Route sibling git-worktree auto-allow through the unified containment authority

auto-shell-policy.ts had a second, bespoke containment notion for
uncontained worktree destinations (a scary-basename denylist plus a
"..\" depth counter), separate from path-restriction.ts's isRestricted.
Replace it with isPermittedSiblingWorktreePath, a narrow addition to the
same authority: a not-yet-created path qualifies only if it is a direct
child of the parent directory of cwd or of a registered worktree root.
This is stricter than the old heuristic for nested "container/leaf"
destinations (now ask instead of auto-allow) but still covers the real
need of creating a brand-new sibling worktree with zero registered roots.

Author: TheGreatAxios

src/permission/auto-shell-policy.ts

@@ -3,6 +3,8 @@ import { commandHasRecursiveRm, expandShellSubjects } from "../shell/run-shell-a
 import { commandReferencesSensitivePath } from "../plugins/secret-guard-plugin.js";
 import { commandHasUnboundedDirectoryListing, commandTargetsRestricted } from "./classify.js";
 import { splitChainedCommand, tokenize } from "./command.js";
+import { isPermittedSiblingWorktreePath } from "./path-restriction.js";
+import type { RootsProvider } from "./worktree-roots.js";
 
 // Auto-mode shell policy: a flat table of rules that constrain what a run_shell
 // command may do when auto mode is on. Auto mode otherwise rubber-stamps every
@@ -287,63 +289,35 @@ const WORKTREE_PRUNE_FLAGS = new Set(["-n", "--dry-run", "-v", "--verbose"]);
 // Flags that take a following value on `git worktree add` (branch name, lock reason).
 const WORKTREE_ADD_VALUE_FLAGS = new Set(["-b", "-B", "--reason"]);
 
-// Sibling worktree destinations must never land in home-config / credential
-// stores even when the path is only one level above cwd.
-const SCARY_WORKTREE_BASENAMES = new Set([
-  ".ssh",
-  ".gnupg",
-  ".aws",
-  ".azure",
-  ".kube",
-  ".docker",
-  ".config",
-  ".Trash",
-  "Library",
-  "AppData",
-  ".netrc",
-]);
-
-// Agent-owned hidden dirs that are legitimate worktree parents outside cwd.
-const ALLOWED_OUTSIDE_DOTDIRS = new Set([".worktrees", ".claude", ".git"]);
-
 function isWorktreeForceFlag(arg: string): boolean {
   return arg === "-f" || arg === "--force";
 }
 
 // True when the path is safe for unattended worktree add/remove: inside the
-// session workspace, or a relative sibling under the parent of cwd that does
-// not touch credential/home-config basenames. Globs, ~, absolute outside paths,
-// and `../../…` always fail closed.
+// session workspace (the unified containment authority's normal notion), or a
+// not-yet-registered sibling location the same authority's narrow
+// isPermittedSiblingWorktreePath rule allows (path-restriction.ts). No
+// bespoke denylist or depth counter here — everything routes through that one
+// authority so a path is never judged "contained" under a looser or stricter
+// rule than the one gate.ts uses to decide restriction.
 function isContainedWorktreePath(
   pathArg: string,
   isRestricted: (path: string, isWrite: boolean) => boolean,
+  cwd: string,
+  rootsProvider: RootsProvider,
 ): boolean {
   if (!pathArg) return false;
-  if (/[*?\[]/.test(pathArg)) return false;
+  // Shell-syntax the containment check below cannot resolve correctly:
+  // `resolve()` treats a leading `~` as a literal path segment rather than
+  // expanding it, so a home-relative path would otherwise read as "inside
+  // cwd"; a glob is not a single concrete destination at all.
+  if (/[*?[]/.test(pathArg)) return false;
   if (pathArg.startsWith("~")) return false;
 
   // Workspace (cwd + registered worktree roots) — always contained.
   if (!isRestricted(pathArg, true)) return true;
 
-  // Absolute path outside the workspace (e.g. /tmp/evil) — ask.
-  if (pathArg.startsWith("/") || /^[A-Za-z]:[\\/]/.test(pathArg)) return false;
-
-  // Relative path that resolves outside workspace: allow only sibling trees
-  // (at most one `..` net step) with no scary path components.
-  const parts = pathArg.replace(/\\/g, "/").split("/").filter((p) => p.length > 0 && p !== ".");
-  let depth = 0;
-  for (const part of parts) {
-    if (part === "..") {
-      depth -= 1;
-      if (depth < -1) return false;
-      continue;
-    }
-    if (SCARY_WORKTREE_BASENAMES.has(part)) return false;
-    if (part.startsWith(".") && !ALLOWED_OUTSIDE_DOTDIRS.has(part)) return false;
-    depth += 1;
-  }
-  // Bare `..` (parent of cwd as the worktree path) is not a contained destination.
-  return depth >= 0;
+  return isPermittedSiblingWorktreePath(cwd, pathArg, rootsProvider);
 }
 
 // Walks worktree args, recording force and every positional path. Value-taking
@@ -385,6 +359,8 @@ function worktreePathArgs(
 function safeWorktreeCommand(
   command: string,
   isRestricted: (path: string, isWrite: boolean) => boolean,
+  cwd: string,
+  rootsProvider: RootsProvider,
 ): boolean | undefined {
   const tokens = tokenize(command);
   if (tokens[0] !== "git" || !tokens.slice(1).includes("worktree")) return undefined;
@@ -417,7 +393,7 @@ function safeWorktreeCommand(
     // add/remove require a path; no path → ask rather than guess.
     if (paths.length === 0) return false;
     // First positional is the worktree path; later tokens on add are commit-ish.
-    return isContainedWorktreePath(paths[0]!, isRestricted);
+    return isContainedWorktreePath(paths[0]!, isRestricted, cwd, rootsProvider);
   }
 
   // move / lock / unlock / repair / unknown — still ask until proven safe.
@@ -433,9 +409,13 @@ function preferRule(a: AutoShellRule | undefined, b: AutoShellRule | undefined):
   return a;
 }
 
+const NO_ROOTS: RootsProvider = () => [];
+
 export function autoShellRuleForCall(
   call: ToolCall,
   isRestricted: (path: string, isWrite: boolean) => boolean = () => false,
+  cwd: string = process.cwd(),
+  rootsProvider: RootsProvider = NO_ROOTS,
 ): AutoShellRule | undefined {
   if (call.name !== "run_shell") return undefined;
   const command = call.arguments.command;
@@ -479,12 +459,12 @@ export function autoShellRuleForCall(
   // destinations are often intentional siblings (`../corbits-dispatch-wts/…`)
   // and are judged by the worktree path policy below instead.
   for (const subject of subjects) {
-    if (safeWorktreeCommand(subject, isRestricted) === true) continue;
+    if (safeWorktreeCommand(subject, isRestricted, cwd, rootsProvider) === true) continue;
     if (commandTargetsRestricted(subject, isRestricted)) return OUTSIDE_WORKSPACE_ASK_RULE;
   }
 
   for (const subject of subjects) {
-    if (safeWorktreeCommand(subject, isRestricted) === false) return WORKTREE_ASK_RULE;
+    if (safeWorktreeCommand(subject, isRestricted, cwd, rootsProvider) === false) return WORKTREE_ASK_RULE;
   }
 
   if (matched !== undefined) return matched;

src/permission/gate.ts

@@ -356,7 +356,7 @@ export function createPermissionGate(options: PermissionGateOptions): Permission
         // operator prompt. Everything else auto-allows. Path-keyed secret
         // reads stay hard-denied by secret-guard; shell that only *mentions*
         // a secret path is ask so an explicit one-time approval can pass it.
-        const shellRule = autoShellRuleForCall(call, isRestrictedHere);
+        const shellRule = autoShellRuleForCall(call, isRestrictedHere, effectiveCwd, rootsProvider);
         if (shellRule?.effect === "deny") return { allowed: false, reason: shellRule.reason };
         if (shellRule === undefined) return { allowed: true };
       } else if (!restricted && AUTO_ALLOWED_TOOLS.has(call.name)) {

src/permission/path-restriction.ts

@@ -86,6 +86,40 @@ export function resolveWorkspacePath(
   return undefined;
 }
 
+// Whether `path` (relative to `cwd`) names a not-yet-created sibling worktree
+// location: a direct child of the parent directory of `cwd` or of a currently
+// registered root — the "one new dir next to something already trusted" shape
+// `git worktree add ../name` uses. This is the single containment authority's
+// answer to "can auto mode create a brand-new worktree that isn't a registered
+// root yet"; there is deliberately no separate basename denylist or `..` depth
+// counter — the parent-directory equality check *is* the depth bound (a path
+// with any extra segment resolves to a different, non-matching parent), and
+// the home-directory guard below is the one home-config bag it purpose-built
+// against ($HOME's own children — .ssh, .aws, .config, … must never qualify).
+export function isPermittedSiblingWorktreePath(
+  cwd: string,
+  path: string,
+  rootsProvider: RootsProvider = () => [],
+  home: string = homedir(),
+): boolean {
+  if (path.length === 0) return false;
+  if (/[*?[]/.test(path)) return false;
+  if (path.startsWith("~")) return false;
+  if (path.startsWith("/") || /^[A-Za-z]:[\\/]/.test(path)) return false;
+
+  const abs = resolve(cwd, path);
+  const realParent = realpathOr(dirname(abs));
+  const realHome = realpathOr(resolve(home));
+  if (realParent === realHome) return false;
+
+  const knownRoots = [...rootsProvider(), ...rootsProvider(true)];
+  const trustedParents = new Set<string>([
+    realpathOr(resolve(cwd, "..")),
+    ...knownRoots.map((root) => realpathOr(dirname(root))),
+  ]);
+  return trustedParents.has(realParent);
+}
+
 function underRoot(abs: string, root: string): boolean {
   // realpathNearestOr on both sides so a not-yet-created state root still
   // compares equal to paths under it (realpathOr alone leaves the root

src/permission/permission.test.ts

@@ -1104,8 +1104,10 @@ describe("createPermissionGate", () => {
     for (const command of [
       "git worktree add feature",
       "git worktree add feature main",
-      "git worktree add -b feature-branch ../corbits-dispatch-wts/CL-5602 origin/main",
-      "git worktree add ../.worktrees/CL-5602",
+      // Sibling worktree directly under the parent of cwd — the narrow
+      // isPermittedSiblingWorktreePath shape (path-restriction.ts): a brand
+      // new, not-yet-registered root one level up from cwd.
+      "git worktree add -b feature-branch ../CL-5602 origin/main",
       "git worktree remove feature",
       "git worktree prune",
       "git worktree prune -n -v",
@@ -1117,6 +1119,36 @@ describe("createPermissionGate", () => {
     }
   });
 
+  test("auto mode auto-allows a relative sibling worktree next to a registered root, zero cwd-sibling roots needed", async () => {
+    // Reproduces the product need: creating a brand-new sibling worktree that
+    // by definition isn't a registered root yet. Here the registered root
+    // lives in its own parent directory (an org-style "…/wts/<repo>" layout)
+    // distinct from cwd's own parent, and cwd reaches the new sibling through
+    // a relative "../../wts/CL-5602" path — still the narrow one-level-up
+    // sibling shape, just anchored at a different trusted parent than cwd's.
+    let asked = 0;
+    const base = mkdtempSync(join(tmpdir(), "corbits-worktree-org-"));
+    const cwd = join(base, "main-repo");
+    mkdirSync(cwd);
+    const wtsDir = join(base, "wts");
+    mkdirSync(wtsDir);
+    const otherRoot = join(wtsDir, "existing-wt");
+    mkdirSync(otherRoot);
+    const gate = createPermissionGate({
+      approvals: [],
+      requestApproval: async () => { asked++; return { allow: false }; },
+      interactive: true,
+      skipPermissions: false,
+      auto: true,
+      cwd,
+      rootsProvider: () => [realpathSync(otherRoot)],
+    });
+
+    const verdict = await gate.evaluate(shellCall("git worktree add ../wts/CL-5602-new"));
+    expect(verdict.allowed).toBe(true);
+    expect(asked).toBe(0);
+  });
+
   test("auto mode prompts for unsafe git worktree operations", async () => {
     const cwd = mkdtempSync(join(tmpdir(), "corbits-worktree-policy-"));
     const outsideAbs = join(tmpdir(), "outside-worktree-absolute");
@@ -1130,6 +1162,13 @@ describe("createPermissionGate", () => {
       "git worktree add -f feature",
       "git worktree add ../.ssh/x",
       "git worktree add ../../escape",
+      // Nested siblings ("container/leaf") no longer auto-allow: the old
+      // basename-denylist-plus-depth-counter heuristic let these through with
+      // zero registered roots, but they don't fit the unified, narrow
+      // isPermittedSiblingWorktreePath shape (a direct child of the parent of
+      // cwd or of a registered root) — see path-restriction.ts.
+      "git worktree add -b feature-branch ../corbits-dispatch-wts/CL-5602 origin/main",
+      "git worktree add ../.worktrees/CL-5602",
       "git worktree remove --force feature",
       "git worktree move feature other",
       "git --no-pager worktree remove feature",