senior-dev works in a private worktree copy that starts from where you are

[ZeroPoint95]

Review this first: internal/session/programcopy.go holds the copy, the snapshot and the clean-up. Everything else feeds it.

Try it:

1. Run make build.
2. In a repository with uncommitted changes, run /senior-dev <brief>.
3. Open its task and click ▸ brief.

Why: senior-dev switched your checkout, refused uncommitted work, and failed runs over missing test dependencies.

Changed

• senior-dev works in a private git worktree copy, not in your checkout. Your branch, index and files never move. The copy lives in ~/Library/Caches/codeaf/worktrees/ and is removed when senior-dev exits. Its branch is always kept.
• It starts from where you are. Your tracked edits and staged additions become the branch's first commit, written through a private index. Untracked files are copied as local inputs and kept out of automatic commits and submitted snapshots, even if the run edits them; stage a new file before launch when it should ship. A checkout in the middle of a merge is cut from HEAD, and the receipt says why.
• A run that handed in a change ends finished, even when its own check failed. codeaf treats that check as a lead and runs the project's own checks first. A run that handed in nothing still ends failed.
• The coder thinks at high by default. --variant or a thinking rung overrides it.
• Shell runs use the profile's worker seat, the same as chat runs.

Added

• The copy has its own dependencies when the network is on (the default):

  • node_modules is cloned copy-on-write;
  • .venv is left out and rebuilt;
  • .env is copied;
  • the prompt gets a ## Dependencies section.

  With SENIOR_DEV_NET=off, the folders are linked instead and that section is left out.

• The task page footer names the models: senior-dev on deepseek-v4-pro, kimi-k2.6 · high. senior-dev reports them in its bootstrap record.

• ▸ brief opens the whole brief as a document that scrolls with the page. ctrl+o close brief returns to the steps.

• program.links in .codeaf/config.json sets which ignored files and folders are carried into the copy.

Fixed

• Two runs on one repository no longer block each other or overwrite each other's refs. The refs are now refs/worktree/senior-dev/…, one set per copy.
• A crashed codeaf no longer finishes a copy while senior-dev is still writing to it. The program holds the same lock, passed to it as fd 3.
• A crashed run's work is committed to its branch. A candidate it submitted is kept on <branch>-submitted.
• All 16 findings from the adversarial review are fixed (cfcee9762).
• Landing instructions explicitly put every follow-up check in a worktree for the run's branch.
• Narrow footers preserve the effort label before shortening the model name.
• Exclude-file cleanup preserves the original final newline and file existence, plus rules added while a run was active.
• Copied untracked inputs stay out of eager commits, submission snapshots, final commits and recovery. Snapshot staging excludes them before their contents enter git's object store. New files created by the run remain eligible for commits.
• The ending's merge instructions stash tracked changes only, leaving local untracked inputs in place.

How it was checked

• make build passed on final commit 36785a070.
• Focused regressions passed across session, senior-dev app/utilities, the shell entry point, and the task-page footer. Coverage includes copied inputs absent from git objects and branch history, submitted snapshots, eager commits, crash recovery, retries, and a real stash-and-merge flow that leaves untracked files intact.
• TMPDIR=/private/tmp GOMAXPROCS=4 GOFLAGS=-p=2 SHARDS=2 make pr-ready BASE=46cc52885 checked all follow-up fixes against the reviewed PR head. Build, vet, formatting, packed/manual gates and repository laws passed. Full cmd/codeaf, internal/seniordev/app, internal/seniordev/util and internal/tui3 suites passed.
• The full session suite completed with four failures listed below. Each reproduces on the clean pre-fix commit 46cc52885 under the same environment; no test was added to a skip ledger.
• The default macOS temp path also triggers three existing /var versus /private/var assertions in the law gate. Those were reproduced on the clean pre-fix commit before using the canonical temp path above.

Four session failures reproduced before these fixes

• TestNewAdmissionReadsSettingsChangedBeforeItsCreation
• TestHeldBeltRunStopsWithoutPreparingRepository
• TestHeldRunReopensOnTheSameAdmissionWithoutPreparingFiles
• TestHeldRecoveryRetainsTheAcceptedCrew

Baseline command: TMPDIR=/private/tmp GOMAXPROCS=4 GOFLAGS=-p=2 make test-focus PKGS=./internal/session RUN='^(TestHeldBeltRunStopsWithoutPreparingRepository|TestHeldRecoveryRetainsTheAcceptedCrew|TestHeldRunReopensOnTheSameAdmissionWithoutPreparingFiles|TestNewAdmissionReadsSettingsChangedBeforeItsCreation)$' TEST_FLAGS=-count=1.

Earlier real-binary review covered both chat entry paths and shell runs, dirty-checkout preservation, stop/recovery, side-by-side runs, dependencies, the model footer, and scrolling a 10,000-character brief.

Reviewer notes

• New per-platform files:
  • internal/session/programcopy_{unix,windows}.go
  • programcopy_clone_{darwin,linux,other}.go
  • internal/delegate/hold_{unix,windows}.go
• StageRecord.Models() reads optional models and effort fields from any stage record. The change is additive within protocol v2.
• senior-dev's stage data now carries its coder models, at most 12.

Not in this PR

• senior-dev still adds .senior-dev/ to .git/info/exclude permanently.
• senior-dev's own ending text still says "failed verification".
• The footer fallback for runs from before this change.
• Deleting branches from runs that changed nothing.
• The missing /resume conversation after an abrupt close.

Checklist

• Change entry: docs/changes/unreleased/1674-senior-dev-worktree-copy.md
• Manual updated: senior-dev.md, delegates.md, tasks.md, task-controls.md, keys.md, worker-harness.md
• No new line in .github/known-red.txt
• Only my own paths staged

🤖 Generated with Claude Code

[AbirAbbas]

Taking over: I pushed six small fixes. Nothing blocks merging after them.

I checked this by hand in the real binary on both roads (plain codeaf and --no-host) and with shell runs, against a throwaway repo with a dirty tree. The person's HEAD, branch, index, files and stash stayed identical before and after. The start receipt, the mid-merge line, stop, recovery after codeaf is closed, side-by-side runs, the footer, ▸ brief, dependency handling and the ending's stash-and-merge all behave as the body says. I proved the merge with the current dev (after #1658) locally with make pr-ready. The only reds were wait-based session tests that fail on dev on this box too, and all of them pass when run alone.

Pushed:

• b191069f1 The first commit now stages only what git status names. Before, the fresh index dropped the person's index flags: a skip-worktree local config went into the kept branch with its hidden edits, and a skip-worktree or assume-unchanged file missing from disk was recorded as a deletion that the ending's merge would apply.
• 8956d0e20 With the network on, a node_modules that is itself a symlink is left out. cp -a and clonefile both copied the link, so npm install in the copy wrote into the person's folder.
• 2b4d86c42 If a swept copy's submitted candidate can't be put on a branch, the copy now stays on disk and the ending says so. Before, it was removed along with the only ref holding the candidate.
• 338243775 A swept copy no longer gets a <branch>-start branch. refs/worktree/senior-dev/start has the same tree as the base, so every recovered run was leaving that branch, plus a sentence saying it held something.
• 02465d7f8 manual: ▸ brief doesn't draw the copy-location line codeaf adds at launch, and the page now says so.
• 46cc52885 A file added to the index and deleted since (AD), or a staged rename whose new name was deleted since (RD), made git add --pathspec-from-file refuse the whole list. The copy then started without ANY of the person's uncommitted work, and the receipt showed could not be read (fatal: pathspec 'gone.txt' did not match any files). The fixed binary carries the work. The old add -A -- . never hit this; the path list in b191069f1 introduced it.

Left for you (not blocking):

1. After a run, the chat model (deepseek-v4-flash) ran pytest in the person's own checkout rather than on the run's branch. That tests the wrong code, and it left __pycache__ behind, which the next run's first commit then carried. The prompt says to use a worktree, but the landing note could say more firmly where to check, or codeaf could run the checks itself.
2. The first commit carries every untracked, non-ignored file onto a branch that is always kept, including things like a credentials.json or a 50 MB file. The receipt names only three paths. Worth deciding whether to warn, or to cap by size.
3. Branches pile up: every run keeps its task/* branch, even when it changed nothing.
4. Nits:
   • Rewriting .git/info/exclude adds a trailing newline, and leaves an empty file where there was none.
   • At about 20 columns the footer drops the effort ("… · h…").
5. /resume didn't list a conversation that began with /senior-dev after an abrupt close. This is probably the untitled-conversation problem Fix shell-opened titles and recover task-only conversations #1667 addresses, not this PR.

[AbirAbbas]

Round 2, on 96b9c08a6 and 36785a070. Today's fixes still hold: all 56 programcopy/programfolder tests pass on the head. The exclude-file and narrow-footer nits are fixed, thanks. credentials.json never reaches a branch or git's object store now.

One blocker, from a hand run in the real binary (shell road and chat road), so I'm holding the merge:

Setup: an untracked, half-written parser.py, then /senior-dev Finish parse_numbers in parser.py (I started it) … add tests in test_parser.py.

1. The start receipt said: "Your untracked files (credentials.json, parser.py) are copied as local inputs, not committed."
2. senior-dev edited parser.py in its copy.
3. The run ended: "submitted a change, and the project's own build and tests passed … its work is on the branch …, 1 file".
4. The branch holds only test_parser.py. A clone of it fails with ModuleNotFoundError: No module named 'parser'.
5. After the ending's stash-and-merge, all eight new tests fail against the person's original parser.py, which still raises NotImplementedError. The finished function survives only in the run's log.

The local-inputs rule drops edits to untracked files by design: the brief, the finishing commit and TestProgramUntrackedInputsStayOutOfSnapshotsAndEndings all say so. That breaks "finish what I started" whenever what was started is a new file. People rarely stage a new file first, and a hand-off from chat gives them no moment to do it.

Suggestion: treat an input the run changed as the run's work and commit it. Keep only inputs it left unchanged (like credentials.json) out. The ending would then need stash -u for those paths, so the untracked original doesn't block the merge. It should also say when edits to inputs were left out, rather than "passed … 1 file".

Smaller: after the run, the chat followed the new landing guidance and ran git worktree add for its checks. It left that worktree registered, with the run's branch checked out in it.

make test-laws is green on a local merge with dev e7a2bef7c. pr-ready failed on three load-timing tests, and each passes alone.

[ZeroPoint95]

Thanks. The round-2 blocker is fixed in fc7feb003, using your suggestion.

What changed

• An untracked file the run changed is now its work and goes on its branch. One it left as it was stays off the branch and out of git's object store.
• codeaf fingerprints each untracked file as it copies it in (SHA-256, outside git). The check lives in internal/gitidentity/inputs.go (Inputs.LeftAlone), and codeaf and senior-dev both use it:
  • codeaf's finishing commit, on a normal ending and on recovery after codeaf went away (ProgramFolder.excludedFromCommit);
  • senior-dev's per-write commit (util.InputLeftAlone);
  • its submitted snapshot, clean-tree check, rollback and DifferentPaths (gitRecorder.ignoredAtStart).
• The child gets the list through SENIOR_DEV_INPUTS_AT_START, beside SENIOR_DEV_IGNORED_AT_START, on both roads.
• An input whose fingerprint hasn't been taken yet counts as untouched. That covers a codeaf that dies while copying.
• The ending names the untracked files the branch holds, and adds git -C <repo> stash push -u -- '<file>' for exactly those, after the plain stash when there is a snapshot. Files it didn't touch are never stashed.
• The start receipt and the brief now say that any untracked file it changes is committed as its work, and the rest stay off the branch.

Your smaller point: the landing note's check instruction is now one command that adds the worktree, runs the check and always removes it (… worktree add -q --detach "$tmp" <branch> && (cd "$tmp" && <check>); status=$?; … worktree remove --force "$tmp"; exit $status). program-outcome.md says the same.

Checked

• Your scenario, in the real binary, shell road and chat road, with an untracked half-written hello.txt plus a credentials.json:
  • the branch holds the finished hello.txt;
  • credentials.json isn't on the branch or in the object store;
  • following the ending's stash-and-merge gives the finished file and leaves credentials.json in place;
  • no worktree is left behind.
• New tests, each confirmed to fail under the old keep-everything-out rule:
  • TestProgramUntrackedInputsTheRunChangedAreItsWork: finished and recovered. It also follows the ending's own stash-and-merge.
  • TestTheProgramIsHandedItsInputsWithTheirFingerprints
  • TestGitRecorderTakesTheInputsTheRunChanged
  • the extended TestEagerCommitSkipsInitialIgnoresAndGeneratedRunPaths
  • TestAnInputIsLeftAloneOnlyWhileItIsAsItWasCopied
• make test-laws: the only failures are the three job-log /var vs /private/var tests, which fail the same way on dev here.
• Manual (senior-dev.md, delegates.md) and the change entry are updated.

Still open (from round 1, not blocking): task/* branches pile up, since every run keeps its branch even when it changed nothing. This has been deferred intentionally, it's not a big deal.

[AbirAbbas]

Taking over (round 3): fc7feb003 fixes the blocker. I checked it by hand in the real binary on the shell road, the chat on the engine road, and a closed-pane recovery. The setup was an untracked half-written parser.py, a credentials.json, an unstaged edit and a staged util.py.

• The branch holds the finished parser.py, and a clone of it passes its tests. The recovered run's branch has the same file.
• credentials.json is off the branch and out of the object store.
• The checkout is untouched.
• The ending's stash, stash push -u and merge work, and the chat's check worktree is removed afterwards.

I pushed five small fixes, all about how file names reach git:

• 920008aa2 The ending's stash push -u -- <file> also took git glob matches. notes[1].md also stashed an untouched notes1.md, which the manual's stash drop then deleted. Names containing *?[\ now get :(literal), and 'parser.py' reads as before.
• 546fd4153 senior-dev's per-write commit and codeaf's finishing commit had the same glob problem: an untouched notes1.md got committed, or written into the object store. Both now use --literal-pathspecs.
• bc2bd56f1 The changed-file list now reads names with -z. Before, a non-ASCII input such as résumé.md was left out of the stash advice, and the person's own copy of it then blocked the merge.
• 97f085227 A name that starts with : is also written :(literal). Git read ':colon.txt' as magic and stashed colon.txt.
• 580e84b36 manual: the ending's commands leave two stashes, and git stash pop on the untracked one fails with parser.py already exists, no checkout. A new section, "Bringing senior-dev's branch in", says to drop once per stash, and how to read a later version of a file out of its stash.

The earlier CI red on fc7feb003 was a test race that predates this PR, in TestAParentHandedADivisionBeforeItStartedOpensOnTheReportsAndNotOnTheWait. It passed 85/85 locally and green on re-run. I'll fix it separately.

Small things left for you, not blocking:

• If an input's fingerprint can't be taken after the copy, edits to that input are dropped.
• Each candidate snapshot re-hashes large inputs, about 119 ms for a 200 MB file.
• The ending can say "the project's own build and tests passed" right next to "no build or tests it could find to run".

[AbirAbbas]

Reviewed and hand-verified over three rounds; see the comments above.