@loicngr/kobo 1.11.36 → 1.11.38

package/dist/server/services/image-service.js

@@ -1,33 +1,15 @@
+import { randomUUID } from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
 import { nanoid } from 'nanoid';
+import { ensureDirectoryInside } from '../utils/safe-path.js';
 const ALLOWED_EXTENSIONS = new Set(['png', 'jpg', 'jpeg', 'gif', 'webp']);
 const IMAGES_DIR = '.ai/images';
 const INDEX_FILE = 'index.json';
 // Per-worktree lock to serialize index.json writes
 const locks = new Map();
 function ensureRealImagesDirectory(worktreePath) {
-    const realWorktree = fs.realpathSync(worktreePath);
-    let current = worktreePath;
-    for (const segment of ['.ai', 'images']) {
-        current = path.join(current, segment);
-        if (fs.existsSync(current)) {
-            const stat = fs.lstatSync(current);
-            if (stat.isSymbolicLink())
-                throw new Error(`Symbolic links are not allowed in image storage: ${current}`);
-            if (!stat.isDirectory())
-                throw new Error(`Image storage path is not a directory: ${current}`);
-        }
-        else {
-            fs.mkdirSync(current);
-        }
-        const realCurrent = fs.realpathSync(current);
-        const relative = path.relative(realWorktree, realCurrent);
-        if (relative === '..' || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
-            throw new Error('Image storage path escapes the worktree');
-        }
-    }
-    return fs.realpathSync(current);
+    return ensureDirectoryInside(worktreePath, '.ai/images');
 }
 function withLock(worktreePath, fn) {
     const prev = locks.get(worktreePath) ?? Promise.resolve();
@@ -56,9 +38,17 @@ function writeIndex(imagesDir, entries) {
     if (fs.existsSync(indexPath) && fs.lstatSync(indexPath).isSymbolicLink()) {
         throw new Error('Symbolic links are not allowed for image index');
     }
-    const tempPath = path.join(imagesDir, `.index-${process.pid}.tmp`);
-    fs.writeFileSync(tempPath, JSON.stringify(entries, null, 2));
-    fs.renameSync(tempPath, indexPath);
+    const tempPath = path.join(imagesDir, `.index-${randomUUID()}.tmp`);
+    let created = false;
+    try {
+        fs.writeFileSync(tempPath, JSON.stringify(entries, null, 2), { flag: 'wx', mode: 0o600 });
+        created = true;
+        fs.renameSync(tempPath, indexPath);
+    }
+    finally {
+        if (created && fs.existsSync(tempPath))
+            fs.unlinkSync(tempPath);
+    }
 }
 /** Save an image buffer to `.ai/images/` and update the index. Returns the UID and relative path. */
 export async function saveImage(worktreePath, fileBuffer, originalName) {
@@ -75,10 +65,17 @@ export async function saveImage(worktreePath, fileBuffer, originalName) {
     await withLock(worktreePath, () => {
         // Write the image file inside the lock so both the file write and index
         // update happen atomically — avoids orphan files on crash between the two.
-        fs.writeFileSync(path.join(imagesDir, filename), fileBuffer);
-        const entries = readIndex(imagesDir);
-        entries.push({ uid, originalName, createdAt: new Date().toISOString() });
-        writeIndex(imagesDir, entries);
+        const imagePath = path.join(imagesDir, filename);
+        fs.writeFileSync(imagePath, fileBuffer, { flag: 'wx', mode: 0o600 });
+        try {
+            const entries = readIndex(imagesDir);
+            entries.push({ uid, originalName, createdAt: new Date().toISOString() });
+            writeIndex(imagesDir, entries);
+        }
+        catch (err) {
+            fs.unlinkSync(imagePath);
+            throw err;
+        }
     });
     return { uid, relativePath: `${IMAGES_DIR}/${filename}` };
 }

package/dist/server/services/pr-checkout-service.js

@@ -5,7 +5,10 @@ import path from 'node:path';
 import * as gitOps from '../utils/git-ops.js';
 import { GitConflictError } from '../utils/git-ops.js';
 import { withGitRepoLock } from '../utils/git-repo-lock.js';
+import { fingerprintWorktree } from '../utils/git-worktree-fingerprint.js';
+import { withWorkspaceLifecycleGuard } from '../utils/workspace-lifecycle-guard.js';
 import { resolveWorkspaceWorktreePath } from '../utils/worktree-paths.js';
+import { hasController } from './agent/orchestrator.js';
 import { createWorktree, listWorktrees, removeWorktreeUnlocked } from './worktree-service.js';
 /**
  * A `pathCollision.worktreePath` decision is untrusted input reaching
@@ -114,8 +117,10 @@ function diagnoseChanges(worktreePath) {
 /** Classify the workspace, if any, that already tracks this branch.
  *  A purged worktree outranks the archived flag: purging always archives, and
  *  "recreate the worktree" is the useful offer, not "unarchive". */
-export function resolveWorkspaceState(workspaces, branch) {
-    const match = workspaces.find((w) => w.workingBranch === branch);
+export function resolveWorkspaceState(workspaces, branch, projectPath) {
+    const match = workspaces.find((w) => w.workingBranch === branch &&
+        typeof w.projectPath === 'string' &&
+        path.resolve(w.projectPath) === path.resolve(projectPath));
     if (!match)
         return { state: 'none' };
     if (match.worktreePurgedAt)
@@ -134,10 +139,13 @@ function safeRevParse(repoPath, ref) {
     }
 }
 /** Hash the observed state so `/resolve` can refuse a plan built on stale facts. */
-export function computeFingerprint(report) {
+export async function computeFingerprint(report) {
     const localHead = safeRevParse(report.projectPath, report.headBranch);
     const remoteHead = safeRevParse(report.projectPath, `origin/${report.headBranch}`);
     const payload = JSON.stringify({
+        contents: report.worktree.state === 'orphan' || report.worktree.state === 'attached'
+            ? await fingerprintWorktree(report.worktree.path)
+            : null,
         localHead,
         remoteHead,
         worktree: report.worktree,
@@ -174,7 +182,7 @@ export function diagnoseLocalState(projectPath, headBranch, worktreesPath, attac
         headBranch,
         targetWorktreePath,
         blockers,
-        workspace: resolveWorkspaceState(workspaces, headBranch),
+        workspace: resolveWorkspaceState(workspaces, headBranch, projectPath),
         worktree,
         localChanges: inspectPath ? diagnoseChanges(inspectPath) : EMPTY_CHANGES,
         ongoingOperation: inspectPath ? gitOps.getOngoingGitOperation(inspectPath) : null,
@@ -249,14 +257,35 @@ export class StaleDiagnosisError extends Error {
  * or a source-branch change.
  */
 export function resolvePrCheckout(input) {
+    const initial = diagnoseLocalState(input.projectPath, input.headBranch, input.worktreesPath, input.attachedPaths, input.workspaces);
+    const owner = initial.worktree.state === 'attached'
+        ? initial.worktree.workspaceId
+        : initial.workspace.state !== 'none'
+            ? initial.workspace.id
+            : null;
+    const resolve = () => resolvePrCheckoutLocked(input, owner);
+    return owner ? withWorkspaceLifecycleGuard(owner, resolve) : resolve();
+}
+function resolvePrCheckoutLocked(input, owner) {
     return withGitRepoLock(input.projectPath, async () => {
+        if (owner && hasController(owner))
+            throw new Error('Stop the workspace agent before changing its checkout');
         const applied = [];
         // 1. Refresh, then refuse a plan built on facts that no longer hold.
         gitOps.fetchSourceBranch(input.projectPath, input.headBranch);
         applied.push({ kind: 'fetch', detail: `origin/${input.headBranch}` });
         const fresh = diagnoseLocalState(input.projectPath, input.headBranch, input.worktreesPath, input.attachedPaths ?? new Map(), input.workspaces ?? []);
-        if (computeFingerprint(fresh) !== input.fingerprint)
+        if ((await computeFingerprint(fresh)) !== input.fingerprint)
             throw new StaleDiagnosisError(fresh);
+        if ((fresh.worktree.state === 'orphan' || fresh.worktree.state === 'attached') &&
+            input.decisions.orphanWorktree === 'create-elsewhere') {
+            throw new Error('Branch is already checked out. Attach its existing worktree instead.');
+        }
+        if (fresh.localChanges.present &&
+            (input.decisions.localChanges ?? 'keep') === 'keep' &&
+            input.decisions.divergence === 'reset-hard') {
+            throw new Error('Cannot preserve local changes during a hard reset. Stash or commit them first, or keep the branch.');
+        }
         // 2. Clear stale worktree metadata before anything needs the path.
         if (fresh.worktree.state === 'stale-metadata') {
             git(input.projectPath, ['worktree', 'prune']);

package/dist/server/services/pr-watcher-service.js

@@ -226,7 +226,7 @@ export async function checkPrStatuses() {
                     });
                     prMergedHook = lifecycleHookService.onPrMerged(ws.id, { prNumber: pr.number, prUrl: pr.url });
                 }
-                if (['extracting', 'brainstorming', 'executing'].includes(ws.status) || hasController(ws.id)) {
+                if (['extracting', 'brainstorming', 'executing', 'compacting'].includes(ws.status) || hasController(ws.id)) {
                     // Agent is working — update the cache but skip auto-archive.
                     // (The defensive base preservation from the no-base branch doesn't apply here
                     // because we ARE in the OPEN→MERGED/CLOSED branch which always has a base.)
@@ -252,7 +252,9 @@ export async function checkPrStatuses() {
                 if (stale())
                     return;
                 const current = getWorkspace(ws.id);
-                if (!current || ['extracting', 'brainstorming', 'executing'].includes(current.status) || hasController(ws.id))
+                if (!current ||
+                    ['extracting', 'brainstorming', 'executing', 'compacting'].includes(current.status) ||
+                    hasController(ws.id))
                     return;
                 try {
                     destroyTerminal(ws.id);
@@ -320,7 +322,7 @@ export async function checkPrStatuses() {
                     emitEphemeral(ws.id, 'pr:merge-conflict', payload);
                     markUnread(ws.id);
                 }
-                const notBusy = !['extracting', 'brainstorming', 'executing'].includes(ws.status);
+                const notBusy = !['extracting', 'brainstorming', 'executing', 'compacting'].includes(ws.status);
                 if (notBusy && !prev.readyToMerge && pr.readyToMerge) {
                     emitEphemeral(ws.id, 'pr:ready-to-merge', payload);
                     markUnread(ws.id);

package/dist/server/services/quota-backoff-service.js

@@ -2,7 +2,15 @@ import { getDb } from '../db/index.js';
 import { emitEphemeral } from './websocket-service.js';
 import { getWorkspace } from './workspace-service.js';
 const timers = new Map();
+let suspended = false;
 let onFireCallback = null;
+/** Stop in-memory delivery without consuming the schedules needed by the next boot. */
+export function suspendForShutdown() {
+    suspended = true;
+    for (const timer of timers.values())
+        clearTimeout(timer);
+    timers.clear();
+}
 function rowToPending(row) {
     return {
         workspaceId: row.workspace_id,
@@ -26,10 +34,9 @@ export function arm(workspaceId, delayMs, meta) {
     const db = getDb();
     const now = new Date();
     const targetAt = new Date(now.getTime() + delayMs).toISOString();
-    const existing = db
-        .prepare('SELECT retry_count FROM pending_quota_backoffs WHERE workspace_id = ?')
-        .get(workspaceId);
-    const retryCount = (existing?.retry_count ?? 0) + 1;
+    const retryCount = meta.retryCount;
+    if (!Number.isSafeInteger(retryCount) || retryCount < 1)
+        throw new Error('retryCount must be a positive integer');
     db.prepare(`INSERT INTO pending_quota_backoffs (workspace_id, target_at, resets_at, source, reason, retry_count, created_at)
      VALUES (?, ?, ?, ?, ?, ?, ?)
      ON CONFLICT(workspace_id) DO UPDATE SET
@@ -42,9 +49,12 @@ export function arm(workspaceId, delayMs, meta) {
     const previous = timers.get(workspaceId);
     if (previous)
         clearTimeout(previous);
-    const timer = setTimeout(() => fireOrSkip(workspaceId), Math.max(0, delayMs));
-    timer.unref?.();
-    timers.set(workspaceId, timer);
+    timers.delete(workspaceId);
+    if (!suspended) {
+        const timer = setTimeout(() => fireOrSkip(workspaceId), Math.max(0, delayMs));
+        timer.unref?.();
+        timers.set(workspaceId, timer);
+    }
     emitEphemeral(workspaceId, 'agent:quota-backoff', {
         targetAt,
         resetsAt: meta.resetsAt,
@@ -90,6 +100,8 @@ export function setOnFireCallback(fn) {
  * archived or missing workspaces are deleted without firing.
  */
 export function restoreOnBoot(onFire) {
+    suspendForShutdown();
+    suspended = false;
     setOnFireCallback(onFire);
     const db = getDb();
     const rows = db.prepare('SELECT * FROM pending_quota_backoffs').all();
@@ -107,7 +119,12 @@ export function restoreOnBoot(onFire) {
 }
 /** Internal — invoked when a timer fires. */
 function fireOrSkip(workspaceId) {
+    if (suspended)
+        return;
     timers.delete(workspaceId);
+    const pending = getPending(workspaceId);
+    if (!pending)
+        return;
     // Final archive check before firing — workspace might have been archived
     // between the timer being armed and now.
     const ws = getWorkspace(workspaceId);
@@ -124,7 +141,7 @@ function fireOrSkip(workspaceId) {
     const cb = onFireCallback;
     if (!cb)
         return;
-    cb(workspaceId);
+    cb(workspaceId, pending);
 }
 /** @internal test-only */
 export const _timers = timers;

package/dist/server/services/wakeup-service.js

@@ -1,5 +1,6 @@
 import { getDb } from '../db/index.js';
 import { slugifyProjectName } from '../utils/project-slug.js';
+import { isWorkspaceLifecycleBusy } from '../utils/workspace-lifecycle-guard.js';
 import { resolveWorkspaceWorktreePath } from '../utils/worktree-paths.js';
 import * as orchestrator from './agent/orchestrator.js';
 import * as settingsService from './settings-service.js';
@@ -12,6 +13,14 @@ const AUTONOMOUS_LOOP_SENTINEL = '<<autonomous-loop-dynamic>>';
 const AUTONOMOUS_LOOP_FALLBACK_PROMPT = 'Continue where you left off.';
 /** In-memory timers — cleared on cancel/fire; rebuilt on boot via rehydrate. */
 const timers = new Map();
+let suspended = false;
+/** Preserve persisted wakeups while preventing delivery during teardown. */
+export function suspendForShutdown() {
+    suspended = true;
+    for (const timer of timers.values())
+        clearTimeout(timer);
+    timers.clear();
+}
 function clamp(n, lo, hi) {
     return Math.max(lo, Math.min(hi, n));
 }
@@ -54,9 +63,12 @@ export function schedule(workspaceId, delaySeconds, prompt, reason, agentSession
         db.prepare(`INSERT OR REPLACE INTO pending_wakeups
          (workspace_id, target_at, prompt, reason, created_at, agent_session_id)
        VALUES (?, ?, ?, ?, ?, ?)`).run(workspaceId, targetAtIso, effectivePrompt, reason ?? null, new Date().toISOString(), agentSessionId ?? null);
-        const timeout = setTimeout(() => fire(workspaceId), clampedSeconds * 1000);
-        timeout.unref?.();
-        timers.set(workspaceId, timeout);
+        timers.delete(workspaceId);
+        if (!suspended) {
+            const timeout = setTimeout(() => fire(workspaceId), clampedSeconds * 1000);
+            timeout.unref?.();
+            timers.set(workspaceId, timeout);
+        }
         emitEphemeral(workspaceId, 'wakeup:scheduled', { targetAt: targetAtIso, reason });
     }
     catch (err) {
@@ -105,6 +117,8 @@ export function isWakeupScheduled(workspaceId) {
 }
 /** Re-register timers for rows persisted across restart. Skips stale entries. */
 export function rehydrate() {
+    suspendForShutdown();
+    suspended = false;
     try {
         const db = getDb();
         const rows = db.prepare('SELECT * FROM pending_wakeups').all();
@@ -139,12 +153,18 @@ export function rehydrate() {
 }
 /** Internal — invoked by setTimeout. */
 function fire(workspaceId) {
+    if (suspended)
+        return;
     try {
         const db = getDb();
         const row = db.prepare('SELECT * FROM pending_wakeups WHERE workspace_id = ?').get(workspaceId);
         timers.delete(workspaceId);
         if (!row)
             return;
+        if (isWorkspaceLifecycleBusy(workspaceId)) {
+            defer(workspaceId, row);
+            return;
+        }
         if (orchestrator.hasController(workspaceId)) {
             // Claude can keep the stream open after a result while a background
             // task runs. Waiting for that controller to disappear deadlocks a

package/dist/server/services/websocket-service.js

@@ -199,11 +199,19 @@ export function emit(workspaceId, type, payload, sessionId) {
  * Broadcast an event to subscribed clients WITHOUT persisting to the database.
  * Used for ephemeral status updates (e.g., dev-server status) that don't need replay.
  */
-export function emitEphemeral(workspaceId, type, payload) {
+export function emitEphemeral(workspaceId, type, payload, sessionId) {
     recordActivity(workspaceId, type, payload);
     const id = nanoid();
     const createdAt = new Date().toISOString();
-    const event = { id, workspaceId, type, payload, createdAt, replayable: false };
+    const event = {
+        id,
+        workspaceId,
+        type,
+        payload,
+        createdAt,
+        replayable: false,
+        ...(sessionId ? { sessionId } : {}),
+    };
     const message = JSON.stringify(event);
     let sendErrorLogged = false;
     for (const [ws, subs] of clients) {

package/dist/server/services/workspace-service.js

@@ -16,10 +16,11 @@ const VALID_TRANSITIONS = {
     // workspace with a distinct brainstormModel silently lost its backoff: the
     // transition threw, the error was swallowed, and the very next lines
     // cancelled the timer that had just been armed.
-    extracting: ['extracting', 'brainstorming', 'idle', 'error', 'awaiting-user', 'quota'],
-    brainstorming: ['executing', 'completed', 'idle', 'error', 'awaiting-user', 'quota'],
-    executing: ['completed', 'idle', 'error', 'quota', 'awaiting-user'],
-    'awaiting-user': ['executing', 'brainstorming', 'extracting', 'idle', 'error', 'completed', 'quota'],
+    extracting: ['compacting', 'extracting', 'brainstorming', 'idle', 'error', 'awaiting-user', 'quota'],
+    brainstorming: ['compacting', 'executing', 'completed', 'idle', 'error', 'awaiting-user', 'quota'],
+    executing: ['compacting', 'completed', 'idle', 'error', 'quota', 'awaiting-user'],
+    'awaiting-user': ['compacting', 'executing', 'brainstorming', 'extracting', 'idle', 'error', 'completed', 'quota'],
+    compacting: ['extracting', 'brainstorming', 'executing', 'awaiting-user', 'completed', 'idle', 'error', 'quota'],
     completed: ['idle', 'executing'],
     idle: ['executing', 'brainstorming', 'extracting', 'error'],
     error: ['idle', 'executing', 'brainstorming', 'extracting'],
@@ -196,6 +197,9 @@ export function updateWorkspaceStatus(id, status) {
     }
     const now = new Date().toISOString();
     db.prepare('UPDATE workspaces SET status = ?, updated_at = ? WHERE id = ?').run(status, now, id);
+    if (status === 'compacting' || workspace.status === 'compacting') {
+        emitEphemeral(id, 'workspace:status', { status });
+    }
     return getWorkspace(id);
 }
 const WORKSPACE_NAME_MAX_LENGTH = 200;

package/dist/server/services/worktree-purge-service.js

@@ -1,6 +1,7 @@
 import { execFile } from 'node:child_process';
 import fs from 'node:fs';
 import { promisify } from 'node:util';
+import { assertAgentStopped } from '../utils/agent-stop-result.js';
 import { logError, logWarn } from '../utils/logger.js';
 import { withWorkspaceLifecycleGuard } from '../utils/workspace-lifecycle-guard.js';
 import * as agentManager from './agent/orchestrator.js';
@@ -29,19 +30,14 @@ async function purgeWorktreeGuarded(workspaceId, expectedArchivedAt) {
     const warnings = [];
     // `removeWorktree` runs later in this same function — the agent must be dead
     // by then, not merely asked to stop.
-    try {
-        await agentManager.stopAgentAndWait(workspaceId, undefined, 'purge');
-    }
-    catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        logError('purge', `stopAgent failed for '${workspace.name}'`, { workspaceId: workspace.id, error: msg });
-    }
+    assertAgentStopped(await agentManager.stopAgentAndWait(workspaceId, undefined, 'purge'));
     try {
         await devServerService.stopDevServer(workspaceId);
     }
     catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
         logError('purge', `stopDevServer failed for '${workspace.name}'`, { workspaceId: workspace.id, error: msg });
+        throw err;
     }
     try {
         destroyTerminal(workspaceId);

package/dist/server/utils/agent-stop-result.js

@@ -0,0 +1,12 @@
+export class AgentStopError extends Error {
+    outcome;
+    code = 'agent-stop-incomplete';
+    constructor(outcome) {
+        super(`Agent stop is not confirmed (${outcome}). Wait for it to stop and retry.`);
+        this.outcome = outcome;
+    }
+}
+export function assertAgentStopped(outcome) {
+    if (outcome !== 'stopped' && outcome !== 'not-running')
+        throw new AgentStopError(outcome);
+}

package/dist/server/utils/git-ops.js

@@ -669,7 +669,13 @@ export function listProperCommits(repoPath, workingBranch, newBase, oldBase) {
  * `repoPath`. The caller (and the Kōbō worktree orchestrator) must ensure
  * `workingBranch` is the active branch — do NOT add a `git checkout` here.
  */
+export function assertCurrentBranch(repoPath, expected) {
+    const actual = getCurrentBranch(repoPath);
+    if (actual !== expected)
+        throw new Error(`Expected checkout '${expected}', found '${actual || 'detached HEAD'}'`);
+}
 export function reconstructBranchOnto(repoPath, workingBranch, newBase, commits) {
+    assertCurrentBranch(repoPath, workingBranch);
     const baseRef = resolveBase(repoPath, newBase);
     const backupBranch = `kobo-backup/${workingBranch}-${Date.now()}`;
     git(repoPath, ['branch', backupBranch, workingBranch]);
@@ -749,8 +755,9 @@ export function pruneBackupBranches(repoPath, workingBranch, keep = 3) {
 }
 /** Abort any in-progress operation, then hard-reset `workingBranch` to a backup branch. */
 export function restoreBranchFromBackup(repoPath, workingBranch, backupBranch) {
+    assertCurrentBranch(repoPath, workingBranch);
     abortOngoingGitOperation(repoPath);
-    git(repoPath, ['checkout', '-q', workingBranch]);
+    assertCurrentBranch(repoPath, workingBranch);
     git(repoPath, ['reset', '--hard', backupBranch]);
 }
 /** Return structured diff shortstat between two refs (three-dot merge base). */

package/dist/server/utils/git-worktree-fingerprint.js

@@ -0,0 +1,86 @@
+import { execFileSync, spawn } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { constants } from 'node:fs';
+import { lstat, open, readlink, realpath } from 'node:fs/promises';
+import path from 'node:path';
+/** Hash diffs and untracked contents without loading large files into memory. */
+export async function fingerprintWorktree(cwd) {
+    return fingerprintRepository(await realpath(cwd), new Set());
+}
+/** Nested repositories contribute HEAD and their own Git-filtered working state, never a .git traversal. */
+async function fingerprintRepository(cwd, visited) {
+    if (visited.has(cwd))
+        throw new Error('Cannot fingerprint a recursive repository path');
+    visited.add(cwd);
+    const gitOptions = { cwd, encoding: 'utf8', timeout: 30_000, maxBuffer: 16 * 1024 * 1024 };
+    const topLevel = execFileSync('git', ['rev-parse', '--show-toplevel'], gitOptions).trim();
+    if ((await realpath(topLevel)) !== cwd)
+        throw new Error('Working tree changed during fingerprinting; retry diagnosis');
+    const hash = createHash('sha256');
+    let head;
+    try {
+        head = execFileSync('git', ['rev-parse', '--verify', '--quiet', 'HEAD'], gitOptions).trim();
+    }
+    catch (err) {
+        // A freshly initialized nested repository has no commit yet. Other Git failures remain fatal.
+        if (err.status !== 1)
+            throw err;
+        head = 'unborn';
+    }
+    hash.update(`HEAD\0${head}\0`);
+    for (const staged of [false, true]) {
+        hash.update(staged ? 'index\0' : 'working-tree\0');
+        await new Promise((resolve, reject) => {
+            const child = spawn('git', ['diff', '--no-ext-diff', '--no-textconv', '--binary', '--no-color', ...(staged ? ['--cached'] : []), '--'], { cwd, stdio: ['ignore', 'pipe', 'pipe'], timeout: 30_000 });
+            child.stdout.on('data', (chunk) => hash.update(chunk));
+            child.stderr.resume();
+            child.on('error', reject);
+            child.on('close', (code) => (code === 0 ? resolve() : reject(new Error('Cannot fingerprint working tree diff'))));
+        });
+    }
+    const names = execFileSync('git', ['ls-files', '--others', '--exclude-standard', '-z'], {
+        cwd,
+        encoding: 'utf8',
+        timeout: 30_000,
+        maxBuffer: 16 * 1024 * 1024,
+    })
+        .split('\0')
+        .filter(Boolean)
+        .sort();
+    for (const name of names) {
+        hash.update(`\0untracked\0${name}\0`);
+        // Remove Git's trailing slash for nested repos before lstat, so a link is never dereferenced.
+        const filePath = path.resolve(cwd, name);
+        const stat = await lstat(filePath);
+        hash.update(`${stat.mode}\0`);
+        if (stat.isSymbolicLink()) {
+            hash.update(await readlink(filePath));
+        }
+        else if (stat.isFile()) {
+            const file = await open(filePath, constants.O_RDONLY | constants.O_NOFOLLOW);
+            try {
+                const before = await file.stat();
+                for await (const chunk of file.createReadStream({ autoClose: false }))
+                    hash.update(chunk);
+                const after = await file.stat();
+                if (before.size !== after.size || before.mtimeMs !== after.mtimeMs || before.ctimeMs !== after.ctimeMs)
+                    throw new Error('Working tree changed during fingerprinting; retry diagnosis');
+            }
+            finally {
+                await file.close();
+            }
+        }
+        else if (stat.isDirectory()) {
+            // `ls-files --others` reports an embedded repository as a directory instead of its files.
+            const nestedPath = await realpath(filePath);
+            const relative = path.relative(cwd, nestedPath);
+            if (!relative || relative === '..' || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative))
+                throw new Error('Nested repository escapes the working tree');
+            hash.update(`\0repository\0${await fingerprintRepository(nestedPath, visited)}\0`);
+        }
+        else {
+            throw new Error('Cannot fingerprint a non-regular untracked file');
+        }
+    }
+    return hash.digest('hex');
+}

package/dist/server/utils/safe-path.js

@@ -66,3 +66,24 @@ function assertLeafIsNotSymlink(candidate) {
         throw err;
     }
 }
+/** Create storage directories without accepting symlinked path components. */
+export function ensureDirectoryInside(rootPath, relativePath) {
+    assertPathInside(rootPath, relativePath);
+    const root = fs.realpathSync(rootPath);
+    let current = root;
+    for (const segment of relativePath.split(path.sep).filter(Boolean)) {
+        current = path.join(current, segment);
+        try {
+            fs.mkdirSync(current);
+        }
+        catch (err) {
+            if (err.code !== 'EEXIST')
+                throw err;
+        }
+        const stat = fs.lstatSync(current);
+        if (stat.isSymbolicLink() || !stat.isDirectory())
+            throw new Error('Symbolic links are not allowed in storage directories');
+        current = resolveExistingPathInside(root, current);
+    }
+    return current;
+}

package/dist/server/utils/script-runner.js

@@ -3,6 +3,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import * as wsService from '../services/websocket-service.js';
 import { getIndexLockPath } from './git-ops.js';
+import { ensureDirectoryInside } from './safe-path.js';
 /** Default wall-clock budget for a user script before it is force-killed. */
 export const SCRIPT_TIMEOUT_MS = 5 * 60 * 1000; // 5 minutes
 /**
@@ -13,10 +14,31 @@ export const SCRIPT_TIMEOUT_MS = 5 * 60 * 1000; // 5 minutes
 export function runScript(opts) {
     const { workspaceId, worktreePath, script, eventPrefix, tmpFileName, env, extraEnv } = opts;
     const timeoutMs = opts.timeoutMs ?? SCRIPT_TIMEOUT_MS;
+    let scriptPath;
+    let scriptDirectory;
+    const cleanup = () => {
+        if (scriptPath) {
+            try {
+                fs.unlinkSync(scriptPath);
+            }
+            catch {
+                /* best effort */
+            }
+        }
+        if (scriptDirectory) {
+            try {
+                fs.rmdirSync(scriptDirectory);
+            }
+            catch {
+                /* best effort */
+            }
+        }
+    };
     return new Promise((resolve) => {
-        const scriptPath = path.join(worktreePath, '.ai', tmpFileName);
-        fs.mkdirSync(path.dirname(scriptPath), { recursive: true });
-        fs.writeFileSync(scriptPath, script, { mode: 0o755 });
+        const storage = ensureDirectoryInside(worktreePath, '.ai');
+        scriptDirectory = fs.mkdtempSync(path.join(storage, '.script-'));
+        scriptPath = path.join(scriptDirectory, path.basename(tmpFileName));
+        fs.writeFileSync(scriptPath, script, { mode: 0o700, flag: 'wx' });
         const proc = spawn('bash', [scriptPath], {
             cwd: worktreePath,
             env: {
@@ -93,12 +115,7 @@ export function runScript(opts) {
                 return;
             settled = true;
             clearTimeout(timeout);
-            try {
-                fs.unlinkSync(scriptPath);
-            }
-            catch {
-                /* best-effort */
-            }
+            cleanup();
             if (exitCode === 0) {
                 wsService.emitEphemeral(workspaceId, `${eventPrefix}:complete`, { hadOutput: outputEmitted });
             }
@@ -119,5 +136,11 @@ export function runScript(opts) {
         proc.on('close', (code) => {
             finish(code ?? 1);
         });
+    }).catch((err) => {
+        cleanup();
+        const message = err instanceof Error ? err.message : String(err);
+        wsService.emit(workspaceId, `${eventPrefix}:output`, { text: `[kobo] Script failed to start: ${message}` });
+        wsService.emitEphemeral(workspaceId, `${eventPrefix}:error`, { exitCode: 1, message });
+        return { exitCode: 1 };
     });
 }