Wt Switch CreateSAFE

Worktrunk is a CLI for Git worktree management, designed for parallel AI agent workflows

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: wt-switch-create
description: Create a new worktrunk worktree (optionally in another repo) and switch this session's working directory into it. Use when launching a session that should work in its own worktree.
argument-hint: "[<branch>] [<repo>] [-- <task>]"
license: MIT OR Apache-2.0
compatibility: Requires the `wt` CLI (https://worktrunk.dev)
---

Arguments: `$ARGUMENTS`. Grammar: `[<branch>] [<repo>] [-- <task>]`.

- **branch** — optional; the branch name for the new worktree. When omitted,
  pick one (step 1 below).
- **repo** — optional path or name; create the worktree in this repo instead
  of the session's current one.
- **task** — optional; what to do inside the new worktree. No task means enter
  the worktree and wait.

Tokens before the `--` are the branch and/or repo. A path-shaped token
(starting with `/`, `~`, `./`, or `../`) is the repo. A bare name can be
either, so make an informed guess. It is the branch when the current repo
already has a branch by that name, as it is for `wt switch` itself. Otherwise
it is the repo when a git repository by that name exists where the user keeps
repos (beside the current repo, or in a workspace directory like
`~/workspace`), and the branch when none does (`docs` is a branch, not the
current repo's `docs/` directory). A name read as the repo carries its absolute
path forward: that path, not the bare token, is the `<repo>` in step 3. Two
tokens that both read as branches don't fit the grammar — ask. Without a `--`,
judge where the task starts: leading tokens that read as a branch name
(`fix-auth`) or a repo are consumed as such, and the rest is the task;
otherwise the whole input is the task (`fix the parser bug` has no
branch-shaped lead — all task).

```
/wt-switch-create my-feature -- fix the parser bug
/wt-switch-create -- fix the parser bug
/wt-switch-create my-feature ~/workspace/other-repo -- fix the parser bug
/wt-switch-create my-feature
```

## What to do

Creating the worktree comes first on every invocation, before any other work.
The invocation is itself the explicit request to create it; a research or
read-only task gets one all the same.

<!-- Maintainers: rationale.md (same directory) covers the harness rules and
design choices behind this — read it before re-adding guards or routes. -->

1. **Pick the branch name** if none was given: short, from the task and
   consistent with existing worktree names, or, mid-session, from the work
   being moved; with nothing to derive from, ask.

2. **With no repo argument, create and enter in one call:**
   `EnterWorktree({name: "<branch>"})`. Worktrunk's `WorktreeCreate` hook runs
   `wt switch --create`, so the result is an ordinary `wt` worktree in the
   default layout, and the user sees no confirmation prompt. On success,
   do the task (or, with no task text, confirm it's ready and wait).

   Mid-session, carry uncommitted work across: `git stash push -u` before the
   `EnterWorktree` call, then `git stash pop` after — the call re-roots the
   session into the new worktree, and the stash is shared across worktrees.

3. **Otherwise create it with `wt` and enter by path.** Two cases reach here: a
   repo argument, which step 2 can't target, and a failed step 2, whose error
   says which — `✗ Branch <branch> already exists`, or `Already in a worktree
   session`. Create with a `Bash` call (omit `-C <repo>` for this repo):

   ```
   wt -C <repo> switch --create <branch> --no-cd --format=json
   ```

   Stdout is JSON whose `path` field is the worktree's absolute path (status
   lines go to stderr). On `Branch <branch> already exists`: if the user named
   the branch, rerun without `--create` (it enters the branch, creating its
   worktree if missing); if step 1 picked the name, pick another and rerun. Any
   other failure (not a git repo, invalid name): report it and stop.

   With a repo argument, `cd <repo>` next, in its own `Bash` call.
   `EnterWorktree` re-roots only within the repository the cwd is in, and
   worktrunk's `PermissionRequest` hook answers the confirmation that call
   asks for only for a `wt` worktree of that same repository. If the `cd`
   reports `Shell cwd was reset`, the repo is unreachable: skip the entry and
   hand back as in **Unreachable** below.

   Then call `EnterWorktree({path: "<path from the JSON>"})`.

   With a repo argument, once the session works in the new worktree (entered,
   or reached by `cd` in the recovery below), read whichever of its root
   `CLAUDE.md` and `AGENTS.md` exist before the task. Claude Code keeps the
   launch repo's root instructions in context and loads only the new repo's
   nested ones, so the new repo's root files supersede the launch repo's for
   the rest of the session.

   - **Accepted** → the session is re-rooted in the worktree. Do the task (or,
     with no task text, confirm it's ready and wait).
   - **Tool error** — the tool ran and returned an error (`Cannot enter
     worktree: ...`) → graceful; nothing moved, and one recovery covers them
     all. The common cause is a session already rooted in a worktree (or a
     pinned agent), which limits entry to the current repo's
     `.claude/worktrees/` and excludes even a same-repo `wt` sibling. The
     recovery test is whether you can `cd` into the worktree, which works
     when it's inside an allowed directory. So `cd <path>` and read the
     result:
     - no `Shell cwd was reset` notice → it stuck; the worktree is reachable.
       Work there, but a bare `cd` is not a tracked re-root, so the cwd can
       revert to the session's launch worktree across turns (and in spawned
       subagents); pin commands with `git -C <path>` / `wt -C <path>` rather
       than trusting the `cd` to persist.
     - `Shell cwd was reset` → **Unreachable.** Stop and ask the user to make
       the directory whose `cd` reset reachable: add a parent that holds both
       the repo and its worktrees, like `~/workspace`, to
       `permissions.additionalDirectories`

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

What the source does

Filesystem

none-observed

Network

none-observed

Shell

none-observed

Dependencies

pinned

Secrets in source

none-found

Findings (5)

.agents/skills

docs/public/.well-known/agent-skills/worktrunk

docs/public/claude-code.md

docs/public/code-signing.md

docs/public/config.md

Gates applied: no_behavioural_pass.

[![ModelsAtlas audit: Wt Switch Create](https://modelsatlas.com/skills/max-sixty/wt-switch-create/badge.svg)](https://modelsatlas.com/skills/max-sixty/wt-switch-create/)

Not your listing, or something out of date? Claim or update your listing.