recomposing-commits — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited recomposing-commits (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Analyze messy commits → isolate in a worktree → let user review → apply back.
Core principle: The original branch is NEVER modified until the user explicitly approves the new history. Worktree isolation and the review gate are non-negotiable — even if the user says "just do it" or "I trust you, skip review."
Announce at start: "I'm using the recomposing-commits skill to reorganize your branch history."
git rev-parse --abbrev-ref HEADRefuse immediately if the current branch is any of: main, master, dev, develop, development, staging, production, release, or matches release/* or hotfix/*.
⛔ Recomposing commits on '<branch>' is not allowed.
This skill only works on feature branches.
Please switch to your feature branch first.Do NOT create a workaround branch. Do NOT proceed. Refuse and stop.
Do NOT use when:
git log --onelineDisplay the output to the user.
Which commit should be the start of the recompose?
Provide the SHA of the first commit you want to reorganize.
(All commits from that SHA through HEAD will be recomposed.)
Enter SHA:Compute the base: BASE=$(git rev-parse <user-sha>^)
git log --oneline $BASE..HEAD
git diff $BASE HEADRead all diffs. Identify logical groups. Flag any files that appear in multiple logical groups (overlapping files — see Step 6).
Always use an absolute path. Relative paths like .git/recompose/feat/HISBA-mastra-ai silently break when branch names contain slashes AND when shell state doesn't persist between tool calls.
BRANCH_NAME=$(git rev-parse --abbrev-ref HEAD)
REPO_ROOT=$(git rev-parse --show-toplevel)
WORKTREE_PATH="$REPO_ROOT/.git/recompose/$BRANCH_NAME"
WORKTREE_BRANCH="recompose/$BRANCH_NAME"
git worktree add "$WORKTREE_PATH" -b "$WORKTREE_BRANCH"All subsequent git operations happen inside `$WORKTREE_PATH`. The original branch is untouched.
Use git -C with the absolute path — do NOT rely on `cd`. Each Bash tool invocation starts with a fresh shell; cd from a previous call does not carry over.
git -C "$WORKTREE_PATH" reset --mixed $BASEAll changes are now unstaged in the worktree, ready to be re-staged logically.
Use git -C "$WORKTREE_PATH" for every command. Never assume the shell is cd'd into the worktree.
For files that belong cleanly to ONE logical commit:
git -C "$WORKTREE_PATH" add <file> <file2>
git -C "$WORKTREE_PATH" commit --no-verify -m "type: description"For overlapping files (same file spans multiple logical commits):
# git add -p requires a TTY — run it inside a single shell block
cd "$WORKTREE_PATH" && git add -p <file> # stage hunk by hunk: y/n/s/e
git -C "$WORKTREE_PATH" commit --no-verify -m "type: first concern"
cd "$WORKTREE_PATH" && git add -p <file>
git -C "$WORKTREE_PATH" commit --no-verify -m "type: second concern"NEVER use `git add -i` or `git rebase -i` — these require interactive TTY input and will hang or fail in this context.
After all commits are created in the worktree, always present this to the user:
Recomposition complete in isolated worktree.
To review:
cd .git/recompose/<branch-name>
git log --oneline
Original branch is UNCHANGED. Nothing will be applied until you approve.
Does the new history look good?
[yes] → Apply to original branch
[no/edit] → Describe what to change, I'll update the worktree
[cancel] → Discard worktree, original branch stays as-isWait for explicit user response. Do not proceed to Step 8 without it.
If the user previously said "no review, just do it": You must still present this review gate. Explain: "The review step is part of this skill's safety guarantee. I've isolated the changes — reviewing takes 30 seconds and means the original branch is safe. Here's what the new history looks like:"
[yes] — Apply back:
Check for remote upstream first:
git -C "$REPO_ROOT" remote -v
git -C "$REPO_ROOT" branch -vvIf branch tracks a remote:
⚠️ This branch has a remote upstream. Applying recomposed commits will
require a force-push. Do you want to proceed?Wait for confirmation, then:
# DO NOT run `git checkout $BRANCH_NAME` — you are already on it in the main worktree.
# git checkout will fail with "already used by worktree". Skip it entirely.
# Use git -C with the absolute REPO_ROOT to ensure you're resetting the right branch.
git -C "$REPO_ROOT" reset --hard "recompose/$BRANCH_NAME"
# Verify it worked
git -C "$REPO_ROOT" log --oneline -5
# Clean up — worktree FIRST, then branch
git -C "$REPO_ROOT" worktree remove "$WORKTREE_PATH"
git -C "$REPO_ROOT" branch -D "recompose/$BRANCH_NAME"[no/edit] — Iterate: Return to the worktree, adjust commits as described, re-present the review gate.
[cancel] — Discard:
git worktree remove "$WORKTREE_PATH"
git branch -D "recompose/$BRANCH_NAME"Original branch is untouched.
| Situation | Command |
|---|---|
| File changes belong to different sections | git add -p <file> → y/n per hunk |
| Hunk mixes two concerns | s to split, then y/n |
| Concerns are truly interleaved lines | e to edit the hunk diff manually |
| File belongs entirely to one commit | git add <file> (no -p needed) |
# 1. Confirm new clean history
git -C "$WORKTREE_PATH" log --oneline $BASE..HEAD
# 2. Full content diff — stats alone are NOT enough
# Stats can match while content differs. Always do a byte-for-byte comparison.
diff \
<(git -C "$REPO_ROOT" diff $BASE HEAD) \
<(git -C "$WORKTREE_PATH" diff $BASE HEAD) \
&& echo "IDENTICAL — diffs match exactly" || echo "DIFFERENCES FOUND — investigate before proceeding"Stats are not sufficient. 66 files changed, 8393 insertions matching does not prove content matches — only a full diff comparison does. Always use the diff <(...) <(...) form and confirm "IDENTICAL" before presenting the review gate.
| Step | Action |
|---|---|
| 1 | git rev-parse --abbrev-ref HEAD — safety check |
| 2 | git log --oneline → ask for start SHA |
| 3 | git diff $BASE HEAD — analyze |
| 4 | git worktree add — isolate |
| 5 | git reset --mixed $BASE — collapse |
| 6 | Stage + commit per logical group |
| 7 | Present review gate — mandatory |
| 8 | Apply back + cleanup |
| Excuse | Reality |
|---|---|
| "git rebase -i is the standard tool for this" | git rebase -i requires interactive TTY — it HANGS in this context. Use git reset --mixed + selective staging. |
| "User said no review, I'll respect their preference" | The review gate is non-negotiable. It costs 30 seconds and protects the original branch. Present it anyway. |
| "I'll just modify the original branch directly, it's faster" | Non-negotiable: all commits happen in the worktree only. Original branch is untouched until approval. |
| "The cleanup branch workaround achieves the same result" | No workarounds for the protected branch check. If on main/master/dev, refuse and stop. |
| "git add -i is similar to git add -p" | git add -i requires interactive TTY. Use git add -p only. |
| "The worktree cleanup can happen after the user reviews" | Clean up as part of Step 8 — leaving worktrees around pollutes the repo. |
| "I can use a relative WORKTREE_PATH, the path is obvious" | Relative paths break when branch names contain slashes. Always use REPO_ROOT=$(git rev-parse --show-toplevel) and an absolute path. |
"I'll cd into the worktree and run git commands there" | Shell state does NOT persist between Bash tool invocations. Use git -C "$WORKTREE_PATH" for every command. |
"I need to git checkout $BRANCH_NAME before the reset" | That checkout FAILS — the branch is already in use by the main worktree. Skip it. Just run git -C "$REPO_ROOT" reset --hard directly. |
| "The diff stats match, so the content is identical" | Stats (66 files, 8393 insertions) can match while content differs. Always verify with diff <(git diff ...) <(git -C worktree diff ...). |
If you find yourself thinking any of these, stop and follow the skill:
git rebase -i"git add <file> for the overlapping file since it's cleaner"cd into the worktree, it's simpler than git -C"~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.