feat(config): add ignore_worktrees to skip linked git worktrees - #1430

Thanks for opening this — it has been seen, and it is queued.

This note is automated, but it is not a brush-off: it exists so you know where your PR stands instead of having to guess from silence.

Current review status: working through a backlog. 0.9.1-rc.1 is out, so the release freeze that held reviews is over — but it left a large queue of open pull requests behind it, and we are reading through them oldest-first. The background is in discussion #1144.

What that means for this PR, concretely:

• It will not be closed for inactivity. No stale bot touches pull requests here.
• It may still sit a while before a human reads it. That is on us, not on you.
• Older PRs are read first, so a recent one is not being skipped — it is behind a queue.

Things that will genuinely speed it up whenever review does happen:

• Keep it rebased on main — the tree is moving quickly right now, and a conflicting branch cannot be reviewed as the diff you intended.
• Get CI green, or say which failures you believe are pre-existing.
• Keep the change to one claim. Bundled features and refactors get split before they get merged, which costs you a round trip.
• Every commit needs a sign-off (git commit -s) — CI enforces DCO.

If this fixes a bug, a reproduction we can run is worth more than a description of the symptom.

Thanks for contributing, and sorry in advance for the wait.

Thank you for the focused ignore_worktrees configuration contribution. This adds public configuration and changes repository-discovery behavior, so I have routed it to 0.11.0-rc with normal priority for a full behavior review. The community queue is currently full, and detailed feedback may take a little time.

@vitalNohj — the behavior review is done, and the answer is accepted: both surfaces ship — the ignore_worktrees config key and the index_worktree per-call override — once the rework below lands. Your detection design carried the decision: the commondir marker is the right discriminator (submodule-safe, since submodule gitdirs never carry it), the fail-open posture on any probe failure is exactly correct, and default-off is verifiably bit-for-bit today's behaviour.

Context you deserve on why this needed a maintainer decision at all: there is a parked direction (see #573) where worktrees eventually get a cheap view keyed by the git common dir rather than nothing. Your key is opt-in-off, so it forecloses none of that — and your commondir plumbing is genuinely reusable for that family-identity work later. But "skip worktrees on purpose" and "worktrees get an overlay" are opposite product answers to the same pain, so shipping yours ahead of that decision was a call, not a formality. It is now made, in your favour.

The rework map — one item is invisible and load-bearing:

1. CONFIG_KEYS row (the invisible one). Since 0.10.0: two silent empty-result paths — tree format returns {} over MCP (default), and config get returns empty for all keys but auto_index #1522/Installer/updater scope and safety: no per-client selector, destructive update step before an interactive prompt, hidden ui_enabled, brittle legacy-marker cleanup #1558, that table in src/cli/cli.c (:6837) is the config set allowlist — config_key_lookup rejects unknown keys (:6997). Your PR predates this, patches the old printf blocks, and adds no row — so on current main every enable command your own docs and refusal message suggest would error unknown config key. Add {CBM_CONFIG_IGNORE_WORKTREES, "false", "<help text>"} with the default mirroring your runtime reader, per the table's keep-in-sync comment. Nothing will fail a test if you miss this — the Installer/updater scope and safety: no per-client selector, destructive update step before an interactive prompt, hidden ui_enabled, brittle legacy-marker cleanup #1558 pin covers only the UI keys — which is precisely why it leads this list.
2. Rebase: conflicts in README, CONFIGURATION.md and the rewritten config region of cli.c; the other nine files auto-merge.
3. The default-off pin: a test asserting that with the key unset, a linked worktree still indexes exactly as today — the regression class we guard hardest. Your explicit-gate probe with its positive control and override-escape is good; this is the missing direction.
4. If you can: cover the auto-index path (your _for_testing wrapper hardcodes false, so the new branch is currently unreachable from the test hook), swap the hardcoded /tmp for th_mktempdir as your body describes, and let fixture failures SKIP rather than PASS.

The one red CI leg on your final SHA (test_daemon_ipc.c:2248, Windows) is a timeout-decided test on a loaded runner, mechanism-unrelated to your diff — it is now on our flake ledger, and a rebase re-runs everything anyway.

Take your time; the acceptance does not expire. This is a first contribution built the way we wish more were.

Thanks again for the worktree-ignore work. The October 1 review remains the current request: separate the unrelated fixes, keep the default-off hook path minimal, and document subdirectory behavior in the focused revision. The earlier approval covered an older head; no new changes are requested by this follow-up.

@vitalNohj, thank you for sticking with this one, and for all the work after the first approval. The commondir check, the fail-open probes, the symlink and nested-worktree handling and the default-off tests are careful work, and they made this easy to finish. To save you another round trip we pushed five small commits on top of your branch that cover the October 1 review:

1. faf25ee - drops the fuzz-link and Cypher hunks from this PR (review item 1). Both landed on main in the meantime: the cbm-fuzz rule now links with -fsanitize-link-c++-runtime, and 70543ba frees a partially parsed MATCH pattern with its own regression test. So no separate PRs are needed. If you would like your two extra malformed-pattern queries as additional test cases, a small tests-only PR is very welcome.
2. 77310d5 - keeps the hook default path untouched (review item 3). The lifecycle hook now reads ignore_worktrees first and does nothing else for it while the key is off: no realpath on the cwd, no worktree probe, and the same project lookup as before the key existed. The key comes from a new cbm_mcp_ignore_worktrees_runtime_enabled(), which replaces cbm_mcp_server_attach_runtime_config(). It never attaches a store to the server (the daemon lends its session server here) and answers from the server store when there is one. Otherwise it opens the runtime store only to read this key, and only if the store already exists, so a hook event never creates _config.db. To answer the question from the review: yes, without a server store the store has to be opened to read the key, and everything after that read is behind the key. A new test, cli_hook_ignore_worktrees_default_off_does_no_worktree_work, pins this; it failed on the previous head, where a default-off event created _config.db. The test for the removed helper is replaced by one for the new reader.
3. 04ed024 - documents subdirectories in docs/CONFIGURATION.md (review item 4). For the record, this is now the stated behavior: a subdirectory of a linked worktree counts as that worktree, so index_repository on it is refused like the worktree root, and a session or hook directory inside it is treated the same way. The walk stops at the first .git it finds; outside any checkout it runs up to the filesystem root, one directory at a time. None of it runs while the key is off.
4. 1976986 - merges current main. Eight files conflicted, all of them lines added next to the same spot on both sides (config keys, the tool schema, docs rows); each is resolved to main plus your change.
5. 141b25a - renames one local variable in the new reader that cppcheck 2.20 flags as shadowing cache_dir().

On review item 2 (one linear series): we merge with merge commits and never force-push a contributor branch, so we left your history as it is rather than rewriting it.

We also checked it end to end on a clone of redis with a linked worktree beside it. With the key off, both checkouts index (34,539 and 34,544 nodes; the worktree carries one extra file). With the key on, the worktree and its src/ subdirectory are refused with your message, the main checkout indexes exactly as before, and index_worktree=true indexes the worktree to the same 34,544 nodes.

Please pull the branch before pushing again, so these commits are not lost. Thank you again; this is a contribution built the way we wish more were.

Merged - thank you very much, @vitalNohj! ignore_worktrees is now on main: with the key on, a linked worktree (and any subdirectory of it) is refused with your actionable message and index_worktree=true still lets someone index it on purpose, while with the key off nothing changes at all - the hook path is exactly the old lookup. The commondir check, the fail-open probes and the symlink and nested-worktree handling made this easy to trust. We dismissed our old October 1 change request, since everything it asked for is covered by the commits above. Thanks again for sticking with it through all the rounds.