Harden worktree detection against submodules and bare repos

IsLinkedWorktree now reads the .git gitfile and checks for worktree
admin markers (.git/worktrees/ or .bare/worktrees/) instead of just
checking whether .git is a file. This prevents submodules (which use
.git/modules/) from being misidentified as linked worktrees.

MainRepoRoot now supports both .git/worktrees/ and .bare/worktrees/
markers when extracting the main repo root, and handles relative
gitdir paths by resolving them against the worktree root. The shared
parseGitfile helper normalizes paths with filepath.ToSlash for
consistent marker matching.

Extract parseGitfile and hasWorktreeMarker into shared helpers used
by GetWorktreeID, IsLinkedWorktree, and MainRepoRoot. Fix git
worktree add argument order in tests (-b before path).

Signed-off-by: Paulo Gomes <paulo@entire.io>
Assisted-by: Assisted-by: Claude Opus 4.6 <noreply@anthropic.com>
Entire-Checkpoint: f6d95094dfb9

Author: pjbgf

cmd/entire/cli/paths/paths.go

@@ -11,7 +11,6 @@ import (
 	"sync"
 
 	"github.com/entireio/cli/cmd/entire/cli/checkpoint/id"
-	"github.com/entireio/cli/cmd/entire/cli/osroot"
 )
 
 // Directory constants
@@ -120,27 +119,23 @@ func ClearWorktreeRootCache() {
 }
 
 // IsLinkedWorktree returns true if the given path is inside a linked git worktree
-// (as opposed to the main repository). Linked worktrees have .git as a file
-// pointing to the main repo, while the main repo has .git as a directory.
-// Uses os.Root for traversal-resistant access.
+// (as opposed to the main repository or a submodule). Linked worktrees have .git
+// as a file whose gitdir points into a worktree admin dir (.git/worktrees/ or
+// .bare/worktrees/). Submodules also have .git as a file but point into
+// .git/modules/, so they are not treated as linked worktrees.
 func IsLinkedWorktree(worktreeRoot string) bool {
-	root, err := os.OpenRoot(worktreeRoot)
-	if err != nil {
-		return false
-	}
-	defer root.Close()
-
-	info, err := root.Stat(".git")
-	if err != nil {
+	gitdir, err := parseGitfile(worktreeRoot)
+	if err != nil || gitdir == "" {
 		return false
 	}
-	return !info.IsDir()
+	return hasWorktreeMarker(gitdir)
 }
 
 // MainRepoRoot returns the root directory of the main repository.
 // In the main repo, this returns the same as WorktreeRoot.
 // In a linked worktree, this parses the .git file to find the main repo root.
-// Uses os.Root for traversal-resistant reads.
+// Supports both standard (.git/worktrees/) and bare-repo (.bare/worktrees/) layouts,
+// and handles relative gitdir paths.
 //
 // Per gitrepository-layout(5), a worktree's .git file is a "gitfile" containing
 // "gitdir: <path>" pointing to $GIT_DIR/worktrees/<id> in the main repository.
@@ -151,31 +146,33 @@ func MainRepoRoot(ctx context.Context) (string, error) {
 		return "", fmt.Errorf("failed to get worktree path: %w", err)
 	}
 
-	if !IsLinkedWorktree(worktreeRoot) {
-		return worktreeRoot, nil
-	}
-
-	root, err := os.OpenRoot(worktreeRoot)
+	gitdir, err := parseGitfile(worktreeRoot)
 	if err != nil {
-		return "", fmt.Errorf("failed to open worktree root: %w", err)
+		return "", err
 	}
-	defer root.Close()
 
-	// Worktree .git file contains: "gitdir: /path/to/main/.git/worktrees/<id>"
-	content, err := osroot.ReadFile(root, ".git")
-	if err != nil {
-		return "", fmt.Errorf("failed to read .git file: %w", err)
+	// Main worktree or non-worktree gitfile (e.g. submodule): return as-is.
+	if gitdir == "" || !hasWorktreeMarker(gitdir) {
+		return worktreeRoot, nil
 	}
 
-	gitdir := strings.TrimSpace(string(content))
-	gitdir = strings.TrimPrefix(gitdir, "gitdir: ")
-
-	// Extract main repo root: everything before "/.git/"
-	idx := strings.LastIndex(gitdir, "/.git/")
-	if idx < 0 {
-		return "", fmt.Errorf("unexpected gitdir format: %s", gitdir)
+	// Extract main repo root: everything before the worktree marker.
+	for _, marker := range worktreeMarkers {
+		if idx := strings.LastIndex(gitdir, marker); idx >= 0 {
+			// marker includes the trailing slash of the git dir (e.g. ".git/worktrees/"),
+			// so we need to trim the leading dir separator + marker prefix.
+			// For ".git/worktrees/", the repo root is everything before "/.git/worktrees/".
+			// The marker without the admin-dir prefix is "/worktrees/", but we want
+			// the path before the git-dir itself, so find the git-dir boundary.
+			gitDirSuffix := strings.TrimSuffix(marker, "worktrees/") // ".git/" or ".bare/"
+			gitDirIdx := strings.LastIndex(gitdir, "/"+gitDirSuffix)
+			if gitDirIdx >= 0 {
+				return filepath.FromSlash(gitdir[:gitDirIdx]), nil
+			}
+		}
 	}
-	return gitdir[:idx], nil
+
+	return "", fmt.Errorf("unexpected gitdir format: %s", gitdir)
 }
 
 // AbsPath returns the absolute path for a relative path within the repository.

cmd/entire/cli/paths/paths_test.go

@@ -151,7 +151,7 @@ func TestMainRepoRoot_LinkedWorktree(t *testing.T) {
 	if err := os.MkdirAll(filepath.Dir(worktreeDir), 0o755); err != nil {
 		t.Fatalf("MkdirAll: %v", err)
 	}
-	cmd := exec.Command("git", "worktree", "add", worktreeDir, "-b", "test-branch") //nolint:noctx // test code
+	cmd := exec.Command("git", "worktree", "add", "-b", "test-branch", worktreeDir) //nolint:noctx // test code
 	cmd.Dir = tmpDir
 	cmd.Env = testutil.GitIsolatedEnv()
 	if output, err := cmd.CombinedOutput(); err != nil {
@@ -170,6 +170,53 @@ func TestMainRepoRoot_LinkedWorktree(t *testing.T) {
 	}
 }
 
+func TestMainRepoRoot_Submodule(t *testing.T) {
+	// Cannot use t.Parallel: uses t.Chdir
+	// MainRepoRoot should return the submodule root (not the superproject)
+	// when running from inside a submodule.
+	superDir := t.TempDir()
+	resolved, err := filepath.EvalSymlinks(superDir)
+	if err != nil {
+		t.Fatalf("EvalSymlinks: %v", err)
+	}
+	superDir = resolved
+
+	// Create the "library" repo that will become a submodule
+	libDir := t.TempDir()
+	testutil.InitRepo(t, libDir)
+	testutil.WriteFile(t, libDir, "lib.txt", "lib")
+	testutil.GitAdd(t, libDir, "lib.txt")
+	testutil.GitCommit(t, libDir, "lib init")
+
+	// Create the superproject
+	testutil.InitRepo(t, superDir)
+	testutil.WriteFile(t, superDir, "main.txt", "main")
+	testutil.GitAdd(t, superDir, "main.txt")
+	testutil.GitCommit(t, superDir, "super init")
+
+	// Add submodule (allow file transport for local clone)
+	cmd := exec.Command("git", "-c", "protocol.file.allow=always", "submodule", "add", libDir, "libs/mylib") //nolint:noctx // test code
+	cmd.Dir = superDir
+	cmd.Env = testutil.GitIsolatedEnv()
+	if output, err := cmd.CombinedOutput(); err != nil {
+		t.Fatalf("git submodule add: %v\n%s", err, output)
+	}
+
+	submoduleDir := filepath.Join(superDir, "libs", "mylib")
+
+	ClearWorktreeRootCache()
+	t.Chdir(submoduleDir)
+
+	// MainRepoRoot should return the submodule root, not the superproject
+	root, err := MainRepoRoot(context.Background())
+	if err != nil {
+		t.Fatalf("MainRepoRoot() error: %v", err)
+	}
+	if root != submoduleDir {
+		t.Errorf("MainRepoRoot() = %q, want %q (should stay in submodule, not escape to superproject)", root, submoduleDir)
+	}
+}
+
 func TestIsLinkedWorktree(t *testing.T) {
 	t.Parallel()
 
@@ -195,6 +242,29 @@ func TestIsLinkedWorktree(t *testing.T) {
 		}
 	})
 
+	t.Run("bare repo worktree", func(t *testing.T) {
+		t.Parallel()
+		dir := t.TempDir()
+		if err := os.WriteFile(filepath.Join(dir, ".git"), []byte("gitdir: /repo/.bare/worktrees/main\n"), 0o644); err != nil {
+			t.Fatal(err)
+		}
+		if !IsLinkedWorktree(dir) {
+			t.Error("IsLinkedWorktree() = false for bare repo worktree, want true")
+		}
+	})
+
+	t.Run("submodule", func(t *testing.T) {
+		t.Parallel()
+		dir := t.TempDir()
+		// Submodules have .git as a file pointing into .git/modules/, not .git/worktrees/
+		if err := os.WriteFile(filepath.Join(dir, ".git"), []byte("gitdir: /repo/.git/modules/mylib\n"), 0o644); err != nil {
+			t.Fatal(err)
+		}
+		if IsLinkedWorktree(dir) {
+			t.Error("IsLinkedWorktree() = true for submodule, want false")
+		}
+	})
+
 	t.Run("no git", func(t *testing.T) {
 		t.Parallel()
 		dir := t.TempDir()

cmd/entire/cli/paths/worktree.go

@@ -3,20 +3,24 @@ package paths
 import (
 	"fmt"
 	"os"
+	"path/filepath"
 	"strings"
 
 	"github.com/entireio/cli/cmd/entire/cli/osroot"
 )
 
-// GetWorktreeID returns the internal git worktree identifier for the given path.
-// For the main worktree (where .git is a directory), returns empty string.
-// For linked worktrees (where .git is a file), extracts the name from
-// .git/worktrees/<name>/ path. This name is stable across `git worktree move`.
-// Uses os.Root for traversal-resistant access.
-func GetWorktreeID(worktreePath string) (string, error) {
+// worktreeMarkers are the path segments that identify a git worktree admin
+// directory inside the gitdir value. Both standard (.git/worktrees/) and
+// bare-repo (.bare/worktrees/) layouts are supported.
+var worktreeMarkers = []string{".git/worktrees/", ".bare/worktrees/"}
+
+// parseGitfile reads a .git gitfile via os.Root and returns the raw gitdir value.
+// Returns empty string and no error if .git is a directory (main worktree).
+// Returns an error if .git doesn't exist or cannot be read.
+func parseGitfile(worktreePath string) (string, error) {
 	root, err := os.OpenRoot(worktreePath)
 	if err != nil {
-		return "", fmt.Errorf("failed to open worktree path: %w", err)
+		return "", fmt.Errorf("failed to open path: %w", err)
 	}
 	defer root.Close()
 
@@ -30,7 +34,6 @@ func GetWorktreeID(worktreePath string) (string, error) {
 		return "", nil
 	}
 
-	// Linked worktree has .git as a file with content: "gitdir: /path/to/.git/worktrees/<name>"
 	content, err := osroot.ReadFile(root, ".git")
 	if err != nil {
 		return "", fmt.Errorf("failed to read .git file: %w", err)
@@ -43,12 +46,53 @@ func GetWorktreeID(worktreePath string) (string, error) {
 
 	gitdir := strings.TrimPrefix(line, "gitdir: ")
 
+	// Resolve relative gitdir paths against the worktree root.
+	if !filepath.IsAbs(gitdir) {
+		gitdir = filepath.Join(worktreePath, gitdir)
+	}
+	gitdir = filepath.Clean(gitdir)
+
+	// Normalize to forward slashes for consistent marker matching.
+	gitdir = filepath.ToSlash(gitdir)
+
+	return gitdir, nil
+}
+
+// hasWorktreeMarker reports whether a gitdir value contains a worktree admin
+// marker (e.g. ".git/worktrees/" or ".bare/worktrees/"). This distinguishes
+// linked worktrees from submodules and other gitfile-based layouts.
+func hasWorktreeMarker(gitdir string) bool {
+	for _, marker := range worktreeMarkers {
+		if strings.Contains(gitdir, marker) {
+			return true
+		}
+	}
+	return false
+}
+
+// GetWorktreeID returns the internal git worktree identifier for the given path.
+// For the main worktree (where .git is a directory), returns empty string.
+// For linked worktrees (where .git is a file pointing into a worktree admin dir),
+// extracts the name from the .git/worktrees/<name>/ path. This name is stable
+// across `git worktree move`.
+// Returns an error for non-worktree gitfiles (e.g. submodules).
+// Uses os.Root for traversal-resistant access.
+func GetWorktreeID(worktreePath string) (string, error) {
+	gitdir, err := parseGitfile(worktreePath)
+	if err != nil {
+		return "", err
+	}
+
+	// Main worktree: .git is a directory, gitdir is empty.
+	if gitdir == "" {
+		return "", nil
+	}
+
 	// Extract worktree name from path like /repo/.git/worktrees/<name>
 	// or /repo/.bare/worktrees/<name> (bare repo + worktree layout).
-	// The path after the marker is the worktree identifier.
 	var worktreeID string
 	var found bool
-	for _, marker := range []string{".git/worktrees/", ".bare/worktrees/"} {
+	for _, marker := range worktreeMarkers {
 		_, worktreeID, found = strings.Cut(gitdir, marker)
 		if found {
 			break