v0.21.15.0 fix(workspace): sanitize default branch name so spaces don't break worktree create

[avinashjoshi]

Summary

Performance / correctness fix. Typing a workspace name with a space in the TUI new-workspace box (e.g. testing codex) fataled creation:

git: git.Add(testing codex -> .../testing-codex): exit status 255
  fatal: 'testing codex' is not a valid branch name

canopy sanitized the name correctly for the on-disk path (testing codex → testing-codex) but passed the raw, space-bearing name straight to git worktree add -b as the branch. Git accepts slashes in refs (feature/oauth) but rejects spaces, colons, .., ~ — so any git-invalid name broke creation.

The fix sanitizes the branch on the fallback path only (internal/workspace/lifecycle.go Create): branch := git.Sanitize(name) when no explicit --branch was supplied. An explicit canopy new x --branch feature/y is still passed to git verbatim — the caller knows what they want, and feature/y is a valid ref Sanitize would have mangled to feature-y. This also realigns a latent inconsistency: the on-disk path basename was already git.Sanitize(name), so for any space-bearing name the branch and path had silently diverged. Now branch == path basename == tmux session holds for every input (the v0 "four names match" invariant).

internal/git/worktree.go's Sanitize doc comment was rewritten to drop the now-false "the git branch keeps its original name" claim.

Test Coverage

All new code paths covered (effectively 100%):

• TestCreate_SanitizesBranchNameWhenNoExplicitBranch — testing codex → branch testing-codex, creates cleanly, verifies the real git branch via rev-parse.
• TestCreate_PreservesExplicitBranchName — --branch feature/y survives intact (not sanitized).
• TestCreate_AlreadyValidNameUnchanged — guards against over-sanitizing valid names.
• TestSanitize — +6 table cases (interior space, collapsing spaces, padded interior, multiple spaces, tilde, idempotent).

Both branches of the if opts.Branch != "" conditional are exercised.

Tests: internal/workspace +3 funcs; internal/git TestSanitize 16 → 22 cases.

Pre-Landing Review

No issues. Diff is minimal with no SQL/LLM/security surface. Adversarial note: git.Sanitize could collapse a pathological all-symbol name (e.g. "///") to "", but that's pre-existing (the path basename already used Sanitize), not introduced here, and namegen handles the empty-name case. The dot-sequence gap (.., trailing ., .lock survive Sanitize) is a rarer instance of the same class — captured as a P3 follow-up in TODOS.md rather than expanded here.

Verification

• go build ./... — OK
• go vet ./... — clean
• go test ./... — all packages pass
• go test -tags=e2e ./internal/git/ ./internal/workspace/ — pass (real git + tmux)

Test plan

• Full unit suite passes (go test ./...)
• e2e-tagged worktree + workspace tests pass
• Build and vet clean

🤖 Generated with Claude Code