@yagni-app/code-staging 1.0.9-staging.1292.1 → 1.0.9-staging.1301.1

package/dist/extension/resilientFetch.d.ts

@@ -52,9 +52,9 @@ export interface ResilientFetchOpts {
 export declare function resilientFetch(url: string, init: RequestInit, opts?: ResilientFetchOpts): Promise<Response>;
 /**
  * Map a non-ok response to a friendly, body-truncated message for a tool's throw.
- * Auth statuses get an actionable re-login hint; everything else carries the
- * status plus a capped slice of the body so a giant HTML error never floods the
- * agent. No em-dashes (house copy rule).
+ * Authentication failures get a re-login hint; permission denials stay distinct.
+ * Other failures carry the status plus a capped slice of the body so a giant
+ * HTML error never floods the agent. No em-dashes (house copy rule).
  */
 export declare function friendlyFetchError(label: string, res: Response): Promise<string>;
 //# sourceMappingURL=resilientFetch.d.ts.map

package/dist/extension/resilientFetch.js

@@ -105,9 +105,9 @@ export async function resilientFetch(url, init, opts = {}) {
 }
 /**
  * Map a non-ok response to a friendly, body-truncated message for a tool's throw.
- * Auth statuses get an actionable re-login hint; everything else carries the
- * status plus a capped slice of the body so a giant HTML error never floods the
- * agent. No em-dashes (house copy rule).
+ * Authentication failures get a re-login hint; permission denials stay distinct.
+ * Other failures carry the status plus a capped slice of the body so a giant
+ * HTML error never floods the agent. No em-dashes (house copy rule).
  */
 export async function friendlyFetchError(label, res) {
     let body = "";
@@ -119,9 +119,12 @@ export async function friendlyFetchError(label, res) {
     }
     if (body.length > MAX_ERROR_BODY)
         body = `${body.slice(0, MAX_ERROR_BODY)} ...`;
-    if (res.status === 401 || res.status === 403) {
+    if (res.status === 401) {
         return `${label} is not authorized (HTTP ${res.status}). Run \`yagni login\` to re-authenticate.`;
     }
+    if (res.status === 403) {
+        return `${label} does not have permission (HTTP 403). Report the permission limitation if it blocks the task.`;
+    }
     if (res.status === 429) {
         return `${label} was rate limited (HTTP 429). Try again in a moment.`;
     }

package/dist/extension/sandbox/config.d.ts

@@ -19,6 +19,7 @@
  * allowlist; loopback needs allowLocalBinding (allowedDomains cannot open it
  * — loopback bypasses the proxy via no_proxy).
  */
+import { type WorktreeGitAccess } from "./worktreeGit.js";
 import type { PermissionRule } from "../permissionRules/loadConfig.js";
 export interface SandboxNetworkSettings {
     allowedDomains?: string[];
@@ -95,6 +96,10 @@ export interface SandboxRuntimeMerge {
         allowWrite: string[];
         denyWrite: string[];
     };
+    /** git safe.directory entries for srt (GIT_CONFIG_* env): the worktree
+     * root + common git dir, so bwrap's uid-mapping does not trip "dubious
+     * ownership" on the main-repo path. Empty when not a worktree session. */
+    gitSafeDirectories: string[];
     /** Permission rules that could not map into sandbox restrictions (surfaced
      * in diagnostics — never silently dropped). */
     droppedRules: string[];
@@ -111,5 +116,5 @@ export interface SandboxRuntimeMerge {
  * cwd-relative bare) resolved per-source; sandbox.filesystem.* uses standard
  * path semantics (/ = absolute) exactly like Claude's two resolvers.
  */
-export declare function mergeRulesIntoSandbox(settings: SandboxSettings, rules: readonly PermissionRule[], base: SandboxRuntimePaths): SandboxRuntimeMerge;
+export declare function mergeRulesIntoSandbox(settings: SandboxSettings, rules: readonly PermissionRule[], base: SandboxRuntimePaths, worktreeGit?: WorktreeGitAccess | null): SandboxRuntimeMerge;
 //# sourceMappingURL=config.d.ts.map

package/dist/extension/sandbox/config.js

@@ -295,7 +295,7 @@ homeDirDefault = homeDirDefaultFn;
  * cwd-relative bare) resolved per-source; sandbox.filesystem.* uses standard
  * path semantics (/ = absolute) exactly like Claude's two resolvers.
  */
-export function mergeRulesIntoSandbox(settings, rules, base) {
+export function mergeRulesIntoSandbox(settings, rules, base, worktreeGit) {
     const homeDir = base.homeDir ?? homeDirDefault();
     const allowWrite = new Set([base.cwd, tmpdir()]);
     const denyWrite = new Set();
@@ -360,6 +360,23 @@ export function mergeRulesIntoSandbox(settings, rules, base) {
         denyRead.add(resolveSandboxFsPath(p, base));
     for (const p of settings.filesystem?.allowRead ?? [])
         allowRead.add(resolveSandboxFsPath(p, base));
+    // Linked-worktree git access: allow writes to the shared common git dir
+    // only (routine worktree git — index.lock, refs, objects — never writes
+    // outside it), and pin hooks + config read-only within the newly allowed
+    // dir. The explicit config/hooks denies are redundant on macOS (srt's
+    // mandatory globs already cover **/.git/hooks and **/.git/config) but
+    // load-bearing on Linux, where srt's deny enforcement only ro-binds
+    // denies WITHIN allowWrite paths and its cwd-anchored mandatory sweep
+    // never sees the main repo — and for bare-repo worktrees, where the
+    // `.git` globs match nothing. Pure-merge contract: the caller passes the
+    // resolved value; this function never touches the filesystem.
+    const gitSafeDirectories = [];
+    if (worktreeGit) {
+        allowWrite.add(worktreeGit.commonGitDir);
+        denyWrite.add(join(worktreeGit.commonGitDir, "hooks"));
+        denyWrite.add(join(worktreeGit.commonGitDir, "config"));
+        gitSafeDirectories.push(worktreeGit.worktreeRoot, worktreeGit.commonGitDir);
+    }
     // Protected paths: always denyWrite, never exempted (Claude parity + our
     // own surfaces). Note srt denyWrite also denies read-of-ignored writes.
     denyWrite.add(join(base.userStateHome, "config.json"));
@@ -382,6 +399,7 @@ export function mergeRulesIntoSandbox(settings, rules, base) {
             allowWrite: [...allowWrite],
             denyWrite: [...denyWrite],
         },
+        gitSafeDirectories,
         droppedRules,
     };
 }

package/dist/extension/sandbox/manager.d.ts

@@ -10,6 +10,7 @@
  * bracket. Pure functions (config building) live in config.ts.
  */
 import { type SandboxSettings, type SandboxRuntimeMerge } from "./config.js";
+import { type WorktreeGitAccess } from "./worktreeGit.js";
 import type { PermissionRule } from "../permissionRules/loadConfig.js";
 /** Where the network ask-callback surfaces a decision. */
 export type NetworkAskHandler = (host: string) => Promise<boolean>;
@@ -39,6 +40,9 @@ export interface SandboxSessionState {
     dependencies: SandboxDependencyStatus | null;
     /** The settings snapshot this session initialized with. */
     settings: SandboxSettings | null;
+    /** Cached linked-worktree git resolution — resolved once at initialize()
+     * (worktree linkage does not change mid-session), undefined until then. */
+    worktreeGit: WorktreeGitAccess | null | undefined;
 }
 /** Default vendored rg shipped with the CLI install. */
 export declare function defaultRgPath(env?: NodeJS.ProcessEnv): string | undefined;
@@ -69,7 +73,9 @@ export declare class YagniSandboxManager {
     /**
      * Build the runtime filesystem/network config from current settings +
      * permission rules. Exposed for diagnostics (/sandbox config display) and
-     * tests; initialize() consumes it internally.
+     * tests; initialize() consumes it internally. Uses the cached worktree
+     * resolution when initialize() already ran; a pre-init caller (tests,
+     * panel) resolves live if the cwd is a linked worktree root.
      */
     buildRuntimeMerge(rules: readonly PermissionRule[]): SandboxRuntimeMerge;
     private runtimeConfig;
@@ -94,7 +100,8 @@ export declare class YagniSandboxManager {
     refreshConfig(rules: readonly PermissionRule[]): void;
     /**
      * Re-init from scratch (config grant changed semantics srt can't hot-swap,
-     * or a toggle). Tears down proxies + violation store first.
+     * or a toggle). Tears down proxies + violation store first. The worktree
+     * cache clears with the state reset and re-resolves on the next init.
      */
     reinitialize(rules: readonly PermissionRule[]): Promise<string | undefined>;
     /** Tear down srt (proxies, violation store, seatbelt state). */

package/dist/extension/sandbox/manager.js

@@ -13,6 +13,7 @@ import { SandboxManager as SrtSandboxManager } from "@anthropic-ai/sandbox-runti
 import { logEvent } from "../errorSink.js";
 import { codeStateHome } from "../stateHome.js";
 import { loadSandboxSettings, mergeRulesIntoSandbox, } from "./config.js";
+import { resolveWorktreeGitAccess } from "./worktreeGit.js";
 /** Default vendored rg shipped with the CLI install. */
 export function defaultRgPath(env = process.env) {
     const agentDir = env.PI_CODING_AGENT_DIR;
@@ -21,7 +22,7 @@ export function defaultRgPath(env = process.env) {
     return `${agentDir.replace(/\/$/, "")}/bin/rg`;
 }
 export class YagniSandboxManager {
-    state = { initialized: false, dependencies: null, settings: null };
+    state = { initialized: false, dependencies: null, settings: null, worktreeGit: undefined };
     askHandler = null;
     opts;
     /** Config warnings already logged this process — buildRuntimeMerge runs
@@ -95,7 +96,9 @@ export class YagniSandboxManager {
     /**
      * Build the runtime filesystem/network config from current settings +
      * permission rules. Exposed for diagnostics (/sandbox config display) and
-     * tests; initialize() consumes it internally.
+     * tests; initialize() consumes it internally. Uses the cached worktree
+     * resolution when initialize() already ran; a pre-init caller (tests,
+     * panel) resolves live if the cwd is a linked worktree root.
      */
     buildRuntimeMerge(rules) {
         const { settings, diagnostics } = loadSandboxSettings({
@@ -105,12 +108,15 @@ export class YagniSandboxManager {
             stateHomeOverride: this.opts.stateHomeOverride,
         });
         this.surfaceConfigDiagnostics(diagnostics);
+        const worktreeGit = this.state.worktreeGit !== undefined
+            ? this.state.worktreeGit
+            : resolveWorktreeGitAccess(this.opts.cwd);
         return mergeRulesIntoSandbox(settings, rules, {
             cwd: this.opts.cwd,
             userStateHome: this.opts.stateHomeOverride ?? codeStateHome(null, this.opts.env, this.opts.userHome),
             projectRoot: this.opts.projectRoot ?? null,
             homeDir: this.opts.userHome,
-        });
+        }, worktreeGit);
     }
     runtimeConfig(merge, settings) {
         return {
@@ -129,6 +135,9 @@ export class YagniSandboxManager {
                 allowWrite: merge.filesystem.allowWrite,
                 denyWrite: merge.filesystem.denyWrite,
             },
+            ...(merge.gitSafeDirectories.length > 0
+                ? { git: { safeDirectories: merge.gitSafeDirectories } }
+                : {}),
             ignoreViolations: settings.ignoreViolations,
             enableWeakerNestedSandbox: settings.enableWeakerNestedSandbox,
             enableWeakerNetworkIsolation: settings.enableWeakerNetworkIsolation,
@@ -176,6 +185,21 @@ export class YagniSandboxManager {
             this.state.dependencies = null;
             return `sandbox initialization failed: ${err instanceof Error ? err.message : String(err)}`;
         }
+        // Cache the worktree resolution only after a successful init — a failed
+        // init leaves it undefined so buildRuntimeMerge keeps resolving live.
+        this.state.worktreeGit = resolveWorktreeGitAccess(this.opts.cwd);
+        // Security-relevant allow widening needs its trail: one line when the
+        // session's git writes were allowed outside cwd (path-only metadata,
+        // same exposure class as sandbox_config_warning fields; silent when
+        // null — that is every non-worktree session).
+        if (this.state.worktreeGit) {
+            logEvent({
+                source: "sandbox",
+                level: "info",
+                event: "sandbox_worktree_git_allow",
+                fields: { commonGitDir: this.state.worktreeGit.commonGitDir },
+            });
+        }
         this.state.initialized = true;
         this.state.settings = load.settings;
         this.opts.events?.onStateChange?.(true);
@@ -198,7 +222,8 @@ export class YagniSandboxManager {
     }
     /**
      * Re-init from scratch (config grant changed semantics srt can't hot-swap,
-     * or a toggle). Tears down proxies + violation store first.
+     * or a toggle). Tears down proxies + violation store first. The worktree
+     * cache clears with the state reset and re-resolves on the next init.
      */
     async reinitialize(rules) {
         if (this.state.initialized) {
@@ -208,7 +233,7 @@ export class YagniSandboxManager {
     }
     /** Tear down srt (proxies, violation store, seatbelt state). */
     async reset() {
-        this.state = { initialized: false, dependencies: null, settings: null };
+        this.state = { initialized: false, dependencies: null, settings: null, worktreeGit: undefined };
         try {
             await SrtSandboxManager.reset();
         }

package/dist/extension/sandbox/panel.js

@@ -20,6 +20,7 @@
  */
 import { Box, Container, HStack, Key, SelectList, Text, matchesKey, } from "@earendil-works/pi-tui";
 import { mergeRulesIntoSandbox } from "./config.js";
+import { resolveWorktreeGitAccess } from "./worktreeGit.js";
 // ---------------------------------------------------------------------------
 // Pure derivation helpers (unit-tested; no TUI dependency)
 // ---------------------------------------------------------------------------
@@ -335,7 +336,7 @@ export function buildPanelState(settings, sessionToggledOff, rules, paths, sessi
         sessionToggledOff,
         dependencyErrors: dependencyStatus.errors,
         dependencyWarnings: dependencyStatus.warnings,
-        merge: mergeRulesIntoSandbox(settings, rules, paths),
+        merge: mergeRulesIntoSandbox(settings, rules, paths, resolveWorktreeGitAccess(paths.cwd)),
         sessionGrants: [...sessionGrants],
     };
 }

package/dist/extension/sandbox/session.js

@@ -22,6 +22,7 @@ import { codeStateHome } from "../stateHome.js";
 import { isDebug } from "../diagnostics.js";
 import { mutateConfigJson, mutateLocalConfig } from "../settingsFiles.js";
 import { loadSandboxSettings } from "./config.js";
+import { resolveWorktreeGitAccess } from "./worktreeGit.js";
 import { annotateCommandOutput, makeSandboxSpawnHook, preWrappedCommand, shouldUseSandbox, shouldUseSandboxForUserCommand, } from "./bash.js";
 import { YagniSandboxManager } from "./manager.js";
 import { SandboxPanel, buildPanelState } from "./panel.js";
@@ -68,6 +69,12 @@ export function makeBashComposition(manager, settings, cwd) {
             ? `Network: only these domains (wildcards ok): ${allowed.join(", ")}`
             : "Network: no domains pre-allowed — the first contact to each host prompts the user");
         restrictions.push(`Filesystem writes: working directory, /tmp, and paths granted by Edit(...) allow rules`);
+        // A linked-worktree session additionally allows the shared common git
+        // dir (git operations work sandboxed there); the description must say
+        // so or the model under-reports what it can do.
+        if (resolveWorktreeGitAccess(cwd)) {
+            restrictions.push("Filesystem writes (git): the linked worktree's shared .git directory — git operations (add/commit/branch/checkout) are allowed and should run sandboxed; its hooks/ and config remain read-only");
+        }
         if (s.filesystem?.denyWrite?.length)
             restrictions.push(`Denied writes: ${s.filesystem.denyWrite.join(", ")}`);
         const strictNote = s.allowUnsandboxedCommands === false

package/dist/extension/sandbox/worktreeGit.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Linked-worktree git resolution for the sandbox. When the session cwd is
+ * the root of a linked worktree, routine git writes (status/add/commit/
+ * branch/checkout) land in the MAIN repo's shared `.git` directory —
+ * outside the sandbox's default write allowlist ({cwd, tmpdir()}), so every
+ * one of them fails with EPERM and forces the dangerouslyDisableSandbox
+ * retry path. Resolving the shared common git dir here lets the sandbox
+ * allow exactly that directory (never the main checkout's working tree).
+ *
+ * Resolution chain (Claude Code's resolveCanonicalRoot, src/utils/git.ts,
+ * applied to the sandbox problem — Claude's own sandbox side only does a
+ * shape check on the gitdir path, which would trust an attacker-crafted
+ * `.git` file; the full chain here is deliberately stricter):
+ *   cwd/.git file → `gitdir:` → resolve against cwd → <gitdir>/commondir →
+ *   resolve against gitdir → common git dir. Both validation checks from
+ *   the reference are enforced before anything is returned:
+ *   1. structural — the worktree gitdir is a direct child of
+ *      <commonDir>/worktrees/ (the commondir we read lives where git put it,
+ *      not wherever an attacker's `.git` file pointed);
+ *   2. back-link — <gitdir>/gitdir points back at THIS cwd's .git (an
+ *      attacker cannot borrow an existing worktree entry of another repo).
+ *
+ * Fail-through cases (all return null, no behavior change vs the
+ * pre-worktree-allow sandbox):
+ * plain main checkout (.git is a directory → EISDIR), no repo at all,
+ * submodule (.git file but no commondir), failed structural/back-link
+ * validation, any read/parse error.
+ *
+ * Bare-repo worktrees are supported: there the common dir is the bare repo
+ * itself (`<bare>/worktrees/<name>/commondir` → `<bare>`), so the allowed
+ * directory IS the common dir (Claude's `/.git/worktrees/` shape marker
+ * silently no-ops there; ours resolves it).
+ *
+ * Root-only by design (Claude sandbox-side parity): a session started in a
+ * worktree SUBDIRECTORY keeps the pre-existing behavior — the `.git` file
+ * sits only at the worktree root.
+ */
+/** Resolved write-target facts for a linked-worktree session. */
+export interface WorktreeGitAccess {
+    /** The shared common git dir git writes actually land in. */
+    commonGitDir: string;
+    /** Realpath'd worktree root (safe.directory needs the on-disk spelling). */
+    worktreeRoot: string;
+}
+/**
+ * Resolve the shared common git dir when cwd is a linked worktree root.
+ * Returns null for every non-worktree / untrusted shape — callers treat
+ * null as "no extra entries" and never widen the sandbox.
+ *
+ * Null REASONS are surfaced (debug level, paths only) whenever a `gitdir:`
+ * .git file existed but validation refused: a legitimate worktree that
+ * silently misses the allow is indistinguishable from "not a worktree"
+ * without them. The plain-repo / no-repo fall-throughs stay silent — they
+ * are the common case and carry no signal.
+ */
+export declare function resolveWorktreeGitAccess(cwd: string): WorktreeGitAccess | null;
+//# sourceMappingURL=worktreeGit.d.ts.map

package/dist/extension/sandbox/worktreeGit.js

@@ -0,0 +1,157 @@
+/**
+ * Linked-worktree git resolution for the sandbox. When the session cwd is
+ * the root of a linked worktree, routine git writes (status/add/commit/
+ * branch/checkout) land in the MAIN repo's shared `.git` directory —
+ * outside the sandbox's default write allowlist ({cwd, tmpdir()}), so every
+ * one of them fails with EPERM and forces the dangerouslyDisableSandbox
+ * retry path. Resolving the shared common git dir here lets the sandbox
+ * allow exactly that directory (never the main checkout's working tree).
+ *
+ * Resolution chain (Claude Code's resolveCanonicalRoot, src/utils/git.ts,
+ * applied to the sandbox problem — Claude's own sandbox side only does a
+ * shape check on the gitdir path, which would trust an attacker-crafted
+ * `.git` file; the full chain here is deliberately stricter):
+ *   cwd/.git file → `gitdir:` → resolve against cwd → <gitdir>/commondir →
+ *   resolve against gitdir → common git dir. Both validation checks from
+ *   the reference are enforced before anything is returned:
+ *   1. structural — the worktree gitdir is a direct child of
+ *      <commonDir>/worktrees/ (the commondir we read lives where git put it,
+ *      not wherever an attacker's `.git` file pointed);
+ *   2. back-link — <gitdir>/gitdir points back at THIS cwd's .git (an
+ *      attacker cannot borrow an existing worktree entry of another repo).
+ *
+ * Fail-through cases (all return null, no behavior change vs the
+ * pre-worktree-allow sandbox):
+ * plain main checkout (.git is a directory → EISDIR), no repo at all,
+ * submodule (.git file but no commondir), failed structural/back-link
+ * validation, any read/parse error.
+ *
+ * Bare-repo worktrees are supported: there the common dir is the bare repo
+ * itself (`<bare>/worktrees/<name>/commondir` → `<bare>`), so the allowed
+ * directory IS the common dir (Claude's `/.git/worktrees/` shape marker
+ * silently no-ops there; ours resolves it).
+ *
+ * Root-only by design (Claude sandbox-side parity): a session started in a
+ * worktree SUBDIRECTORY keeps the pre-existing behavior — the `.git` file
+ * sits only at the worktree root.
+ */
+import { readFileSync, realpathSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { logEvent } from "../errorSink.js";
+import { isDebug } from "../diagnostics.js";
+/**
+ * Resolve the shared common git dir when cwd is a linked worktree root.
+ * Returns null for every non-worktree / untrusted shape — callers treat
+ * null as "no extra entries" and never widen the sandbox.
+ *
+ * Null REASONS are surfaced (debug level, paths only) whenever a `gitdir:`
+ * .git file existed but validation refused: a legitimate worktree that
+ * silently misses the allow is indistinguishable from "not a worktree"
+ * without them. The plain-repo / no-repo fall-throughs stay silent — they
+ * are the common case and carry no signal.
+ */
+export function resolveWorktreeGitAccess(cwd) {
+    let gitContent;
+    try {
+        gitContent = readFileSync(join(cwd, ".git"), "utf-8").trim();
+    }
+    catch {
+        // No .git, or .git is a directory (plain main checkout → EISDIR).
+        return null;
+    }
+    if (!gitContent.startsWith("gitdir:"))
+        return null;
+    // gitdir may be relative (rare, but git accepts it) — resolve against cwd.
+    const worktreeGitDir = resolve(cwd, gitContent.slice("gitdir:".length).trim());
+    const debugRefused = (reason) => {
+        if (!isDebug())
+            return;
+        logEvent({
+            source: "sandbox",
+            level: "debug",
+            event: "sandbox_worktree_git_refused",
+            fields: { reason, worktreeGitDir },
+        });
+    };
+    let commonContent;
+    try {
+        // Submodules have a .git file but no commondir (ENOENT → fall through).
+        commonContent = readFileSync(join(worktreeGitDir, "commondir"), "utf-8").trim();
+    }
+    catch {
+        debugRefused("no-commondir");
+        return null;
+    }
+    const commonDir = resolve(worktreeGitDir, commonContent);
+    // Structural check: the worktree gitdir must be a direct child of
+    // <commonDir>/worktrees — the commondir we just read must live inside the
+    // common dir it named, not at an arbitrary attacker-chosen path. win32
+    // compares case-insensitively (git preserves the casing used at worktree
+    // creation, so genuine worktrees can carry casing drift between the
+    // gitdir spelling and the commondir resolution); POSIX compares exactly.
+    const structuralMatches = process.platform === "win32"
+        ? dirname(worktreeGitDir).toLowerCase() === join(commonDir, "worktrees").toLowerCase()
+        : dirname(worktreeGitDir) === join(commonDir, "worktrees");
+    if (!structuralMatches) {
+        debugRefused("structural-mismatch");
+        return null;
+    }
+    // Back-link check: git writes <worktreeGitDir>/gitdir pointing back at
+    // this worktree's .git. Realpath the worktree root (not the .git entry —
+    // a symlinked .git must not be followed) so legitimate worktrees reached
+    // through a symlinked path (macOS /tmp → /private/tmp) still validate.
+    // win32: git's strbuf_realpath expands 8.3 short names (C:\\RUNNER~1 →
+    // runneradmin) when it writes the back-link, while Node's JS-side
+    // realpath does not — both sides go through realpathSync.native (which
+    // expands them) and compare case-insensitively, or every genuine
+    // worktree under a short-named TEMP would fail closed on spelling.
+    // POSIX compares exactly (symlinks already resolved by realpath).
+    let rawBacklink;
+    try {
+        rawBacklink = readFileSync(join(worktreeGitDir, "gitdir"), "utf-8").trim();
+    }
+    catch {
+        debugRefused("no-backlink");
+        return null;
+    }
+    let backlink;
+    try {
+        backlink = process.platform === "win32" ? realpathSync.native(rawBacklink) : realpathSync(rawBacklink);
+    }
+    catch {
+        // Exists but cannot be canonicalized: dangling symlink, permissions —
+        // a different failure than an absent back-link, and worth its own code.
+        debugRefused("backlink-unreadable");
+        return null;
+    }
+    let realCwd;
+    try {
+        realCwd = process.platform === "win32" ? realpathSync.native(cwd) : realpathSync(cwd);
+    }
+    catch {
+        return null;
+    }
+    const backlinkMatches = process.platform === "win32"
+        ? backlink.toLowerCase() === join(realCwd, ".git").toLowerCase()
+        : backlink === join(realCwd, ".git");
+    if (!backlinkMatches) {
+        debugRefused("backlink-mismatch");
+        return null;
+    }
+    return {
+        commonGitDir: safeRealpath(commonDir),
+        worktreeRoot: realCwd,
+    };
+}
+/** realpath that tolerates a vanished path (returns the input spelling) —
+ * post-validation only, so a stale spelling can never widen anything: the
+ * validation above already proved the entry structure exists. */
+function safeRealpath(p) {
+    try {
+        return realpathSync(p);
+    }
+    catch {
+        return p;
+    }
+}
+//# sourceMappingURL=worktreeGit.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "1.0.9-staging.1292.1",
+  "version": "1.0.9-staging.1301.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -58,5 +58,5 @@
     "turndown": "^7.2.4",
     "typebox": "^1.3.15"
   },
-  "yagniSourceSha": "be851fcdc82a066edbe8ebb394685bc1b61169f8"
+  "yagniSourceSha": "2d51041ec00bbf091fa349e5c0a199cf52d4fe1e"
 }