Feature: Git worktree TOCTOU race condition fix
  As a security-conscious developer
  I want the git worktree sandbox to avoid TOCTOU race conditions
  So that another process cannot claim the worktree path between deletion and git creation

  Background:
    Given a gwt test git repository is initialised

  # --- TOCTOU Race Condition Tests ---

  Scenario: Worktree path is created atomically without race window
    When a gwt sandbox is created for plan "plan-toctou-001"
    Then the gwt sandbox worktree path should exist
    And the gwt sandbox should be in the "created" state
    And the gwt sandbox context should reference plan "plan-toctou-001"

  Scenario: Worktree path uses parent directory approach
    When a gwt sandbox is created for plan "plan-toctou-002"
    Then the gwt sandbox worktree path should exist
    And the gwt toctou sandbox should have a parent temp directory
    And the gwt toctou worktree should be a subdirectory of its parent

  Scenario: Multiple concurrent sandboxes do not collide
    When a gwt sandbox is created for plan "plan-toctou-concurrent-1"
    And the gwt toctou sandbox is saved as "first"
    And a gwt sandbox is created for plan "plan-toctou-concurrent-2"
    And the gwt toctou sandbox is saved as "second"
    Then the gwt toctou saved sandbox "first" worktree path should exist
    And the gwt toctou saved sandbox "second" worktree path should exist
    And the gwt toctou saved sandbox paths "first" and "second" should differ

  Scenario: Rapid successive worktree creations all succeed
    When a gwt sandbox is created for plan "plan-toctou-rapid-1"
    And the gwt toctou sandbox is saved as "r1"
    And a gwt sandbox is created for plan "plan-toctou-rapid-2"
    And the gwt toctou sandbox is saved as "r2"
    And a gwt sandbox is created for plan "plan-toctou-rapid-3"
    And the gwt toctou sandbox is saved as "r3"
    Then the gwt toctou saved sandbox "r1" worktree path should exist
    And the gwt toctou saved sandbox "r2" worktree path should exist
    And the gwt toctou saved sandbox "r3" worktree path should exist

  Scenario: Worktree path isolation is maintained across operations
    When a gwt sandbox is created for plan "plan-toctou-isolation"
    And a gwt file "test.txt" is created in the worktree with content "isolation test"
    And the gwt path "test.txt" is resolved
    And the gwt sandbox is committed with message "isolation test commit"
    Then the gwt commit result should indicate success
    And the gwt file "test.txt" should exist in the original repo

  Scenario: Cleanup properly removes parent directory structure
    When a gwt sandbox is created for plan "plan-toctou-cleanup"
    And the gwt toctou parent directory path is recorded
    And the gwt sandbox is cleaned up
    Then the gwt sandbox worktree path should not exist
    And the gwt toctou recorded parent directory should not exist

  Scenario: Branch sanitisation works with parent directory approach
    When a gwt sandbox is created for plan "plan with spaces!@#$%^&*()"
    Then the gwt sandbox worktree path should exist
    And the gwt sandbox branch name should be safe for git
    And the gwt sandbox should be in the "created" state

  Scenario: Worktree paths are unique across sandboxes
    When a gwt sandbox is created for plan "plan-toctou-unique-1"
    And the gwt toctou sandbox is saved as "u1"
    And a gwt sandbox is created for plan "plan-toctou-unique-2"
    And the gwt toctou sandbox is saved as "u2"
    Then the gwt toctou saved sandbox "u1" worktree path should exist
    And the gwt toctou saved sandbox "u2" worktree path should exist
    And the gwt toctou saved sandbox paths "u1" and "u2" should differ

  Scenario: Rollback works correctly with parent directory approach
    When a gwt sandbox is created for plan "plan-toctou-rollback"
    And a gwt file "rollback_test.txt" is created in the worktree with content "rollback data"
    And the gwt path "rollback_test.txt" is resolved
    And the gwt sandbox is rolled back
    Then the gwt sandbox should be in the "rolled_back" state
    And the gwt file "rollback_test.txt" should not exist in the worktree

  Scenario: Commit and rollback sequence works with parent directory approach
    When a gwt sandbox is created for plan "plan-toctou-commit-rollback"
    And a gwt file "commit_rollback.txt" is created in the worktree with content "test data"
    And the gwt sandbox is committed with message "commit rollback test"
    Then the gwt commit result should indicate success
    And the gwt file "commit_rollback.txt" should exist in the original repo
    When the gwt sandbox is rolled back
    Then the gwt sandbox should be in the "rolled_back" state
    And the gwt file "commit_rollback.txt" should not exist in the original repo
