@peakflo/agent-harness 0.2.17-rc.1 → 0.2.17-rc.2

package/dist/github-workspace.d.ts

@@ -40,6 +40,7 @@ export declare class GitHubWorkspaceProvider implements WorkspaceProvider {
     private sameRepository;
     /** Never fetch a different repository into a shared durable bare clone. */
     private bareRepositoryPath;
+    private isUnusableCheckout;
     /**
      * A session owns its checkout, including branch changes and detached HEAD.
      * Check its root and repository identity, never its branch or commit. Keep

package/dist/github-workspace.js

@@ -25,8 +25,8 @@ function githubRepositoryIdentity(remote) {
     try {
         const url = new URL(ssh ? `https://github.com/${ssh[1]}` : remote);
         const host = url.hostname.toLowerCase();
-        // The loopback proxy can also be used as an explicit Git remote. Its
-        // credentials and port are transport details, not repository identity.
+        // Within a harness-owned checkout/cache, loopback owner/repo URLs denote
+        // the GitHub proxy. This is not proof of identity for arbitrary local URLs.
         if (!['github.com', '127.0.0.1', 'localhost', '[::1]'].includes(host)) {
             return null;
         }
@@ -114,36 +114,50 @@ class GitHubWorkspaceProvider {
     }
     /** Never fetch a different repository into a shared durable bare clone. */
     async bareRepositoryPath(path, cloneUrl) {
-        try {
-            await (0, promises_1.lstat)(path);
-        }
-        catch (error) {
-            if (error.code === 'ENOENT')
-                return path;
-            throw error;
-        }
-        const origin = await this.runGit(['config', '--get', 'remote.origin.url'], {
-            cwd: path
-        }).catch(() => null);
-        if (origin &&
-            (await this.sameRepository(cloneUrl, origin.stdout.trim(), path))) {
-            return path;
-        }
-        // Leave the old clone and all its linked worktrees intact. A separate
-        // clone also prevents an unrelated agent/<session> ref from being reused.
         const identity = githubRepositoryIdentity(cloneUrl) ?? cloneUrl;
         const digest = (0, node_crypto_1.createHash)('sha256')
             .update(identity)
             .digest('hex')
             .slice(0, 16);
-        return this.bareRepositoryPath(`${path}.recovered-${digest}`, cloneUrl);
+        // Leave old clones and linked worktrees intact. Bound collision handling
+        // without appending the same suffix recursively to a file name.
+        for (let attempt = 0; attempt < 16; attempt += 1) {
+            const candidate = attempt === 0 ? path : `${path}.recovered-${digest}-${attempt}`;
+            try {
+                const entry = await (0, promises_1.lstat)(candidate);
+                if (!entry.isDirectory() || entry.isSymbolicLink())
+                    continue;
+            }
+            catch (error) {
+                if (error.code === 'ENOENT')
+                    return candidate;
+                throw error;
+            }
+            const origin = await this.runGit(['config', '--get', 'remote.origin.url'], {
+                cwd: candidate
+            }).catch((error) => {
+                if (this.isUnusableCheckout(error) || error.code === 1)
+                    return null;
+                throw new Error('Could not inspect repository cache. Existing files were kept.');
+            });
+            if (origin &&
+                (await this.sameRepository(cloneUrl, origin.stdout.trim(), candidate))) {
+                return candidate;
+            }
+        }
+        throw new Error('Could not prepare a repository cache. Existing files were kept.');
+    }
+    isUnusableCheckout(error) {
+        const gitError = error;
+        return (gitError.code === 128 &&
+            /not a git repository|invalid gitfile format|bad config line/i.test(gitError.stderr ?? ''));
     }
     /**
      * A session owns its checkout, including branch changes and detached HEAD.
      * Check its root and repository identity, never its branch or commit. Keep
      * an unrelated or unusable checkout aside before preparing a replacement.
      */
-    async canReuseWorktree(worktree, cloneUrl, sessionId) {
+    async canReuseWorktree(bare, worktree, cloneUrl, sessionId) {
         let entry;
         try {
             entry = await (0, promises_1.lstat)(worktree);
@@ -155,23 +169,38 @@ class GitHubWorkspaceProvider {
         }
         if (entry.isDirectory() && !entry.isSymbolicLink()) {
             try {
-                const [topLevel, origin] = await Promise.all([
+                const [topLevel, origin, commonDir] = await Promise.all([
                     this.runGit(['rev-parse', '--show-toplevel'], { cwd: worktree }),
                     this.runGit(['config', '--get', 'remote.origin.url'], {
                         cwd: worktree
-                    })
+                    }).catch((error) => {
+                        if (error.code === 1 && !error.stderr)
+                            return { stdout: '' };
+                        throw error;
+                    }),
+                    this.runGit(['rev-parse', '--git-common-dir'], { cwd: worktree })
                 ]);
-                const [expectedWorktree, actualWorktree] = await Promise.all([
+                const [expectedWorktree, actualWorktree, repositoriesRoot, actualCommon] = await Promise.all([
                     (0, promises_1.realpath)(worktree),
-                    (0, promises_1.realpath)((0, node_path_1.resolve)(worktree, topLevel.stdout.trim()))
+                    (0, promises_1.realpath)((0, node_path_1.resolve)(worktree, topLevel.stdout.trim())),
+                    (0, promises_1.realpath)((0, node_path_1.join)((0, node_path_1.resolve)(this.options.root), '.repositories')),
+                    (0, promises_1.realpath)((0, node_path_1.resolve)(worktree, commonDir.stdout.trim()))
                 ]);
                 const sameRepository = await this.sameRepository(cloneUrl, origin.stdout.trim(), worktree);
-                if (actualWorktree === expectedWorktree && sameRepository)
+                const managedCommon = actualCommon.startsWith(`${repositoriesRoot}/`) ||
+                    actualCommon === (0, node_path_1.join)(expectedWorktree, '.git');
+                if (actualWorktree === expectedWorktree &&
+                    sameRepository &&
+                    managedCommon)
                     return true;
             }
-            catch {
-                // A broken Git file is recoverable. Do not echo a remote URL or a Git
-                // error here: it can contain credentials. Preserve every file below.
+            catch (error) {
+                // Only a proven broken Git checkout is moved. Resource exhaustion,
+                // permission errors and timeouts must leave a healthy checkout in place.
+                // Do not echo Git errors: they can contain remote credentials.
+                if (!this.isUnusableCheckout(error)) {
+                    throw new Error('Could not inspect the existing repository workspace. Retry the message. Existing files were not changed.');
+                }
             }
         }
         const backupRoot = await (0, promises_1.mkdtemp)((0, node_path_1.join)(this.sessionPath(sessionId), `.preserved-${Date.now()}-`));
@@ -181,11 +210,17 @@ class GitHubWorkspaceProvider {
         if (entry.isDirectory() && !entry.isSymbolicLink()) {
             await this.runGit(['worktree', 'move', worktree, backup], {
                 cwd: worktree
-            }).catch(() => (0, promises_1.rename)(worktree, backup));
+            }).catch(async () => {
+                await (0, promises_1.rename)(worktree, backup);
+                await this.runGit(['worktree', 'repair', backup], { cwd: bare }).catch(() => undefined);
+            });
         }
         else {
             await (0, promises_1.rename)(worktree, backup);
         }
+        // A broken .git file cannot be repaired. Remove only obsolete Git
+        // registrations now, before reusing the vacated path; keep all saved files.
+        await this.runGit(['worktree', 'prune', '--expire=now'], { cwd: bare });
         const notes = this.preparationNotes.get(sessionId) ?? [];
         notes.push(`The previous repository folder could not be reused. All its files ` +
             `were kept at ${backup}. A fresh checkout was prepared. ` +
@@ -432,6 +467,11 @@ class GitHubWorkspaceProvider {
                     '+refs/heads/*:refs/remotes/origin/*'
                 ], { cwd: bare });
             }
+            // The identity check above permits old proxy/sentinel URL forms. Fetch
+            // through the current lease URL so a stale loopback port cannot fail first.
+            await this.runGit(['config', 'remote.origin.url', repository.cloneUrl], {
+                cwd: bare
+            });
             await this.runGit([...gitArgs, 'fetch', 'origin', '+refs/heads/*:refs/remotes/origin/*'], {
                 cwd: bare,
                 timeout: 10 * 60_000,
@@ -440,7 +480,7 @@ class GitHubWorkspaceProvider {
             });
             await this.runGit(['worktree', 'prune'], { cwd: bare });
             const branch = `agent/${request.sessionId}`;
-            const reuse = await this.canReuseWorktree(worktree, repository.cloneUrl, request.sessionId);
+            const reuse = await this.canReuseWorktree(bare, worktree, repository.cloneUrl, request.sessionId);
             if (!reuse) {
                 try {
                     await this.runGit(['worktree', 'add', worktree, branch], {
@@ -476,12 +516,15 @@ class GitHubWorkspaceProvider {
             });
             // Hooks must be per worktree; a shared bare-repo hook would overwrite
             // another session's allowed destination when sessions overlap.
+            // A reused checkout may belong to a recovered cache or a standalone clone.
+            // Configure its actual common directory, rather than the default cache.
             await this.runGit(['config', 'extensions.worktreeConfig', 'true'], {
                 cwd: worktree
             });
             await this.runGit(['config', '--worktree', 'core.bare', 'false'], {
                 cwd: worktree
             });
+            await this.runGit(['config', '--worktree', 'remote.origin.url', repository.cloneUrl], { cwd: worktree });
             const hooks = (0, node_path_1.join)(sessionRoot, '.github-hooks', name);
             await (0, github_command_guards_1.installPushGuard)(hooks, request.sessionId, repository.defaultBranch, repository.cloneUrl);
             await this.runGit(['config', '--worktree', 'core.hooksPath', hooks], {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@peakflo/agent-harness",
-  "version": "0.2.17-rc.1",
+  "version": "0.2.17-rc.2",
   "description": "Headless Peakflo coding-agent harness. One codebase, three hosting modes: a Daytona cloud sandbox, a customer VM, and the 20x desktop.",
   "license": "MIT",
   "type": "commonjs",