@saga-ai/cli 0.2.0 → 0.4.0

package/README.md

@@ -14,6 +14,7 @@ Run commands using npx (no global installation required):
 ```bash
 npx @saga-ai/cli init
 npx @saga-ai/cli find <query>
+npx @saga-ai/cli worktree <epic-slug> <story-slug>
 npx @saga-ai/cli implement <story-slug>
 npx @saga-ai/cli dashboard
 ```
@@ -56,6 +57,23 @@ Returns JSON with:
 
 Supports typo tolerance (e.g., "implment" matches "implement").
 
+### `saga worktree <epic-slug> <story-slug>`
+
+Create a git worktree and branch for story isolation.
+
+```bash
+saga worktree my-epic my-story
+saga worktree auth-system login-form --path /path/to/project
+```
+
+Creates:
+- Branch: `story-<story-slug>-epic-<epic-slug>`
+- Worktree: `.saga/worktrees/<epic-slug>/<story-slug>/`
+
+Returns JSON with:
+- `success: true` + `worktreePath`, `branch` - Worktree created
+- `success: false` + `error` - Creation failed (branch exists, directory exists, etc.)
+
 ### `saga implement <story-slug>`
 
 Run autonomous story implementation using Claude workers.

package/dist/cli.cjs

@@ -3037,8 +3037,8 @@ var {
 } = import_index.default;
 
 // src/cli.ts
-var import_node_path5 = require("node:path");
-var import_node_fs5 = require("node:fs");
+var import_node_path7 = require("node:path");
+var import_node_fs6 = require("node:fs");
 
 // src/commands/init.ts
 var import_node_path2 = require("node:path");
@@ -4957,7 +4957,7 @@ function buildScopeSettings() {
     hooks: {
       PreToolUse: [
         {
-          matcher: "Read|Write|Edit",
+          matcher: "Read|Write|Edit|Glob|Grep",
           hooks: [hookCommand]
         }
       ]
@@ -5196,10 +5196,12 @@ async function dashboardCommand(options) {
 }
 
 // src/commands/scope-validator.ts
-function getFilePathFromInput(toolInput) {
+var import_node_path5 = require("node:path");
+function getFilePathFromInput(hookInput) {
   try {
-    const data = JSON.parse(toolInput);
-    return data.file_path || data.path || null;
+    const data = JSON.parse(hookInput);
+    const toolInput = data.tool_input || {};
+    return toolInput.file_path || toolInput.path || null;
   } catch {
     return null;
   }
@@ -5213,6 +5215,15 @@ function normalizePath(path) {
 function isArchiveAccess(path) {
   return path.includes(".saga/archive");
 }
+function isWithinWorktree(filePath, worktreePath) {
+  const absoluteFilePath = (0, import_node_path5.resolve)(filePath);
+  const absoluteWorktree = (0, import_node_path5.resolve)(worktreePath);
+  const relativePath = (0, import_node_path5.relative)(absoluteWorktree, absoluteFilePath);
+  if (relativePath.startsWith("..") || (0, import_node_path5.resolve)(relativePath) === relativePath) {
+    return false;
+  }
+  return true;
+}
 function checkStoryAccess(path, allowedEpic, allowedStory) {
   if (!path.includes(".saga/epics/")) {
     return true;
@@ -5233,24 +5244,27 @@ function checkStoryAccess(path, allowedEpic, allowedStory) {
     return pathEpic === allowedEpic;
   }
 }
-function printScopeViolation(filePath, epicSlug, storySlug, reason) {
+function printScopeViolation(filePath, epicSlug, storySlug, worktreePath, reason) {
   console.error(`SCOPE VIOLATION: ${reason}
 
 Attempted path: ${filePath}
 
 Your scope is limited to:
+  Worktree: ${worktreePath}
   Epic: ${epicSlug}
   Story: ${storySlug}
-  Allowed: .saga/epics/${epicSlug}/stories/${storySlug}/
+  Allowed story files: .saga/epics/${epicSlug}/stories/${storySlug}/
 
+Workers cannot access files outside the worktree directory.
 To access other stories, start a new /implement session for that story.`);
 }
 async function scopeValidatorCommand() {
+  const worktreePath = process.env.SAGA_PROJECT_DIR || "";
   const epicSlug = process.env.SAGA_EPIC_SLUG || "";
   const storySlug = process.env.SAGA_STORY_SLUG || "";
-  if (!epicSlug || !storySlug) {
+  if (!worktreePath || !epicSlug || !storySlug) {
     console.error(
-      "ERROR: scope-validator requires SAGA_EPIC_SLUG and SAGA_STORY_SLUG environment variables"
+      "ERROR: scope-validator requires SAGA_PROJECT_DIR, SAGA_EPIC_SLUG, and SAGA_STORY_SLUG environment variables"
     );
     process.exit(2);
   }
@@ -5264,11 +5278,22 @@ async function scopeValidatorCommand() {
     process.exit(0);
   }
   const normPath = normalizePath(filePath);
+  if (!isWithinWorktree(normPath, worktreePath)) {
+    printScopeViolation(
+      filePath,
+      epicSlug,
+      storySlug,
+      worktreePath,
+      "Access outside worktree blocked\nReason: Workers can only access files within their assigned worktree directory."
+    );
+    process.exit(2);
+  }
   if (isArchiveAccess(normPath)) {
     printScopeViolation(
       filePath,
       epicSlug,
       storySlug,
+      worktreePath,
       "Access to archive folder blocked\nReason: The archive folder contains completed stories and is read-only during execution."
     );
     process.exit(2);
@@ -5278,6 +5303,7 @@ async function scopeValidatorCommand() {
       filePath,
       epicSlug,
       storySlug,
+      worktreePath,
       "Access to other story blocked\nReason: Workers can only access their assigned story's files."
     );
     process.exit(2);
@@ -5307,9 +5333,107 @@ async function findCommand(query, options) {
   }
 }
 
+// src/commands/worktree.ts
+var import_node_path6 = require("node:path");
+var import_node_fs5 = require("node:fs");
+var import_node_child_process2 = require("node:child_process");
+function runGitCommand(args, cwd) {
+  try {
+    const output = (0, import_node_child_process2.execSync)(`git ${args.join(" ")}`, {
+      cwd,
+      encoding: "utf-8",
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    return { success: true, output: output.trim() };
+  } catch (error) {
+    const stderr = error.stderr?.toString().trim() || error.message;
+    return { success: false, output: stderr };
+  }
+}
+function branchExists(branchName, cwd) {
+  const result = runGitCommand(["rev-parse", "--verify", branchName], cwd);
+  return result.success;
+}
+function getMainBranch(cwd) {
+  const result = runGitCommand(
+    ["symbolic-ref", "refs/remotes/origin/HEAD"],
+    cwd
+  );
+  if (result.success) {
+    return result.output.replace("refs/remotes/origin/", "");
+  }
+  return "main";
+}
+function createWorktree(projectPath, epicSlug, storySlug) {
+  const branchName = `story-${storySlug}-epic-${epicSlug}`;
+  const worktreePath = (0, import_node_path6.join)(
+    projectPath,
+    ".saga",
+    "worktrees",
+    epicSlug,
+    storySlug
+  );
+  if (branchExists(branchName, projectPath)) {
+    return {
+      success: false,
+      error: `Branch already exists: ${branchName}`
+    };
+  }
+  if ((0, import_node_fs5.existsSync)(worktreePath)) {
+    return {
+      success: false,
+      error: `Worktree directory already exists: ${worktreePath}`
+    };
+  }
+  const mainBranch = getMainBranch(projectPath);
+  runGitCommand(["fetch", "origin", mainBranch], projectPath);
+  const createBranchResult = runGitCommand(
+    ["branch", branchName, `origin/${mainBranch}`],
+    projectPath
+  );
+  if (!createBranchResult.success) {
+    return {
+      success: false,
+      error: `Failed to create branch: ${createBranchResult.output}`
+    };
+  }
+  const worktreeParent = (0, import_node_path6.join)(projectPath, ".saga", "worktrees", epicSlug);
+  (0, import_node_fs5.mkdirSync)(worktreeParent, { recursive: true });
+  const createWorktreeResult = runGitCommand(
+    ["worktree", "add", worktreePath, branchName],
+    projectPath
+  );
+  if (!createWorktreeResult.success) {
+    return {
+      success: false,
+      error: `Failed to create worktree: ${createWorktreeResult.output}`
+    };
+  }
+  return {
+    success: true,
+    worktreePath,
+    branch: branchName
+  };
+}
+async function worktreeCommand(epicSlug, storySlug, options) {
+  let projectPath;
+  try {
+    projectPath = resolveProjectPath(options.path);
+  } catch (error) {
+    const result2 = { success: false, error: error.message };
+    console.log(JSON.stringify(result2));
+    process.exit(1);
+  }
+  const result = createWorktree(projectPath, epicSlug, storySlug);
+  console.log(JSON.stringify(result));
+  if (!result.success) {
+    process.exit(1);
+  }
+}
+
 // src/cli.ts
-var packageJsonPath = (0, import_node_path5.join)(__dirname, "..", "package.json");
-var packageJson = JSON.parse((0, import_node_fs5.readFileSync)(packageJsonPath, "utf-8"));
+var packageJsonPath = (0, import_node_path7.join)(__dirname, "..", "package.json");
+var packageJson = JSON.parse((0, import_node_fs6.readFileSync)(packageJsonPath, "utf-8"));
 var program2 = new Command();
 program2.name("saga").description("CLI for SAGA - Structured Autonomous Goal Achievement").version(packageJson.version).addHelpCommand("help [command]", "Display help for a command");
 program2.option("-p, --path <dir>", "Path to SAGA project directory (overrides auto-discovery)");
@@ -5334,6 +5458,10 @@ program2.command("find <query>").description("Find an epic or story by slug/titl
     type: options.type
   });
 });
+program2.command("worktree <epic-slug> <story-slug>").description("Create git worktree for a story").action(async (epicSlug, storySlug) => {
+  const globalOpts = program2.opts();
+  await worktreeCommand(epicSlug, storySlug, { path: globalOpts.path });
+});
 program2.command("dashboard").description("Start the dashboard server").option("--port <n>", "Port to run the server on (default: 3847)", parseInt).action(async (options) => {
   const globalOpts = program2.opts();
   await dashboardCommand({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saga-ai/cli",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "description": "CLI for SAGA - Structured Autonomous Goal Achievement",
   "type": "module",
   "bin": {