fix(workflow): detect changes inside untracked directories

[ydflow]

Summary

A read-only prompt step can edit, add, or remove files inside an already untracked directory and still finish successfully. git status --porcelain collapses the directory to ?? notes/, so both snapshots hash a directory as missing even when its contents changed.

Request --untracked-files=all so the existing snapshot comparison hashes individual files. Add regression cases for edits, additions, removals with another file remaining, and an unchanged directory. Clarify the existing read-only behavior in both workflow guides.

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature causing existing behavior to change)
• Documentation only
• Refactor / internal cleanup

Test Plan

• npm run build
• npx tsc --noEmit
• npm run lint
• npx vitest run (full suite not run locally)
• Added/updated tests for the change

On Windows with Node 24.19.0:

• npx vitest run workflow-local-driver: 16 passed. The three mutation cases fail against the unchanged upstream runtime at 27a026fc3073543c77a41a2bf6c0feb4c7b235d0, reporting succeeded instead of failed.
• npx vitest run workflow --exclude src/__tests__/workflow-cache.test.ts: 188 passed across 8 files.
• Including workflow-cache.test.ts: 282 passed, 24 failed. The same 24 failures reproduce in a separate baseline worktree at 27a026f: Windows EPERM when its fixtures create file symlinks. No failures were suppressed or changed by this PR.

Real CLI verification after build

Used a fresh Git repository, isolated HOME/USERPROFILE, teamai init --self --agent claude --force, and teamai pull. A fake claude executable on PATH runs as a real child process, writes a valid result to TEAMAI_WORKFLOW_RESULT, and edits/adds/removes a file in the pre-existing untracked notes/ directory. notes/keep.txt stays present for every case.

Ran the built CLI four times:

node dist/index.js workflow start review --driver local --tools default=claude

edit notes/draft.txt: CLI exit 1, run failed, read_only_dirty names notes/draft.txt
add notes/new.txt: CLI exit 1, run failed, read_only_dirty names notes/new.txt
remove notes/draft.txt: CLI exit 1, run failed, read_only_dirty names notes/draft.txt
leave notes/ unchanged: CLI exit 0, run succeeded

Checked each persisted run JSON and confirmed mutations remain in place for inspection. This exercises CLI routing, the local driver, executable resolution/spawn, and run persistence. It uses a fake tool, not a live model; other agent backends are left to CI.

Related Issues

Found through source inspection of the read-only prompt behavior introduced by #1120. No existing issue or open PR addressing this directory snapshot defect was found at submission time. #1126 and #1148 change other workflow runtime paths, not this snapshot function.

Notes for Reviewers

The runtime change is one Git option. gitStatus feeds the two snapshotWorktree calls around the prompt adapter; the existing changedPaths result already reports read_only_dirty through reportAttempt. No run-state format or lease/report semantics change.

Prepared with assistance from an AI coding agent.

[github-actions]

No findings in the specified diff.

The Git option addresses the directory-collapsing issue, and the regression tests cover edits, additions, removals, and an unchanged directory. Both workflow guides are updated consistently.

The PR description documents sufficient testing, including four representative built-CLI runs and persisted-result checks. A fake tool is adequate for this verification; no full provider × agent matrix is required.

Review was read-only; I did not run, build, or install PR code.