cc-workspace 4.2.0 → 4.3.0

package/bin/cli.js

@@ -225,6 +225,9 @@ function generateSettings(orchDir) {
         // block-orchestrator-writes.sh is NOT here — it's in team-lead agent
         // frontmatter only. Putting it in settings.json would block teammates
         // from writing in their worktrees.
+        // guard-session-checkout.sh is NOT here — it's in implementer agent
+        // frontmatter only. team-lead doesn't have Bash, and teammates don't
+        // inherit orchestrator hooks.
         withMatcher("Teammate", "validate-spawn-prompt.sh", 5)
       ],
       SessionStart: [
@@ -416,7 +419,7 @@ function updateLocal() {
   const hooksDir = path.join(orchDir, ".claude", "hooks");
   if (fs.existsSync(hooksDir)) {
     // Clean obsolete hooks before copying new ones
-    const obsoleteHooks = ["block-orchestrator-writes.sh", "worktree-create-context.sh", "verify-cycle-complete.sh"];
+    const obsoleteHooks = ["block-orchestrator-writes.sh", "worktree-create-context.sh", "verify-cycle-complete.sh", "guard-session-checkout.sh"];
     for (const f of obsoleteHooks) {
       const fp = path.join(hooksDir, f);
       if (fs.existsSync(fp)) fs.unlinkSync(fp);

package/global-skills/agents/implementer.md

@@ -2,43 +2,99 @@
 name: implementer
 description: >
   Implementation teammate for a single service. Receives tasks from the
-  orchestrator, implements in an isolated worktree, runs tests, reports back.
-  Used via Task tool when explicit worktree isolation is needed for subagents
+  orchestrator, implements in a worktree of the target repo, runs tests,
+  reports back. Used via Task tool for subagents needing code isolation
   (Agent Teams teammates get automatic isolation).
-isolation: worktree
 model: sonnet
 tools: Read, Write, Edit, MultiEdit, Bash, Glob, Grep
 memory: project
 maxTurns: 50
+hooks:
+  PreToolUse:
+    - matcher: Bash
+      hooks:
+        - type: command
+          command: |
+            INPUT=$(cat)
+            CMD=$(echo "$INPUT" | jq -r '.tool_input.command // empty') || true
+            [ -z "$CMD" ] && exit 0
+            # Block git checkout/switch in sibling repos (would disrupt main working tree)
+            if echo "$CMD" | grep -qE 'git\s+(-C\s+\.\./\S+\s+)?(checkout|switch)\s'; then
+              # Allow checkout inside /tmp/ worktrees (that's the intended workflow)
+              if echo "$CMD" | grep -qE '^\s*cd\s+/tmp/' || echo "$CMD" | grep -qE 'git\s+-C\s+/tmp/'; then
+                exit 0
+              fi
+              printf '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"BLOCKED: git checkout/switch targets a main repo. Use your /tmp/ worktree instead. See Git workflow instructions."}}'
+              exit 0
+            fi
+            exit 0
+          timeout: 5
 ---
 
 # Implementer — Service Teammate
 
 You are a focused implementer. You receive tasks and deliver clean code.
 
-## Git workflow (CRITICAL — do this first)
-You are in a temporary worktree. If you don't commit, YOUR WORK WILL BE LOST.
+## Git workflow (CRITICAL — do this FIRST)
 
-1. **FIRST**: check out the session branch specified in your instructions:
-   `git checkout session/{name}`
-2. **Verify**: `git branch --show-current` must show `session/{name}`
-3. **Commit after each logical unit** — never wait until the end
-4. **Before reporting back**: `git status` must show clean working tree.
-   If anything is uncommitted: COMMIT IT NOW before reporting.
+You work in a **temporary worktree** of the target repo. This isolates your
+changes from the main working directory. If you don't commit, YOUR WORK IS LOST.
+
+### Setup (run before any code changes)
+
+The orchestrator tells you which repo and session branch to use.
+Example: repo=`../prism`, branch=`session/feature-auth`.
+
+```bash
+# 1. Create a worktree of the TARGET repo in /tmp/
+git -C ../[repo] worktree add /tmp/[repo]-[session] session/[branch]
+
+# 2. Move into the worktree — ALL work happens here
+cd /tmp/[repo]-[session]
+
+# 3. Verify you're on the right branch
+git branch --show-current  # must show session/[branch]
+```
+
+If the session branch doesn't exist yet:
+```bash
+git -C ../[repo] branch session/[branch] [source-branch]
+git -C ../[repo] worktree add /tmp/[repo]-[session] session/[branch]
+```
+
+### During work
+- **Stay in `/tmp/[repo]-[session]`** for ALL commands (code, tests, git)
+- **Commit after each logical unit** — never wait until the end
+- Use conventional commits (`feat:`, `fix:`, `refactor:`, etc.)
+
+### Before reporting back
+```bash
+# Must be clean
+git status
+# Show what you did
+git log --oneline -10
+```
+
+### Cleanup (LAST step, after final report)
+```bash
+git -C ../[repo] worktree remove /tmp/[repo]-[session]
+```
 
 ## Workflow
-1. Check out the session branch (see Git workflow above)
+1. Set up the worktree (see Git workflow above)
 2. Read the repo's CLAUDE.md — follow its conventions strictly
 3. Implement the assigned tasks from the plan
-4. Use the **LSP tool** for code navigation (go-to-definition, find-references)
-5. Run existing tests — fix any regressions you introduce
-6. Identify and remove dead code exposed by your changes
-7. Commit on the session branch with conventional commits — after each unit, not at the end
-8. Before reporting: `git status` — must be clean. `git log --oneline -5` — include in report
-9. Report back: files changed, tests pass/fail, dead code found, commits (hash+message), blockers
+4. Run existing tests — fix any regressions you introduce
+5. Identify and remove dead code exposed by your changes
+6. Commit on the session branch with conventional commits — after each unit, not at the end
+7. Before reporting: `git status` — must be clean. `git log --oneline -5` — include in report
+8. Report back: files changed, tests pass/fail, dead code found, commits (hash+message), blockers
+9. Clean up the worktree (last step)
 
 ## Rules
 - Follow existing patterns in the codebase — consistency over preference
+- **NEVER run `git checkout` or `git switch` outside of `/tmp/`** — this would disrupt the main repo
+- **NEVER `cd` into `../[repo]` to work** — always use the `/tmp/` worktree
 - If you face an architectural decision NOT covered by the plan: **STOP and escalate**
 - Never guess on multi-tenant scoping or auth — escalate if unclear
 - Every new behavior needs at least one success test and one error test

package/global-skills/agents/team-lead.md

@@ -102,8 +102,18 @@ If active sessions exist, display them:
 ### During dispatch
 - Include the session branch in every teammate spawn prompt
 - Teammates use the session branch — they do NOT create their own branches
-- The spawn prompt must say: "Branch session/{name} ALREADY EXISTS.
-  Create your worktree from this branch. ALL commits go on this branch."
+- The spawn prompt MUST include these EXACT instructions:
+  ```
+  CRITICAL Git workflow — worktree isolation:
+  1. git -C ../[repo] worktree add /tmp/[repo]-[session] session/{name}
+  2. cd /tmp/[repo]-[session]
+  3. git branch --show-current    (verify: must show session/{name})
+  4. ALL work happens in /tmp/[repo]-[session] — NEVER cd into ../[repo]
+  5. NEVER run git checkout/switch outside /tmp/ — it disrupts the main repo
+  6. Commit after each logical unit. Before reporting: git status must be clean.
+  7. Cleanup last: git -C ../[repo] worktree remove /tmp/[repo]-[session]
+  Branch session/{name} ALREADY EXISTS. ALL commits go on this branch.
+  ```
 
 ### During collection
 - Verify commits are on the session branch via Task subagent:
@@ -146,8 +156,8 @@ You use **Agent Teams** (Teammate tool) to orchestrate:
 - You communicate with teammates via **SendMessage** (mid-wave instructions, clarifications)
 - You coordinate via the shared task list
 - Agent Teams teammates benefit from automatic worktree isolation
-- For classic subagents (Task tool), worktree isolation must be
-  explicitly declared via `isolation: worktree` in the frontmatter
+- For classic subagents (Task tool with implementer), the teammate
+  creates its own worktree of the target repo in /tmp/ (see implementer agent)
 
 For lightweight read-only tasks (scans, checks), you can use Task
 with Explore subagents (Haiku) — faster and cheaper.

package/global-skills/dispatch-feature/references/spawn-templates.md

@@ -15,16 +15,24 @@ You are teammate-[service]. Read the CLAUDE.md in your repo first.
 You are working in a temporary worktree. If you don't commit, YOUR WORK WILL BE LOST
 when the worktree is cleaned up.
 
-1. FIRST THING: check out the session branch:
+CRITICAL: Do NOT run `git checkout` in the main repo. Do NOT use `git -C ../repo checkout`.
+You are already in an isolated worktree — all git commands run HERE, not in the main repo.
+
+1. FIRST THING: Switch to the session branch inside your worktree:
    git checkout session/{session-name}
+   (This is safe — you are in a worktree, not the main repo)
 2. Verify you are on the right branch:
    git branch --show-current  (must show: session/{session-name})
-3. Commit AFTER EACH logical unit — do NOT wait until the end
-4. Before reporting back, verify ALL changes are committed:
+3. If checkout fails with "did not match any file(s)":
+   git fetch origin session/{session-name}
+   git checkout session/{session-name}
+4. Commit AFTER EACH logical unit — do NOT wait until the end
+5. Before reporting back, verify ALL changes are committed:
    git status  (must show: nothing to commit, working tree clean)
-5. If git status shows uncommitted changes when you're done: COMMIT THEM NOW
+6. If git status shows uncommitted changes when you're done: COMMIT THEM NOW
 
 Branch `session/{session-name}` ALREADY EXISTS. Do NOT create other branches.
+Do NOT create branches named worktree-agent-* — use the session branch.
 
 ## Constitution (non-negotiable)
 [paste all rules from your workspace's constitution.md]
@@ -70,16 +78,24 @@ You are teammate-[service]. Read the CLAUDE.md in your repo first.
 You are working in a temporary worktree. If you don't commit, YOUR WORK WILL BE LOST
 when the worktree is cleaned up.
 
-1. FIRST THING: check out the session branch:
+CRITICAL: Do NOT run `git checkout` in the main repo. Do NOT use `git -C ../repo checkout`.
+You are already in an isolated worktree — all git commands run HERE, not in the main repo.
+
+1. FIRST THING: Switch to the session branch inside your worktree:
    git checkout session/{session-name}
+   (This is safe — you are in a worktree, not the main repo)
 2. Verify you are on the right branch:
    git branch --show-current  (must show: session/{session-name})
-3. Commit AFTER EACH logical unit — do NOT wait until the end
-4. Before reporting back, verify ALL changes are committed:
+3. If checkout fails with "did not match any file(s)":
+   git fetch origin session/{session-name}
+   git checkout session/{session-name}
+4. Commit AFTER EACH logical unit — do NOT wait until the end
+5. Before reporting back, verify ALL changes are committed:
    git status  (must show: nothing to commit, working tree clean)
-5. If git status shows uncommitted changes when you're done: COMMIT THEM NOW
+6. If git status shows uncommitted changes when you're done: COMMIT THEM NOW
 
 Branch `session/{session-name}` ALREADY EXISTS. Do NOT create other branches.
+Do NOT create branches named worktree-agent-* — use the session branch.
 
 ## Constitution (non-negotiable)
 [paste all rules from your workspace's constitution.md]
@@ -128,16 +144,24 @@ You are teammate-[service]. Read the CLAUDE.md in your repo first.
 You are working in a temporary worktree. If you don't commit, YOUR WORK WILL BE LOST
 when the worktree is cleaned up.
 
-1. FIRST THING: check out the session branch:
+CRITICAL: Do NOT run `git checkout` in the main repo. Do NOT use `git -C ../repo checkout`.
+You are already in an isolated worktree — all git commands run HERE, not in the main repo.
+
+1. FIRST THING: Switch to the session branch inside your worktree:
    git checkout session/{session-name}
+   (This is safe — you are in a worktree, not the main repo)
 2. Verify you are on the right branch:
    git branch --show-current  (must show: session/{session-name})
-3. Commit AFTER EACH logical unit — do NOT wait until the end
-4. Before reporting back, verify ALL changes are committed:
+3. If checkout fails with "did not match any file(s)":
+   git fetch origin session/{session-name}
+   git checkout session/{session-name}
+4. Commit AFTER EACH logical unit — do NOT wait until the end
+5. Before reporting back, verify ALL changes are committed:
    git status  (must show: nothing to commit, working tree clean)
-5. If git status shows uncommitted changes when you're done: COMMIT THEM NOW
+6. If git status shows uncommitted changes when you're done: COMMIT THEM NOW
 
 Branch `session/{session-name}` ALREADY EXISTS. Do NOT create other branches.
+Do NOT create branches named worktree-agent-* — use the session branch.
 
 ## Constitution (non-negotiable)
 [paste all rules from your workspace's constitution.md]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cc-workspace",
-  "version": "4.2.0",
+  "version": "4.3.0",
   "description": "Claude Code multi-workspace orchestrator — skills, hooks, agents, and templates for multi-service projects",
   "bin": {
     "cc-workspace": "./bin/cli.js"