pr-hijack-via-stale-worktree-branch-ref

PR-Hijack via Stale Worktree Branch Ref

Problem

In a long-lived git worktree (especially .claude/worktrees/<name>/ patterns created by a parallel-session harness), a same-named local branch can be created via git checkout -b X origin/main even when branch X already exists upstream with an open PR. Pushing that local branch with git push -u origin X succeeds — git reports * [new branch] — and silently replaces the remote ref. The result:

• The remote branch ref now points at YOUR commit
• The open PR (call it #N) on that branch now lists YOUR commit
• PR #N's title and body still describe the ORIGINAL author's work
• The original author's commit is orphaned on the remote but still reachable in YOUR local reflog (because the worktree's reflog captured it earlier)
• gh pr create fails with a pull request for branch "X" into "main" already exists and surfaces PR #N — which is now an artefact of two unrelated commits

The hijack is silent on both sides: git's push output doesn't warn, gh doesn't either, and the PR's web view shows a perfectly plausible (but wrong) state.

Context / Trigger Conditions

Surfaces when ALL of:

1. You are working in a worktree (typically .claude/worktrees/<name>/) that has been used by a previous session
2. The session-start git status banner shows a branch name that does NOT match git status -sb once you actually run it (stale banner)
3. A prior session in the same worktree opened a PR on a generically-named feature branch (e.g., feat/drivers-headline-and-stripe-removal, feat/refactor-foo, fix/bar-bug)
4. The worktree's local refs were reset between sessions (git reset --hard, branch deletion, or worktree-recreation) WITHOUT a corresponding git push --force to clean up the remote
5. You create a local branch by the same generic name

Exact failure-signature triad:

# Symptom 1 — push reports new-branch despite upstream existing
$ git push -u origin feat/<name>
* [new branch]        feat/<name> -> feat/<name>

# Symptom 2 — gh pr create rejects with already-exists
$ gh pr create ...
a pull request for branch "feat/<name>" into branch "main" already exists:
https://github.com/<org>/<repo>/pull/N

# Symptom 3 — that PR's commits don't match its title/body
$ gh pr view N --json commits
{ "commits": [{ "oid": "<YOUR-SHA>", "messageHeadline": "<YOUR WORK>" }] }