fix(server): reject Git-confirmed bare-root projects - #8646

Human hold

This is a narrower project-add policy proposal for #8164, not a complete fix for the original report. Keep it unmerged until a maintainer approves rejecting Git-confirmed bare roots. Already-converted nonbare roots remain accepted. No initialization behavior changes are included.

Change

A root whose .git file points to an embedded bare repository has no checkout of its own. Project add now rejects that root with an explanation and directs the user to an individual worktree. The check applies to CLI add and normalized project.create commands.

The original index heuristic rejected a valid unborn separate-git-dir checkout with a linked worktree and accepted a bare repository after git read-tree --empty created an index. The correction asks Git for its current bare status instead. It makes one bounded query only for in-root gitdir pointers; ordinary repositories, directories without a pointer, and external linked-worktree pointers keep the no-process fast path. Query errors remain accepted rather than guessing.

The shared pointer parser preserves native separators for the eligibility filter; devHome keeps its original backslash normalization. The final query gives Git the .git file itself, so Git—not the filter—resolves pointer syntax and trailing spaces. GIT_WORK_TREE is removed for this probe, and the explicit gitfile prevents an inherited GIT_DIR from redirecting the query.

Before and after

Real Git, production handlers and disposable SQLite fixtures on Linux. Original guard tested against main 931d41f9. Candidate includes main 2fb99a7a.

The expanded WorkspacePaths tests fail in four cases against the old guard and pass with the correction. The POSIX backslash regression failed before the raw-parser repair. Three further review regressions failed on 2b1d4d88 and pass with the gitfile-query correction: malformed pointer headers beside an unrelated bare repo, a valid trailing-space gitdir beside a bare trimmed-name sibling, and inherited Git environment overrides. Controls cover both GIT_WORK_TREE and GIT_DIR. CLI/SQLite tests verify that rejected roots create no project record and that valid or already-converted roots remain addable. The same fixtures exercise production command normalization.

cd apps/server
vp test run src/workspace/WorkspacePaths.test.ts src/bin.test.ts \
  src/orchestration/Normalizer.test.ts src/cli/project.test.ts --maxWorkers 2 \
  -t 'WorkspacePathsLive|current Git bare status|canonicalizeClientCommandTimestamps|maps declared server failures|preserves unexpected server failures'
../../node_modules/.bin/tsgo --noEmit
cd ../../packages/shared
vp test run src/devHome.test.ts src/git.test.ts --maxWorkers 2
../../node_modules/.bin/tsgo --noEmit

56 focused tests pass, including the Windows-style devHome pointer control. Scoped types, lint, formatting and whitespace checks pass. This is nonvisual server validation; no native macOS client add/start evidence is claimed. At e80cb32c, all executed CI jobs, Macroscope Correctness/Approvability and Cursor Bugbot pass. All five review threads are resolved; there are no active change requests. Preview jobs and CodeRabbit's disabled automatic review are skipped. The watcher completed. The human policy hold and missing native add/start proof remain; this is not a complete fix for the original issue.

Limits

• Git can describe the current repository, not recover the intent of every root already converted to nonbare. A valid unborn checkout and a converted root produced matching bare/inside flags, local config and HEAD in the audit. No replacement heuristic is introduced.
• The exact report's bare-clone commands left core.bare=true in the Linux fixture. T3's existing initRepository changed it to false, after which the detector accepted the parent and status listed sibling worktrees as untracked. This PR does not change that initialization path or repair existing projects.
• Startup auto-bootstrap dispatches directly and still bypasses command normalization. HTTP dispatch still maps normalization errors to its existing generic invalid_command response.
• This does not decide policy for external gitdir pointers, roots that are themselves bare gitdirs, or already-converted layouts. The original issue stays open.

Original implementation by Walid Baharwal is preserved in 48fc1cd9; current main was merged without rewriting the author's history.

Correction and verification: GPT 6 Astra via Codex in T3 Code.