[NoRiceToday]

Issue: Closes #438

What

• Batch mid-session protected-file detections into one decision dialog.
• Add exact-path, batch, and project-scoped basename exceptions.
• Keep launch-time protection and the audit trail unchanged.

Why

Creating a worktree can generate a burst of protected-pattern files such as .env and .env.local. omac cannot tell whether they are local defaults or real secrets, so it warns. The old watch produced one popup per file; an exact path does not cover the next worktree, and a global basename exception would silence that name in every project. A project-scoped exception is the narrowest scope that covers future worktrees of the same repository.

How

• Resolve the project root by walking to the first .git entry; a validated linked worktree maps to the main repository. core.worktree is never read.
• Store {root, name} in ~/.config/omac/prefs.yaml; match only below the canonical root.
• Offer the project option last, after keep, exact paths, and the batch.
• Refuse / and $HOME as roots. Non-git projects and worktrees outside the repository keep exact-path and batch choices.

Diagram

flowchart TD
  W[workdir] --> G{first .git entry}
  G -- directory --> R[parent = repo root]
  G -- file --> V{validated linked worktree?}
  V -- yes --> M[parent of common dir = main repo]
  V -- no --> L[directory holding .git = repo root]
  R --> C{contains workdir and<br/>not / or $HOME?}
  M --> C
  L --> C
  C -- yes --> P[project option offered]
  C -- no --> N[no project option]

Loading

Verification

• go build ./... — pass
• go vet ./internal/cli ./internal/prefs ./internal/netprompt ./internal/sandboxrun — pass
• go test ./internal/prefs ./internal/netprompt ./internal/pathutil — pass
• go test -race ./internal/cli -run 'Protected|GitProjectRoot|PathUnder|AskExceptions' — pass
• go test ./internal/sandboxrun -run 'Worktree|Grant' -skip 'Integration' — pass
• Full internal/cli still fails only on pre-existing sandbox limits (/tmp, ~/.config/omac).

Follow-up

Revoking a project exception still means editing prefs.yaml.

[JonathanRohland-TNG]

Thanks for this, the batching, the exact-path exceptions and the one-line summary fix the noise in #438 well. I'd like to suggest that we simplify how the project scope is chosen before we merge:

Problem: the git-based root can be wider than the project

resolveGitProjectRoot maps a linked worktree to filepath.Dir(common). Two cases go wrong (both reproduced locally on 88a74a7):

1. Bare repo with worktrees. Layout ~/repos/shop.git (bare) + ~/repos/shop-main (worktree). The common dir is shop.git, so the root becomes ~/repos. "Ignore every .env in this project (repos)" then silences .env in every repo under ~/repos.

     ~/repos/                    ← root (!)
     ├── other-project/          ← now "in the project"
     ├── yarp3/                  ← now "in the project"
     ├── shop.git/               ← common dir (bare)
     │   └── worktrees/
     │       └── shop-main/
     │           ├── gitdir
     │           └── commondir   "../.."
     └── shop-main/              ← workdir
         ├── .git                "gitdir: ~/repos/shop.git/worktrees/shop-main"
         └── .env
   

   Repro with plain git:

   git init --bare ~/repos/shop.git
   git -C ~/repos/shop.git worktree add --orphan ~/repos/shop-main
   # resolveGitProjectRoot("~/repos/shop-main") → "~/repos", true

2. Forged worktree metadata. The agent can write .git in the workdir. It can create a .git file plus a matching <x>/worktrees/<name> admin dir with a valid back-pointer, so ResolveWorktreeCommonDir accepts it and the root moves to the workdir's parent. The agent wrote both sides of each check, so every check passes. If the user clicks the project option, the exception covers sibling projects.

     ~/repos/                    ← root (!)
     ├── other-project/          ← now "in the project"
     ├── yarp3/                  ← now "in the project"
     └── proj/                   ← workdir = fake common dir
         ├── .git                "gitdir: ~/repos/proj/worktrees/n"
         ├── worktrees/
         │   └── n/              ← fake admin dir
         │       ├── gitdir      "~/repos/proj/.git"
         │       └── commondir   "../.."
         └── .env.local
   

   The root is resolved on the first dialog, so the agent can plant this any time before then.

Both pass the / and $HOME gates, and the label only shows the folder name, so the user can't tell.

Proposal: let the current omac workspace folder define the scope

The case in #438 is a worktree created under yarp3/.worktrees/<name> while a session runs in yarp3. The watch scans the workdir recursively, so that session sees the burst. Every affected file is a descendant of the folder omac was started in.

So instead of deriving a root from git metadata:

• Offer "Ignore every <name> under <full path>" with the session workdir as the path.
• Optionally also offer the workdir's parent folders, so a session started inside .worktrees/A can pick yarp3. Candidates come from the workdir path string only, which the agent cannot change.
• Keep refusing / and $HOME, and show the full path in the label.
• Store {root, name} in ~/.config/omac/prefs.yaml as now; matching stays a prefix check under root.

This removes gitroot.go and its tests, needs no .git parsing, and closes both cases above. Trade-off: worktrees outside the project folder (bare layouts, ../repo.worktrees, Orca's default ~/orca/workspaces) are not covered by one exception. The current approach also refuses worktrees outside the repo, so we don't lose anything there.

Why I'm suggesting this

It's a simpler solution, and I'm not aware of a relevant case it doesn't cover. If there is a reason to derive the common folder from git metadata, it isn't obvious to me, so please tell me if I'm missing one. Otherwise I'd go with the simpler design. It's easier to reason about, and it leaves fewer chances for edge cases nobody anticipated. The two cases above would be two examples of non-obvious behavior.

Other findings – Independent of the scope question

• Concurrent sessions lose prefs.yaml updates. The store is loaded once and saved later, so a second session's exceptions (and suppress_plugin_warning) can be overwritten. Re-load before Save and merge.
• Dialog timeout on macOS doesn't match the intended behavior. askExceptions returns silently on DeadlineExceeded ("the user did not answer"), but chooseDarwin returns signal: killed instead, so macOS falls through to the no-backend alert while Linux stays silent. Either return ctx.Err() in chooseDarwin like chooseZenity does, or make the alert after a timeout intentional on all platforms.

[JonathanRohland-TNG]

Nitpick: This comment doesn't really make sense without the context of the discussion on this PR.

[JonathanRohland-TNG]

After the latest commit, the flowchart in the PR description doesn't match the implemented behavior anymore.
I would suggest to adjust it before merging, to make it clear what was implemented.

The same is true for the openspec files, which is actually more important (since these might influence future agents).

[JonathanRohland-TNG]

From a UX perspective, I find that this dialog is quite a wall-of-text and contains too much technical details, which makes it hard to parse what it is actually trying to ask me:

My suggestion

The following 2 files matching file-paths that are denied by omac were created during this session. They remain readable by the agent until omac restarts:
<list of file paths>

If you do not want to be notified about this every time, you can suppress this warning for the filenames or paths in the future. Please choose how you want to proceed:

- Keep warning every time (default)
- Suppress warnings for this path permanently: /Users/rohlandj/repos/tng-agent-tooling/pr440-dialog-test/yarp3/ worktrees/feat-a/.env
- Suppress warnings for this path permanently: /Users/rohlandj/repos/tng-agent-tooling/pr440-dialog-test/yarp3/.worktrees/feat-a/.env.local
- Suppress warnings for all 2 files permanently
- Suppress warnings for every file .env under /Users/rohlandj/repos/tng-agent-tooling/pr440-dialog-test/yarp3
- Suppress warnings for every file .env.local under /Users/rohlandj/repos/tng-agent-tooling/pr440-dialog-test/yarp3

I also removed the option to put the ignorance-root from the options-list (love this word ;)) higher than the workspace-folder, because I don't see the use case for this and I found the number of options overwhelming. If you have a need for this, I don't mind adding it back.

It's also quite unfortunate that the dialog doesn't allow the user to select multiple options, so they can only choose to handle one file or all if them, but nothing in-between.

EDIT: Changed "Ignore for..." to "Suppress warnings for..." to make it clear what ignoring means.