[Nurozen]

The bug

A shared bare mirror can carry more than one remote — an upstream origin plus a fork. Stave could not be pointed at the second one. Every base and reference ref went through a rule that prepended origin/ to anything not already starting with origin/ or refs/:

$ stave space create --json -k sync -e t3code:fork/main --dry-run x
  "dry-run: add edit worktree stave/x/t3code from origin/fork/main ..."

origin/fork/main does not exist. A real run got as far as git worktree add and failed with a raw git error. The only spelling that worked was -e t3code:refs/remotes/fork/main, which nothing tells you about.

After this change, against the same mirror:

$ stave space create --json -k sync -e t3code:fork/main --dry-run x
  "dry-run: add edit worktree stave/x/t3code from refs/remotes/fork/main ..."

$ stave space create --json -k sync -e t3code:nosuch/main --dry-run x
{"error": {"code": "ref_not_found",
  "message": "repo \"t3code\": ref \"nosuch/main\" does not resolve (looked for refs/remotes/origin/nosuch/main); remotes on the bare repo: fork, origin; run 'stave repos sync t3code' if the branch was pushed after the last fetch",
  "details": {"repo": "t3code", "ref": "nosuch/main", "tried": "refs/remotes/origin/nosuch/main", "remotes": ["fork", "origin"]}}}

What changed

1. Base/ref resolution consults the mirror's actual remotes (resolveRefSpelling, internal/space/service.go). A base whose first path segment names a configured remote resolves against that remote:

Spelling	Resolves to	Recorded as
main	refs/remotes/origin/main	origin/main
origin/main	refs/remotes/origin/main	origin/main
fork/main, mirror has a fork remote	refs/remotes/fork/main	refs/remotes/fork/main
fork/main, mirror does not	refs/remotes/origin/fork/main	origin/fork/main
refs/...	itself	itself

origin/ keeps its short spelling so no existing manifest changes; a non-origin remote is recorded as the full refs/remotes/... because a bare fork/main is ambiguous under git's rev-parse ordering. A first segment that names no remote is still a branch on origin, so feature/login and review's pr/123 are unaffected. A mirror that cannot be interrogated falls back to the old offline rule.

2. The resolved ref is verified before it reaches git (Service.resolveRef + RefNotFoundError/ref_not_found). This replaces the space:<id>-only preflight (whose wording is preserved) and extends the check to reference worktrees, --start-point, and space retarget.

The check only refuses what a fetch could not have supplied, so it never makes a preview stricter than the run it previews. A local ref (refs/heads/..., what space:<id> sugar resolves to) is always conclusive — stave never pushes its own branches. A remote-tracking ref is conclusive only when that command fetched the mirror itself; under --dry-run (which only prints the fetch), --no-fetch, or retarget (which never fetches) a miss is a warning: on stderr and the command proceeds. That keeps stave review working for a PR whose base branch was deleted on merge, and keeps a --dry-run preview from refusing a branch pushed since the last sync. --dry-run still resolves the spelling exactly as the real run does, which is where the bug was visible in the first place.

A mirror whose single remote is not named origin resolves bare branches against the remote it does have; an explicit origin/... is left to fail honestly.

3. --no-fetch on stave space create, matching space add. It threads to every composed AddRepo and suppresses the matching dry-run: fetch lines. Same argument added to the stave_space_create agent tool.

4. Coded errors for the reachable refusals in internal/space. Messages are unchanged; each now carries a code so --json stops answering {"code":"unknown"}. Reused: repo_not_in_space (retarget), saga_space, archive_not_found, invalid_arguments (nine usage refusals). New: not_a_saga, not_a_saga_member, and the memory trio memory_not_found / memory_alias_required / memory_already_attached — the memory verbs were a whole --json surface with no vocabulary at all.

5. An off-TTY stave summon exits 3. It correctly printed the command instead of launching, but returned nil, so a script could not tell "printed a command, launched nothing" from "launched the agent, which exited 0". --print-command asks for the same output deliberately and stays exit 0 — the distinction is intent, not output. Composite verbs (space create --summon, saga create --summon, review --summon) swallow it and keep their own status: their work succeeded.

6. The read-only --json probes now use the error envelope. space status --json, saga status --json and saga list --json wrote their success payload as JSON but returned failures raw, so probing a missing space printed open /.../ghost/.stave.yaml: no such file or directory — prose, from a --json surface. All three go through runJSON now and a missing space is space_not_found. These are the calls a scripted caller makes before deciding whether to create a space, so they are the ones that most needed a code.

Deliberately not done

stave space create is still not idempotent end to end, and I did not add an --if-exists=reuse flag. Making reuse safe would mean deciding what happens when the existing space holds the repo on a different base than the one requested — silently handing back a worktree on origin/main when the caller asked for fork/main is worse than the refusal. Meanwhile the refusals are already coded and detailed (space_exists, repo_already_in_space with {repo, mode}), so a scripted caller can branch on the failure of a single create call without a probe — and item 6 above fixes the probe it would otherwise have used.

Testing

go build ./..., go test ./... (also under -race), gofmt -l . and golangci-lint run ./... are clean. New coverage: a real-git test that builds a two-remote mirror with a diverged fork and asserts the worktree's actual HEAD is fork's commit (internal/space/baseref_test.go), a spelling table including the single-non-origin-remote case, the refuse-vs-warn matrix (--dry-run and --no-fetch must not refuse what a fetching run would build), the RemoteNames git probe, create --no-fetch, the coded refusals, the summon exit code and stream split, and the read-verb envelope.

Manually exercised against a real two-remote mirror: create/add on fork/main (worktree HEAD matches fork's commit), nested fork/feature/login, reference worktrees on a fork ref, space sync, retarget, and an archive/restore round trip — all with a refs/remotes/fork/main base recorded in the manifest.

🤖 Generated with Claude Code