fix(merge): refuse rollback when main worktree is dirty

Author: nigel-dev

src/tools/merge.ts

@@ -19,6 +19,21 @@ async function getBaseBranch(cwd: string): Promise<string> {
   throw new Error('Could not find main or master branch');
 }
 
+async function assertCleanWorktree(cwd: string): Promise<void> {
+  const status = await gitCommand(['status', '--porcelain'], { cwd });
+  if (status.exitCode !== 0) {
+    throw new Error(
+      `Failed to check main worktree status: ${status.stderr || status.stdout}`,
+    );
+  }
+
+  if (status.stdout.trim() !== '') {
+    throw new Error(
+      'Main worktree has uncommitted changes. Refusing merge because automatic rollback may discard local changes. Commit, stash, or clean the worktree and retry.',
+    );
+  }
+}
+
 export const mc_merge: ToolDefinition = tool({
   description: 'Merge a job\'s branch back to main (for non-PR workflows)',
   args: {
@@ -60,7 +75,8 @@ export const mc_merge: ToolDefinition = tool({
       );
     }
 
-    // 7. Execute merge based on strategy
+    await assertCleanWorktree(mainWorktreePath);
+
     if (mergeStrategy === 'squash') {
       // Squash: merge --squash then commit
       const squashResult = await gitCommand(['merge', '--squash', job.branch], {
@@ -146,7 +162,6 @@ export const mc_merge: ToolDefinition = tool({
       }
     }
 
-    // 8. Check if job belongs to active plan
     let planWarning = '';
     if (job.planId) {
       const activePlan = await loadPlan();
@@ -156,7 +171,6 @@ export const mc_merge: ToolDefinition = tool({
       }
     }
 
-    // 9. Return success message
     const lines: string[] = [
       `${planWarning}Successfully merged '${job.branch}' into '${baseBranch}'`,
       '',

tests/tools/merge.test.ts

@@ -1,4 +1,4 @@
-import { describe, it, expect, beforeEach, afterEach, vi, type Mock } from 'vitest';
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
 import { join } from 'path';
 import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'fs';
 import { tmpdir } from 'os';
@@ -7,10 +7,11 @@ import * as jobState from '../../src/lib/job-state';
 import * as worktree from '../../src/lib/worktree';
 import * as config from '../../src/lib/config';
 import * as planState from '../../src/lib/plan-state';
+import * as git from '../../src/lib/git';
 
 const { mc_merge } = await import('../../src/tools/merge');
 
-let mockGetJobByName: Mock;
+let mockGetJobByName: any;
 
 const mockContext = {
   sessionID: 'test-session',
@@ -25,8 +26,42 @@ const mockContext = {
 
 describe('mc_merge', () => {
   beforeEach(() => {
-    vi.clearAllMocks();
+    vi.restoreAllMocks();
     mockGetJobByName = vi.spyOn(jobState, 'getJobByName').mockImplementation(() => undefined as any);
+    vi.spyOn(worktree, 'getMainWorktree').mockResolvedValue('/tmp/mc-merge-mock-main');
+    vi.spyOn(config, 'loadConfig').mockResolvedValue({ mergeStrategy: 'squash' } as any);
+    vi.spyOn(planState, 'loadPlan').mockResolvedValue(null);
+    vi.spyOn(git, 'gitCommand').mockImplementation(async (args: string[]) => {
+      if (
+        args[0] === 'rev-parse' &&
+        args.includes('--verify') &&
+        args[args.length - 1] === 'main'
+      ) {
+        return { stdout: 'main', stderr: '', exitCode: 0 };
+      }
+
+      if (
+        args[0] === 'rev-parse' &&
+        args.includes('--verify') &&
+        args[args.length - 1] === 'master'
+      ) {
+        return { stdout: '', stderr: '', exitCode: 1 };
+      }
+
+      if (args[0] === 'rev-parse' && args.includes('--abbrev-ref')) {
+        return { stdout: 'main', stderr: '', exitCode: 0 };
+      }
+
+      if (args[0] === 'merge' && args.includes('--squash')) {
+        return { stdout: '', stderr: 'mock squash merge failure', exitCode: 1 };
+      }
+
+      return { stdout: '', stderr: '', exitCode: 0 };
+    });
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
   });
 
   describe('tool definition', () => {
@@ -59,6 +94,49 @@ describe('mc_merge', () => {
     });
   });
 
+  describe('safety guard', () => {
+    it('should refuse merge when main worktree has uncommitted changes', async () => {
+      const job: Job = {
+        id: 'job-dirty',
+        name: 'dirty-merge',
+        worktreePath: '/tmp/mc-worktrees/dirty-merge',
+        branch: 'mc/dirty-merge',
+        tmuxTarget: 'mc-dirty-merge',
+        placement: 'session',
+        status: 'running',
+        prompt: 'Dirty merge test',
+        mode: 'vanilla',
+        createdAt: new Date().toISOString(),
+      };
+
+      mockGetJobByName.mockResolvedValue(job);
+
+      (git.gitCommand as any).mockImplementation(async (args: string[]) => {
+        if (
+          args[0] === 'rev-parse' &&
+          args.includes('--verify') &&
+          args[args.length - 1] === 'main'
+        ) {
+          return { stdout: 'main', stderr: '', exitCode: 0 };
+        }
+
+        if (args[0] === 'rev-parse' && args.includes('--abbrev-ref')) {
+          return { stdout: 'main', stderr: '', exitCode: 0 };
+        }
+
+        if (args[0] === 'status' && args.includes('--porcelain')) {
+          return { stdout: ' M README.md', stderr: '', exitCode: 0 };
+        }
+
+        return { stdout: '', stderr: '', exitCode: 0 };
+      });
+
+      await expect(
+        mc_merge.execute({ name: 'dirty-merge' }, mockContext),
+      ).rejects.toThrow('Main worktree has uncommitted changes');
+    });
+  });
+
   describe('tool args validation', () => {
     it('should have name as required arg', () => {
       const nameArg = mc_merge.args.name;