guardrails/source-control: worktree-create.sh drive-relative C:foo root bypasses containment guard (fail-open, Windows)

[kyle-sexton]

Problem

worktree-create.sh's containment guard is bypassed by a Windows drive-relative root of the form C:foo (a drive letter + path with NO separator after the colon). Git-for-Windows resolves C:foo against that drive's per-drive current directory to <toplevel>/foo, landing the worktree checkout INSIDE the repository — while the containment ancestor-walk is skipped (parent==probe on a separatorless string, so the [[ -e ]] probe is false and the guard block never runs). Fail-open.

Repro

bash worktree-create.sh --name feat/x --root 'C:foo' --repo-dir "$repo" from a shell whose C: drive CWD is inside $repo → exit 0, checkout at <toplevel>/foo.

Scope / why this is a SEPARATE follow-up (not a #898 regression)

Confirmed by independent verification of PR #898 (backslash-root fix, head 1ff6d69):

• Distinct grammar class. feat(source-control): route /worktree create through a shared worktree-creation helper (#399 Phase A) #898 closed the backslash-separator asymmetry (\→/ swap). C:foo has no separator at all — the swap is a verified no-op on it. Different root cause (drive-relative resolution vs separator grammar).
• Pre-existing, orthogonal to feat(source-control): route /worktree create through a shared worktree-creation helper (#399 Phase A) #898, and explicitly documented as out-of-scope in the feat(source-control): route /worktree create through a shared worktree-creation helper (#399 Phase A) #898 fix commit.
• Pathological input. A worktree_root is a directory-typed config; every realistic source (a Windows folder picker, an absolute path, a forward/back-slash path) is absolute. C:foo drive-relative-with-no-separator is not a form a picker or user plausibly supplies for a root — a human won't hit it on the default path. Bounded blast radius (the user's own worktree lands in a wrong-but-reversible location).

Deferred under the #650 model (repro + fix direction + origin cite), permitted because it fails on a pathological non-default input, not because it's a merge-gate/security-posture fail-open on the default path.

Fix direction

Handle drive-relative C:x input in the anchor/normalize stage: detect a drive-letter prefix NOT followed by a separator, and either reject (fail closed) or canonicalize it to absolute (e.g. via cygpath -m/-w resolving the drive CWD) BEFORE the append + normalize_path + ancestor walk, so the guard and git worktree add see the same absolute form. The anchor test (?:*) and the walk both need to treat C:x as drive-relative, not absolute.

Origin

Independent verifier of PR #898 (tower out-of-loop review, 2026-07-22 ~06:40Z), flagged for-awareness as a non-blocker.

[kyle-sexton]

This was generated by AI (triage-decide lane — intake routing).

Triaged: verified fail-open (Windows drive-relative C:foo bypasses worktree-create.sh containment guard) — but GATED on a prerequisite, so NOT routed status: ready (T8d).

🔒 Blocked by #898 (feat/399-shared-worktree-helper). Confirmed against the clone: worktree-create.sh does not exist on origin/main — PR #898 introduces the shared helper. So this fix cannot land independently; it must branch from #898 or land after it merges. Recorded as a semantic blocked-by marker (native issue-dependency edges are issue-to-issue; blocker is PR #898).

The fix direction is fully specified in the issue (detect a drive-letter prefix NOT followed by a separator at the anchor/normalize stage, before the append + normalize_path + ancestor walk, so the guard and git worktree add see the same absolute form; the anchor test ?:* and the walk must both treat C:x as drive-relative). Distinct grammar class from #898's backslash-separator fix (the \→/ swap is a verified no-op on separatorless C:foo), and explicitly out-of-scope in #898's commit.

Decision defaulted (applies once unblocked, post-#898): REJECT drive-relative C:x input (fail-closed) rather than canonicalize it — veto before merge. Rationale: this is a containment security guard and C:foo is a pathological non-default input no folder-picker or absolute path produces; failing closed on unrecognized root grammar matches the guard's purpose better than silently resolving it. If a maintainer wants leniency, canonicalize via cygpath -m/-w instead.

Disposition: off raw (needs-triage cleared), priority: medium + area: security, no status label (blocked = dependency edge). Re-evaluate to status: ready when #898 merges. Severity note (T5): fail-open, but bounded blast radius (pathological input, wrong-but-reversible worktree location, all on a non-default path) — priority stays medium per #552.

[kyle-sexton]

This was generated by AI (triage-decide lane — blocked-by gate lifted).

Unblocked → routed status: ready. Prerequisite PR #898 merged (2026-07-22T07:16:41Z); plugins/source-control/scripts/worktree-create.sh is now on origin/main (verified), so this fix can land independently. The T8d ready-gate recorded earlier is satisfied.

The plan + acceptance from the earlier triage comment stand unchanged, including the Decision defaulted: REJECT drive-relative C:x (fail-closed), not canonicalize — veto before merge. Implementer: fix at the anchor/normalize stage in the now-on-main worktree-create.sh so the guard and git worktree add see the same absolute form; both repro forms (block-noncanonical-commit and block-dangerous-git analogues) must be closed.

Note: sibling worktree-helper item #965 (worktree_root userConfig shell-safety of the invocation) is a distinct concern also now on-main — separate work.