@getollie/cli 0.2.0 → 0.2.1

package/README.md

@@ -60,6 +60,14 @@ DAYTONA_API_KEY=... ollie agent --executor daytona 'run the native test suite an
 
 Agent `--ndjson` emits one runner event per line. Agent workspace writes persist to the host.
 
+Use repeatable `--mount <host-path:sandbox-path>` options to expose additional host directories read-write to the agent sandbox:
+
+```bash
+ollie agent --mount ./data:/data --mount /tmp/cache:/cache 'process the data'
+```
+
+Mount destinations must be normalized absolute sandbox paths outside `/workspace`, and mount destinations may not overlap. Relative host paths are resolved from the directory where Ollie is invoked. Additional mounts apply to the agent's primary sandbox tools, not delegated local or Daytona executors.
+
 The agent remains in the restricted workspace environment by default. `--executor local` adds a `delegateTask` tool that can start fresh subagents with native `bash`, file, package-manager, build, and test access. The local executor shares the current workspace, runs with the current user's permissions, inherits the current process environment, and is **not isolated**. It must be selected explicitly.
 
 `--executor daytona` runs delegated agents in an isolated Daytona sandbox. Ollie uploads the complete workspace before each delegated task, synchronizes all files back afterward, stops the sandbox between tasks while preserving its filesystem, and deletes it when the run finishes. Configure the SDK with `DAYTONA_API_KEY` and optionally `DAYTONA_API_URL`, `DAYTONA_TARGET`, or `OLLIE_DAYTONA_SNAPSHOT`.
@@ -68,9 +76,10 @@ The agent remains in the restricted workspace environment by default. `--executo
 
 ```bash
 ollie sandbox --cwd /path/to/workspace
+ollie sandbox --cwd /path/to/workspace --mount ./data:/data
 ```
 
-The worker reserves stdout for newline-delimited request/response records and retains one sandbox until EOF, so in-session changes persist between requests. Its workspace writes persist to the host by default.
+The worker reserves stdout for newline-delimited request/response records and retains one sandbox until EOF, so in-session changes persist between requests. Its workspace and additional mount writes persist to the host by default.
 
 ### Diagnostics
 
@@ -101,11 +110,13 @@ Configuration precedence is CLI flags, then environment variables, then defaults
 ```ts
 import { createJustBash, SANDBOX_WORKSPACE_PATH } from "@getollie/cli";
 
-const bash = createJustBash(process.cwd());
+const bash = createJustBash(process.cwd(), {
+  mounts: [{ hostPath: "./data", mountPoint: "/data" }],
+});
 const result = await bash.exec(`echo generated > ${SANDBOX_WORKSPACE_PATH}/output.txt`);
 ```
 
-The configured host directory is mounted read-write at `/workspace`, so writes persist directly to it. Symlinks are disabled, and Python and JavaScript support are enabled.
+The configured host directory is mounted read-write at `/workspace`, and optional additional host directories can be mounted read-write elsewhere, so writes persist directly to them. Symlinks are disabled, and Python and JavaScript support are enabled.
 
 ### Sandbox Git
 

package/dist/cli.js

@@ -8,7 +8,11 @@ import { Command } from "commander";
 
 // src/config.ts
 import { access, stat } from "fs/promises";
-import { resolve } from "path";
+import { resolve as resolve2 } from "path";
+
+// src/sandbox/mounts.ts
+import { realpathSync, statSync } from "fs";
+import { posix, resolve } from "path";
 
 // src/utils/errors.ts
 var CliError = class extends Error {
@@ -26,6 +30,64 @@ function getErrorMessage(error) {
   return String(error);
 }
 
+// src/sandbox/mounts.ts
+var SANDBOX_WORKSPACE_PATH = "/workspace";
+function pathsOverlap(left, right) {
+  return left === right || left.startsWith(`${right}/`) || right.startsWith(`${left}/`);
+}
+function validateMountPoint(mountPoint) {
+  if (!posix.isAbsolute(mountPoint) || mountPoint === "/" || mountPoint.includes("\\") || mountPoint.includes("\0") || posix.normalize(mountPoint) !== mountPoint) {
+    throw new CliError(
+      `Mount point must be a normalized absolute sandbox path other than /: ${mountPoint}`
+    );
+  }
+  if (pathsOverlap(mountPoint, SANDBOX_WORKSPACE_PATH)) {
+    throw new CliError(`Mount point must be outside ${SANDBOX_WORKSPACE_PATH}: ${mountPoint}`);
+  }
+}
+function validateSandboxMounts(mounts) {
+  const validated = [];
+  for (const mount of mounts) {
+    validateMountPoint(mount.mountPoint);
+    let hostPath;
+    try {
+      hostPath = realpathSync(resolve(mount.hostPath));
+      if (!statSync(hostPath).isDirectory()) {
+        throw new Error("not a directory");
+      }
+    } catch {
+      throw new CliError(
+        `Mount source does not exist or is not a directory: ${resolve(mount.hostPath)}`
+      );
+    }
+    const conflict = validated.find(
+      (candidate) => pathsOverlap(candidate.mountPoint, mount.mountPoint)
+    );
+    if (conflict) {
+      throw new CliError(
+        `Mount points must not overlap: ${conflict.mountPoint} and ${mount.mountPoint}`
+      );
+    }
+    validated.push({ hostPath, mountPoint: mount.mountPoint });
+  }
+  return validated;
+}
+function parseSandboxMounts(specs = []) {
+  const mounts = specs.map((spec) => {
+    const separator = spec.lastIndexOf(":");
+    if (separator <= 0 || separator === spec.length - 1) {
+      throw new CliError(
+        `Invalid mount ${JSON.stringify(spec)}. Expected <host-path>:<sandbox-path>`
+      );
+    }
+    return {
+      hostPath: spec.slice(0, separator),
+      mountPoint: spec.slice(separator + 1)
+    };
+  });
+  return validateSandboxMounts(mounts);
+}
+
 // src/config.ts
 var DEFAULT_PROVIDER = "openai";
 var DEFAULT_MODEL = "gpt-5.6";
@@ -54,7 +116,7 @@ function parseExecutor(value) {
   return executor;
 }
 async function resolveRunConfig(input = {}, env = process.env) {
-  const cwd = resolve(input.cwd ?? env.OLLIE_CWD ?? process.cwd());
+  const cwd = resolve2(input.cwd ?? env.OLLIE_CWD ?? process.cwd());
   const stats = await stat(cwd).catch(() => null);
   if (!stats?.isDirectory()) {
     throw new CliError(`Working directory does not exist or is not a directory: ${cwd}`);
@@ -63,6 +125,7 @@ async function resolveRunConfig(input = {}, env = process.env) {
   const executor = parseExecutor(input.executor ?? env.OLLIE_EXECUTOR);
   return {
     cwd,
+    mounts: parseSandboxMounts(input.mount),
     provider: input.provider ?? env.OLLIE_PROVIDER ?? DEFAULT_PROVIDER,
     model: input.model ?? env.OLLIE_MODEL ?? DEFAULT_MODEL,
     executor,
@@ -99,23 +162,23 @@ async function resolveRunConfig(input = {}, env = process.env) {
 import { access as access2, stat as stat2 } from "fs/promises";
 
 // src/sandbox/just-bash.ts
-import { realpathSync, statSync } from "fs";
+import { realpathSync as realpathSync2, statSync as statSync2 } from "fs";
 import { Bash, InMemoryFs, MountableFs, ReadWriteFs } from "just-bash";
 
 // src/sandbox/git/index.ts
-import { posix as posix2 } from "path";
+import { posix as posix3 } from "path";
 import { createTwoFilesPatch } from "diff";
 import * as git from "isomorphic-git";
 import { defineCommand } from "just-bash";
 
 // src/sandbox/git/fs-adapter.ts
-import { posix } from "path";
+import { posix as posix2 } from "path";
 var ROOT = "/workspace";
 function safePath(path) {
   if (path.includes("\0") || path.includes("\\")) {
     throw Object.assign(new Error("Invalid virtual Git path"), { code: "EINVAL" });
   }
-  const normalized = posix.resolve(path);
+  const normalized = posix2.resolve(path);
   if (normalized !== ROOT && !normalized.startsWith(`${ROOT}/`)) {
     throw Object.assign(new Error("Git path is outside /workspace"), { code: "EACCES" });
   }
@@ -135,7 +198,7 @@ function normalizeError(error) {
   throw Object.assign(new Error("Virtual filesystem operation failed"), { code: "EIO" });
 }
 async function ensureParent(fs, path) {
-  const parent = posix.dirname(path);
+  const parent = posix2.dirname(path);
   if (!await fs.exists(parent)) await fs.mkdir(parent, { recursive: true });
 }
 function statShape(stat4) {
@@ -370,9 +433,9 @@ function virtualPath(ctx, input = ".") {
 async function repositoryDir(ctx) {
   let current = virtualPath(ctx);
   while (current === WORKSPACE || current.startsWith(`${WORKSPACE}/`)) {
-    if (await ctx.fs.exists(posix2.join(current, ".git"))) return current;
+    if (await ctx.fs.exists(posix3.join(current, ".git"))) return current;
     if (current === WORKSPACE) break;
-    current = posix2.dirname(current);
+    current = posix3.dirname(current);
   }
   throw new Error("not a git repository (or any parent up to /workspace)");
 }
@@ -455,7 +518,7 @@ async function writeGlobalConfig(ctx, values) {
     ([section, entries]) => `[${section}]
 ${entries.map(([key, value]) => `	${key} = ${value}`).join("\n")}`
   ).join("\n");
-  await ctx.fs.mkdir(posix2.dirname(GLOBAL_CONFIG_PATH), { recursive: true });
+  await ctx.fs.mkdir(posix3.dirname(GLOBAL_CONFIG_PATH), { recursive: true });
   await ctx.fs.writeFile(GLOBAL_CONFIG_PATH, content ? `${content}
 ` : "");
 }
@@ -469,7 +532,7 @@ async function handleInit(context, args) {
       throw new Error("cannot create repository directory");
   });
   await git.init({ fs: context.fs, dir, defaultBranch: branchOpt.value ?? "main" });
-  return ok(`Initialized empty Git repository in ${posix2.join(dir, ".git")}/
+  return ok(`Initialized empty Git repository in ${posix3.join(dir, ".git")}/
 `);
 }
 async function handleStatus(context, args) {
@@ -622,7 +685,7 @@ async function handleDiff(context, args) {
     const changed = cachedFlag.enabled ? headStatus !== stageStatus : workdirStatus !== stageStatus;
     if (!changed) continue;
     const oldBytes = cachedFlag.enabled ? head && headStatus !== 0 ? (await git.readBlob({ fs: context.fs, dir, oid: head, filepath })).blob : empty : await readStage(filepath);
-    const newBytes = cachedFlag.enabled ? await readStage(filepath) : workdirStatus === 0 ? empty : await context.command.fs.readFileBuffer(posix2.join(dir, filepath));
+    const newBytes = cachedFlag.enabled ? await readStage(filepath) : workdirStatus === 0 ? empty : await context.command.fs.readFileBuffer(posix3.join(dir, filepath));
     patches.push(patch(filepath, oldBytes, newBytes));
   }
   return ok(patches.join(""));
@@ -689,7 +752,7 @@ async function handleCheckout(context, args) {
     const oid = await git.resolveRef({ fs: context.fs, dir, ref });
     for (const filepath of filepaths) {
       const blob = await readCheckoutBlob(context, dir, oid, filepath);
-      await context.command.fs.writeFile(posix2.join(dir, filepath), blob);
+      await context.command.fs.writeFile(posix3.join(dir, filepath), blob);
     }
     return ok();
   }
@@ -816,7 +879,7 @@ async function handleClone(context, args) {
   const [rawUrl, destination, ...rest] = noCheckoutFlag.rest;
   if (!rawUrl || rest.length) usage("clone requires a URL and optional directory");
   const url = validateRemoteUrl(rawUrl);
-  const inferred = posix2.basename(new URL(url).pathname).replace(/\.git$/, "") || "repository";
+  const inferred = posix3.basename(new URL(url).pathname).replace(/\.git$/, "") || "repository";
   const dir = virtualPath(context.command, destination ?? inferred);
   const depth = positiveInteger(depthOpt.value, "--depth");
   await git.clone({
@@ -980,30 +1043,35 @@ Supported commands: ${COMMANDS.join(", ")}
 }
 
 // src/sandbox/just-bash.ts
-var SANDBOX_WORKSPACE_PATH = "/workspace";
+var SANDBOX_WORKSPACE_PATH2 = "/workspace";
 function canonicalizeWorkspaceRoot(workspaceRoot) {
-  const canonicalRoot = realpathSync(workspaceRoot);
-  if (!statSync(canonicalRoot).isDirectory()) {
+  const canonicalRoot = realpathSync2(workspaceRoot);
+  if (!statSync2(canonicalRoot).isDirectory()) {
     throw new Error("The sandbox workspace root must be a directory");
   }
   return canonicalRoot;
 }
-function createWorkspaceFs(workspaceRoot) {
+function createWorkspaceFs(workspaceRoot, options) {
   const root = canonicalizeWorkspaceRoot(workspaceRoot);
+  const additionalMounts = validateSandboxMounts(options.mounts ?? []).map((mount) => ({
+    mountPoint: mount.mountPoint,
+    filesystem: new ReadWriteFs({ root: mount.hostPath, allowSymlinks: false })
+  }));
   return new MountableFs({
     base: new InMemoryFs(),
     mounts: [
       {
-        mountPoint: SANDBOX_WORKSPACE_PATH,
+        mountPoint: SANDBOX_WORKSPACE_PATH2,
         filesystem: new ReadWriteFs({ root, allowSymlinks: false })
-      }
+      },
+      ...additionalMounts
     ]
   });
 }
 function createJustBash(workspaceRoot, options = {}) {
   return new Bash({
-    fs: createWorkspaceFs(workspaceRoot),
-    cwd: SANDBOX_WORKSPACE_PATH,
+    fs: createWorkspaceFs(workspaceRoot, options),
+    cwd: SANDBOX_WORKSPACE_PATH2,
     env: {
       HOME: "/home/user",
       TERM: "xterm-256color"
@@ -1353,7 +1421,7 @@ var ExecutorController = class {
 // src/executor/daytona.ts
 import { randomUUID } from "crypto";
 import { mkdir, readdir, readFile, rm, stat as stat3, writeFile } from "fs/promises";
-import { dirname, isAbsolute, relative, resolve as resolve2, sep } from "path";
+import { dirname, isAbsolute, relative, resolve as resolve3, sep } from "path";
 import {
   Daytona,
   DaytonaProcessExecutionTimeoutError
@@ -1388,7 +1456,7 @@ async function listLocalFiles(root) {
   const files = /* @__PURE__ */ new Map();
   async function visit(directory) {
     for (const entry of await readdir(directory, { withFileTypes: true })) {
-      const absolutePath = resolve2(directory, entry.name);
+      const absolutePath = resolve3(directory, entry.name);
       if (entry.isDirectory()) {
         await visit(absolutePath);
       } else if (entry.isFile()) {
@@ -1472,7 +1540,7 @@ ${marker}
     this.#disposed = true;
   }
   #resolvePath(path) {
-    const target = isAbsolute(path) ? resolve2(path) : resolve2(this.#workspacePath, path);
+    const target = isAbsolute(path) ? resolve3(path) : resolve3(this.#workspacePath, path);
     if (target !== this.#workspacePath && !target.startsWith(`${this.#workspacePath}/`)) {
       throw new Error(`Path is outside the Daytona workspace: ${path}`);
     }
@@ -1488,7 +1556,7 @@ var DaytonaWorkspaceSynchronizer = class {
   #sandbox;
   #knownFiles = /* @__PURE__ */ new Set();
   constructor(cwd, remoteWorkspacePath, sandbox) {
-    this.#cwd = resolve2(cwd);
+    this.#cwd = resolve3(cwd);
     this.#remoteWorkspacePath = remoteWorkspacePath;
     this.#sandbox = sandbox;
   }
@@ -1519,7 +1587,7 @@ var DaytonaWorkspaceSynchronizer = class {
     for (const [path, size] of localFiles) {
       signal?.throwIfAborted();
       await abortable(
-        this.#sandbox.fs.uploadFile(resolve2(this.#cwd, path), this.#remotePath(path)),
+        this.#sandbox.fs.uploadFile(resolve3(this.#cwd, path), this.#remotePath(path)),
         signal
       );
       if (this.#knownFiles.has(path)) filesUpdated++;
@@ -1551,7 +1619,7 @@ var DaytonaWorkspaceSynchronizer = class {
     let bytesTransferred = 0;
     for (const path of this.#knownFiles) {
       if (remoteFiles.has(path)) continue;
-      await rm(resolve2(this.#cwd, path), { force: true });
+      await rm(resolve3(this.#cwd, path), { force: true });
       filesDeleted++;
     }
     for (const path of remoteFiles) {
@@ -1581,7 +1649,7 @@ var DaytonaWorkspaceSynchronizer = class {
     return `${this.#remoteWorkspacePath}/${path}`;
   }
   #localPath(path) {
-    const target = resolve2(this.#cwd, path);
+    const target = resolve3(this.#cwd, path);
     if (target !== this.#cwd && !target.startsWith(`${this.#cwd}${sep}`)) {
       throw new Error(`Daytona returned a path outside the workspace: ${path}`);
     }
@@ -1715,7 +1783,7 @@ Terminus-2 spirit:
 - Summarize final findings and important command results clearly.
 
 Runtime context:
-- Working directory: ${SANDBOX_WORKSPACE_PATH}
+- Working directory: ${SANDBOX_WORKSPACE_PATH2}
 - Current time: ${options.now.toISOString()}
 - Maximum model/tool steps: ${options.maxSteps}
 - Per-command timeout: ${options.commandTimeoutMs} ms
@@ -1770,8 +1838,8 @@ async function createWorkspaceTools(options) {
 }
 async function createTools(options) {
   return createWorkspaceTools({
-    sandbox: createJustBash(options.cwd),
-    destination: SANDBOX_WORKSPACE_PATH,
+    sandbox: createJustBash(options.cwd, { mounts: options.mounts }),
+    destination: SANDBOX_WORKSPACE_PATH2,
     maxOutputBytes: options.maxOutputBytes,
     extraInstructions: "Use bash commands to inspect files, search, run tests, and gather terminal state. Sandbox-native git is available; local Git changes persist in the workspace, and git push has permanent remote effects, so destructive actions and pushes must only be used when explicitly requested. Keep commands bounded."
   });
@@ -1846,7 +1914,7 @@ var ModelTaskDelegator = class {
 // src/executor/local.ts
 import { spawn } from "child_process";
 import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
-import { dirname as dirname2, isAbsolute as isAbsolute2, resolve as resolve3 } from "path";
+import { dirname as dirname2, isAbsolute as isAbsolute2, resolve as resolve4 } from "path";
 var LocalSandbox = class {
   #cwd;
   #commandTimeoutMs;
@@ -1855,7 +1923,7 @@ var LocalSandbox = class {
   #processes = /* @__PURE__ */ new Set();
   #disposed = false;
   constructor(options, signal) {
-    this.#cwd = resolve3(options.cwd);
+    this.#cwd = resolve4(options.cwd);
     this.#commandTimeoutMs = options.commandTimeoutMs;
     this.#env = options.env ?? process.env;
     this.#signal = signal;
@@ -1968,7 +2036,7 @@ var LocalSandbox = class {
     this.#processes.clear();
   }
   #resolvePath(path) {
-    return isAbsolute2(path) ? path : resolve3(this.#cwd, path);
+    return isAbsolute2(path) ? path : resolve4(this.#cwd, path);
   }
   #assertActive() {
     if (this.#disposed) throw new Error("Local executor session has been disposed");
@@ -1979,7 +2047,7 @@ var LocalExecutorSession = class {
   context;
   #disposed = false;
   constructor(options, signal) {
-    const workspacePath = resolve3(options.cwd);
+    const workspacePath = resolve4(options.cwd);
     this.sandbox = new LocalSandbox(options, signal);
     this.context = {
       kind: "local",
@@ -2096,6 +2164,7 @@ async function runOneShot(options) {
     });
     const workspaceTools = await createTools({
       cwd: options.cwd,
+      mounts: options.mounts,
       maxOutputBytes: options.maxOutputBytes
     });
     const executorProvider = createExecutorProvider(options);
@@ -2173,7 +2242,7 @@ async function runOneShot(options) {
 
 // src/sandbox/runtime.ts
 import { once } from "events";
-import { posix as posix3 } from "path";
+import { posix as posix4 } from "path";
 import { createInterface } from "readline";
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -2211,7 +2280,7 @@ function requireString(params, name) {
   return value;
 }
 function validateVirtualPath(path) {
-  if (!posix3.isAbsolute(path) || path.includes("\\") || path.includes("\0") || posix3.normalize(path) !== path || path.split("/").some((component) => component === "." || component === "..")) {
+  if (!posix4.isAbsolute(path) || path.includes("\\") || path.includes("\0") || posix4.normalize(path) !== path || path.split("/").some((component) => component === "." || component === "..")) {
     throw new Error("Path must be a normalized absolute virtual path");
   }
   return path;
@@ -2272,7 +2341,7 @@ async function runWorker(options = {}) {
   const workspaceRoot = options.cwd ?? process.cwd();
   const input = options.input ?? process.stdin;
   const output = options.output ?? process.stdout;
-  const bash = createJustBash(workspaceRoot);
+  const bash = createJustBash(workspaceRoot, { mounts: options.mounts });
   const lines = createInterface({ input, crlfDelay: Number.POSITIVE_INFINITY });
   const close = () => lines.close();
   if (options.signal?.aborted) {
@@ -2323,8 +2392,18 @@ function truncateText(input, maxBytes) {
 function addExecOptions(command, ndjsonDescription = "emit one JSON result record") {
   return command.option("--cwd <path>", "working directory").option("--timeout <ms>", "command timeout in milliseconds").option("--max-output <bytes>", "maximum retained output").option("--ndjson", ndjsonDescription);
 }
+function collectOption(value, previous) {
+  return [...previous ?? [], value];
+}
+function addMountOption(command) {
+  return command.option(
+    "--mount <host-path:sandbox-path>",
+    "mount a host directory read-write (repeatable)",
+    collectOption
+  );
+}
 function addAgentOptions(command) {
-  return addExecOptions(command, "emit newline-delimited JSON event records").option("--provider <provider>", "model provider", "openai").option("--model <model>", "model id").option(
+  return addMountOption(addExecOptions(command, "emit newline-delimited JSON event records")).option("--provider <provider>", "model provider", "openai").option("--model <model>", "model id").option(
     "--executor <executor>",
     "delegated executor: none, local, or daytona (local is unisolated; daytona requires DAYTONA_API_KEY)",
     "none"
@@ -2430,6 +2509,7 @@ async function runSandbox(options) {
   try {
     await runWorker({
       cwd: options.cwd,
+      mounts: parseSandboxMounts(options.mount),
       signal: controller.signal
     });
     if (signalExitCode !== void 0) {
@@ -2458,7 +2538,10 @@ function createProgram() {
   agent.action(async (prompt, options) => {
     await runAgent(prompt, options);
   });
-  program.command("sandbox").description("run the persistent sandbox NDJSON command interface").option("--cwd <path>", "working directory").action(async (options) => {
+  const sandbox = addMountOption(
+    program.command("sandbox").description("run the persistent sandbox NDJSON command interface").option("--cwd <path>", "working directory")
+  );
+  sandbox.action(async (options) => {
     await runSandbox(options);
   });
   program.command("doctor").description("validate the local Ollie setup without making model calls").option("--cwd <path>", "working directory").option("--provider <provider>", "model provider", "openai").option("--model <model>", "model id").option("--json", "emit JSON report").action(async (options) => {