git_worktree_manager/operations/
guard.rs

1//! `gw guard` — Claude Code PreToolUse(Bash) hook helper.
2//!
3//! Input format: a JSON object with at least `tool_name` and `tool_input`.
4//! Policy: when `tool_name == "Bash"` and the call's cwd is unhealthy
5//! (missing path or not a directory), block the tool call with a strong
6//! abort instruction in stderr — regardless of which command is being run.
7//!
8//! Rationale: the guard exists for sessions whose worktree was removed out
9//! from under them (e.g. `gw rm` while Claude was paused). In that state
10//! every shell command runs in a stale environment, so the safe default is
11//! to refuse all of them and ask the user before continuing. Sessions with
12//! a healthy cwd pass through transparently.
13
14use std::io::Read;
15use std::path::Path;
16
17use crate::error::{CwError, Result};
18
19#[derive(Debug, serde::Deserialize)]
20struct HookPayload {
21    tool_name: Option<String>,
22    tool_input: Option<serde_json::Value>,
23}
24
25fn read_input(source: &str) -> std::io::Result<String> {
26    if source == "-" {
27        let mut s = String::new();
28        std::io::stdin().read_to_string(&mut s)?;
29        Ok(s)
30    } else {
31        std::fs::read_to_string(source)
32    }
33}
34
35fn cwd_is_healthy(cwd: &Path) -> bool {
36    cwd.exists() && cwd.is_dir()
37}
38
39pub fn run(tool_input_source: &str) -> Result<()> {
40    let raw = read_input(tool_input_source).map_err(CwError::Io)?;
41    let payload: HookPayload = serde_json::from_str(&raw).map_err(CwError::Json)?;
42
43    if payload.tool_name.as_deref() != Some("Bash") {
44        return Ok(());
45    }
46    let input = match payload.tool_input {
47        Some(v) => v,
48        None => return Ok(()),
49    };
50    let cwd_str = input.get("cwd").and_then(|v| v.as_str());
51    let cwd = match cwd_str {
52        Some(s) => std::path::PathBuf::from(s),
53        None => std::env::current_dir().unwrap_or_else(|_| std::path::PathBuf::from(".")),
54    };
55    if cwd_is_healthy(&cwd) {
56        return Ok(());
57    }
58
59    let command = input.get("command").and_then(|v| v.as_str()).unwrap_or("");
60    eprintln!(
61        "STOP. gw guard: cwd '{}' no longer exists or is not a directory. \
62         The worktree may have been removed while this session was paused. \
63         Do NOT execute any further commands. Ask the user to confirm the \
64         situation before continuing. (blocked command: '{}')",
65        cwd.display(),
66        command,
67    );
68    Err(CwError::ExitCode(2))
69}
git_worktree_manager/operations/guard.rs

git_worktree_manager/operations/
guard.rs
