@agentmeshhq/agent 0.2.0 → 0.3.0

package/dist/core/daemon.js

@@ -2,22 +2,29 @@ import { execSync, spawn } from "node:child_process";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import { addAgentToState, getAgentState, loadConfig, resetAgentRestartCount, updateAgentInState, } from "../config/loader.js";
+import { getAgentState, loadState, updateAgentInState } from "../config/loader.js";
 import { loadContext, loadOrCreateContext, saveContext } from "../context/index.js";
+import { renderMissingWorkdirMessage } from "./daemon/assignment-message.js";
+import { bootstrapDaemon } from "./daemon/bootstrap.js";
+import { removeClaudeMd, writeClaudeMd } from "./daemon/context-template.js";
+import { formatCrashLog } from "./daemon/crash-log.js";
+import { cleanupGitAuth, setupGitAuth } from "./daemon/git-auth.js";
+import { getNudgeMessage, getStuckDetail, isWithinNudgeWaitWindow, } from "./daemon/health-policy.js";
+import { writeSandboxOpencodeConfig } from "./daemon/sandbox-config.js";
+import { captureAgentChildPids, persistRunningState } from "./daemon/state.js";
+import { startTmuxRuntimeSession } from "./daemon/tmux-session.js";
+import { configureGitIdentity, setupWorkspace, validatePushAccess } from "./daemon/workspace.js";
 import { Heartbeat } from "./heartbeat.js";
-import { handleWebSocketEvent, injectRestoredContext, injectStartupMessage } from "./injector.js";
-import { checkInbox, fetchAssignments, registerAgent } from "./registry.js";
-import { buildRunnerConfig, getRunnerDisplayName } from "./runner.js";
+import { handleWebSocketEvent, injectOnboardMessage, injectRestoredContext, injectStartupMessage, } from "./injector.js";
+import { checkInbox, fetchAssignments, fetchOnboard, registerAgent, } from "./registry.js";
+import { getRunnerDisplayName } from "./runner.js";
 import { DockerSandbox } from "./sandbox.js";
-import { getLatestSessionId, snapshotSessionId, waitForNewSessionId } from "./session-id.js";
-import { captureSessionContext, captureSessionOutput, createSession, destroySession, getSessionName, isSessionHealthy, sessionExists, updateSessionEnvironment, } from "./tmux.js";
+import { getLatestSessionId, waitForNewSessionId } from "./session-id.js";
+import { captureSessionContext, captureSessionOutput, destroySession, isSessionHealthy, killProcessTree, updateSessionEnvironment, } from "./tmux.js";
+import { prepareOpenCodeRuntime } from "./tmux-runtime.js";
 import { checkAgentProgress, cleanupOrphanContainers, isProcessRunning, sendNudge, } from "./watchdog.js";
 import { AgentWebSocket } from "./websocket.js";
-// Maximum number of auto-restart attempts
-const MAX_RESTART_ATTEMPTS = 3;
-// Time after which restart count resets (30 minutes of stable operation)
-const RESTART_COUNT_RESET_MS = 30 * 60 * 1000;
-// Time to wait after nudging before restarting (2 minutes)
+// Time to wait after nudging before marking as stuck (2 minutes)
 const NUDGE_WAIT_MS = 2 * 60 * 1000;
 // Path to the sandbox OpenCode config (permissive permissions)
 const SANDBOX_OPENCODE_CONFIG_PATH = path.join(os.homedir(), ".agentmesh", "opencode-sandbox.json");
@@ -47,63 +54,30 @@ export class AgentDaemon {
     sandboxImage;
     sandboxCpu;
     sandboxMemory;
+    onboardData = null;
     sandbox = null;
     healthCheckInterval = null;
-    serverContext;
     // Session resume tracking
     _preStartSessionId;
     _attemptedResumeSessionId;
-    // Auto-restart tracking
-    restartCount = 0;
-    lastStableTime = null;
+    // Stuck detection tracking
     stuckSince = null;
     nudgeSentAt = null;
     constructor(options) {
-        const config = loadConfig();
-        if (!config) {
-            throw new Error("No config found. Run 'agentmesh init' first.");
-        }
-        // Ensure config has required fields with defaults
-        if (!config.agents)
-            config.agents = [];
-        if (!config.defaults)
-            config.defaults = { command: "opencode", model: "claude-sonnet-4-5-20250929" };
-        this.config = config;
+        const boot = bootstrapDaemon(options);
+        this.config = boot.config;
         this.agentName = options.name;
-        this.shouldRestoreContext = options.restoreContext === true;
-        this.isWorkerAgent = options.worker === true;
-        this.autoSetup = options.autoSetup === true;
-        // Find or create agent config
-        let agentConfig = config.agents.find((a) => a.name === options.name);
-        if (!agentConfig) {
-            agentConfig = {
-                name: options.name,
-                command: options.command || config.defaults.command,
-                workdir: options.workdir,
-                model: options.model || config.defaults.model,
-            };
-        }
-        // Override with provided options
-        if (options.command)
-            agentConfig.command = options.command;
-        if (options.workdir)
-            agentConfig.workdir = options.workdir;
-        if (options.model)
-            agentConfig.model = options.model;
-        this.agentConfig = agentConfig;
-        this.serveMode = options.serve === true;
-        this.servePort = options.servePort || 3001;
-        this.sandboxMode = options.sandbox === true;
-        this.sandboxImage = options.sandboxImage || "agentmesh/agent-sandbox:latest";
-        this.sandboxCpu = options.sandboxCpu || "1";
-        this.sandboxMemory = options.sandboxMemory || "2g";
-        // Build runner configuration with model resolution
-        this.runnerConfig = buildRunnerConfig({
-            cliModel: options.model,
-            agentModel: agentConfig.model,
-            defaultModel: config.defaults.model,
-            command: agentConfig.command,
-        });
+        this.shouldRestoreContext = boot.shouldRestoreContext;
+        this.isWorkerAgent = boot.isWorkerAgent;
+        this.autoSetup = boot.autoSetup;
+        this.agentConfig = boot.agentConfig;
+        this.serveMode = boot.serveMode;
+        this.servePort = boot.servePort;
+        this.sandboxMode = boot.sandboxMode;
+        this.sandboxImage = boot.sandboxImage;
+        this.sandboxCpu = boot.sandboxCpu;
+        this.sandboxMemory = boot.sandboxMemory;
+        this.runnerConfig = boot.runnerConfig;
         const runnerName = getRunnerDisplayName(this.runnerConfig.type);
         console.log(`Runner: ${runnerName}`);
         console.log(`Effective model: ${this.runnerConfig.model}`);
@@ -121,8 +95,13 @@ export class AgentDaemon {
                 throw new Error(`Agent "${this.agentName}" is already running (PID: ${existingState.pid}). ` +
                     `Use 'agentmesh stop ${this.agentName}' first.`);
             }
-            // Process not running, clean up stale state
+            // Process not running — clean up stale state and any orphaned child processes
             console.log(`Cleaning up stale state for PID ${existingState.pid}`);
+            const orphanPids = existingState.childPids ?? [];
+            if (orphanPids.length > 0) {
+                console.log(`[STARTUP] Found ${orphanPids.length} orphaned child PIDs from previous run — killing...`);
+                killProcessTree(orphanPids);
+            }
         }
         // Clean up orphan containers in sandbox mode
         if (this.sandboxMode) {
@@ -131,9 +110,6 @@ export class AgentDaemon {
                 console.log(`Cleaned up ${cleaned} orphan container(s)`);
             }
         }
-        // Reset restart count on manual start
-        this.restartCount = 0;
-        this.lastStableTime = new Date();
         // Register with hub first (needed for assignment check)
         console.log("Registering with AgentMesh hub...");
         console.log(`Existing state: ${existingState ? `agentId=${existingState.agentId}` : "none"}`);
@@ -151,15 +127,71 @@ export class AgentDaemon {
         if (registration.status === "re-registered") {
             console.log(`Re-registered as: ${this.agentId}`);
             if (registration.context && Object.keys(registration.context).length > 0) {
-                this.serverContext = registration.context;
                 console.log(`Server context restored: ${Object.keys(registration.context).join(", ")}`);
             }
         }
         else {
             console.log(`Registered as: ${this.agentId}`);
         }
+        // Fetch onboard payload (project context, credentials, team)
+        try {
+            this.onboardData = await fetchOnboard(this.config.hubUrl, this.token);
+            if (this.onboardData) {
+                console.log(`Onboard data received${this.onboardData.project ? `: project=${this.onboardData.project.name}` : ""}`);
+                // Set up git credentials before workspace setup
+                for (const repo of this.onboardData.repos) {
+                    if (repo.credential) {
+                        const extraEnv = setupGitAuth({
+                            type: repo.credential.type,
+                            value: repo.credential.value,
+                            repoUrl: repo.url,
+                            agentName: this.agentName,
+                        });
+                        Object.assign(this.runnerConfig.env, extraEnv);
+                    }
+                }
+                // Cache onboard data locally for offline fallback
+                this.cacheOnboardData();
+            }
+        }
+        catch (error) {
+            console.log("Onboard fetch failed (non-fatal):", error.message);
+            // Try loading cached onboard data
+            this.onboardData = this.loadCachedOnboardData();
+            if (this.onboardData) {
+                console.log("Loaded cached onboard data");
+            }
+        }
         // Check assignments and auto-setup workdir if needed (before creating tmux session)
         await this.checkAssignments();
+        // Enforce unique working directories — no two running agents may share the same workdir
+        if (this.agentConfig.workdir) {
+            const resolvedWorkdir = path.resolve(this.agentConfig.workdir);
+            const state = loadState();
+            const conflict = state.agents.find((a) => a.name !== this.agentName &&
+                a.workdir &&
+                path.resolve(a.workdir) === resolvedWorkdir &&
+                a.pid > 0 &&
+                isProcessRunning(a.pid));
+            if (conflict) {
+                throw new Error(`Workdir conflict: "${resolvedWorkdir}" is already in use by agent "${conflict.name}" (PID: ${conflict.pid}).\n` +
+                    `Each agent must have its own working directory to avoid git conflicts.\n` +
+                    `Use --workdir to specify a unique path, e.g.:\n` +
+                    `  agentmesh start --name ${this.agentName} --workdir ~/Dev/${this.assignedProject || "project"}-${this.agentName}`);
+            }
+        }
+        // Check for serve port collision
+        if (this.serveMode) {
+            const state = loadState();
+            const portConflict = state.agents.find((a) => a.name !== this.agentName &&
+                a.servePort === this.servePort &&
+                a.pid > 0 &&
+                isProcessRunning(a.pid));
+            if (portConflict) {
+                throw new Error(`Port ${this.servePort} already in use by agent "${portConflict.name}" (PID: ${portConflict.pid}).\n` +
+                    `Use --serve-port to specify a different port.`);
+            }
+        }
         // Choose runtime mode: sandbox > serve > tmux
         if (this.sandboxMode) {
             await this.startSandboxMode();
@@ -168,39 +200,16 @@ export class AgentDaemon {
             await this.startServeMode();
         }
         else {
-            // Check if session already exists
-            const sessionName = getSessionName(this.agentName);
-            const sessionAlreadyExists = sessionExists(sessionName);
-            // Create tmux session if it doesn't exist
-            if (!sessionAlreadyExists) {
-                // Load saved context to check for OpenCode session ID (for native resume)
-                let savedSessionId;
-                if (this.shouldRestoreContext && this.agentId) {
-                    const savedContext = loadContext(this.agentId);
-                    savedSessionId = savedContext?.custom?.opencodeSessionId;
-                    if (savedSessionId) {
-                        console.log(`[CONTEXT] Found saved OpenCode session ID: ${savedSessionId}`);
-                    }
-                }
-                // Snapshot the latest session ID in logs BEFORE starting OpenCode.
-                // This lets us detect whether OpenCode actually resumed vs created a new session.
-                const preStartSessionId = snapshotSessionId(this.agentName);
-                console.log(`Creating tmux session: ${sessionName}`);
-                // Include runner env vars (e.g., OPENCODE_MODEL) at session creation
-                const created = createSession(this.agentName, this.agentConfig.command, this.agentConfig.workdir, this.runnerConfig.env, // Apply model env at process start
-                savedSessionId);
-                if (!created) {
-                    throw new Error("Failed to create tmux session");
-                }
-                // Store pre-start snapshot for fallback detection later
-                this._preStartSessionId = preStartSessionId;
-                this._attemptedResumeSessionId = savedSessionId;
-            }
-            else {
-                console.log(`Reconnecting to existing session: ${sessionName}`);
-                // Update environment for existing session
-                updateSessionEnvironment(this.agentName, this.runnerConfig.env);
-            }
+            const sessionStart = startTmuxRuntimeSession({
+                agentName: this.agentName,
+                agentId: this.agentId,
+                command: this.agentConfig.command,
+                workdir: this.agentConfig.workdir,
+                runnerEnv: this.runnerConfig.env,
+                shouldRestoreContext: this.shouldRestoreContext,
+            });
+            this._preStartSessionId = sessionStart.preStartSessionId;
+            this._attemptedResumeSessionId = sessionStart.attemptedResumeSessionId;
             // Inject environment variables into tmux session
             console.log("Injecting environment variables...");
             updateSessionEnvironment(this.agentName, {
@@ -209,20 +218,27 @@ export class AgentDaemon {
             });
         }
         // Save state including runtime model info
-        const sessionName = this.serveMode ? `serve:${this.servePort}` : getSessionName(this.agentName);
-        addAgentToState({
-            name: this.agentName,
+        persistRunningState({
+            agentName: this.agentName,
             agentId: this.agentId,
             pid: process.pid,
-            tmuxSession: sessionName,
-            startedAt: new Date().toISOString(),
             token: this.token,
             workdir: this.agentConfig.workdir,
             assignedProject: this.assignedProject,
             runtimeModel: this.runnerConfig.model,
             runnerType: this.runnerConfig.type,
             sandboxContainer: this.sandbox?.getContainerName(),
+            serveMode: this.serveMode,
+            servePort: this.servePort,
         });
+        // Track child PIDs for cleanup on restart/stop (tmux mode only — sandbox/serve manage their own)
+        if (!this.sandboxMode && !this.serveMode) {
+            const childPids = captureAgentChildPids(this.agentName);
+            if (childPids.length > 0) {
+                updateAgentInState(this.agentName, { childPids });
+                console.log(`[STARTUP] Tracking ${childPids.length} child PIDs: ${childPids.join(", ")}`);
+            }
+        }
         // Start heartbeat with auto-refresh
         console.log("Starting heartbeat...");
         this.heartbeat = new Heartbeat({
@@ -312,6 +328,20 @@ export class AgentDaemon {
             console.error("Failed to check inbox:", error);
             injectStartupMessage(this.agentName, 0);
         }
+        // Inject onboard project context
+        if (this.onboardData?.project) {
+            injectOnboardMessage(this.agentName, this.onboardData);
+        }
+        // Write persistent CLAUDE.md context file
+        if (this.onboardData && this.agentConfig.workdir) {
+            const mdPath = writeClaudeMd({
+                workdir: this.agentConfig.workdir,
+                onboard: this.onboardData,
+            });
+            if (mdPath) {
+                console.log(`✓ CLAUDE.md written: ${mdPath}`);
+            }
+        }
         // Restore context from previous session
         if (this.shouldRestoreContext && this.agentId) {
             console.log("Checking for previous context...");
@@ -403,27 +433,28 @@ Nudge agent:
         this.healthCheckInterval = setInterval(async () => {
             if (!this.isRunning)
                 return;
-            // Reset restart count after stable operation
-            if (this.lastStableTime && this.restartCount > 0) {
-                const stableTime = Date.now() - this.lastStableTime.getTime();
-                if (stableTime > RESTART_COUNT_RESET_MS) {
-                    console.log(`[HEALTH] Agent stable for 30+ minutes, resetting restart count`);
-                    this.restartCount = 0;
-                    resetAgentRestartCount(this.agentName);
-                }
-            }
             // For sandbox mode, pass container name so health check looks inside container
             const containerName = this.sandboxMode ? this.sandbox?.getContainerName() : undefined;
             const health = isSessionHealthy(this.agentName, containerName);
             if (!health.healthy) {
-                // Session died - attempt restart
+                // Session died - log and mark as failed (no auto-restart)
                 await this.handleSessionDeath(health.reason || "unknown", logDir);
                 return;
             }
             // Session is alive - check progress watchdog
             const progress = checkAgentProgress(this.agentName, containerName);
-            if (progress.status === "permission_blocked" || progress.status === "stuck") {
-                await this.handleStuckAgent(progress);
+            if (progress.status === "waiting_for_human") {
+                // Agent is intentionally waiting for human input - do not classify as stuck
+                if (this.stuckSince) {
+                    // Clear any prior stuck tracking since the agent signalled a legitimate wait
+                    this.stuckSince = null;
+                    this.nudgeSentAt = null;
+                    updateAgentInState(this.agentName, { stuckSince: undefined, status: "waiting" });
+                }
+                console.log(`[HEALTH] Agent is waiting for human input: ${progress.details}`);
+            }
+            else if (progress.status === "permission_blocked" || progress.status === "stuck") {
+                this.handleStuckAgent(progress);
             }
             else if (progress.status === "active") {
                 // Agent is working - reset stuck tracking
@@ -433,7 +464,6 @@ Nudge agent:
                     this.nudgeSentAt = null;
                     updateAgentInState(this.agentName, { stuckSince: undefined, status: "running" });
                 }
-                this.lastStableTime = new Date();
             }
         }, 60000); // Check every 60 seconds
     }
@@ -451,86 +481,55 @@ Nudge agent:
         catch {
             lastOutput = "Failed to capture session output";
         }
-        const crashLog = `
-================================================================================
-AGENT CRASH DETECTED
-================================================================================
-Timestamp: ${timestamp}
-Agent: ${this.agentName}
-Agent ID: ${this.agentId}
-Reason: ${reason}
-Restart Count: ${this.restartCount}/${MAX_RESTART_ATTEMPTS}
-Sandbox: ${this.sandboxMode ? this.sandbox?.getContainerName() : "none"}
-Workdir: ${this.agentConfig.workdir}
-Model: ${this.runnerConfig.model}
-
---- Last Session Output ---
-${lastOutput}
-================================================================================
-
-`;
+        const crashLog = formatCrashLog({
+            timestamp,
+            agentName: this.agentName,
+            agentId: this.agentId,
+            reason,
+            sandboxLabel: this.sandboxMode ? this.sandbox?.getContainerName() || "sandbox" : "none",
+            workdir: this.agentConfig.workdir,
+            model: this.runnerConfig.model,
+            lastOutput,
+        });
         fs.appendFileSync(logFile, crashLog);
-        // Save context (including session ID) before restart attempt
+        // Save context before marking as failed
         if (this.agentId) {
             this.saveAgentContext();
         }
-        // Check if we can restart
-        if (this.restartCount < MAX_RESTART_ATTEMPTS) {
-            this.restartCount++;
-            console.error(`[CRASH] Session died: ${reason}. Attempting restart (${this.restartCount}/${MAX_RESTART_ATTEMPTS})...`);
-            updateAgentInState(this.agentName, {
-                restartCount: this.restartCount,
-                lastRestartAt: timestamp,
-                status: "running",
-            });
-            try {
-                await this.restartSession();
-                console.log(`[RESTART] Agent restarted successfully`);
-                this.lastStableTime = new Date();
-            }
-            catch (error) {
-                console.error(`[RESTART] Failed to restart: ${error.message}`);
-            }
-        }
-        else {
-            // Exceeded restart limit - mark as failed
-            console.error(`[FAILED] Agent exceeded restart limit (${MAX_RESTART_ATTEMPTS}). Manual intervention required.`);
-            // Terminal bell to alert user
-            process.stdout.write("\x07");
-            updateAgentInState(this.agentName, {
-                status: "failed",
-                restartCount: this.restartCount,
-            });
-            // Stop monitoring
-            this.isRunning = false;
-            if (this.healthCheckInterval) {
-                clearInterval(this.healthCheckInterval);
-                this.healthCheckInterval = null;
-            }
+        // Mark as failed — no auto-restart, user must intervene
+        console.error(`[FAILED] Session died: ${reason}. Manual intervention required (use 'agentmesh restart ${this.agentName}').`);
+        // Terminal bell to alert user
+        process.stdout.write("\x07");
+        updateAgentInState(this.agentName, {
+            status: "failed",
+        });
+        // Stop monitoring
+        this.isRunning = false;
+        if (this.healthCheckInterval) {
+            clearInterval(this.healthCheckInterval);
+            this.healthCheckInterval = null;
         }
     }
     /**
      * Handles stuck agent - sends nudge first, then restarts if still stuck
      */
-    async handleStuckAgent(progress) {
+    handleStuckAgent(progress) {
         const now = new Date();
         if (!this.stuckSince) {
             // First detection of stuck state
             this.stuckSince = now;
-            console.log(`[HEALTH] Agent appears stuck: ${progress.details || progress.blockedOn || "no activity"}`);
+            console.log(`[HEALTH] Agent appears stuck: ${getStuckDetail(progress)}`);
             updateAgentInState(this.agentName, {
                 stuckSince: now.toISOString(),
                 status: "stuck",
             });
         }
-        // Only nudge worker agents - others restart immediately
+        // Nudge worker agents — don't escalate to restart
         if (this.isWorkerAgent) {
             // If we haven't sent a nudge yet, send one
             if (!this.nudgeSentAt) {
                 console.log(`[HEALTH] Sending nudge to worker agent...`);
-                const nudgeMessage = progress.status === "permission_blocked"
-                    ? "Please continue with your task. If you see a permission prompt, try an alternative approach that doesn't require that permission."
-                    : "Please continue with your current task.";
+                const nudgeMessage = getNudgeMessage(progress);
                 const sent = sendNudge(this.agentName, nudgeMessage);
                 if (sent) {
                     this.nudgeSentAt = now;
@@ -542,114 +541,13 @@ ${lastOutput}
                 return;
             }
             // Check if enough time has passed since nudge
-            const timeSinceNudge = now.getTime() - this.nudgeSentAt.getTime();
-            if (timeSinceNudge < NUDGE_WAIT_MS) {
+            if (isWithinNudgeWaitWindow(this.nudgeSentAt, NUDGE_WAIT_MS, now)) {
                 // Still waiting for agent to respond to nudge
                 return;
             }
+            // Nudge grace period expired — log warning but do NOT restart
+            console.log(`[HEALTH] Agent still stuck after nudge. Manual intervention required.`);
         }
-        // Agent still stuck - trigger restart (or restart immediately if not a worker)
-        console.log(`[HEALTH] Agent still stuck${this.isWorkerAgent ? " after nudge" : ""}, triggering restart...`);
-        this.stuckSince = null;
-        this.nudgeSentAt = null;
-        await this.handleSessionDeath("stuck_after_nudge", path.join(os.homedir(), ".agentmesh", "logs"));
-    }
-    /**
-     * Restarts the agent session (sandbox or non-sandbox)
-     */
-    async restartSession() {
-        // Destroy existing session
-        destroySession(this.agentName);
-        if (this.sandboxMode && this.sandbox) {
-            // Restart sandbox container
-            const newContainerId = await this.sandbox.restart();
-            console.log(`[RESTART] New container: ${newContainerId.substring(0, 12)}`);
-            // Recreate tmux session for sandbox
-            const containerName = this.sandbox.getContainerName();
-            const sessionName = getSessionName(this.agentName);
-            // Build environment args for docker exec
-            const envArgs = [];
-            const allEnv = {
-                ...this.runnerConfig.env,
-                AGENT_TOKEN: this.token,
-                AGENTMESH_AGENT_ID: this.agentId,
-            };
-            for (const [key, value] of Object.entries(allEnv)) {
-                if (value !== undefined && value !== "") {
-                    envArgs.push(`-e "${key}=${value}"`);
-                }
-            }
-            const envString = envArgs.join(" ");
-            const modelArg = this.runnerConfig.env?.OPENCODE_MODEL
-                ? ` --model ${this.runnerConfig.env.OPENCODE_MODEL}`
-                : "";
-            const dockerExecCommand = `docker exec -it ${envString} ${containerName} opencode${modelArg}`;
-            const created = createSession(this.agentName, dockerExecCommand, undefined, undefined);
-            if (!created) {
-                throw new Error("Failed to create tmux session for restarted sandbox");
-            }
-            // Update state with new container name
-            updateAgentInState(this.agentName, {
-                sandboxContainer: containerName,
-            });
-        }
-        else {
-            // Non-sandbox restart — load saved session ID for native resume
-            let savedSessionId;
-            let savedContext = null;
-            if (this.agentId) {
-                savedContext = loadContext(this.agentId);
-                savedSessionId = savedContext?.custom?.opencodeSessionId;
-                if (savedSessionId) {
-                    console.log(`[RESTART] Attempting to resume OpenCode session: ${savedSessionId}`);
-                }
-            }
-            const preRestartSessionId = snapshotSessionId(this.agentName);
-            const created = createSession(this.agentName, this.agentConfig.command, this.agentConfig.workdir, this.runnerConfig.env, savedSessionId);
-            if (!created) {
-                throw new Error("Failed to create tmux session");
-            }
-            // Re-inject environment
-            updateSessionEnvironment(this.agentName, {
-                AGENT_TOKEN: this.token,
-                AGENTMESH_AGENT_ID: this.agentId,
-                ...this.runnerConfig.env,
-            });
-            // Verify native resume and fallback if needed
-            if (savedSessionId && savedContext) {
-                const newSessionId = await waitForNewSessionId(this.agentName, preRestartSessionId, 15000);
-                if (!newSessionId) {
-                    const health = isSessionHealthy(this.agentName);
-                    const currentSessionId = getLatestSessionId(this.agentName);
-                    if (!health.healthy) {
-                        console.log(`[RESTART] Fallback: OpenCode not healthy, injecting text summary.`);
-                        savedContext.custom = { ...savedContext.custom, opencodeSessionId: undefined };
-                        saveContext(savedContext);
-                        injectRestoredContext(this.agentName, savedContext);
-                    }
-                    else if (currentSessionId === savedSessionId) {
-                        console.log(`[RESTART] Resumed OpenCode session ${savedSessionId}`);
-                    }
-                    else {
-                        console.log(`[RESTART] Fallback: session not found. Injecting text summary.`);
-                        savedContext.custom = { ...savedContext.custom, opencodeSessionId: undefined };
-                        saveContext(savedContext);
-                        injectRestoredContext(this.agentName, savedContext);
-                    }
-                }
-                else if (newSessionId === savedSessionId) {
-                    console.log(`[RESTART] Resumed OpenCode session ${savedSessionId}`);
-                }
-                else {
-                    console.log(`[RESTART] Fallback: resume failed (got ${newSessionId}). Injecting text summary.`);
-                    savedContext.custom = { ...savedContext.custom, opencodeSessionId: newSessionId };
-                    saveContext(savedContext);
-                    injectRestoredContext(this.agentName, savedContext);
-                }
-            }
-        }
-        // Wait for session to be ready
-        await new Promise((resolve) => setTimeout(resolve, 2000));
     }
     async stop() {
         console.log(`\nStopping agent: ${this.agentName}`);
@@ -664,6 +562,12 @@ ${lastOutput}
             console.log("Saving agent context...");
             this.saveAgentContext();
         }
+        // Clean up git credential files
+        cleanupGitAuth(this.agentName);
+        // Remove CLAUDE.md context file
+        if (this.agentConfig.workdir) {
+            removeClaudeMd(this.agentConfig.workdir);
+        }
         // Stop heartbeat
         if (this.heartbeat) {
             this.heartbeat.stop();
@@ -709,27 +613,7 @@ ${lastOutput}
     async startServeMode() {
         console.log(`Starting opencode serve mode on port ${this.servePort}...`);
         const workdir = this.agentConfig.workdir || process.cwd();
-        // Isolate OpenCode's SQLite database per agent to prevent WAL corruption.
-        // See docs/RCA-OPENCODE-SQLITE-CORRUPTION.md for details.
-        const agentDataDir = path.join(os.homedir(), ".agentmesh", "opencode-data", this.agentName);
-        const agentOpencodeDir = path.join(agentDataDir, "opencode");
-        if (!fs.existsSync(agentOpencodeDir)) {
-            fs.mkdirSync(agentOpencodeDir, { recursive: true });
-        }
-        // Copy auth.json from default OpenCode data dir so agents inherit API keys.
-        // Strips xAI provider to prevent OpenCode from defaulting to non-Anthropic models.
-        const agentAuthPath = path.join(agentOpencodeDir, "auth.json");
-        const sourceAuthPath = path.join(os.homedir(), ".local", "share", "opencode", "auth.json");
-        if (!fs.existsSync(agentAuthPath) && fs.existsSync(sourceAuthPath)) {
-            try {
-                const auth = JSON.parse(fs.readFileSync(sourceAuthPath, "utf-8"));
-                delete auth.xai;
-                fs.writeFileSync(agentAuthPath, JSON.stringify(auth, null, 2));
-            }
-            catch {
-                // Non-fatal — agent will just need manual auth
-            }
-        }
+        const agentDataDir = prepareOpenCodeRuntime(this.agentName);
         // Build environment for opencode serve
         const env = {
             ...process.env,
@@ -954,8 +838,51 @@ Logs:    docker logs ${containerName}
             if (!this.agentConfig.workdir) {
                 const assignmentWithWorkdir = assignments.find((a) => a.project.workdir);
                 if (assignmentWithWorkdir?.project.workdir) {
-                    console.log(`Using workdir from project settings: ${assignmentWithWorkdir.project.workdir}`);
-                    this.agentConfig.workdir = assignmentWithWorkdir.project.workdir;
+                    // Append agent name as sibling directory to avoid shared workdir conflicts
+                    // e.g. /Users/raju/Dev/agentmesh -> /Users/raju/Dev/agentmesh-agent-1
+                    const baseWorkdir = assignmentWithWorkdir.project.workdir;
+                    const uniqueWorkdir = path.join(path.dirname(baseWorkdir), `${path.basename(baseWorkdir)}-${this.agentName}`);
+                    console.log(`Using workdir from project settings (per-agent): ${uniqueWorkdir}`);
+                    // If the unique dir doesn't exist, set up workspace (clone or pull)
+                    const gitDir = path.join(uniqueWorkdir, ".git");
+                    if (!fs.existsSync(gitDir)) {
+                        // Find repo info from assignments or onboard data for cloning
+                        const repoAssignment = assignments.find((a) => a.repo !== null);
+                        if (repoAssignment?.repo) {
+                            this.agentConfig.workdir = setupWorkspace({
+                                workspacePath: uniqueWorkdir,
+                                repoUrl: repoAssignment.repo.url,
+                                defaultBranch: repoAssignment.repo.default_branch,
+                                projectName: repoAssignment.project.name,
+                            });
+                            configureGitIdentity({
+                                workspacePath: uniqueWorkdir,
+                                agentName: this.agentName,
+                                agentDisplayName: this.onboardData?.agent.display_name ?? this.agentName,
+                            });
+                            validatePushAccess(uniqueWorkdir);
+                        }
+                        else {
+                            // No repo info — just create the directory
+                            fs.mkdirSync(uniqueWorkdir, { recursive: true });
+                            this.agentConfig.workdir = uniqueWorkdir;
+                        }
+                    }
+                    else {
+                        // Directory exists with .git — pull latest
+                        console.log(`Workspace exists, pulling latest...`);
+                        try {
+                            execSync("git fetch origin && git pull", {
+                                cwd: uniqueWorkdir,
+                                stdio: "pipe",
+                                timeout: 30_000,
+                            });
+                        }
+                        catch (error) {
+                            console.warn(`Could not pull latest: ${error.message}`);
+                        }
+                        this.agentConfig.workdir = uniqueWorkdir;
+                    }
                     return;
                 }
                 // No project.workdir set, check if we have a repo assignment
@@ -966,39 +893,29 @@ Logs:    docker logs ${containerName}
                     const suggestedPath = `~/.agentmesh/workspaces/${this.config.workspace}/${repoAssignment.project.code.toLowerCase()}/${this.agentName}`;
                     // If --auto-setup is enabled, automatically clone the repo
                     if (this.autoSetup) {
-                        this.agentConfig.workdir = this.setupWorkspace(expandedPath, repo.url, repo.default_branch, repoAssignment.project.name);
+                        this.agentConfig.workdir = setupWorkspace({
+                            workspacePath: expandedPath,
+                            repoUrl: repo.url,
+                            defaultBranch: repo.default_branch,
+                            projectName: repoAssignment.project.name,
+                        });
+                        // Configure git identity and validate push access
+                        configureGitIdentity({
+                            workspacePath: expandedPath,
+                            agentName: this.agentName,
+                            agentDisplayName: this.onboardData?.agent.display_name ?? this.agentName,
+                        });
+                        validatePushAccess(expandedPath);
                         return;
                     }
-                    console.error(`
-━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
-⚠️  WORKDIR REQUIRED
-
-You have a project assignment with a repository, but no workdir is configured.
-
-Project:  ${repoAssignment.project.name}
-Repo:     ${repo.full_name}
-Branch:   ${repo.default_branch}
-
-Option 1: Set workdir in project settings (recommended)
-  - Go to AgentMesh HQ → Projects → ${repoAssignment.project.name} → Settings
-  - Set the workdir field to the local path
-
-Option 2: Set up workspace manually and pass --workdir:
-
-  mkdir -p ${suggestedPath}
-  git clone ${repo.url} ${suggestedPath}
-  cd ${suggestedPath} && git checkout ${repo.default_branch}
-
-Then start the agent with:
-
-  agentmesh start -n ${this.agentName} --workdir ${suggestedPath}
-
-Option 3: Use --auto-setup to automatically clone the repository:
-
-  agentmesh start -n ${this.agentName} --auto-setup
-
-━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
-`);
+                    console.error(renderMissingWorkdirMessage({
+                        projectName: repoAssignment.project.name,
+                        repoFullName: repo.full_name,
+                        repoUrl: repo.url,
+                        defaultBranch: repo.default_branch,
+                        suggestedPath,
+                        agentName: this.agentName,
+                    }));
                     // No session to clean up - we haven't created it yet
                     process.exit(1);
                 }
@@ -1010,78 +927,61 @@ Option 3: Use --auto-setup to automatically clone the repository:
         }
     }
     /**
-     * Sets up workspace by cloning repository or using existing clone
-     * Returns the absolute path to the workspace
+     * Ensures the sandbox OpenCode config exists
+     * Creates ~/.agentmesh/opencode-sandbox.json with permissive permissions and model
      */
-    setupWorkspace(workspacePath, repoUrl, defaultBranch, projectName) {
-        console.log(`\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━`);
-        console.log(`🔧 AUTO-SETUP: Setting up workspace for ${projectName}`);
-        console.log(`━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n`);
-        // Check if directory already exists and is a git repo
-        const gitDir = path.join(workspacePath, ".git");
-        if (fs.existsSync(gitDir)) {
-            console.log(`✓ Workspace already exists: ${workspacePath}`);
-            console.log(`  Updating from remote...`);
-            try {
-                // Fetch and checkout the branch
-                execSync(`git fetch origin`, { cwd: workspacePath, stdio: "inherit" });
-                execSync(`git checkout ${defaultBranch}`, { cwd: workspacePath, stdio: "inherit" });
-                execSync(`git pull origin ${defaultBranch}`, { cwd: workspacePath, stdio: "inherit" });
-                console.log(`✓ Workspace updated successfully\n`);
-            }
-            catch (error) {
-                console.warn(`⚠ Could not update workspace: ${error.message}`);
-                console.log(`  Continuing with existing state...\n`);
-            }
-            return workspacePath;
-        }
-        // Create parent directories
-        const parentDir = path.dirname(workspacePath);
-        if (!fs.existsSync(parentDir)) {
-            console.log(`Creating directory: ${parentDir}`);
-            fs.mkdirSync(parentDir, { recursive: true });
-        }
-        // Clone the repository
-        console.log(`Cloning repository...`);
-        console.log(`  URL: ${repoUrl}`);
-        console.log(`  Path: ${workspacePath}`);
-        console.log(`  Branch: ${defaultBranch}\n`);
+    ensureSandboxOpencodeConfig() {
+        writeSandboxOpencodeConfig({
+            configPath: SANDBOX_OPENCODE_CONFIG_PATH,
+            baseConfig: SANDBOX_OPENCODE_CONFIG,
+            model: this.runnerConfig.env?.OPENCODE_MODEL,
+        });
+        console.log(`Updated sandbox OpenCode config: ${SANDBOX_OPENCODE_CONFIG_PATH}`);
+    }
+    /**
+     * Caches onboard data to disk for offline fallback
+     */
+    cacheOnboardData() {
+        if (!this.onboardData || !this.agentId)
+            return;
         try {
-            execSync(`git clone --branch ${defaultBranch} "${repoUrl}" "${workspacePath}"`, {
-                stdio: "inherit",
-            });
-            console.log(`\n✓ Repository cloned successfully`);
+            const cacheDir = path.join(os.homedir(), ".agentmesh", "context");
+            if (!fs.existsSync(cacheDir)) {
+                fs.mkdirSync(cacheDir, { recursive: true });
+            }
+            // Strip credential values before caching
+            const cacheData = {
+                ...this.onboardData,
+                repos: this.onboardData.repos.map((r) => ({
+                    ...r,
+                    credential: r.credential ? { type: r.credential.type, value: "***" } : null,
+                })),
+                cached_at: new Date().toISOString(),
+            };
+            const cachePath = path.join(cacheDir, `${this.agentId}-onboard.json`);
+            fs.writeFileSync(cachePath, JSON.stringify(cacheData, null, 2));
         }
         catch (error) {
-            console.error(`\n✗ Failed to clone repository: ${error.message}`);
-            console.error(`\nMake sure you have access to the repository and SSH keys are configured.`);
-            // No session to clean up - we haven't created it yet
-            process.exit(1);
+            console.log("Failed to cache onboard data:", error.message);
         }
-        console.log(`✓ Workspace ready: ${workspacePath}\n`);
-        return workspacePath;
     }
     /**
-     * Ensures the sandbox OpenCode config exists
-     * Creates ~/.agentmesh/opencode-sandbox.json with permissive permissions and model
+     * Loads cached onboard data from disk (without credentials)
      */
-    ensureSandboxOpencodeConfig() {
-        const configDir = path.dirname(SANDBOX_OPENCODE_CONFIG_PATH);
-        if (!fs.existsSync(configDir)) {
-            fs.mkdirSync(configDir, { recursive: true });
+    loadCachedOnboardData() {
+        if (!this.agentId)
+            return null;
+        try {
+            const cachePath = path.join(os.homedir(), ".agentmesh", "context", `${this.agentId}-onboard.json`);
+            if (!fs.existsSync(cachePath))
+                return null;
+            const raw = fs.readFileSync(cachePath, "utf-8");
+            const data = JSON.parse(raw);
+            return data;
         }
-        // Build config with model if available
-        const config = {
-            ...SANDBOX_OPENCODE_CONFIG,
-        };
-        // Include model from runner config
-        const model = this.runnerConfig.env?.OPENCODE_MODEL;
-        if (model) {
-            config.model = model;
+        catch {
+            return null;
         }
-        // Always write to ensure model is up to date
-        fs.writeFileSync(SANDBOX_OPENCODE_CONFIG_PATH, JSON.stringify(config, null, 2));
-        console.log(`Updated sandbox OpenCode config: ${SANDBOX_OPENCODE_CONFIG_PATH}`);
     }
 }
 //# sourceMappingURL=daemon.js.map