@overlordai/worker 1.0.53 → 1.0.54

package/dist/executor/codex.executor.js

@@ -1,8 +1,48 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CodexExecutor = void 0;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
 const protocol_1 = require("@overlordai/protocol");
 const base_executor_js_1 = require("./base.executor.js");
+const pino_1 = __importDefault(require("pino"));
+const log = (0, pino_1.default)({ name: 'codex-executor' });
 /**
  * Executor for OpenAI Codex CLI.
  *
@@ -11,41 +51,39 @@ const base_executor_js_1 = require("./base.executor.js");
  */
 class CodexExecutor extends base_executor_js_1.AgentExecutor {
     agentType = protocol_1.AgentType.CODEX;
+    authErrorPatterns = [
+        { pattern: /Authentication failed|Please log in|invalid.*api.*key/i, failureType: 'auth_failure' },
+        { pattern: /Rate limit exceeded|too many requests/i, failureType: 'rate_limit' },
+        { pattern: /command not found|ENOENT/i, failureType: 'binary_missing' },
+    ];
     getStartCommand() {
         return 'codex';
     }
-    buildArgs(config, _workspacePath) {
-        const args = ['--full-auto'];
-        if (config.maxTurns) {
-            args.push('--max-turns', String(config.maxTurns));
+    buildArgs(_config, _workspacePath) {
+        return ['--full-auto'];
+    }
+    prepareEnvironment(worktreePath, realHome) {
+        // Codex stores config in ~/.codex — symlink entire directory if it exists
+        try {
+            const src = path.join(realHome, '.codex');
+            if (!fs.existsSync(src))
+                return; // skip to avoid dangling symlink
+            const dst = path.join(worktreePath, '.codex');
+            fs.symlinkSync(src, dst);
+        }
+        catch (err) {
+            if (err.code !== 'EEXIST') {
+                log.warn({ worktreePath, err }, 'Codex environment setup failed (non-fatal)');
+            }
         }
-        return args;
+    }
+    buildEnvVars(_realHome) {
+        return {};
     }
     detectPrompt(cleanOutput) {
         // Match Codex's prompt indicators at end of output
         return /[>❯]\s*$/.test(cleanOutput.trimEnd());
     }
-    detectStageComplete(cleanOutput, stage) {
-        if (cleanOutput.includes(`${protocol_1.STAGE_DONE_SENTINEL}${stage}]]`)) {
-            return true;
-        }
-        return false;
-    }
-    detectAuthError(cleanOutput) {
-        if (/Authentication failed|Please log in|invalid.*api.*key/i.test(cleanOutput)) {
-            return { detected: true, failureType: 'auth_failure' };
-        }
-        if (/Rate limit exceeded|too many requests/i.test(cleanOutput)) {
-            return { detected: true, failureType: 'rate_limit' };
-        }
-        if (/command not found|ENOENT/i.test(cleanOutput)) {
-            return { detected: true, failureType: 'binary_missing' };
-        }
-        return null;
-    }
-    formatCommand(stage) {
-        return stage.command ?? stage.name;
-    }
 }
 exports.CodexExecutor = CodexExecutor;
 //# sourceMappingURL=codex.executor.js.map

package/dist/executor/codex.executor.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex.executor.js","sourceRoot":"","sources":["../../src/executor/codex.executor.ts"],"names":[],"mappings":";;;AAAA,mDAAsE;AAEtE,yDAAmD;AAGnD;;;;;GAKG;AACH,MAAa,aAAc,SAAQ,gCAAa;IACrC,SAAS,GAAG,oBAAS,CAAC,KAAK,CAAC;IAErC,eAAe;QACb,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,SAAS,CAAC,MAAsB,EAAE,cAAsB;QACtD,MAAM,IAAI,GAAa,CAAC,aAAa,CAAC,CAAC;QAEvC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QACpD,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,YAAY,CAAC,WAAmB;QAC9B,mDAAmD;QACnD,OAAO,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,mBAAmB,CAAC,WAAmB,EAAE,KAAa;QACpD,IAAI,WAAW,CAAC,QAAQ,CAAC,GAAG,8BAAmB,GAAG,KAAK,IAAI,CAAC,EAAE,CAAC;YAC7D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,eAAe,CAAC,WAAmB;QACjC,IAAI,wDAAwD,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/E,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;QACzD,CAAC;QACD,IAAI,wCAAwC,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/D,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;QACvD,CAAC;QACD,IAAI,2BAA2B,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAClD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC;QAC3D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,aAAa,CAAC,KAAkB;QAC9B,OAAO,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC;IACrC,CAAC;CACF;AA7CD,sCA6CC"}
+{"version":3,"file":"codex.executor.js","sourceRoot":"","sources":["../../src/executor/codex.executor.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,4CAA8B;AAC9B,gDAAkC;AAClC,mDAAiD;AAEjD,yDAAmD;AAEnD,gDAAwB;AAExB,MAAM,GAAG,GAAG,IAAA,cAAI,EAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;AAE7C;;;;;GAKG;AACH,MAAa,aAAc,SAAQ,gCAAa;IACrC,SAAS,GAAG,oBAAS,CAAC,KAAK,CAAC;IAElB,iBAAiB,GAAuB;QACzD,EAAE,OAAO,EAAE,wDAAwD,EAAE,WAAW,EAAE,cAAc,EAAE;QAClG,EAAE,OAAO,EAAE,wCAAwC,EAAE,WAAW,EAAE,YAAY,EAAE;QAChF,EAAE,OAAO,EAAE,2BAA2B,EAAE,WAAW,EAAE,gBAAgB,EAAE;KACxE,CAAC;IAEF,eAAe;QACb,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,SAAS,CAAC,OAAuB,EAAE,cAAsB;QACvD,OAAO,CAAC,aAAa,CAAC,CAAC;IACzB,CAAC;IAED,kBAAkB,CAAC,YAAoB,EAAE,QAAgB;QACvD,0EAA0E;QAC1E,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC1C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,OAAO,CAAC,iCAAiC;YAClE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;YAC9C,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1B,GAAG,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,GAAG,EAAE,EAAE,4CAA4C,CAAC,CAAC;YAChF,CAAC;QACH,CAAC;IACH,CAAC;IAED,YAAY,CAAC,SAAiB;QAC5B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,YAAY,CAAC,WAAmB;QAC9B,mDAAmD;QACnD,OAAO,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IAChD,CAAC;CACF;AAvCD,sCAuCC"}

package/dist/executor/cursor.executor.d.ts

@@ -1,19 +1,18 @@
-import { AgentType } from '@overlordai/protocol';
-import type { ConfigSnapshot, StageConfig } from '@overlordai/protocol';
+import type { ConfigSnapshot } from '@overlordai/protocol';
 import { AgentExecutor } from './base.executor.js';
-import type { AuthErrorResult } from './base.executor.js';
+import type { AuthErrorPattern } from './base.executor.js';
 /**
  * Executor for Cursor Agent CLI.
  *
  * Uses --yolo flag for fully automated mode.
  */
 export declare class CursorExecutor extends AgentExecutor {
-    readonly agentType = AgentType.CURSOR;
+    readonly agentType: "cursor";
+    protected readonly authErrorPatterns: AuthErrorPattern[];
     getStartCommand(): string;
     buildArgs(_config: ConfigSnapshot, _workspacePath: string): string[];
+    prepareEnvironment(_worktreePath: string, _realHome: string): void;
+    buildEnvVars(_realHome: string): Record<string, string>;
     detectPrompt(cleanOutput: string): boolean;
-    detectStageComplete(cleanOutput: string, stage: string): boolean;
-    detectAuthError(cleanOutput: string): AuthErrorResult | null;
-    formatCommand(stage: StageConfig): string;
 }
 //# sourceMappingURL=cursor.executor.d.ts.map

package/dist/executor/cursor.executor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cursor.executor.d.ts","sourceRoot":"","sources":["../../src/executor/cursor.executor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAuB,MAAM,sBAAsB,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE1D;;;;GAIG;AACH,qBAAa,cAAe,SAAQ,aAAa;IAC/C,QAAQ,CAAC,SAAS,oBAAoB;IAEtC,eAAe,IAAI,MAAM;IAIzB,SAAS,CAAC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE;IAIpE,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO;IAK1C,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAOhE,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI;IAa5D,aAAa,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM;CAG1C"}
+{"version":3,"file":"cursor.executor.d.ts","sourceRoot":"","sources":["../../src/executor/cursor.executor.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE3D;;;;GAIG;AACH,qBAAa,cAAe,SAAQ,aAAa;IAC/C,QAAQ,CAAC,SAAS,WAAoB;IAEtC,SAAS,CAAC,QAAQ,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,CAItD;IAEF,eAAe,IAAI,MAAM;IAIzB,SAAS,CAAC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE;IAIpE,kBAAkB,CAAC,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;IAIlE,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAIvD,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO;CAI3C"}

package/dist/executor/cursor.executor.js

@@ -10,37 +10,27 @@ const base_executor_js_1 = require("./base.executor.js");
  */
 class CursorExecutor extends base_executor_js_1.AgentExecutor {
     agentType = protocol_1.AgentType.CURSOR;
+    authErrorPatterns = [
+        { pattern: /Authentication failed|Please log in/i, failureType: 'auth_failure' },
+        { pattern: /Rate limit exceeded/i, failureType: 'rate_limit' },
+        { pattern: /command not found|ENOENT/i, failureType: 'binary_missing' },
+    ];
     getStartCommand() {
         return 'cursor';
     }
     buildArgs(_config, _workspacePath) {
-        return ['--yolo'];
+        return ['agent', '--yolo'];
+    }
+    prepareEnvironment(_worktreePath, _realHome) {
+        // Cursor uses XDG .config/ which is already symlinked by workspace-manager
+    }
+    buildEnvVars(_realHome) {
+        return {};
     }
     detectPrompt(cleanOutput) {
         // Match Cursor Agent's ? prompt at end of output
         return /\?\s*$/.test(cleanOutput.trimEnd());
     }
-    detectStageComplete(cleanOutput, stage) {
-        if (cleanOutput.includes(`${protocol_1.STAGE_DONE_SENTINEL}${stage}]]`)) {
-            return true;
-        }
-        return false;
-    }
-    detectAuthError(cleanOutput) {
-        if (/Authentication failed|Please log in/i.test(cleanOutput)) {
-            return { detected: true, failureType: 'auth_failure' };
-        }
-        if (/Rate limit exceeded/i.test(cleanOutput)) {
-            return { detected: true, failureType: 'rate_limit' };
-        }
-        if (/command not found|ENOENT/i.test(cleanOutput)) {
-            return { detected: true, failureType: 'binary_missing' };
-        }
-        return null;
-    }
-    formatCommand(stage) {
-        return stage.command ?? stage.name;
-    }
 }
 exports.CursorExecutor = CursorExecutor;
 //# sourceMappingURL=cursor.executor.js.map

package/dist/executor/cursor.executor.js.map

@@ -1 +1 @@
-{"version":3,"file":"cursor.executor.js","sourceRoot":"","sources":["../../src/executor/cursor.executor.ts"],"names":[],"mappings":";;;AAAA,mDAAsE;AAEtE,yDAAmD;AAGnD;;;;GAIG;AACH,MAAa,cAAe,SAAQ,gCAAa;IACtC,SAAS,GAAG,oBAAS,CAAC,MAAM,CAAC;IAEtC,eAAe;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,SAAS,CAAC,OAAuB,EAAE,cAAsB;QACvD,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpB,CAAC;IAED,YAAY,CAAC,WAAmB;QAC9B,iDAAiD;QACjD,OAAO,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,mBAAmB,CAAC,WAAmB,EAAE,KAAa;QACpD,IAAI,WAAW,CAAC,QAAQ,CAAC,GAAG,8BAAmB,GAAG,KAAK,IAAI,CAAC,EAAE,CAAC;YAC7D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,eAAe,CAAC,WAAmB;QACjC,IAAI,sCAAsC,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC7D,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;QACzD,CAAC;QACD,IAAI,sBAAsB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC7C,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;QACvD,CAAC;QACD,IAAI,2BAA2B,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAClD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC;QAC3D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,aAAa,CAAC,KAAkB;QAC9B,OAAO,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC;IACrC,CAAC;CACF;AAvCD,wCAuCC"}
+{"version":3,"file":"cursor.executor.js","sourceRoot":"","sources":["../../src/executor/cursor.executor.ts"],"names":[],"mappings":";;;AAAA,mDAAiD;AAEjD,yDAAmD;AAGnD;;;;GAIG;AACH,MAAa,cAAe,SAAQ,gCAAa;IACtC,SAAS,GAAG,oBAAS,CAAC,MAAM,CAAC;IAEnB,iBAAiB,GAAuB;QACzD,EAAE,OAAO,EAAE,sCAAsC,EAAE,WAAW,EAAE,cAAc,EAAE;QAChF,EAAE,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,YAAY,EAAE;QAC9D,EAAE,OAAO,EAAE,2BAA2B,EAAE,WAAW,EAAE,gBAAgB,EAAE;KACxE,CAAC;IAEF,eAAe;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,SAAS,CAAC,OAAuB,EAAE,cAAsB;QACvD,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC7B,CAAC;IAED,kBAAkB,CAAC,aAAqB,EAAE,SAAiB;QACzD,2EAA2E;IAC7E,CAAC;IAED,YAAY,CAAC,SAAiB;QAC5B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,YAAY,CAAC,WAAmB;QAC9B,iDAAiD;QACjD,OAAO,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9C,CAAC;CACF;AA7BD,wCA6BC"}

package/dist/executor/custom.executor.d.ts

@@ -1,21 +1,29 @@
-import { AgentType } from '@overlordai/protocol';
-import type { ConfigSnapshot, StageConfig } from '@overlordai/protocol';
+import type { ConfigSnapshot } from '@overlordai/protocol';
 import { AgentExecutor } from './base.executor.js';
-import type { AuthErrorResult } from './base.executor.js';
+import type { AuthErrorPattern } from './base.executor.js';
 /**
  * Executor for custom/user-provided agent CLIs.
  *
  * The custom executor uses the configSnapshot's customCommand field
  * to determine which CLI binary to invoke. This allows projects to
  * integrate arbitrary agent tooling into the Overlord pipeline.
+ *
+ * SECURITY: agentCommand comes from admin-configured project settings
+ * (ConfigSnapshot.agentCommand), NOT from end-user input. Only users
+ * with project admin privileges can set this value via the server API.
+ * The command is passed to `sh -c` intentionally to support shell
+ * features (pipes, redirects, etc.) that admins may need. The PTY
+ * environment is already sandboxed (no inherited process.env, restricted
+ * env vars via RESERVED_PREFIXES). The null-byte check prevents
+ * argument injection at the execve level.
  */
 export declare class CustomExecutor extends AgentExecutor {
-    readonly agentType = AgentType.CUSTOM;
+    readonly agentType: "custom";
+    protected readonly authErrorPatterns: AuthErrorPattern[];
     getStartCommand(): string;
     buildArgs(config: ConfigSnapshot, _workspacePath: string): string[];
+    prepareEnvironment(_worktreePath: string, _realHome: string): void;
+    buildEnvVars(_realHome: string): Record<string, string>;
     detectPrompt(cleanOutput: string): boolean;
-    detectStageComplete(cleanOutput: string, stage: string): boolean;
-    detectAuthError(cleanOutput: string): AuthErrorResult | null;
-    formatCommand(stage: StageConfig): string;
 }
 //# sourceMappingURL=custom.executor.d.ts.map

package/dist/executor/custom.executor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"custom.executor.d.ts","sourceRoot":"","sources":["../../src/executor/custom.executor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAuB,MAAM,sBAAsB,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE1D;;;;;;GAMG;AACH,qBAAa,cAAe,SAAQ,aAAa;IAC/C,QAAQ,CAAC,SAAS,oBAAoB;IAEtC,eAAe,IAAI,MAAM;IAMzB,SAAS,CAAC,MAAM,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE;IAanE,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO;IAK1C,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAOhE,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI;IAa5D,aAAa,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM;CAG1C"}
+{"version":3,"file":"custom.executor.d.ts","sourceRoot":"","sources":["../../src/executor/custom.executor.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE3D;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,cAAe,SAAQ,aAAa;IAC/C,QAAQ,CAAC,SAAS,WAAoB;IAEtC,SAAS,CAAC,QAAQ,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,CAItD;IAEF,eAAe,IAAI,MAAM;IAMzB,SAAS,CAAC,MAAM,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE;IAQnE,kBAAkB,CAAC,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;IAIlE,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAIvD,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO;CAI3C"}

package/dist/executor/custom.executor.js

@@ -9,49 +9,46 @@ const base_executor_js_1 = require("./base.executor.js");
  * The custom executor uses the configSnapshot's customCommand field
  * to determine which CLI binary to invoke. This allows projects to
  * integrate arbitrary agent tooling into the Overlord pipeline.
+ *
+ * SECURITY: agentCommand comes from admin-configured project settings
+ * (ConfigSnapshot.agentCommand), NOT from end-user input. Only users
+ * with project admin privileges can set this value via the server API.
+ * The command is passed to `sh -c` intentionally to support shell
+ * features (pipes, redirects, etc.) that admins may need. The PTY
+ * environment is already sandboxed (no inherited process.env, restricted
+ * env vars via RESERVED_PREFIXES). The null-byte check prevents
+ * argument injection at the execve level.
  */
 class CustomExecutor extends base_executor_js_1.AgentExecutor {
     agentType = protocol_1.AgentType.CUSTOM;
+    authErrorPatterns = [
+        { pattern: /Authentication failed|Unauthorized|403 Forbidden/i, failureType: 'auth_failure' },
+        { pattern: /Rate limit|too many requests|429/i, failureType: 'rate_limit' },
+        { pattern: /command not found|ENOENT|No such file/i, failureType: 'binary_missing' },
+    ];
     getStartCommand() {
         // The actual command is determined at spawn time via buildArgs / config.
         // Default to 'sh' as a safe fallback; the real command comes from config.
         return 'sh';
     }
     buildArgs(config, _workspacePath) {
-        // For custom executors, the command and arguments are fully
-        // specified in the config snapshot's agentCommand field.
-        const args = [];
-        if (config.agentCommand) {
-            // When agentCommand is set, we run: sh -c "<agentCommand>"
-            args.push('-c', config.agentCommand);
+        if (!config.agentCommand)
+            return [];
+        if (/\0/.test(config.agentCommand)) {
+            throw new Error('agentCommand contains null bytes');
         }
-        return args;
+        return ['-c', config.agentCommand];
+    }
+    prepareEnvironment(_worktreePath, _realHome) {
+        // Custom executors manage their own auth
+    }
+    buildEnvVars(_realHome) {
+        return {};
     }
     detectPrompt(cleanOutput) {
         // Generic prompt detection: look for common shell prompt patterns
         return /[$#>❯]\s*$/.test(cleanOutput.trimEnd());
     }
-    detectStageComplete(cleanOutput, stage) {
-        if (cleanOutput.includes(`${protocol_1.STAGE_DONE_SENTINEL}${stage}]]`)) {
-            return true;
-        }
-        return false;
-    }
-    detectAuthError(cleanOutput) {
-        if (/Authentication failed|Unauthorized|403 Forbidden/i.test(cleanOutput)) {
-            return { detected: true, failureType: 'auth_failure' };
-        }
-        if (/Rate limit|too many requests|429/i.test(cleanOutput)) {
-            return { detected: true, failureType: 'rate_limit' };
-        }
-        if (/command not found|ENOENT|No such file/i.test(cleanOutput)) {
-            return { detected: true, failureType: 'binary_missing' };
-        }
-        return null;
-    }
-    formatCommand(stage) {
-        return stage.command ?? stage.name;
-    }
 }
 exports.CustomExecutor = CustomExecutor;
 //# sourceMappingURL=custom.executor.js.map

package/dist/executor/custom.executor.js.map

@@ -1 +1 @@
-{"version":3,"file":"custom.executor.js","sourceRoot":"","sources":["../../src/executor/custom.executor.ts"],"names":[],"mappings":";;;AAAA,mDAAsE;AAEtE,yDAAmD;AAGnD;;;;;;GAMG;AACH,MAAa,cAAe,SAAQ,gCAAa;IACtC,SAAS,GAAG,oBAAS,CAAC,MAAM,CAAC;IAEtC,eAAe;QACb,yEAAyE;QACzE,0EAA0E;QAC1E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,SAAS,CAAC,MAAsB,EAAE,cAAsB;QACtD,4DAA4D;QAC5D,yDAAyD;QACzD,MAAM,IAAI,GAAa,EAAE,CAAC;QAE1B,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACxB,2DAA2D;YAC3D,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QACvC,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,YAAY,CAAC,WAAmB;QAC9B,kEAAkE;QAClE,OAAO,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,mBAAmB,CAAC,WAAmB,EAAE,KAAa;QACpD,IAAI,WAAW,CAAC,QAAQ,CAAC,GAAG,8BAAmB,GAAG,KAAK,IAAI,CAAC,EAAE,CAAC;YAC7D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,eAAe,CAAC,WAAmB;QACjC,IAAI,mDAAmD,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC1E,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;QACzD,CAAC;QACD,IAAI,mCAAmC,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC1D,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;QACvD,CAAC;QACD,IAAI,wCAAwC,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/D,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC;QAC3D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,aAAa,CAAC,KAAkB;QAC9B,OAAO,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC;IACrC,CAAC;CACF;AAlDD,wCAkDC"}
+{"version":3,"file":"custom.executor.js","sourceRoot":"","sources":["../../src/executor/custom.executor.ts"],"names":[],"mappings":";;;AAAA,mDAAiD;AAEjD,yDAAmD;AAGnD;;;;;;;;;;;;;;;GAeG;AACH,MAAa,cAAe,SAAQ,gCAAa;IACtC,SAAS,GAAG,oBAAS,CAAC,MAAM,CAAC;IAEnB,iBAAiB,GAAuB;QACzD,EAAE,OAAO,EAAE,mDAAmD,EAAE,WAAW,EAAE,cAAc,EAAE;QAC7F,EAAE,OAAO,EAAE,mCAAmC,EAAE,WAAW,EAAE,YAAY,EAAE;QAC3E,EAAE,OAAO,EAAE,wCAAwC,EAAE,WAAW,EAAE,gBAAgB,EAAE;KACrF,CAAC;IAEF,eAAe;QACb,yEAAyE;QACzE,0EAA0E;QAC1E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,SAAS,CAAC,MAAsB,EAAE,cAAsB;QACtD,IAAI,CAAC,MAAM,CAAC,YAAY;YAAE,OAAO,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IACrC,CAAC;IAED,kBAAkB,CAAC,aAAqB,EAAE,SAAiB;QACzD,yCAAyC;IAC3C,CAAC;IAED,YAAY,CAAC,SAAiB;QAC5B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,YAAY,CAAC,WAAmB;QAC9B,kEAAkE;QAClE,OAAO,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IAClD,CAAC;CACF;AAnCD,wCAmCC"}

package/dist/git-operations.d.ts

@@ -1,31 +1,33 @@
 /**
- * Wraps git CLI commands via child_process.execFileSync.
- * Every method is synchronous and throws on non-zero exit.
+ * Wraps git CLI commands via child_process.execFile.
+ * Every method is async and rejects on non-zero exit.
  */
 export declare class GitOperations {
     private sshKeyPath?;
     constructor(sshKeyPath?: string);
     /** Build environment with optional SSH key override. */
     private buildEnv;
+    /** Run git with standard options; returns stdout as Buffer. */
+    private run;
     /** git clone --bare <repoUrl> <targetDir> */
-    cloneBare(repoUrl: string, targetDir: string): void;
+    cloneBare(repoUrl: string, targetDir: string): Promise<void>;
     /** git remote get-url origin */
-    getRemoteUrl(bareDir: string): string;
+    getRemoteUrl(bareDir: string): Promise<string>;
     /** git remote set-url origin <url> (update remote to match latest config) */
-    setRemoteUrl(bareDir: string, url: string): void;
+    setRemoteUrl(bareDir: string, url: string): Promise<void>;
     /** Ensure the bare repo has a proper fetch refspec for origin/* refs. */
-    ensureFetchRefspec(bareDir: string): void;
+    ensureFetchRefspec(bareDir: string): Promise<void>;
     /** Delete a local branch if it exists (cleanup for retries). */
-    deleteBranchIfExists(bareDir: string, branch: string): void;
+    deleteBranchIfExists(bareDir: string, branch: string): Promise<void>;
     /** git fetch origin (run inside bare repo) */
-    fetch(bareDir: string): void;
+    fetch(bareDir: string): Promise<void>;
     /** git worktree add <worktreePath> -b <branch> <startPoint> */
-    addWorktree(bareDir: string, worktreePath: string, branch: string, startPoint: string): void;
+    addWorktree(bareDir: string, worktreePath: string, branch: string, startPoint: string): Promise<void>;
     /** git worktree remove <worktreePath> --force */
-    removeWorktree(bareDir: string, worktreePath: string): void;
+    removeWorktree(bareDir: string, worktreePath: string): Promise<void>;
     /** git worktree prune */
-    pruneWorktrees(bareDir: string): void;
+    pruneWorktrees(bareDir: string): Promise<void>;
     /** git config --local <key> <value> */
-    setLocalConfig(worktreePath: string, key: string, value: string): void;
+    setLocalConfig(worktreePath: string, key: string, value: string): Promise<void>;
 }
 //# sourceMappingURL=git-operations.d.ts.map

package/dist/git-operations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"git-operations.d.ts","sourceRoot":"","sources":["../src/git-operations.ts"],"names":[],"mappings":"AAQA;;;GAGG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,UAAU,CAAC,CAAS;gBAEhB,UAAU,CAAC,EAAE,MAAM;IAI/B,wDAAwD;IACxD,OAAO,CAAC,QAAQ;IAQhB,6CAA6C;IAC7C,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;IAgBnD,gCAAgC;IAChC,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM;IASrC,6EAA6E;IAC7E,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI;IAShD,yEAAyE;IACzE,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAsBzC,gEAAgE;IAChE,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAgC3D,8CAA8C;IAC9C,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAU5B,+DAA+D;IAC/D,WAAW,CACT,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,GACjB,IAAI;IAUP,iDAAiD;IACjD,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI;IAU3D,yBAAyB;IACzB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAUrC,uCAAuC;IACvC,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;CASvE"}
+{"version":3,"file":"git-operations.d.ts","sourceRoot":"","sources":["../src/git-operations.ts"],"names":[],"mappings":"AAUA;;;GAGG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,UAAU,CAAC,CAAS;gBAEhB,UAAU,CAAC,EAAE,MAAM;IAI/B,wDAAwD;IACxD,OAAO,CAAC,QAAQ;IAQhB,+DAA+D;IAC/D,OAAO,CAAC,GAAG;IAsBX,6CAA6C;IACvC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMlE,gCAAgC;IAC1B,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAKpD,6EAA6E;IACvE,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/D,yEAAyE;IACnE,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAaxD,gEAAgE;IAC1D,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAkB1E,8CAA8C;IACxC,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK3C,+DAA+D;IACzD,WAAW,CACf,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC;IAKhB,iDAAiD;IAC3C,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK1E,yBAAyB;IACnB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKpD,uCAAuC;IACjC,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAItF"}

package/dist/git-operations.js

@@ -7,11 +7,13 @@ exports.GitOperations = void 0;
 const node_child_process_1 = require("node:child_process");
 const pino_1 = __importDefault(require("pino"));
 const safe_env_js_1 = require("./safe-env.js");
+const git_token_helper_js_1 = require("./git-token-helper.js");
+const protocol_1 = require("@overlordai/protocol");
 const logger = (0, pino_1.default)({ name: 'git-operations' });
 const EXEC_TIMEOUT = 120_000; // 2 minutes
 /**
- * Wraps git CLI commands via child_process.execFileSync.
- * Every method is synchronous and throws on non-zero exit.
+ * Wraps git CLI commands via child_process.execFile.
+ * Every method is async and rejects on non-zero exit.
  */
 class GitOperations {
     sshKeyPath;
@@ -26,50 +28,45 @@ class GitOperations {
         }
         return env;
     }
-    /** git clone --bare <repoUrl> <targetDir> */
-    cloneBare(repoUrl, targetDir) {
-        logger.info({ repoUrl, targetDir }, 'Cloning bare repository');
-        (0, node_child_process_1.execFileSync)('git', ['clone', '--bare', repoUrl, targetDir], {
-            timeout: EXEC_TIMEOUT,
-            stdio: 'pipe',
-            env: this.buildEnv(),
-        });
-        // Bare clones may not have a proper fetch refspec — ensure origin/* refs work
-        (0, node_child_process_1.execFileSync)('git', ['config', 'remote.origin.fetch', '+refs/heads/*:refs/remotes/origin/*'], {
-            cwd: targetDir,
-            timeout: EXEC_TIMEOUT,
-            stdio: 'pipe',
-            env: this.buildEnv(),
+    /** Run git with standard options; returns stdout as Buffer. */
+    run(args, cwd) {
+        return new Promise((resolve, reject) => {
+            (0, node_child_process_1.execFile)('git', args, {
+                cwd,
+                timeout: EXEC_TIMEOUT,
+                encoding: 'buffer',
+                env: this.buildEnv(),
+            }, (error, stdout) => {
+                if (error) {
+                    reject(error);
+                }
+                else {
+                    resolve(stdout);
+                }
+            });
         });
     }
+    /** git clone --bare <repoUrl> <targetDir> */
+    async cloneBare(repoUrl, targetDir) {
+        logger.info({ repoUrl: (0, git_token_helper_js_1.maskUrl)(repoUrl), targetDir }, 'Cloning bare repository');
+        await this.run(['clone', '--bare', repoUrl, targetDir]);
+        await this.run(['config', 'remote.origin.fetch', '+refs/heads/*:refs/remotes/origin/*'], targetDir);
+    }
     /** git remote get-url origin */
-    getRemoteUrl(bareDir) {
-        return (0, node_child_process_1.execFileSync)('git', ['remote', 'get-url', 'origin'], {
-            cwd: bareDir,
-            timeout: EXEC_TIMEOUT,
-            stdio: 'pipe',
-            env: this.buildEnv(),
-        }).toString().trim();
+    async getRemoteUrl(bareDir) {
+        const buf = await this.run(['remote', 'get-url', 'origin'], bareDir);
+        return buf.toString().trim();
     }
     /** git remote set-url origin <url> (update remote to match latest config) */
-    setRemoteUrl(bareDir, url) {
-        (0, node_child_process_1.execFileSync)('git', ['remote', 'set-url', 'origin', url], {
-            cwd: bareDir,
-            timeout: EXEC_TIMEOUT,
-            stdio: 'pipe',
-            env: this.buildEnv(),
-        });
+    async setRemoteUrl(bareDir, url) {
+        await this.run(['remote', 'set-url', 'origin', url], bareDir);
     }
     /** Ensure the bare repo has a proper fetch refspec for origin/* refs. */
-    ensureFetchRefspec(bareDir) {
+    async ensureFetchRefspec(bareDir) {
         const expected = '+refs/heads/*:refs/remotes/origin/*';
         try {
-            const current = (0, node_child_process_1.execFileSync)('git', ['config', 'remote.origin.fetch'], {
-                cwd: bareDir,
-                timeout: EXEC_TIMEOUT,
-                stdio: 'pipe',
-                env: this.buildEnv(),
-            }).toString().trim();
+            const buf = await this.run(['config', 'remote.origin.fetch'], bareDir);
+            const current = buf.toString().trim();
             if (current === expected)
                 return;
         }
@@ -77,96 +74,51 @@ class GitOperations {
             // config key missing
         }
         logger.info({ bareDir }, 'Setting fetch refspec on existing bare repo');
-        (0, node_child_process_1.execFileSync)('git', ['config', 'remote.origin.fetch', expected], {
-            cwd: bareDir,
-            timeout: EXEC_TIMEOUT,
-            stdio: 'pipe',
-            env: this.buildEnv(),
-        });
+        await this.run(['config', 'remote.origin.fetch', expected], bareDir);
     }
     /** Delete a local branch if it exists (cleanup for retries). */
-    deleteBranchIfExists(bareDir, branch) {
-        // Prune stale worktree refs first — a worktree from a previous failed
-        // attempt may still reference this branch, preventing deletion.
+    async deleteBranchIfExists(bareDir, branch) {
         try {
-            (0, node_child_process_1.execFileSync)('git', ['worktree', 'prune'], {
-                cwd: bareDir,
-                timeout: EXEC_TIMEOUT,
-                stdio: 'pipe',
-                env: this.buildEnv(),
-            });
+            await this.run(['worktree', 'prune'], bareDir);
         }
         catch {
             // prune failure is non-fatal
         }
         try {
-            (0, node_child_process_1.execFileSync)('git', ['branch', '-D', branch], {
-                cwd: bareDir,
-                timeout: EXEC_TIMEOUT,
-                stdio: 'pipe',
-                env: this.buildEnv(),
-            });
+            await this.run(['branch', '-D', branch], bareDir);
             logger.info({ bareDir, branch }, 'Deleted stale branch');
         }
         catch (err) {
-            const msg = err instanceof Error ? err.message : String(err);
-            if (msg.includes('not found') || msg.includes('No such branch')) {
-                // Branch doesn't exist — fine
-            }
-            else {
+            const msg = (0, protocol_1.getErrorMessage)(err);
+            if (!msg.includes('not found') && !msg.includes('No such branch')) {
                 logger.warn({ bareDir, branch, err: msg }, 'Failed to delete branch');
             }
         }
     }
     /** git fetch origin (run inside bare repo) */
-    fetch(bareDir) {
+    async fetch(bareDir) {
         logger.info({ bareDir }, 'Fetching origin');
-        (0, node_child_process_1.execFileSync)('git', ['fetch', 'origin'], {
-            cwd: bareDir,
-            timeout: EXEC_TIMEOUT,
-            stdio: 'pipe',
-            env: this.buildEnv(),
-        });
+        await this.run(['fetch', 'origin'], bareDir);
     }
     /** git worktree add <worktreePath> -b <branch> <startPoint> */
-    addWorktree(bareDir, worktreePath, branch, startPoint) {
+    async addWorktree(bareDir, worktreePath, branch, startPoint) {
         logger.info({ bareDir, worktreePath, branch, startPoint }, 'Adding worktree');
-        (0, node_child_process_1.execFileSync)('git', ['worktree', 'add', worktreePath, '-b', branch, startPoint], {
-            cwd: bareDir,
-            timeout: EXEC_TIMEOUT,
-            stdio: 'pipe',
-            env: this.buildEnv(),
-        });
+        await this.run(['worktree', 'add', worktreePath, '-b', branch, startPoint], bareDir);
     }
     /** git worktree remove <worktreePath> --force */
-    removeWorktree(bareDir, worktreePath) {
+    async removeWorktree(bareDir, worktreePath) {
         logger.info({ bareDir, worktreePath }, 'Removing worktree');
-        (0, node_child_process_1.execFileSync)('git', ['worktree', 'remove', worktreePath, '--force'], {
-            cwd: bareDir,
-            timeout: EXEC_TIMEOUT,
-            stdio: 'pipe',
-            env: this.buildEnv(),
-        });
+        await this.run(['worktree', 'remove', worktreePath, '--force'], bareDir);
     }
     /** git worktree prune */
-    pruneWorktrees(bareDir) {
+    async pruneWorktrees(bareDir) {
         logger.info({ bareDir }, 'Pruning worktrees');
-        (0, node_child_process_1.execFileSync)('git', ['worktree', 'prune'], {
-            cwd: bareDir,
-            timeout: EXEC_TIMEOUT,
-            stdio: 'pipe',
-            env: this.buildEnv(),
-        });
+        await this.run(['worktree', 'prune'], bareDir);
     }
     /** git config --local <key> <value> */
-    setLocalConfig(worktreePath, key, value) {
+    async setLocalConfig(worktreePath, key, value) {
         logger.debug({ worktreePath, key }, 'Setting local git config');
-        (0, node_child_process_1.execFileSync)('git', ['config', '--local', key, value], {
-            cwd: worktreePath,
-            timeout: EXEC_TIMEOUT,
-            stdio: 'pipe',
-            env: this.buildEnv(),
-        });
+        await this.run(['config', '--local', key, value], worktreePath);
     }
 }
 exports.GitOperations = GitOperations;