fix: confine repository-supplied paths

[timvw]

Summary

• confine patterns from committed .wt.toml files to the configured worktree root
• resolve containment through existing and dangling symlink components
• place migrate-derived primary destinations under repo_root while preserving machine-local overrides
• document the behavior and cover direct, relative, override, symlink, and migration cases

Verification

• go test ./... -count=1
• golangci-lint run
• independent Claude review: no blockers

Closes #154

Summary by CodeRabbit

• Bug Fixes

  • Primary migration targets now resolve beneath the configured repository root.
  • Invalid paths and targets outside the repository root are rejected.
  • Repository-defined worktree patterns cannot escape the configured worktree root, including through symlinks.
  • Local configuration and environment overrides may still intentionally place worktrees elsewhere.

• Documentation

  • Updated configuration and worktree guidance to explain path restrictions and approved override options.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 85616ad3-57b1-490b-b41e-8eccad52d30e

📥 Commits

Reviewing files that changed from the base of the PR and between 0cf3ab0 and c91b346.

📒 Files selected for processing (6)

• cmd/migrate.go
• cmd/migrate_test.go
• cmd/worktree_path.go
• cmd/worktree_path_test.go
• docs/configuration.md
• plugins/wt/skills/wt/SKILL.md

Included review availability: Your plan provides up to 10 included reviews per hour; 8 remain after this review.

---

📝 Walkthrough

Walkthrough

The migration flow now resolves primary checkout targets beneath repo_root. Repository-supplied worktree patterns cannot escape root, including through symlinks. Local Git configuration and environment overrides remain unrestricted. Tests and documentation reflect these rules.

Changes

Repository-root path safety

Layer / File(s)	Summary
Migration primary target resolution cmd/migrate.go, cmd/migrate_test.go	Primary migration targets use the configured absolute repo_root. Invalid and escaping targets are rejected. Tests and subprocess helpers configure this root explicitly.
Repository pattern containment cmd/worktree_path.go, cmd/worktree_path_test.go, docs/configuration.md, plugins/wt/skills/wt/SKILL.md	Repository .wt.toml patterns remain inside root, including symlink escapes and absolute paths. Local Git configuration and WORKTREE_PATTERN can place worktrees outside the root. Documentation and diagnostics reflect the source-specific behavior.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to c91b3

The path-confinement and migration updates are merge-ready after normal checks and review; no actionable merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 14 functions across 4 files. (2 skipped: …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the primary change: confining paths supplied by repositories.
Linked Issues check	✅ Passed	The changes satisfy issue #154 by confining committed .wt.toml patterns to the configured worktree root, accounting for symlink escapes, preserving machine-local overrides, and adding corresponding mi…
Out of Scope Changes check	✅ Passed	The code, tests, and documentation changes directly support the linked issue and stated objectives. No unrelated changes are evident.

Full details: Linked Issues check

Explanation

The changes satisfy issue #154 by confining committed .wt.toml patterns to the configured worktree root, accounting for symlink escapes, preserving machine-local overrides, and adding corresponding migration behavior, tests, and documentation.

Full details: Docstring Coverage

Explanation

Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 14 functions across 4 files. (2 skipped: 2 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/154-anchor-repo-pattern

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

❌ Patch coverage is 73.33333% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 54.82%. Comparing base (0cf3ab0) to head (c91b346).

Files with missing lines	Patch %	Lines
cmd/migrate.go	60.00%	4 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #156      +/-   ##
==========================================
+ Coverage   54.53%   54.82%   +0.29%     
==========================================
  Files          43       43              
  Lines        5510     5519       +9     
==========================================
+ Hits         3005     3026      +21     
+ Misses       2505     2493      -12     

Files with missing lines	Coverage Δ
cmd/worktree_path.go	79.25% <100.00%> (+0.64%)	⬆️
cmd/migrate.go	11.63% <60.00%> (+2.38%)	⬆️

... and 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.