, PR merged (`gh pr merge --squash`; on pending checks may `gh pr checks --watch` then retry, with `--auto` as last resort), then default-branch switch + pull.
@@ -328,7 +328,7 @@ When an editor workspace contains **multiple sibling repositories**, each with i
 
 - **Resolve the target repo first** — explicit `root:` / `repo:` hints, then `issue-flow agent resolve`, then branch/single-scaffold heuristics, then the **workspace default** from `issueflow-workspace.toml` at the workspace root (create it with `issue-flow workspace init`); **ask** when still ambiguous. Never let `git` or `gh` infer the repo from cwd alone.
 - **Scoped rules** — this repo's `issueflow-rules` apply under this project root only (path globs). Put **toolchain-specific** run/test commands in `.issueflows/04-designs-and-guides/this-project.md`, not in shared boilerplate that every repo merges.
-- **Per-repo lifecycle** — `/iflow-cleanup`, branch hygiene, and focus issue folders are **per repository**; repeat commands in each repo when needed.
+- **Per-repo lifecycle** — `/iflow-cleanup`, branch hygiene, and focus issue folders are **per repository**; repeat commands in each repo when needed (`/iflow-cleanup all` is the one opt-in workspace-wide pass).
 - **Design doc** — see `.issueflows/04-designs-and-guides/multi-repo-workspaces.md` when present (issue #67).
 
 

.cursor/skills/caveman/SKILL.md

@@ -6,7 +6,7 @@ description: >-
   caveman mode, token-greedy / terse answers, or says "be brief" / "stop
   wasting tokens". Stays active across the session once on; off via "stop
   caveman" / "normal mode".
-issue-flow-version: 0.5.15
+issue-flow-version: 0.5.17
 ---
 
 # Be token greedy - as a caveman

.cursor/skills/gh-ci/SKILL.md

@@ -7,7 +7,7 @@ description: >-
   gh run list and gh run watch when PR checks are empty or unavailable. Use
   when waiting for CI, merge-ready, Actions pending/failed, or the user
   mentions gh run watch / gh pr checks / "CI green".
-issue-flow-version: 0.5.15
+issue-flow-version: 0.5.17
 ---
 
 # gh-ci — wait on GitHub CI with `gh`

.cursor/skills/grill-me/SKILL.md

@@ -5,7 +5,7 @@ description: >-
   the decision tree is resolved, then feed the conclusions into the issue plan.
   Use when the user wants to stress-test a plan, asks to "grill me", or during
   /iflow-plan when grilling is turned on. Off via "stop grilling" / "normal mode".
-issue-flow-version: 0.5.15
+issue-flow-version: 0.5.17
 ---
 
 # Grill me — relentless planning interview

.cursor/skills/iflow-archive/SKILL.md

@@ -4,7 +4,7 @@ description: >-
   Condense old solved issue groups into one dated summary file, then delete
   the originals. Destructive, one consolidated confirm.
 disable-model-invocation: true
-issue-flow-version: 0.5.15
+issue-flow-version: 0.5.17
 ---
 
 # issue-flow — archive solved issues (`/iflow-archive`)

.cursor/skills/iflow-auto/SKILL.md

@@ -4,7 +4,7 @@ description: >-
   Unattended large-change orchestrator over a confirmed epic: cycle a stage,
   adversarial review, loop budget, next-epoch gate when the queue is clear.
 disable-model-invocation: true
-issue-flow-version: 0.5.15
+issue-flow-version: 0.5.17
 ---
 
 # issue-flow — advanced auto (`/iflow-auto`)

.cursor/skills/iflow-build/SKILL.md

@@ -4,7 +4,7 @@ description: >-
   Implement the confirmed plan for the focus issue using the project's
   documented conventions.
 disable-model-invocation: true
-issue-flow-version: 0.5.15
+issue-flow-version: 0.5.17
 ---
 
 # issue-flow — issue build (`/iflow-build`)

.cursor/skills/iflow-capture/SKILL.md

@@ -4,7 +4,7 @@ description: >-
   Capture a GitHub issue locally as issue<number>_original.md and archive
   other current issues by done status.
 disable-model-invocation: true
-issue-flow-version: 0.5.15
+issue-flow-version: 0.5.17
 ---
 
 # issue-flow — issue capture (`/iflow-capture`)

.cursor/skills/iflow-cleanup/SKILL.md

@@ -6,7 +6,7 @@ description: >-
   confirm). Optional GitHub remote audit via trailing "include GitHub" or
   baked cleanup_include_github. Never --force, never deletes unique work.
 disable-model-invocation: true
-issue-flow-version: 0.5.15
+issue-flow-version: 0.5.17
 ---
 
 # issue-flow — issue cleanup (`/iflow-cleanup`)
@@ -66,7 +66,7 @@ Optional free-form text after the command:
 - **Self-update (opt-out tokens)** — trailing `no bleeding`, `no bleeding-edge`, or `skip self-update` (case-insensitive) **skips** the upgrade even when `on_bleeding_edge` is baked true.
 - **Phase A ask tokens** — trailing `ask a1` or `ask a2` (case-insensitive) forces that phase's yes/no prompt even when `cleanup_yes_a1` / `cleanup_yes_a2` is baked true.
 - **Pre-authorized force-delete (orchestrator token)** — trailing `drive` (or `landed`) means the caller (`/iflow-drive`) already obtained one confirm that **explicitly covered** `-D` on squash-landed branches. Phase A1 and A2 then run **without re-asking**, but A2's scope narrows: `squash_landed` always; `merged_pr_divergent` only when none of its unique commits is newer than the PR's `mergedAt`; never `unique_work` / `skipped`. Tip SHAs are still printed. A human typing `/iflow-cleanup` never passes this token.
-- **Workspace walk (opt-in tokens)** — trailing `workspace`, `all`, or `include workspace` (case-insensitive) runs this skill **sequentially for every scaffolded workspace member**. One up-front confirm listing member names. Then existing Phase A1/A2 (and optional B) **per member**. A declined A2 in one repo continues to the next; user `abort` / `stop` ends the walk. Ignore these tokens when parsing a named branch. There is no mute `workspace cleanup` CLI. When self-update is enabled, upgrade the tool **once** at the start of the walk, then `issue-flow update` per member (do not reinstall PyPI on every member).
+- **Workspace mode (opt-in tokens)** — trailing `all`, `workspace`, or `include workspace` (case-insensitive) runs cleanup for **every scaffolded workspace member** in one pass (see step 4b). Confirms are **consolidated across members but still split by phase**: one A1 confirm, one A2 confirm, and (when Phase B is enabled) one Phase B confirm — never more than three for the whole workspace. Extra `root:<path>` hints include a scaffolded repo outside the registry (`--extra-root`). Ignore these tokens when parsing a named branch. When self-update is enabled, upgrade the tool **once** at the start, then `issue-flow update` per member (do not reinstall PyPI on every member). The CLI half is `issue-flow workspace cleanup` — classify-only unless told otherwise.
 
 **Phase B enable rule:** run Phase B when (`cleanup_include_github` is baked true **or** an opt-in GitHub token is present) **and** no opt-out token is present.
 
@@ -97,6 +97,13 @@ Optional free-form text after the command:
 
    > **Why the extra buckets:** this project merges PRs with **squash**, which lands a *new* commit on the default branch. A squash-merged branch tip is therefore never an ancestor of the default, so `git branch -d` refuses it forever — `-d` alone can never prune landed branches here.
 
+4b. **Workspace mode** (only with an `all` / `workspace` token — replaces steps 2–6 for the whole workspace; steps 7–8 then run per member).
+   1. **Survey.** Resolve the workspace root (`issue-flow agent resolve --json` → `workspace_root`). Run `issue-flow workspace cleanup --json` from there (add `--extra-root <path>` per `root:` hint). It fetches, classifies `default-sync`, buckets local branches with the same code as `agent local-branches`, lists linked worktrees, and computes an A1 / A2 plan per member — **read-only**. Print the grouped table. Members it **refused** (`skipped: true` — dirty product-code tree, detached HEAD, missing `origin`, locked) are reported with their reason and left out of every confirm; the loop continues with the rest.
+   2. **Phase A1 (one confirm for all members).** List per member: `switch <default>` (or why it is blocked), `pull --ff-only`, worktree removes, and `branch -d <reachable…>` by name. Members whose `default_sync.action` is not `even` / `ff_only` are listed **with that action** and their pull is **skipped** — never pulled, rebased, or pushed; their `-d` deletes still run. Ask once. On yes: `issue-flow workspace cleanup --apply --json` (same `--extra-root` hints). Without the CLI, run the listed `git -C <member>` commands yourself. A1 never authorises A2.
+   3. **Phase A2 (second confirm, never implied by A1).** Only when any member's `plan.a2.branch_D` is non-empty. List per member every `<name>  <tip>` with its bucket (`squash_landed` / `merged_pr_divergent`) and merged PR; show `merged_pr_divergent` unique-commit subjects; print the recovery line `git branch <name> <tip>`. **Never** list `unique_work` or `skipped` branches — the CLI never plans them either. Ask once, separately. On yes: `issue-flow workspace cleanup --apply --yes-delete-squash-landed --json`; report every `applied.a2.deleted` entry as `<name> <tip> <flag>` so the SHAs stay in the transcript. The `drive` / `landed` token replaces this prompt with the orchestrator's earlier confirm (same narrowed scope as step 6).
+   4. **Phase B (third confirm, only when enabled per the Input rule).** Run step 9 per member and present **one** confirm grouped by member.
+   5. Steps 7 (folder sweep) and 8 (epic gate offer) run per member. Step 10 reports each member.
+
 5. **Consolidated confirm (Phase A1 — local)** — one yes/no prompt listing every action:
    - `git switch <default>` (home only; skip if already on default)
    - `git pull --ff-only` — if it fails, **stop** A1 steps that assume default is current (apply-changelog, release tag, self-update) and recover via `default-sync` (see below).
@@ -158,13 +165,14 @@ Bash accepts the same `--body-file` / `-F` flags. Use that pattern for every mul
 
    - Phase B is **read-only until that second confirm**. Declining leaves remotes untouched.
 
-10. **Report.** Summarize: default branch, PR/merge status, Phase A1 commands and `-d` deletions, Phase A2 `-D` deletions with their tip SHAs (or "declined" / "none offered"), branches left alone as unique work, folder sweep, epic stage-gate offer, self-update action (`upgraded` / `skipped` / `failed` / "not enabled"), and (when run) Phase B bucket counts, remote deletes, findings issue URL or "skipped". If this run used a workspace token, report each member. Else if `issue-flow agent resolve --json` reports `sibling_roots`, list them and remind the user that **each scaffolded repo needs its own `/iflow-cleanup`** (or `/iflow-cleanup workspace`) — do not loop automatically without the token. If other open PRs still show `DIRTY` / CONFLICTING (often `HISTORY.md`), **offer** `/iflow-pr-sync` — do not auto-run it.
+10. **Report.** Summarize: default branch, PR/merge status, Phase A1 commands and `-d` deletions, Phase A2 `-D` deletions with their tip SHAs (or "declined" / "none offered"), branches left alone as unique work, folder sweep, epic stage-gate offer, self-update action (`upgraded` / `skipped` / `failed` / "not enabled"), and (when run) Phase B bucket counts, remote deletes, findings issue URL or "skipped". In workspace mode, report each member (including refused ones with their reason). Else if `issue-flow agent resolve --json` reports `sibling_roots`, list them and remind the user that **each scaffolded repo needs its own `/iflow-cleanup`** — do not loop automatically unless invoked with `all` (or `workspace`). If other open PRs still show `DIRTY` / CONFLICTING (often `HISTORY.md`), **offer** `/iflow-pr-sync` — do not auto-run it.
 
 ## Constraints
 
 - Never use `git push --force`. Never rebase default, force-push default, or push default to skip CI.
 - `git branch -D` is allowed **only** for `squash_landed` / `merged_pr_divergent` branches, **only** after the Phase A2 confirm (or an orchestrator confirm that explicitly named `-D`, signalled by the `drive` / `landed` token), and **only** with their tip SHAs reported. Never `-D` a branch holding unique work, a branch you could not classify, or the current branch. In Phase A1, a `-d` refusal is reported and left alone — it is never a licence to force-delete.
 - Never delete the default branch (local or remote).
+- `issue-flow workspace cleanup` is classify-only by default. Pass `--apply` only after the workspace A1 yes, and `--apply --yes-delete-squash-landed` only after the workspace A2 yes (or the orchestrator token). Never pass either flag to "just see what happens".
 - Remote deletes and findings-issue creation require the **Phase B** confirm; the Phase A1 and A2 yeses must not imply them (nor each other).
 - If anything is ambiguous (detached HEAD, multiple remotes, missing tracking info), report and stop rather than guess.
 - Do not open or update PRs. Do not bump version fields — pyproject bumps belong to `/iflow-close`. The only version action allowed here is creating a release tag / GitHub release that `/iflow-close` **planned** (tag-derived strategy or publish-on-success label), inside the Phase A consolidated confirm.

.cursor/skills/iflow-close/SKILL.md

@@ -4,7 +4,7 @@ description: >-
   Finish and land the focus issue: tests, optional version bump, status
   update, commit, push, and PR.
 disable-model-invocation: true
-issue-flow-version: 0.5.15
+issue-flow-version: 0.5.17
 ---
 
 # issue-flow — issue close (`/iflow-close`)

.cursor/skills/iflow-comments/SKILL.md

@@ -4,7 +4,7 @@ description: >-
   Triage a GitHub issue's comment thread into the curated, bucketed summary
   section of issue<N>_original.md.
 disable-model-invocation: true
-issue-flow-version: 0.5.15
+issue-flow-version: 0.5.17
 ---
 
 # issue-flow — issue comments triage

.cursor/skills/iflow-cycle/SKILL.md

@@ -5,7 +5,7 @@ description: >-
   through the yolo chain under one up-front confirm. Stops only when input is
   strictly necessary.
 disable-model-invocation: true
-issue-flow-version: 0.5.15
+issue-flow-version: 0.5.17
 ---
 
 # issue-flow — issue cycle (`/iflow-cycle`)

.cursor/skills/iflow-doctor/SKILL.md

@@ -3,7 +3,7 @@ name: iflow-doctor
 description: >-
   Audit .issueflows/ for dirty conditions and optionally apply safe repairs.
 disable-model-invocation: true
-issue-flow-version: 0.5.15
+issue-flow-version: 0.5.17
 ---
 
 # issue-flow — doctor (`.issueflows/` health) (`/iflow-doctor`)

.cursor/skills/iflow-drive/SKILL.md

@@ -6,7 +6,7 @@ description: >-
   review, then local cleanup (-d reachable, -D squash-landed) and
   /iflow-status.
 disable-model-invocation: true
-issue-flow-version: 0.5.15
+issue-flow-version: 0.5.17
 ---
 
 # issue-flow — drive (`/iflow-drive`)

.cursor/skills/iflow-epic/SKILL.md

@@ -4,7 +4,7 @@ description: >-
   Plan a larger change as a staged epic: draft epic<N>_plan.md with stages of
   manageable issue specs, then publish confirmed stages as GitHub issues.
 disable-model-invocation: true
-issue-flow-version: 0.5.15
+issue-flow-version: 0.5.17
 ---
 
 # issue-flow — epic planning (`/iflow-epic`)

.cursor/skills/iflow-fix/SKILL.md

@@ -4,7 +4,7 @@ description: >-
   Interactive session: one long-lived branch + GitHub issue for a stream of
   small iterative fixes, landed together via /iflow-close.
 disable-model-invocation: true
-issue-flow-version: 0.5.15
+issue-flow-version: 0.5.17
 ---
 
 # issue-flow — interactive iterative-fix session (`/iflow-fix`)

.cursor/skills/iflow-graphify/SKILL.md

@@ -4,7 +4,7 @@ description: >-
   Rebuild the graphify knowledge graph (graphify-out/) by shelling out to
   `issue-flow graphify` or `graphify` directly.
 disable-model-invocation: true
-issue-flow-version: 0.5.15
+issue-flow-version: 0.5.17
 ---
 
 # issue-flow — graph rebuild (`/iflow-graphify`)

.cursor/skills/iflow-history-update/SKILL.md

@@ -4,7 +4,7 @@ description: >-
   Update the changelog when landing an issue: append a bullet to
   [Unreleased], or promote it to a release section after a version bump.
 disable-model-invocation: true
-issue-flow-version: 0.5.15
+issue-flow-version: 0.5.17
 ---
 
 # issue-flow — history update

.cursor/skills/iflow-init/SKILL.md

@@ -5,7 +5,7 @@ description: >-
   scaffold is missing; bootstrap a parent folder of git siblings; point at
   update / doctor / iflow-capture when a project scaffold exists.
 disable-model-invocation: true
-issue-flow-version: 0.5.15
+issue-flow-version: 0.5.17
 ---
 
 # issue-flow — harness init (`/iflow-init`)

.cursor/skills/iflow-issue/SKILL.md

@@ -4,7 +4,7 @@ description: >-
   Create one well-specified normal GitHub issue, then optionally branch and
   run /iflow-capture into the standard lifecycle.
 disable-model-invocation: true
-issue-flow-version: 0.5.15
+issue-flow-version: 0.5.17
 ---
 
 # issue-flow — create a normal issue (`/iflow-issue`)

.cursor/skills/iflow-ops/SKILL.md

@@ -4,7 +4,7 @@ description: >-
   Run ops / no-PR work for the focus issue (staging→prod, flag flips, external
   deploys), then finish via /iflow-close ops.
 disable-model-invocation: true
-issue-flow-version: 0.5.15
+issue-flow-version: 0.5.17
 ---
 
 # issue-flow — ops / no-PR (`/iflow-ops`)

.cursor/skills/iflow-pause/SKILL.md

@@ -4,7 +4,7 @@ description: >-
   Park work on the current issue without closing it: update status, move
   the group to 02-partly-solved-issues/, optional WIP commit.
 disable-model-invocation: true
-issue-flow-version: 0.5.15
+issue-flow-version: 0.5.17
 ---
 
 # issue-flow — issue pause (`/iflow-pause`)

.cursor/skills/iflow-pick/SKILL.md

@@ -4,7 +4,7 @@ description: >-
   Front door: choose the next issue, create the issue branch, and run
   /iflow-capture.
 disable-model-invocation: true
-issue-flow-version: 0.5.15
+issue-flow-version: 0.5.17
 ---
 
 # issue-flow — pick next issue (`/iflow-pick`)

.cursor/skills/iflow-plan/SKILL.md

@@ -4,7 +4,7 @@ description: >-
   Draft a structured plan in issue<N>_plan.md and get explicit user
   confirmation before any implementation starts.
 disable-model-invocation: true
-issue-flow-version: 0.5.15
+issue-flow-version: 0.5.17
 ---
 
 # issue-flow — issue plan (`/iflow-plan`)

.cursor/skills/iflow-pr-sync/SKILL.md

@@ -4,7 +4,7 @@ description: >-
   Refresh open PR heads onto the default branch after another merge left them
   DIRTY (usually HISTORY.md). Uses sync-branch keep-both + force-with-lease.
 disable-model-invocation: true
-issue-flow-version: 0.5.15
+issue-flow-version: 0.5.17
 ---
 
 # issue-flow — PR queue sync (`/iflow-pr-sync`)

.cursor/skills/iflow-review/SKILL.md

@@ -3,7 +3,7 @@ name: iflow-review
 description: >-
   Review open GitHub issues and apply labels (extendable kinds; v1: yolo).
 disable-model-invocation: true
-issue-flow-version: 0.5.15
+issue-flow-version: 0.5.17
 ---
 
 # issue-flow — review and label issues (`/iflow-review`)

.cursor/skills/iflow-setup/SKILL.md

@@ -4,7 +4,7 @@ description: >-
   Guide a new user from an empty folder or an unprepared existing project to
   a working issue-flow setup: uv project, git repo, GitHub remote, and scaffold.
 disable-model-invocation: true
-issue-flow-version: 0.5.15
+issue-flow-version: 0.5.17
 ---
 
 # issue-flow — guided project setup (`/iflow-setup`)