@saadnvd1/agent-os 0.3.564 → 0.3.565

package/lib/orchestrator/rebase.ts

@@ -29,6 +29,7 @@ import type { TaskPR } from "../tasks/state";
 import { run } from "../tasks/gh";
 import { isAllowedBase } from "../tasks/session";
 import { git as runGit, gitFetch, revParse } from "../git-exec";
+import { addWorktree } from "../worktree-add";
 import { comparePatches } from "./patch";
 import { outputOf, type Runner } from "../stacks/git";
 import { restackedHeads, stackNotice } from "../stacks/restack";
@@ -289,7 +290,13 @@ async function rebaseAt(
 ): Promise<{ sha: string }> {
   const dir = fs.mkdtempSync(path.join(os.tmpdir(), "aos-rebase-"));
   try {
-    await deps.runner("git", ["worktree", "add", "--detach", dir, head], repo);
+    await addWorktree(
+      (args, cwd) => deps.runner("git", args, cwd),
+      repo,
+      dir,
+      head,
+      ["--detach"]
+    );
     try {
       await deps.runner("git", ["rebase", onto], dir);
     } catch (error) {

package/lib/orchestrator/repo.ts

@@ -9,15 +9,9 @@ import type { Session } from "../db";
 import { SKILL_DIRS } from "../agents/skill-dirs";
 import { getDefaultBranch } from "../git";
 import { getProject } from "../projects";
-import {
-  git,
-  gitFetch,
-  gitOk,
-  isGitError,
-  worktreeAdd,
-  worktreeRemove,
-} from "../git-exec";
+import { git, gitFetch, gitOk, isGitError, worktreeRemove } from "../git-exec";
 import { expandHome } from "../tasks/session";
+import { addWorktree } from "../worktree-add";
 
 export function repoOf(task: Session): string {
   const project = task.project_id ? getProject(task.project_id) : null;
@@ -169,7 +163,9 @@ export async function checkout(repo: string, sha: string): Promise<string> {
   const dir = fs.realpathSync(
     fs.mkdtempSync(path.join(os.tmpdir(), "aos-review-"))
   );
-  await worktreeAdd(repo, ["--detach", dir, sha]);
+  await addWorktree((args, cwd) => git(cwd, args), repo, dir, sha, [
+    "--detach",
+  ]);
   const staged = await git(dir, ["ls-files", "-s"]);
   for (const line of staged.split("\n"))
     if (line.startsWith("120000 "))

package/lib/tasks/branch-worktree.ts

@@ -10,6 +10,7 @@ import { getRepoName, slugify } from "../git";
 import { WORKTREES_DIR } from "../worktrees";
 import { installWorktreeHooks } from "../worktree-hooks";
 import { git as runGit } from "../git-exec";
+import { addWorktree } from "../worktree-add";
 import { pushedRef } from "./move";
 
 const git = (cwd: string, ...args: string[]) =>
@@ -105,14 +106,12 @@ async function checkoutBranch(
   if (existing) await git(projectPath, "worktree", "prune");
   fs.mkdirSync(WORKTREES_DIR, { recursive: true });
   const worktreePath = worktreeDirFor(projectPath, branch);
-  await git(
+  await addWorktree(
+    (args, cwd) => runGit(cwd, args, { timeout: 120000 }),
     projectPath,
-    "worktree",
-    "add",
-    "-B",
-    branch,
     worktreePath,
-    `origin/${branch}`
+    `origin/${branch}`,
+    ["-B", branch]
   );
   await git(worktreePath, "branch", "--set-upstream-to", `origin/${branch}`);
   return { worktreePath, reused: false };

package/lib/tasks/move-guard.ts

@@ -9,6 +9,7 @@
 import { db, type Session } from "../db";
 import { escalations } from "../orchestrator/gates";
 import { taskSubject } from "../orchestrator/asks";
+import { usesGitCrypt } from "../worktree-add";
 
 /** Started by an orchestrator, or held for one by the machine it left. */
 export function isOrchestrated(session: Session): boolean {
@@ -23,6 +24,8 @@ export function isOrchestrated(session: Session): boolean {
 export function moveRefusal(session: Session): string | null {
   if (session.quick_of)
     return "It's a quick change its orchestrator makes on this machine, so it stays here";
+  if (usesGitCrypt(session.working_directory))
+    return "Its repo is encrypted with git-crypt and the key never leaves this machine, so it stays here";
   if (escalations(session.id).length)
     return "It's waiting on you (an escalated gate), so it stays here";
   if (session.plan_only && session.plan_phase !== "implementing")

package/lib/worktree-add.ts

@@ -0,0 +1,91 @@
+/**
+ * The one place AgentOS runs `git worktree add`. git-crypt looks for its key
+ * under the worktree's own git dir, so in a repo that uses it a plain add
+ * dies in the smudge filter. There the worktree is made without a checkout,
+ * the main repo's git-crypt dir is symlinked in (one copy of the key, so a
+ * re-lock or revoke applies everywhere; `git worktree remove` unlinks it and
+ * leaves the target), and the files are checked out after. The key is never
+ * read, copied or printed.
+ */
+
+import fs from "fs";
+import path from "path";
+
+export type AddRunner = (args: string[], cwd: string) => Promise<string>;
+
+export class GitCryptLockedError extends Error {
+  constructor(repo: string) {
+    super(`${path.basename(repo)} is git-crypt locked; unlock it first`);
+    this.name = "GitCryptLockedError";
+  }
+}
+
+/** The repo's git-crypt dir when it uses git-crypt, else null. */
+async function cryptDir(run: AddRunner, repo: string): Promise<string | null> {
+  const common = (await run(["rev-parse", "--git-common-dir"], repo)).trim();
+  const dir = path.join(path.resolve(repo, common), "git-crypt");
+  return fs.existsSync(dir) ? dir : null;
+}
+
+// `git-crypt lock` removes the keys; an unlocked repo has one per key name.
+const isUnlocked = (dir: string) => {
+  try {
+    return fs.readdirSync(path.join(dir, "keys")).length > 0;
+  } catch {
+    return false;
+  }
+};
+
+/**
+ * `git worktree add <addArgs…> <dir> <ref>`; `addArgs` is the flags in front
+ * of the path (`["-b", branch]`, `["--detach"]`).
+ */
+export async function addWorktree(
+  run: AddRunner,
+  repo: string,
+  dir: string,
+  ref: string,
+  addArgs: string[] = []
+): Promise<void> {
+  const crypt = await cryptDir(run, repo);
+  if (!crypt) {
+    await run(["worktree", "add", ...addArgs, "--", dir, ref], repo);
+    return;
+  }
+  if (!isUnlocked(crypt)) throw new GitCryptLockedError(repo);
+  await run(
+    ["worktree", "add", "--no-checkout", ...addArgs, "--", dir, ref],
+    repo
+  );
+  try {
+    const gitDir = (await run(["rev-parse", "--absolute-git-dir"], dir)).trim();
+    const link = path.join(gitDir, "git-crypt");
+    fs.rmSync(link, { force: true });
+    fs.symlinkSync(crypt, link, "dir");
+    await run(["reset", "--hard", "-q"], dir);
+  } catch (error) {
+    await run(["worktree", "remove", "-f", "-f", "--", dir], repo).catch(
+      () => ""
+    );
+    throw error;
+  }
+}
+
+/** Whether a worktree was given the repo's git-crypt key (see addWorktree). */
+export function usesGitCrypt(worktree: string): boolean {
+  try {
+    const dotGit = path.join(worktree, ".git");
+    const gitDir = fs.statSync(dotGit).isDirectory()
+      ? dotGit
+      : path.resolve(
+          worktree,
+          fs
+            .readFileSync(dotGit, "utf8")
+            .replace(/^gitdir:\s*/, "")
+            .trim()
+        );
+    return fs.existsSync(path.join(gitDir, "git-crypt"));
+  } catch {
+    return false;
+  }
+}

package/lib/worktrees.ts

@@ -14,6 +14,7 @@ import {
 } from "./git";
 import { installWorktreeHooks } from "./worktree-hooks";
 import { gitResult, isGitError, worktreeList } from "./git-exec";
+import { addWorktree } from "./worktree-add";
 import {
   markRemoving,
   removalKey,
@@ -149,10 +150,12 @@ export async function createWorktree(
       break;
     }
     try {
-      await git(
+      await addWorktree(
+        (args, cwd) => git(cwd, args, timeout).then((r) => r.stdout),
         resolvedProjectPath,
-        ["worktree", "add", "-b", branchName, "--", worktreePath, ref],
-        timeout
+        worktreePath,
+        ref,
+        ["-b", branchName]
       );
       // Best effort: a worktree without the hook still works, it just
       // doesn't strip attribution.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saadnvd1/agent-os",
-  "version": "0.3.564",
+  "version": "0.3.565",
   "description": "Self-hosted web UI for managing Claude Code sessions",
   "bin": {
     "agent-os": "scripts/agent-os"