Prevent cwd loss during branch-finish prune (#424)

The prior cleanup fix only pivoted before the cleanup prune path, leaving the no-cleanup temporary prune able to spawn gx from an agent worktree cwd that may have disappeared during nested finish cleanup.

This moves the cwd pivot behind a shared helper, calls it before both prune paths, restores scripts/template parity, and mirrors the legacy frontend script copy.

Constraint: gx worktree prune may run after merge-side cleanup or parent gitlink handling changes the active worktree state.

Rejected: stderr filtering in wrapper scripts | it would hide the warning without fixing the package behavior.

Confidence: high

Scope-risk: narrow

Directive: Keep branch-finish prune calls preceded by the cwd pivot when running from active agent worktrees.

Tested: bash -n scripts/agent-branch-finish.sh; bash -n templates/scripts/agent-branch-finish.sh; bash -n frontend/scripts/agent-branch-finish.sh; node --test --test-name-pattern 'agent-branch-finish pivots' test/metadata.test.js; node --test test/finish.test.js; openspec validate --specs

Not-tested: full metadata.test.js remains blocked by unrelated vscode/guardex-active-agents/extension.js template drift

Co-authored-by: NagyVikt <nagy.viktordp@gmail.com>

Author: NagyVikt

frontend/scripts/agent-branch-finish.sh

@@ -526,6 +526,15 @@ if [[ -n "$base_worktree" ]] && is_clean_worktree "$base_worktree" && [[ "$PUSH_
   git -C "$base_worktree" pull --ff-only origin "$BASE_BRANCH" >/dev/null 2>&1 || true
 fi
 
+# Pivot out of the agent worktree before prune calls that may remove it.
+# Without this, subprocess spawns can fail with ENOENT uv_cwd after cwd
+# disappears even when the merge succeeded.
+pivot_to_repo_root_before_prune() {
+  if [[ "$current_worktree" == "$source_worktree" && "$source_worktree" == "${agent_worktree_root}"/* ]]; then
+    cd "$repo_root" 2>/dev/null || true
+  fi
+}
+
 if [[ "$CLEANUP_AFTER_MERGE" -eq 1 ]]; then
   if [[ "$source_worktree" == "$repo_root" ]]; then
     if is_clean_worktree "$source_worktree"; then
@@ -560,6 +569,8 @@ if [[ "$CLEANUP_AFTER_MERGE" -eq 1 ]]; then
     if [[ "$DELETE_REMOTE_BRANCH" -eq 1 ]]; then
       prune_args+=(--delete-remote-branches)
     fi
+
+    pivot_to_repo_root_before_prune
     if ! bash "${repo_root}/scripts/agent-worktree-prune.sh" "${prune_args[@]}"; then
       echo "[agent-branch-finish] Warning: automatic worktree prune failed." >&2
       echo "[agent-branch-finish] You can run manual cleanup: bash scripts/agent-worktree-prune.sh --base ${BASE_BRANCH} --delete-branches" >&2
@@ -573,6 +584,7 @@ if [[ "$CLEANUP_AFTER_MERGE" -eq 1 ]]; then
   fi
 else
   if [[ -x "${repo_root}/scripts/agent-worktree-prune.sh" ]]; then
+    pivot_to_repo_root_before_prune
     if ! bash "${repo_root}/scripts/agent-worktree-prune.sh" --base "$BASE_BRANCH"; then
       echo "[agent-branch-finish] Warning: temporary worktree prune failed." >&2
     fi

scripts/agent-branch-finish.sh

@@ -787,6 +787,15 @@ if [[ -n "$base_worktree" ]] && is_clean_worktree "$base_worktree" && [[ "$PUSH_
 fi
 maybe_auto_commit_parent_gitlink "$base_worktree"
 
+# Pivot out of the agent worktree before prune calls that may remove it.
+# Without this, subprocess spawns can fail with ENOENT uv_cwd after cwd
+# disappears even when the merge succeeded.
+pivot_to_repo_root_before_prune() {
+  if [[ "$current_worktree" == "$source_worktree" && "$source_worktree" == "${agent_worktree_root}"/* ]]; then
+    cd "$repo_root" 2>/dev/null || true
+  fi
+}
+
 if [[ "$CLEANUP_AFTER_MERGE" -eq 1 ]]; then
   if [[ "$source_worktree" == "$repo_root" ]]; then
     if is_clean_worktree "$source_worktree"; then
@@ -831,16 +840,7 @@ if [[ "$CLEANUP_AFTER_MERGE" -eq 1 ]]; then
     prune_args+=(--delete-remote-branches)
   fi
 
-  # Pivot out of the agent worktree before the prune may remove it. The prune
-  # subprocess inherits cwd=repo_root from the CLI caller, so its own active
-  # cwd check can't see that our shell is sitting in the worktree it is about
-  # to delete. Without this pivot the directory disappears mid-call, every
-  # subsequent subprocess spawn fails with ENOENT uv_cwd, and `set -e` flips
-  # the script exit code to 1 even though the merge succeeded.
-  if [[ "$current_worktree" == "$source_worktree" && "$source_worktree" == "${agent_worktree_root}"/* ]]; then
-    cd "$repo_root" 2>/dev/null || true
-  fi
-
+  pivot_to_repo_root_before_prune
   if ! run_guardex_cli worktree prune "${prune_args[@]}"; then
     echo "[agent-branch-finish] Warning: automatic worktree prune failed." >&2
     echo "[agent-branch-finish] You can run manual cleanup: gx cleanup --base ${BASE_BRANCH}" >&2
@@ -852,6 +852,7 @@ if [[ "$CLEANUP_AFTER_MERGE" -eq 1 ]]; then
     echo "[agent-branch-finish] Leave this directory, then run: gx cleanup --base ${BASE_BRANCH}" >&2
   fi
 else
+  pivot_to_repo_root_before_prune
   if ! run_guardex_cli worktree prune --base "$BASE_BRANCH"; then
     echo "[agent-branch-finish] Warning: temporary worktree prune failed." >&2
   fi

templates/scripts/agent-branch-finish.sh

@@ -787,6 +787,15 @@ if [[ -n "$base_worktree" ]] && is_clean_worktree "$base_worktree" && [[ "$PUSH_
 fi
 maybe_auto_commit_parent_gitlink "$base_worktree"
 
+# Pivot out of the agent worktree before prune calls that may remove it.
+# Without this, subprocess spawns can fail with ENOENT uv_cwd after cwd
+# disappears even when the merge succeeded.
+pivot_to_repo_root_before_prune() {
+  if [[ "$current_worktree" == "$source_worktree" && "$source_worktree" == "${agent_worktree_root}"/* ]]; then
+    cd "$repo_root" 2>/dev/null || true
+  fi
+}
+
 if [[ "$CLEANUP_AFTER_MERGE" -eq 1 ]]; then
   if [[ "$source_worktree" == "$repo_root" ]]; then
     if is_clean_worktree "$source_worktree"; then
@@ -830,17 +839,20 @@ if [[ "$CLEANUP_AFTER_MERGE" -eq 1 ]]; then
   if [[ "$DELETE_REMOTE_BRANCH" -eq 1 ]]; then
     prune_args+=(--delete-remote-branches)
   fi
+
+  pivot_to_repo_root_before_prune
   if ! run_guardex_cli worktree prune "${prune_args[@]}"; then
     echo "[agent-branch-finish] Warning: automatic worktree prune failed." >&2
     echo "[agent-branch-finish] You can run manual cleanup: gx cleanup --base ${BASE_BRANCH}" >&2
   fi
 
   echo "[agent-branch-finish] Merged '${SOURCE_BRANCH}' into '${BASE_BRANCH}' via ${merge_status} flow and cleaned source branch/worktree."
-  if [[ "$source_worktree" == "$current_worktree" && "$source_worktree" == "${agent_worktree_root}"/* ]]; then
+  if [[ "$source_worktree" == "$current_worktree" && "$source_worktree" == "${agent_worktree_root}"/* && -d "$source_worktree" ]]; then
     echo "[agent-branch-finish] Current worktree '${source_worktree}' still exists because it is the active shell cwd." >&2
     echo "[agent-branch-finish] Leave this directory, then run: gx cleanup --base ${BASE_BRANCH}" >&2
   fi
 else
+  pivot_to_repo_root_before_prune
   if ! run_guardex_cli worktree prune --base "$BASE_BRANCH"; then
     echo "[agent-branch-finish] Warning: temporary worktree prune failed." >&2
   fi

test/metadata.test.js

@@ -232,6 +232,21 @@ test('critical runtime helper scripts and active-agents sources stay in sync wit
   }
 });
 
+test('agent-branch-finish pivots out of active agent cwd before every prune path', () => {
+  const script = fs.readFileSync(path.join(repoRoot, 'scripts', 'agent-branch-finish.sh'), 'utf8');
+
+  assert.match(script, /pivot_to_repo_root_before_prune\(\) \{\n\s+if \[\[ "\$current_worktree" == "\$source_worktree"/);
+  assert.match(script, /cd "\$repo_root" 2>\/dev\/null \|\| true/);
+  assert.match(
+    script,
+    /pivot_to_repo_root_before_prune\n\s+if ! run_guardex_cli worktree prune "\$\{prune_args\[@\]\}"; then/,
+  );
+  assert.match(
+    script,
+    /else\n\s+pivot_to_repo_root_before_prune\n\s+if ! run_guardex_cli worktree prune --base "\$BASE_BRANCH"; then/,
+  );
+});
+
 test('thin CLI entrypoint delegates to src/cli runtime', () => {
   const entryPath = path.join(repoRoot, 'bin', 'multiagent-safety.js');
   const entrySource = fs.readFileSync(entryPath, 'utf8');