Treat short -f spellings as force and fix remove notice wording

Short -f takes no value: real git rejects -f=<value> and glued -f<val> the way it rejects --force=<value>, so the worktree policy treats them as force instead of letting the generic-flag skip swallow them. The grant-mismatch notice keeps the destination noun for add and names the worktree itself for remove.

Author: TheGreatAxios

src/permission/auto-shell-policy.test.ts

@@ -97,7 +97,7 @@ describe("read-only git commands pass through the policy", () => {
   });
 });
 
-describe("git worktree --force=<value> asks (CL-6824)", () => {
+describe("git worktree force spellings ask (CL-6824)", () => {
   // Control: a contained non-force add is not flagged at all.
   test("contained non-force add stays unflagged", () => {
     expect(
@@ -118,10 +118,32 @@ describe("git worktree --force=<value> asks (CL-6824)", () => {
     }
   });
 
+  // Short -f takes no value either — real git dies with
+  // "error: unknown switch `='" for `-f=<value>` and
+  // "error: unknown switch `<char>'" for glued `-f<val>` (exit 129 both) —
+  // but the spellings still express force intent, so the policy asks rather
+  // than letting the generic-flag skip swallow them.
+  test("-f=<value> and glued -f<val> spellings hit the worktree ask rule", () => {
+    for (const flag of ["-f=true", "-f=", "-ftrue", "-ff"]) {
+      expect(
+        autoShellRuleForCall(shellCall(`git worktree add ${flag} ./wt-short`))
+          ?.name,
+      ).toBe("git-worktree");
+      expect(
+        autoShellRuleForCall(
+          shellCall(`git worktree remove ${flag} ./wt-short`),
+        )?.name,
+      ).toBe("git-worktree");
+    }
+  });
+
   // The negation is not force: --no-force must not be caught by the prefix.
   test("--no-force stays unflagged", () => {
     expect(
       autoShellRuleForCall(shellCall("git worktree add --no-force ./wt-no")),
     ).toBeUndefined();
+    expect(
+      autoShellRuleForCall(shellCall("git worktree remove --no-force ./wt-no")),
+    ).toBeUndefined();
   });
 });

src/permission/auto-shell-policy.ts

@@ -351,7 +351,13 @@ export function isWorktreeForceFlag(arg: string): boolean {
   // "error: option `force' takes no value"), but the spelling still expresses
   // force intent, so the policy treats it as force rather than letting the
   // --flag=value path skip swallow it.
-  return arg === "-f" || arg === "--force" || arg.startsWith("--force=");
+  if (arg === "--force" || arg.startsWith("--force=")) return true;
+  // Short -f takes no value either (real git rejects `-f=<value>` with
+  // "error: unknown switch `='" and glued `-f<val>` with
+  // "error: unknown switch `<char>'"); the same fail-closed reasoning applies.
+  // Any `-f`-prefixed token expresses force intent. `--no-force` negations are
+  // unaffected: they start with "--n", not "-f".
+  return arg.startsWith("-f");
 }
 
 // True when the path is safe for unattended worktree add/remove: inside the

src/permission/gate.test.ts

@@ -349,7 +349,31 @@ describe("grant-mismatch asks carry the guard reason as a notice (CL-6824)", ()
     );
   });
 
-  test("uncontained destination names the approved locations", async () => {
+  test("short -f=<value> is still force in the notice", async () => {
+    const { verdict, seen } = await askWithGrants(
+      "git worktree add -f=true ../sib-force-short-eq",
+      worktreeGrant,
+    );
+    expect(verdict.allowed).toBe(false);
+    expect(seen).toHaveLength(1);
+    expect(seen[0]?.notice).toBe(
+      "A standing grant matches this command, but it uses --force, so it still needs approval.",
+    );
+  });
+
+  test("glued -f<val> is still force in the notice", async () => {
+    const { verdict, seen } = await askWithGrants(
+      "git worktree remove -ftrue ../sib-force-glued",
+      worktreeGrant,
+    );
+    expect(verdict.allowed).toBe(false);
+    expect(seen).toHaveLength(1);
+    expect(seen[0]?.notice).toBe(
+      "A standing grant matches this command, but it uses --force, so it still needs approval.",
+    );
+  });
+
+  test("uncontained add destination names the approved locations", async () => {
     // A direct child of tmpdir() is not a permitted sibling of sessionCwd
     // (only direct children of root/ are), so the restricted guard trips.
     const outside = join(tmpdir(), "gate-6824-outside");
@@ -364,6 +388,21 @@ describe("grant-mismatch asks carry the guard reason as a notice (CL-6824)", ()
     );
   });
 
+  test("uncontained remove names the worktree, not a destination", async () => {
+    // `remove` names an existing worktree — there is no destination — so the
+    // notice drops the destination noun the `add` case uses.
+    const outside = join(tmpdir(), "gate-6824-outside-remove");
+    const { verdict, seen } = await askWithGrants(
+      `git worktree remove ${outside}`,
+      worktreeGrant,
+    );
+    expect(verdict.allowed).toBe(false);
+    expect(seen).toHaveLength(1);
+    expect(seen[0]?.notice).toBe(
+      "A standing grant matches this command, but the worktree is outside the approved locations, so it still needs approval.",
+    );
+  });
+
   test("secret reference names the sensitive path", async () => {
     const { verdict, seen } = await askWithGrants("cat .env", catGrant);
     expect(verdict.allowed).toBe(false);
@@ -414,4 +453,25 @@ describe("grant-mismatch asks carry the guard reason as a notice (CL-6824)", ()
     expect(verdict.allowed).toBe(true);
     expect(seen).toHaveLength(0);
   });
+
+  test("a --no-force command still allows with no prompt and no notice", async () => {
+    const seen: PermissionRequest[] = [];
+    const gate = createPermissionGate({
+      approvals: worktreeGrant,
+      interactive: true,
+      skipPermissions: false,
+      reactorGated: false,
+      cwd: sessionCwd,
+      rootsProvider: () => [],
+      requestApproval: async (request) => {
+        seen.push(request);
+        return { allow: false };
+      },
+    });
+    const verdict = await gate.evaluate(
+      shellCall("git worktree add --no-force ../sib-noforce -b br-noforce"),
+    );
+    expect(verdict.allowed).toBe(true);
+    expect(seen).toHaveLength(0);
+  });
 });

src/permission/gate.ts

@@ -153,11 +153,14 @@ function segmentGuard(
 // Display-only refinement — the guard decision itself is unchanged.
 function worktreeMismatchKind(
   segment: string,
-): "force" | "destination" | undefined {
+): "force" | "destination" | "worktree" | undefined {
   const tokens = tokenize(segment);
   if (tokens[0] !== "git" || tokens[1] !== "worktree") return undefined;
   if (tokens[2] !== "add" && tokens[2] !== "remove") return undefined;
-  return tokens.slice(3).some(isWorktreeForceFlag) ? "force" : "destination";
+  if (tokens.slice(3).some(isWorktreeForceFlag)) return "force";
+  // `add` takes a destination for the new worktree; `remove` names an
+  // existing worktree, so only `add` gets the destination noun.
+  return tokens[2] === "remove" ? "worktree" : "destination";
 }
 
 // Explains a grant mismatch: a standing grant covers the segment, but the
@@ -177,6 +180,9 @@ function grantMismatchNotice(
   if (worktreeKind === "destination") {
     return "A standing grant matches this command, but the worktree destination is outside the approved locations, so it still needs approval.";
   }
+  if (worktreeKind === "worktree") {
+    return "A standing grant matches this command, but the worktree is outside the approved locations, so it still needs approval.";
+  }
   return "A standing grant matches this command, but it targets a path outside the workspace, so it still needs approval.";
 }