carson 3.10.3 → 3.10.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2bbb3e13e1c89593777ce820ddcf6ef96502693aaa1c2d41303e95cc374a46d9
-  data.tar.gz: 402e3a4b6152547e7b328c02686aeea4780a329cc61a187e75ec256de8355244
+  metadata.gz: 29198792c7eb5bb9c02c43fc31d6a2ba04fc1430684e978cc365c2e74b47f810
+  data.tar.gz: b0e164e172315cc707017a9c82e83328fdb1e84a5e4f983aa5aeabc9caae1b04
 SHA512:
-  metadata.gz: d415ae9589a2a65587709a3adf079f112c5489890c68ffe42b295b23527dca980669e8433ec3a531f77628dd07099d7368d5c055817463627e5d9aa8710ec61a
-  data.tar.gz: 45d641154e946ee1f1f37e1d6b3a61971cab37c34433e6fd4ecbc6f44f0691b01268213f1664416061db5cedcf8f306b58698043667613f345005dd3f852050d
+  metadata.gz: 45361da34684eaf4d399f7d40eba060a63f3c364f41ed890ac448f6ffeeb4d886961f451ce393adec495240ffc5bff5bc95399b59d7afd08aaba0eadf0579fde
+  data.tar.gz: b827c09fcf9cef558f237471abd328906ecda337f2bdef04a7991ee2547b2a31437840eb651d04e1ca659c1d55b891e84890cf57b857247240fd3a5ecd81f71c

data/RELEASE.md

@@ -5,6 +5,17 @@ Release-note scope rule:
 - `RELEASE.md` records only version deltas, breaking changes, and migration actions.
 - Operational usage guides live in `MANUAL.md` and `API.md`.
 
+## 3.10.5
+
+### What changed
+
+- **CWD guard for prune** — `carson prune` now proactively detects when the process CWD is inside a worktree and skips that worktree's branch in all prune paths (stale, orphan, absorbed). Previously, prune relied on git's own refusal to delete a branch checked out in a worktree — accidental protection, not principled safety. The new guard matches the same CWD-awareness that `worktree remove` already has.
+- **`cwd_worktree_branch` helper** — new method that finds the branch checked out in the worktree containing the process CWD. Uses longest-path matching because worktree directories live inside the main repo tree (`.claude/worktrees/`).
+
+### Migration
+
+- No breaking changes. New safety guard — previously git-protected operations now fail earlier with clearer diagnostics.
+
 ## 3.10.3
 
 ### What changed

data/VERSION

@@ -1 +1 @@
-3.10.3
+3.10.5

data/lib/carson/runtime/local/prune.rb

@@ -20,16 +20,17 @@ module Carson
 
 				prune_git!( "fetch", config.git_remote, "--prune", json_output: json_output )
 				active_branch = current_branch
+				cwd_branch = cwd_worktree_branch
 				counters = { deleted: 0, skipped: 0 }
 				branches = []
 
 				stale_branches = stale_local_branches
-				prune_stale_branch_entries( stale_branches: stale_branches, active_branch: active_branch, counters: counters, branches: branches )
+				prune_stale_branch_entries( stale_branches: stale_branches, active_branch: active_branch, cwd_branch: cwd_branch, counters: counters, branches: branches )
 
-				orphan_branches = orphan_local_branches( active_branch: active_branch )
+				orphan_branches = orphan_local_branches( active_branch: active_branch, cwd_branch: cwd_branch )
 				prune_orphan_branch_entries( orphan_branches: orphan_branches, counters: counters, branches: branches )
 
-				absorbed_branches = absorbed_local_branches( active_branch: active_branch )
+				absorbed_branches = absorbed_local_branches( active_branch: active_branch, cwd_branch: cwd_branch )
 				prune_absorbed_branch_entries( absorbed_branches: absorbed_branches, counters: counters, branches: branches )
 
 				prune_finish(
@@ -90,27 +91,28 @@ module Carson
 				end
 			end
 
-			def prune_stale_branch_entries( stale_branches:, active_branch:, counters: { deleted: 0, skipped: 0 }, branches: [] )
+			def prune_stale_branch_entries( stale_branches:, active_branch:, cwd_branch: nil, counters: { deleted: 0, skipped: 0 }, branches: [] )
 				stale_branches.each do |entry|
-					result = prune_stale_branch_entry( entry: entry, active_branch: active_branch )
+					result = prune_stale_branch_entry( entry: entry, active_branch: active_branch, cwd_branch: cwd_branch )
 					counters[ result.fetch( :action ) ] += 1
 					branches << result
 				end
 				counters
 			end
 
-			def prune_stale_branch_entry( entry:, active_branch: )
+			def prune_stale_branch_entry( entry:, active_branch:, cwd_branch: nil )
 				branch = entry.fetch( :branch )
 				upstream = entry.fetch( :upstream )
 				return prune_skip_stale_branch( type: :protected, branch: branch, upstream: upstream ) if config.protected_branches.include?( branch )
 				return prune_skip_stale_branch( type: :current, branch: branch, upstream: upstream ) if branch == active_branch
+				return prune_skip_stale_branch( type: :cwd_worktree, branch: branch, upstream: upstream ) if cwd_branch && branch == cwd_branch
 
 				prune_delete_stale_branch( branch: branch, upstream: upstream )
 			end
 
 			def prune_skip_stale_branch( type:, branch:, upstream: )
-				reason = type == :protected ? "protected branch" : "current branch"
-				status = type == :protected ? "skip_protected_branch" : "skip_current_branch"
+				reason = { protected: "protected branch", current: "current branch", cwd_worktree: "checked out in CWD worktree" }.fetch( type, type.to_s )
+				status = { protected: "skip_protected_branch", current: "skip_current_branch", cwd_worktree: "skip_cwd_worktree_branch" }.fetch( type, "skip_#{type}" )
 				puts_verbose "#{status}: #{branch} (upstream=#{upstream})"
 				{ action: :skipped, branch: branch, upstream: upstream, type: "stale", reason: reason }
 			end
@@ -208,7 +210,7 @@ module Carson
 			end
 
 			# Detects local branches with no upstream tracking ref — candidates for orphan pruning.
-			def orphan_local_branches( active_branch: )
+			def orphan_local_branches( active_branch:, cwd_branch: nil )
 				git_capture!( "for-each-ref", "--format=%(refname:short)\t%(upstream:short)", "refs/heads" ).lines.filter_map do |line|
 					branch, upstream = line.strip.split( "\t", 2 )
 					branch = branch.to_s.strip
@@ -217,6 +219,7 @@ module Carson
 					next unless upstream.empty?
 					next if config.protected_branches.include?( branch )
 					next if branch == active_branch
+					next if cwd_branch && branch == cwd_branch
 					next if branch == TEMPLATE_SYNC_BRANCH
 
 					branch
@@ -226,7 +229,7 @@ module Carson
 			# Detects local branches whose upstream still exists but whose content is already on main.
 			# Two-step evidence: (1) find the merge-base, (2) verify every file the branch changed
 			# relative to the merge-base has identical content on main.
-			def absorbed_local_branches( active_branch: )
+			def absorbed_local_branches( active_branch:, cwd_branch: nil )
 				git_capture!( "for-each-ref", "--format=%(refname:short)\t%(upstream:short)\t%(upstream:track)", "refs/heads" ).lines.filter_map do |line|
 					branch, upstream, track = line.strip.split( "\t", 3 )
 					branch = branch.to_s.strip
@@ -237,6 +240,7 @@ module Carson
 					next if track.include?( "gone" )
 					next if config.protected_branches.include?( branch )
 					next if branch == active_branch
+					next if cwd_branch && branch == cwd_branch
 					next if branch == TEMPLATE_SYNC_BRANCH
 
 					next unless branch_absorbed_into_main?( branch: branch )

data/lib/carson/runtime/local/worktree.rb

@@ -1,14 +1,15 @@
 # Safe worktree lifecycle management for coding agents.
-# Three operations: create, done (mark completed), remove (batch cleanup).
-# The deferred deletion model: worktrees persist after use, cleaned up later.
+# Three operations: create, done (mark completed), remove (full cleanup).
+# Remove guards against unpushed commits and CWD-inside-worktree — safe by default.
 # Supports --json for machine-readable structured output with recovery commands.
 module Carson
 	class Runtime
 		module Local
 
 			# Creates a new worktree under .claude/worktrees/<name> with a fresh branch.
+			# Uses main_worktree_root so this works even when called from inside a worktree.
 			def worktree_create!( name:, json_output: false )
-				worktrees_dir = File.join( repo_root, ".claude", "worktrees" )
+				worktrees_dir = File.join( main_worktree_root, ".claude", "worktrees" )
 				wt_path = File.join( worktrees_dir, name )
 
 				if Dir.exist?( wt_path )
@@ -83,35 +84,16 @@ module Carson
 					)
 				end
 
-				# Check for unpushed commits.
-				# If the remote branch does not exist, check whether the branch has unique commits
-				# versus the main branch. If it does, block — the work exists only locally.
-				# If the branch has no unique commits (just created, no work done), allow.
-				# Note: Open3.capture3 returns Process::Status (always truthy), so .success? is required.
+				# Check for unpushed commits using shared guard.
 				branch = worktree_branch( path: resolved_path )
-				if branch
-					remote = config.git_remote
-					remote_ref = "#{remote}/#{branch}"
-					ahead, _, ahead_status, = Open3.capture3( "git", "rev-list", "--count", "#{remote_ref}..#{branch}", chdir: resolved_path )
-					if !ahead_status.success?
-						# Remote ref does not exist. Only block if the branch has unique commits vs main.
-						unique, _, unique_status, = Open3.capture3( "git", "rev-list", "--count", "#{config.main_branch}..#{branch}", chdir: resolved_path )
-						if unique_status.success? && unique.strip.to_i > 0
-							return worktree_finish(
-								result: { command: "worktree done", status: "block", name: name, branch: branch,
-									error: "branch has not been pushed to #{remote}",
-									recovery: "git -C #{resolved_path} push -u #{remote} #{branch}" },
-								exit_code: EXIT_BLOCK, json_output: json_output
-							)
-						end
-					elsif ahead.strip.to_i > 0
-						return worktree_finish(
-							result: { command: "worktree done", status: "block", name: name, branch: branch,
-								error: "worktree has unpushed commits",
-								recovery: "git -C #{resolved_path} push #{remote} #{branch}" },
-							exit_code: EXIT_BLOCK, json_output: json_output
-						)
-					end
+				unpushed = check_unpushed_commits( branch: branch, worktree_path: resolved_path )
+				if unpushed
+					return worktree_finish(
+						result: { command: "worktree done", status: "block", name: name, branch: branch,
+							error: unpushed[ :error ],
+							recovery: unpushed[ :recovery ] },
+						exit_code: EXIT_BLOCK, json_output: json_output
+					)
 				end
 
 				# Clear worktree from session state.
@@ -167,6 +149,21 @@ module Carson
 				branch = worktree_branch( path: resolved_path )
 				puts_verbose "worktree_remove: path=#{resolved_path} branch=#{branch} force=#{force}"
 
+				# Safety: refuse if the branch has unpushed commits (unless --force).
+				# Prevents accidental destruction of work that exists only locally.
+				unless force
+					unpushed = check_unpushed_commits( branch: branch, worktree_path: resolved_path )
+					if unpushed
+						return worktree_finish(
+							result: { command: "worktree remove", status: "block", name: File.basename( resolved_path ),
+								branch: branch,
+								error: unpushed[ :error ],
+								recovery: unpushed[ :recovery ] },
+							exit_code: EXIT_BLOCK, json_output: json_output
+						)
+					end
+				end
+
 				# Step 1: remove the worktree (directory + git registration).
 				rm_args = [ "worktree", "remove" ]
 				rm_args << "--force" if force
@@ -279,6 +276,51 @@ module Carson
 				false
 			end
 
+			# Checks whether a branch has unpushed commits that would be lost on removal.
+			# Returns nil if safe, or { error:, recovery: } hash if unpushed work exists.
+			def check_unpushed_commits( branch:, worktree_path: )
+				return nil unless branch
+
+				remote = config.git_remote
+				remote_ref = "#{remote}/#{branch}"
+				ahead, _, ahead_status, = Open3.capture3( "git", "rev-list", "--count", "#{remote_ref}..#{branch}", chdir: worktree_path )
+				if !ahead_status.success?
+					# Remote ref does not exist. Only block if the branch has unique commits vs main.
+					unique, _, unique_status, = Open3.capture3( "git", "rev-list", "--count", "#{config.main_branch}..#{branch}", chdir: worktree_path )
+					if unique_status.success? && unique.strip.to_i > 0
+						return { error: "branch has not been pushed to #{remote}",
+							recovery: "git -C #{worktree_path} push -u #{remote} #{branch}, or use --force to override" }
+					end
+				elsif ahead.strip.to_i > 0
+					return { error: "worktree has unpushed commits",
+						recovery: "git -C #{worktree_path} push #{remote} #{branch}, or use --force to override" }
+				end
+
+				nil
+			end
+
+			# Returns the branch checked out in the worktree that contains the process CWD,
+			# or nil if CWD is not inside any worktree. Used by prune to proactively
+			# protect the CWD worktree's branch from deletion.
+			# Matches the longest (most specific) path because worktree directories
+			# live under the main repo tree (.claude/worktrees/).
+			def cwd_worktree_branch
+				cwd = realpath_safe( Dir.pwd )
+				best_branch = nil
+				best_length = -1
+				worktree_list.each do |wt|
+					wt_path = wt.fetch( :path )
+					normalised = File.join( wt_path, "" )
+					if ( cwd == wt_path || cwd.start_with?( normalised ) ) && wt_path.length > best_length
+						best_branch = wt.fetch( :branch, nil )
+						best_length = wt_path.length
+					end
+				end
+				best_branch
+			rescue StandardError
+				nil
+			end
+
 			# Returns the main (non-worktree) repository root.
 			# Uses git-common-dir to find the shared .git directory, then takes its parent.
 			# Falls back to repo_root if detection fails.
@@ -293,8 +335,9 @@ module Carson
 			# This prevents worktree directories from appearing as untracked files
 			# in the host repository. Uses the local exclude file (never committed)
 			# so the host repo's .gitignore is never touched.
+			# Uses main_worktree_root — worktrees have .git as a file, not a directory.
 			def ensure_claude_dir_excluded!
-				git_dir = File.join( repo_root, ".git" )
+				git_dir = File.join( main_worktree_root, ".git" )
 				return unless File.directory?( git_dir )
 
 				info_dir = File.join( git_dir, "info" )
@@ -312,12 +355,14 @@ module Carson
 			# Resolves a worktree path: if it's a bare name, look under .claude/worktrees/.
 			# Returns the canonical (realpath) form so comparisons against git worktree list succeed,
 			# even when the OS resolves symlinks differently (e.g. /tmp → /private/tmp on macOS).
+			# Uses main_worktree_root (not repo_root) so resolution works from inside worktrees.
 			def resolve_worktree_path( worktree_path: )
 				if worktree_path.include?( "/" )
 					return realpath_safe( worktree_path )
 				end
 
-				candidate = File.join( repo_root, ".claude", "worktrees", worktree_path )
+				root = main_worktree_root
+				candidate = File.join( root, ".claude", "worktrees", worktree_path )
 				return realpath_safe( candidate ) if Dir.exist?( candidate )
 
 				realpath_safe( worktree_path )

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: carson
 version: !ruby/object:Gem::Version
-  version: 3.10.3
+  version: 3.10.5
 platform: ruby
 authors:
 - Hailei Wang