one-code-extension 0.4.1 → 0.6.0

package/extensions/worktree/index.ts

@@ -2,29 +2,42 @@
  * worktree extension — Claude Code's EnterWorktree/ExitWorktree.
  *
  * enter_worktree creates (or switches into) a git worktree under
- * `.claude/worktrees/` and "moves" the session there. pi fixes a session's cwd
+ * `.claude/worktrees/` (`.onecode/worktrees/` in independent mode) and "moves"
+ * the session there. pi fixes a session's cwd
  * at creation, so the move is enforced on the tool_call hook: bash commands
  * are prefixed with `cd`, relative paths resolve against the worktree (see
  * rewrite.ts), and an every-turn reminder keeps the model oriented. State
- * rides in tool-result details so a resumed or branched session restores it.
+ * rides in tool-result details so a resumed or branched session restores it;
+ * a /clear or /new keeps the worktree, as Claude Code does, by recording it on
+ * the new branch.
  */
 
 import { execFile } from "node:child_process";
 import { randomBytes } from "node:crypto";
 import { existsSync, mkdirSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
 import { promisify } from "node:util";
 import { StringEnum } from "@earendil-works/pi-ai";
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
 import { restoreLatestDetails } from "../lib/branch-restore.ts";
+import { checkoutGitRunsProgram } from "../auto-mode/git-checkout-programs.ts";
 import { DEFER_CHANNEL } from "../lib/deferred.ts";
 import { REMINDER_CHANNEL } from "../lib/reminders.ts";
+import { absoluteFrom, comparablePath, tryRealpath } from "../lib/paths.ts";
 import { WORKTREE_CHANNEL, type WorktreeLocation } from "../lib/worktree-channel.ts";
-import { worktreeBashGuardReason } from "./guards.ts";
+import { namesGit, unlistedWorktreesReason, worktreeBashGuardReason } from "./guards.ts";
+import { worktreePowershellGuardReason } from "./powershell-guards.ts";
+import { bashParserReady } from "../lib/bash-parser.ts";
 import { ORIGINAL_COMMAND_CHANNEL, type OriginalCommandRecord } from "../lib/original-command.ts";
+import { enterWorktreeDescription, ENTER_WORKTREE_PARAMS, EXIT_WORKTREE_DESCRIPTION, EXIT_WORKTREE_PARAMS } from "./descriptions.ts";
 import { rewriteToolInput, validateWorktreeName } from "./rewrite.ts";
 import { ccToolRenderers } from "../lib/tui-render.ts";
+import { findProjectRoot, HARNESS_GIT_CONFIG, HARNESS_GIT_NO_HOOKS, repositoryWorktrees } from "../lib/git.ts";
+import { projectConfigDir, projectConfigDirName } from "../lib/config-mode.ts";
+import { readState, readStringsState, recordState } from "../lib/ledger/state.ts";
+import { processState } from "../lib/process-state.ts";
 
 const run = promisify(execFile);
 const REMINDER_KEY = "cc-worktree-session";
@@ -36,7 +49,7 @@ interface WorktreeState {
 	baseCommit?: string;
 	createdByUs: boolean;
 	originalCwd: string;
-	/** Root of the shared checkout (`git rev-parse --show-toplevel` at entry). */
+	/** Root of the main checkout, even when the session started in a linked worktree. */
 	sharedRoot: string;
 }
 
@@ -46,7 +59,7 @@ interface WorktreeDetails {
 }
 
 async function git(args: string[], cwd: string): Promise<string> {
-	const { stdout } = await run("git", args, { cwd, maxBuffer: 10 * 1024 * 1024 });
+	const { stdout } = await run("git", [...HARNESS_GIT_CONFIG, ...HARNESS_GIT_NO_HOOKS, ...args], { cwd, maxBuffer: 10 * 1024 * 1024 });
 	return stdout.trim();
 }
 
@@ -58,6 +71,32 @@ async function listWorktreePaths(cwd: string): Promise<string[]> {
 		.map((line) => line.slice("worktree ".length));
 }
 
+/**
+ * The worktree git-isolation guard, said when the session enters: before it,
+ * GPT-6 Sol and Astra both ran a read-only `git -C <main checkout> status`
+ * and met the refusal with no warning (2026-10-04 self-test).
+ */
+const ISOLATION_NOTE = "Git commands aimed at the main checkout or another worktree of this repository are refused until you exit.";
+
+/** The `one-code:state` key of the worktree paths the branch was already told are gone. */
+const MISSING_REPORTED_STATE = "worktree:missing-reported";
+
+/** The `one-code:state` key of the worktree a /clear or /new carried onto its new branch. */
+const CARRIED_STATE = "worktree:carried";
+
+/**
+ * The worktree the session is in, as process state (lib/process-state.ts): a
+ * /clear or /new starts an empty branch, and Claude Code keeps the session in
+ * its worktree across that (decisions/tools.md). Children never load this
+ * extension, so only the main session writes it.
+ */
+const liveWorktree = () => processState<{ state?: WorktreeState }>("worktree:live", () => ({}));
+
+function isWorktreeState(value: unknown): value is WorktreeState {
+	const s = value as Partial<WorktreeState> | null | undefined;
+	return typeof s?.path === "string" && typeof s.originalCwd === "string" && typeof s.sharedRoot === "string" && typeof s.createdByUs === "boolean";
+}
+
 export default function worktreeExtension(pi: ExtensionAPI) {
 	let state: WorktreeState | undefined;
 
@@ -66,44 +105,98 @@ export default function worktreeExtension(pi: ExtensionAPI) {
 		`${s.branch ? ` (branch ${s.branch})` : ""}, not in ${s.originalCwd}. ` +
 		"Relative paths and bash commands already run there. Use exit_worktree to leave when the user asks.";
 
-	const applyState = (next: WorktreeState | undefined) => {
+	const applyState = (next: WorktreeState | undefined, toolCallId?: string) => {
 		state = next;
-		const location: WorktreeLocation | null = next ? { path: next.path, branch: next.branch } : null;
+		liveWorktree().state = next;
+		const location: WorktreeLocation | null = next ? { path: next.path, branch: next.branch, sharedRoot: next.sharedRoot } : null;
 		pi.events.emit(WORKTREE_CHANNEL, location);
 		if (next) {
 			pi.events.emit(REMINDER_CHANNEL, {
 				text: reminderFor(next),
-				scope: "every-turn",
 				key: REMINDER_KEY,
 				placement: "sticky-append",
+				toolCallId,
 			});
 		} else {
 			pi.events.emit(REMINDER_CHANNEL, { key: REMINDER_KEY, remove: true });
 		}
 	};
 
-	const reconstructState = (ctx: ExtensionContext) => {
+	/**
+	 * The worktree a /clear or /new keeps: the one this process was in, when it
+	 * belongs to this directory and still exists, recorded on the new branch so
+	 * a resume of it reads it back. A branch with its own worktree tool results
+	 * follows them instead (they come after the carry).
+	 */
+	const carriedState = (ctx: ExtensionContext, reason: string | undefined): WorktreeState | undefined => {
+		// A recorded carry holds only in the directory it was entered from, as
+		// the live one does: a branch forked into another project, or continued
+		// after its directory went away, starts outside the worktree.
+		const enteredHere = (s: WorktreeState) => comparablePath(tryRealpath(s.originalCwd) ?? s.originalCwd) === comparablePath(tryRealpath(ctx.cwd) ?? ctx.cwd);
+		const recorded = readState(ctx, CARRIED_STATE);
+		if (isWorktreeState(recorded)) return enteredHere(recorded) ? recorded : undefined;
+		const live = liveWorktree().state;
+		if (reason !== "new" || !live || !existsSync(live.path) || !enteredHere(live)) return undefined;
+		recordState(pi, CARRIED_STATE, live);
+		return live;
+	};
+
+	const reconstructState = (ctx: ExtensionContext, reason?: string) => {
 		const details = restoreLatestDetails<WorktreeDetails>(ctx.sessionManager.getBranch(), WORKTREE_TOOLS, (d) => d?.worktreeState !== undefined);
-		let restored = details?.worktreeState ?? undefined;
-		if (restored && !existsSync(restored.path)) restored = undefined;
+		let restored = details ? (details.worktreeState ?? undefined) : carriedState(ctx, reason);
+		if (restored && !existsSync(restored.path)) {
+			// Nothing in the tool details records that the session left, so every
+			// later restore finds the same stale state; tell the branch once, and
+			// record that it was told (a resume, /reload or /tree reads it back).
+			const reported = readStringsState(ctx, MISSING_REPORTED_STATE);
+			if (!reported.includes(restored.path)) {
+				recordState(pi, MISSING_REPORTED_STATE, [...reported, restored.path]);
+				pi.events.emit(REMINDER_CHANNEL, {
+					text: `Left worktree session; back in ${restored.originalCwd}. The worktree at ${restored.path} no longer exists.`,
+				});
+			}
+			restored = undefined;
+		}
 		// Sessions persisted before sharedRoot existed: originalCwd is the best guess.
 		if (restored && !restored.sharedRoot) restored = { ...restored, sharedRoot: restored.originalCwd };
 		applyState(restored);
 	};
 
-	pi.on("session_start", (_event, ctx) => reconstructState(ctx));
+	pi.on("session_start", (event, ctx) => reconstructState(ctx, event.reason));
 	pi.on("session_tree", (_event, ctx) => reconstructState(ctx));
 
-	pi.on("tool_call", (event) => {
+	/** The repository's worktrees for a git command's target check; undefined when git cannot list them. */
+	const otherWorktrees = async (command: string, cwd: string): Promise<string[] | undefined> =>
+		namesGit(command) ? repositoryWorktrees(cwd) : [];
+
+	pi.on("tool_call", async (event) => {
 		if (!state) return;
-		if (["enter_worktree", "exit_worktree", "Agent", "SendMessage", "workflow"].includes(event.toolName)) return;
-		if (event.toolName === "bash") {
+		if (WORKTREE_TOOLS.has(event.toolName)) return;
+		if (!existsSync(state.path)) {
+			return { block: true, reason: `The active worktree at ${state.path} no longer exists. Use exit_worktree with action: "keep" to return to ${state.originalCwd}, or enter_worktree with path to switch to an existing worktree. No tool has run in the original checkout.` };
+		}
+		if (["Agent", "SendMessage", "workflow"].includes(event.toolName)) return;
+		if (event.toolName === "bash" || event.toolName === "monitor") {
 			// Guard before rewriting (and before the permission prompt — this
 			// extension loads ahead of permissions): git must verifiably target
 			// this worktree, and shared-stash footguns are refused with the recipe.
+			// A monitor's command runs through the same bash, so it is judged the same way.
+			const command = (event.input as Record<string, unknown>).command;
+			if (typeof command === "string") {
+				await bashParserReady();
+				const others = await otherWorktrees(command, state.path);
+				if (others === undefined) return { block: true, reason: unlistedWorktreesReason(state.path) };
+				const reason = worktreeBashGuardReason({ command, worktreePath: state.path, sharedRoot: state.sharedRoot, otherWorktrees: others });
+				if (reason) return { block: true, reason };
+			}
+		}
+		if (event.toolName === "powershell") {
+			// The same invariants for PowerShell, the primary shell on Windows.
 			const command = (event.input as Record<string, unknown>).command;
 			if (typeof command === "string") {
-				const reason = worktreeBashGuardReason({ command, worktreePath: state.path, sharedRoot: state.sharedRoot });
+				const others = await otherWorktrees(command, state.path);
+				if (others === undefined) return { block: true, reason: unlistedWorktreesReason(state.path) };
+				const reason = worktreePowershellGuardReason({ command, worktreePath: state.path, sharedRoot: state.sharedRoot, otherWorktrees: others });
 				if (reason) return { block: true, reason };
 			}
 		}
@@ -118,15 +211,12 @@ export default function worktreeExtension(pi: ExtensionAPI) {
 		name: "enter_worktree",
 		label: "Enter Worktree",
 		...ccToolRenderers("Enter Worktree"),
-		description:
-			"Create an isolated git worktree under .claude/worktrees/ (branched from the current HEAD) and switch this session into it — subsequent commands and relative paths run there. Use ONLY when the user or project instructions explicitly ask for a worktree. Pass `name` to name the new worktree, or `path` to switch into an existing worktree instead (mutually exclusive). Leave with exit_worktree.",
+		description: enterWorktreeDescription(projectConfigDirName()),
 		parameters: Type.Object({
-			name: Type.Optional(
-				Type.String({ description: "Name for a new worktree (segments of letters/digits/._-, max 64 chars). Random if omitted" }),
-			),
-			path: Type.Optional(Type.String({ description: "Existing worktree (from `git worktree list`) to switch into instead of creating one" })),
+			name: Type.Optional(Type.String({ description: ENTER_WORKTREE_PARAMS.name })),
+			path: Type.Optional(Type.String({ description: ENTER_WORKTREE_PARAMS.path })),
 		}),
-		async execute(_toolCallId, params, _signal, _onUpdate, ctx) {
+		async execute(toolCallId, params, _signal, _onUpdate, ctx) {
 			const fail = (text: string) => ({ content: [{ type: "text" as const, text }], details: {} as WorktreeDetails, isError: true });
 
 			if (params.name && params.path) return fail("Pass either `name` or `path`, not both.");
@@ -139,15 +229,22 @@ export default function worktreeExtension(pi: ExtensionAPI) {
 
 			let repoRoot: string;
 			try {
-				repoRoot = await git(["rev-parse", "--show-toplevel"], ctx.cwd);
+				// git prints `C:/…` on Windows; resolve gives the native form every path built from it shares.
+				repoRoot = resolve(await git(["rev-parse", "--show-toplevel"], ctx.cwd));
 			} catch {
 				return fail("enter_worktree needs a git repository; this directory is not one.");
 			}
 
+			const sharedRoot = findProjectRoot(repoRoot) ?? repoRoot;
 			if (params.path) {
 				const known = await listWorktreePaths(ctx.cwd);
-				const target = known.find((p) => p === params.path);
+				// git lists `C:/…` on Windows, while the model passes the `C:\…` we showed it.
+				const requested = absoluteFrom(ctx.cwd, params.path);
+				const wanted = comparablePath(tryRealpath(requested) ?? requested);
+				const listed = known.find((p) => comparablePath(tryRealpath(p) ?? p) === wanted);
+				const target = listed === undefined ? undefined : resolve(listed);
 				if (!target) return fail(`${params.path} is not a worktree of this repository. Known worktrees:\n${known.join("\n")}`);
+				if (!existsSync(target)) return fail(`Worktree ${target} no longer exists. Choose an existing worktree from \`git worktree list\`.`);
 				// The branch is display-only here (footer, reminder): a detached HEAD
 				// leaves it unset silently, a failing git is reported in the result text.
 				let branch: string | undefined;
@@ -158,10 +255,10 @@ export default function worktreeExtension(pi: ExtensionAPI) {
 				} catch (error) {
 					branchNote = ` Its branch could not be read (${(error as Error).message.split("\n")[0]}).`;
 				}
-				const next: WorktreeState = { path: target, branch, createdByUs: false, originalCwd: ctx.cwd, sharedRoot: repoRoot };
-				applyState(next);
+				const next: WorktreeState = { path: target, branch, createdByUs: false, originalCwd: ctx.cwd, sharedRoot };
+				applyState(next, toolCallId);
 				return {
-					content: [{ type: "text", text: `Switched into existing worktree ${target}${branch ? ` (branch ${branch})` : ""}.${branchNote} All work now happens there; exit_worktree returns to ${ctx.cwd}.` }],
+					content: [{ type: "text", text: `Switched into existing worktree ${target}${branch ? ` (branch ${branch})` : ""}.${branchNote} All work now happens there; exit_worktree returns to ${ctx.cwd}. ${ISOLATION_NOTE}` }],
 					details: { worktreeState: next } satisfies WorktreeDetails,
 				};
 			}
@@ -177,7 +274,13 @@ export default function worktreeExtension(pi: ExtensionAPI) {
 			const nameError = validateWorktreeName(name);
 			if (nameError) return fail(`Invalid worktree name "${name}": ${nameError}`);
 
-			const worktreesDir = join(repoRoot, ".claude", "worktrees");
+			// Hooks are disabled by the git wrapper; checkout filters must go through
+			// the normal shell permission gate rather than execute implicitly here.
+			const program = checkoutGitRunsProgram(repoRoot, homedir(), []);
+			if (program) return fail(`Could not create worktree safely: ${program}. Create it with a permission-reviewed \`git worktree add\` command, then enter it with \`path\`.`);
+
+			// `.onecode/worktrees` in independent mode (lib/config-mode.ts).
+			const worktreesDir = join(projectConfigDir(repoRoot), "worktrees");
 			mkdirSync(worktreesDir, { recursive: true });
 			// Self-ignoring directory: worktrees never show up as untracked files.
 			const ignorePath = join(worktreesDir, ".gitignore");
@@ -195,13 +298,13 @@ export default function worktreeExtension(pi: ExtensionAPI) {
 				return fail(`Could not create worktree: ${(error as Error).message}`);
 			}
 
-			const next: WorktreeState = { path, branch, baseCommit, createdByUs: true, originalCwd: ctx.cwd, sharedRoot: repoRoot };
-			applyState(next);
+			const next: WorktreeState = { path, branch, baseCommit, createdByUs: true, originalCwd: ctx.cwd, sharedRoot };
+			applyState(next, toolCallId);
 			return {
 				content: [
 					{
 						type: "text",
-						text: `Created worktree ${path} on branch ${branch} (from HEAD ${baseCommit.slice(0, 8)}). All commands and relative paths now run there; exit_worktree returns to ${ctx.cwd}.`,
+						text: `Created worktree ${path} on branch ${branch} (from HEAD ${baseCommit.slice(0, 8)}). All commands and relative paths now run there; exit_worktree returns to ${ctx.cwd}. ${ISOLATION_NOTE}`,
 					},
 				],
 				details: { worktreeState: next } satisfies WorktreeDetails,
@@ -213,11 +316,10 @@ export default function worktreeExtension(pi: ExtensionAPI) {
 		name: "exit_worktree",
 		label: "Exit Worktree",
 		...ccToolRenderers("Exit Worktree"),
-		description:
-			'End the worktree session started by enter_worktree and return to the original directory. action: "keep" leaves the worktree and branch on disk; "remove" deletes both — refused (listing the changes) if there are uncommitted files or commits not on the original branch, unless discard_changes is true. No-op when no worktree session is active.',
+		description: EXIT_WORKTREE_DESCRIPTION,
 		parameters: Type.Object({
-			action: StringEnum(["keep", "remove"] as const, { description: '"keep" preserves the worktree on disk; "remove" deletes it and its branch' }),
-			discard_changes: Type.Optional(Type.Boolean({ description: "Required true to remove a worktree with uncommitted files or unmerged commits" })),
+			action: StringEnum(["keep", "remove"] as const, { description: EXIT_WORKTREE_PARAMS.action }),
+			discard_changes: Type.Optional(Type.Boolean({ description: EXIT_WORKTREE_PARAMS.discard_changes })),
 		}),
 		async execute(_toolCallId, params, _signal, _onUpdate, ctx) {
 			if (!state) {
@@ -234,7 +336,9 @@ export default function worktreeExtension(pi: ExtensionAPI) {
 					content: [
 						{
 							type: "text",
-							text: `Left worktree session; back in ${current.originalCwd}. The worktree remains at ${current.path}${current.branch ? ` (branch ${current.branch})` : ""} — re-enter it with enter_worktree {path}.`,
+							text: `Left worktree session; back in ${current.originalCwd}. ` + (existsSync(current.path)
+								? `The worktree remains at ${current.path}${current.branch ? ` (branch ${current.branch})` : ""} — re-enter it with enter_worktree (path: "${current.path}").`
+								: `The worktree at ${current.path} no longer exists. No branch was removed.`),
 						},
 					],
 					details: { worktreeState: null } satisfies WorktreeDetails,
@@ -254,11 +358,13 @@ export default function worktreeExtension(pi: ExtensionAPI) {
 			if (!params.discard_changes) {
 				const blockers: string[] = [];
 				try {
-					const dirty = await git(["status", "--porcelain"], current.path);
-					if (dirty) blockers.push(`Uncommitted changes:\n${dirty}`);
+					const dirty = await git(["status", "--porcelain", "--untracked-files=all"], current.path);
+					if (dirty) blockers.push(`Uncommitted files:\n${dirty}`);
 					if (current.baseCommit && current.branch) {
-						const ahead = await git(["rev-list", "--count", `${current.baseCommit}..${current.branch}`], current.path);
-						if (ahead !== "0") blockers.push(`${ahead} commit(s) on ${current.branch} not on the original branch.`);
+						const ahead = await git(["rev-list", "--count", "HEAD", `refs/heads/${current.branch}`, `^${current.baseCommit}`], current.path);
+						if (ahead !== "0") blockers.push(`${ahead} commit(s) on HEAD or ${current.branch} not on the original branch.`);
+					} else {
+						blockers.push("Could not verify commits without the original branch and base commit.");
 					}
 				} catch {
 					blockers.push("Could not verify the worktree is clean.");
@@ -278,8 +384,7 @@ export default function worktreeExtension(pi: ExtensionAPI) {
 			}
 
 			try {
-				await git(["worktree", "remove", "--force", current.path], current.originalCwd);
-				if (current.branch) await git(["branch", "-D", current.branch], current.originalCwd);
+				await git(["worktree", "remove", ...(params.discard_changes ? ["--force"] : []), current.path], current.originalCwd);
 			} catch (error) {
 				return {
 					content: [{ type: "text", text: `Could not remove the worktree: ${(error as Error).message}` }],
@@ -288,6 +393,19 @@ export default function worktreeExtension(pi: ExtensionAPI) {
 				};
 			}
 			applyState(undefined);
+			if (current.branch) {
+				try {
+					// The commit check above (or discard consent) already cleared the branch;
+					// -d would also refuse a tip the original checkout's current HEAD lacks.
+					await git(["branch", "-D", current.branch], current.originalCwd);
+				} catch (error) {
+					return {
+						content: [{ type: "text", text: `Removed worktree ${current.path}; back in ${current.originalCwd}, but could not delete branch ${current.branch}: ${(error as Error).message}. Inspect the branch before removing it manually.` }],
+						details: { worktreeState: null } satisfies WorktreeDetails,
+						isError: true,
+					};
+				}
+			}
 			return {
 				content: [{ type: "text", text: `Removed worktree ${current.path}${current.branch ? ` and branch ${current.branch}` : ""}; back in ${current.originalCwd}.` }],
 				details: { worktreeState: null } satisfies WorktreeDetails,

package/extensions/worktree/powershell-guards.ts

@@ -0,0 +1,167 @@
+/**
+ * Worktree-session guards for the `powershell` tool (pure): the same two
+ * invariants guards.ts enforces for bash (git must verifiably target this
+ * session's worktree; shared-stash forms that collide with a concurrent
+ * session are refused), judged on PowerShell's statement split
+ * (permissions/powershell-rules.ts). On Windows PowerShell is the primary
+ * shell, so without this the invariant did not hold where it matters most.
+ *
+ * Conservative in the one direction that matters: git in a line the split
+ * cannot follow (a script block, `$(…)`, a call operator, `Invoke-Expression`,
+ * a nested shell, backtick escapes), after a directory change it cannot
+ * resolve, or next to a GIT_DIR / GIT_WORK_TREE / GIT_COMMON_DIR setting is
+ * refused, naming the plain form that passes. A line without git passes.
+ * Steering, not security: the permission gate still judges every command.
+ */
+
+import { homedir } from "node:os";
+import { isAbsolute, resolve } from "node:path";
+import { toAbsolute } from "../auto-mode/paths.ts";
+import { gitSubcommand } from "../auto-mode/shell-analysis.ts";
+import { powershellInjectionSyntax, powershellStatements, statementCommand } from "../permissions/powershell-rules.ts";
+import { containsPath, isolated, sharedRepositoryRoots, stashReason, type WorktreeGuardContext } from "./guards.ts";
+
+/** git as a word (`git`, `GIT`, `git.exe`); PowerShell resolves commands case-insensitively. */
+const mentionsGit = (text: string) => /\bgit(?:\.exe)?\b/i.test(text);
+
+/** The repository variables, in any spelling (`$env:GIT_DIR = …`, `Set-Item env:GIT_WORK_TREE`, `[Environment]::SetEnvironmentVariable('GIT_DIR', …)`). */
+const REPOSITORY_ENV = /\bGIT_(?:DIR|WORK_TREE|COMMON_DIR)\b/i;
+
+/** The words of one statement, quotes removed (`'…'` literal, `"…"` with doubled quotes). */
+function statementWords(statement: string): string[] {
+	const words: string[] = [];
+	const pattern = /'((?:[^']|'')*)'|"((?:[^"]|"")*)"|([^\s'"]+)/g;
+	let end = 0;
+	for (const match of statement.matchAll(pattern)) {
+		const value = match[1] !== undefined ? match[1].replace(/''/g, "'") : match[2] !== undefined ? match[2].replace(/""/g, '"') : match[3];
+		// Quotes can start mid-word: --git-dir="C:\\my repo\\.git" is one argument.
+		if (words.length > 0 && match.index === end) words[words.length - 1] += value;
+		else words.push(value);
+		end = match.index + match[0].length;
+	}
+	return words;
+}
+
+/** A PowerShell path word resolved against `dir`: `~` and `~\` expand, a drive or UNC path stands alone. */
+function resolvePowershellPath(dir: string, word: string): string {
+	const home = homedir();
+	const tilde = word === "~" || word.startsWith("~/") || word.startsWith("~\\") ? `~/${word.slice(2)}` : word;
+	if (/^[A-Za-z]:[\\/]/.test(tilde) || tilde.startsWith("\\\\") || isAbsolute(tilde)) return resolve(tilde);
+	return toAbsolute(dir, tilde === "~/" ? "~" : tilde, home);
+}
+
+/** Values PowerShell expands at runtime (a variable, a subexpression) or a wildcard `-Path` matches. */
+const dynamicPath = (word: string) => /[$`*?[]/.test(word);
+
+/** Location parameters that take a value, besides the path itself. */
+const LOCATION_VALUE_PARAMETERS = /^-(?:erroraction|ea|warningaction|wa|informationaction|infa|stackname|errorvariable|ev|warningvariable|wv|informationvariable|iv|outvariable|ov)$/i;
+const PATH_PARAMETER = /^-(?:literalpath|path|lp|pspath)(?::(.+))?$/i;
+
+/** The directory a `Set-Location` / `Push-Location` statement moves to, as written; undefined when none is named. */
+function locationTarget(args: string[]): string | undefined {
+	let positional: string | undefined;
+	for (let j = 0; j < args.length; j++) {
+		const word = args[j];
+		const named = PATH_PARAMETER.exec(word);
+		if (named) return named[1] ?? args[j + 1] ?? "";
+		if (LOCATION_VALUE_PARAMETERS.test(word)) j++;
+		else if (!word.startsWith("-") || word === "-") positional ??= word;
+	}
+	return positional;
+}
+
+export function worktreePowershellGuardReason(context: WorktreeGuardContext): string | undefined {
+	const { command, worktreePath } = context;
+	const sharedRoots = sharedRepositoryRoots(context);
+	if (!mentionsGit(command)) return undefined;
+	const plainGit = `Run git as its own plain statement, with literal paths inside ${worktreePath} (no script blocks, call operators or nested shells).`;
+
+	const statements = powershellStatements(command);
+	if (statements === undefined) {
+		return isolated(worktreePath, "this command's quoting could not be followed, so the repository its git commands target cannot be verified", plainGit);
+	}
+	const syntax = powershellInjectionSyntax(command);
+	if (syntax) {
+		return isolated(worktreePath, `this command runs git next to ${syntax}, so the repository it targets cannot be verified`, plainGit);
+	}
+	if (REPOSITORY_ENV.test(command)) {
+		return isolated(
+			worktreePath,
+			"this command sets GIT_DIR, GIT_WORK_TREE or GIT_COMMON_DIR, which can point git at another repository",
+			`Drop the variable and run git from ${worktreePath}.`,
+		);
+	}
+
+	/** Directory the current statement runs in; undefined = not statically known. */
+	let dir: string | undefined = worktreePath;
+	for (const statement of statements) {
+		const cmd = statementCommand(statement);
+		const [, ...args] = statementWords(statement);
+
+		if (cmd === "set-location" || cmd === "push-location") {
+			const target = locationTarget(args);
+			const absolute = target !== undefined && (/^[A-Za-z]:[\\/]/.test(target) || target.startsWith("\\\\") || isAbsolute(target));
+			// No argument: pwsh 7 goes home. `-`/`+` walk the location history, which is not known here.
+			if (target === undefined) dir = args.length === 0 ? homedir() : undefined;
+			else if (!target || target === "-" || target === "+" || dynamicPath(target)) dir = undefined;
+			// A relative move from an unknown directory stays unknown; an absolute one re-anchors.
+			else if (dir !== undefined || absolute) dir = resolvePowershellPath(dir ?? worktreePath, target);
+			continue;
+		}
+		if (cmd === "pop-location") {
+			dir = undefined;
+			continue;
+		}
+		if (cmd !== "git") continue;
+
+		if (dir === undefined) {
+			return isolated(worktreePath, "a preceding directory change makes the repository this git command targets unverifiable", `Use literal paths inside ${worktreePath} instead.`);
+		}
+
+		let effective = dir;
+		const extraTargets: string[] = [];
+		let i = 0;
+		while (i < args.length && args[i].startsWith("-")) {
+			const word = args[i];
+			const lower = word.toLowerCase();
+			const pathFlag = word === "-C" || lower === "--git-dir" || lower === "--work-tree";
+			const inlined = lower.startsWith("--git-dir=") || lower.startsWith("--work-tree=");
+			const configWorktree = word === "-c" && /^core\.worktree=/i.test(args[i + 1] ?? "");
+			if (lower === "--config-env" || lower.startsWith("--config-env=")) {
+				return isolated(worktreePath, "`git --config-env` reads its configuration at runtime, so the repository it targets cannot be verified", `Use literal paths inside ${worktreePath} instead.`);
+			}
+			if (pathFlag || inlined || configWorktree) {
+				const raw = inlined ? word.slice(word.indexOf("=") + 1) : configWorktree ? args[i + 1].slice(args[i + 1].indexOf("=") + 1) : args[i + 1];
+				if (!raw || dynamicPath(raw)) {
+					return isolated(worktreePath, `\`git ${word}\` computes its repository target at runtime, so it cannot be verified`, `Use literal paths inside ${worktreePath} instead.`);
+				}
+				const target = resolvePowershellPath(effective, raw);
+				if (word === "-C") effective = target;
+				else extraTargets.push(target);
+				i += inlined ? 1 : 2;
+				continue;
+			}
+			i += word === "-c" || lower === "--namespace" || lower === "--exec-path" ? 2 : 1;
+		}
+
+		const targets = [effective, ...extraTargets];
+		for (const target of targets) {
+			if (containsPath(worktreePath, target)) continue;
+			if (sharedRoots.some((root) => containsPath(root, target))) {
+				return isolated(
+					worktreePath,
+					`this git command targets ${target}, which is the shared checkout or another worktree of the same repository`,
+					`Run the equivalent against ${worktreePath}.`,
+				);
+			}
+		}
+		if (targets.some((target) => containsPath(worktreePath, target))) {
+			const { sub, rest } = gitSubcommand(args.map((value) => ({ value })));
+			if (sub === "stash") {
+				const reason = stashReason(rest);
+				if (reason) return reason;
+			}
+		}
+	}
+	return undefined;
+}

package/extensions/worktree/rewrite.ts

@@ -10,31 +10,23 @@
  */
 
 import { isAbsolute, resolve } from "node:path";
+import { powershellQuote, shellQuote } from "../lib/shell-quote.ts";
+import { normalizeToolPath } from "../lib/tool-path.ts";
 
 /** Tools whose `path` argument is relative to the session cwd. */
 const PATH_TOOLS = new Set(["read", "edit", "write", "notebook_edit", "grep", "find", "ls", "lsp_diagnostics"]);
 /** Of those, the ones where a missing path means "the cwd itself". */
 const DEFAULTS_TO_CWD = new Set(["grep", "find", "ls"]);
 
-export function shellQuote(path: string): string {
-	return `'${path.replace(/'/g, "'\\''")}'`;
-}
-
-/** PowerShell single-quoted literal: only `'` needs escaping, as `''`. */
-export function powershellQuote(path: string): string {
-	return `'${path.replace(/'/g, "''")}'`;
-}
-
-
 /**
- * Mutates `input` in place so the call runs inside the worktree. For bash,
- * returns the model's ORIGINAL command (pre-`cd`-wrapper) so the caller can
+ * Mutates `input` in place so the call runs inside the worktree. For bash
+ * (and `monitor`, which runs a bash command), returns the model's ORIGINAL command (pre-`cd`-wrapper) so the caller can
  * publish it over `ORIGINAL_COMMAND_CHANNEL` keyed by the call id: the
  * permission matcher evaluates rules against what the model asked for, not
  * the wrapper (which starts with `cd` and matches no Bash rule), while the
  * classifier and safety floor keep reading the wrapped `input.command`, whose
  * `cd` makes containment resolve inside the worktree —
- * docs/decisions/code-review-remediation.md ("Worktree vs. permission rules").
+ * working-docs/decisions/code-review-remediation.md ("Worktree vs. permission rules").
  * The original is deliberately NOT stored in `input`: a key there is
  * model-writable (lib/original-command.ts).
  */
@@ -43,7 +35,10 @@ export function rewriteToolInput(
 	input: Record<string, unknown>,
 	worktreePath: string,
 ): { originalCommand?: string } {
-	if (toolName === "bash") {
+	// `monitor` runs its command through the same bash as the `bash` tool
+	// (background/index.ts), so it gets the same `cd` wrapper; a `ws` monitor
+	// has no command and nothing to move.
+	if (toolName === "bash" || toolName === "monitor") {
 		if (typeof input.command === "string") {
 			const originalCommand = input.command;
 			input.command = `cd ${shellQuote(worktreePath)} && (${originalCommand}\n)`;
@@ -73,8 +68,11 @@ export function rewriteToolInput(
 		(field) => typeof input[field] === "string" && (input[field] as string).length > 0,
 	);
 	if (pathField) {
-		const value = input[pathField] as string;
-		if (!isAbsolute(value)) input[pathField] = resolve(worktreePath, value);
+		// Read the value the way pi's tools will (`~`, `@`, `file://`): judged
+		// raw, `~/x` and `@src/x` looked relative and became literal `~` and `@src`
+		// directories inside the worktree.
+		const normalized = normalizeToolPath(input[pathField] as string);
+		if (!isAbsolute(normalized)) input[pathField] = resolve(worktreePath, normalized);
 	} else if (DEFAULTS_TO_CWD.has(toolName)) {
 		input.path = worktreePath;
 	}