[Feat] Unified worktree protection policy for destructive operations

[samzong]

What's changed?

• Add ProtectionPolicy struct (IsProtected / Reason) as a single predicate for worktree protection
• Wire protection into Remove, Promote, and Prune — replaces scattered inline bare/main checks
• Unify main branch resolution: getDefaultBranch, findMainWorktreePath, and prune all go through resolveBaseBranchWithPolicy
• Add --all / -a flag to gmc wt rm that removes all non-protected worktrees
• Contextual error messages reflect why a worktree is protected (bare repository / main worktree / main branch)
• Bare-layout repos correctly use HEAD fallback for non-main/master default branches

Why

• Protection was inconsistent: Remove only checked bare, Promote had no check at all, Prune had its own inline logic
• Main branch identification was scattered across three different functions with different resolution strategies
• --all is a common workflow need when cleaning up after parallel development sessions

[gemini-code-assist]

Code Review

This pull request introduces a --all flag for the worktree remove command and implements a centralized ProtectionPolicy to prevent the accidental removal or promotion of critical worktrees, such as the main branch or bare repository. The feedback focuses on the safety of the ProtectionPolicy implementation; specifically, the NewProtectionPolicy function and its helpers currently swallow errors when resolving the repository root or main branch. It is recommended to update these methods to return and handle errors to ensure that bulk operations do not proceed with an incomplete or incorrect protection state.

[gemini-code-assist]

The NewProtectionPolicy function can fail if it cannot resolve the repository root or the main branch. This error should be handled to prevent proceeding with an incomplete protection policy, which could lead to accidental removal of protected worktrees.

	pp, err := wtClient.NewProtectionPolicy()
	if err != nil {
		return nil, err
	}

[gemini-code-assist]

Handle the error from NewProtectionPolicy to ensure that pruning candidates are correctly identified and protected worktrees are not accidentally included.

	pp, err := c.NewProtectionPolicy()
	if err != nil {
		return nil, "", err
	}

[gemini-code-assist]

Handle the potential error from resolvedMainBranch to ensure the main worktree path is correctly identified.

	mainBranch, err := c.resolvedMainBranch()
	if err != nil {
		return "", err
	}

[gemini-code-assist]

It is critical to handle errors when initializing the protection policy. If the policy fails to resolve the main branch, it might silently allow the removal of the main worktree.

	pp, err := c.NewProtectionPolicy()
	if err != nil {
		return removeContext{}, err
	}
	if pp.IsProtected(wtInfo) {

[gemini-code-assist]

Ensure the protection policy is correctly initialized before checking if a worktree can be promoted.

	pp, err := c.NewProtectionPolicy()
	if err != nil {
		return report, err
	}

[gemini-code-assist]

The NewProtectionPolicy function currently swallows errors from GetWorktreeRoot and resolveBaseBranchWithPolicy. This is a significant safety risk: if the main branch cannot be resolved (e.g., due to a git error), the policy will have an empty MainBranch, and IsProtected will return false for the main branch worktree. This could lead to accidental deletion of the main branch during bulk operations like rm --all. The function should return an error so callers can abort safely.

Suggested change

	func (c *Client) NewProtectionPolicy() ProtectionPolicy {
	var p ProtectionPolicy
	root, err := c.GetWorktreeRoot()
	if err != nil {
	return p
	}
	p.RootPath = root
	repoDir := repoDirForGit(root)
	isBareLayout := repoDir != root
	branch, err := c.resolveBaseBranchWithPolicy(repoDir, "", isBareLayout)
	if err != nil {
	return p
	}
	p.MainBranch = localBranchName(branch)
	return p
	}
	func (c *Client) NewProtectionPolicy() (ProtectionPolicy, error) {
	var p ProtectionPolicy
	root, err := c.GetWorktreeRoot()
	if err != nil {
	return p, fmt.Errorf("failed to get worktree root: %w", err)
	}
	p.RootPath = root
	repoDir := repoDirForGit(root)
	isBareLayout := repoDir != root
	branch, err := c.resolveBaseBranchWithPolicy(repoDir, "", isBareLayout)
	if err != nil {
	return p, fmt.Errorf("failed to resolve main branch: %w", err)
	}
	p.MainBranch = localBranchName(branch)
	return p, nil
	}

[gemini-code-assist]

Update these helper methods to propagate errors from NewProtectionPolicy.

func (c *Client) IsProtectedWorktree(wt Info) (bool, error) {
	pp, err := c.NewProtectionPolicy()
	if err != nil {
		return false, err
	}
	return pp.IsProtected(wt), nil
}

func (c *Client) resolvedMainBranch() (string, error) {
	pp, err := c.NewProtectionPolicy()
	if err != nil {
		return "", err
	}
	return pp.MainBranch, nil
}

[gemini-code-assist]

Update the test to handle the new error return from IsProtectedWorktree.

		protected, err := client.IsProtectedWorktree(wt)
		if err != nil {
			t.Fatalf("IsProtectedWorktree() error = %v", err)
		}