Fix discard in linked worktrees

[Tranthanh98]

Summary

• resolve linked-worktree .git pointer files before storing undo snapshots
• use the resolved undo root for orphaned backup maintenance
• add regression coverage with a real linked worktree

Fixes #29.

Validation

• xcodebuild -project macgit.xcodeproj -scheme macgit -destination platform=macOS -only-testing:macgitTests/GitFileUndoSnapshotStoreTests test
• xcodebuild -project macgit.xcodeproj -scheme macgit -destination platform=macOS build
• git diff --check
• manually verified Discard and Undo from the linked worktree build

Summary by CodeRabbit

• Bug Fixes
  • Undo snapshots now work with Git linked worktrees, using the repository’s Git directory for snapshot storage.
  • Snapshot operations now report an error if the repository’s Git metadata is missing or invalid. Orphaned-backup checks skip repositories whose Git directory cannot be resolved.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Advanced

Run ID: de42c365-eb50-4f33-bbb2-2289e50b9012

📥 Commits

Reviewing files that changed from the base of the PR and between 48a9cb4 and 5487b32.

📒 Files selected for processing (3)

• macgit/Services/AdvancedMaintenanceService.swift
• macgit/Services/GitFileUndoSnapshotStore.swift
• macgitTests/GitFileUndoSnapshotStoreTests.swift

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.

---

📝 Walkthrough

Walkthrough

Undo snapshot paths now use the resolved Git directory, including for linked worktrees. Maintenance uses the snapshot store to find undo roots and skips repositories when lookup fails.

Changes

Linked-worktree undo paths

Layer / File(s)	Summary
Resolve Git directories for undo snapshots macgit/Services/GitFileUndoSnapshotStore.swift, macgitTests/GitFileUndoSnapshotStoreTests.swift	The snapshot store resolves a .git directory or validates a .git file’s gitdir: target. Capture, restore, and delete propagate path-resolution errors. A linked-worktree test covers snapshot capture, restore, and deletion.
Use resolved undo roots in maintenance macgit/Services/AdvancedMaintenanceService.swift	Maintenance gets each repository’s undo root from the snapshot store and skips repositories when lookup fails.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix · Severity of issue fixed: Low

Merge Risk: ⚪ Minimal · up to 5487b

No confirmed issue remains that would prevent merging after normal checks.

Security Architecture Review

Security architecture risk: 🟡 Moderate · up to 5487b

Linked-worktree undo gains needed support, but a changed or misdirected Git-directory pointer could affect backups outside the selected worktree or make an existing undo backup unavailable.

Retained concerns

• Medium · security · inferred: A .git file can direct the undo root to any existing directory without proving that it belongs to the selected repository. With a locally controlled pointer, snapshot operations can use another accessible root; maintenance can report UUID-named backup directories there for user-confirmed deletion.
• Medium · reliability · inferred: For a linked worktree, changing or invalidating the pointer after capture can separate an undo entry from its backup. Restore or deletion then fails or uses a different root; suppressed deletion errors and skipped maintenance lookup can leave the original backup without a recovery path through these operations.

Security review details

Security Blast Radius

• inferred — The pointer can redirect undo operations outside the selected worktree, but the resulting access remains subject to the application’s filesystem permissions and the fixed macgit/undo suffix. Maintenance scans recent repositories and requires a separate removal action.

Security Findings and Attack Paths

• inferred — If a locally controlled .git file points at another accessible Git directory, maintenance can classify that directory’s unregistered UUID-named undo backups as orphans. User-confirmed removal acts on the directories in the report. This is a conditional cross-repository integrity path, not an established remote attack or a verified deletion.

Trust Boundaries and Controls

• observed — Callers retain the selected repository URL through capture and undo, while the store independently trusts its current .git pointer for backup location. Maintenance excludes IDs in the process-local registry and removal checks that exclusion again.

Resilience and Maintainability Implications

• inferred — A failed root lookup prevents deletion from unregistering its snapshot ID; undo-stack cleanup suppresses that error, and maintenance cannot inspect the old root through a now-invalid pointer. This weakens recovery of backups after pointer changes.

Hardening Proposals

• proposed — Verify that a resolved Git directory belongs to the selected worktree before using it for undo data, and retain enough root identity with a captured snapshot to restore or clean it up if the pointer later changes.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 13 functions across 3 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: fixing discard behavior for linked worktrees.
Linked Issues check	✅ Passed	Issue [#29] requires discard support in a linked worktree where .git is a pointer file. GitFileUndoSnapshotStore.gitDirectory(in:) now reads and validates the gitdir: pointer, resolves relative …
Out of Scope Changes check	✅ Passed	The changes stay within issue [#29]. The production changes resolve linked-worktree Git pointers for undo storage and orphan-backup maintenance. The added Git test helpers and regression test support …

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}