@yemi33/minions 0.1.2383 → 0.1.2384

package/engine/cli.js

@@ -653,6 +653,12 @@ const commands = {
 
         const hadPid = agentPid && agentPid > 0; // track before liveness check
         if (agentPid && agentPid > 0 && !isPidAlive(agentPid)) agentPid = null;
+        if (agentPid && !shared.isDispatchExecutionPathSafe(item, config)) {
+          e.log('warn', `Reattach: refusing ${item.id} — persisted execution path is not safe under current checkout config`);
+          try { shared.killImmediate({ pid: agentPid }); }
+          catch (err) { e.log('warn', `Reattach: failed to terminate unsafe dispatch ${item.id}: ${err.message}`); }
+          agentPid = null;
+        }
 
         // PID was found but confirmed dead — exempt from restart grace period (#869)
         if (hadPid && !agentPid) {
@@ -812,18 +818,14 @@ const commands = {
             );
           } catch (err) { e.log('warn', `Orphan dispatch complete: ${err.message}`); }
 
-          // P-d9e6b2c4 — live-mode dispatch-end auto-restore + terminal-failure
-          // notify on the engine-restart reattach completion path. originalRef
-          // is only persisted for live-mode dispatches (P-c5a1f3b8), so its
-          // presence is the liveMode signal here — the slimmed meta.project
-          // carries no checkoutMode. Mirrors the in-process onAgentClose wiring
-          // (engine.js). Fire-and-forget + best-effort: the helper swallows its
-          // own errors and only ever issues a plain `git checkout <originalRef>`
-          // (never --force/reset/clean/stash) against the operator tree.
-          if (item.originalRef && item.meta?.branch && item.meta?.project?.localPath) {
+          // Restore only records explicitly dispatched live and still configured
+          // live. Worktree mode fails closed even if stale state carries
+          // originalRef fields.
+          if (shared.isLiveCheckoutDispatchRecord(item, config)) {
             try {
               require('./live-checkout').maybeRestoreLiveCheckoutFromRecord({
                 item,
+                config,
                 isTerminalFailure: !isSuccess,
                 resultLabel: result,
                 log: (lvl, msg) => e.log(lvl, msg),
@@ -1201,6 +1203,38 @@ const commands = {
       const timeout = config.engine?.shutdownTimeout || shared.ENGINE_DEFAULTS.shutdownTimeout;
       const deadline = Date.now() + timeout;
 
+      async function cancelTimedOutPooled(ids) {
+        const closing = [];
+        for (const id of ids) {
+          const procInfo = e.activeProcesses.get(id);
+          if (!procInfo?._pooled) continue;
+          try {
+            procInfo.proc.kill();
+            if (typeof procInfo.proc.waitForClose === 'function') {
+              closing.push(procInfo.proc.waitForClose());
+            }
+          } catch (err) {
+            e.log('warn', `Failed to cancel pooled dispatch ${id} during shutdown: ${err.message}`);
+          }
+        }
+        await Promise.allSettled(closing);
+
+        const stillActive = new Set((getDispatch().active || []).map(item => item.id));
+        for (const id of ids) {
+          e.activeProcesses.delete(id);
+          e.realActivityMap.delete(id);
+          if (!stillActive.has(id)) continue;
+          e.completeDispatch(
+            id,
+            DISPATCH_RESULT.ERROR,
+            'Pooled dispatch cancelled after graceful shutdown timeout',
+            '',
+            { failureClass: FAILURE_CLASS.TIMEOUT, retryable: true },
+          );
+        }
+        finishShutdown(`Shutdown timeout (${timeout / 1000}s) — cancelled ${ids.length} pooled agent(s) for retry.`, 1);
+      }
+
       const poll = setInterval(() => {
         pooledIds = getOutstandingPooledIds();
         if (pooledIds.length === 0 && agentWorkerPool.isDrained()) {
@@ -1210,24 +1244,10 @@ const commands = {
         }
         if (Date.now() >= deadline) {
           clearInterval(poll);
-          for (const id of pooledIds) {
-            const procInfo = e.activeProcesses.get(id);
-            if (procInfo?._pooled) {
-              try { procInfo.proc.kill(); } catch (err) {
-                e.log('warn', `Failed to cancel pooled dispatch ${id} during shutdown: ${err.message}`);
-              }
-              e.activeProcesses.delete(id);
-              e.realActivityMap.delete(id);
-            }
-            e.completeDispatch(
-              id,
-              DISPATCH_RESULT.ERROR,
-              'Pooled dispatch cancelled after graceful shutdown timeout',
-              '',
-              { failureClass: FAILURE_CLASS.TIMEOUT, retryable: true },
-            );
-          }
-          finishShutdown(`Shutdown timeout (${timeout / 1000}s) — cancelled ${pooledIds.length} pooled agent(s) for retry.`, 1);
+          void cancelTimedOutPooled(pooledIds).catch((err) => {
+            e.log('error', `Pooled shutdown cleanup failed: ${err.message}`);
+            finishShutdown(`Shutdown cleanup failed after timeout: ${err.message}`, 1);
+          });
         }
       }, 2000);
     }

package/engine/create-pr-worktree.js

@@ -1,7 +1,7 @@
 /**
  * engine/create-pr-worktree.js — checkout-mode-aware Create-PR staging.
  *
- * Background (the bug this fixes): the CC "Create PR" flow has the LLM commit /
+ * Background (the bug this fixes): the CC "Create PR" flow used to have the LLM commit /
  * branch / push directly in the project's LIVE operator checkout
  * (`project.localPath`). For a `checkoutMode: "worktree"` project that is wrong —
  * a misstep by the LLM (committing before branching, freelancing `git pull`)
@@ -10,16 +10,13 @@
  *   - `live`     → operate in the live checkout (handled by the existing flow);
  *   - `worktree` → operate in an isolated git worktree, never the live checkout.
  *
- * This module implements the `worktree` path. `prepareCreatePrWorktree` moves the
- * uncommitted edits CC made in the live checkout into a fresh worktree (created
- * off the same base commit, on a new branch) and then restores the live checkout
- * clean — DETERMINISTICALLY, server-side, so nothing relies on the LLM running
- * git correctly. CC is then told to commit / push / open the PR inside the
- * returned worktree path, and to call `cleanupCreatePrWorktree` when done.
+ * This module implements the `worktree` path. `prepareCreatePrWorktree` copies
+ * pre-existing operator edits into a fresh worktree created from the configured
+ * main tip. The source checkout is never reset, cleaned, checked out, or deleted
+ * from; the operator remains the sole owner of that tree.
  *
- * Safety ordering: the worktree is populated and verified BEFORE the live
- * checkout is touched. If applying the diff fails, the worktree is removed and
- * the live checkout is left exactly as it was — the operator never loses work.
+ * If applying the diff fails, the worktree is removed and the source checkout is
+ * left exactly as it was.
  */
 
 const fs = require('fs');
@@ -29,16 +26,15 @@ const shared = require('./shared');
 const PATCH_APPLY_TIMEOUT_MS = 120000;
 
 /**
- * Move a worktree-mode project's uncommitted live-checkout changes into an
- * isolated worktree and restore the live checkout clean.
+ * Copy a worktree-mode project's uncommitted operator changes into an isolated
+ * worktree without modifying the source checkout.
  *
  * @returns {Promise<{ ok:true, worktreePath, branch, baseBranch, baseSha,
  *   trackedChanged:boolean, untrackedCount:number } | { ok:false, reason:string }>}
- * @throws on a git/fs failure AFTER which the live checkout is guaranteed
- *   untouched (the operator keeps their work).
+ * @throws on a git/fs failure; the source checkout remains untouched.
  */
 async function prepareCreatePrWorktree({
-  project, branch, minionsDir, engine, log = () => {}, _git, _fs,
+  project, projects, branch, minionsDir, engine, log = () => {}, _git, _fs,
 } = {}) {
   const git = _git || ((args, opts) => shared.shellSafeGit(args, opts));
   const fsm = _fs || fs;
@@ -49,12 +45,15 @@ async function prepareCreatePrWorktree({
   if (!localPath) {
     throw new Error('prepareCreatePrWorktree: project.localPath required');
   }
+  if (shared.resolveCheckoutMode(project, shared.WORK_TYPE.IMPLEMENT) !== shared.CHECKOUT_MODES.WORKTREE) {
+    throw new Error('prepareCreatePrWorktree: project must use checkoutMode "worktree"');
+  }
   const mainBranch = (project.mainBranch && String(project.mainBranch).trim()) || 'main';
 
-  // 1. Capture the uncommitted state from the live checkout.
-  const baseSha = (await git(['-C', localPath, 'rev-parse', 'HEAD'])).trim();
-  if (!/^[0-9a-f]{7,40}$/i.test(baseSha)) {
-    throw new Error(`prepareCreatePrWorktree: could not resolve HEAD in ${localPath} (got ${JSON.stringify(baseSha)})`);
+  // 1. Capture the uncommitted state from the protected operator checkout.
+  const sourceHeadSha = (await git(['-C', localPath, 'rev-parse', 'HEAD'])).trim();
+  if (!/^[0-9a-f]{7,40}$/i.test(sourceHeadSha)) {
+    throw new Error(`prepareCreatePrWorktree: could not resolve HEAD in ${localPath} (got ${JSON.stringify(sourceHeadSha)})`);
   }
   // `git diff HEAD --binary` captures staged + unstaged tracked changes
   // (including deletions and binary deltas) as a single patch.
@@ -70,9 +69,29 @@ async function prepareCreatePrWorktree({
     return { ok: false, reason: 'no-changes' };
   }
 
-  // 2. Create an isolated worktree off the SAME base commit the edits were made
-  //    against, on a NEW branch (so it never collides with `main` being checked
-  //    out in the live tree, and never commits onto a shared branch).
+  // 2. Resolve the configured main tip without changing the operator checkout.
+  // Prefer the fetched remote-tracking ref; local-only repos fall back to the
+  // local main branch.
+  try {
+    await git(['-C', localPath, 'fetch', 'origin', mainBranch], { timeout: 30000 });
+  } catch (e) {
+    log('warn', `[cc-create-pr] fetch origin ${mainBranch} failed; trying local ${mainBranch}: ${e.message}`);
+  }
+  let baseSha = '';
+  for (const ref of [`refs/remotes/origin/${mainBranch}`, `refs/heads/${mainBranch}`]) {
+    try {
+      baseSha = (await git(['-C', localPath, 'rev-parse', '--verify', ref])).trim();
+    } catch { /* try next base */ }
+    if (/^[0-9a-f]{7,40}$/i.test(baseSha)) break;
+    baseSha = '';
+  }
+  if (!baseSha) {
+    throw new Error(`prepareCreatePrWorktree: could not resolve origin/${mainBranch} or local ${mainBranch}`);
+  }
+
+  // 3. Create a fresh isolated branch from main, then apply only the captured
+  // uncommitted changes. Topic commits currently checked out by the operator
+  // never enter the PR.
   const uid = shared.uid();
   const sanitized = String(project.name || 'project').replace(/[^a-zA-Z0-9._-]/g, '-').slice(0, 40) || 'project';
   const requested = branch && String(branch).trim();
@@ -86,6 +105,7 @@ async function prepareCreatePrWorktree({
   const wtRel = (engine && engine.worktreeRoot) || shared.ENGINE_DEFAULTS.worktreeRoot;
   const worktreesBase = path.resolve(projectRoot, wtRel);
   const wtPath = path.join(worktreesBase, `cc-createpr-${sanitized}-${uid}`);
+  shared.assertWorktreeOutsideProjects(wtPath, Array.isArray(projects) ? projects : [project]);
   try { fsm.mkdirSync(worktreesBase, { recursive: true }); } catch { /* best-effort; worktree add will surface a real failure */ }
 
   await git(
@@ -94,8 +114,8 @@ async function prepareCreatePrWorktree({
   );
   try { shared.writeWorktreeOwnerMarker(wtPath, { source: 'cc-create-pr', project: project.name }); } catch { /* marker is best-effort */ }
 
-  // 3. Reproduce the live-checkout changes inside the worktree. If anything here
-  //    fails, tear the worktree down and leave the live checkout untouched.
+  // 4. Reproduce the operator-checkout changes inside the worktree. If anything
+  //    here fails, tear the worktree down and leave the source untouched.
   try {
     if (hasTracked) {
       const patchFile = path.join(wtPath, `.cc-createpr-${uid}.patch`);
@@ -111,64 +131,15 @@ async function prepareCreatePrWorktree({
     }
   } catch (e) {
     // Tear the worktree down via shared.removeWorktree (EPERM/EBUSY retry +
-    // escalation + real-repo refusal — CLAUDE.md footgun #6). The live checkout
-    // has NOT been touched yet at this point, so the operator keeps their work.
+    // escalation + real-repo refusal — CLAUDE.md footgun #6).
     try { shared.removeWorktree(wtPath, projectRoot, worktreesBase); } catch { /* leak rather than throw a second error */ }
     throw new Error(
       `prepareCreatePrWorktree: failed to stage changes into the worktree — ${e.message}. ` +
-      'The live checkout was left untouched.',
-    );
-  }
-
-  // 4. The worktree now holds the changes — restore the live checkout clean.
-  //    The captured edits are SAFE in the worktree (step 3 verified), so the
-  //    documented job here is to return the live checkout to a clean HEAD.
-  //    Use `git reset --hard HEAD` (NOT `git checkout -- .`): the old
-  //    working-tree-only revert left the STAGED INDEX intact, so any change CC
-  //    had `git add`-ed stayed staged → the live checkout was reported "restored"
-  //    while still dirty, wedging the next Create-PR / live dispatch (the
-  //    operator's "no recovery from dirty checkout"). `reset --hard` reverts
-  //    staged + unstaged tracked changes in one shot; untracked entries are
-  //    removed surgically below (only the ones we captured — never ignored or
-  //    pre-existing untracked files, which `git clean` would wrongly nuke).
-  //    This `reset --hard` is intentional and scoped to THIS Create-PR-worktree
-  //    staging flow whose explicit contract is to restore the live checkout
-  //    clean — it is NOT the live-checkout DISPATCH mode (which never resets).
-  const residualUntracked = [];
-  try {
-    await git(['-C', localPath, 'reset', '--hard', 'HEAD']);
-    for (const rel of untracked) {
-      const target = path.join(localPath, rel.replace(/\/$/, ''));
-      try {
-        // Retry transient Windows file locks (EBUSY/EPERM/ENOTEMPTY) before
-        // giving up — a single failed unlink is what left the tree dirty. A few
-        // quick retries ride out a transient AV/indexer lock without a long stall.
-        shared._retryFsOp(() => fsm.rmSync(target, { recursive: true, force: true }), `cc-create-pr rm ${rel}`, { attempts: 4, baseMs: 100 });
-      } catch (rmErr) {
-        residualUntracked.push(rel);
-        log('warn', `[cc-create-pr] could not remove untracked ${rel} from live checkout after retries: ${rmErr.message}`);
-      }
-    }
-  } catch (e) {
-    // shared.removeWorktree carries the EPERM/EBUSY retry + escalation +
-    // real-repo refusal (CLAUDE.md footgun #6 — don't hand-roll force-remove).
-    try { shared.removeWorktree(wtPath, projectRoot, worktreesBase); } catch { /* leak rather than double-throw */ }
-    throw new Error(
-      `prepareCreatePrWorktree: failed to restore live checkout — ${e.message}. ` +
-      `Worktree at ${wtPath} may need manual cleanup.`,
+      'The operator checkout was left untouched.',
     );
   }
 
-  // If untracked removal could not fully clean the live tree, surface it in the
-  // return (liveTreeDirty) instead of silently reporting success — the caller
-  // can warn CC / the operator rather than letting the residue wedge the next
-  // dispatch with a phantom "dirty" refusal.
-  const liveTreeDirty = residualUntracked.length > 0;
-  if (liveTreeDirty) {
-    log('warn', `[cc-create-pr] live checkout ${localPath} left with ${residualUntracked.length} residual untracked path(s) after staging; surfacing liveTreeDirty`);
-  } else {
-    log('info', `[cc-create-pr] staged ${project.name} changes into isolated worktree ${wtPath} on branch ${branchName} (live checkout restored)`);
-  }
+  log('info', `[cc-create-pr] copied ${project.name} changes into isolated worktree ${wtPath} on branch ${branchName}; operator checkout preserved`);
   return {
     ok: true,
     worktreePath: wtPath,
@@ -177,8 +148,7 @@ async function prepareCreatePrWorktree({
     baseSha,
     trackedChanged: hasTracked,
     untrackedCount: untracked.length,
-    liveTreeDirty,
-    residualUntracked,
+    sourceCheckoutPreserved: true,
   };
 }
 
@@ -187,7 +157,7 @@ async function prepareCreatePrWorktree({
  * touch a path that doesn't carry the minions ownership marker (so a bad/forged
  * path can never delete an arbitrary directory).
  */
-async function cleanupCreatePrWorktree({ worktreePath, project, _git, _fs } = {}) {
+async function cleanupCreatePrWorktree({ worktreePath, project, projects, _git, _fs } = {}) {
   const git = _git || ((args, opts) => shared.shellSafeGit(args, opts));
   const fsm = _fs || fs;
   if (!worktreePath || typeof worktreePath !== 'string') {
@@ -200,6 +170,14 @@ async function cleanupCreatePrWorktree({ worktreePath, project, _git, _fs } = {}
   if (!shared.hasWorktreeOwnerMarker(worktreePath)) {
     return { ok: false, reason: 'not-owned' };
   }
+  try {
+    shared.assertWorktreeOutsideProjects(
+      worktreePath,
+      Array.isArray(projects) ? projects : (project ? [project] : shared.getProjects()),
+    );
+  } catch {
+    return { ok: false, reason: 'protected-project-overlap' };
+  }
   const fromDir = (project && project.localPath) || worktreePath;
   try {
     await git(['-C', fromDir, 'worktree', 'remove', '--force', worktreePath]);

package/engine/keep-process-sweep.js

@@ -81,6 +81,20 @@ function validateKeepPidsRecord(parsed, opts) {
   if (typeof parsed.cwd === 'string' && parsed.cwd.length > 500) {
     return { ok: false, reason: 'cwd-too-long' };
   }
+  if (opts.allowedCwdRoot) {
+    if (typeof parsed.cwd !== 'string' || parsed.cwd.length === 0) {
+      return { ok: false, reason: INVALID_WORKDIR_REASON_PREFIX + 'cwd-required-for-dispatch-confinement' };
+    }
+    try {
+      const cwdReal = shared.realPathForComparison(parsed.cwd);
+      const rootReal = shared.realPathForComparison(opts.allowedCwdRoot);
+      if (!shared.isPathInsideOrEqual(cwdReal, rootReal)) {
+        return { ok: false, reason: INVALID_WORKDIR_REASON_PREFIX + 'cwd-outside-dispatch-worktree' };
+      }
+    } catch (err) {
+      return { ok: false, reason: INVALID_WORKDIR_REASON_PREFIX + 'cwd-containment-check-failed (' + err.message + ')' };
+    }
+  }
   // W-mp6k7ywi000fa33c — when the engine requires a real git workdir
   // (default true; per-WI override via `meta.keep_processes_skip_workdir_check`),
   // verify the recorded `cwd` looks like a real worktree. Empty/missing
@@ -110,22 +124,105 @@ function validateKeepPidsRecord(parsed, opts) {
   if (parsed.wi_id != null && typeof parsed.wi_id !== 'string') {
     return { ok: false, reason: 'wi_id-not-string' };
   }
+  for (const field of ['project', 'work_type', 'checkout_mode', 'dispatch_root']) {
+    if (parsed[field] != null && typeof parsed[field] !== 'string') {
+      return { ok: false, reason: field + '-not-string' };
+    }
+  }
+
+  let canonicalCwd = typeof parsed.cwd === 'string' ? parsed.cwd : '';
+  if (canonicalCwd) {
+    try { canonicalCwd = shared.realPathForComparison(canonicalCwd); }
+    catch (err) {
+      return { ok: false, reason: INVALID_WORKDIR_REASON_PREFIX + 'cwd-canonicalization-failed (' + err.message + ')' };
+    }
+  }
+  let canonicalDispatchRoot = typeof parsed.dispatch_root === 'string' ? parsed.dispatch_root : '';
+  if (canonicalDispatchRoot) {
+    try { canonicalDispatchRoot = shared.realPathForComparison(canonicalDispatchRoot); }
+    catch (err) {
+      return { ok: false, reason: INVALID_WORKDIR_REASON_PREFIX + 'dispatch-root-canonicalization-failed (' + err.message + ')' };
+    }
+  }
 
   return {
     ok: true,
     value: {
       pids: pids,
       purpose: typeof parsed.purpose === 'string' ? parsed.purpose : '',
-      cwd: typeof parsed.cwd === 'string' ? parsed.cwd : '',
+      cwd: canonicalCwd,
       ports: Array.isArray(parsed.ports) ? parsed.ports.map(Number) : [],
       expires_at: parsed.expires_at,
       expiresAtMs: expiresAtMs,
       written_by: typeof parsed.written_by === 'string' ? parsed.written_by : '',
       wi_id: typeof parsed.wi_id === 'string' ? parsed.wi_id : '',
+      project: typeof parsed.project === 'string' ? parsed.project : '',
+      work_type: typeof parsed.work_type === 'string' ? parsed.work_type : '',
+      checkout_mode: typeof parsed.checkout_mode === 'string' ? parsed.checkout_mode : '',
+      dispatch_root: canonicalDispatchRoot,
     },
   };
 }
 
+function validateKeepProcessExecutionContext(record, opts) {
+  opts = opts || {};
+  if (!record) return { ok: false, reason: 'record-missing' };
+  if (!record.cwd) {
+    return record.checkout_mode || record.dispatch_root
+      ? { ok: false, reason: 'cwd-missing' }
+      : { ok: true, legacy: true };
+  }
+  let projects;
+  try {
+    projects = Array.isArray(opts.projects) ? opts.projects : shared.getProjects(opts.config);
+  } catch {
+    return { ok: false, reason: 'project-config-unavailable' };
+  }
+
+  for (const project of projects) {
+    if (!project?.localPath) continue;
+    const mode = shared.resolveCheckoutMode(
+      project,
+      record.work_type || shared.WORK_TYPE.IMPLEMENT,
+    );
+    if (mode !== shared.CHECKOUT_MODES.WORKTREE) continue;
+    try {
+      if (shared.pathsOverlap(record.cwd, project.localPath)) {
+        return { ok: false, reason: 'cwd-overlaps-worktree-mode-operator-checkout' };
+      }
+    } catch {
+      return { ok: false, reason: 'cwd-overlap-check-failed' };
+    }
+  }
+
+  const project = record.project ? shared.findProjectByName(projects, record.project) : null;
+  if (project && shared.resolveCheckoutMode(project, record.work_type || shared.WORK_TYPE.IMPLEMENT) === shared.CHECKOUT_MODES.LIVE) {
+    try {
+      if (!shared.isPathInsideOrEqual(record.cwd, project.localPath)) {
+        return { ok: false, reason: 'live-cwd-outside-project' };
+      }
+    } catch {
+      return { ok: false, reason: 'live-cwd-unavailable' };
+    }
+    return { ok: true };
+  }
+
+  if (!record.dispatch_root) {
+    return record.checkout_mode
+      ? { ok: false, reason: 'dispatch-root-missing' }
+      : { ok: true, legacy: true };
+  }
+  try {
+    shared.assertWorktreeOutsideProjects(record.dispatch_root, projects);
+    if (!shared.isPathInsideOrEqual(record.cwd, record.dispatch_root)) {
+      return { ok: false, reason: 'cwd-outside-dispatch-root' };
+    }
+  } catch {
+    return { ok: false, reason: 'dispatch-root-overlaps-operator-checkout' };
+  }
+  return { ok: true };
+}
+
 function readKeepPidsFile(agentId, opts) {
   opts = opts || {};
   const filePath = path.join(_agentsDir(), agentId, KEEP_PIDS_FILENAME);
@@ -198,6 +295,16 @@ function sweepKeepProcesses(opts) {
     const value = rec.value;
     const filePath = rec.filePath;
     const agentId = rec.agentId;
+    const executionContext = validateKeepProcessExecutionContext(value, opts);
+    if (!executionContext.ok) {
+      for (const pid of value.pids) {
+        if (killOne(pid)) stats.killedPids++;
+        _audit('unsafe-context-kill', { agentId, pid, reason: executionContext.reason, wi_id: value.wi_id });
+      }
+      try { fs.unlinkSync(filePath); } catch {}
+      log('warn', 'keep-processes: removed unsafe execution context for ' + agentId + ' — ' + executionContext.reason);
+      continue;
+    }
     if (value.expiresAtMs < now) {
       let killed = 0;
       for (const pid of value.pids) {
@@ -227,6 +334,7 @@ function getActiveAnchorPids(opts) {
   for (const rec of listAllKeepPidsFiles({ now: now })) {
     if (!rec.valid) continue;
     if (rec.value.expiresAtMs < now) continue;
+    if (!validateKeepProcessExecutionContext(rec.value, opts).ok) continue;
     for (const pid of rec.value.pids) out.add(pid);
   }
   return out;
@@ -237,13 +345,7 @@ function getActiveAnchorPidsForAgent(agentId, opts) {
   const now = Number.isFinite(opts.now) ? opts.now : Date.now();
   const out = new Set();
   if (!agentId) return { pids: out, record: null };
-  // W-mp6k7ywi000fa33c — forward `requireGitWorkdir` (and any future opts)
-  // so the per-WI override path can disable workdir validation. Earlier
-  // implementation only forwarded `now`, which silently ignored opts.
-  const readOpts = { now: now };
-  if (Object.prototype.hasOwnProperty.call(opts, 'requireGitWorkdir')) {
-    readOpts.requireGitWorkdir = opts.requireGitWorkdir;
-  }
+  const readOpts = { ...opts, now };
   const rec = readKeepPidsFile(String(agentId), readOpts);
   if (!rec) return { pids: out, record: null };
   if (!rec.valid) {
@@ -251,10 +353,26 @@ function getActiveAnchorPidsForAgent(agentId, opts) {
     return { pids: out, record: null, reason: rec.reason };
   }
   if (rec.value.expiresAtMs < now) return { pids: out, record: rec.value, reason: 'expired' };
+  const executionContext = validateKeepProcessExecutionContext(rec.value, opts);
+  if (!executionContext.ok) return { pids: out, record: rec.value, reason: executionContext.reason };
   for (const pid of rec.value.pids) out.add(pid);
   return { pids: out, record: rec.value };
 }
 
+function getActiveKeepProcessCwds(opts) {
+  opts = opts || {};
+  const now = Number.isFinite(opts.now) ? opts.now : Date.now();
+  const out = [];
+  for (const rec of listAllKeepPidsFiles({ now })) {
+    if (!rec.valid || rec.value.expiresAtMs < now || !rec.value.cwd) continue;
+    if (!validateKeepProcessExecutionContext(rec.value, opts).ok) continue;
+    if (alivePids(rec.value.pids, opts).length === 0) continue;
+    try { out.push(shared.realPathForComparison(rec.value.cwd)); }
+    catch { /* malformed/unreachable cwd contributes no anchor */ }
+  }
+  return out;
+}
+
 function computeReapPlan(descendants, agentId, opts) {
   opts = opts || {};
   const list = (Array.isArray(descendants) ? descendants : []).map(Number)
@@ -311,6 +429,7 @@ function evaluateKeepPidsAcceptance(agentId, opts) {
       record: rec.value,
       recordedCwd: rec.value.cwd || null,
       filePath: rec.filePath,
+      parsedRaw: rec.parsed || null,
     };
   }
   const reason = rec.reason || 'unknown';
@@ -368,7 +487,7 @@ function buildKeepProcessesHint(opts) {
     '{',
     '  "pids": [12345, 12346],',
     '  "purpose": "bun run dev (Constellation server + dashboard)",',
-    '  "cwd": "D:/repos/constellation",',
+    '  "cwd": "<absolute path at or below MINIONS_AGENT_CWD>",',
     '  "ports": [3001, 5173],',
     '  "expires_at": "<ISO-8601 timestamp <= ' + ttl + ' minutes from now>",',
     '  "written_by": "' + agentId + '",',
@@ -377,6 +496,7 @@ function buildKeepProcessesHint(opts) {
     '```',
     '',
     'Caps the engine enforces: max ' + maxPids + ' PIDs, TTL <= ' + maxTtl + ' minutes, `purpose`/`cwd` <= 500 chars, <= 20 ports. Files outside the cap are dropped (engine reaps as normal) and a warning is logged.',
+    '`cwd` MUST resolve at or below the current dispatch root from `MINIONS_AGENT_CWD`. The operator checkout is rejected for worktree-mode dispatches, even when it is a valid Git checkout.',
     '',
     'If you do NOT write the file, the engine will kill ALL of your descendant processes when you exit (today\'s default). Do not write the file unless you are intentionally leaving a process behind for the human or follow-up work.',
     '',
@@ -452,6 +572,8 @@ module.exports = {
   sweepKeepProcesses: sweepKeepProcesses,
   getActiveAnchorPids: getActiveAnchorPids,
   getActiveAnchorPidsForAgent: getActiveAnchorPidsForAgent,
+  getActiveKeepProcessCwds: getActiveKeepProcessCwds,
+  validateKeepProcessExecutionContext: validateKeepProcessExecutionContext,
   computeReapPlan: computeReapPlan,
   buildKeepProcessesHint: buildKeepProcessesHint,
   evaluateKeepPidsAcceptance: evaluateKeepPidsAcceptance,

package/engine/lifecycle.js

@@ -3501,7 +3501,7 @@ async function rebaseBranchOntoMain(pr, project, config) {
   // and produce mirror writes. Misconfigured engine.worktreeRoot is the only
   // way this lands inside root; the assert throws so the caller can recover.
   try {
-    shared.assertWorktreeOutsideProject(tmpWt, root);
+    shared.assertWorktreeOutsideProjects(tmpWt, shared.getProjects(config));
   } catch (err) {
     log('warn', `Post-merge rebase: refusing nested worktree path — ${err.message}`);
     return { success: false, error: err.message };

package/engine/live-checkout.js

@@ -2034,6 +2034,7 @@ async function applyLiveCheckoutAutoStash(opts = {}) {
  *
  * @param {object} opts
  * @param {object} opts.item                 persisted dispatch record (has id, originalRef, meta.branch, meta.project.{localPath,name})
+ * @param {object} [opts.config]              current config; worktree mode makes this helper fail closed
  * @param {boolean} [opts.isTerminalFailure]  true on error/timeout/crash
  * @param {string}  [opts.resultLabel]        short status word for the alert body
  * @param {function} [opts.log]               (level, msg) => void
@@ -2043,8 +2044,9 @@ async function applyLiveCheckoutAutoStash(opts = {}) {
  * @returns {Promise<object>} restore result (or { skipped:true } for a non-live record)
  */
 async function maybeRestoreLiveCheckoutFromRecord(opts = {}) {
-  const { item, isTerminalFailure, resultLabel, log, writeInboxAlert, gitOpts, _git } = opts;
-  if (!item || !item.originalRef || !item.meta?.branch || !item.meta?.project?.localPath) {
+  const { item, config, isTerminalFailure, resultLabel, log, writeInboxAlert, gitOpts, _git } = opts;
+  if (!shared.isLiveCheckoutDispatchRecord(item, config)
+      || !item.originalRef || !item.meta?.branch || !item.meta?.project?.localPath) {
     return { restored: false, reason: 'not-live-record', skipped: true };
   }
   try {