one-code-extension 0.1.4 → 0.3.0

package/extensions/workflow/vm-runtime.ts

@@ -1,31 +1,127 @@
 /**
- * Executes a parsed workflow script body inside a fresh `node:vm` context.
+ * Runs a parsed workflow script body in a worker thread (`script-worker.mjs`),
+ * inside a `node:vm` context there. Off the TUI thread, a runaway script
+ * cannot freeze pi, and the worker's heartbeat lets the host kill CPU loops
+ * even after an await — which a vm `timeout` (synchronous prefix only) never
+ * could. The run's signal also stops scripts that await forever.
  *
- * The context gets exactly one host binding — `__workflow__`, the globals
- * object — and none of the host's intrinsics (the vm realm supplies its own
- * Math/Date/Promise/etc., which the prelude then neuters for determinism).
- * The vm `timeout` only bounds the synchronous prefix of execution (up to the
- * first await); async runaway is bounded by the agent/budget caps inside the
- * injected agent(), not here.
+ * Only agent()/workflow() RPCs and log/phase notices reach the host, through
+ * the gated globals. The vm context is a determinism guard for resume replay,
+ * NOT a security sandbox: a script can reach the worker realm through the
+ * prototype chain of its globals, so what it gets is the worker's process, not
+ * pi's — the same class of exposure as before, one thread further away.
  */
-
-import vm from "node:vm";
-import type { ScriptGlobals } from "./globals.ts";
+import { Worker } from "node:worker_threads";
+import { performance } from "node:perf_hooks";
+import { MAX_AGENTS_PER_RUN, MAX_ITEMS_PER_CALL, MAX_NOTICES_PER_TICK, type ScriptGlobals } from "./globals.ts";
+import { whenAborted } from "../lib/abort.ts";
 import { wrapScriptBody } from "./script-source.ts";
-import { WorkflowScriptError } from "./types.ts";
+import { WorkflowScriptError, type AgentCallOptions } from "./types.ts";
+
+export interface WorkflowRuntimeOptions {
+	signal?: AbortSignal;
+	/** Maximum time without a worker heartbeat, not a timeout on agent I/O. */
+	timeoutMs?: number;
+}
+
+const SLOT_SPENT = 0;
+const SLOT_HEARTBEAT = 1;
 
-const SYNC_TIMEOUT_MS = 5_000;
+type WorkerMessage =
+	| { type: "result"; value: unknown }
+	| { type: "error"; message: string }
+	| { type: "log" | "phase"; value: string }
+	| { type: "call"; id: number; method: "agent"; args: [string, AgentCallOptions?] }
+	| { type: "call"; id: number; method: "workflow"; args: [unknown, unknown?] };
 
-export async function runWorkflowScript(body: string, globals: ScriptGlobals, filename = "workflow.js"): Promise<unknown> {
-	const context = vm.createContext({ __workflow__: globals }, { codeGeneration: { strings: false, wasm: false } });
-	let completion: unknown;
+export async function runWorkflowScript(
+	body: string,
+	globals: ScriptGlobals,
+	filename = "workflow.js",
+	options: WorkflowRuntimeOptions = {},
+): Promise<unknown> {
+	if (options.signal?.aborted) throw new WorkflowScriptError("Workflow run was aborted");
+	const timeoutMs = options.timeoutMs ?? 5_000;
+	// Two atomic slots shared with the worker: [0] the output tokens spent so
+	// far (kept current here so budget.spent()/remaining() stay synchronous in
+	// scripts), [1] the worker's heartbeat counter (bumped by its own timer, so
+	// a script that starves the worker's event loop stops bumping it). Atomics,
+	// not messages: the host reads them on its own schedule, and a stalled host
+	// loop cannot misread a healthy worker.
+	const shared = new BigInt64Array(new SharedArrayBuffer(2 * BigInt64Array.BYTES_PER_ELEMENT));
+	const updateBudget = () => Atomics.store(shared, SLOT_SPENT, BigInt(Math.trunc(globals.budget.spent())));
+	updateBudget();
+	const worker = new Worker(new URL("./script-worker.mjs", import.meta.url), {
+		workerData: {
+			source: wrapScriptBody(body), filename, args: globals.args,
+			total: globals.budget.total, shared: shared.buffer,
+			maxItems: MAX_ITEMS_PER_CALL, maxPending: MAX_AGENTS_PER_RUN, maxNotices: MAX_NOTICES_PER_TICK,
+		},
+		// Do not inherit CLI test/load hooks into this plain JavaScript worker.
+		execArgv: [],
+	});
+	let watchdog: ReturnType<typeof setInterval> | undefined;
+	let unhookAbort = () => {};
 	try {
-		const script = new vm.Script(wrapScriptBody(body), { filename });
-		completion = script.runInContext(context, { timeout: SYNC_TIMEOUT_MS });
-	} catch (error) {
-		throw error instanceof WorkflowScriptError ? error : new WorkflowScriptError(`Workflow script failed: ${(error as Error).message}`);
+		return await new Promise<unknown>((resolve, reject) => {
+			let stopped = false;
+			let lastHeartbeat = performance.now();
+			let lastBeat = 0n;
+			const fail = (message: string) => {
+				if (stopped) return;
+				stopped = true;
+				reject(new WorkflowScriptError(message));
+			};
+			unhookAbort = whenAborted(options.signal, () => fail("Workflow run was aborted"));
+			watchdog = setInterval(() => {
+				updateBudget();
+				const beat = Atomics.load(shared, SLOT_HEARTBEAT);
+				if (beat !== lastBeat) {
+					lastBeat = beat;
+					lastHeartbeat = performance.now();
+				}
+				// Until the first beat the worker is still starting up: allow at least 5 s.
+				const allowed = lastBeat === 0n ? Math.max(5_000, timeoutMs) : timeoutMs;
+				if (performance.now() - lastHeartbeat > allowed) {
+					fail(`Workflow script timed out: worker was unresponsive for ${timeoutMs}ms`);
+				}
+			}, Math.max(10, Math.min(250, timeoutMs / 4)));
+			const reply = async (message: Extract<WorkerMessage, { type: "call" }>) => {
+				try {
+					const value = await (message.method === "agent"
+						? globals.agent(...message.args)
+						: globals.workflow(...message.args));
+					if (stopped) return;
+					updateBudget();
+					worker.postMessage({ id: message.id, value });
+				} catch (error) {
+					if (stopped) return;
+					worker.postMessage({ id: message.id, error: {
+						message: error instanceof Error ? error.message : String(error),
+						fatal: error instanceof WorkflowScriptError,
+					} });
+				}
+			};
+			worker.on("message", (message: WorkerMessage) => {
+				if (stopped) return;
+				try {
+					switch (message.type) {
+						case "result": stopped = true; resolve(message.value); break;
+						case "error": fail(`Workflow script failed: ${message.message}`); break;
+						case "log": globals.log(message.value); break;
+						case "phase": globals.phase(message.value); break;
+						case "call": void reply(message).catch((error) => fail(String(error))); break;
+					}
+				} catch (error) {
+					fail(error instanceof Error ? error.message : String(error));
+				}
+			});
+			worker.on("error", (error) => fail(`Workflow worker failed: ${error instanceof Error ? error.message : String(error)}`));
+			worker.on("exit", (code) => fail(`Workflow worker exited before returning a result (code ${code})`));
+		});
+	} finally {
+		clearInterval(watchdog);
+		unhookAbort();
+		await worker.terminate();
 	}
-	// The wrap's final statement is the async IIFE, so the completion value is
-	// the promise of the script's own result (including a top-level `return`).
-	return await Promise.resolve(completion);
 }

package/extensions/workflow/widget.ts

@@ -1,18 +1,43 @@
 /**
- * Live progress panel for workflow runs, rendered with the plain string[]
- * overload of ctx.ui.setWidget. Re-renders are debounced so a chatty fan-out
- * doesn't thrash the TUI; the widget clears itself once no run is active.
+ * Persistent workflow status strip below the editor (Claude Code's bottom
+ * workflow entry): one row per run — marker, name, description, right-aligned
+ * live stats — rendered via the component overload of ctx.ui.setWidget so it
+ * can right-align against the real width. Re-renders are debounced against
+ * chatty fan-outs; a 1s ticker keeps elapsed time moving while a run is live.
+ *
+ * The strip also carries the soft-focus state for the down-arrow flow (wired
+ * in index.ts): `setFocus` highlights a row, and the factory captures the TUI
+ * handle + the focused editor component so the input hook can verify the
+ * editor really has focus before stealing keys from it.
  */
 
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { linesComponent, liveUiCtx, safeThemeBold, safeThemePaint } from "../lib/tui-render.ts";
 import type { RunHandle, WorkflowRunManager } from "./run-manager.ts";
+import { MAX_STATUS_ROWS, renderStatusRows, type ViewerRunSnapshot } from "./viewer.ts";
 
 const WIDGET_KEY = "workflow";
 const DEBOUNCE_MS = 250;
-const EVENT_TAIL = 4;
+
+/** The slice of pi-tui's TUI the strip needs (structurally typed, no dep). */
+interface TuiLike {
+	getFocusedComponent?(): unknown;
+}
 
 export class WorkflowWidget {
 	private timer: ReturnType<typeof setTimeout> | undefined;
+	private ticker: ReturnType<typeof setInterval> | undefined;
+	/** Soft-focused row index (into the newest-first snapshot list). */
+	focusIndex: number | undefined;
+	/** Captured from the widget factory; used by the focus wiring in index.ts. */
+	tui: TuiLike | undefined;
+	/**
+	 * The core editor component, captured while it holds focus (duck-typed on
+	 * getText — dialogs and selectors don't have it). Identity-compared before
+	 * consuming any key, so the strip never steals input from a dialog or a
+	 * pop-up editor.
+	 */
+	editorBaseline: unknown;
 
 	constructor(
 		private readonly manager: WorkflowRunManager,
@@ -25,8 +50,62 @@ export class WorkflowWidget {
 		this.schedule();
 	}
 
+	/**
+	 * Re-set the widget so it re-inserts below rows other extensions just set
+	 * (setWidget order is last-write order); the permission-mode badge triggers
+	 * this over the status channel to keep the strip beneath the mode line.
+	 */
+	refresh(): void {
+		this.schedule();
+	}
+
+	/** Rows currently selectable (capped like the render). */
+	rowCount(): number {
+		return Math.min(this.manager.list().length, MAX_STATUS_ROWS);
+	}
+
+	selectedRun(): ViewerRunSnapshot | undefined {
+		if (this.focusIndex === undefined) return undefined;
+		return this.manager.snapshots(MAX_STATUS_ROWS)[this.focusIndex];
+	}
+
+	setFocus(index: number | undefined): void {
+		this.focusIndex = index;
+		this.render();
+	}
+
+	/** True when the core editor is focused and empty — safe to take the down key. */
+	editorFocusedAndIdle(ctx: ExtensionContext): boolean {
+		if (!this.editorFocused()) return false;
+		try {
+			return ctx.ui.getEditorText().trim() === "";
+		} catch {
+			return false;
+		}
+	}
+
+	/** True when the core editor still holds real focus (strip may keep soft focus). */
+	editorFocused(): boolean {
+		return Boolean(this.tui && this.editorBaseline && this.tui.getFocusedComponent?.() === this.editorBaseline);
+	}
+
+	/**
+	 * Set by dispose(): pi replaces the session (and this instance) on /clear,
+	 * /new and /resume and invalidates the old ctx, while aborting runs still
+	 * report progress for a moment — schedule()/render() must go quiet the
+	 * instant we are disposed (same hazard as the subagent panel, SUBAGENT-REVIEW H1).
+	 */
+	private disposed = false;
+
+	dispose(): void {
+		this.disposed = true;
+		if (this.timer) clearTimeout(this.timer);
+		if (this.ticker) clearInterval(this.ticker);
+		this.timer = this.ticker = undefined;
+	}
+
 	private schedule(): void {
-		if (this.timer) return;
+		if (this.disposed || this.timer) return;
 		this.timer = setTimeout(() => {
 			this.timer = undefined;
 			this.render();
@@ -35,22 +114,51 @@ export class WorkflowWidget {
 	}
 
 	private render(): void {
-		const ctx = this.getCtx();
-		if (!ctx?.hasUI) return;
-		const active = this.manager.list().filter((h) => h.status === "running");
-		if (active.length === 0) {
+		const ctx = this.disposed ? undefined : liveUiCtx(this.getCtx());
+		if (!ctx) {
+			this.syncTicker([]);
+			return;
+		}
+		const totalRuns = this.manager.list().length;
+		const runs = this.manager.snapshots(MAX_STATUS_ROWS);
+		this.syncTicker(runs);
+		if (!runs.length) {
 			ctx.ui.setWidget(WIDGET_KEY, undefined);
 			return;
 		}
-		const lines: string[] = [];
-		for (const handle of active) {
-			const state = handle.state;
-			const phase = state?.currentPhase();
-			const stats = state ? `${state.agentCount()} agents · ${state.outputTokens()} out-tokens` : "starting…";
-			lines.push(`⚡ workflow ${handle.meta.name} (${handle.runId}) — ${phase ? `${phase} · ` : ""}${stats}`);
-			for (const event of handle.recentEvents.slice(-EVENT_TAIL)) lines.push(`   ${event}`);
+		if (this.focusIndex !== undefined && this.focusIndex >= this.rowCount()) {
+			this.focusIndex = Math.max(0, this.rowCount() - 1);
+		}
+		const selected = this.focusIndex;
+		const now = Date.now();
+		ctx.ui.setWidget(
+			WIDGET_KEY,
+			(tui, theme) => {
+				this.tui = tui as TuiLike;
+				const focused = (tui as TuiLike).getFocusedComponent?.();
+				if (focused && typeof (focused as { getText?: unknown }).getText === "function") {
+					this.editorBaseline = focused;
+				}
+				const paint = { fg: safeThemePaint(theme), bold: safeThemeBold(theme) };
+				// One-space indent to align with string-array widgets (pi's Text
+				// wraps those with paddingX=1 — the permission-mode badge above).
+				return linesComponent((width) =>
+					renderStatusRows({ runs, totalRuns, selected, width: width - 1, now }, paint).map((line) => ` ${line}`),
+				);
+			},
+			{ placement: "belowEditor" },
+		);
+	}
+
+	/** Keep elapsed time ticking while any run is live; stop when none is. */
+	private syncTicker(runs: ViewerRunSnapshot[]): void {
+		const active = runs.some((run) => run.status === "running");
+		if (active && !this.ticker && !this.disposed) {
+			this.ticker = setInterval(() => this.render(), 1000);
+			this.ticker.unref?.();
+		} else if (!active && this.ticker) {
+			clearInterval(this.ticker);
+			this.ticker = undefined;
 		}
-		lines.push("   /workflows to inspect · /workflows stop <runId> to stop");
-		ctx.ui.setWidget(WIDGET_KEY, lines);
 	}
 }

package/extensions/worktree/guards.ts

@@ -0,0 +1,240 @@
+/**
+ * Worktree-session bash guards (pure).
+ *
+ * While enter_worktree isolation is active, other sessions may be working in
+ * the shared checkout and in sibling worktrees at the same time. Two
+ * invariants are enforced on bash commands BEFORE execution (and before the
+ * permission prompt — the guard runs in the same tool_call hook that rewrites
+ * inputs, which loads ahead of the permission gate):
+ *
+ * 1. Git operations must verifiably target this session's own worktree. A git
+ *    whose repository is decided at runtime (`xargs`/`parallel`/`find -exec`
+ *    feeding it arguments, a `-C "$DIR"` computed from a variable, a `cd`
+ *    whose destination cannot be resolved), or that points into the shared
+ *    checkout or a sibling worktree (`git -C`, `--git-dir`, `--work-tree`, a
+ *    preceding `cd`), is refused with the fix named. Git against an unrelated
+ *    repository elsewhere on disk is left alone — the permission gate and
+ *    auto-mode still apply to it.
+ * 2. The stash stack is shared by the main checkout and every worktree of the
+ *    repository, and parallel sessions can interleave on it. Stash forms that
+ *    collide with a concurrent session (untagged push, `pop`, `clear`,
+ *    ref-less `drop`) are refused with the tag + apply-by-SHA recipe.
+ *
+ * Steering, not security: only bash is inspected here, and an unparseable
+ * command is refused only when it visibly involves git (fail closed on the
+ * invariant, fail open on everything else).
+ */
+
+import { homedir } from "node:os";
+import { isWithin, toAbsolute } from "../auto-mode/paths.ts";
+import { gitSubcommand, leadTokens, parseCommand, resolvePayload, type Token } from "../auto-mode/shell-analysis.ts";
+
+export interface WorktreeGuardContext {
+	command: string;
+	/** The isolated worktree this session works in. */
+	worktreePath: string;
+	/** Root of the shared checkout the worktree belongs to. */
+	sharedRoot: string;
+}
+
+/** Expansion syntax the guard cannot resolve statically. */
+const hasExpansion = (value: string) => /[$`]/.test(value);
+
+const isolated = (worktreePath: string, problem: string, fix: string): string =>
+	`This session is isolated in the worktree ${worktreePath}, but ${problem}. ` +
+	`Refusing to run it — a worktree-isolated session's git operations must target its own worktree. ${fix}`;
+
+function stashMessage(form: string, hazard: string): string {
+	return (
+		`Blocked: \`${form}\` — the git stash stack is shared between the main checkout and every worktree of this repository, and parallel sessions may push or pop entries concurrently; ${hazard}. ` +
+		"Prefer a temporary WIP commit on this worktree's branch to set work aside. If you must stash: " +
+		'`git stash push -u -m "<unique-tag>"`, capture your entry\'s SHA with `git stash list --format=\'%H %gs\'`, ' +
+		"restore with `git stash apply <sha>` (not pop), and drop your entry only after re-finding it by tag."
+	);
+}
+
+function stashReason(rest: Token[]): string | undefined {
+	const words = rest.map((t) => t.value);
+	const sub = words.find((w) => !w.startsWith("-"));
+	// `-m` may ride in a short-flag bundle (`git stash push -um wip`).
+	const tagged = words.some(
+		(w) => (/^-[a-zA-Z]+$/.test(w) && w.includes("m")) || w === "--message" || w.startsWith("--message="),
+	);
+	if (sub === undefined || sub === "push" || sub === "save") {
+		if (tagged) return undefined;
+		return stashMessage(
+			sub ? `git stash ${sub}` : "git stash",
+			"an untagged entry cannot be reliably re-found once other sessions push their own",
+		);
+	}
+	if (sub === "pop") {
+		return stashMessage("git stash pop", "`pop` resolves stash indexes at apply time, so it can grab or destroy another session's entry");
+	}
+	if (sub === "clear") {
+		return stashMessage("git stash clear", "`clear` deletes every session's stashes, not just yours");
+	}
+	if (sub === "drop") {
+		const ref = words.slice(words.indexOf("drop") + 1).find((w) => !w.startsWith("-"));
+		if (!ref) {
+			return stashMessage("git stash drop", "a ref-less `drop` deletes whatever is currently stash@{0}, which may be another session's entry");
+		}
+	}
+	return undefined;
+}
+
+export function worktreeBashGuardReason({ command, worktreePath, sharedRoot }: WorktreeGuardContext): string | undefined {
+	const { segments, parseFailed } = parseCommand(command);
+	if (parseFailed || segments.length === 0) {
+		if (!/\bgit\b/.test(command)) return undefined;
+		return isolated(
+			worktreePath,
+			"this command is too complex to verify that its git operations stay inside the worktree",
+			`Break it into plain, separate git commands with literal paths and run them from ${worktreePath}.`,
+		);
+	}
+
+	// Claude Code's exact refusal for stdin-fed git (one static string for
+	// both mechanisms) — keep it byte-identical to the capture.
+	const stdinFed = () =>
+		isolated(
+			worktreePath,
+			"this command feeds git its arguments from stdin at runtime (xargs/parallel), so the repository it targets cannot be verified",
+			`Run the equivalent from ${worktreePath} without the redirect.`,
+		);
+
+	/** Directory later segments run in; undefined = not statically known. */
+	let dir: string | undefined = worktreePath;
+	/** Subshell nesting: a `cd` inside `(...)` must not leak past the `)`. */
+	let depth = 0;
+	let dirBeforeSubshell: { dir: string | undefined } | undefined;
+
+	const checkSegment = (seg: (typeof segments)[number]): string | undefined => {
+		const tokens = leadTokens(seg);
+		const rawLead = tokens[0]?.value;
+		if (!rawLead) return undefined;
+
+		if (rawLead === "cd") {
+			// Skip cd's own options (-P/-L/-e/-@); `--` ends them; a lone `-`
+			// means the previous directory, which is not statically known.
+			let j = 1;
+			while (j < tokens.length && tokens[j].value.startsWith("-") && !["-", "--"].includes(tokens[j].value)) j++;
+			if (tokens[j]?.value === "--") j++;
+			const target = tokens[j]?.value;
+			if (!target) dir = homedir();
+			else if (hasExpansion(target) || target === "-") dir = undefined;
+			// An absolute (or ~) destination re-anchors the tracked directory
+			// even when it was unknown — later git commands become checkable again.
+			else if (target.startsWith("/") || target === "~" || target.startsWith("~/")) dir = toAbsolute("/", target, homedir());
+			else if (dir !== undefined) dir = toAbsolute(dir, target, homedir());
+			return undefined;
+		}
+		if (rawLead === "pushd" || rawLead === "popd") {
+			dir = undefined;
+			return undefined;
+		}
+
+		const { command: cmd, args, peeled } = resolvePayload(tokens);
+
+		// Git whose arguments are assembled at runtime — the repository it will
+		// target cannot be read off the command.
+		if (cmd === "git" && peeled.includes("xargs")) return stdinFed();
+		if (rawLead === "parallel" && tokens.some((t) => t.value === "git")) return stdinFed();
+		if (
+			cmd === "find" &&
+			args.some((a) => ["-exec", "-execdir", "-ok", "-okdir"].includes(a.value)) &&
+			args.some((a) => a.value === "git")
+		) {
+			return isolated(
+				worktreePath,
+				"this command assembles git invocations at runtime (find -exec), so the repositories they target cannot be verified",
+				"Run the git commands directly, with explicit literal paths, instead of assembling them at runtime.",
+			);
+		}
+
+		if (cmd !== "git") return undefined;
+
+		if (dir === undefined) {
+			return isolated(
+				worktreePath,
+				"a preceding directory change makes the repository this git command targets unverifiable",
+				`Use literal paths inside ${worktreePath} instead.`,
+			);
+		}
+
+		// Effective repository target: the tracked cwd, adjusted by global flags.
+		let effective = dir;
+		const extraTargets: string[] = [];
+		let i = 0;
+		while (i < args.length) {
+			const value = args[i].value;
+			if (!value.startsWith("-")) break;
+			const pathFlag = value === "-C" || value === "--git-dir" || value === "--work-tree";
+			const inlined = value.startsWith("--git-dir=") || value.startsWith("--work-tree=");
+			if (pathFlag || inlined) {
+				const raw = inlined ? value.slice(value.indexOf("=") + 1) : args[i + 1]?.value;
+				if (!raw || hasExpansion(raw)) {
+					return isolated(
+						worktreePath,
+						`\`git ${value}\` computes its repository target at runtime, so it cannot be verified`,
+						`Use literal paths inside ${worktreePath} instead.`,
+					);
+				}
+				const resolved = toAbsolute(effective, raw, homedir());
+				if (value === "-C") effective = resolved;
+				else extraTargets.push(resolved);
+				i += inlined ? 1 : 2;
+				continue;
+			}
+			i += ["-c", "--namespace", "--exec-path", "--config-env"].includes(value) ? 2 : 1;
+		}
+
+		const targets = [effective, ...extraTargets];
+		for (const target of targets) {
+			if (isWithin(worktreePath, target)) continue;
+			if (isWithin(sharedRoot, target)) {
+				return isolated(
+					worktreePath,
+					`this git command targets ${target}, which is the shared checkout or another worktree of the same repository`,
+					`Run the equivalent against ${worktreePath}.`,
+				);
+			}
+			// An unrelated repository elsewhere on disk — not this guard's concern.
+		}
+
+		// The stash stack is per-repository and shared across its worktrees. Any
+		// shared-root target that is NOT inside the worktree already returned
+		// above, so only worktree-contained targets can reach this check.
+		if (targets.some((t) => isWithin(worktreePath, t))) {
+			const { sub, rest } = gitSubcommand(args);
+			if (sub === "stash") {
+				const reason = stashReason(rest);
+				if (reason) return reason;
+			}
+		}
+		return undefined;
+	};
+
+	for (const seg of segments) {
+		// Subshell bookkeeping reads the RAW tokens — leadTokens strips the very
+		// parens being counted. A `cd` between `(` and `)` is scoped: the tracked
+		// directory is restored when the subshell closes.
+		const first = seg.tokens[0]?.value ?? "";
+		const opens = (/^\(+/.exec(first)?.[0] ?? "").length;
+		if (opens > 0 && depth === 0) dirBeforeSubshell = { dir };
+		depth += opens;
+
+		const reason = checkSegment(seg);
+		if (reason) return reason;
+
+		const last = seg.tokens[seg.tokens.length - 1]?.value ?? "";
+		const closes = (/\)+$/.exec(last)?.[0] ?? "").length;
+		if (closes > 0 && depth > 0) {
+			depth = Math.max(0, depth - closes);
+			if (depth === 0 && dirBeforeSubshell) {
+				dir = dirBeforeSubshell.dir;
+				dirBeforeSubshell = undefined;
+			}
+		}
+	}
+	return undefined;
+}

package/extensions/worktree/index.ts

@@ -20,6 +20,8 @@ import { Type } from "typebox";
 import { restoreLatestDetails } from "../lib/branch-restore.ts";
 import { DEFER_CHANNEL } from "../lib/deferred.ts";
 import { REMINDER_CHANNEL } from "../lib/reminders.ts";
+import { worktreeBashGuardReason } from "./guards.ts";
+import { ORIGINAL_COMMAND_CHANNEL, type OriginalCommandRecord } from "../lib/original-command.ts";
 import { rewriteToolInput, validateWorktreeName } from "./rewrite.ts";
 import { ccToolRenderers } from "../lib/tui-render.ts";
 
@@ -33,6 +35,8 @@ interface WorktreeState {
 	baseCommit?: string;
 	createdByUs: boolean;
 	originalCwd: string;
+	/** Root of the shared checkout (`git rev-parse --show-toplevel` at entry). */
+	sharedRoot: string;
 }
 
 interface WorktreeDetails {
@@ -64,7 +68,12 @@ export default function worktreeExtension(pi: ExtensionAPI) {
 	const applyState = (next: WorktreeState | undefined) => {
 		state = next;
 		if (next) {
-			pi.events.emit(REMINDER_CHANNEL, { text: reminderFor(next), scope: "every-turn", key: REMINDER_KEY });
+			pi.events.emit(REMINDER_CHANNEL, {
+				text: reminderFor(next),
+				scope: "every-turn",
+				key: REMINDER_KEY,
+				placement: "sticky-append",
+			});
 		} else {
 			pi.events.emit(REMINDER_CHANNEL, { key: REMINDER_KEY, remove: true });
 		}
@@ -74,6 +83,8 @@ export default function worktreeExtension(pi: ExtensionAPI) {
 		const details = restoreLatestDetails<WorktreeDetails>(ctx.sessionManager.getBranch(), WORKTREE_TOOLS, (d) => d?.worktreeState !== undefined);
 		let restored = details?.worktreeState ?? undefined;
 		if (restored && !existsSync(restored.path)) restored = undefined;
+		// Sessions persisted before sharedRoot existed: originalCwd is the best guess.
+		if (restored && !restored.sharedRoot) restored = { ...restored, sharedRoot: restored.originalCwd };
 		applyState(restored);
 	};
 
@@ -82,8 +93,22 @@ export default function worktreeExtension(pi: ExtensionAPI) {
 
 	pi.on("tool_call", (event) => {
 		if (!state) return;
-		if (["enter_worktree", "exit_worktree", "subagent", "send_message", "workflow"].includes(event.toolName)) return;
-		rewriteToolInput(event.toolName, event.input as Record<string, unknown>, state.path);
+		if (["enter_worktree", "exit_worktree", "Agent", "SendMessage", "workflow"].includes(event.toolName)) return;
+		if (event.toolName === "bash") {
+			// Guard before rewriting (and before the permission prompt — this
+			// extension loads ahead of permissions): git must verifiably target
+			// this worktree, and shared-stash footguns are refused with the recipe.
+			const command = (event.input as Record<string, unknown>).command;
+			if (typeof command === "string") {
+				const reason = worktreeBashGuardReason({ command, worktreePath: state.path, sharedRoot: state.sharedRoot });
+				if (reason) return { block: true, reason };
+			}
+		}
+		const { originalCommand } = rewriteToolInput(event.toolName, event.input as Record<string, unknown>, state.path);
+		if (originalCommand !== undefined) {
+			const record: OriginalCommandRecord = { toolCallId: event.toolCallId, command: originalCommand, cwd: state.path };
+			pi.events.emit(ORIGINAL_COMMAND_CHANNEL, record);
+		}
 	});
 
 	pi.registerTool({
@@ -120,7 +145,7 @@ export default function worktreeExtension(pi: ExtensionAPI) {
 				const known = await listWorktreePaths(ctx.cwd);
 				const target = known.find((p) => p === params.path);
 				if (!target) return fail(`${params.path} is not a worktree of this repository. Known worktrees:\n${known.join("\n")}`);
-				const next: WorktreeState = { path: target, createdByUs: false, originalCwd: ctx.cwd };
+				const next: WorktreeState = { path: target, createdByUs: false, originalCwd: ctx.cwd, sharedRoot: repoRoot };
 				applyState(next);
 				return {
 					content: [{ type: "text", text: `Switched into existing worktree ${target}. All work now happens there; exit_worktree returns to ${ctx.cwd}.` }],
@@ -157,7 +182,7 @@ export default function worktreeExtension(pi: ExtensionAPI) {
 				return fail(`Could not create worktree: ${(error as Error).message}`);
 			}
 
-			const next: WorktreeState = { path, branch, baseCommit, createdByUs: true, originalCwd: ctx.cwd };
+			const next: WorktreeState = { path, branch, baseCommit, createdByUs: true, originalCwd: ctx.cwd, sharedRoot: repoRoot };
 			applyState(next);
 			return {
 				content: [