fix: stop session done from deleting untracked work, plus a test audit

[d6veteran]

Robin audited the suite. The most important thing they found is not a test gap.

205 tests (was 175). shellcheck clean.

1. session done destroyed untracked work

cmd_session_done guarded with git diff --quiet and git diff --cached --quiet. Neither sees an untracked file. Two lines later, worktree removal retried with --force on any failure, overriding git's own refusal to remove a worktree holding untracked files.

Isolated three ways — same commands, only the file state differs:

Worktree state	Before
Modified tracked file	Refused, exit 1, preserved
Staged new file	Refused, exit 1, preserved
Untracked new file	✓ Session closed, exit 0, worktree deleted, file gone

It then wrote merged into the branch index. Nothing was merged.

Writing a file and not staging it yet is the most ordinary state in a working session, so the destructive path was the common one.

The guard is now one git status --porcelain call, which sees staged, unstaged, and untracked together, and it lists the offending paths — a refusal you can't act on is only half a fix. The --force fallback is gone: git blocks exactly the states the guard should have caught, so a block now surfaces with the manual command rather than being forced through.

The exact sequence that destroyed the file now prints:

⚠ Worktree still has uncommitted work:
    ?? notes.txt
  Commit it, stash it, or delete the files, then close the session.
  Untracked files count: they are not in any commit and would be lost.

No --force flag added. The stated problem is data loss, and the refusal names the files and the remedy, so there's no dead end. Deliberate discard is a different, unreported need — a small addition later if it turns out to be annoying.

2. The suite rewrote its own tracked files

Found while verifying Robin's drift work. The install.sh end-to-end test ran the real installer from $REPO_DIR. install.sh delegates to claude-team sync, which resolves its repo directory from the CLI's own path — the real clone — and regenerates agents/ and commands/ there.

The consequence is worse than untidiness: the drift check runs before the install test, so a genuine drift failed the first run and was silently repaired later in the same run. Run it again, green, nothing fixed. That's precisely how a real failure gets written off as flaky.

Installer now runs from a throwaway copy. Verified by appending a marker to a committed agent and confirming it survives a full run.

3. The drift check was one-directional

The old check asked whether each profile line appeared in the generated file — a subset test, blind to extra or wrong content. It also predicted expected output by re-implementing the generator's stripping logic by hand in the test file. That second implementation is exactly what let the same check assert the missing Handoff Brief as correct: the hand-written awk mirrored the generator's bug instead of the requirement.

It now regenerates from the committed profiles with the real generator into a scratch tree and diffs. Catches both directions, and can't mirror a bug the generator doesn't have, because it is the generator. Deleted ~26 lines of mirror logic.

Robin flagged the limit honestly: regenerate-and-diff structurally cannot catch a generator whose transform is wrong but self-consistent. That needs content assertions, which is what the Handoff Brief presence checks are. Both kinds are needed.

4. Other coverage added

cmd_launch had no assertion on which profile it attaches — patching it to resolve sasha for every persona left the suite green. launch --worktree had zero coverage despite combining git side effects with process exec. Also: branch guard refusing to clobber a foreign hook, session start reusing a divergent local branch, and every command failing safely when the profiles directory is missing entirely.

Reported, not fixed

• stderr leak under lock contention. bin/claude-team:95 — a trailing 2>/dev/null never applies, because bash sets up redirections left-to-right and the < fails first. 8 of 15 concurrent calls leak a raw bash error. Functionally harmless, exit code and data correct.
• Hardcoded persona rosters drifted in 4 places. claude-team help and the installer Quick Start are missing 4 to 9 of the 17. Same hardcoded-list bug class as the persona copies and the handoff brief.

Robin's risk assessment names that list-vs-derived pattern as the project's recurring weak spot, which matches what three of today's six PRs fixed.

Verification

Every finding reproduced independently before acting: the data-loss bug three ways, the repo mutation with a marker file, the drift blindness by injecting content no profile contains. Runtime 7.8s → 9.0s locally.

---

Generated by Claude Code