Auto-allow contained git worktree ops in auto mode

Dispatch and issue workflows need unattended worktree add/remove/prune
for sibling paths. Force flags, absolute outside paths, globs, home
expansion, and credential basenames still require operator approval.

Author: TheGreatAxios

docs/ARCHITECTURE.md

@@ -94,7 +94,7 @@ In TUI chat mode there is no completion gate — the session stays open across t
 
 Two directors, selected by role:
 
-- **ChatDirector** (interactive, `src/agent/director.ts`) — Extends `DefaultDirector` with task list tracking, workflow nudges, LSP auto-activation, multi-turn chat semantics, and an optional **goal governor** (session-scoped auto-continue until every acceptance criterion is done). It never terminates the session: operator declines are surfaced as replies and the reactor stays alive for the next message. Auto mode is toggled by CLI flags (`--auto` / `--no-auto`); there is currently no in-session key to toggle it (default on; constrained envelope — workspace writes and unconstrained shell auto-allow; installs, recursive rm, worktree changes, sensitive-path and opaque-wrapper shell still ask; shell file-mutation denied). It is not a separate edit/plan mode.
+- **ChatDirector** (interactive, `src/agent/director.ts`) — Extends `DefaultDirector` with task list tracking, workflow nudges, LSP auto-activation, multi-turn chat semantics, and an optional **goal governor** (session-scoped auto-continue until every acceptance criterion is done). It never terminates the session: operator declines are surfaced as replies and the reactor stays alive for the next message. Auto mode is toggled by CLI flags (`--auto` / `--no-auto`); there is currently no in-session key to toggle it (default on; constrained envelope — workspace writes and unconstrained shell auto-allow; installs, recursive rm, force/uncontained worktree changes, sensitive-path and opaque-wrapper shell still ask; contained non-force `git worktree add`/`remove`/`prune` and `list` auto-allow; shell file-mutation denied). It is not a separate edit/plan mode.
 - **SubAgentDirector** (delegated work, `src/subagent/index.ts`) — Drives a dispatched worker until a turn arrives with no tool calls, then replies with the final assistant text and ends the run. A tool-less completion with **zero tool calls in the entire run** is returned as a **never-acted** salvage report (not a successful implement); explore/read-only workers that used tools then replied with findings remain normal completes. Hard stops also fire after 2 consecutive identical tool-call fingerprints (**no-progress**), on progressive re-read pressure (**thrash** — the same path re-read past a limit amid enough tool volume, tracked by `src/subagent/thrash.ts`), or after the leaf turn budget (**turn-budget**, default 30, overridable via `task(maxTurns)`, agent profile `maxTurns`, or `settings.subagentMaxTurns`, capped at 100), each returning a structured salvage report (reason, partial findings, blockers) so a thrashing child cannot burn tokens indefinitely. A fourth hard stop, **repetition**, is detected outside the director entirely: `runSubAgent`'s stream sink watches the streamed text of the in-flight cycle for degenerate token loops (`src/subagent/repetition.ts`) — whitespace-collapsed raw text, a smallest-period KMP check over the probe tail, default window >= 16 chars repeated >= 8 times, evaluated every 256 streamed chars — and on a hit aborts the run controller mid-cycle, returning a `repetition` salvage report that leads with the looped window and warns the parent against re-dispatching the identical brief. Because directors only see completed turns, this is the only stop that can catch a loop inside a single turn that never finishes. A one-shot **report-forced** signal fires a few turns before the cap while the leaf is still tooling — it is not a stop: the director injects a wrap-up nudge and lets the leaf finish on its own, so turn-budget stays reachable for a leaf still making progress. Operator/parent cancel after any progress likewise returns a **cancelled** salvage report (partial findings + tool activity) instead of a bare cancel string; cancel before progress still surfaces as cancelled-by-operator. Optional `task(tier=)` (`fast` | `standard` | `clever`) overrides profile inference, profile tier, and the parent provider for that spawn only, and fails closed when the tier is unconfigured. The parent `task` tool keeps a session-scoped brief-dispatch ledger (`src/subagent/brief-dispatch.ts`): fingerprints cover prompt + agent + intent + success_criteria + do_not (not maxTurns/description/tier). After thrash / no-progress / repetition / never-acted salvage, an identical re-dispatch is hard-blocked for the rest of the parent chat; change at least one fingerprint field to force a re-run. Turn-budget salvage still invites a higher maxTurns for a few same-brief retries without a successful complete, then flips the parent hint to stop and change approach (soft — further identical dispatches are still admitted). A successful complete resets the same-brief retry budget.
 
 
@@ -262,7 +262,7 @@ tool call
 
 - **classify** — Read-only tools (`read_file`, `search_files`, `grep`, `list_dir`) are tier `allow`; everything else is tier `ask`. Builds approval requests: shell yields one request for the full command the model asked to run (security still splits under the gate); file tools keyed on the target path; other tools keyed on tool name.
 - **command** — Splits chained commands for security classification and derives command-shape approval scopes. Multi-segment chains only offer an exact-command persist pattern (a prefix like `npm *` must not cover `npm i && rm -rf /` later).
-- **auto-shell-policy** — Constrains `run_shell` even when auto mode would otherwise rubber-stamp it. Before matching, `expandShellSubjects` peels `bash`/`sh`/`zsh -c`, `xargs` utility tails, and transparent prefixes (`env`, `nice`, `timeout`, …) so rules see the real payload; an unparseable wrapper (variable expansion or command substitution) sets an opaque flag that forces `ask`. Effects: `deny` blocks outright (file mutations through ad-hoc tooling — output redirection, `tee`, `sed -i`/`perl -i`, interpreter inline programs or heredocs — which must instead go through `write_file`/`edit_file`); `ask` declines to auto-allow and falls through to the operator prompt (recursive `rm`, dependency installs and remote runners: npm/yarn/pnpm/bun, pip, cargo, go, brew, npx/bunx, …, git worktree add/remove/prune, shell that references a sensitive path such as `.env` or a private key, and opaque wrappers). Deny beats ask when multiple subjects match. Quoted spans are stripped before pattern matching so a quoted `>` or install word in an argument is not flagged, and program names are matched only in command position. Adding a table category is a one-line rule append in `AUTO_SHELL_RULES`.
+- **auto-shell-policy** — Constrains `run_shell` even when auto mode would otherwise rubber-stamp it. Before matching, `expandShellSubjects` peels `bash`/`sh`/`zsh -c`, `xargs` utility tails, and transparent prefixes (`env`, `nice`, `timeout`, …) so rules see the real payload; an unparseable wrapper (variable expansion or command substitution) sets an opaque flag that forces `ask`. Effects: `deny` blocks outright (file mutations through ad-hoc tooling — output redirection, `tee`, `sed -i`/`perl -i`, interpreter inline programs or heredocs — which must instead go through `write_file`/`edit_file`); `ask` declines to auto-allow and falls through to the operator prompt (recursive `rm`, dependency installs and remote runners: npm/yarn/pnpm/bun, pip, cargo, go, brew, npx/bunx, …, force or uncontained `git worktree` ops, shell that references a sensitive path such as `.env` or a private key, and opaque wrappers). Contained non-force `git worktree add`/`remove`/`prune` and read-only `list` auto-allow (sibling destinations like `../corbits-dispatch-wts/…` included; absolute outside, `~`, globs, and credential basenames still ask). Deny beats ask when multiple subjects match. Quoted spans are stripped before pattern matching so a quoted `>` or install word in an argument is not flagged, and program names are matched only in command position. Adding a table category is a one-line rule append in `AUTO_SHELL_RULES`.
 - **gate** — Evaluates a call: `skipPermissions` allows everything; `allow`-tier passes; for `ask`-tier, checks persisted approvals, otherwise requests operator approval. Shell security classifies each chain segment (`||` / `&&` / `|` / `;` / newlines), but the operator is prompted once for the full command block — any unapproved segment fails the whole block, and execution always runs the unsplit original. Safe pipeline tails and pure shell no-ops (`true` / `false` / `:` and bare control-flow keywords stranded by chain-splitting) skip without a prompt. In a non-interactive run an unresolved `ask` becomes a denial. In auto mode: non-shell built-ins in `AUTO_ALLOWED_TOOLS` (writes/edits/deletes, `manage_tasks`, `task`, …) auto-allow when not path-restricted; for `run_shell` the gate consults the auto-shell policy — a `deny` rule fails the call, an `ask` rule skips the auto-allow shortcut and proceeds to the normal approval flow, and anything unmatched is auto-allowed. Paths outside the workspace and writes under the session state root (`~/.corbits/projects/...` and legacy `.agent-state`) still ask. Mutating MCP and unknown built-ins are not blanket-allowed. Newly granted scopes are appended in memory and persisted.
 
 - **matcher** — Approval pattern matching via `@intx/authz` `matchPattern` (`*` wildcards). Exact-command grants store a backslash before each metacharacter; those patterns match by equality after unescape (the package has no escape syntax).

src/permission/auto-shell-policy.ts

@@ -232,7 +232,7 @@ const WORKTREE_ASK_RULE: AutoShellRule = {
   name: "git-worktree",
   effect: "ask",
   reason:
-    "Git worktree add, remove, and prune change the workspace boundary and need explicit operator approval in auto mode. Only read-only git worktree list can run unattended.",
+    "This git worktree command uses a force flag, an uncontained path, or a subcommand that still needs explicit operator approval in auto mode. Contained non-force add/remove/prune and read-only list can run unattended.",
   patterns: [],
 };
 
@@ -283,8 +283,109 @@ const UNBOUNDED_LISTING_ASK_RULE: AutoShellRule = {
 };
 
 const WORKTREE_LIST_FLAGS = new Set(["--porcelain", "-v", "--verbose", "-z"]);
+const WORKTREE_PRUNE_FLAGS = new Set(["-n", "--dry-run", "-v", "--verbose"]);
+// Flags that take a following value on `git worktree add` (branch name, lock reason).
+const WORKTREE_ADD_VALUE_FLAGS = new Set(["-b", "-B", "--reason"]);
+
+// Sibling worktree destinations must never land in home-config / credential
+// stores even when the path is only one level above cwd.
+const SCARY_WORKTREE_BASENAMES = new Set([
+  ".ssh",
+  ".gnupg",
+  ".aws",
+  ".azure",
+  ".kube",
+  ".docker",
+  ".config",
+  ".Trash",
+  "Library",
+  "AppData",
+  ".netrc",
+]);
+
+// Agent-owned hidden dirs that are legitimate worktree parents outside cwd.
+const ALLOWED_OUTSIDE_DOTDIRS = new Set([".worktrees", ".claude", ".git"]);
+
+function isWorktreeForceFlag(arg: string): boolean {
+  return arg === "-f" || arg === "--force";
+}
+
+// True when the path is safe for unattended worktree add/remove: inside the
+// session workspace, or a relative sibling under the parent of cwd that does
+// not touch credential/home-config basenames. Globs, ~, absolute outside paths,
+// and `../../…` always fail closed.
+function isContainedWorktreePath(
+  pathArg: string,
+  isRestricted: (path: string, isWrite: boolean) => boolean,
+): boolean {
+  if (!pathArg) return false;
+  if (/[*?\[]/.test(pathArg)) return false;
+  if (pathArg.startsWith("~")) return false;
+
+  // Workspace (cwd + registered worktree roots) — always contained.
+  if (!isRestricted(pathArg, true)) return true;
+
+  // Absolute path outside the workspace (e.g. /tmp/evil) — ask.
+  if (pathArg.startsWith("/") || /^[A-Za-z]:[\\/]/.test(pathArg)) return false;
+
+  // Relative path that resolves outside workspace: allow only sibling trees
+  // (at most one `..` net step) with no scary path components.
+  const parts = pathArg.replace(/\\/g, "/").split("/").filter((p) => p.length > 0 && p !== ".");
+  let depth = 0;
+  for (const part of parts) {
+    if (part === "..") {
+      depth -= 1;
+      if (depth < -1) return false;
+      continue;
+    }
+    if (SCARY_WORKTREE_BASENAMES.has(part)) return false;
+    if (part.startsWith(".") && !ALLOWED_OUTSIDE_DOTDIRS.has(part)) return false;
+    depth += 1;
+  }
+  // Bare `..` (parent of cwd as the worktree path) is not a contained destination.
+  return depth >= 0;
+}
+
+// Walks worktree args, recording force and every positional path. Value-taking
+// flags consume the next token so branch names are not mistaken for paths.
+function worktreePathArgs(
+  args: string[],
+  valueFlags: Set<string>,
+): { force: boolean; paths: string[] } {
+  const paths: string[] = [];
+  let force = false;
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i]!;
+    if (arg === "--") {
+      paths.push(...args.slice(i + 1));
+      break;
+    }
+    if (isWorktreeForceFlag(arg)) {
+      force = true;
+      continue;
+    }
+    if (arg.startsWith("-") && arg !== "-") {
+      // `--flag=value` carries its value inline; no following token to skip.
+      if (arg.includes("=")) continue;
+      if (valueFlags.has(arg)) {
+        i += 1;
+        continue;
+      }
+      continue;
+    }
+    paths.push(arg);
+  }
+  return { force, paths };
+}
 
-function safeWorktreeCommand(command: string): boolean | undefined {
+// `true` = auto-allow, `false` = ask, `undefined` = not a worktree command.
+// Contained non-force add/remove and ordinary prune/list auto-allow so dispatch
+// can create sibling worktrees without a human click; force flags, uncontained
+// paths, and uncommon subcommands still ask.
+function safeWorktreeCommand(
+  command: string,
+  isRestricted: (path: string, isWrite: boolean) => boolean,
+): boolean | undefined {
   const tokens = tokenize(command);
   if (tokens[0] !== "git" || !tokens.slice(1).includes("worktree")) return undefined;
   // Worktree policy applies only to one plain command with no git cwd override;
@@ -294,7 +395,32 @@ function safeWorktreeCommand(command: string): boolean | undefined {
   const args = tokens.slice(3);
 
   if (subcommand === "list") return args.every((arg) => WORKTREE_LIST_FLAGS.has(arg));
-  // Boundary-changing subcommands always route to ask, even when the destination is inside cwd.
+
+  if (subcommand === "prune") {
+    for (let i = 0; i < args.length; i++) {
+      const arg = args[i]!;
+      if (WORKTREE_PRUNE_FLAGS.has(arg)) continue;
+      if (arg.startsWith("--expire=")) continue;
+      if (arg === "--expire") {
+        i += 1;
+        continue;
+      }
+      return false;
+    }
+    return true;
+  }
+
+  if (subcommand === "add" || subcommand === "remove") {
+    const valueFlags = subcommand === "add" ? WORKTREE_ADD_VALUE_FLAGS : new Set<string>();
+    const { force, paths } = worktreePathArgs(args, valueFlags);
+    if (force) return false;
+    // add/remove require a path; no path → ask rather than guess.
+    if (paths.length === 0) return false;
+    // First positional is the worktree path; later tokens on add are commit-ish.
+    return isContainedWorktreePath(paths[0]!, isRestricted);
+  }
+
+  // move / lock / unlock / repair / unknown — still ask until proven safe.
   return false;
 }
 
@@ -349,14 +475,16 @@ export function autoShellRuleForCall(
 
   // Containment: a command whose path arguments resolve outside the workspace
   // (including through a symlink) must ask rather than auto-run, the same way
-  // path-arg tool calls already do. Checked per expanded subject so a wrapped
-  // payload (bash -c, xargs, env -S) is judged on its real target, not the wrapper.
+  // path-arg tool calls already do. Contained worktree ops are exempt — their
+  // destinations are often intentional siblings (`../corbits-dispatch-wts/…`)
+  // and are judged by the worktree path policy below instead.
   for (const subject of subjects) {
+    if (safeWorktreeCommand(subject, isRestricted) === true) continue;
     if (commandTargetsRestricted(subject, isRestricted)) return OUTSIDE_WORKSPACE_ASK_RULE;
   }
 
   for (const subject of subjects) {
-    if (safeWorktreeCommand(subject) === false) return WORKTREE_ASK_RULE;
+    if (safeWorktreeCommand(subject, isRestricted) === false) return WORKTREE_ASK_RULE;
   }
 
   if (matched !== undefined) return matched;