@cat-factory/executor-harness 1.37.0 → 1.39.0

package/dist/agent.js

@@ -529,14 +529,19 @@ async function runMultiRepoExplore(job, opts) {
         { repo: job.repo, cloneBranch: job.branch, ghToken: job.ghToken },
         ...peers.map((peer) => ({
             repo: peer.repo,
-            cloneBranch: peer.repo.baseBranch,
+            // A read-only peer clones at its default branch (the bug-investigator) unless the job pins
+            // an explicit branch — the merger checks each peer out at its PR branch so the combined diff
+            // sees the PR change (`git diff origin/<base>...HEAD`).
+            cloneBranch: peer.cloneBranch ?? peer.repo.baseBranch,
             ghToken: peer.ghToken ?? job.ghToken,
         })),
     ].map((leg) => ({ ...leg, dirName: claimDir(leg.repo) }));
     return withWorkspace('explore-multi', async (root) => {
         // Clone phase: every repo (read-only) into its sibling dir under the workspace root. No
-        // work branch, no resume — the investigator only reads — so the legs are independent and
-        // clone in parallel (wall-clock is the slowest single clone, not the sum).
+        // work branch, no resume — the agent only reads — so the legs are independent and clone in
+        // parallel (wall-clock is the slowest single clone, not the sum). `full` is honoured per the
+        // job (the merger needs full history so `git diff origin/<base>...HEAD` has the merge base;
+        // the bug-investigator leaves it shallow).
         opts.onPhase?.('clone');
         await Promise.all(legs.map(async (leg) => {
             const dir = join(root, leg.dirName);
@@ -549,6 +554,7 @@ async function runMultiRepoExplore(job, opts) {
                 repo: { ...leg.repo, baseBranch: leg.cloneBranch },
                 ghToken: leg.ghToken,
                 dir,
+                full: job.full,
                 signal: opts.signal,
             });
         }));

package/dist/git.js

@@ -51,14 +51,18 @@ const GIT_TIMEOUT_MS = Math.max(GIT_TIMEOUT_FLOOR_MS, loadRunnerLimits().inactiv
 // Emptying the helper list (`credential.helper=` with no value RESETS the multi-valued config,
 // dropping the system/global/local helpers) removes GCM from the chain, so git falls back to
 // the harness's own askpass helper — which returns the per-job PAT we already hold (see
-// `authEnv`). `credential.interactive=false` is belt-and-suspenders for any backend that still
-// runs. The token is never in argv; only this non-secret config is.
-const NON_INTERACTIVE_CREDENTIAL_ARGS = [
-    '-c',
-    'credential.helper=',
-    '-c',
-    'credential.interactive=false',
-];
+// `authEnv`). The token is never in argv; only this non-secret config is.
+//
+// DO NOT re-add `-c credential.interactive=false` here. It reads like harmless belt-and-braces
+// but modern git (≥ 2.47, incl. the executor image + host git) HONORS `credential.interactive`
+// and treats invoking GIT_ASKPASS as "interactive" — so with it set git SKIPS the askpass
+// entirely and dies with "fatal: unable to get password from user", failing EVERY authenticated
+// clone/push on both the native and container paths (it clones a public base repo fine — that
+// needs no auth — then fails only at push, which is what makes it look intermittent). The GCM
+// popup it was meant to belt-and-braces against is already fully handled by the emptied helper
+// list above plus `GIT_TERMINAL_PROMPT=0` / `GCM_INTERACTIVE=never` in the env (see authEnv /
+// nonInteractiveGitEnv). Exported so a unit test can pin that this arg never creeps back in.
+export const NON_INTERACTIVE_CREDENTIAL_ARGS = ['-c', 'credential.helper='];
 /**
  * Env applied to git commands that DON'T carry {@link authEnv} (local ops like config/checkout/
  * rev-parse). Keeps them from ever going interactive too — `GIT_TERMINAL_PROMPT=0` blocks the

package/dist/job.js

@@ -136,6 +136,10 @@ function parsePeerRepos(value) {
         // read-only explore fan-out (bug-investigator) — validate it only when present.
         if (e.newBranch !== undefined)
             spec.newBranch = str(e.newBranch, `peerRepos[${i}].newBranch`);
+        // Read-only explore fan-out: the branch to check the peer out at (the merger's PR branch).
+        if (e.cloneBranch !== undefined) {
+            spec.cloneBranch = str(e.cloneBranch, `peerRepos[${i}].cloneBranch`);
+        }
         if (typeof e.frameId === 'string' && e.frameId)
             spec.frameId = e.frameId;
         if (typeof e.ghToken === 'string' && e.ghToken)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/executor-harness",
-  "version": "1.37.0",
+  "version": "1.39.0",
   "description": "Container payload: a thin TypeScript wrapper that runs the Pi coding agent against a cloned repo and opens a PR. Runs in the Cloudflare Container (and, in local native mode, as a host process); carries no secrets.",
   "repository": {
     "type": "git",
@@ -26,8 +26,8 @@
     "hono": "^4.12.27",
     "typescript": "^6.0.3",
     "vitest": "^4.1.9",
-    "@cat-factory/server": "0.99.4",
-    "@cat-factory/spend": "0.11.13"
+    "@cat-factory/server": "0.104.0",
+    "@cat-factory/spend": "0.11.21"
   },
   "scripts": {
     "build": "tsc -p tsconfig.json",

package/src/agent.ts

@@ -655,15 +655,20 @@ async function runMultiRepoExplore(job: AgentJob, opts: RunOptions): Promise<Age
     { repo: job.repo, cloneBranch: job.branch, ghToken: job.ghToken },
     ...peers.map((peer) => ({
       repo: peer.repo,
-      cloneBranch: peer.repo.baseBranch,
+      // A read-only peer clones at its default branch (the bug-investigator) unless the job pins
+      // an explicit branch — the merger checks each peer out at its PR branch so the combined diff
+      // sees the PR change (`git diff origin/<base>...HEAD`).
+      cloneBranch: peer.cloneBranch ?? peer.repo.baseBranch,
       ghToken: peer.ghToken ?? job.ghToken,
     })),
   ].map((leg) => ({ ...leg, dirName: claimDir(leg.repo) }))
 
   return withWorkspace('explore-multi', async (root) => {
     // Clone phase: every repo (read-only) into its sibling dir under the workspace root. No
-    // work branch, no resume — the investigator only reads — so the legs are independent and
-    // clone in parallel (wall-clock is the slowest single clone, not the sum).
+    // work branch, no resume — the agent only reads — so the legs are independent and clone in
+    // parallel (wall-clock is the slowest single clone, not the sum). `full` is honoured per the
+    // job (the merger needs full history so `git diff origin/<base>...HEAD` has the merge base;
+    // the bug-investigator leaves it shallow).
     opts.onPhase?.('clone')
     await Promise.all(
       legs.map(async (leg) => {
@@ -677,6 +682,7 @@ async function runMultiRepoExplore(job: AgentJob, opts: RunOptions): Promise<Age
           repo: { ...leg.repo, baseBranch: leg.cloneBranch },
           ghToken: leg.ghToken,
           dir,
+          full: job.full,
           signal: opts.signal,
         })
       }),

package/src/git.ts

@@ -61,14 +61,18 @@ const GIT_TIMEOUT_MS = Math.max(
 // Emptying the helper list (`credential.helper=` with no value RESETS the multi-valued config,
 // dropping the system/global/local helpers) removes GCM from the chain, so git falls back to
 // the harness's own askpass helper — which returns the per-job PAT we already hold (see
-// `authEnv`). `credential.interactive=false` is belt-and-suspenders for any backend that still
-// runs. The token is never in argv; only this non-secret config is.
-const NON_INTERACTIVE_CREDENTIAL_ARGS = [
-  '-c',
-  'credential.helper=',
-  '-c',
-  'credential.interactive=false',
-]
+// `authEnv`). The token is never in argv; only this non-secret config is.
+//
+// DO NOT re-add `-c credential.interactive=false` here. It reads like harmless belt-and-braces
+// but modern git (≥ 2.47, incl. the executor image + host git) HONORS `credential.interactive`
+// and treats invoking GIT_ASKPASS as "interactive" — so with it set git SKIPS the askpass
+// entirely and dies with "fatal: unable to get password from user", failing EVERY authenticated
+// clone/push on both the native and container paths (it clones a public base repo fine — that
+// needs no auth — then fails only at push, which is what makes it look intermittent). The GCM
+// popup it was meant to belt-and-braces against is already fully handled by the emptied helper
+// list above plus `GIT_TERMINAL_PROMPT=0` / `GCM_INTERACTIVE=never` in the env (see authEnv /
+// nonInteractiveGitEnv). Exported so a unit test can pin that this arg never creeps back in.
+export const NON_INTERACTIVE_CREDENTIAL_ARGS = ['-c', 'credential.helper=']
 
 /**
  * Env applied to git commands that DON'T carry {@link authEnv} (local ops like config/checkout/

package/src/job.ts

@@ -78,6 +78,13 @@ export interface PeerRepoSpec {
    * (the bug-investigator), which only clones the peer to read it and never pushes.
    */
   newBranch?: string
+  /**
+   * The EXISTING branch to check the peer out at for a READ-ONLY explore fan-out (the `merger`
+   * scoring the combined diff clones each peer at its PR branch so the diff sees the PR change).
+   * Absent ⇒ the peer is cloned at its repo default branch (the bug-investigator). Ignored on the
+   * coding fan-out, which creates `newBranch` instead.
+   */
+  cloneBranch?: string
   /** Open a PR/MR in this peer when set AND the run changed the peer (skipped for a clean repo). */
   pr?: PrSpec
   /** Per-repo GitHub token; defaults to the job's `ghToken` (one installation per workspace today). */
@@ -236,6 +243,10 @@ function parsePeerRepos(value: unknown): PeerRepoSpec[] {
     // `newBranch` is required for a coding fan-out (it pushes to it) but ABSENT for a
     // read-only explore fan-out (bug-investigator) — validate it only when present.
     if (e.newBranch !== undefined) spec.newBranch = str(e.newBranch, `peerRepos[${i}].newBranch`)
+    // Read-only explore fan-out: the branch to check the peer out at (the merger's PR branch).
+    if (e.cloneBranch !== undefined) {
+      spec.cloneBranch = str(e.cloneBranch, `peerRepos[${i}].cloneBranch`)
+    }
     if (typeof e.frameId === 'string' && e.frameId) spec.frameId = e.frameId
     if (typeof e.ghToken === 'string' && e.ghToken) spec.ghToken = e.ghToken
     if (typeof e.pr === 'object' && e.pr !== null) {