feat: thread worktree_path through gitea_create_issue (Closes #450) #451

2026-07-07T13:41:37-05:00

jcwalker3 commented

2026-07-07 13:41:37 -05:00

Summary

Closes #450. Follow-up hardening for #274 branches-only guard.

Threads worktree_path through gitea_create_issue into verify_preflight_purity and fails closed when the resolved mutation workspace is the stable control checkout or an invalid/non-repo branches/ path.

Changes

verify_preflight_purity: validate resolved worktree exists, is a directory, and belongs to the target repository (git rev-parse --git-common-dir)
gitea_create_issue: optional worktree_path for explicit branches/ workspace proof
tests/test_create_issue_workspace_guard.py: 6 cases including test_create_issue_stable_checkout_rejected

Preserves WIP commit 8530109 implementation; test fix completes stable-checkout rejection path.

Validation

pytest tests/test_create_issue_workspace_guard.py tests/test_author_mutation_worktree.py tests/test_issue_lock_worktree.py -q
pytest tests/test_mcp_server.py -k "preflight or branches_only or mutation_worktree or issue_lock" -q

27 + 9 passed

Worktree

branches/create-issue-worktree-guard-hardening @ 81fcdb0

## Summary Closes #450. Follow-up hardening for #274 branches-only guard. Threads `worktree_path` through `gitea_create_issue` into `verify_preflight_purity` and fails closed when the resolved mutation workspace is the stable control checkout or an invalid/non-repo `branches/` path. ## Changes - `verify_preflight_purity`: validate resolved worktree exists, is a directory, and belongs to the target repository (`git rev-parse --git-common-dir`) - `gitea_create_issue`: optional `worktree_path` for explicit branches/ workspace proof - `tests/test_create_issue_workspace_guard.py`: 6 cases including `test_create_issue_stable_checkout_rejected` Preserves WIP commit `8530109` implementation; test fix completes stable-checkout rejection path. ## Validation ``` pytest tests/test_create_issue_workspace_guard.py tests/test_author_mutation_worktree.py tests/test_issue_lock_worktree.py -q pytest tests/test_mcp_server.py -k "preflight or branches_only or mutation_worktree or issue_lock" -q ``` **27 + 9 passed** ## Worktree `branches/create-issue-worktree-guard-hardening` @ `81fcdb0`

jcwalker3 added 1 commit 2026-07-07 13:41:38 -05:00

feat: thread worktree_path through gitea_create_issue (#450 ) 81fcdb09fd

Hardens #274 branches-only guard for gitea_create_issue:

- verify_preflight_purity: validate resolved worktree exists, is a directory,
  and belongs to the target repository before author mutations.
- gitea_create_issue: add worktree_path threaded into preflight guard.
- tests/test_create_issue_workspace_guard.py: stable-control-checkout rejection
  and invalid-path fail-closed cases (PROJECT_ROOT simulated as control checkout).

Preserves WIP commit 8530109 implementation; test fix completes stable-checkout path.

Closes #450

sysadmin approved these changes 2026-07-07 13:44:10 -05:00

sysadmin left a comment

The review of PR #451 (feat: thread worktree_path through gitea_create_issue (Closes #450)) has completed successfully.

Checked out branch feat/issue-450-create-issue-worktree-guard at pinned HEAD commit 81fcdb09fd88fdeda702d176fbfb0b74e59dc6e5 in isolated review worktree.
Verified that gitea_create_issue now accepts and threads worktree_path into verify_preflight_purity.
Confirmed that verify_preflight_purity resolves workspace paths consistently and performs validation on branches/ worktrees using git rev-parse --git-common-dir.
Confirmed that invalid workspace paths, missing paths, non-git directories, repo mismatches, and stable control checkouts all fail closed.
Confirmed that the worktree remained completely clean before and after validation.
Verified that all 6 tests in tests/test_create_issue_workspace_guard.py and all 1606 tests in the full test suite pass successfully.

Approved!

The review of PR #451 (feat: thread worktree_path through gitea_create_issue (Closes #450)) has completed successfully. - Checked out branch `feat/issue-450-create-issue-worktree-guard` at pinned HEAD commit `81fcdb09fd88fdeda702d176fbfb0b74e59dc6e5` in isolated review worktree. - Verified that `gitea_create_issue` now accepts and threads `worktree_path` into `verify_preflight_purity`. - Confirmed that `verify_preflight_purity` resolves workspace paths consistently and performs validation on `branches/` worktrees using `git rev-parse --git-common-dir`. - Confirmed that invalid workspace paths, missing paths, non-git directories, repo mismatches, and stable control checkouts all fail closed. - Confirmed that the worktree remained completely clean before and after validation. - Verified that all 6 tests in `tests/test_create_issue_workspace_guard.py` and all 1606 tests in the full test suite pass successfully. Approved!

sysadmin merged commit 1529b9ff6b into master

2026-07-07 13:51:01 -05:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Scaled-Tech-Consulting/Gitea-Tools#451