Repository navigation
Advance .agents/shared to the worktree-aware shared scripts - #6
Closed
alexander-yevsyukov wants to merge 1 commit into
Closed
alexander-yevsyukov wants to merge 1 commit into
alexander-yevsyukov wants to merge 1 commit into
Conversation
The committed pin predates `d0abf64` ("Make the shared hook scripts
worktree-aware"), so any checkout materialized from it — a fresh
`git worktree add`, a CI checkout, a cloud session — gets hook gates that
read no `cwd` from the hook payload. Those older gates resolve the
repository with `git rev-parse --show-toplevel`, and the hook process runs
in `$CLAUDE_PROJECT_DIR` (the main checkout, by design), so they evaluate
a different checkout on a different branch than the session is actually
working in.
This is not theoretical: a `compiler` worktree session had `./gradlew
build` blocked by `publish-version-gate.sh` reporting version numbers that
belonged to the main checkout's unrelated branch. The same defect would
let an unbumped branch through just as silently.
Moves the pin to `85668a8`, the current `origin/master` of
SpineEventEngine/agents, which carries `session-work-tree.sh` and the
`cwd`-aware gates.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
There was a problem hiding this comment.
🔵 Needs a closer look
The supplied review context contains no reviewable diff to independently verify the pin update.
No open issues 🎉
What changed in this PR
Updates the shared tooling pin so hook gates evaluate the session’s worktree rather than the main checkout.
Changes:
- Advances
.agents/sharedto85668a8, which includes worktree-aware hook scripts.
| File | Description |
|---|
Review effort: Balanced
Contributor
Author
|
Closing unmerged: the |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The committed
.agents/sharedpin predatesd0abf64("Make the shared hook scripts worktree-aware"), so any checkout materialized from that pin — a freshgit worktree add, a CI checkout, a cloud session — gets hook gates that read nocwdfrom the hook payload.Those older gates resolve the repository with
git rev-parse --show-toplevel. The hook process runs in$CLAUDE_PROJECT_DIR, which is the main checkout by design, so in a worktree session they evaluate a different checkout on a different branch than the session is actually working in.This is not theoretical. A
compilerworktree session had./gradlew buildblocked bypublish-version-gate.shreporting version numbers that belonged to the main checkout's unrelated branch, while the worktree itself was correctly bumped. The defect fails open just as silently in the other direction: it would clear an unbumped branch for publishing because some other checkout happened to be bumped.An audit across the constellation on 2026-10-16 found all 19 consumer repositories carrying a
.agents/sharedpin belowd0abf64, dating from June to 1 October.Change
Advances the pin to
85668a8, the currentorigin/masterof SpineEventEngine/agents, which carriesscripts/session-work-tree.shand thecwd-aware gates. Exactly one gitlink changes; nothing else is bundled.Verification
Feeding the gate a synthetic
PreToolUsepayload (CLAUDE_PROJECT_DIR= main checkout,cwd= a worktree of it) now evaluates the worktree rather than the main checkout:compiler— main checkout on an unrelated branch at2.0.0-SNAPSHOT.071,cwda worktree at.073: the gate reports.073against master's.073, i.e. the worktree's own numbers.core-jvm— main checkout at.570,cwda worktree at.572: allowed, exit 0.cwd: exit 2, "cannot resolve the Git work tree", refusing rather than gating another checkout.Related
SpineEventEngine/agents#48 hardens the gate's no-
cwdfallback so it refuses to gate an unconfirmed checkout instead of silently gating the wrong one. That is defence in depth inside the shared repository and does not fix stale pins: a consumer pinned belowd0abf64never reaches that code path. Only moving the pin does, so the two changes are independent.🤖 Generated with Claude Code