Update module go:github.com/d-kuro/gwq/cmd/gwq to v0.1.1

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
go:github.com/d-kuro/gwq/cmd/gwq	0.0.13 → 0.1.1

---

Release Notes

d-kuro/gwq (go:github.com/d-kuro/gwq/cmd/gwq)

v0.1.1

Compare Source

Release v0.1.1

🎉 New Features

Template variables in setup_commands (#​110)

Each string in [[repository_settings]].setup_commands is now rendered with Go text/template before being executed via POSIX sh -c. Available variables:

Variable	Example
{{.Host}}	github.com (empty if no remote)
{{.Owner}}	d-kuro (empty if no remote)
{{.Repository}}	gwq (empty if no remote)
{{.Branch}}	feature/new-ui (raw, not filesystem-sanitized)
{{.Hash}}	a1b2c3d4 (empty if no remote)
{{.Path}}	absolute worktree path

{{.Path}} is new; the others are the same set that naming.template already recognized.

Because each entry is shelled out through sh -c, familiar shell features (~ expansion, &&, pipes, command substitution, quoting) now work without a wrapper:

[[repository_settings]]
repository = "~/src/myproject"
setup_commands = [
    # Write metadata about the worktree to a local file
    'printf "branch=%s\npath=%s\n" "{{.Branch}}" "{{.Path}}" > .worktree-info',
    # Create a per-worktree build directory (quote {{.Path}} in case it has spaces)
    'mkdir -p "{{.Path}}/build"',
    # Append a line to a history file so you can audit created worktrees
    'echo "{{.Branch}} -> {{.Path}}" >> ~/.gwq-history',
]

Commands that reference an unknown key (e.g. {{.Typo}}) are skipped with a [gwq] setup command template error: ... warning on stderr — they are never passed to the shell with a literal {{ ... }} in them. When the repository has no resolvable origin, {{.Branch}} and {{.Path}} still render and the remote-derived fields remain empty so commands depending only on those two variables keep working.

Closes #​106.

⚠️ Breaking Changes

1. setup_commands entries are no longer tokenized with strings.Fields and passed to exec.Command; each entry is now executed with sh -c. Configs that relied on whitespace-split argv semantics, unescaped shell metacharacters, or literal * (which would have been passed verbatim before) may behave differently and should be quoted as regular shell commands.
2. setup_commands strings pass through text/template. Commands that contain literal {{ or }} must escape them using Go template syntax ({{"{{"}}), otherwise the template will fail to parse and the command will be skipped.

📦 Upgrade Instructions

Homebrew:

brew upgrade d-kuro/tap/gwq

Go:

go install github.com/d-kuro/gwq/cmd/gwq@v0.1.1

Full Changelog: d-kuro/gwq@v0.1.0...v0.1.1

v0.1.0

Compare Source

Release v0.1.0

🔒 Security Fixes

Gate local .gwq.toml behind a trust prompt (#​108)

Fixes a privilege escalation vector where any .gwq.toml in the current working directory was merged into global configuration on every subcommand. A hostile repository could ship a .gwq.toml with repository_settings.setup_commands and silently run arbitrary code on the next gwq add.

New behavior:

• Local .gwq.toml is untrusted until you explicitly accept it. The prompt appears the first time gwq sees a given (absolute path, SHA-256) pair and is persisted to ~/.config/gwq/trusted_configs.json (mode 0600, atomic rename, symlink-guarded), direnv-style.
• A content change to a previously-trusted .gwq.toml invalidates the decision and re-prompts.
• Control bytes (C0/C1, CR, DEL) in the displayed file contents are escaped to \xHH so a hostile config cannot forge the [y/N] prompt via ANSI sequences. Large files are truncated to 4 KiB.
• Prompt and warning output go to stderr so shell integration that uses stdout as a protocol (gwq cd, completion) is not corrupted.
• Non-regular files (directory, FIFO) and non-TTY sessions are skipped with a stderr warning instead of prompting — existing CI and scripted usage with no .gwq.toml is unaffected.

Behavior matrix:

situation	outcome
no .gwq.toml	no disk read, no prompt (lazy load)
.gwq.toml already trusted (same hash)	silent merge
new .gwq.toml in TTY	prompt with sanitized contents; y / yes merges and persists
file content changed since last accept	re-prompt
deny (n, Enter, EOF)	stderr warning, file skipped, command continues
non-TTY / CI	stderr warning, file skipped, no prompt
non-regular file	stderr warning, file skipped
trust store path is a symlink	gwq refuses to write; symlink target untouched

To revoke trust for a previously-accepted config, delete or edit ~/.config/gwq/trusted_configs.json. A dedicated gwq config trust/untrust subcommand is not included in this release.

⚠️ Breaking Changes

• A .gwq.toml in the current directory is no longer merged automatically. The first time gwq sees one in an interactive shell, you must confirm at a [y/N] prompt. Users who relied on implicit merge (including repository_settings.setup_commands) will need to accept the prompt once per file-content version.
• In non-TTY environments (CI, scripts, pipes), .gwq.toml is never merged and is skipped with a stderr warning. If you depended on local config in CI, move those settings to the global ~/.config/gwq/config.toml or wire up trust explicitly by editing ~/.config/gwq/trusted_configs.json.

📦 Upgrade Instructions

Homebrew:

brew upgrade d-kuro/tap/gwq

Go:

go install github.com/d-kuro/gwq/cmd/gwq@v0.1.0

Full Changelog: d-kuro/gwq@v0.0.20...v0.1.0

v0.0.20

Compare Source

Release v0.0.20

🎉 New Features

Auto-cd on gwq add under shell integration (#​103)

When shell integration is enabled with cd.launch_shell = false, gwq add can now change the current shell's directory to the newly created worktree instead of spawning a nested sub-shell.

Two mechanisms:

1. --stay (-s) now does a true cd under shell integration. Previously it always spawned a nested shell, even when cd.launch_shell = false. Now it reuses the same __GWQ_CD_SHIM pipeline as gwq cd and cds the parent shell.
2. New cd.auto_cd_on_add config (default false) — when true under shell integration, any successful gwq add auto-cds into the new worktree without needing -s.

Configuration:

[cd]
launch_shell = false
auto_cd_on_add = true  # optional

Setup (same as gwq cd):

# bash (~/.bashrc)
source <(gwq completion bash)

# zsh (~/.zshrc)
source <(gwq completion zsh)

# fish (~/.config/fish/config.fish)
gwq completion fish | source

After reloading your shell, gwq add -s feature/x (or plain gwq add feature/x with auto_cd_on_add = true) lands you inside the new worktree with no nested shell.

Behavior details

• Outside shell integration (cd.launch_shell = true or wrapper not sourced), --stay still spawns a sub-shell as before.
• Under shell integration, gwq add routes success messages to stderr so stdout can carry the worktree path for the wrapper to consume. Non-shim stdout behavior is unchanged, so gwq add >log.txt still captures the success lines.
• PowerShell is completion-only (no shell integration).

🐛 Bug Fixes

• gwq add --expires <invalid> no longer creates a stray worktree. The duration is now parsed before the worktree is created, so invalid values fail fast.

📦 Upgrade Instructions

Homebrew:

brew upgrade d-kuro/tap/gwq

Go:

go install github.com/d-kuro/gwq/cmd/gwq@v0.0.20

Full Changelog: d-kuro/gwq@v0.0.19...v0.0.20

v0.0.19

Compare Source

Release v0.0.19

🎉 New Features

Per-Repository Basedir Override (#​100)

Added a basedir field to repository_settings so individual repositories can override the global worktree.basedir. This is useful when a specific project follows a different convention (e.g., ./worktrees/ alongside the repository root) while keeping the global default for other repositories.

Configuration example:

[[repository_settings]]
repository = "~/src/myproject"
copy_files = ["templates/.env.example"]
setup_commands = ["npm install"]
basedir = "./worktrees"

When no repository_settings are configured, the extra git call to resolve the main repository path is skipped entirely.

🐛 Bug Fixes

• Use absolute URL for release notes link in release PR body (#​99)
• Remove 404-prone release notes link from release PR body (#​101)

👥 Contributors

• @​ssshhhooota (#​100)

📦 Upgrade Instructions

Homebrew:

brew upgrade d-kuro/tap/gwq

Go:

go install github.com/d-kuro/gwq/cmd/gwq@v0.0.19

Full Changelog: d-kuro/gwq@v0.0.18...v0.0.19

v0.0.18

Compare Source

Release v0.0.18

🐛 Bug Fixes

Include main worktrees, exclude submodules, preserve glob patterns (#​96)

Fixed several issues with global worktree discovery and config path handling:

• Include main worktrees in global discovery: gwq list -g now detects repos where .git is a directory (main worktree), not just linked worktrees where .git is a file
• Exclude submodules: Submodule .git files are now detected and skipped, preventing submodule entries from appearing in gwq list -g
• Preserve glob patterns in config: repository_settings entries containing glob characters (*?[) are no longer broken by filepath.Abs() prepending the CWD

👥 Contributors

• @​chris-monardo (#​96)

📦 Upgrade Instructions

Homebrew:

brew upgrade d-kuro/tap/gwq

Go:

go install github.com/d-kuro/gwq/cmd/gwq@v0.0.18

Full Changelog: d-kuro/gwq@v0.0.17...v0.0.18

v0.0.17

Compare Source

Release v0.0.17

🐛 Bug Fixes

Support git URLs using SSH config aliases (#​93)

Fixed gwq add failing when the git remote uses an SSH config alias without git@ prefix (e.g., workgit:myorg/myrepo.git).

• Added isSCPLikeURL() helper to detect SCP-like syntax and convert host:path to https://host/path for URL parsing
• Distinguishes SCP-like aliases from host:port URLs by checking if the segment after : is numeric

📦 Upgrade Instructions

Homebrew:

brew upgrade d-kuro/tap/gwq

Go:

go install github.com/d-kuro/gwq/cmd/gwq@v0.0.17

Full Changelog: d-kuro/gwq@v0.0.16...v0.0.17

v0.0.16

Compare Source

Release v0.0.16

🐛 Bug Fixes

Fix repository_settings resolution from inside a worktree (#​91)

Fixed an issue where repository_settings could not be resolved when running gwq from inside a worktree directory.

🧹 Code Improvements

• Update github.com/charmbracelet/lipgloss to v2 (#​83)

📦 Upgrade Instructions

Homebrew:

brew upgrade d-kuro/tap/gwq

Go:

go install github.com/d-kuro/gwq/cmd/gwq@v0.0.16

Full Changelog: d-kuro/gwq@v0.0.15...v0.0.16

v0.0.15

Compare Source

Release v0.0.15

🐛 Bug Fixes

Fix nested group URL parsing for GitLab (#​87)

For GitLab repositories with nested groups (e.g. gitlab.com/org/team/suborg/repo), the Repository field was incorrectly set to the second path component instead of the actual repository name. Now uses the last path component instead.

Fixes #​85

📚 Documentation

• Add CLAUDE.md and release skill, remove RELEASING.md (#​89)

👥 Contributors

• @​sushi30 (#​87)

📦 Upgrade Instructions

Homebrew:

brew upgrade d-kuro/tap/gwq

Go:

go install github.com/d-kuro/gwq/cmd/gwq@v0.0.15

Full Changelog: d-kuro/gwq@v0.0.14...v0.0.15

v0.0.14

Compare Source

Release v0.0.14

🎉 New Features

cd.launch_shell Option (#​80)

Added a cd.launch_shell config option (default: true) that allows gwq cd to change directory in the current shell without spawning a nested shell.

Configuration:

[cd]
launch_shell = false  # default: true

Setup:

# bash (~/.bashrc)
source <(gwq completion bash)

# zsh (~/.zshrc)
source <(gwq completion zsh)

# fish (~/.config/fish/config.fish)
gwq completion fish | source

When launch_shell = false, the shell wrapper function intercepts gwq cd and runs cd in the current shell instead of spawning a nested shell. Supports bash, zsh, and fish. PowerShell is completion only.

🧹 Code Improvements

• Modernize codebase for Go 1.26 (#​78)

📚 Documentation

• Add contributors guidelines to RELEASING.md (#​77)
• Add missing contributors to release notes (#​76)

👥 Contributors

• @​Tiryoh (#​80)

📦 Upgrade Instructions

Homebrew:

brew upgrade d-kuro/tap/gwq

Go:

go install github.com/d-kuro/gwq/cmd/gwq@v0.0.14

Full Changelog: d-kuro/gwq@v0.0.13...v0.0.14

---

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

• Branch creation
  • "before 8am on Saturday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.