@proagentstore/cli 0.4.58 → 0.4.60

package/dist/browser-runner/coding/inspect.js

@@ -40,7 +40,7 @@ function requireWorkTree(workDir) {
  * password prompt nobody can see: `GIT_TERMINAL_PROMPT=0` for https, `BatchMode=yes` for ssh.
  * The user's own `GIT_SSH_COMMAND` wins when set — it may carry a key or a proxy we must keep.
  */
-function networkGitEnv() {
+export function networkGitEnv() {
     return {
         ...process.env,
         GIT_TERMINAL_PROMPT: "0",

package/dist/browser-runner/coding/repo-write.js

@@ -1,7 +1,7 @@
 import { execFileSync } from "node:child_process";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
-import { InspectError } from "./inspect.js";
+import { InspectError, networkGitEnv } from "./inspect.js";
 /**
  * May this string become a git token?
  *
@@ -32,11 +32,18 @@ export function gitWriteArgv(cmd, opts = {}) {
             // discard work.
             return ["checkout", opts.branch.trim(), "--"];
         }
+        case "fast-forward":
+            // No caller-supplied token at all: the branch is whatever HEAD is (checked against the
+            // declared one BEFORE this runs), the remote is the upstream git records for it. `--ff-only`
+            // is the whole contract — git aborts, touching nothing, when the histories have diverged.
+            // `--no-rebase` so a `pull.rebase=true` config on the owner's machine cannot turn the
+            // abort into a rebase of their local commits.
+            return ["pull", "--ff-only", "--no-rebase"];
         default:
             throw new InspectError(`unsupported git write command: ${cmd}`);
     }
 }
-function git(workDir, argv) {
+function git(workDir, argv, opts = {}) {
     // stderr is PIPED rather than inherited: git narrates a checkout on stderr, and the runner's
     // console is a user-facing log, not a place for `Switched to branch 'main'`. Piping it is also
     // what makes `e.stderr` available, which is the only honest sentence to put on the card when git
@@ -44,11 +51,22 @@ function git(workDir, argv) {
     return execFileSync("git", argv, {
         cwd: workDir,
         encoding: "utf-8",
-        timeout: 15_000,
+        timeout: opts.timeout ?? 15_000,
         maxBuffer: 1024 * 1024,
         stdio: ["ignore", "pipe", "pipe"],
+        env: opts.env,
     }).toString();
 }
+/** git's diagnosis is the FIRST `fatal:`/`error:` line of stderr; the tail is boilerplate. */
+function gitFailureLine(e) {
+    const err = e;
+    const lines = String(err.stderr || err.message || "")
+        .split("\n")
+        .map((l) => l.trim())
+        .filter(Boolean);
+    const line = lines.find((l) => /^(fatal|error):/i.test(l)) ?? lines[0] ?? "git failed";
+    return line.replace(/^(fatal|error):\s*/i, "").slice(0, 200);
+}
 /** The current branch, or the short SHA when detached, or null when even that fails. */
 function currentBranch(workDir) {
     try {
@@ -134,3 +152,114 @@ export function switchRepoBranch(workDir, branch) {
     }
     return { ok: after === to, changed: after === to, from, to, branch: after, dirty: dirtyAfter };
 }
+/**
+ * Bring a CLEAN checkout up to its upstream, or refuse and change nothing (#802).
+ *
+ * Every precondition is checked HERE, at the hands, not only in the cloud — the same rule
+ * `switchRepoBranch` follows and for the same reason: the cloud's picture of the tree is a read
+ * taken moments earlier over a relay, and the write has to be safe against the tree as it IS.
+ *
+ *   dirty        NOT refused (#804 — it was at 0.4.59). Unlike a checkout, a fast-forward carries
+ *                nothing across: an uncommitted edit to a file the incoming commits do not touch is
+ *                the same edit afterwards, and one they DO touch makes git abort before writing a
+ *                byte ("Your local changes … would be overwritten"). Untracked files likewise —
+ *                left alone, unless an incoming commit adds that path, which git refuses by name.
+ *                The check is therefore git's own, against the real history, and arrives as
+ *                `error`. Nothing here stashes, cleans or commits on the owner's behalf.
+ *   off-branch   refused when `branch` is given and HEAD is elsewhere. The declared branch is the
+ *                one the cloud judged stale; pulling whatever the checkout happens to be on would
+ *                be acting on a verdict about a different ref.
+ *   detached     refused — there is no branch for a pull to advance.
+ *   no-upstream  refused — `git pull` with no tracking information is a prompt, and a guess about
+ *                which remote was meant is exactly the decision this module must never make.
+ *   diverged     NOT a precondition: `--ff-only` is the check, and git makes it atomically against
+ *                the real history. It surfaces as `error`, with the tree untouched.
+ *
+ * Never creates a branch, never sets an upstream, never stashes.
+ */
+export function fastForwardRepo(workDir, opts = {}) {
+    const want = typeof opts.branch === "string" && opts.branch.trim() ? opts.branch.trim() : null;
+    if (want !== null && !isSwitchableBranchName(want))
+        throw new InspectError(`unusable branch name: ${String(opts.branch)}`);
+    const base = { ok: false, changed: false, branch: null, upstream: null, from: null, to: null, commits: null, dirty: false };
+    if (!existsSync(resolve(workDir, ".git")))
+        return { ...base, refused: "not-a-repo" };
+    let abbrev;
+    try {
+        abbrev = git(workDir, ["rev-parse", "--abbrev-ref", "HEAD"]).trim();
+    }
+    catch {
+        return { ...base, refused: "unknown-head" };
+    }
+    if (!abbrev)
+        return { ...base, refused: "unknown-head" };
+    if (abbrev === "HEAD")
+        return { ...base, refused: "detached" };
+    const branch = abbrev;
+    // Read, reported, never a refusal (see the doc above). A status git will not give is `null`,
+    // not `false` — "clean" is a claim, and this is the field the owner's sentence is built from.
+    let dirty;
+    try {
+        dirty = isDirty(workDir);
+    }
+    catch {
+        dirty = null;
+    }
+    if (want !== null && branch !== want)
+        return { ...base, branch, dirty, refused: "off-branch" };
+    let upstream;
+    try {
+        upstream = git(workDir, ["rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{u}"]).trim();
+    }
+    catch {
+        return { ...base, branch, dirty, refused: "no-upstream" };
+    }
+    if (!upstream)
+        return { ...base, branch, dirty, refused: "no-upstream" };
+    let from;
+    try {
+        from = git(workDir, ["rev-parse", "HEAD"]).trim() || null;
+    }
+    catch {
+        from = null;
+    }
+    try {
+        // The one network call in this file: the no-prompt environment `inspect.ts` uses for
+        // fetches, and a timeout above the runner's fetch cap, because a pull IS a fetch first.
+        git(workDir, gitWriteArgv("fast-forward"), { timeout: 30_000, env: networkGitEnv() });
+    }
+    catch (e) {
+        // `--ff-only` refused, an incoming commit would overwrite a local change or an untracked
+        // path, the network failed, or auth was needed and (correctly) not prompted for. In every
+        // case git left the tree as it was; the sentence says which, and names the file when there
+        // is one.
+        return { ...base, branch, upstream, from, to: from, dirty, error: gitFailureLine(e) };
+    }
+    // CONFIRM, do not assume — read HEAD back and count what arrived from git, not from the
+    // exit code.
+    let to;
+    try {
+        to = git(workDir, ["rev-parse", "HEAD"]).trim() || null;
+    }
+    catch {
+        to = null;
+    }
+    let commits = null;
+    if (from && to) {
+        try {
+            const n = Number.parseInt(git(workDir, ["rev-list", "--count", `${from}..${to}`]).trim(), 10);
+            commits = Number.isFinite(n) ? n : null;
+        }
+        catch {
+            commits = null;
+        }
+    }
+    let dirtyAfter;
+    try {
+        dirtyAfter = isDirty(workDir);
+    }
+    catch {
+        dirtyAfter = null;
+    }
+    return { ok: to !== null, changed: Boolean(from && to && from !== to), branch, upstream, from, to, commits, dirty: dirtyAfter };
+}

package/dist/browser-runner/coding/runtime.js

@@ -3,7 +3,7 @@ import { join, resolve } from "node:path";
 import { RunnerInputError } from "../errors.js";
 import { defaultStatePath, HeadlessSession } from "./headless.js";
 import { InspectError, readGitRemoteOrigin, readRepoFile, repoSearch, repoSync, repoTree, runRepoGit } from "./inspect.js";
-import { switchRepoBranch } from "./repo-write.js";
+import { fastForwardRepo, switchRepoBranch } from "./repo-write.js";
 import { checkWorkdir, ensureRepo, sanitizeSessionName } from "./repo.js";
 import { asTurnAuthor } from "./turn-author.js";
 /** Hard cap on a pane returned to the brain/console (matches the worker MAX_PANE_CHARS). */
@@ -65,14 +65,22 @@ export class CodingRuntime {
         return repoSync(this.resolveWorkDir(input), { branch: input.branch, forceFetch: input.forceFetch });
     }
     /**
-     * The ONE write the platform may make in a checkout by itself (#322) — put it back on a branch
-     * it declared, or refuse. See `repo-write.ts`: fixed argv, clean tree required, nothing in the
-     * `checkout .`/`reset`/`clean`/`stash` family exists to be reached.
+     * The writes the platform may make in a checkout by itself — put it back on a branch it
+     * declared (#322), or fast-forward it to its upstream (#802) — or refuse. See `repo-write.ts`:
+     * fixed argv, clean tree required, nothing in the `checkout .`/`reset`/`clean`/`stash` family
+     * exists to be reached.
      */
     gitWrite(input) {
-        if (input.cmd !== "switch-branch")
-            throw new InspectError(`unsupported git write command: ${String(input.cmd)}`);
-        return switchRepoBranch(this.resolveWorkDir(input), input.branch);
+        const workDir = this.resolveWorkDir(input);
+        if (input.cmd === "switch-branch") {
+            if (typeof input.branch !== "string")
+                throw new InspectError("switch-branch needs a branch");
+            return switchRepoBranch(workDir, input.branch);
+        }
+        // The second verb (#802): bring a clean checkout that is ON `branch` up to its upstream.
+        if (input.cmd === "fast-forward")
+            return fastForwardRepo(workDir, { branch: input.branch });
+        throw new InspectError(`unsupported git write command: ${String(input.cmd)}`);
     }
     /**
      * Find something in the repo — by file CONTENT or by file NAME (#508).

package/dist/browser-runner/server.js

@@ -343,9 +343,11 @@ async function route(runner, req, res) {
             return json(res, 400, { error: e instanceof Error ? e.message : String(e) });
         }
     }
-    // The ONE write surface (#322). A standing policy may put a checkout back on the branch it
-    // declared; it may not commit, discard, or touch a remote. An older runner 404s this, which the
-    // cloud reports as "asked, not confirmed" rather than as done.
+    // The ONE write surface (#322, #802). A standing policy may put a checkout back on the branch
+    // it declared, and a run may fast-forward a clean checkout to its upstream before it starts; it
+    // may not commit, discard, or push. An older runner 404s the endpoint (and a 0.4.58 runner
+    // 400s the `fast-forward` verb), which the cloud reports as "asked, not confirmed" rather than
+    // as done.
     if (req.method === "POST" && path === "/coding/git-write") {
         const b = await readJson(req);
         try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proagentstore/cli",
-  "version": "0.4.58",
+  "version": "0.4.60",
   "description": "CLI for creating, publishing, and running ProAgentStore agents",
   "license": "MIT",
   "type": "module",