[DEV-90] Isolate CLI task execution in git worktrees to protect the user's current work

[danii1]

Task: DEV-90

Summary: Isolate CLI task execution in git worktrees to protect the user's current work

Implementation Details

I'll start by exploring the codebase to understand the structure and find existing worktree-related logic.
The exploration revealed two existing worktree implementations. Now let me read the key files directly to ground the implementation.
Now let me read the main entry point sections — the CLI options, main(), and the per-task processing flow.
Now let me read processSingleTask and the surrounding helpers:
Let me read the key Utils functions in utils.ts:
I have a good picture now. Let me verify a few remaining details — config dir walk-up semantics, the test git-state guard, docs layout, and a few Utils signatures:
Important discovery: findConfigDir stops at the first .git entry — so from inside ANY worktree, config resolution falls back to <worktree>/.devintern-code. Let me check which durable-state loaders resolve lazily from cwd, to pick the right integration strategy:
The queue-db env override (WEBHOOK_QUEUE_DB) is key — all durable stores route through it. Now let me check loadProjectSettings/loadEnvironment in index.ts:
loadProjectSettings reads directly from process.cwd() — confirming the symlink approach is needed. Let me check the docs layout and test runner setup before implementing:
All research done. Now I have the complete picture. Let me set up my task list and implement.
Now let me fix two issues I introduced — the undefined phaseActiveForGuard and the fragile mkdir path in ensureStateDirIgnored:
Module created. Now wiring into index.ts — first the import and CLI option:
Now the main() pull-vs-fetch change (a pull would move the user's branch; when isolating we only fetch — the worktree branches from the fetched refs):
Now the task loop — enter isolation per task, with explicit finish calls on every path (the catch body may call process.exit(), which would skip a finally):
Let me review the loop I just wrote — I need to fix a dropped results.successful++ and simplify:
Now hook cleanup into gracefulShutdown (runs before tracker I/O so teardown is fast and can't be skipped by the 15s exit timer):
Two fixes needed: wire the commander flag (--no-worktree-isolation) at both call sites, and drop the unused import:
Both call sites wired. Now the test suite:
A few fixes needed in the test file (clone path, a helper for failing git commands), plus a module improvement — don't auto-commit on a detached HEAD during interrupt preservation (the commit would be unreachable; prefer the patch):
Now the module fix — reuse the captured state and skip commits on detached HEAD:
Now let's run the new tests to validate the implementation:
All 12 tests pass with the full lifecycle verified. Now typecheck, lint, and the full suite:
The on overload works but removeListener hits a bun-types quirk. Cleaner fix anyway: install the exit guard once permanently — it self-no-ops when no isolation is active, so removal isn't needed:
Now remove the two removeExitGuard() call sites:
Typecheck clean. Now lint and format:
One lint warning is mine (lstatSync unused in the module). Removing it:
Now the full test suite for the package to check for regressions:
All 897 tests pass, 0 failures. Now the documentation:
Now update usage.md — flag examples and a pointer section:
Now configuration.md — add the environment variables after the Output Directory section:
Now the CLAUDE.md architecture note:
Final verification — format, lint, typecheck, plus a CLI --help smoke test for the new flag:
The opt-out flag correctly triggered legacy pull behavior. Let me verify default (isolation on) uses fetch-only sync:
Excellent — fetch-only sync works by default. Now a full end-to-end smoke test with a stub agent to exercise the real CLI wiring through success and failure paths:
End-to-end flow works. Note the isolation correctly anchored at the invocation cwd's repo (the monorepo, since that's where I ran the CLI). Let me verify the smoke repo is untouched and clean up test residue:
Let me verify the smoke repo state cleanly and clean up the monorepo residue from the smoke test:
Smoke repo is pristine. Cleaning monorepo residue from the smoke run:
All clean. Final verification round — full tests, typecheck, lint, and a diff review:
Diff is clean and minimal. Let me do a final review pass of the complete module:
Everything is verified. Completing the task list:
DEV-90 is implemented. Summary of what was built:

Implementation

New module: packages/code/src/lib/worktree-isolation.ts — task runs now execute inside a disposable git worktree at <repo>/.devintern-code/worktrees/<task>-<pid>-<ts> instead of the user's checkout. It extends the codebase's existing worktree patterns rather than reinventing them: the repo-manager/review-worktree teardown ladder (git worktree remove --force → rmSync → prune), the pipeline's own createFeatureBranch (runs safely in the throwaway tree, including all its worktree-conflict handling), and the fleet mode's create→run→remove lifecycle.

Key behaviors, mapped to acceptance criteria:

• Isolation — process cwd moves into a detached worktree based on origin/<target> (fallbacks: local branch, HEAD); the user's uncommitted changes, staged files, index, and branch are never touched. A .devintern-code symlink back to the shared state dir plus pinned WEBHOOK_QUEUE_DB keep config/settings/queue.db resolving correctly (config discovery stops at the worktree's .git). Startup sync switches from pull to fetch-only so the user's branch isn't fast-forwarded.
• Results preserved — uncommitted worktree changes are committed to the task's feature branch before removal (feat: on success, wip(devintern): on failure/interrupt; commits survive worktree removal), with a binary-safe patch fallback (worktree-changes.patch in the output dir). --no-auto-commit gets patch-only preservation.
• Teardown on every path — normal completion/failure, process.exit() (exit-event guard), SIGINT/SIGTERM (hooked into gracefulShutdown before tracker I/O), and hard kills via pid-liveness orphan sweep with a 7-day age backstop. Teardown is fully synchronous and best-effort.
• Non-git dirs — graceful fallback with a clear notice; opt-outs: --no-worktree-isolation, DEVINTERN_NO_WORKTREE_ISOLATION=1, DEVINTERN_TASK_WORKTREE_DIR.

Wiring (src/index.ts, +76 lines): CLI flag, per-task enter/finish around processSingleTask with explicit finish calls on exiting paths, shutdown hook.

Verification

• 12 new tests + 885 pre-existing: 897 pass, 0 fail; typecheck, oxlint, oxfmt clean
• End-to-end smoke test against a real dirty repo confirmed: worktree created, user's tree byte-identical afterward, results on feature/<key>, zero leftover registrations

---

This PR was automatically created by @devintern/code