fix(#260): enforce worktree absolute-path safety via PreToolUse hook

Closes #260 Moves the step-0b absolute-path guard from prose instructions to a harness-enforced PreToolUse hook (gsd-worktree-path-guard.js). Hard-blocks Edit/Write/MultiEdit calls whose absolute path resolves outside the active worktree root.
2026-06-01 10:56:06 -04:00
parent 4332e1a5dd
commit faf329ecb9
10 changed files with 632 additions and 2 deletions
--- a/docs/INVENTORY-MANIFEST.json
+++ b/docs/INVENTORY-MANIFEST.json
@@ -355,7 +355,8 @@
      "gsd-statusline.js",
      "gsd-update-banner.js",
      "gsd-validate-commit.sh",
-      "gsd-workflow-guard.js"
+      "gsd-workflow-guard.js",
+      "gsd-worktree-path-guard.js"
    ]
  }
 }