fix: clean reviewer snapshots and scope git guard

src/paired-workspace-manager.test.ts

@@ -319,4 +319,76 @@ describe('paired workspace manager', () => {
       ),
     ).toBe(false);
   });
+
+  it('keeps reviewer git status clean while hiding denied tracked files', async () => {
+    const { db, manager } = await loadModules();
+    db._initTestDatabase();
+
+    const canonicalDir = path.join(tempRoot, 'canonical');
+    fs.mkdirSync(path.join(canonicalDir, '.claude'), { recursive: true });
+    runGit(['init'], canonicalDir);
+    runGit(['config', 'user.email', 'test@example.com'], canonicalDir);
+    runGit(['config', 'user.name', 'EJClaw Test'], canonicalDir);
+    fs.writeFileSync(path.join(canonicalDir, 'tracked.ts'), 'export const ok = 1;\n');
+    fs.writeFileSync(
+      path.join(canonicalDir, '.claude', 'settings.json'),
+      '{"secret":true}\n',
+    );
+    fs.writeFileSync(
+      path.join(canonicalDir, '.env.production'),
+      'TRACKED_SECRET=1\n',
+    );
+    fs.writeFileSync(path.join(canonicalDir, '.env.example'), 'EXAMPLE=1\n');
+    runGit(
+      ['add', 'tracked.ts', '.claude/settings.json', '.env.production', '.env.example'],
+      canonicalDir,
+    );
+    runGit(['commit', '-m', 'initial'], canonicalDir);
+
+    const now = '2026-03-28T00:00:00.000Z';
+    db.upsertPairedProject({
+      chat_jid: 'dc:test',
+      group_folder: 'paired-room',
+      canonical_work_dir: canonicalDir,
+      workspace_topology: 'shadow-snapshot',
+      created_at: now,
+      updated_at: now,
+    });
+    db.createPairedTask({
+      id: 'paired-task-4',
+      chat_jid: 'dc:test',
+      group_folder: 'paired-room',
+      owner_service_id: 'codex-main',
+      reviewer_service_id: 'codex-review',
+      title: null,
+      source_ref: 'HEAD',
+      review_requested_at: null,
+      status: 'draft',
+      created_at: now,
+      updated_at: now,
+    });
+
+    const reviewerWorkspace =
+      manager.refreshReviewerSnapshotForPairedTask('paired-task-4');
+
+    expect(
+      runGit(['status', '--short'], reviewerWorkspace.workspace_dir),
+    ).toBe('');
+    expect(
+      fs.existsSync(
+        path.join(reviewerWorkspace.workspace_dir, '.claude', 'settings.json'),
+      ),
+    ).toBe(false);
+    expect(
+      fs.existsSync(
+        path.join(reviewerWorkspace.workspace_dir, '.env.production'),
+      ),
+    ).toBe(false);
+    expect(
+      fs.readFileSync(
+        path.join(reviewerWorkspace.workspace_dir, '.env.example'),
+        'utf-8',
+      ),
+    ).toBe('EXAMPLE=1\n');
+  });
 });

src/paired-workspace-manager.ts

@@ -92,6 +92,19 @@ function runGit(args: string[], cwd?: string): string {
   }).trim();
 }
 
+function runGitWithInput(
+  args: string[],
+  cwd: string,
+  input: string,
+): string {
+  return execFileSync('git', args, {
+    cwd,
+    input,
+    encoding: 'utf-8',
+    stdio: ['pipe', 'pipe', 'pipe'],
+  }).trim();
+}
+
 function ensureGitRepository(repoDir: string): void {
   const insideWorkTree = runGit(
     ['rev-parse', '--is-inside-work-tree'],
@@ -167,24 +180,35 @@ function shouldIncludeUntrackedReviewerPath(relativePath: string): boolean {
   );
 }
 
-function copySelectedSnapshotTree(sourceDir: string, targetDir: string): void {
-  resetDirectoryExceptGit(targetDir);
-
-  const trackedFiles = listGitPaths(sourceDir, [
+function listAllowedTrackedFiles(sourceDir: string): string[] {
+  return listGitPaths(sourceDir, [
     'ls-files',
     '--cached',
     '-z',
   ]).filter((relativePath) => !isReviewerSnapshotDeniedPath(relativePath));
-  const untrackedFiles = listGitPaths(sourceDir, [
+}
+
+function listDeletedTrackedFiles(sourceDir: string): string[] {
+  return listGitPaths(sourceDir, ['ls-files', '--deleted', '-z']).filter(
+    (relativePath) => !isReviewerSnapshotDeniedPath(relativePath),
+  );
+}
+
+function listAllowedUntrackedFiles(sourceDir: string): string[] {
+  return listGitPaths(sourceDir, [
     'ls-files',
     '--others',
     '--exclude-standard',
     '-z',
   ]).filter(shouldIncludeUntrackedReviewerPath);
+}
 
-  const filesToCopy = [...new Set([...trackedFiles, ...untrackedFiles])].sort();
-
-  for (const relativePath of filesToCopy) {
+function copySnapshotPaths(
+  sourceDir: string,
+  targetDir: string,
+  relativePaths: string[],
+): void {
+  for (const relativePath of [...new Set(relativePaths)].sort()) {
     const sourcePath = path.join(sourceDir, relativePath);
     if (!fs.existsSync(sourcePath)) continue;
 
@@ -194,6 +218,31 @@ function copySelectedSnapshotTree(sourceDir: string, targetDir: string): void {
   }
 }
 
+function removeSnapshotPaths(targetDir: string, relativePaths: string[]): void {
+  for (const relativePath of [...new Set(relativePaths)].sort()) {
+    fs.rmSync(path.join(targetDir, relativePath), {
+      recursive: true,
+      force: true,
+    });
+  }
+}
+
+function applyReviewerSparseCheckout(
+  reviewerDir: string,
+  allowedTrackedFiles: string[],
+): void {
+  runGit(['sparse-checkout', 'init', '--no-cone'], reviewerDir);
+  const patterns =
+    allowedTrackedFiles.length > 0
+      ? `${allowedTrackedFiles.join('\n')}\n`
+      : '/*\n!/*\n';
+  runGitWithInput(
+    ['sparse-checkout', 'set', '--no-cone', '--stdin'],
+    reviewerDir,
+    patterns,
+  );
+}
+
 function configureReviewerGitIsolation(workspaceDir: string): void {
   try {
     runGit(['config', '--local', 'push.default', 'nothing'], workspaceDir);
@@ -307,9 +356,26 @@ export function refreshReviewerSnapshotForPairedTask(
     runGit(['clone', '--shared', ownerWorkspace.workspace_dir, reviewerDir]);
   }
 
+  const allowedTrackedFiles = listAllowedTrackedFiles(ownerWorkspace.workspace_dir);
+  const deletedTrackedFiles = listDeletedTrackedFiles(ownerWorkspace.workspace_dir);
+  const allowedUntrackedFiles = listAllowedUntrackedFiles(
+    ownerWorkspace.workspace_dir,
+  );
+
   runGit(['reset', '--hard', 'HEAD'], reviewerDir);
   runGit(['clean', '-fdx'], reviewerDir);
-  copySelectedSnapshotTree(ownerWorkspace.workspace_dir, reviewerDir);
+  applyReviewerSparseCheckout(reviewerDir, allowedTrackedFiles);
+  copySnapshotPaths(
+    ownerWorkspace.workspace_dir,
+    reviewerDir,
+    allowedTrackedFiles,
+  );
+  removeSnapshotPaths(reviewerDir, deletedTrackedFiles);
+  copySnapshotPaths(
+    ownerWorkspace.workspace_dir,
+    reviewerDir,
+    allowedUntrackedFiles,
+  );
   configureReviewerGitIsolation(reviewerDir);
 
   const refreshedAt = new Date().toISOString();