@jonit-dev/night-watch-cli 1.7.76 → 1.7.77

package/dist/cli.js

@@ -5399,9 +5399,9 @@ function scanExistingPrdSlugs(prdDir) {
   }
   return slugs;
 }
-function buildProviderArgs(provider, prompt2) {
+function buildProviderArgs(provider, prompt2, workingDir) {
   if (provider === "codex") {
-    return ["exec", "--yolo", prompt2];
+    return ["exec", "-C", workingDir, "--yolo", prompt2];
   }
   return ["-p", prompt2, "--dangerously-skip-permissions"];
 }
@@ -5425,7 +5425,7 @@ async function sliceRoadmapItem(projectDir, prdDir, item, config) {
   const promptVars = createSlicerPromptVars(item.title, item.section, item.description, prdDir, filename);
   const prompt2 = renderSlicerPrompt(promptVars);
   const provider = resolveJobProvider(config, "slicer");
-  const providerArgs = buildProviderArgs(provider, prompt2);
+  const providerArgs = buildProviderArgs(provider, prompt2, projectDir);
   const logDir = path14.join(projectDir, "logs");
   if (!fs15.existsSync(logDir)) {
     fs15.mkdirSync(logDir, { recursive: true });

package/dist/scripts/night-watch-audit-cron.sh

@@ -135,6 +135,16 @@ Failed to create audit worktree."
   exit 1
 fi
 
+if ! assert_isolated_worktree "${PROJECT_DIR}" "${AUDIT_WORKTREE_DIR}" "audit"; then
+  log "FAIL: Audit worktree guard rejected ${AUDIT_WORKTREE_DIR}"
+  send_telegram_status_message "🔎 Night Watch Auditor: failed" "Project: ${PROJECT_NAME}
+Provider (model): ${PROVIDER_MODEL_DISPLAY}
+Failure reason: worktree_guard_failed
+Audit run refused to execute in the primary checkout."
+  emit_result "failure" "reason=worktree_guard_failed"
+  exit 1
+fi
+
 # Ensure the logs dir exists inside the worktree so the provider can write the report
 mkdir -p "${AUDIT_WORKTREE_DIR}/logs"
 
@@ -167,6 +177,7 @@ for AUDIT_ATTEMPT in $(seq 1 "${AUDIT_MAX_RETRIES}"); do
       if (
         cd "${AUDIT_WORKTREE_DIR}" && timeout "${MAX_RUNTIME}" \
           codex exec \
+            -C "${AUDIT_WORKTREE_DIR}" \
             --yolo \
             "${AUDIT_PROMPT}" \
             >> "${LOG_FILE}" 2>&1

package/dist/scripts/night-watch-cron.sh

@@ -333,6 +333,10 @@ finalize_prd_done() {
   # NOTE: PRDs are moved to done/ immediately when a PR is opened (or already merged)
   # rather than waiting for reviewer/merge loops.
   if prepare_detached_worktree "${PROJECT_DIR}" "${BOOKKEEP_WORKTREE_DIR}" "${DEFAULT_BRANCH}" "${LOG_FILE}"; then
+    if ! assert_isolated_worktree "${PROJECT_DIR}" "${BOOKKEEP_WORKTREE_DIR}" "executor-bookkeeping"; then
+      log "WARN: Bookkeeping worktree guard rejected ${BOOKKEEP_WORKTREE_DIR}"
+      return 1
+    fi
     if mark_prd_done "${BOOKKEEP_PRD_DIR}" "${ELIGIBLE_PRD}"; then
       night_watch_history record "${PROJECT_DIR}" "${ELIGIBLE_PRD}" success --exit-code 0 2>/dev/null || true
       if [[ "${PRD_DIR_REL}" = /* ]]; then
@@ -480,6 +484,14 @@ if ! prepare_branch_worktree "${PROJECT_DIR}" "${WORKTREE_DIR}" "${BRANCH_NAME}"
   exit 1
 fi
 
+if ! assert_isolated_worktree "${PROJECT_DIR}" "${WORKTREE_DIR}" "executor"; then
+  log "FAIL: Executor worktree guard rejected ${WORKTREE_DIR}"
+  restore_issue_to_ready "Failed worktree isolation guard for branch ${BRANCH_NAME}. Moved back to Ready for retry."
+  night_watch_history record "${PROJECT_DIR}" "${ELIGIBLE_PRD}" failure --exit-code 1 2>/dev/null || true
+  emit_result "failure" "prd=${ELIGIBLE_PRD}|branch=${BRANCH_NAME}|reason=worktree_guard_failed|detail=$(latest_failure_detail "${LOG_FILE}")"
+  exit 1
+fi
+
 # Sandbox: prevent the agent from modifying crontab during execution
 export NW_EXECUTION_CONTEXT=agent
 
@@ -521,6 +533,7 @@ while [ "${ATTEMPT}" -lt "${MAX_RETRIES}" ]; do
       if (
         cd "${WORKTREE_DIR}" && timeout "${MAX_RUNTIME}" \
           codex exec \
+            -C "${WORKTREE_DIR}" \
             --yolo \
             "${PROMPT}" \
             >> "${LOG_FILE}" 2>&1

package/dist/scripts/night-watch-helpers.sh

@@ -550,6 +550,44 @@ prepare_detached_worktree() {
   git -C "${project_dir}" worktree add --detach "${worktree_dir}" "${base_ref}" >> "${log_file}" 2>&1
 }
 
+assert_isolated_worktree() {
+  local project_dir="${1:?project_dir required}"
+  local worktree_dir="${2:?worktree_dir required}"
+  local context_label="${3:-worktree}"
+  local project_real=""
+  local worktree_real=""
+
+  if ! project_real=$(cd "${project_dir}" && pwd -P); then
+    log "FAIL: ${context_label} guard could not resolve project directory ${project_dir}"
+    return 1
+  fi
+
+  if ! worktree_real=$(cd "${worktree_dir}" && pwd -P); then
+    log "FAIL: ${context_label} guard could not resolve worktree directory ${worktree_dir}"
+    return 1
+  fi
+
+  if [ "${project_real}" = "${worktree_real}" ]; then
+    log "FAIL: ${context_label} guard refused to run in the primary checkout ${project_real}"
+    return 1
+  fi
+
+  if [ ! -f "${worktree_dir}/.git" ]; then
+    log "FAIL: ${context_label} guard expected linked worktree metadata at ${worktree_dir}/.git"
+    return 1
+  fi
+
+  if ! git -C "${worktree_dir}" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+    log "FAIL: ${context_label} guard found invalid git worktree at ${worktree_real}"
+    return 1
+  fi
+
+  if ! git -C "${project_dir}" worktree list --porcelain 2>/dev/null | grep -qF "worktree ${worktree_real}"; then
+    log "FAIL: ${context_label} guard could not find registered worktree ${worktree_real}"
+    return 1
+  fi
+}
+
 # ── Mark PRD as done ─────────────────────────────────────────────────────────
 
 mark_prd_done() {

package/dist/scripts/night-watch-pr-reviewer-cron.sh

@@ -910,6 +910,12 @@ if ! prepare_detached_worktree "${PROJECT_DIR}" "${REVIEW_WORKTREE_DIR}" "${DEFA
   exit 1
 fi
 
+if ! assert_isolated_worktree "${PROJECT_DIR}" "${REVIEW_WORKTREE_DIR}" "reviewer"; then
+  log "FAIL: Reviewer worktree guard rejected ${REVIEW_WORKTREE_DIR}"
+  emit_result "failure" "reason=worktree_guard_failed"
+  exit 1
+fi
+
 REVIEWER_PROMPT_PATH=$(resolve_instruction_path_with_fallback "${REVIEW_WORKTREE_DIR}" "pr-reviewer.md" "night-watch-pr-reviewer.md" || true)
 if [ -z "${REVIEWER_PROMPT_PATH}" ]; then
   log "FAIL: Missing reviewer prompt file. Checked pr-reviewer.md/night-watch-pr-reviewer.md in instructions/, .claude/commands/, and bundled templates/"
@@ -1054,6 +1060,11 @@ for ATTEMPT in $(seq 1 "${TOTAL_ATTEMPTS}"); do
       log "RETRY: Unable to recreate reviewer worktree; aborting"
       break
     fi
+    if ! assert_isolated_worktree "${PROJECT_DIR}" "${REVIEW_WORKTREE_DIR}" "reviewer"; then
+      EXIT_CODE=1
+      log "RETRY: Reviewer worktree guard rejected recreated directory; aborting"
+      break
+    fi
   fi
 
   log "RETRY: Starting attempt ${ATTEMPT}/${TOTAL_ATTEMPTS} (timeout: ${ATTEMPT_TIMEOUT}s) pr=${TARGET_PR:-all}"
@@ -1078,6 +1089,7 @@ for ATTEMPT in $(seq 1 "${TOTAL_ATTEMPTS}"); do
       if (
         cd "${REVIEW_WORKTREE_DIR}" && timeout "${ATTEMPT_TIMEOUT}" \
           codex exec \
+            -C "${REVIEW_WORKTREE_DIR}" \
             --yolo \
             "${REVIEWER_PROMPT}" \
             >> "${LOG_FILE}" 2>&1

package/dist/scripts/night-watch-qa-cron.sh

@@ -541,6 +541,15 @@ Action: generating QA tests and evidence."
     break
   fi
 
+  if ! assert_isolated_worktree "${PROJECT_DIR}" "${QA_WORKTREE_DIR}" "qa"; then
+    log "FAIL: QA worktree guard rejected ${QA_WORKTREE_DIR} for PR #${pr_num}"
+    FAILED_AUTOMATION_PRS_CSV=$(append_csv "${FAILED_AUTOMATION_PRS_CSV}" "#${pr_num}")
+    FAILED_PR="#${pr_num}"
+    FAILED_REASON="worktree_guard_failed"
+    EXIT_CODE=1
+    break
+  fi
+
   log "QA: Checking out PR #${pr_num} in worktree"
   # Prefer detached checkout to avoid "branch already used by worktree" failures
   # when the same branch is already checked out in another local worktree.
@@ -613,6 +622,7 @@ Action: generating QA tests and evidence."
       if (
         cd "${QA_WORKTREE_DIR}" && timeout "${MAX_RUNTIME}" \
           codex exec \
+            -C "${QA_WORKTREE_DIR}" \
             --yolo \
             "${QA_PROMPT}" \
             >> "${LOG_FILE}" 2>&1

package/dist/scripts/publish.sh

@@ -37,14 +37,16 @@ echo "==> Publishing to npm..."
 cd "$CLI_PKG"
 npm publish --access public
 
-echo "==> Installing globally (with retry for registry propagation)..."
+echo "==> Installing globally (waiting for registry propagation)..."
+echo "    Waiting 60s for npm registry to propagate..."
+sleep 60
 for attempt in 1 2 3 4 5; do
   if npm i -g "@jonit-dev/night-watch-cli@$NEW_VERSION"; then
     break
   fi
   if [[ $attempt -lt 5 ]]; then
-    echo "    Attempt $attempt failed, retrying in 30s..."
-    sleep 30
+    echo "    Attempt $attempt failed, retrying in 60s..."
+    sleep 60
   else
     echo "    All attempts failed. Install manually: npm i -g @jonit-dev/night-watch-cli@$NEW_VERSION"
     exit 1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jonit-dev/night-watch-cli",
-  "version": "1.7.76",
+  "version": "1.7.77",
   "description": "Autonomous PRD execution using AI Provider CLIs + cron",
   "type": "module",
   "bin": {