Auto-allow contained git worktree ops in auto mode - #378
Merged
TheGreatAxios merged 3 commits intoAug 8, 2026
Merged
Conversation
Dispatch and issue workflows need unattended worktree add/remove/prune for sibling paths. Force flags, absolute outside paths, globs, home expansion, and credential basenames still require operator approval.
TheGreatAxios
force-pushed
the
cl-5637-auto-allow-contained-git-worktree-ops-in-auto-mode
branch
from
August 8, 2026 18:58
208e987 to
2215a39
Compare
… authority auto-shell-policy.ts had a second, bespoke containment notion for uncontained worktree destinations (a scary-basename denylist plus a "..\" depth counter), separate from path-restriction.ts's isRestricted. Replace it with isPermittedSiblingWorktreePath, a narrow addition to the same authority: a not-yet-created path qualifies only if it is a direct child of the parent directory of cwd or of a registered worktree root. This is stricter than the old heuristic for nested "container/leaf" destinations (now ask instead of auto-allow) but still covers the real need of creating a brand-new sibling worktree with zero registered roots.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
git worktree add/remove, pluspruneandlist, in auto mode~, globs, scary basenames, and uncommon subcommands../corbits-dispatch-wts/…) skip the outside-workspace ask so dispatch can create worktrees unattendedFixes CL-5637
Test plan
git worktree add ../corbits-dispatch-wts/foo origin/maingit worktree add -f …andgit worktree add /tmp/evil