cc-workspace 4.2.0 → 4.2.1

package/bin/cli.js

@@ -225,7 +225,8 @@ function generateSettings(orchDir) {
         // block-orchestrator-writes.sh is NOT here — it's in team-lead agent
         // frontmatter only. Putting it in settings.json would block teammates
         // from writing in their worktrees.
-        withMatcher("Teammate", "validate-spawn-prompt.sh", 5)
+        withMatcher("Teammate", "validate-spawn-prompt.sh", 5),
+        withMatcher("Bash", "guard-session-checkout.sh", 5)
       ],
       SessionStart: [
         withoutMatcher("session-start-context.sh", 10)

package/global-skills/agents/implementer.md

@@ -19,11 +19,16 @@ You are a focused implementer. You receive tasks and deliver clean code.
 ## Git workflow (CRITICAL — do this first)
 You are in a temporary worktree. If you don't commit, YOUR WORK WILL BE LOST.
 
-1. **FIRST**: check out the session branch specified in your instructions:
-   `git checkout session/{name}`
+**CRITICAL**: Do NOT run `git checkout` in the main repo. Do NOT use `git -C ../repo checkout`.
+You are already in an isolated worktree — all git commands run HERE, not in the main repo.
+
+1. **FIRST**: Switch to the session branch inside your worktree:
+   `git checkout session/{name}` (safe — you're in a worktree)
 2. **Verify**: `git branch --show-current` must show `session/{name}`
-3. **Commit after each logical unit** — never wait until the end
-4. **Before reporting back**: `git status` must show clean working tree.
+3. If checkout fails: `git fetch origin session/{name}` then retry
+4. **Do NOT stay on `worktree-agent-*` branches** — always switch to the session branch
+5. **Commit after each logical unit** — never wait until the end
+6. **Before reporting back**: `git status` must show clean working tree.
    If anything is uncommitted: COMMIT IT NOW before reporting.
 
 ## Workflow

package/global-skills/agents/team-lead.md

@@ -102,8 +102,15 @@ If active sessions exist, display them:
 ### During dispatch
 - Include the session branch in every teammate spawn prompt
 - Teammates use the session branch — they do NOT create their own branches
-- The spawn prompt must say: "Branch session/{name} ALREADY EXISTS.
-  Create your worktree from this branch. ALL commits go on this branch."
+- The spawn prompt MUST include these EXACT instructions:
+  ```
+  CRITICAL: Do NOT run `git checkout` in the main repo. Do NOT use `git -C ../repo checkout`.
+  You are in an isolated worktree — all git commands run HERE.
+  1. git checkout session/{name}  (switch to session branch inside your worktree)
+  2. git branch --show-current    (verify: must show session/{name})
+  3. Do NOT stay on worktree-agent-* branches — use the session branch.
+  Branch session/{name} ALREADY EXISTS. ALL commits go on this branch.
+  ```
 
 ### During collection
 - Verify commits are on the session branch via Task subagent:

package/global-skills/dispatch-feature/references/spawn-templates.md

@@ -15,16 +15,24 @@ You are teammate-[service]. Read the CLAUDE.md in your repo first.
 You are working in a temporary worktree. If you don't commit, YOUR WORK WILL BE LOST
 when the worktree is cleaned up.
 
-1. FIRST THING: check out the session branch:
+CRITICAL: Do NOT run `git checkout` in the main repo. Do NOT use `git -C ../repo checkout`.
+You are already in an isolated worktree — all git commands run HERE, not in the main repo.
+
+1. FIRST THING: Switch to the session branch inside your worktree:
    git checkout session/{session-name}
+   (This is safe — you are in a worktree, not the main repo)
 2. Verify you are on the right branch:
    git branch --show-current  (must show: session/{session-name})
-3. Commit AFTER EACH logical unit — do NOT wait until the end
-4. Before reporting back, verify ALL changes are committed:
+3. If checkout fails with "did not match any file(s)":
+   git fetch origin session/{session-name}
+   git checkout session/{session-name}
+4. Commit AFTER EACH logical unit — do NOT wait until the end
+5. Before reporting back, verify ALL changes are committed:
    git status  (must show: nothing to commit, working tree clean)
-5. If git status shows uncommitted changes when you're done: COMMIT THEM NOW
+6. If git status shows uncommitted changes when you're done: COMMIT THEM NOW
 
 Branch `session/{session-name}` ALREADY EXISTS. Do NOT create other branches.
+Do NOT create branches named worktree-agent-* — use the session branch.
 
 ## Constitution (non-negotiable)
 [paste all rules from your workspace's constitution.md]
@@ -70,16 +78,24 @@ You are teammate-[service]. Read the CLAUDE.md in your repo first.
 You are working in a temporary worktree. If you don't commit, YOUR WORK WILL BE LOST
 when the worktree is cleaned up.
 
-1. FIRST THING: check out the session branch:
+CRITICAL: Do NOT run `git checkout` in the main repo. Do NOT use `git -C ../repo checkout`.
+You are already in an isolated worktree — all git commands run HERE, not in the main repo.
+
+1. FIRST THING: Switch to the session branch inside your worktree:
    git checkout session/{session-name}
+   (This is safe — you are in a worktree, not the main repo)
 2. Verify you are on the right branch:
    git branch --show-current  (must show: session/{session-name})
-3. Commit AFTER EACH logical unit — do NOT wait until the end
-4. Before reporting back, verify ALL changes are committed:
+3. If checkout fails with "did not match any file(s)":
+   git fetch origin session/{session-name}
+   git checkout session/{session-name}
+4. Commit AFTER EACH logical unit — do NOT wait until the end
+5. Before reporting back, verify ALL changes are committed:
    git status  (must show: nothing to commit, working tree clean)
-5. If git status shows uncommitted changes when you're done: COMMIT THEM NOW
+6. If git status shows uncommitted changes when you're done: COMMIT THEM NOW
 
 Branch `session/{session-name}` ALREADY EXISTS. Do NOT create other branches.
+Do NOT create branches named worktree-agent-* — use the session branch.
 
 ## Constitution (non-negotiable)
 [paste all rules from your workspace's constitution.md]
@@ -128,16 +144,24 @@ You are teammate-[service]. Read the CLAUDE.md in your repo first.
 You are working in a temporary worktree. If you don't commit, YOUR WORK WILL BE LOST
 when the worktree is cleaned up.
 
-1. FIRST THING: check out the session branch:
+CRITICAL: Do NOT run `git checkout` in the main repo. Do NOT use `git -C ../repo checkout`.
+You are already in an isolated worktree — all git commands run HERE, not in the main repo.
+
+1. FIRST THING: Switch to the session branch inside your worktree:
    git checkout session/{session-name}
+   (This is safe — you are in a worktree, not the main repo)
 2. Verify you are on the right branch:
    git branch --show-current  (must show: session/{session-name})
-3. Commit AFTER EACH logical unit — do NOT wait until the end
-4. Before reporting back, verify ALL changes are committed:
+3. If checkout fails with "did not match any file(s)":
+   git fetch origin session/{session-name}
+   git checkout session/{session-name}
+4. Commit AFTER EACH logical unit — do NOT wait until the end
+5. Before reporting back, verify ALL changes are committed:
    git status  (must show: nothing to commit, working tree clean)
-5. If git status shows uncommitted changes when you're done: COMMIT THEM NOW
+6. If git status shows uncommitted changes when you're done: COMMIT THEM NOW
 
 Branch `session/{session-name}` ALREADY EXISTS. Do NOT create other branches.
+Do NOT create branches named worktree-agent-* — use the session branch.
 
 ## Constitution (non-negotiable)
 [paste all rules from your workspace's constitution.md]

package/global-skills/hooks/guard-session-checkout.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+# guard-session-checkout.sh
+# PreToolUse hook (matcher: Bash): blocks `git checkout session/` in main repos.
+# Session branches must only be checked out INSIDE worktrees, never in main repos
+# (doing so disrupts other parallel sessions).
+# v4.2.1: hard guardrail — this hook BLOCKS (exit 0 + deny JSON).
+set -euo pipefail
+
+INPUT=$(cat)
+COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null) || true
+
+[ -z "$COMMAND" ] && exit 0
+
+# Only care about git checkout/switch targeting session/ branches
+if ! echo "$COMMAND" | grep -qE 'git\s+(checkout|switch)\s+.*session/' 2>/dev/null; then
+    exit 0
+fi
+
+# Pattern 1: git -C <repo> checkout session/ — always wrong (targets main repo from outside)
+if echo "$COMMAND" | grep -qE 'git\s+-C\s+\S+\s+(checkout|switch)\s+.*session/' 2>/dev/null; then
+    printf '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"BLOCKED: git checkout session/ with -C targets the main repo directly. This disrupts other parallel sessions. You are in a worktree — run `git checkout session/{name}` from INSIDE your worktree (without -C) instead. If you are not in a worktree, something is wrong with your isolation setup."}}'
+    exit 0
+fi
+
+# Pattern 2: git checkout session/ without -C — check if we are in a main repo
+# In a worktree, .git is a FILE (gitdir pointer). In a main repo, .git is a DIRECTORY.
+if [ -d ".git" ] && [ ! -f ".git" ]; then
+    printf '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"BLOCKED: git checkout session/ detected in a main repo (not a worktree). Checking out a session branch in the main repo disrupts other parallel sessions. You must work in an isolated worktree. If you are a teammate, your worktree should already exist — run `git checkout session/{name}` from inside it."}}'
+    exit 0
+fi
+
+# We are in a worktree (.git is a file) — allow the checkout
+exit 0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cc-workspace",
-  "version": "4.2.0",
+  "version": "4.2.1",
   "description": "Claude Code multi-workspace orchestrator — skills, hooks, agents, and templates for multi-service projects",
   "bin": {
     "cc-workspace": "./bin/cli.js"