@h-rig/isolation-plugin 0.0.6-alpha.156 → 0.0.6-alpha.158

package/dist/src/isolation/types.d.ts

@@ -0,0 +1,15 @@
+import type { AgentRuntime, IsolationMode, RuntimeSnapshotSidecar, TaskBrowserConfig } from "@rig/contracts";
+export type { AgentRuntime, IsolationMode, RuntimeSnapshotSidecar };
+export type RuntimeMetadata = {
+    id: string;
+    taskId: string;
+    mode: IsolationMode;
+    workspaceDir: string;
+    createdAt: string;
+};
+export type RuntimeTaskEntry = {
+    role?: string;
+    scope?: string[];
+    validation?: string[];
+    browser?: TaskBrowserConfig;
+};

package/dist/src/isolation/types.js

@@ -0,0 +1 @@
+// @bun

package/dist/src/isolation/worktree.d.ts

@@ -0,0 +1,22 @@
+import { runGitCommand } from "./shared";
+export declare function resolveMonorepoBaseRef(monorepoRoot: string): Promise<string>;
+export declare function ensureProvisioningHostProjectRootEnv(projectRoot: string): void;
+export declare function provisionRuntimeWorktree(config: {
+    monorepoRoot: string;
+    taskId: string;
+    runtimeId: string;
+    workspaceDir: string;
+    baseRef: string;
+}): Promise<void>;
+export declare function isGitLockContention(result: {
+    exitCode: number;
+    stdout?: unknown;
+    stderr?: unknown;
+}): boolean;
+export declare function runGitWithLockRetry(repoRoot: string, args: string[], attempts?: number): Promise<Awaited<ReturnType<typeof runGitCommand>>>;
+export declare function cleanupRuntimeWorktree(monorepoRoot: string, workspaceDir: string): Promise<void>;
+export declare function configureRuntimeGitIdentity(projectRoot: string, repoRoot: string): Promise<void>;
+export declare function resolveMonorepoBaseCommit(monorepoRoot: string, baseRef: string): Promise<string>;
+export declare function runtimeBranchName(taskId: string, runtimeId: string): string;
+export declare function runtimeWorktreeName(taskId: string, runtimeId: string): string;
+export declare function runtimeWorktreeNameFromRuntimeId(runtimeId: string): string;

package/dist/src/isolation/worktree.js

@@ -0,0 +1,353 @@
+// @bun
+// packages/isolation-plugin/src/isolation/worktree.ts
+import { existsSync as existsSync2, mkdirSync, rmSync as rmSync2 } from "fs";
+import { dirname, resolve } from "path";
+import { assertPathInsideRoot, safeGitRefComponent as safeGitRefComponent2, safePathSegment } from "@rig/core/safe-identifiers";
+
+// packages/isolation-plugin/src/isolation/shared.ts
+import { existsSync, readFileSync, rmSync } from "fs";
+import { agentId, safeGitRefComponent, taskRuntimeId } from "@rig/core/safe-identifiers";
+import { resolveCheckoutRoot } from "@rig/core/checkout-root";
+function isRuntimeGatewayGitPath(candidate) {
+  return /\/\.rig\/bin\/git$/.test(candidate.replace(/\\/g, "/"));
+}
+function resolveHostGitBinary() {
+  const candidates = [
+    process.env.RIG_GIT_BIN?.trim() || "",
+    "/usr/bin/git",
+    "/opt/homebrew/bin/git",
+    "/usr/local/bin/git"
+  ];
+  const bunResolved = Bun.which("git");
+  if (bunResolved && !isRuntimeGatewayGitPath(bunResolved)) {
+    candidates.push(bunResolved);
+  }
+  for (const candidate of candidates) {
+    if (candidate && !isRuntimeGatewayGitPath(candidate) && existsSync(candidate)) {
+      return candidate;
+    }
+  }
+  return "git";
+}
+var generatedCredentialFiles = new Set;
+async function runGitCommand(repoRoot, args) {
+  const gitBinary = resolveHostGitBinary();
+  return Bun.$`${gitBinary} -C ${repoRoot} ${args}`.quiet().nothrow();
+}
+async function readGitConfigValue(repoRoot, key, global = false) {
+  const args = ["config", ...global ? ["--global"] : [], "--get", key];
+  const result = await runGitCommand(repoRoot, args);
+  if (result.exitCode !== 0) {
+    return "";
+  }
+  return String(result.stdout).trim();
+}
+async function readGitStdout(repoRoot, args) {
+  const result = await runGitCommand(repoRoot, args);
+  if (result.exitCode !== 0) {
+    throw new Error(`git -C ${repoRoot} ${args.join(" ")} failed: ${result.stderr || result.stdout}`);
+  }
+  return String(result.stdout).trim();
+}
+async function hasGitRemote(repoRoot, remote) {
+  const result = await runGitCommand(repoRoot, ["remote", "get-url", remote]);
+  return result.exitCode === 0;
+}
+async function ensureFullGitHistory(repoRoot) {
+  const shallow = await runGitCommand(repoRoot, ["rev-parse", "--is-shallow-repository"]);
+  if (shallow.exitCode !== 0 || String(shallow.stdout).trim() !== "true") {
+    return;
+  }
+  const unshallow = await runGitCommand(repoRoot, ["fetch", "--unshallow", "--tags", "origin"]);
+  if (unshallow.exitCode === 0) {
+    return;
+  }
+  const output = `${unshallow.stderr}
+${unshallow.stdout}`.trim();
+  if (/--unshallow on a complete repository|does not make sense/i.test(output)) {
+    return;
+  }
+  throw new Error(`Failed to expand git history for ${repoRoot}: ${output}`);
+}
+async function refreshRemoteBranch(repoRoot, remote, branch) {
+  if (!await hasGitRemote(repoRoot, remote)) {
+    return;
+  }
+  try {
+    await ensureFullGitHistory(repoRoot);
+    const fetch = await runGitCommand(repoRoot, [
+      "fetch",
+      "--prune",
+      "--tags",
+      remote,
+      `+refs/heads/${branch}:refs/remotes/${remote}/${branch}`
+    ]);
+    if (fetch.exitCode !== 0) {
+      return;
+    }
+  } catch {
+    return;
+  }
+}
+function sanitizeRuntimeRefSegment(value) {
+  return safeGitRefComponent(value, { fallback: "runtime", maxLength: 64 });
+}
+function runtimeBranchBackupName(branch) {
+  const branchId = branch.replace(/^rig\//, "");
+  return `rig-backup/${sanitizeRuntimeRefSegment(branchId)}-${Date.now()}`;
+}
+
+// packages/isolation-plugin/src/isolation/worktree.ts
+async function resolveMonorepoBaseRef(monorepoRoot) {
+  const explicit = process.env.RIG_RUNTIME_BASE_REF?.trim();
+  if (explicit) {
+    const exists = await runGitCommand(monorepoRoot, ["rev-parse", "--verify", "--quiet", explicit]);
+    if (exists.exitCode !== 0) {
+      throw new Error(`RIG_RUNTIME_BASE_REF=${explicit} does not resolve at ${monorepoRoot}.`);
+    }
+    return explicit;
+  }
+  for (const remote of await preferredBaseRemotes(monorepoRoot)) {
+    await refreshRemoteBranch(monorepoRoot, remote, "main");
+    const remoteMain = await runGitCommand(monorepoRoot, ["show-ref", "--verify", "--quiet", `refs/remotes/${remote}/main`]);
+    if (remoteMain.exitCode === 0) {
+      return `${remote}/main`;
+    }
+  }
+  const localMain = await runGitCommand(monorepoRoot, ["show-ref", "--verify", "--quiet", "refs/heads/main"]);
+  if (localMain.exitCode === 0) {
+    return "main";
+  }
+  throw new Error(`Failed to resolve a monorepo base ref at ${monorepoRoot}. Expected local main or a remote main ref.`);
+}
+function ensureProvisioningHostProjectRootEnv(projectRoot) {
+  if (!projectRoot.trim()) {
+    return;
+  }
+  if (!process.env.RIG_HOST_PROJECT_ROOT?.trim()) {
+    process.env.RIG_HOST_PROJECT_ROOT = projectRoot;
+  }
+  if (!process.env.PROJECT_RIG_ROOT?.trim()) {
+    process.env.PROJECT_RIG_ROOT = projectRoot;
+  }
+}
+async function provisionRuntimeWorktree(config) {
+  const worktreesRoot = resolve(config.monorepoRoot, ".worktrees");
+  assertPathInsideRoot(worktreesRoot, config.workspaceDir, "runtime worktree path");
+  const branch = runtimeBranchName(config.taskId, config.runtimeId);
+  let hasValidWorktree = existsSync2(resolve(config.workspaceDir, ".git")) && (await runGitCommand(config.workspaceDir, ["rev-parse", "--show-toplevel"])).exitCode === 0;
+  if (existsSync2(config.workspaceDir) && !hasValidWorktree) {
+    rmSync2(config.workspaceDir, { recursive: true, force: true });
+  }
+  if (!hasValidWorktree) {
+    mkdirSync(dirname(config.workspaceDir), { recursive: true });
+    const branchExists = await runGitCommand(config.monorepoRoot, ["show-ref", "--verify", "--quiet", `refs/heads/${branch}`]);
+    const addArgs = branchExists.exitCode === 0 ? ["worktree", "add", "--force", config.workspaceDir, branch] : ["worktree", "add", "--force", "-b", branch, config.workspaceDir, config.baseRef];
+    const add = await runGitWithLockRetry(config.monorepoRoot, addArgs);
+    if (add.exitCode !== 0) {
+      throw new Error(`Failed to create monorepo worktree for ${config.runtimeId}: ${add.stderr.toString() || add.stdout.toString()}`);
+    }
+    hasValidWorktree = true;
+  }
+  await ensureRuntimeBranch(config.workspaceDir, branch, config.baseRef);
+}
+function isGitLockContention(result) {
+  if (result.exitCode === 0) {
+    return false;
+  }
+  const text = `${result.stderr != null ? String(result.stderr) : ""}
+${result.stdout != null ? String(result.stdout) : ""}`;
+  return /could not lock|cannot lock|unable to create '[^']*\.lock'|index\.lock|is already locked|File exists/i.test(text);
+}
+async function runGitWithLockRetry(repoRoot, args, attempts = 5) {
+  let result = await runGitCommand(repoRoot, args);
+  for (let attempt = 1;attempt < attempts && isGitLockContention(result); attempt++) {
+    await Bun.sleep(50 * attempt);
+    result = await runGitCommand(repoRoot, args);
+  }
+  return result;
+}
+async function cleanupRuntimeWorktree(monorepoRoot, workspaceDir) {
+  assertPathInsideRoot(resolve(monorepoRoot, ".worktrees"), workspaceDir, "runtime worktree path");
+  await runGitCommand(monorepoRoot, ["worktree", "remove", "--force", workspaceDir]);
+}
+async function configureRuntimeGitIdentity(projectRoot, repoRoot) {
+  const userName = process.env.RIG_GIT_USER_NAME?.trim() || await readGitConfigValue(projectRoot, "user.name") || await readGitConfigValue(projectRoot, "user.name", true) || process.env.GIT_AUTHOR_NAME?.trim() || process.env.GIT_COMMITTER_NAME?.trim() || "rig-agent";
+  const userEmail = process.env.RIG_GIT_USER_EMAIL?.trim() || await readGitConfigValue(projectRoot, "user.email") || await readGitConfigValue(projectRoot, "user.email", true) || process.env.GIT_AUTHOR_EMAIL?.trim() || process.env.GIT_COMMITTER_EMAIL?.trim() || "rig-agent@users.noreply.github.com";
+  for (const [key, value] of [
+    ["user.name", userName],
+    ["user.email", userEmail]
+  ]) {
+    await runGitCommand(repoRoot, ["config", "--local", key, value]);
+  }
+}
+async function resolveMonorepoBaseCommit(monorepoRoot, baseRef) {
+  return readGitStdout(monorepoRoot, ["rev-parse", baseRef]);
+}
+async function ensureRuntimeBranch(repoRoot, branch, baseRef) {
+  const pruneWorktrees = async () => {
+    await runGitCommand(repoRoot, ["worktree", "prune", "--expire", "now"]);
+  };
+  await pruneWorktrees();
+  await clearInterruptedRuntimeGitState(repoRoot, branch);
+  const current = await runGitCommand(repoRoot, ["rev-parse", "--abbrev-ref", "HEAD"]);
+  if (current.exitCode === 0 && current.stdout.toString().trim() === branch) {
+    await repairDisconnectedRuntimeBranch(repoRoot, branch, baseRef);
+    await clearInterruptedRuntimeGitState(repoRoot, branch);
+    return;
+  }
+  let checkout = await runGitCommand(repoRoot, ["checkout", "-B", branch]);
+  const checkoutError = checkout.stderr.toString() || checkout.stdout.toString();
+  if (checkout.exitCode !== 0 && checkoutError.includes("already used by worktree")) {
+    await pruneWorktrees();
+    checkout = await runGitCommand(repoRoot, ["checkout", "-B", branch]);
+  }
+  if (checkout.exitCode !== 0 && /resolve your current index first|would be overwritten by checkout/i.test(checkoutError)) {
+    await discardTrackedRuntimeChanges(repoRoot, branch, checkoutError);
+    checkout = await runGitCommand(repoRoot, ["checkout", "-B", branch]);
+  }
+  if (checkout.exitCode !== 0) {
+    throw new Error(`Failed to prepare runtime branch ${branch} in ${repoRoot}: ${checkout.stderr.toString() || checkout.stdout.toString()}`);
+  }
+  await repairDisconnectedRuntimeBranch(repoRoot, branch, baseRef);
+  await clearInterruptedRuntimeGitState(repoRoot, branch);
+}
+async function repairDisconnectedRuntimeBranch(repoRoot, branch, baseRef) {
+  const mergeBase = await runGitCommand(repoRoot, ["merge-base", "HEAD", baseRef]);
+  if (mergeBase.exitCode === 0) {
+    const counts = await runGitCommand(repoRoot, ["rev-list", "--left-right", "--count", `HEAD...${baseRef}`]);
+    if (counts.exitCode === 0) {
+      const [aheadRaw = "0", behindRaw = "0"] = String(counts.stdout).trim().split(/\s+/);
+      const ahead = Number.parseInt(aheadRaw, 10);
+      const behind = Number.parseInt(behindRaw, 10);
+      if (Number.isFinite(ahead) && Number.isFinite(behind) && ahead === 0 && behind > 0) {
+        const reset = await runGitCommand(repoRoot, ["reset", "--hard", baseRef]);
+        if (reset.exitCode !== 0) {
+          throw new Error(`Failed to reset stale runtime branch ${branch} to ${baseRef} in ${repoRoot}: ${reset.stderr.toString() || reset.stdout.toString()}`);
+        }
+        console.log(`[rig-agent] Reset stale runtime branch ${branch} to ${baseRef} in ${repoRoot}`);
+      }
+    }
+    return;
+  }
+  const backupBranch = runtimeBranchBackupName(branch);
+  const rename = await runGitCommand(repoRoot, ["branch", "-m", backupBranch]);
+  if (rename.exitCode !== 0) {
+    throw new Error(`Failed to archive disconnected runtime branch ${branch} in ${repoRoot}: ${rename.stderr.toString() || rename.stdout.toString()}`);
+  }
+  const recreate = await runGitCommand(repoRoot, ["checkout", "-B", branch, baseRef]);
+  if (recreate.exitCode !== 0) {
+    throw new Error(`Failed to recreate runtime branch ${branch} from ${baseRef} in ${repoRoot}: ${recreate.stderr.toString() || recreate.stdout.toString()}`);
+  }
+  console.log(`[rig-agent] Recreated disconnected runtime branch ${branch} from ${baseRef}; archived as ${backupBranch}`);
+}
+async function clearInterruptedRuntimeGitState(repoRoot, branch) {
+  let cleared = false;
+  for (const [sentinel, abortArgs] of [
+    ["MERGE_HEAD", ["merge", "--abort"]],
+    ["REBASE_HEAD", ["rebase", "--abort"]],
+    ["CHERRY_PICK_HEAD", ["cherry-pick", "--abort"]]
+  ]) {
+    const state = await runGitCommand(repoRoot, ["rev-parse", "--verify", "--quiet", sentinel]);
+    if (state.exitCode !== 0) {
+      continue;
+    }
+    cleared = true;
+    const abort = await runGitCommand(repoRoot, [...abortArgs]);
+    if (abort.exitCode === 0) {
+      continue;
+    }
+    const reset = await runGitCommand(repoRoot, ["reset", "--hard", "HEAD"]);
+    if (reset.exitCode !== 0) {
+      throw new Error(`Failed to recover interrupted git state for runtime branch ${branch} in ${repoRoot}: ${reset.stderr.toString() || reset.stdout.toString()}`);
+    }
+  }
+  const unmerged = await runGitCommand(repoRoot, ["ls-files", "-u"]);
+  if (unmerged.exitCode === 0 && String(unmerged.stdout).trim()) {
+    cleared = true;
+    const reset = await runGitCommand(repoRoot, ["reset", "--hard", "HEAD"]);
+    if (reset.exitCode !== 0) {
+      throw new Error(`Failed to clear unmerged files for runtime branch ${branch} in ${repoRoot}: ${reset.stderr.toString() || reset.stdout.toString()}`);
+    }
+  }
+  if (cleared) {
+    console.log(`[rig-agent] Reset interrupted git state in runtime branch ${branch} at ${repoRoot}`);
+  }
+}
+async function discardTrackedRuntimeChanges(repoRoot, branch, reason) {
+  const status = await runGitCommand(repoRoot, ["status", "--porcelain"]);
+  if (status.exitCode !== 0) {
+    throw new Error(`Failed to inspect runtime worktree state for ${branch} in ${repoRoot}: ${status.stderr.toString() || status.stdout.toString()}`);
+  }
+  const trackedChanges = String(status.stdout).split(/\r?\n/).map((line) => line.trimEnd()).filter(Boolean).filter((line) => !line.startsWith("?? "));
+  if (trackedChanges.length === 0) {
+    return;
+  }
+  const reset = await runGitCommand(repoRoot, ["reset", "--hard", "HEAD"]);
+  if (reset.exitCode !== 0) {
+    throw new Error(`Failed to discard tracked runtime changes for ${branch} in ${repoRoot}: ${reset.stderr.toString() || reset.stdout.toString()}`);
+  }
+  console.log(`[rig-agent] Reset tracked runtime changes in ${branch} at ${repoRoot} after checkout failed: ${reason.trim()}`);
+}
+function runtimeBranchName(taskId, runtimeId) {
+  const taskComponent = safeGitRefComponent2(taskId, { fallback: "task", maxLength: 72 });
+  if (runtimeId === taskRuntimeId(taskId)) {
+    return `rig/${taskComponent}`;
+  }
+  return `rig/${taskComponent}-${safeGitRefComponent2(runtimeId, { fallback: "runtime", maxLength: 48 })}`;
+}
+function runtimeWorktreeName(taskId, runtimeId) {
+  if (runtimeId === taskRuntimeId(taskId)) {
+    return safePathSegment(taskId, { fallback: "task", maxLength: 72 });
+  }
+  return safePathSegment(runtimeId, { fallback: "runtime", maxLength: 72 });
+}
+function runtimeWorktreeNameFromRuntimeId(runtimeId) {
+  return safePathSegment(runtimeId.replace(/^task-/, ""), { fallback: "runtime", maxLength: 72 });
+}
+async function preferredBaseRemotes(repoRoot) {
+  const remotesResult = await runGitCommand(repoRoot, ["remote"]);
+  if (remotesResult.exitCode !== 0) {
+    return [];
+  }
+  const remotes = String(remotesResult.stdout).split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+  if (remotes.length === 0) {
+    return [];
+  }
+  const preferred = [];
+  const pushRemote = (remote) => {
+    if (!preferred.includes(remote)) {
+      preferred.push(remote);
+    }
+  };
+  if (await hasGitRemote(repoRoot, "github")) {
+    pushRemote("github");
+  }
+  for (const remote of remotes) {
+    if (remote === "github") {
+      continue;
+    }
+    const urlResult = await runGitCommand(repoRoot, ["remote", "get-url", remote]);
+    const url = urlResult.exitCode === 0 ? String(urlResult.stdout).trim() : "";
+    if (/github\.com[:/]/i.test(url)) {
+      pushRemote(remote);
+    }
+  }
+  for (const remote of remotes) {
+    pushRemote(remote);
+  }
+  return preferred;
+}
+export {
+  runtimeWorktreeNameFromRuntimeId,
+  runtimeWorktreeName,
+  runtimeBranchName,
+  runGitWithLockRetry,
+  resolveMonorepoBaseRef,
+  resolveMonorepoBaseCommit,
+  provisionRuntimeWorktree,
+  isGitLockContention,
+  ensureProvisioningHostProjectRootEnv,
+  configureRuntimeGitIdentity,
+  cleanupRuntimeWorktree
+};

package/dist/src/native-extract.d.ts

@@ -0,0 +1,2 @@
+export declare function hasEmbeddedNatives(): boolean;
+export declare function extractEmbeddedNative(name: string): string | null;

package/dist/src/native-extract.js

@@ -0,0 +1,44 @@
+// @bun
+// packages/isolation-plugin/src/native-extract.ts
+import { existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from "fs";
+import { tmpdir } from "os";
+import { resolve } from "path";
+
+// packages/isolation-plugin/src/embedded-native-assets.ts
+var embeddedNatives = null;
+
+// packages/isolation-plugin/src/native-extract.ts
+var sharedNativeOutputDir = resolve(tmpdir(), "rig-native");
+var extractionCache = {};
+function hasEmbeddedNatives() {
+  return embeddedNatives != null;
+}
+function extractEmbeddedNative(name) {
+  if (name in extractionCache) {
+    return extractionCache[name] ?? null;
+  }
+  const entry = embeddedNatives?.[name];
+  if (!entry) {
+    extractionCache[name] = null;
+    return null;
+  }
+  try {
+    const targetPath = resolve(sharedNativeOutputDir, entry.fileName);
+    mkdirSync(sharedNativeOutputDir, { recursive: true });
+    const upToDate = existsSync(targetPath) && statSync(targetPath).size === entry.size;
+    if (!upToDate) {
+      const bytes = readFileSync(entry.filePath);
+      const tempPath = `${targetPath}.${process.pid}.${Date.now()}.tmp`;
+      writeFileSync(tempPath, bytes, { mode: 493 });
+      renameSync(tempPath, targetPath);
+    }
+    extractionCache[name] = targetPath;
+  } catch {
+    extractionCache[name] = null;
+  }
+  return extractionCache[name] ?? null;
+}
+export {
+  hasEmbeddedNatives,
+  extractEmbeddedNative
+};

package/dist/src/plugin.d.ts

@@ -1,4 +1,4 @@
 export declare const ISOLATION_PLUGIN_NAME = "@rig/isolation-plugin";
-export declare const isolationPlugin: import("@rig/core").RigPlugin;
-export declare function createIsolationPlugin(): import("@rig/core").RigPlugin;
+export declare const isolationPlugin: import("@rig/core/config").RigPlugin;
+export declare function createIsolationPlugin(): import("@rig/core/config").RigPlugin;
 export default isolationPlugin;