forge-orkes 0.75.0 → 0.79.0

package/experimental/m10/source/hooks/forge-branch-guard.sh

@@ -1,61 +0,0 @@
-#!/usr/bin/env bash
-# Forge PreToolUse(Bash) guardrail — protect the shared main checkout's HEAD when
-# parallel git worktrees are active.
-#
-# Blocks the "moved the shared HEAD under other sessions" catastrophe (canvaz, burned
-# twice 2026-06-05): switching branches or hard-resetting in the MAIN checkout while
-# sibling worktrees are branched off it. Orchestration-agnostic — depends only on git
-# worktree state, so it holds whether coordination is M10, Agent Teams, or manual
-# worktrees.
-#
-# Scope is deliberately narrow to avoid false positives:
-#   - fires ONLY when >1 worktree exists (single-worktree/solo work is never touched)
-#   - fires ONLY in the main checkout (linked worktrees own their own HEAD)
-#   - skips any command containing `cd` (can't reliably tell which tree it targets)
-#   - allows safe forms: file restore (`git checkout -- <path>`), branch create (`-b`)
-#
-# exit 0 = allow; exit 2 = deny. Override by running the command yourself outside Claude.
-
-set -uo pipefail
-
-PAYLOAD=$(cat)
-CMD=$(printf '%s' "$PAYLOAD" | jq -r '.tool_input.command // empty' 2>/dev/null) || exit 0
-[ -z "$CMD" ] && exit 0
-
-# Only git commands are interesting; and bail on `cd` (target tree is ambiguous).
-case "$CMD" in
-  *git*) ;;
-  *) exit 0 ;;
-esac
-case "$CMD" in
-  *"cd "*) exit 0 ;;
-esac
-
-git rev-parse --is-inside-work-tree >/dev/null 2>&1 || exit 0
-
-# Single worktree → no shared-HEAD hazard.
-wt_count=$(git worktree list 2>/dev/null | wc -l | tr -d ' ')
-[ "${wt_count:-1}" -le 1 ] && exit 0
-
-# Main checkout iff --git-dir == --git-common-dir (linked worktrees differ).
-[ "$(git rev-parse --git-dir 2>/dev/null)" = "$(git rev-parse --git-common-dir 2>/dev/null)" ] || exit 0
-
-deny() { echo "[forge-branch-guard] $*" >&2; exit 2; }
-
-# Branch switch (checkout/switch to a ref), excluding file-restore (`--`) and create (`-b`).
-switches_branch=0
-if printf '%s' "$CMD" | grep -qE '\bgit[[:space:]]+(checkout|switch)\b'; then
-  if ! printf '%s' "$CMD" | grep -qE '([[:space:]]--([[:space:]]|$))|(\bgit[[:space:]]+(checkout|switch)[[:space:]]+-[bB]\b)'; then
-    switches_branch=1
-  fi
-fi
-
-# Hard/keep/merge reset rewrites HEAD + working tree.
-hard_reset=0
-printf '%s' "$CMD" | grep -qE '\bgit[[:space:]]+reset[[:space:]]+(--hard|--keep|--merge)\b' && hard_reset=1
-
-if [ "$switches_branch" = "1" ] || [ "$hard_reset" = "1" ]; then
-  deny "Refusing to move the shared main HEAD — $wt_count worktrees are branched off it (the 'burned twice' failure). Switch/reset inside a worktree, or stop the other sessions first. Override: run the command yourself outside Claude."
-fi
-
-exit 0