kimaki 0.26.0 → 0.28.0

package/src/voice-routing-question.e2e.test.ts

@@ -0,0 +1,131 @@
+// Voice routes must leave the source question answerable without aborting its run.
+import { afterEach, describe, expect, test } from 'vitest'
+import { setupQueueAdvancedSuite, TEST_USER_ID } from './queue-advanced-e2e-setup.js'
+import { waitForBotMessageContaining, waitForFooterMessage } from './test-utils.js'
+import { store } from './store.js'
+
+const TEXT_CHANNEL_ID = '200000000000001083'
+
+describe('voice routing preserves source questions', () => {
+  const ctx = setupQueueAdvancedSuite({
+    channelId: TEXT_CHANNEL_ID,
+    channelName: 'voice-routing-question',
+    dirName: 'voice-routing-question',
+    username: 'voice-question-tester',
+  })
+
+  afterEach(() => {
+    store.setState({ test: { deterministicTranscription: null } })
+  })
+
+  // Separate registrations permit distinct inline snapshots with Vitest 3.
+  for (const sessionAction of ['btw', 'new-session'] as const) {
+    test(`${sessionAction} preserves the source dropdown`, async () => {
+      const marker = `QUESTION_SELECT_QUEUE_MARKER voice ${sessionAction}`
+      await ctx.discord.channel(TEXT_CHANNEL_ID).user(TEST_USER_ID).sendMessage({ content: marker })
+      const source = await ctx.discord.channel(TEXT_CHANNEL_ID).waitForThread({
+        timeout: 4_000,
+        predicate: (thread) => thread.name === marker,
+      })
+      const th = ctx.discord.thread(source.id)
+      const messages = await waitForBotMessageContaining({
+        discord: ctx.discord,
+        threadId: source.id,
+        text: 'How to proceed?',
+        timeout: 4_000,
+      })
+      const question = messages.find((message) => message.content.includes('How to proceed?'))
+      if (!question) throw new Error('Expected question message')
+      const customId = JSON.stringify(question.components).match(
+        /"custom_id":"(ask_question:[^"]+)"/,
+      )?.[1]
+      if (!customId) throw new Error('Expected question dropdown')
+
+      const prompt = `Explain routing without changing the source ${sessionAction}`
+      store.setState({
+        test: {
+          deterministicTranscription: {
+            transcription: prompt,
+            queueMessage: false,
+            sessionAction,
+          },
+        },
+      })
+      await th.user(TEST_USER_ID).sendVoiceMessage()
+      const confirmation = sessionAction === 'btw' ? 'Session forked!' : 'Created new session in'
+      const routingMessages = await waitForBotMessageContaining({
+        discord: ctx.discord,
+        threadId: source.id,
+        text: confirmation,
+        timeout: 4_000,
+      })
+      const targetId = routingMessages.find((message) => message.content.includes(confirmation))
+        ?.content.match(/<#(\d+)>/)?.[1]
+      if (!targetId) throw new Error('Expected destination thread link')
+      const target = await ctx.discord.channel(TEXT_CHANNEL_ID).waitForThread({
+        timeout: 4_000,
+        predicate: (thread) => thread.id === targetId,
+      })
+      await waitForFooterMessage({ discord: ctx.discord, threadId: target.id, timeout: 4_000 })
+      const interaction = await th.user(TEST_USER_ID).selectMenu({
+        messageId: question.id,
+        customId,
+        values: ['0'],
+      })
+      await th.waitForInteractionAck({ interactionId: interaction.id, timeout: 4_000 })
+      await waitForBotMessageContaining({
+        discord: ctx.discord,
+        threadId: source.id,
+        text: '» **voice-question-tester:** Alpha',
+        timeout: 4_000,
+      })
+      await waitForFooterMessage({ discord: ctx.discord, threadId: source.id, timeout: 4_000 })
+      const transcript = (await th.text({ showInteractions: true })).replaceAll(
+        target.id,
+        'TARGET_THREAD',
+      )
+      if (sessionAction === 'btw') {
+        expect(transcript).toMatchInlineSnapshot(`
+          "--- from: user (voice-question-tester)
+          QUESTION_SELECT_QUEUE_MARKER voice btw
+          --- from: assistant (TestBot)
+          > *using deterministic-provider/deterministic-v2*
+          **Select action**
+          How to proceed?
+          ✓ _Alpha_
+          --- from: user (voice-question-tester)
+          [attachment: voice-message.ogg]
+          --- from: assistant (TestBot)
+          🎤 Transcribing voice message...
+          📝 **Transcribed message:** Explain routing without changing the source btw
+          Session forked! Continue in <#TARGET_THREAD>
+          [user selects dropdown: 0]
+          » **voice-question-tester:** Alpha
+          > tool done
+          > *project ⋅ main ⋅ 1s ⋅ 0% ⋅ deterministic-v2* <@200000000000000991>"
+        `)
+      } else {
+        expect(transcript).toMatchInlineSnapshot(`
+          "--- from: user (voice-question-tester)
+          QUESTION_SELECT_QUEUE_MARKER voice new-session
+          --- from: assistant (TestBot)
+          > *using deterministic-provider/deterministic-v2*
+          **Select action**
+          How to proceed?
+          ✓ _Alpha_
+          --- from: user (voice-question-tester)
+          [attachment: voice-message.ogg]
+          --- from: assistant (TestBot)
+          🎤 Transcribing voice message...
+          📝 **Transcribed message:** Explain routing without changing the source new-session
+          Created new session in <#TARGET_THREAD>
+          [user selects dropdown: 0]
+          » **voice-question-tester:** Alpha
+          > tool done
+          > *project ⋅ main ⋅ <1s ⋅ 0% ⋅ deterministic-v2* <@200000000000000991>"
+        `)
+      }
+      expect(transcript).not.toContain('expired')
+    })
+  }
+})

package/src/voice.test.ts

@@ -10,6 +10,7 @@ import {
   extractTranscription,
   normalizeAudioMediaType,
   getOpenAIAudioConversionStrategy,
+  buildTranscriptionTool,
 } from './voice.js'
 import {
   getVoiceAttachmentMatchReason,
@@ -65,9 +66,92 @@ describe('voice attachment detection', () => {
       ]
     `)
   })
+
+  test('does not treat iOS and Discord videos as voice', () => {
+    expect(
+      [
+        getVoiceAttachmentMatchReason({
+          name: 'ScreenRecording_08-26-2026_11-10-29_1.mov',
+          contentType: 'video/quicktime',
+          duration: 12.4,
+          width: 1170,
+          height: 2532,
+        }),
+        getVoiceAttachmentMatchReason({
+          name: 'IMG_1234.MOV',
+          contentType: null,
+          duration: 8,
+          width: 1920,
+          height: 1080,
+        }),
+        getVoiceAttachmentMatchReason({
+          name: 'clip.mp4',
+          contentType: 'video/mp4',
+          duration: 4,
+        }),
+        getVoiceAttachmentMatchReason({
+          name: 'clip.mp4',
+          contentType: null,
+        }),
+        isVoiceAttachment({
+          name: 'memo.m4a',
+          contentType: null,
+          duration: 3.2,
+        }),
+      ]).toMatchInlineSnapshot(`
+        [
+          null,
+          null,
+          null,
+          null,
+          true,
+        ]
+      `)
+  })
 })
 
 describe('extractTranscription', () => {
+  test('only offers contextual routing when a source session exists', () => {
+    expect(buildTranscriptionTool({}).inputSchema).toMatchObject({
+      properties: { sessionAction: { enum: ['new-session'] } },
+    })
+    expect(buildTranscriptionTool({ canForkSession: true }).inputSchema).toMatchObject({
+      properties: { sessionAction: { enum: ['btw', 'new-session'] } },
+    })
+    expect(JSON.stringify(buildTranscriptionTool({ canForkSession: true })))
+      .not.toContain('by the way')
+  })
+
+  test.each(['btw', 'new-session'])('extracts %s routing without queueing', (sessionAction) => {
+    const result = extractTranscription([{
+      type: 'tool-call',
+      toolCallId: 'routing',
+      toolName: 'transcriptionResult',
+      input: JSON.stringify({
+        transcription: 'Explain the authentication flow',
+        sessionAction,
+        queueMessage: true,
+        agent: 'plan',
+      }),
+    }])
+    expect(result).toEqual({
+      transcription: 'Explain the authentication flow',
+      sessionAction,
+      queueMessage: false,
+      agent: 'plan',
+    })
+  })
+
+  test('ignores unknown session routing', () => {
+    const result = extractTranscription([{
+      type: 'tool-call',
+      toolCallId: 'routing',
+      toolName: 'transcriptionResult',
+      input: JSON.stringify({ transcription: 'Keep working', sessionAction: 'invalid' }),
+    }])
+    expect(result).toEqual({ transcription: 'Keep working', queueMessage: false, agent: undefined })
+  })
+
   test('extracts transcription from tool call', () => {
     const result = extractTranscription([
       {
@@ -81,6 +165,7 @@ describe('extractTranscription', () => {
       {
         "agent": undefined,
         "queueMessage": false,
+        "sessionAction": undefined,
         "transcription": "hello world",
       }
     `)
@@ -102,6 +187,7 @@ describe('extractTranscription', () => {
       {
         "agent": undefined,
         "queueMessage": true,
+        "sessionAction": undefined,
         "transcription": "Fix the login bug in auth.ts",
       }
     `)
@@ -172,24 +258,31 @@ describe('extractTranscription', () => {
   })
 })
 
-describe('transcribeAudio with real API', () => {
+const liveVoiceTest = describe.skipIf(
+  process.env['KIMAKI_LIVE_VOICE_TESTS'] !== '1',
+)
+
+liveVoiceTest('transcribeAudio with real API', () => {
   const audioPath = path.join(
     import.meta.dirname,
     '..',
     'scripts',
     'example-audio.mp3',
   )
+  const oggPath = path.join(import.meta.dirname, '..', 'scripts', 'example-audio.ogg')
+  const geminiLiveTest = test.skipIf(
+    !process.env.GEMINI_API_KEY || !fs.existsSync(audioPath),
+  )
+  const openAiLiveTest = test.skipIf(
+    !process.env.OPENAI_API_KEY || !fs.existsSync(audioPath),
+  )
+  const openAiOggLiveTest = test.skipIf(
+    !process.env.OPENAI_API_KEY || !fs.existsSync(oggPath),
+  )
 
-  test('transcribes with Gemini', { timeout: 30_000 }, async () => {
+  geminiLiveTest('transcribes with Gemini', { timeout: 30_000 }, async () => {
     const apiKey = process.env.GEMINI_API_KEY
-    if (!apiKey) {
-      console.log('Skipping: GEMINI_API_KEY not set')
-      return
-    }
-    if (!fs.existsSync(audioPath)) {
-      console.log('Skipping: example-audio.mp3 not found')
-      return
-    }
+    if (!apiKey) throw new Error('GEMINI_API_KEY is required')
 
     const audio = fs.readFileSync(audioPath)
     const result = await transcribeAudio({
@@ -205,16 +298,9 @@ describe('transcribeAudio with real API', () => {
     console.log('Gemini transcription:', result)
   })
 
-  test('transcribes with OpenAI', { timeout: 30_000 }, async () => {
+  openAiLiveTest('transcribes with OpenAI', { timeout: 30_000 }, async () => {
     const apiKey = process.env.OPENAI_API_KEY
-    if (!apiKey) {
-      console.log('Skipping: OPENAI_API_KEY not set')
-      return
-    }
-    if (!fs.existsSync(audioPath)) {
-      console.log('Skipping: example-audio.mp3 not found')
-      return
-    }
+    if (!apiKey) throw new Error('OPENAI_API_KEY is required')
 
     const audio = fs.readFileSync(audioPath)
     const result = await transcribeAudio({
@@ -230,17 +316,9 @@ describe('transcribeAudio with real API', () => {
     console.log('OpenAI transcription:', result)
   })
 
-  test('transcribes OGG with OpenAI (converts to WAV)', { timeout: 30_000 }, async () => {
+  openAiOggLiveTest('transcribes OGG with OpenAI (converts to WAV)', { timeout: 30_000 }, async () => {
     const apiKey = process.env.OPENAI_API_KEY
-    const oggPath = path.join(import.meta.dirname, '..', 'scripts', 'example-audio.ogg')
-    if (!apiKey) {
-      console.log('Skipping: OPENAI_API_KEY not set')
-      return
-    }
-    if (!fs.existsSync(oggPath)) {
-      console.log('Skipping: example-audio.ogg not found')
-      return
-    }
+    if (!apiKey) throw new Error('OPENAI_API_KEY is required')
 
     const audio = fs.readFileSync(oggPath)
     const result = await transcribeAudio({

package/src/voice.ts

@@ -258,22 +258,31 @@ type TranscriptionLoopError =
 
 // Build the transcription tool schema dynamically so the agent field can
 // use an enum constrained to the actual available agent names.
-function buildTranscriptionTool({
+export function buildTranscriptionTool({
   agentNames,
+  canForkSession = false,
 }: {
   agentNames?: string[]
+  canForkSession?: boolean
 }): LanguageModelV3FunctionTool {
   const properties: Record<string, Record<string, unknown>> = {
     transcription: {
       type: 'string',
       description:
-        'The final transcription of the audio. MUST be non-empty. If audio is unclear, transcribe your best interpretation. If silent, too short to understand, or completely incomprehensible, use "[inaudible audio]".',
+        'The final transcription of the audio. If only a session routing instruction was spoken with no request, return an empty string. If audio is unclear, transcribe your best interpretation. If silent, too short to understand, or completely incomprehensible, use "[inaudible audio]".',
     },
     queueMessage: {
       type: 'boolean',
       description:
         'Set to true ONLY if the user explicitly says "queue this message", "queue this", or similar phrasing indicating they want this message queued instead of sent immediately. If not mentioned, omit or set to false.',
     },
+    sessionAction: {
+      type: 'string',
+      enum: canForkSession ? ['btw', 'new-session'] : ['new-session'],
+      description:
+        'Use "new-session" only when explicitly asked to create a new chat, session, or thread with no conversation history. Remove routing instructions from transcription. Omit for normal messages. Never combine with queueMessage.' +
+        (canForkSession ? ' Use "btw" only when explicitly asked to create a side chat or fork with current context.' : ''),
+    },
   }
 
   if (agentNames && agentNames.length > 0) {
@@ -301,6 +310,7 @@ function buildTranscriptionTool({
 export type TranscriptionResult = {
   transcription: string
   queueMessage: boolean
+  sessionAction?: 'btw' | 'new-session'
   /** Agent name extracted from voice message, only set if user explicitly requested an agent. */
   agent?: string
 }
@@ -308,7 +318,7 @@ export type TranscriptionResult = {
 /**
  * Extract transcription result from doGenerate content array.
  * Looks for a tool-call named 'transcriptionResult', falls back to text content.
- * Returns structured result with transcription text and queueMessage flag.
+ * Returns transcription text, queue/session routing, and optional agent selection.
  */
 export function extractTranscription(
   content: Array<LanguageModelV3Content>,
@@ -327,7 +337,10 @@ export function extractTranscription(
       return {}
     })()
     const transcription = (typeof args.transcription === 'string' ? args.transcription : '').trim()
-    const queueMessage = args.queueMessage === true
+    const sessionAction = args.sessionAction === 'btw' || args.sessionAction === 'new-session'
+      ? args.sessionAction
+      : undefined
+    const queueMessage = !sessionAction && args.queueMessage === true
     const agent = typeof args.agent === 'string' ? args.agent : undefined
     voiceLogger.log(
       `Transcription result received: "${transcription.slice(0, 100)}..."${queueMessage ? ' [QUEUE]' : ''}${agent ? ` [AGENT:${agent}]` : ''}`,
@@ -335,7 +348,7 @@ export function extractTranscription(
     if (!transcription) {
       return new EmptyTranscriptionError()
     }
-    return { transcription, queueMessage, agent }
+    return { transcription, queueMessage, agent, sessionAction }
   }
 
   // Fall back to text content if no tool call
@@ -363,6 +376,7 @@ async function runTranscriptionOnce({
   mediaType,
   temperature,
   agentNames,
+  canForkSession,
   provider,
 }: {
   model: LanguageModelV3
@@ -371,9 +385,10 @@ async function runTranscriptionOnce({
   mediaType: string
   temperature: number
   agentNames?: string[]
+  canForkSession?: boolean
   provider?: TranscriptionProvider
 }): Promise<TranscriptionLoopError | TranscriptionResult> {
-  const tool = buildTranscriptionTool({ agentNames })
+  const tool = buildTranscriptionTool({ agentNames, canForkSession })
   const options: LanguageModelV3CallOptions = {
     prompt: [
       {
@@ -471,6 +486,7 @@ export async function transcribeAudio({
   currentSessionContext,
   lastSessionContext,
   agents,
+  canForkSession = false,
 }: {
   audio: Buffer | Uint8Array | ArrayBuffer | string
   prompt?: string
@@ -485,6 +501,7 @@ export async function transcribeAudio({
   lastSessionContext?: string
   /** Available agents for agent selection via voice. Names used as enum values in the tool schema. */
   agents?: Array<{ name: string; description?: string }>
+  canForkSession?: boolean
 }): Promise<TranscribeAudioErrors | TranscriptionResult> {
   const apiKey =
     apiKeyParam || process.env.OPENAI_API_KEY || process.env.GEMINI_API_KEY
@@ -595,6 +612,16 @@ This is a software development environment. The speaker is giving instructions t
  - Example: "Queue this message. Fix the login bug in auth.ts" → transcription: "Fix the login bug in auth.ts", queueMessage: true
  - If removing the queue phrase would leave empty content (user only said "queue this" with nothing else), keep the full spoken text as the transcription — never return an empty transcription.
  - If no queue intent is detected, omit queueMessage or set it to false.
+
+ SESSION ROUTING:
+  - Only route when the user explicitly asks to create a new chat, session, or thread for the request. Set sessionAction to "new-session": a separate thread with NO conversation history.
+  ${canForkSession ? '- If the user explicitly asks to create a side chat or fork with current context, set sessionAction to "btw" instead.' : '- Context-preserving side chats and forks are unavailable here. Preserve requests for them as spoken text without setting sessionAction.'}
+ - Remove these routing words from the transcription. Include only the actual request, not instructions about where to send it.
+ - Example: "Fix the login bug. Create this as a new chat session" -> transcription: "Fix the login bug", sessionAction: "new-session".
+  - Do not infer routing from conversational phrases, task content, or session context.
+  - If both routing and queueing are requested, sessionAction takes priority; set queueMessage to false. An explicit fresh-session request takes priority over a contextual fork.
+  - If there is no actual request after removing routing words, return an empty transcription and omit sessionAction. Never invent placeholder content.
+ - Otherwise omit sessionAction. Agent selection can be combined with either route.
 ${agents && agents.length > 0 ? `
  AGENT SELECTION:
  - Only set the agent field when the user explicitly says phrases like "use the X agent", "switch to X agent", "with the X agent", or similar phrasing that clearly names a specific agent to switch to.
@@ -634,6 +661,7 @@ Note: "critique" is a CLI tool for showing diffs in the browser.`
     mediaType,
     temperature: temperature ?? 0.3,
     agentNames: agentNames && agentNames.length > 0 ? agentNames : undefined,
+    canForkSession,
     provider: resolvedProvider,
   })
 }

package/src/worktree-clone-isolation.e2e.test.ts

@@ -0,0 +1,213 @@
+// Verifies OpenCode workspace creation stays bound to the requested local clone.
+
+import fs from 'node:fs'
+import path from 'node:path'
+import { afterAll, beforeAll, expect, test } from 'vitest'
+import { setDataDir } from './config.js'
+import { tryWorkspaceCreate } from './commands/new-worktree.js'
+import { initializeOpencodeForDirectory, stopOpencodeServer } from './opencode.js'
+import { chooseLockPort } from './test-utils.js'
+import { execAsync, getManagedWorktreeDirectory } from './worktrees.js'
+import { KIMAKI_WORKTREE_ADAPTER_TYPE } from './git-worktree-core.js'
+
+const WORKTREE_BRANCH = 'opencode/kimaki-clone-isolation'
+const REJECTED_WORKTREE_BRANCH = 'opencode/kimaki-rejected-clone-isolation'
+
+async function git({ cwd, args }: { cwd: string; args: string[] }) {
+  const result = await execAsync(`git ${args.map((arg) => JSON.stringify(arg)).join(' ')}`, {
+    cwd,
+    timeout: 60_000,
+  })
+  return result.stdout.trim()
+}
+
+let sandbox = ''
+let requestedClone = ''
+let otherClone = ''
+
+beforeAll(async () => {
+  const root = path.resolve(process.cwd(), 'tmp')
+  fs.mkdirSync(root, { recursive: true })
+  sandbox = fs.mkdtempSync(path.join(root, 'worktree-clone-isolation-'))
+  const remote = path.join(sandbox, 'remote.git')
+  requestedClone = path.join(sandbox, 'holocron')
+  otherClone = path.join(sandbox, 'fumabase')
+
+  process.env['KIMAKI_LOCK_PORT'] = String(chooseLockPort({ key: 'worktree-clone-isolation' }))
+  setDataDir(path.join(sandbox, 'data'))
+
+  await git({ cwd: sandbox, args: ['init', '--bare', '-b', 'main', remote] })
+  await git({ cwd: sandbox, args: ['clone', remote, otherClone] })
+  await git({
+    cwd: otherClone,
+    args: ['config', 'user.email', 'kimaki-tests@example.com'],
+  })
+  await git({ cwd: otherClone, args: ['config', 'user.name', 'Kimaki Tests'] })
+  fs.writeFileSync(path.join(otherClone, 'preview.txt'), 'old preview\n')
+  await git({ cwd: otherClone, args: ['add', 'preview.txt'] })
+  await git({ cwd: otherClone, args: ['commit', '-m', 'old preview'] })
+  await git({ cwd: otherClone, args: ['push', 'origin', 'HEAD:main'] })
+  await git({ cwd: otherClone, args: ['switch', '-c', 'preview'] })
+
+  await git({ cwd: sandbox, args: ['clone', remote, requestedClone] })
+  await git({
+    cwd: requestedClone,
+    args: ['config', 'user.email', 'kimaki-tests@example.com'],
+  })
+  await git({ cwd: requestedClone, args: ['config', 'user.name', 'Kimaki Tests'] })
+  fs.mkdirSync(path.join(requestedClone, 'vite'))
+  fs.writeFileSync(path.join(requestedClone, 'vite', 'README.md'), 'new layout\n')
+  await git({ cwd: requestedClone, args: ['add', 'vite/README.md'] })
+  await git({ cwd: requestedClone, args: ['commit', '-m', 'add vite layout'] })
+}, 20_000)
+
+afterAll(async () => {
+  await stopOpencodeServer()
+  delete process.env['KIMAKI_LOCK_PORT']
+  if (sandbox) fs.rmSync(sandbox, { recursive: true, force: true })
+})
+
+test('creates a workspace from the exact requested clone and commit', async () => {
+  const requestedCommit = await git({
+    cwd: requestedClone,
+    args: ['rev-parse', 'HEAD^{commit}'],
+  })
+  const requestedCommonDirectory = path.resolve(
+    requestedClone,
+    await git({
+      cwd: requestedClone,
+      args: ['rev-parse', '--git-common-dir'],
+    }),
+  )
+
+  const requestedClientResult = await initializeOpencodeForDirectory(requestedClone)
+  if (requestedClientResult instanceof Error) throw requestedClientResult
+  const otherClientResult = await initializeOpencodeForDirectory(otherClone)
+  if (otherClientResult instanceof Error) throw otherClientResult
+  const requestedClient = requestedClientResult()
+  const otherClient = otherClientResult()
+
+  // Load the requested clone first, then overwrite the colliding OpenCode
+  // project adapter with the other clone before creating the workspace.
+  await requestedClient.config.get({ directory: requestedClone })
+  await otherClient.config.get({ directory: otherClone })
+
+  const response = await requestedClient.experimental.workspace.create({
+    directory: requestedClone,
+    type: KIMAKI_WORKTREE_ADAPTER_TYPE,
+    branch: WORKTREE_BRANCH,
+    extra: {
+      projectDirectory: requestedClone,
+      baseCommit: requestedCommit,
+    },
+  })
+  if (response.error) throw new Error(JSON.stringify(response.error))
+  const workspace = response.data
+  if (!workspace) throw new Error('OpenCode returned no workspace')
+
+  try {
+    const actualCommit = await git({
+      cwd: workspace.directory!,
+      args: ['rev-parse', 'HEAD^{commit}'],
+    })
+    const actualCommonDirectory = path.resolve(
+      workspace.directory!,
+      await git({
+        cwd: workspace.directory!,
+        args: ['rev-parse', '--git-common-dir'],
+      }),
+    )
+
+    expect({
+      usesRequestedClone:
+        path.resolve(actualCommonDirectory) === path.resolve(requestedCommonDirectory),
+      usesRequestedCommit: actualCommit === requestedCommit,
+      hasRequestedLayout: fs.existsSync(path.join(workspace.directory!, 'vite', 'README.md')),
+      absentFromOtherClone: !(
+        await git({
+          cwd: otherClone,
+          args: ['worktree', 'list', '--porcelain'],
+        })
+      ).includes(workspace.directory!),
+    }).toMatchInlineSnapshot(`
+        {
+          "absentFromOtherClone": true,
+          "hasRequestedLayout": true,
+          "usesRequestedClone": true,
+          "usesRequestedCommit": true,
+        }
+      `)
+  } finally {
+    await requestedClient.experimental.workspace.remove({
+      id: workspace.id,
+      directory: requestedClone,
+    })
+  }
+}, 30_000)
+
+test('removes workspace state when identity validation rejects creation', async () => {
+  const requestedCommit = await git({
+    cwd: requestedClone,
+    args: ['rev-parse', 'HEAD^{commit}'],
+  })
+
+  const result = await tryWorkspaceCreate({
+    worktreeName: REJECTED_WORKTREE_BRANCH,
+    projectDirectory: requestedClone,
+    baseCommit: requestedCommit.toUpperCase(),
+  })
+  expect(result).toBeInstanceOf(Error)
+
+  const clientResult = await initializeOpencodeForDirectory(requestedClone)
+  if (clientResult instanceof Error) throw clientResult
+  const client = clientResult()
+  const listResponse = await client.experimental.workspace.list({
+    directory: requestedClone,
+  })
+  if (listResponse.error) throw new Error(JSON.stringify(listResponse.error))
+  const rejectedWorkspaces = (listResponse.data ?? []).filter((workspace) => {
+    return workspace.branch === REJECTED_WORKTREE_BRANCH
+  })
+
+  try {
+    const managedDirectory = getManagedWorktreeDirectory({
+      directory: requestedClone,
+      name: REJECTED_WORKTREE_BRANCH,
+    })
+    const [requestedWorktrees, otherWorktrees] = await Promise.all([
+      git({ cwd: requestedClone, args: ['worktree', 'list', '--porcelain'] }),
+      git({ cwd: otherClone, args: ['worktree', 'list', '--porcelain'] }),
+    ])
+    const branchExists = await execAsync(
+      `git show-ref --verify --quiet ${JSON.stringify(`refs/heads/${REJECTED_WORKTREE_BRANCH}`)}`,
+      { cwd: requestedClone },
+    )
+      .then(() => true)
+      .catch(() => false)
+
+    expect({
+      workspaceRows: rejectedWorkspaces.length,
+      directoryExists: fs.existsSync(managedDirectory),
+      requestedCloneRegistration: requestedWorktrees.includes(managedDirectory),
+      otherCloneRegistration: otherWorktrees.includes(managedDirectory),
+      branchExists,
+    }).toMatchInlineSnapshot(`
+      {
+        "branchExists": false,
+        "directoryExists": false,
+        "otherCloneRegistration": false,
+        "requestedCloneRegistration": false,
+        "workspaceRows": 0,
+      }
+    `)
+  } finally {
+    await Promise.all(
+      rejectedWorkspaces.map((workspace) => {
+        return client.experimental.workspace.remove({
+          id: workspace.id,
+          directory: requestedClone,
+        })
+      }),
+    )
+  }
+}, 30_000)