@posthog/agent 1.27.0 → 1.28.0

package/dist/index.js

@@ -196,7 +196,7 @@ function createTappedWritableStream(underlying, options) {
 // package.json
 var package_default = {
   name: "@posthog/agent",
-  version: "1.27.0",
+  version: "1.28.0",
   repository: "https://github.com/PostHog/array",
   description: "TypeScript agent framework wrapping Claude Agent SDK with Git-based task execution for PostHog",
   main: "./dist/index.js",
@@ -7127,6 +7127,37 @@ ${ignorePattern}
     };
   }
   async deleteWorktree(worktreePath) {
+    const resolvedWorktreePath = path2.resolve(worktreePath);
+    const resolvedMainRepoPath = path2.resolve(this.mainRepoPath);
+    if (resolvedWorktreePath === resolvedMainRepoPath) {
+      const error = new Error(
+        "Cannot delete worktree: path matches main repo path"
+      );
+      this.logger.error("Safety check failed", { worktreePath, error });
+      throw error;
+    }
+    if (resolvedMainRepoPath.startsWith(resolvedWorktreePath) && resolvedMainRepoPath !== resolvedWorktreePath) {
+      const error = new Error(
+        "Cannot delete worktree: path is a parent of main repo path"
+      );
+      this.logger.error("Safety check failed", { worktreePath, error });
+      throw error;
+    }
+    try {
+      const gitPath = path2.join(resolvedWorktreePath, ".git");
+      const stat2 = await fs5.stat(gitPath);
+      if (stat2.isDirectory()) {
+        const error = new Error(
+          "Cannot delete worktree: path appears to be a main repository (contains .git directory)"
+        );
+        this.logger.error("Safety check failed", { worktreePath, error });
+        throw error;
+      }
+    } catch (error) {
+      if (error instanceof Error && error.message.includes("Cannot delete worktree")) {
+        throw error;
+      }
+    }
     this.logger.info("Deleting worktree", { worktreePath });
     try {
       await execFileAsync(