leo-kuang-ai Worktree Isolation
Detect whether the current checkout is already isolated, then create or attach a worktree under .worktrees/<slug> only when isolation is still needed. The bundled script adds branch-specific setup that git worktree add alone does not handle:
- Does not copy
.env*files by default;--copy-envis an explicit opt-in for workflows that need local env files - Detects
mise/direnvconfigs and prints review commands without changing user trust state - Adds
.worktreesto.gitignoreif not already ignored - Does not modify the main repo checkout —
from-branchand PR heads are fetched, not checked out
Step 0: Detect existing isolation
Before creating anything, invoke the bundled script with detect --json through the same bash -c wrapper whose command text includes exec bash ...worktree-manager.sh:
bash -c 'if [ -n "${CLAUDE_SKILL_DIR:-}" ]; then exec bash "$CLAUDE_SKILL_DIR/scripts/worktree-manager.sh" "$@"; fi; exec bash "$(git rev-parse --show-toplevel)"/".kiro/skills/spec-worktree/scripts/worktree-manager.sh" "$@"' _ detect --json
The output is the deterministic facts contract spec-worktree-detect.v1:
{
"schema_version": "spec-worktree-detect.v1",
"state": "ordinary-checkout | linked-worktree | submodule | unknown",
"reason_code": "same-git-dir | linked-worktree | submodule-superproject | not-git-repo | git-query-failed | output-contract-failed",
"worktree_root": "<absolute path or null>",
"main_worktree_root": "<absolute path or null>",
"git_dir": "<resolved absolute path or null>",
"common_dir": "<resolved absolute path or null>",
"branch": "<current branch or null>"
}
state=ordinary-checkout and state=submodule mean creation may proceed if the workflow still needs isolation. For state=submodule, the new worktree is created under the submodule's own working tree (<submodule-root>/.worktrees/<branch>), not the superproject. state=linked-worktree means the current checkout is already isolated; report worktree_root and branch, then work in place instead of creating another worktree. state=unknown or any non-zero detect exit means stop and report reason_code; do not fall back to raw git worktree add.
The script computes this by comparing resolved absolute --absolute-git-dir and resolved absolute --git-common-dir. Equal paths are an ordinary checkout. Different paths plus non-empty --show-superproject-working-tree are a submodule. Different paths plus empty superproject output are an existing linked worktree.
detect --json requires node on PATH to serialize the facts. When node is missing the command still prints a parseable state=unknown/reason_code=output-contract-failed object and exits non-zero, so a consumer always gets a structured reason_code rather than empty output.
Choose the mode
There are two modes. The caller must choose one before invoking the script:
- New work: create a fresh branch from a base branch. Use this when the task has no existing ref to test or modify.
- Isolate an existing ref: attach a worktree to a PR head, existing branch, tag, or commit. Use this for PR review, dogfood, or any workflow that needs to test a target ref without switching the primary checkout.
A branch can be checked out in only one worktree at a time. In existing-ref mode, if the target branch is already checked out anywhere, the script reports already_checked_out branch=<name> path=<path> and exits 0 without creating a second checkout. The caller must act on that verdict: work at the reported path, ask the user, or stop. Never force a duplicate branch checkout.
Creating a new-work worktree
Invoke the bundled script through a bash -c wrapper whose command text includes exec bash ...worktree-manager.sh. On Claude Code, ${CLAUDE_SKILL_DIR} resolves to the skill's own runtime directory across marketplace-cached installs and local plugin development. In source or non-Claude runtime contexts, use the repo-root fallback path so generated Codex assets can rewrite it to the installed skill directory. This shape intentionally matches the narrow allowed-tools pattern.
bash -c 'if [ -n "${CLAUDE_SKILL_DIR:-}" ]; then exec bash "$CLAUDE_SKILL_DIR/scripts/worktree-manager.sh" "$@"; fi; exec bash "$(git rev-parse --show-toplevel)"/".kiro/skills/spec-worktree/scripts/worktree-manager.sh" "$@"' _ create [--copy-env] <branch-name> [from-branch]
Defaults:
from-branchdefaults to origin's default branch (ormainif that cannot be resolved)- The new branch is created at
origin/<from-branch>(or the local ref if the remote is unavailable) .env*files are not copied unless--copy-envis passed
Examples:
bash -c 'if [ -n "${CLAUDE_SKILL_DIR:-}" ]; then exec bash "$CLAUDE_SKILL_DIR/scripts/worktree-manager.sh" "$@"; fi; exec bash "$(git rev-parse --show-toplevel)"/".kiro/skills/spec-worktree/scripts/worktree-manager.sh" "$@"' _ create feat/login
bash -c 'if [ -n "${CLAUDE_SKILL_DIR:-}" ]; then exec bash "$CLAUDE_SKILL_DIR/scripts/worktree-manager.sh" "$@"; fi; exec bash "$(git rev-parse --show-toplevel)"/".kiro/skills/spec-worktree/scripts/worktree-manager.sh" "$@"' _ create fix/email-validation develop
bash -c 'if [ -n "${CLAUDE_SKILL_DIR:-}" ]; then exec bash "$CLAUDE_SKILL_DIR/scripts/worktree-manager.sh" "$@"; fi; exec bash "$(git rev-parse --show-toplevel)"/".kiro/skills/spec-worktree/scripts/worktree-manager.sh" "$@"' _ create --copy-env feat/local-env
After creation, switch to the worktree with cd .worktrees/<branch-name>.
The create command consumes the same detection function before creating .worktrees/<branch> or running git worktree add. It refuses linked-worktree, unknown, not-git-repo, git-query-failed, and output-contract-failed states so this helper cannot create nested or invisible worktrees by bypassing Step 0.
Isolating an existing ref
Invoke isolate when the caller names a target ref that already exists:
bash -c 'if [ -n "${CLAUDE_SKILL_DIR:-}" ]; then exec bash "$CLAUDE_SKILL_DIR/scripts/worktree-manager.sh" "$@"; fi; exec bash "$(git rev-parse --show-toplevel)"/".kiro/skills/spec-worktree/scripts/worktree-manager.sh" "$@"' _ isolate [--copy-env] <target-ref|pr:<number>|#<number>> [worktree-slug]
Examples:
bash -c 'if [ -n "${CLAUDE_SKILL_DIR:-}" ]; then exec bash "$CLAUDE_SKILL_DIR/scripts/worktree-manager.sh" "$@"; fi; exec bash "$(git rev-parse --show-toplevel)"/".kiro/skills/spec-worktree/scripts/worktree-manager.sh" "$@"' _ isolate feature/login
bash -c 'if [ -n "${CLAUDE_SKILL_DIR:-}" ]; then exec bash "$CLAUDE_SKILL_DIR/scripts/worktree-manager.sh" "$@"; fi; exec bash "$(git rev-parse --show-toplevel)"/".kiro/skills/spec-worktree/scripts/worktree-manager.sh" "$@"' _ isolate pr:123
bash -c 'if [ -n "${CLAUDE_SKILL_DIR:-}" ]; then exec bash "$CLAUDE_SKILL_DIR/scripts/worktree-manager.sh" "$@"; fi; exec bash "$(git rev-parse --show-toplevel)"/".kiro/skills/spec-worktree/scripts/worktree-manager.sh" "$@"' _ isolate '#123' pr-123
Behavior:
- Existing local branch:
git worktree add .worktrees/<slug> <branch>. - Remote-only
origin/<branch>: create a local branch in the new worktree fromorigin/<branch>. - PR shorthand
pr:<number>or#<number>: fetchpull/<number>/headinto local branchpr-<number>, then attach the worktree to that branch so fix commits are not orphaned onFETCH_HEAD. - Tag or commit: create a detached worktree at that commit.
- Already in a linked worktree: check the target out in place unless it is already the current branch; do not create a nested worktree.
- Target branch already checked out elsewhere: report
already_checked_out branch=<name> path=<path>and do not create a second checkout.
Env File Opt-In
Use --copy-env only when the workflow explicitly needs local environment files in the new worktree. The opt-in path works for both create and isolate: it copies .env* files except .env.example, .env.template, and .env.sample, prints only file names, backs up pre-existing destination files, and appends an owner-only .env-copy.log containing only timestamp, basename, and byte size. The log contains no absolute path, content-derived hash, or file contents and is added to the worktree git exclude file.
Even when env files were copied intentionally, downstream staging must still treat them as denied by default. A batch may stage an env file only when the task/implementation unit declares the exact env path in expected_side_effects and explicitly states that changing that env file is intended.
Other worktree operations
Use git directly — no wrapper is needed and none is provided:
git worktree list # list worktrees
git worktree remove .worktrees/<branch> # remove a worktree
cd .worktrees/<branch> # switch to a worktree
cd "$(git rev-parse --show-toplevel)" # return to main checkout
Do not manually copy .env* files as a default setup step. If an existing worktree needs env files, recreate it with --copy-env or copy files manually only after a human explicitly opts in and records the same file-name-only audit information.
Dev tool trust behavior
Trust stores are user-owned state outside the worktree contract. When mise or direnv configs are present, the script only prints the exact mise trust <file> or direnv allow command and tells the user to review the worktree content first. It never executes either command, even when the config matches a trusted branch; worktree creation success does not imply trust approval.
When to create a worktree
Create a worktree when:
- Reviewing a PR while keeping the main checkout free for other work
- Running multiple features in parallel without branch-switching overhead
- Keeping the default branch free of in-progress state
Do not create a new-work worktree for single-task work that can happen on a branch in the main checkout, and never create a nested worktree when Step 0 reports state=linked-worktree. For existing-ref isolation, use isolate so branch uniqueness and already-checked-out verdicts remain deterministic.
Integration
This helper accepts only a caller-owned isolation contract: caller identity, target repo, target ref or new branch, reason isolation is needed, allowed setup side effects, environment-copy authorization, and the return path consumer. It detects or creates the worktree and returns facts. It never selects an execution engine, dispatches a worker, stages, commits, pushes, opens a PR, or decides cleanup. A worker placed in a linked worktree is edit-and-test only: it must not run git add, git commit, or any command that writes the shared Git index. A worker sandbox EPERM is evidence about that worker only, not host capability evidence.
spec-dogfood uses existing-ref mode for a PR or non-current branch: isolate pr:<number> or isolate <branch>. It consumes Worktree ready: <path> or already_checked_out branch=<name> path=<path> without switching the primary checkout.
spec-work may use new-work or existing-ref mode only after execution-strategy.md has locked one target repo and recorded mutation authorization. It owns all implementation and recovery state outside this helper. A linked worktree does not enforce Git-index isolation: before a mutation-capable worker starts, the caller still needs a host receipt that denies writes to the exact Git common directory/index path and filters credential environment. Without it, use worker_git_index_enforcement_unavailable, do not dispatch that worker, and continue inline/serial. The returned worktree root becomes the snapshot worktree_identity.repo_root; any later identity drift routes back to spec-work as run-source-drifted rather than causing this helper to recreate, reset, or rerun work.
未来 caller 必须先在其 public owner source 中增加 forward invocation 与 intake contract。本 helper 的 reverse claim 不能单独建立 integration edge。
Troubleshooting
"Worktree already exists": the path is already in use. Either switch to it (cd .worktrees/<branch>) or remove it (git worktree remove .worktrees/<branch>) before recreating.
"Cannot remove worktree: it is the current worktree": cd out of the worktree first, then git worktree remove.
Dev tool trust was skipped: the script prints the manual command. Review the config diff (git diff <base-ref> -- .envrc), then run the printed command from the worktree directory.