cc-workspace 4.2.1 → 4.3.0

package/bin/cli.js

@@ -225,8 +225,10 @@ function generateSettings(orchDir) {
         // block-orchestrator-writes.sh is NOT here — it's in team-lead agent
         // frontmatter only. Putting it in settings.json would block teammates
         // from writing in their worktrees.
-        withMatcher("Teammate", "validate-spawn-prompt.sh", 5),
-        withMatcher("Bash", "guard-session-checkout.sh", 5)
+        // guard-session-checkout.sh is NOT here — it's in implementer agent
+        // frontmatter only. team-lead doesn't have Bash, and teammates don't
+        // inherit orchestrator hooks.
+        withMatcher("Teammate", "validate-spawn-prompt.sh", 5)
       ],
       SessionStart: [
         withoutMatcher("session-start-context.sh", 10)
@@ -417,7 +419,7 @@ function updateLocal() {
   const hooksDir = path.join(orchDir, ".claude", "hooks");
   if (fs.existsSync(hooksDir)) {
     // Clean obsolete hooks before copying new ones
-    const obsoleteHooks = ["block-orchestrator-writes.sh", "worktree-create-context.sh", "verify-cycle-complete.sh"];
+    const obsoleteHooks = ["block-orchestrator-writes.sh", "worktree-create-context.sh", "verify-cycle-complete.sh", "guard-session-checkout.sh"];
     for (const f of obsoleteHooks) {
       const fp = path.join(hooksDir, f);
       if (fs.existsSync(fp)) fs.unlinkSync(fp);

package/global-skills/agents/implementer.md

@@ -2,48 +2,99 @@
 name: implementer
 description: >
   Implementation teammate for a single service. Receives tasks from the
-  orchestrator, implements in an isolated worktree, runs tests, reports back.
-  Used via Task tool when explicit worktree isolation is needed for subagents
+  orchestrator, implements in a worktree of the target repo, runs tests,
+  reports back. Used via Task tool for subagents needing code isolation
   (Agent Teams teammates get automatic isolation).
-isolation: worktree
 model: sonnet
 tools: Read, Write, Edit, MultiEdit, Bash, Glob, Grep
 memory: project
 maxTurns: 50
+hooks:
+  PreToolUse:
+    - matcher: Bash
+      hooks:
+        - type: command
+          command: |
+            INPUT=$(cat)
+            CMD=$(echo "$INPUT" | jq -r '.tool_input.command // empty') || true
+            [ -z "$CMD" ] && exit 0
+            # Block git checkout/switch in sibling repos (would disrupt main working tree)
+            if echo "$CMD" | grep -qE 'git\s+(-C\s+\.\./\S+\s+)?(checkout|switch)\s'; then
+              # Allow checkout inside /tmp/ worktrees (that's the intended workflow)
+              if echo "$CMD" | grep -qE '^\s*cd\s+/tmp/' || echo "$CMD" | grep -qE 'git\s+-C\s+/tmp/'; then
+                exit 0
+              fi
+              printf '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"BLOCKED: git checkout/switch targets a main repo. Use your /tmp/ worktree instead. See Git workflow instructions."}}'
+              exit 0
+            fi
+            exit 0
+          timeout: 5
 ---
 
 # Implementer — Service Teammate
 
 You are a focused implementer. You receive tasks and deliver clean code.
 
-## Git workflow (CRITICAL — do this first)
-You are in a temporary worktree. If you don't commit, YOUR WORK WILL BE LOST.
+## Git workflow (CRITICAL — do this FIRST)
 
-**CRITICAL**: Do NOT run `git checkout` in the main repo. Do NOT use `git -C ../repo checkout`.
-You are already in an isolated worktree — all git commands run HERE, not in the main repo.
+You work in a **temporary worktree** of the target repo. This isolates your
+changes from the main working directory. If you don't commit, YOUR WORK IS LOST.
 
-1. **FIRST**: Switch to the session branch inside your worktree:
-   `git checkout session/{name}` (safe — you're in a worktree)
-2. **Verify**: `git branch --show-current` must show `session/{name}`
-3. If checkout fails: `git fetch origin session/{name}` then retry
-4. **Do NOT stay on `worktree-agent-*` branches** — always switch to the session branch
-5. **Commit after each logical unit** — never wait until the end
-6. **Before reporting back**: `git status` must show clean working tree.
-   If anything is uncommitted: COMMIT IT NOW before reporting.
+### Setup (run before any code changes)
+
+The orchestrator tells you which repo and session branch to use.
+Example: repo=`../prism`, branch=`session/feature-auth`.
+
+```bash
+# 1. Create a worktree of the TARGET repo in /tmp/
+git -C ../[repo] worktree add /tmp/[repo]-[session] session/[branch]
+
+# 2. Move into the worktree — ALL work happens here
+cd /tmp/[repo]-[session]
+
+# 3. Verify you're on the right branch
+git branch --show-current  # must show session/[branch]
+```
+
+If the session branch doesn't exist yet:
+```bash
+git -C ../[repo] branch session/[branch] [source-branch]
+git -C ../[repo] worktree add /tmp/[repo]-[session] session/[branch]
+```
+
+### During work
+- **Stay in `/tmp/[repo]-[session]`** for ALL commands (code, tests, git)
+- **Commit after each logical unit** — never wait until the end
+- Use conventional commits (`feat:`, `fix:`, `refactor:`, etc.)
+
+### Before reporting back
+```bash
+# Must be clean
+git status
+# Show what you did
+git log --oneline -10
+```
+
+### Cleanup (LAST step, after final report)
+```bash
+git -C ../[repo] worktree remove /tmp/[repo]-[session]
+```
 
 ## Workflow
-1. Check out the session branch (see Git workflow above)
+1. Set up the worktree (see Git workflow above)
 2. Read the repo's CLAUDE.md — follow its conventions strictly
 3. Implement the assigned tasks from the plan
-4. Use the **LSP tool** for code navigation (go-to-definition, find-references)
-5. Run existing tests — fix any regressions you introduce
-6. Identify and remove dead code exposed by your changes
-7. Commit on the session branch with conventional commits — after each unit, not at the end
-8. Before reporting: `git status` — must be clean. `git log --oneline -5` — include in report
-9. Report back: files changed, tests pass/fail, dead code found, commits (hash+message), blockers
+4. Run existing tests — fix any regressions you introduce
+5. Identify and remove dead code exposed by your changes
+6. Commit on the session branch with conventional commits — after each unit, not at the end
+7. Before reporting: `git status` — must be clean. `git log --oneline -5` — include in report
+8. Report back: files changed, tests pass/fail, dead code found, commits (hash+message), blockers
+9. Clean up the worktree (last step)
 
 ## Rules
 - Follow existing patterns in the codebase — consistency over preference
+- **NEVER run `git checkout` or `git switch` outside of `/tmp/`** — this would disrupt the main repo
+- **NEVER `cd` into `../[repo]` to work** — always use the `/tmp/` worktree
 - If you face an architectural decision NOT covered by the plan: **STOP and escalate**
 - Never guess on multi-tenant scoping or auth — escalate if unclear
 - Every new behavior needs at least one success test and one error test

package/global-skills/agents/team-lead.md

@@ -104,11 +104,14 @@ If active sessions exist, display them:
 - Teammates use the session branch — they do NOT create their own branches
 - The spawn prompt MUST include these EXACT instructions:
   ```
-  CRITICAL: Do NOT run `git checkout` in the main repo. Do NOT use `git -C ../repo checkout`.
-  You are in an isolated worktree — all git commands run HERE.
-  1. git checkout session/{name}  (switch to session branch inside your worktree)
-  2. git branch --show-current    (verify: must show session/{name})
-  3. Do NOT stay on worktree-agent-* branches — use the session branch.
+  CRITICAL Git workflow — worktree isolation:
+  1. git -C ../[repo] worktree add /tmp/[repo]-[session] session/{name}
+  2. cd /tmp/[repo]-[session]
+  3. git branch --show-current    (verify: must show session/{name})
+  4. ALL work happens in /tmp/[repo]-[session] — NEVER cd into ../[repo]
+  5. NEVER run git checkout/switch outside /tmp/ — it disrupts the main repo
+  6. Commit after each logical unit. Before reporting: git status must be clean.
+  7. Cleanup last: git -C ../[repo] worktree remove /tmp/[repo]-[session]
   Branch session/{name} ALREADY EXISTS. ALL commits go on this branch.
   ```
 
@@ -153,8 +156,8 @@ You use **Agent Teams** (Teammate tool) to orchestrate:
 - You communicate with teammates via **SendMessage** (mid-wave instructions, clarifications)
 - You coordinate via the shared task list
 - Agent Teams teammates benefit from automatic worktree isolation
-- For classic subagents (Task tool), worktree isolation must be
-  explicitly declared via `isolation: worktree` in the frontmatter
+- For classic subagents (Task tool with implementer), the teammate
+  creates its own worktree of the target repo in /tmp/ (see implementer agent)
 
 For lightweight read-only tasks (scans, checks), you can use Task
 with Explore subagents (Haiku) — faster and cheaper.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cc-workspace",
-  "version": "4.2.1",
+  "version": "4.3.0",
   "description": "Claude Code multi-workspace orchestrator — skills, hooks, agents, and templates for multi-service projects",
   "bin": {
     "cc-workspace": "./bin/cli.js"

package/global-skills/hooks/guard-session-checkout.sh

@@ -1,33 +0,0 @@
-#!/usr/bin/env bash
-# guard-session-checkout.sh
-# PreToolUse hook (matcher: Bash): blocks `git checkout session/` in main repos.
-# Session branches must only be checked out INSIDE worktrees, never in main repos
-# (doing so disrupts other parallel sessions).
-# v4.2.1: hard guardrail — this hook BLOCKS (exit 0 + deny JSON).
-set -euo pipefail
-
-INPUT=$(cat)
-COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null) || true
-
-[ -z "$COMMAND" ] && exit 0
-
-# Only care about git checkout/switch targeting session/ branches
-if ! echo "$COMMAND" | grep -qE 'git\s+(checkout|switch)\s+.*session/' 2>/dev/null; then
-    exit 0
-fi
-
-# Pattern 1: git -C <repo> checkout session/ — always wrong (targets main repo from outside)
-if echo "$COMMAND" | grep -qE 'git\s+-C\s+\S+\s+(checkout|switch)\s+.*session/' 2>/dev/null; then
-    printf '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"BLOCKED: git checkout session/ with -C targets the main repo directly. This disrupts other parallel sessions. You are in a worktree — run `git checkout session/{name}` from INSIDE your worktree (without -C) instead. If you are not in a worktree, something is wrong with your isolation setup."}}'
-    exit 0
-fi
-
-# Pattern 2: git checkout session/ without -C — check if we are in a main repo
-# In a worktree, .git is a FILE (gitdir pointer). In a main repo, .git is a DIRECTORY.
-if [ -d ".git" ] && [ ! -f ".git" ]; then
-    printf '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"BLOCKED: git checkout session/ detected in a main repo (not a worktree). Checking out a session branch in the main repo disrupts other parallel sessions. You must work in an isolated worktree. If you are a teammate, your worktree should already exist — run `git checkout session/{name}` from inside it."}}'
-    exit 0
-fi
-
-# We are in a worktree (.git is a file) — allow the checkout
-exit 0