feat(mcp): elicitation-gate forced worktree remove of a dirty or locked tree #178

Merged

hexajon merged 1 commit from refs/pull/178/head into main

2026-07-17 02:18:28 +00:00

hexajon commented

2026-07-17 02:18:13 +00:00

(Migrated from codeberg.org)

Summary

madt_worktrees action=remove force=true on a dirty or locked worktree now asks the client's human for explicit accept/decline before anything is deleted - the same consent seam the destructive issue delete uses. This makes the README's "Force exists, but you type it" claim true on the MCP surface, not just the CLI.

Decline is a plain abort: nothing removed, tree intact
A client without elicitation support gets a refusal naming the CLI command to run by hand (madtea worktree remove --force) - never a silent discard; this deliberately diverges from the issue-delete gate's silent-proceed because force has no other guard here
A clean, unlocked force remove stays dialog-free, and the CLI --force stays ungated (human-typed) - the gate lives only in the MCP registration closure
Detection via new service read WorktreeForceWouldDiscard (dirty via status --porcelain, locked via worktree-list porcelain); detection errors fail toward refusal, never a blind discard
Gate ordered after the foreign-worktree ownership guard, so the sanctioned foreign-abandon flow keeps working and just gains the consent step
Tool description, madt_help worktrees topic, reference docs, and the README clobber section state the gate; accept/decline/refusal/clean-path tests pin it

Closes #168.

Closes #168

## Summary `madt_worktrees action=remove force=true` on a dirty or locked worktree now asks the client's human for explicit accept/decline before anything is deleted - the same consent seam the destructive issue delete uses. This makes the README's "Force exists, but you type it" claim true on the MCP surface, not just the CLI. - Decline is a plain abort: nothing removed, tree intact - A client without elicitation support gets a refusal naming the CLI command to run by hand (`madtea worktree remove --force`) - never a silent discard; this deliberately diverges from the issue-delete gate's silent-proceed because force has no other guard here - A clean, unlocked force remove stays dialog-free, and the CLI `--force` stays ungated (human-typed) - the gate lives only in the MCP registration closure - Detection via new service read WorktreeForceWouldDiscard (dirty via status --porcelain, locked via worktree-list porcelain); detection errors fail toward refusal, never a blind discard - Gate ordered after the foreign-worktree ownership guard, so the sanctioned foreign-abandon flow keeps working and just gains the consent step - Tool description, madt_help worktrees topic, reference docs, and the README clobber section state the gate; accept/decline/refusal/clean-path tests pin it Closes #168. Closes #168

No reviewers

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

sixfold-space/madtea!178

No description provided.

Rows
Columns