@saadnvd1/agent-os 0.3.465 → 0.3.467

package/README.md

@@ -908,10 +908,13 @@ it may do on its own, and the lines that always come back to you as asks.
   `BLOCKED:` or waiting, the diff stays in scope (no secrets, not only
   lockfiles, nothing outside the repo, within the card) and its stack parent
   has merged, and the PR body's Code review section names that commit. `land` judges each item again at its own head right before
-  merging it. The second failure of a gate or a repo with no CI goes to you
-  as an ask, and the orchestrator stops merging that task. Failures count per
-  task and gate: a review that blocks counts when its verdict arrives, once
-  per commit, whether or not `sign_off` ever reads it.
+  merging it. A gate failing again on a different commit, or a repo with no
+  CI, goes to you as an ask, and the orchestrator stops merging that task.
+  A failure counts once per task, gate and head commit, however many times
+  and from wherever that commit is judged (the armed watcher, CI finishing,
+  `sign_off`, `done`, `land`); a pass in between doesn't reset it. A review
+  that blocks counts when its verdict arrives, whether or not `sign_off`
+  ever reads it.
 - **Arm to merge:** `arm` (or **Arm merge** on a task's row) makes AgentOS
   merge the task's PR itself the moment every `sign_off` gate passes at its
   head, starting the review once CI is green, so nothing polls `sign_off`.
@@ -1258,6 +1261,13 @@ One Node process serves every terminal, chat stream and request, so a route
 handler in `app/api/` may not call a `*Sync` child_process or fs function:
 ESLint refuses it. Use the async form with a timeout.
 
+Every git process starts in `lib/git-exec.ts`: `git()`, `gitResult()`,
+`gitOk()` and named operations (`revParse`, `worktreeAdd`, `gitPush`, …). It
+sets one timeout, kills a hung git, never lets git prompt, keeps the server's
+tmux out of hooks and rejects with a `GitError` carrying the exit code and
+stderr. ESLint refuses git spawned anywhere else in `lib/`, `app/` or
+`server.ts`.
+
 `scripts/redeploy` (and `scripts/autodeploy`, which calls it) builds into
 `.next-build` while the live server keeps serving `.next`. The build is swapped
 in by rename only once it finished with a `BUILD_ID`, right before the restart.

package/app/api/git/commit/route.ts

@@ -45,7 +45,8 @@ export async function POST(request: NextRequest) {
 
     if (
       branchName &&
-      (typeof branchName !== "string" || !isValidBranchName(path, branchName))
+      (typeof branchName !== "string" ||
+        !(await isValidBranchName(path, branchName)))
     ) {
       return NextResponse.json(
         { error: "Invalid branch name" },
@@ -64,8 +65,8 @@ export async function POST(request: NextRequest) {
 
     // Create new branch if on main/master and branch name provided
     let newBranch = false;
-    if (branchName && isMainBranch(path)) {
-      createBranch(path, branchName);
+    if (branchName && (await isMainBranch(path))) {
+      await createBranch(path, branchName);
       newBranch = true;
     }
 

package/app/api/git/file-content/route.ts

@@ -1,10 +1,7 @@
 import { NextRequest, NextResponse } from "next/server";
-import { execFile } from "child_process";
-import { promisify } from "util";
+import { git } from "@/lib/git-exec";
 import { expandPath } from "@/lib/git-status";
 
-const execFileAsync = promisify(execFile);
-
 /**
  * GET /api/git/file-content?path=...&file=...
  * Get file content from git HEAD (original version before changes)
@@ -33,17 +30,9 @@ export async function GET(request: NextRequest) {
 
     try {
       // Get file content from HEAD
-      const { stdout: content } = await execFileAsync(
-        "git",
-        ["show", `HEAD:${file}`],
-        {
-          cwd: expandedPath,
-          encoding: "utf-8",
-          maxBuffer: 10 * 1024 * 1024, // 10MB
-          timeout: 30_000,
-          killSignal: "SIGKILL",
-        }
-      );
+      const content = await git(expandedPath, ["show", `HEAD:${file}`], {
+        timeout: 30_000,
+      });
 
       return NextResponse.json({ content });
     } catch (gitError: unknown) {

package/app/api/git/history/[hash]/diff/route.ts

@@ -31,7 +31,7 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
       );
     }
 
-    const diff = getCommitFileDiff(path, hash, file);
+    const diff = await getCommitFileDiff(path, hash, file);
     return NextResponse.json({ diff });
   } catch (error) {
     console.error("Error getting commit file diff:", error);

package/app/api/git/history/[hash]/route.ts

@@ -23,7 +23,7 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
       );
     }
 
-    const commit = getCommitDetail(path, hash);
+    const commit = await getCommitDetail(path, hash);
     if (!commit) {
       return NextResponse.json({ error: "Commit not found" }, { status: 404 });
     }

package/app/api/git/history/route.ts

@@ -15,7 +15,7 @@ export async function GET(request: NextRequest) {
       );
     }
 
-    const commits = getCommitHistory(path, limit);
+    const commits = await getCommitHistory(path, limit);
     return NextResponse.json({ commits });
   } catch (error) {
     console.error("Error getting commit history:", error);

package/app/api/git/push/route.ts

@@ -28,7 +28,7 @@ export async function POST(request: NextRequest) {
     }
 
     // Check if remote exists
-    const remoteUrl = getRemoteUrl(path);
+    const remoteUrl = await getRemoteUrl(path);
     if (!remoteUrl) {
       return NextResponse.json(
         { error: "No remote origin configured" },
@@ -48,7 +48,7 @@ export async function POST(request: NextRequest) {
     }
 
     // Push (set upstream if needed)
-    const needsUpstream = !hasUpstream(path);
+    const needsUpstream = !(await hasUpstream(path));
     const output = await push(path, needsUpstream);
 
     forgetGitStatus(path);

package/app/api/sessions/[id]/pr/route.ts

@@ -2,6 +2,7 @@ import { NextRequest, NextResponse } from "next/server";
 import { execFile } from "child_process";
 import { promisify } from "util";
 import { getDb, queries, type Session } from "@/lib/db";
+import { gitPush } from "@/lib/git-exec";
 
 const execFileAsync = promisify(execFile);
 
@@ -69,8 +70,7 @@ async function createPR(
 ): Promise<PRInfo> {
   // First push the branch if not already pushed
   try {
-    await execFileAsync("git", ["push", "-u", "origin", "--", branchName], {
-      cwd: projectPath,
+    await gitPush(projectPath, ["-u", "origin", "--", branchName], {
       timeout: 30000,
     });
   } catch {

package/lib/away/deploy.ts

@@ -9,7 +9,7 @@
 
 import fs from "fs";
 import type { ProjectConfig } from "../project-config";
-import { run } from "../tasks/gh";
+import { gitFetch, isAncestor } from "../git-exec";
 import { expandHome } from "../tasks/session";
 import { selfUrl } from "../agents/self-env";
 import { commitTime } from "../orchestrator/repo";
@@ -61,15 +61,11 @@ async function contains(
   sha: string
 ): Promise<boolean> {
   if (tip === sha) return true;
-  const ancestor = () =>
-    run("git", ["merge-base", "--is-ancestor", sha, tip], repo).then(
-      () => true,
-      () => false
-    );
+  const ancestor = () => isAncestor(repo, sha, tip);
   if (await ancestor()) return true;
   // The deployed commit may be newer than this checkout knows. A fetch that
   // fails throws, so stale refs never read as "not deployed".
-  await run("git", ["fetch", "--quiet", "origin"], repo);
+  await gitFetch(repo, ["--quiet", "origin"]);
   return ancestor();
 }
 

package/lib/away/run.ts

@@ -23,6 +23,7 @@ import { notifyPhone } from "../notify";
 import { getProject } from "../projects";
 import { loadProjectConfig } from "../project-config";
 import { run } from "../tasks/gh";
+import { git } from "../git-exec";
 import { expandHome } from "../tasks/session";
 import { auditId, auditsRoot, writeAtomic } from "../session-audit/store";
 import {
@@ -199,11 +200,11 @@ async function dirtySessions(ids: string[]): Promise<Set<string>> {
         // A linked machine's worktree isn't on this disk.
         if (!s || (s.host_id && s.host_id !== "local")) return;
         const dir = expandHome(s.worktree_path || s.working_directory);
-        const out = await run(
-          "git",
-          ["status", "--porcelain", "--untracked-files=normal"],
-          dir
-        ).catch(() => "");
+        const out = await git(dir, [
+          "status",
+          "--porcelain",
+          "--untracked-files=normal",
+        ]).catch(() => "");
         if (out.trim()) dirty.add(id);
       })
     );

package/lib/build.ts

@@ -3,20 +3,16 @@
 // A worker whose build isn't the server's is running code from before a
 // redeploy.
 
-import { execFileSync } from "child_process";
 import fs from "fs";
 import path from "path";
 import type { ChatState } from "./chat/events";
+import { gitSync } from "./git-exec";
 
 export function buildId(): string {
   if (process.env.AGENTOS_BUILD) return process.env.AGENTOS_BUILD;
   let id = "";
   try {
-    id = execFileSync("git", ["rev-parse", "HEAD"], {
-      cwd: process.cwd(),
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"],
-    }).trim();
+    id = gitSync(process.cwd(), ["rev-parse", "HEAD"]).trim();
   } catch {}
   if (!id) {
     try {

package/lib/chat/files.ts

@@ -1,5 +1,6 @@
 import { execFile } from "child_process";
 import { promisify } from "util";
+import { git } from "../git-exec";
 import type { FileSuggestion } from "./events";
 import {
   indexPaths,
@@ -33,11 +34,36 @@ export function sweepFileIndexes(now = Date.now()): void {
 
 export const fileIndexCount = () => cache.size;
 
+const LIST_TIMEOUT_MS = 5000;
+
+export interface Lister {
+  // The program it needs.
+  cmd: string;
+  list: (cwd: string) => Promise<string>;
+}
+
 // Ways to list a folder's files with ignored ones left out: ripgrep, or
 // git where ripgrep isn't installed.
-export const LISTERS: [string, string[]][] = [
-  ["rg", ["--files", "--hidden", "-g", "!.git"]],
-  ["git", ["ls-files", "--cached", "--others", "--exclude-standard"]],
+export const LISTERS: Lister[] = [
+  {
+    cmd: "rg",
+    list: async (cwd) =>
+      (
+        await execFileAsync("rg", ["--files", "--hidden", "-g", "!.git"], {
+          cwd,
+          maxBuffer: 64 * 1024 * 1024,
+          timeout: LIST_TIMEOUT_MS,
+        })
+      ).stdout,
+  },
+  {
+    cmd: "git",
+    list: (cwd) =>
+      git(cwd, ["ls-files", "--cached", "--others", "--exclude-standard"], {
+        timeout: LIST_TIMEOUT_MS,
+        maxBuffer: 64 * 1024 * 1024,
+      }),
+  },
 ];
 
 // The folder's files, for @mentions when no agent is running to match them
@@ -46,13 +72,9 @@ export async function listFiles(
   cwd: string,
   listers = LISTERS
 ): Promise<IndexedPath[]> {
-  for (const [cmd, args] of listers) {
+  for (const { list } of listers) {
     try {
-      const { stdout } = await execFileAsync(cmd, args, {
-        cwd,
-        maxBuffer: 64 * 1024 * 1024,
-        timeout: 5000,
-      });
+      const stdout = await list(cwd);
       return indexPaths(
         withFolders(stdout.split("\n").filter(Boolean).slice(0, MAX_FILES))
       );

package/lib/db/migrations.ts

@@ -1327,6 +1327,37 @@ const migrations: Migration[] = [
       installChangeTriggers(db, TABLES_WATCHED_58);
     },
   },
+  {
+    id: 59,
+    name: "gate_failure_commits",
+    up: (db) => {
+      // Each head a gate failed on, once: a gate's failure counts once per
+      // commit however many times that commit is judged (the armed watcher,
+      // CI finishing, sign_off, done, land), and the second commit it fails
+      // on goes to Saad. The key is what makes it once, across restarts and
+      // concurrent evaluations.
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS orchestrator_gate_failure_commits (
+          session_id TEXT NOT NULL,
+          gate TEXT NOT NULL,
+          sha TEXT NOT NULL,
+          workspace_id TEXT NOT NULL,
+          reason TEXT,
+          created_at TEXT NOT NULL DEFAULT (datetime('now')),
+          PRIMARY KEY (session_id, gate, sha)
+        );
+        INSERT OR IGNORE INTO orchestrator_gate_failure_commits (session_id, gate, sha, workspace_id, reason)
+          SELECT session_id, gate, last_sha, workspace_id, last_reason
+          FROM orchestrator_gate_failures WHERE last_sha IS NOT NULL;
+        CREATE TRIGGER IF NOT EXISTS gate_failures_clear_commits
+          AFTER DELETE ON orchestrator_gate_failures
+        BEGIN
+          DELETE FROM orchestrator_gate_failure_commits
+            WHERE session_id = OLD.session_id AND gate = OLD.gate;
+        END;
+      `);
+    },
+  },
 ];
 
 // `upTo`: stop after this id (tests that start from an older database).

package/lib/done/remote.ts

@@ -4,7 +4,7 @@
 
 import type { Session } from "../db";
 import type { TaskPR } from "../tasks";
-import { run } from "../tasks/gh";
+import { git, gitPush } from "../git-exec";
 import { projectPathFor } from "../tasks/session";
 import { PROTECTED_BRANCHES } from "../tasks/finish";
 import { liveChildren } from "../stacks/guard";
@@ -23,15 +23,14 @@ export async function deleteMergedRemote(
     liveChildren(s.id).length
   )
     return false;
-  const line = await run(
-    "git",
-    ["ls-remote", "--heads", "origin", `refs/heads/${branch}`],
+  const line = await git(
     repo,
-    30000
+    ["ls-remote", "--heads", "origin", `refs/heads/${branch}`],
+    { timeout: 30000 }
   ).catch(() => "");
   const tip = line.trim().split(/\s+/)[0];
   if (!tip || tip !== pr.head) return false;
-  return run("git", ["push", "origin", "--delete", branch], repo, 60000)
+  return gitPush(repo, ["origin", "--delete", branch], { timeout: 60000 })
     .then(() => true)
     .catch(() => false);
 }

package/lib/done/testing.ts

@@ -4,18 +4,13 @@
 import fs from "fs";
 import os from "os";
 import path from "path";
-import { execFileSync } from "child_process";
+import { gitSync } from "../git-exec";
 
 // Old enough that CI counts as settled on every commit.
 const env = { ...process.env, GIT_COMMITTER_DATE: "2026-01-01T00:00:00Z" };
 
 export const git = (cwd: string, ...args: string[]) =>
-  execFileSync("git", args, {
-    cwd,
-    encoding: "utf8",
-    stdio: "pipe",
-    env,
-  }).trim();
+  gitSync(cwd, args, { env }).trim();
 
 export function commitFile(cwd: string, file: string, text: string): string {
   fs.mkdirSync(path.dirname(path.join(cwd, file)), { recursive: true });

package/lib/done/worktree.ts

@@ -7,7 +7,7 @@
 import fs from "fs";
 import type { Session } from "../db";
 import { getDefaultBranch } from "../git";
-import { run } from "../tasks/gh";
+import { git as runGit } from "../git-exec";
 import { mergePolicy } from "../tasks/merge-policy";
 import { getProject } from "../projects";
 import {
@@ -24,7 +24,7 @@ export type WorktreeFate =
   | { action: "kept"; why: string; path: string };
 
 const git = (cwd: string, ...args: string[]) =>
-  run("git", args, cwd, 30000).then((out) => out.trim());
+  runGit(cwd, args, { timeout: 30000 }).then((out) => out.trim());
 
 // The main checkout a worktree belongs to.
 async function repoOf(worktree: string): Promise<string> {