create-claude-cabinet 0.43.0 → 0.45.0

package/templates/hooks/watchtower-session-start.sh

@@ -5,6 +5,12 @@
 # a state summary, then outputs it as hookSpecificOutput for Claude's
 # additionalContext.
 #
+# Also runs the frontier-model watchdog: the SessionStart payload (stdin
+# JSON, per the CC hook contract) carries the session's `model` id. If
+# ~/.claude/cc-registry.json designates a frontierModel and this session
+# runs a different model, a loud warning is prepended to the injected
+# context. Visibility only — never blocks anything.
+#
 # If watchtower is not installed (no config.json), exits silently.
 # If the context builder produces no output, exits silently.
 #
@@ -13,16 +19,85 @@
 
 command -v jq >/dev/null 2>&1 || exit 0
 
+# Hook payload arrives on stdin (.tool_input-style JSON; never an env var).
+# Guard against interactive invocation where stdin is a tty.
+PAYLOAD=""
+if [ ! -t 0 ]; then
+  PAYLOAD=$(cat)
+fi
+
 WATCHTOWER_DIR="${HOME}/.claude-cabinet/watchtower"
 PROJECT_PATH="$(pwd)"
 
-# No config → watchtower not installed → exit silently
-if [ ! -f "${WATCHTOWER_DIR}/config.json" ]; then
-  exit 0
+# --- Frontier-model watchdog -------------------------------------------------
+# Canonical match rule lives in the orient skill (templates/skills/orient/
+# SKILL.md, "Frontier-Model Watchdog") — this is a reference implementation
+# of that rule, not a second definition:
+#   - key starting with "claude-" AND containing a digit => exact model ID,
+#     exact case-insensitive match required
+#   - anything else => family alias, case-insensitive containment
+#   - absent/empty/whitespace key => silent no-op ('' would match everything
+#     and silence the watchdog while appearing configured)
+FRONTIER_WARNING=""
+SESSION_MODEL=""
+if [ -n "${PAYLOAD}" ]; then
+  SESSION_MODEL=$(printf '%s' "${PAYLOAD}" | jq -r '.model // empty' 2>/dev/null)
+fi
+REGISTRY="${HOME}/.claude/cc-registry.json"
+FRONTIER_KEY=""
+if [ -f "${REGISTRY}" ]; then
+  FRONTIER_KEY=$(jq -r '.frontierModel // empty' "${REGISTRY}" 2>/dev/null | tr -d '[:space:]')
+fi
+if [ -n "${FRONTIER_KEY}" ] && [ -z "${SESSION_MODEL}" ]; then
+  # A key is configured but the payload exposed no model id (field absent,
+  # renamed, or reshaped by a future CC release). Say so instead of going
+  # silent — silence here is indistinguishable from "model matches".
+  FRONTIER_WARNING="ℹ FRONTIER WATCHDOG: a frontier model is designated (${FRONTIER_KEY}) but the SessionStart payload exposed no session model id — the early-boundary check was SKIPPED, not passed. The /orient watchdog phase remains the boundary."
+fi
+if [ -n "${SESSION_MODEL}" ] && [ -n "${FRONTIER_KEY}" ]; then
+  key_lc=$(printf '%s' "${FRONTIER_KEY}" | tr '[:upper:]' '[:lower:]')
+  model_lc=$(printf '%s' "${SESSION_MODEL}" | tr '[:upper:]' '[:lower:]')
+  # Session model ids may carry a bracketed runtime suffix (e.g.
+  # claude-fable-5[1m]); strip it before exact comparison — the suffix is
+  # session configuration, not model identity.
+  model_base_lc="${model_lc%%\[*}"
+  matched=0
+  case "${key_lc}" in
+    claude-*[0-9]*)
+      # Exact model ID — require identity against the suffix-stripped id.
+      [ "${model_base_lc}" = "${key_lc}" ] && matched=1
+      ;;
+    *)
+      # Family alias — containment.
+      case "${model_lc}" in
+        *"${key_lc}"*) matched=1 ;;
+      esac
+      ;;
+  esac
+  if [ "${matched}" -eq 0 ]; then
+    FRONTIER_WARNING="⚠ FRONTIER WATCHDOG: this session runs ${SESSION_MODEL}; your designated frontier model is ${FRONTIER_KEY} — switch with /model or relaunch. Surface this warning to the user as the FIRST line of any briefing. (Visibility only; nothing is blocked. Update the key with: npx create-claude-cabinet --frontier-model <model>)"
+  fi
+fi
+# -----------------------------------------------------------------------------
+
+# No config → watchtower not installed → still emit a frontier warning if
+# one fired (the hook only registers on watchtower installs, but a torn-down
+# config should not eat the watchdog), otherwise exit silently.
+CONTEXT=""
+if [ -f "${WATCHTOWER_DIR}/config.json" ]; then
+  # Build context. Suppress stderr to avoid noise on missing files.
+  CONTEXT=$(node "${WATCHTOWER_DIR}/scripts/watchtower-build-context.mjs" --project-path "${PROJECT_PATH}" 2>/dev/null)
 fi
 
-# Build context. Suppress stderr to avoid noise on missing files.
-CONTEXT=$(node "${WATCHTOWER_DIR}/scripts/watchtower-build-context.mjs" --project-path "${PROJECT_PATH}" 2>/dev/null)
+if [ -n "${FRONTIER_WARNING}" ]; then
+  if [ -n "${CONTEXT}" ]; then
+    CONTEXT="${FRONTIER_WARNING}
+
+${CONTEXT}"
+  else
+    CONTEXT="${FRONTIER_WARNING}"
+  fi
+fi
 
 # Empty context → nothing to inject
 if [ -z "${CONTEXT}" ]; then

package/templates/mux/__tests__/claude-carveout.fixture.sh

@@ -0,0 +1,136 @@
+#!/bin/bash
+# Sandboxed AC verification for act:14305d16 — the .claude/ authored/infra
+# carve-out generalized from a static plans/methodology pair to "any tracked
+# .claude/ file is authored; only gitignored infra is disposable"
+# (.claude/rules/artifacts-of-thought.md).
+#
+# Drives templates/mux/config/worktree-session-health.sh directly against a
+# throwaway repo + worktree under mktemp with HOME overridden — never touches
+# the real ~/.mux/worktrees, ~/.config/mux, or any live worktree.
+set -uo pipefail
+
+REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
+SANDBOX=$(mktemp -d /tmp/cc-carveout-test.XXXXXX)
+FAKE_HOME="$SANDBOX/home"
+PROJ="$SANDBOX/proj"
+WT="$SANDBOX/wt"
+HEALTH="$REPO_ROOT/templates/mux/config/worktree-session-health.sh"
+DIRTY="$REPO_ROOT/templates/mux/config/worktree-dirty-check.sh"
+
+pass=0; fail=0
+ok()  { echo "  PASS: $1"; pass=$((pass+1)); }
+bad() { echo "  FAIL: $1"; fail=$((fail+1)); }
+assert() { # assert <desc> <cmd...>
+  local desc="$1"; shift
+  if "$@" >/dev/null 2>&1; then ok "$desc"; else bad "$desc"; fi
+}
+run_health() { HOME="$FAKE_HOME" bash "$HEALTH" "$PROJ" "$WT" "$@" 2>&1; }
+
+mkdir -p "$FAKE_HOME/.local/share/mux/wt-health" "$FAKE_HOME/.claude/projects"
+trap 'rm -rf "$SANDBOX"' EXIT
+
+# --- fixture main repo --------------------------------------------------------
+# Tracked (= authored): plans/, methodology/, rules/, cabinet/c.md.
+# Gitignored (= infra): skills/ entirely; cabinet/_briefing.md inside the
+# otherwise-tracked cabinet/ (the mixed-dir case).
+git init -q "$PROJ"
+git -C "$PROJ" config user.email t@t.t; git -C "$PROJ" config user.name t
+mkdir -p "$PROJ/.claude/plans" "$PROJ/.claude/rules" "$PROJ/.claude/cabinet" "$PROJ/.claude/skills"
+printf '%s\n' '.claude/skills/' '.claude/cabinet/_briefing*.md' > "$PROJ/.gitignore"
+echo plan > "$PROJ/.claude/plans/p.md"
+echo rule > "$PROJ/.claude/rules/r.md"
+echo cabinet-doc > "$PROJ/.claude/cabinet/c.md"
+echo briefing-v1 > "$PROJ/.claude/cabinet/_briefing.md"
+echo skill-v1 > "$PROJ/.claude/skills/s.md"
+echo code > "$PROJ/file.txt"
+git -C "$PROJ" add -A && git -C "$PROJ" commit -qm init
+MAIN_SLUG=$(echo "$PROJ" | sed 's|[/.]|-|g')
+mkdir -p "$FAKE_HOME/.claude/projects/$MAIN_SLUG"
+
+git -C "$PROJ" worktree add -q "$WT" -b mux/carveout HEAD
+
+frozen() { git -C "$WT" ls-files -v .claude/ | grep -c '^h '; }
+excl()   { cat "$(git -C "$WT" rev-parse --git-dir)/info/exclude" 2>/dev/null; }
+
+echo "== T1: health run leaves every tracked .claude/ file unfrozen (AC1)"
+run_health --refresh >"$SANDBOX/t1.out"
+assert "zero tracked .claude/ files carry the assume-unchanged bit" \
+  test "$(frozen)" -eq 0
+assert "tracked rules/ file shows H in ls-files -v" \
+  bash -c "git -C '$WT' ls-files -v .claude/rules/r.md | grep -q '^H '"
+assert "tracked cabinet/ file shows H in ls-files -v" \
+  bash -c "git -C '$WT' ls-files -v .claude/cabinet/c.md | grep -q '^H '"
+assert "gitignored skills/ infra copied from main" \
+  grep -qx skill-v1 "$WT/.claude/skills/s.md"
+assert "gitignored briefing inside mixed cabinet/ copied from main" \
+  grep -qx briefing-v1 "$WT/.claude/cabinet/_briefing.md"
+
+echo "== T2: exclude negations are derived from the index, not a static pair"
+assert "exclude hides untracked infra (.claude/*)" \
+  bash -c "excl() { cat \"\$(git -C '$WT' rev-parse --git-dir)/info/exclude\"; }; excl | grep -qxF '.claude/*'"
+for d in plans rules cabinet; do
+  assert "exclude negates tracked dir $d/" \
+    bash -c "cat \"\$(git -C '$WT' rev-parse --git-dir)/info/exclude\" | grep -qxF '!.claude/$d/'"
+done
+assert "no negation for pure-infra skills/" \
+  bash -c "! cat \"\$(git -C '$WT' rev-parse --git-dir)/info/exclude\" | grep -qxF '!.claude/skills/'"
+run_health >"$SANDBOX/t2.out"
+assert "second run does not duplicate managed exclude lines" \
+  bash -c "[ \"\$(cat \"\$(git -C '$WT' rev-parse --git-dir)/info/exclude\" | grep -cxF '.claude/*')\" -eq 1 ]"
+
+echo "== T3: legacy frozen worktree heals (the 2026-06-11 trap)"
+git -C "$WT" update-index --assume-unchanged .claude/rules/r.md
+echo trapped-edit > "$WT/.claude/rules/r.md"
+assert "precondition: frozen edit invisible to git status" \
+  bash -c "! git -C '$WT' status --porcelain | grep -q rules/r.md"
+run_health >"$SANDBOX/t3.out"
+assert "health run clears the bit" test "$(frozen)" -eq 0
+assert "edit to tracked rules/ file now visible to git" \
+  bash -c "git -C '$WT' status --porcelain | grep -q 'M .claude/rules/r.md'"
+
+echo "== T4: --refresh never overwrites tracked, locally-modified files (AC2)"
+echo main-side-edit > "$PROJ/.claude/rules/r.md"      # uncommitted main edit
+echo skill-v2      > "$PROJ/.claude/skills/s.md"      # infra changed in main
+echo briefing-v2   > "$PROJ/.claude/cabinet/_briefing.md"
+run_health --refresh >"$SANDBOX/t4.out"
+assert "worktree's modified tracked rules/ file survives refresh" \
+  grep -qx trapped-edit "$WT/.claude/rules/r.md"
+assert "tracked cabinet doc untouched by refresh" \
+  grep -qx cabinet-doc "$WT/.claude/cabinet/c.md"
+assert "pure-infra skills/ refreshed to main's version" \
+  grep -qx skill-v2 "$WT/.claude/skills/s.md"
+assert "mixed-dir gitignored briefing refreshed to main's version" \
+  grep -qx briefing-v2 "$WT/.claude/cabinet/_briefing.md"
+
+echo "== T5: freshness check ignores tracked files (no refresh churn loop)"
+sleep 1; touch "$PROJ/.claude/rules/r.md" "$PROJ/.claude/plans/p.md"
+out=$(run_health)
+assert "newer tracked main files do not count as stale infra" \
+  grep -q 'current with main repo' <<<"$out"
+
+echo "== T6: new doc beside tracked files is visible + dirty"
+echo new-rule > "$WT/.claude/rules/new-rule.md"
+assert "new untracked rules/ doc appears in git status" \
+  bash -c "git -C '$WT' status --porcelain --untracked-files=all | grep -q 'new-rule.md'"
+out=$(bash "$DIRTY" "$WT" "$PROJ")
+assert "dirty-check counts it as authored record ($out)" \
+  grep -q 'verdict=dirty' <<<"$out"
+rm "$WT/.claude/rules/new-rule.md"
+git -C "$WT" checkout -q -- .claude/rules/r.md
+
+echo "== T7: infra-only worktree is clean (churn never blocks cleanup)"
+out=$(bash "$DIRTY" "$WT" "$PROJ")
+assert "worktree with only copied infra => clean ($out)" \
+  grep -q 'verdict=clean' <<<"$out"
+
+echo "== T8: pure-infra deletions in main reconcile on refresh"
+rm "$PROJ/.claude/skills/s.md"; echo skill-new > "$PROJ/.claude/skills/s2.md"
+run_health --refresh >"$SANDBOX/t8.out"
+assert "deleted main infra file removed from worktree" \
+  test ! -e "$WT/.claude/skills/s.md"
+assert "new main infra file arrives in worktree" \
+  grep -qx skill-new "$WT/.claude/skills/s2.md"
+
+echo ""
+echo "RESULT: $pass passed, $fail failed (sandbox: $SANDBOX)"
+exit $fail

package/templates/mux/__tests__/claude-carveout.test.mjs

@@ -0,0 +1,38 @@
+// Guard test for the .claude/ authored/infra carve-out (act:14305d16).
+//
+// Drives claude-carveout.fixture.sh, which builds a throwaway repo +
+// worktree under mktemp with HOME overridden — it never touches the real
+// ~/.mux/worktrees, ~/.config/mux, or any live worktree.
+//
+// The rule under test (.claude/rules/artifacts-of-thought.md): ANY tracked
+// .claude/ file is authored project record; only gitignored infra is
+// disposable. Covers:
+//   - no tracked .claude/ file ever carries the assume-unchanged bit
+//   - legacy frozen worktrees heal (the bit that hid an edit to
+//     .claude/rules/enforcement-pipeline.md on 2026-06-11)
+//   - --refresh never overwrites a tracked, locally-modified .claude/ file
+//   - exclude negations derive from the index, not a static plans/methodology pair
+//   - pure-infra entries still reconcile deletions; mixed dirs copy only
+//     their gitignored files
+
+import { test } from 'node:test';
+import assert from 'node:assert';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+
+const fixture = path.join(
+  path.dirname(fileURLToPath(import.meta.url)),
+  'claude-carveout.fixture.sh'
+);
+
+test('.claude/ carve-out: tracked = authored, gitignored = infra (sandboxed fixture suite)', () => {
+  const res = spawnSync('bash', [fixture], { encoding: 'utf8', timeout: 120_000 });
+  const output = `${res.stdout}\n${res.stderr}`;
+  assert.strictEqual(
+    res.status,
+    0,
+    `fixture suite reported failures:\n${output}`
+  );
+  assert.match(output, /RESULT: \d+ passed, 0 failed/);
+});

package/templates/mux/__tests__/mux-fail-loud.fixture.sh

@@ -0,0 +1,254 @@
+#!/bin/bash
+# Sandboxed AC verification for act:fe6aab6f (mux fail-loud sweep).
+#
+# Everything runs under a mktemp dir with HOME overridden AND a private
+# throwaway tmux server (tmux -L mux-test-$$ -f /dev/null) — it never touches
+# the real ~/.mux/worktrees, ~/.config/mux, or the operator's live tmux
+# server (the test runner itself may be running inside one). The test server
+# is killed in cleanup even on assertion failure.
+set -uo pipefail
+
+REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
+SANDBOX=$(mktemp -d /tmp/cc-mux-failloud-test.XXXXXX)
+FAKE_HOME="$SANDBOX/home"
+PROJ="$SANDBOX/proj"
+WT_DIR="$FAKE_HOME/.mux/worktrees"
+MUX="$REPO_ROOT/templates/mux/bin/mux"
+
+pass=0; fail=0
+ok()  { echo "  PASS: $1"; pass=$((pass+1)); }
+bad() { echo "  FAIL: $1"; fail=$((fail+1)); }
+assert() { # assert <desc> <cmd...>
+  local desc="$1"; shift
+  if "$@" >/dev/null 2>&1; then ok "$desc"; else bad "$desc"; fi
+}
+
+# --- private throwaway tmux server -------------------------------------------
+# Never the operator's live server: dedicated socket, no config, killed on exit.
+unset TMUX TMUX_PANE
+SOCK="mux-test-$$"
+TMX() { tmux -L "$SOCK" -f /dev/null "$@"; }
+cleanup() { TMX kill-server 2>/dev/null || true; rm -rf "$SANDBOX"; }
+trap cleanup EXIT
+
+# --- sandbox home -------------------------------------------------------------
+mkdir -p "$FAKE_HOME/.config/mux" "$WT_DIR" "$FAKE_HOME/.local/share/mux/wt-health" \
+         "$FAKE_HOME/.claude/projects"
+cp "$REPO_ROOT/templates/mux/config/worktree-session-health.sh" "$FAKE_HOME/.config/mux/"
+cp "$REPO_ROOT/templates/mux/config/worktree-dirty-check.sh" "$FAKE_HOME/.config/mux/"
+chmod +x "$FAKE_HOME/.config/mux/"*.sh
+
+# Stub muxlib.py — answers only what cmd_new/cmd_resume/create_worktree ask.
+# project-path mimics the real muxlib: prints the path, or exits 1 when the
+# project isn't registered (STUB_PROJ_PATH empty/unset).
+cat > "$FAKE_HOME/.config/mux/muxlib.py" <<'PY'
+import sys, os
+cmd = sys.argv[1] if len(sys.argv) > 1 else ""
+if cmd == "project-path":
+    p = os.environ.get("STUB_PROJ_PATH", "")
+    if p:
+        print(p)
+    else:
+        sys.exit(1)
+elif cmd == "project-names":
+    print("sess")
+elif cmd in ("worktree-add", "worktree-remove"):
+    pass
+elif cmd == "worktree-is-active":
+    print("yes")
+elif cmd == "narrate-check":
+    print("yes")
+PY
+echo '{"active":[]}' > "$FAKE_HOME/.config/mux/worktrees.json"
+echo '{}' > "$FAKE_HOME/.config/mux/projects.json"
+
+# --- fixture projects ----------------------------------------------------------
+# .claude/rules/ is tracked (= authored record), .claude/skills/ is gitignored
+# (= disposable infra) — lets T3 assert the creation-path carve-out.
+git init -q "$PROJ"
+git -C "$PROJ" config user.email t@t.t; git -C "$PROJ" config user.name t
+echo code > "$PROJ/file.txt"
+mkdir -p "$PROJ/.claude/rules" "$PROJ/.claude/skills"
+echo '.claude/skills/' > "$PROJ/.gitignore"
+echo rule > "$PROJ/.claude/rules/r.md"
+echo skill > "$PROJ/.claude/skills/s.md"
+git -C "$PROJ" add -A && git -C "$PROJ" commit -qm init
+MAIN_SLUG=$(echo "$PROJ" | sed 's|[/.]|-|g')
+mkdir -p "$FAKE_HOME/.claude/projects/$MAIN_SLUG"
+
+EMPTY_PROJ="$SANDBOX/empty-proj"   # git repo, NO commits → worktree add must fail
+git init -q "$EMPTY_PROJ"
+
+PLAIN_DIR="$SANDBOX/plain-dir"     # registered project that is not a git repo
+mkdir -p "$PLAIN_DIR"
+
+# --- test desk on the private server -------------------------------------------
+HOME="$FAKE_HOME" TMX new-session -d -s sess -x 200 -y 50 -c "$PROJ" \
+  || { echo "FATAL: could not start private tmux server"; exit 1; }
+SOCKET_PATH=$(TMX display-message -p -t sess '#{socket_path}')
+SERVER_PID=$(TMX display-message -p -t sess '#{pid}')
+PANE_ID=$(TMX display-message -p -t sess:0 '#{pane_id}')
+
+# Run mux "inside" the private server: TMUX points at the test socket so
+# in_tmux passes and every bare `tmux` call lands on the throwaway server.
+run_mux() { # run_mux <stub-proj-path> <args...>
+  local stub="$1"; shift
+  env HOME="$FAKE_HOME" STUB_PROJ_PATH="$stub" \
+      TMUX="${SOCKET_PATH},${SERVER_PID},0" TMUX_PANE="$PANE_ID" \
+      bash "$MUX" "$@"
+}
+win_count() { TMX list-windows -t sess 2>/dev/null | wc -l | tr -d ' '; }
+win_opt()   { TMX show-options -wv -t "sess:$1" "$2" 2>/dev/null; }
+
+ID_A="aaaaaaaa-1111-2222-3333-444444444444"
+ID_B="bbbbbbbb-1111-2222-3333-444444444444"
+ID_C="cccccccc-1111-2222-3333-444444444444"
+ID_D="dddddddd-1111-2222-3333-444444444444"
+ID_E="eeeeeeee-1111-2222-3333-444444444444"
+ID_F="ffffffff-1111-2222-3333-444444444444"
+
+echo "== T0: no surviving silent fallbacks in bin/mux (AC1)"
+assert "zero '|| win_path=\"\$path\"' fallbacks remain" \
+  bash -c "! grep -q '|| win_path=\"\\\$path\"' '$MUX'"
+
+echo "== T1: cmd_resume input guard (id flows into branch/path/send-keys)"
+before=$(win_count)
+out=$(run_mux "$PROJ" resume abc 2>&1); rc=$?
+assert "id shorter than 8 chars dies ($rc)" test "$rc" -ne 0
+out=$(run_mux "$PROJ" resume 'not$a-valid;id!!' 2>&1); rc=$?
+assert "non-hex id dies ($rc)" test "$rc" -ne 0
+assert "guard failures open no window" test "$(win_count)" -eq "$before"
+
+echo "== T2: no active Claude => by-design main landing (stays working)"
+before=$(win_count)
+out=$(run_mux "$PROJ" resume "$ID_A" 2>&1); rc=$?
+assert "resume with no active Claude exits 0 ($rc)" test "$rc" -eq 0
+assert "window resume-aaaaaaaa opened" test "$(win_count)" -eq $((before + 1))
+assert "main landing carries NO @mux_worktree flag" \
+  test -z "$(win_opt resume-aaaaaaaa @mux_worktree)"
+
+# Activate the desk: a non-shell pane command makes has_active_claude true.
+TMX new-window -t sess -d -n fakeclaude 'sleep 300'
+
+echo "== T3: active Claude + git project => worktree + window options (AC3)"
+out=$(run_mux "$PROJ" resume "$ID_B" 2>&1); rc=$?
+assert "resume exits 0 ($rc)" test "$rc" -eq 0
+assert "worktree created" test -d "$WT_DIR/sess-resume-bbbbbbbb"
+assert "@mux_worktree returns 1 (AC3)" \
+  test "$(win_opt resume-bbbbbbbb @mux_worktree)" = "1"
+assert "@wt_healthy set alongside (·wt indicator not red)" \
+  test "$(win_opt resume-bbbbbbbb @wt_healthy)" = "1"
+
+echo "== T3b: creation-path carve-out — tracked .claude/ never frozen (act:14305d16)"
+WT_B="$WT_DIR/sess-resume-bbbbbbbb"
+assert "no tracked .claude/ file carries the assume-unchanged bit" \
+  bash -c "! git -C '$WT_B' ls-files -v .claude/ | grep -q '^h '"
+assert "gitignored .claude/skills/ infra copied into the worktree" \
+  test -f "$WT_B/.claude/skills/s.md"
+assert "tracked .claude/rules/ file checked out, not clobbered" \
+  bash -c "grep -qx rule '$WT_B/.claude/rules/r.md'"
+
+echo "== T4: re-resume of the same id REUSES the existing worktree"
+TMX kill-window -t sess:resume-bbbbbbbb 2>/dev/null
+out=$(run_mux "$PROJ" resume "$ID_B" 2>&1); rc=$?
+assert "second resume of same id exits 0 ($rc)" test "$rc" -eq 0
+assert "existing worktree reused (no uniquified sibling)" \
+  bash -c "! ls -d '$WT_DIR'/sess-resume-bbbbbbbb-* 2>/dev/null | grep -q ."
+assert "reused window flagged @mux_worktree=1" \
+  test "$(win_opt resume-bbbbbbbb @mux_worktree)" = "1"
+assert "reused window flagged @wt_healthy=1" \
+  test "$(win_opt resume-bbbbbbbb @wt_healthy)" = "1"
+
+echo "== T5: slug path occupied by an INVALID dir => die naming the path"
+mkdir -p "$WT_DIR/sess-resume-cccccccc"
+before=$(win_count)
+out=$(run_mux "$PROJ" resume "$ID_C" 2>&1); rc=$?
+assert "invalid leftover dies ($rc)" test "$rc" -ne 0
+assert "die message names the colliding path" \
+  grep -q "sess-resume-cccccccc" <<<"$out"
+assert "die message offers a recovery command" grep -q "rm -rf" <<<"$out"
+assert "nothing opened in main" test "$(win_count)" -eq "$before"
+
+echo "== T6: real worktree-creation failure => die, nothing opens (AC2)"
+before=$(win_count)
+out=$(run_mux "$EMPTY_PROJ" resume "$ID_D" 2>&1); rc=$?
+assert "cmd_resume: forced creation failure dies ($rc)" test "$rc" -ne 0
+assert "cmd_resume: die message refuses main checkout" \
+  grep -q "refusing to run work on the main checkout" <<<"$out"
+assert "cmd_resume: nothing opened in main" test "$(win_count)" -eq "$before"
+out=$(run_mux "$EMPTY_PROJ" new 2>&1); rc=$?
+assert "cmd_new no-prompt: forced creation failure dies ($rc)" test "$rc" -ne 0
+assert "cmd_new no-prompt: die message refuses main checkout" \
+  grep -q "refusing to run work on the main checkout" <<<"$out"
+assert "cmd_new no-prompt: nothing opened in main" test "$(win_count)" -eq "$before"
+
+echo "== T7: isolation impossible BY DESIGN => loud fall-through, not die"
+before=$(win_count)
+out=$(run_mux "$PLAIN_DIR" resume "$ID_E" 2>&1); rc=$?
+assert "non-git project dir: resume still works ($rc)" test "$rc" -eq 0
+assert "non-git project dir: visible warning names why" \
+  grep -q "isn't a git repository" <<<"$out"
+assert "non-git project dir: window opened on main" test "$(win_count)" -eq $((before + 1))
+assert "non-git landing carries NO @mux_worktree flag" \
+  test -z "$(win_opt resume-eeeeeeee @mux_worktree)"
+before=$(win_count)
+out=$(run_mux "" resume "$ID_F" 2>&1); rc=$?
+assert "unregistered desk: resume still works ($rc)" test "$rc" -eq 0
+assert "unregistered desk: visible warning names why" \
+  grep -q "isn't a registered mux project" <<<"$out"
+assert "unregistered desk: window opened" test "$(win_count)" -eq $((before + 1))
+
+echo "== T8: cmd_new no-prompt success path still isolates + flags"
+before=$(win_count)
+out=$(run_mux "$PROJ" new 2>&1); rc=$?
+assert "cmd_new no-prompt exits 0 ($rc)" test "$rc" -eq 0
+assert "window opened" test "$(win_count)" -eq $((before + 1))
+new_wt=$(ls -d "$WT_DIR"/sess-window-* 2>/dev/null | head -1)
+assert "worktree created for the new window" test -n "$new_wt"
+if [[ -n "$new_wt" ]]; then
+  wname=$(basename "$new_wt"); wname="${wname#sess-}"
+  assert "new window flagged @mux_worktree=1" \
+    test "$(win_opt "$wname" @mux_worktree)" = "1"
+  assert "new window flagged @wt_healthy=1" \
+    test "$(win_opt "$wname" @wt_healthy)" = "1"
+fi
+
+echo "== T9: mux handoff seeds the next session into a WORKTREE, not main"
+# Design intent (worktree-to-worktree handoffs): the seeded session is a
+# second session on the desk — the shared-main commit-sweep class (1adc5ef)
+# is what isolation prevents. Safe since the 40cc831 carve-out.
+DESC="$SANDBOX/seed.json"
+cat > "$DESC" <<JSON
+{ "project": "sess", "project_path": "$PROJ", "name": "seeded-next",
+  "seed_prompt": "continue the thing" }
+JSON
+before=$(win_count)
+out=$(run_mux "$PROJ" handoff "$DESC" 2>&1); rc=$?
+assert "handoff exits 0 ($rc)" test "$rc" -eq 0
+assert "window opened" test "$(win_count)" -eq $((before + 1))
+assert "worktree created for the seeded session" test -d "$WT_DIR/sess-seeded-next"
+assert "seeded window flagged @mux_worktree=1" \
+  test "$(win_opt seeded-next @mux_worktree)" = "1"
+assert "seeded window flagged @wt_healthy=1" \
+  test "$(win_opt seeded-next @wt_healthy)" = "1"
+assert "launch message says worktree" grep -q "fresh worktree" <<<"$out"
+assert "launch message does not claim main checkout" \
+  bash -c "! grep -q \"main checkout\" <<<'$out'"
+
+echo "== T9b: handoff without isolation falls through LOUDLY to main"
+DESC2="$SANDBOX/seed2.json"
+cat > "$DESC2" <<JSON
+{ "project": "sess", "project_path": "$PLAIN_DIR", "name": "seeded-plain",
+  "seed_prompt": "x" }
+JSON
+before=$(win_count)
+out=$(run_mux "$PLAIN_DIR" handoff "$DESC2" 2>&1); rc=$?
+assert "non-git project handoff exits 0 ($rc)" test "$rc" -eq 0
+assert "window opened" test "$(win_count)" -eq $((before + 1))
+assert "loud fall-through names why" grep -q "No worktree isolation" <<<"$out"
+assert "main landing carries NO @mux_worktree" \
+  test -z "$(win_opt seeded-plain @mux_worktree)"
+
+echo ""
+echo "RESULT: $pass passed, $fail failed (sandbox: $SANDBOX)"
+exit $fail

package/templates/mux/__tests__/mux-fail-loud.test.mjs

@@ -0,0 +1,41 @@
+// Guard test for the mux fail-loud sweep (act:fe6aab6f).
+//
+// Drives mux-fail-loud.fixture.sh, which runs cmd_new / cmd_resume against a
+// PRIVATE throwaway tmux server (tmux -L mux-test-$$ -f /dev/null) plus a
+// sandboxed git repo with HOME overridden — it never touches the operator's
+// live tmux server, ~/.mux/worktrees, or ~/.config/mux. The test server is
+// killed in cleanup even when assertions fail.
+//
+// Covers:
+//   - zero `|| win_path="$path"` silent fallbacks remain in bin/mux
+//   - forced worktree-creation failure on cmd_new (no-prompt) and cmd_resume
+//     exits non-zero and opens nothing in main
+//   - successful `mux resume` sets @mux_worktree=1 AND @wt_healthy=1
+//   - re-resume of the same id reuses the deterministic resume-<id8>
+//     worktree; an invalid leftover at that path dies naming it
+//   - by-design main landings stay working: no-active-Claude resume,
+//     unregistered desks, and non-git project dirs fall through LOUDLY
+//   - cmd_resume rejects non-id-shaped input before it reaches branch
+//     names / paths / send-keys
+
+import { test } from 'node:test';
+import assert from 'node:assert';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+
+const fixture = path.join(
+  path.dirname(fileURLToPath(import.meta.url)),
+  'mux-fail-loud.fixture.sh'
+);
+
+test('mux fail-loud sweep: cmd_new/cmd_resume (sandboxed tmux fixture suite)', () => {
+  const res = spawnSync('bash', [fixture], { encoding: 'utf8', timeout: 120_000 });
+  const output = `${res.stdout}\n${res.stderr}`;
+  assert.strictEqual(
+    res.status,
+    0,
+    `fixture suite reported failures:\n${output}`
+  );
+  assert.match(output, /RESULT: \d+ passed, 0 failed/);
+});