@peakflo/agent-harness 0.2.16 → 0.2.17-rc.1

package/dist/github-workspace.d.ts

@@ -2,6 +2,8 @@ import { type RequestListener, type Server } from 'node:http';
 import type { WorkspaceProvider, WorkspaceRequest } from './ports';
 import type { PeerUidResolver } from './runtime/loopback-peer';
 import type { LeasedGitHubCredential } from './types';
+/** Compare repository identity without retaining URL credentials or a branch. */
+export declare function githubRepositoryIdentity(remote: string): string | null;
 export interface GitHubWorkspaceOptions {
     root: string;
     port?: number;
@@ -29,16 +31,19 @@ export declare class GitHubWorkspaceProvider implements WorkspaceProvider {
     private caCertificatePath;
     private readonly restartNotedSessions;
     private readonly restoredWorktreeNotes;
+    private readonly preparationNotes;
     private readonly preparedWorktrees;
     private readonly directHosts;
     constructor(options: GitHubWorkspaceOptions);
     private rememberDirectUrls;
     private runGit;
+    private sameRepository;
+    /** Never fetch a different repository into a shared durable bare clone. */
+    private bareRepositoryPath;
     /**
-     * A harness crash must not erase or recreate a session checkout. Accept an
-     * existing path only when Git proves that it is the exact worktree this
-     * provider would have created: same canonical root, same bare repository,
-     * and same per-session branch. Anything else fails closed.
+     * A session owns its checkout, including branch changes and detached HEAD.
+     * Check its root and repository identity, never its branch or commit. Keep
+     * an unrelated or unusable checkout aside before preparing a replacement.
      */
     private canReuseWorktree;
     private dirtyFileCount;
@@ -56,6 +61,7 @@ export declare class GitHubWorkspaceProvider implements WorkspaceProvider {
     prepare(request: WorkspaceRequest): Promise<string>;
     getEnvironment(sessionId: string, directUrls?: string[]): Record<string, string>;
     takeTurnNote(sessionId: string): string | null;
+    takePreparationNotes(sessionId: string): string[];
     preserveAtTurnEnd(sessionId: string): Promise<boolean>;
     release(sessionId: string, options?: {
         force?: boolean;

package/dist/github-workspace.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.GitHubWorkspaceProvider = void 0;
+exports.githubRepositoryIdentity = githubRepositoryIdentity;
 exports.directHostnames = directHostnames;
 const node_child_process_1 = require("node:child_process");
 const node_crypto_1 = require("node:crypto");
@@ -18,6 +19,28 @@ const DEFAULT_PROXY_PORT = 7780;
 const LINK_SECRET_FILE = '.github-proxy-link-secret';
 const WIP_PUSH_FAILED_FILE = '.worktree-wip-push-failed';
 const WIP_COMMIT_MESSAGE = 'chore(agent): wip — uncommitted at turn end';
+/** Compare repository identity without retaining URL credentials or a branch. */
+function githubRepositoryIdentity(remote) {
+    const ssh = /^git@github\.com:(.+)$/i.exec(remote);
+    try {
+        const url = new URL(ssh ? `https://github.com/${ssh[1]}` : remote);
+        const host = url.hostname.toLowerCase();
+        // The loopback proxy can also be used as an explicit Git remote. Its
+        // credentials and port are transport details, not repository identity.
+        if (!['github.com', '127.0.0.1', 'localhost', '[::1]'].includes(host)) {
+            return null;
+        }
+        if (!['https:', 'http:', 'ssh:'].includes(url.protocol))
+            return null;
+        const path = url.pathname.replace(/\/$/, '').replace(/\.git$/i, '');
+        if (!/^\/[a-z0-9_.-]+\/[a-z0-9_.-]+$/i.test(path))
+            return null;
+        return `github.com${path.toLowerCase()}`;
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Hostnames of URLs the agent reaches WITHOUT a proxy (control plane, model
  * gateway, MCP). Shared with the credential proxy's NO_PROXY so both proxies
@@ -49,6 +72,7 @@ class GitHubWorkspaceProvider {
     caCertificatePath = null;
     restartNotedSessions = new Set();
     restoredWorktreeNotes = new Map();
+    preparationNotes = new Map();
     preparedWorktrees = new Map();
     directHosts = new Set();
     constructor(options) {
@@ -76,13 +100,50 @@ class GitHubWorkspaceProvider {
             env: { ...this.gitEnvironment, ...environment }
         });
     }
+    async sameRepository(expectedUrl, actualUrl, cwd) {
+        const expected = githubRepositoryIdentity(expectedUrl);
+        if (expected)
+            return githubRepositoryIdentity(actualUrl) === expected;
+        try {
+            return ((await (0, promises_1.realpath)((0, node_path_1.resolve)(cwd, actualUrl))) ===
+                (await (0, promises_1.realpath)(expectedUrl)));
+        }
+        catch {
+            return false;
+        }
+    }
+    /** Never fetch a different repository into a shared durable bare clone. */
+    async bareRepositoryPath(path, cloneUrl) {
+        try {
+            await (0, promises_1.lstat)(path);
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return path;
+            throw error;
+        }
+        const origin = await this.runGit(['config', '--get', 'remote.origin.url'], {
+            cwd: path
+        }).catch(() => null);
+        if (origin &&
+            (await this.sameRepository(cloneUrl, origin.stdout.trim(), path))) {
+            return path;
+        }
+        // Leave the old clone and all its linked worktrees intact. A separate
+        // clone also prevents an unrelated agent/<session> ref from being reused.
+        const identity = githubRepositoryIdentity(cloneUrl) ?? cloneUrl;
+        const digest = (0, node_crypto_1.createHash)('sha256')
+            .update(identity)
+            .digest('hex')
+            .slice(0, 16);
+        return this.bareRepositoryPath(`${path}.recovered-${digest}`, cloneUrl);
+    }
     /**
-     * A harness crash must not erase or recreate a session checkout. Accept an
-     * existing path only when Git proves that it is the exact worktree this
-     * provider would have created: same canonical root, same bare repository,
-     * and same per-session branch. Anything else fails closed.
+     * A session owns its checkout, including branch changes and detached HEAD.
+     * Check its root and repository identity, never its branch or commit. Keep
+     * an unrelated or unusable checkout aside before preparing a replacement.
      */
-    async canReuseWorktree(bare, worktree, branch) {
+    async canReuseWorktree(worktree, cloneUrl, sessionId) {
         let entry;
         try {
             entry = await (0, promises_1.lstat)(worktree);
@@ -92,33 +153,45 @@ class GitHubWorkspaceProvider {
                 return false;
             throw error;
         }
-        if (!entry.isDirectory() || entry.isSymbolicLink()) {
-            throw new Error(`Existing repository workspace is not a directory: ${worktree}`);
-        }
-        try {
-            const [topLevel, commonDir, currentBranch] = await Promise.all([
-                this.runGit(['rev-parse', '--show-toplevel'], { cwd: worktree }),
-                this.runGit(['rev-parse', '--git-common-dir'], { cwd: worktree }),
-                this.runGit(['symbolic-ref', '--quiet', '--short', 'HEAD'], {
-                    cwd: worktree
-                })
-            ]);
-            const [expectedWorktree, actualWorktree, expectedBare, actualBare] = await Promise.all([
-                (0, promises_1.realpath)(worktree),
-                (0, promises_1.realpath)((0, node_path_1.resolve)(worktree, topLevel.stdout.trim())),
-                (0, promises_1.realpath)(bare),
-                (0, promises_1.realpath)((0, node_path_1.resolve)(worktree, commonDir.stdout.trim()))
-            ]);
-            if (actualWorktree !== expectedWorktree ||
-                actualBare !== expectedBare ||
-                currentBranch.stdout.trim() !== branch) {
-                throw new Error('repository or branch does not match');
+        if (entry.isDirectory() && !entry.isSymbolicLink()) {
+            try {
+                const [topLevel, origin] = await Promise.all([
+                    this.runGit(['rev-parse', '--show-toplevel'], { cwd: worktree }),
+                    this.runGit(['config', '--get', 'remote.origin.url'], {
+                        cwd: worktree
+                    })
+                ]);
+                const [expectedWorktree, actualWorktree] = await Promise.all([
+                    (0, promises_1.realpath)(worktree),
+                    (0, promises_1.realpath)((0, node_path_1.resolve)(worktree, topLevel.stdout.trim()))
+                ]);
+                const sameRepository = await this.sameRepository(cloneUrl, origin.stdout.trim(), worktree);
+                if (actualWorktree === expectedWorktree && sameRepository)
+                    return true;
+            }
+            catch {
+                // A broken Git file is recoverable. Do not echo a remote URL or a Git
+                // error here: it can contain credentials. Preserve every file below.
             }
-            return true;
         }
-        catch (error) {
-            throw new Error(`Existing repository workspace cannot be reused safely: ${worktree}: ${error instanceof Error ? error.message : String(error)}`);
+        const backupRoot = await (0, promises_1.mkdtemp)((0, node_path_1.join)(this.sessionPath(sessionId), `.preserved-${Date.now()}-`));
+        const backup = (0, node_path_1.join)(backupRoot, 'repository');
+        // Git updates a linked worktree's administrative paths when possible.
+        // A plain directory, symlink or broken checkout still keeps all bytes.
+        if (entry.isDirectory() && !entry.isSymbolicLink()) {
+            await this.runGit(['worktree', 'move', worktree, backup], {
+                cwd: worktree
+            }).catch(() => (0, promises_1.rename)(worktree, backup));
         }
+        else {
+            await (0, promises_1.rename)(worktree, backup);
+        }
+        const notes = this.preparationNotes.get(sessionId) ?? [];
+        notes.push(`The previous repository folder could not be reused. All its files ` +
+            `were kept at ${backup}. A fresh checkout was prepared. ` +
+            'Review the saved folder before you remove it.');
+        this.preparationNotes.set(sessionId, notes);
+        return false;
     }
     async dirtyFileCount(worktree) {
         const status = await this.runGit(['status', '--porcelain=v1', '-z'], {
@@ -331,7 +404,7 @@ class GitHubWorkspaceProvider {
         let reusedWorktree = false;
         for (const repository of request.repositories) {
             const [owner, name] = repository.fullName.split('/');
-            const bare = (0, node_path_1.join)(repositoriesRoot, `${owner}--${name}.git`);
+            const bare = await this.bareRepositoryPath((0, node_path_1.join)(repositoriesRoot, `${owner}--${name}.git`), repository.cloneUrl);
             const worktree = (0, node_path_1.join)(sessionRoot, name);
             // The empty value resets every inherited/global helper. Without it, Git
             // can pass the installation token to a desktop keychain helper on the
@@ -367,7 +440,7 @@ class GitHubWorkspaceProvider {
             });
             await this.runGit(['worktree', 'prune'], { cwd: bare });
             const branch = `agent/${request.sessionId}`;
-            const reuse = await this.canReuseWorktree(bare, worktree, branch);
+            const reuse = await this.canReuseWorktree(worktree, repository.cloneUrl, request.sessionId);
             if (!reuse) {
                 try {
                     await this.runGit(['worktree', 'add', worktree, branch], {
@@ -375,14 +448,17 @@ class GitHubWorkspaceProvider {
                     });
                 }
                 catch {
-                    await this.runGit([
-                        'worktree',
-                        'add',
-                        '-b',
-                        branch,
-                        worktree,
-                        `origin/${repository.defaultBranch}`
-                    ], { cwd: bare });
+                    const existingBranch = await this.runGit(['show-ref', '--verify', '--quiet', `refs/heads/${branch}`], { cwd: bare }).then(() => true, () => false);
+                    await this.runGit(existingBranch
+                        ? ['worktree', 'add', '--detach', worktree, branch]
+                        : [
+                            'worktree',
+                            'add',
+                            '-b',
+                            branch,
+                            worktree,
+                            `origin/${repository.defaultBranch}`
+                        ], { cwd: bare });
                 }
             }
             else {
@@ -401,7 +477,7 @@ class GitHubWorkspaceProvider {
             // Hooks must be per worktree; a shared bare-repo hook would overwrite
             // another session's allowed destination when sessions overlap.
             await this.runGit(['config', 'extensions.worktreeConfig', 'true'], {
-                cwd: bare
+                cwd: worktree
             });
             await this.runGit(['config', '--worktree', 'core.bare', 'false'], {
                 cwd: worktree
@@ -504,6 +580,11 @@ class GitHubWorkspaceProvider {
             .filter(Boolean)
             .join('\n');
     }
+    takePreparationNotes(sessionId) {
+        const notes = this.preparationNotes.get(sessionId) ?? [];
+        this.preparationNotes.delete(sessionId);
+        return notes;
+    }
     async preserveAtTurnEnd(sessionId) {
         const worktrees = await this.worktreesForSession(sessionId);
         const failures = await this.readFailedPushes(sessionId);
@@ -563,6 +644,7 @@ class GitHubWorkspaceProvider {
         await (0, promises_1.rm)(this.sessionPath(sessionId), { recursive: true, force: true });
         this.preparedWorktrees.delete(sessionId);
         this.restoredWorktreeNotes.delete(sessionId);
+        this.preparationNotes.delete(sessionId);
         this.restartNotedSessions.delete(sessionId);
         this.clearCredential(sessionId);
         return true;

package/dist/ports.d.ts

@@ -389,6 +389,8 @@ export interface WorkspaceProvider {
     getEnvironment?(sessionId: string, directUrls?: string[]): Record<string, string>;
     /** One-use host note to prepend to the next model turn, when present. */
     takeTurnNote?(sessionId: string): string | null;
+    /** Recovery notices to show in the transcript and pass to the model. */
+    takePreparationNotes?(sessionId: string): string[];
     /**
      * Save dirty repository work before a turn gives up its credential.
      * A false result means a remote backup failed and cleanup must keep the tree.

package/dist/runtime/session-runner.js

@@ -859,6 +859,20 @@ class SessionRunner {
                         .join('\n')
                     : `Repository workspace was not prepared: ${reason}`);
             }
+            const workspaceNotes = this.deps.workspace.takePreparationNotes?.(session.sessionId) ?? [];
+            if (workspaceNotes.length > 0) {
+                const content = workspaceNotes.join('\n');
+                turnContent = `${content}\n\n${turnContent}`;
+                partsProduced += this.record(session.sessionId, [
+                    {
+                        id: `workspace-recovery-${session.turnId}`,
+                        role: 'system',
+                        partType: 'text',
+                        content
+                    }
+                ]);
+                await this.flush(session.sessionId, this.pending.splice(0), undefined, false);
+            }
             /*
              * THE USER'S ATTACHMENTS, INTO THIS TURN'S WORKSPACE — every turn, since
              * each lease carries its own turn's files and the session may have moved

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@peakflo/agent-harness",
-  "version": "0.2.16",
+  "version": "0.2.17-rc.1",
   "description": "Headless Peakflo coding-agent harness. One codebase, three hosting modes: a Daytona cloud sandbox, a customer VM, and the 20x desktop.",
   "license": "MIT",
   "type": "commonjs",