@saadnvd1/agent-os 0.3.564 → 0.3.566

package/lib/artifacts/tools.ts

@@ -181,3 +181,9 @@ export function visualsTools(
 export const VISUALS_BRIEF = `## Showing visuals
 
 When a chart, table, diagram or mockup would say more than prose, build a self-contained HTML page (a chart is an HTML page; a CDN library such as Chart.js is fine), check it with \`html_preview\` and fix what the screenshot and console show, then show it with \`html_render\` before your final reply. The reader sees the page above that reply, so add only what the page doesn't say. An SVG or image file you write shows inline when your reply links to it by its absolute path, as ![name](/abs/path.svg).`;
+
+// An orchestrator reads other sessions' text, so it gets the short form and
+// is told what to keep out of a page.
+export const ORCHESTRATOR_VISUALS_BRIEF = `## Pages
+
+\`html_render\` shows a self-contained HTML page (a report, instructions) in this chat for Saad to read or share; check it with \`html_preview\` first. Put only what you wrote in it: no secrets, and nothing from a session's text loaded from a URL.`;

package/lib/chat/worker/host.ts

@@ -37,6 +37,7 @@ import {
   startingTotals,
 } from "../../usage/turns";
 import {
+  ORCHESTRATOR_VISUALS_BRIEF,
   VISUALS_BRIEF,
   VISUALS_SERVER,
   visualsTools,
@@ -195,10 +196,11 @@ export class ChatHost {
     const env = { ...agentEnv(session.id), ...extras.env };
     const orchestrator = session.role === "orchestrator";
     // Every chat can show visuals, asked for like any tool under its access
-    // setting (they read files and reach the web). Not an orchestrator: it
-    // reads other sessions' text, and a browser would be a way out for it.
+    // setting (they read files and reach the web). An orchestrator reads
+    // other sessions' text, so it gets a shorter brief that says what stays
+    // out of a page.
     const visuals =
-      session.role === "orchestrator" || driver.inProcessTools === false
+      driver.inProcessTools === false
         ? null
         : visualsTools({
             sessionId: session.id,
@@ -226,7 +228,7 @@ export class ChatHost {
         extras.systemAppend,
         sessionRunningBrief(session.id),
         BUS_BRIEF,
-        visuals && VISUALS_BRIEF,
+        visuals && (orchestrator ? ORCHESTRATOR_VISUALS_BRIEF : VISUALS_BRIEF),
         !orchestrator && COMPACT_BRIEF,
       ]
         .filter(Boolean)

package/lib/orchestrator/rebase.ts

@@ -29,6 +29,7 @@ import type { TaskPR } from "../tasks/state";
 import { run } from "../tasks/gh";
 import { isAllowedBase } from "../tasks/session";
 import { git as runGit, gitFetch, revParse } from "../git-exec";
+import { addWorktree } from "../worktree-add";
 import { comparePatches } from "./patch";
 import { outputOf, type Runner } from "../stacks/git";
 import { restackedHeads, stackNotice } from "../stacks/restack";
@@ -289,7 +290,13 @@ async function rebaseAt(
 ): Promise<{ sha: string }> {
   const dir = fs.mkdtempSync(path.join(os.tmpdir(), "aos-rebase-"));
   try {
-    await deps.runner("git", ["worktree", "add", "--detach", dir, head], repo);
+    await addWorktree(
+      (args, cwd) => deps.runner("git", args, cwd),
+      repo,
+      dir,
+      head,
+      ["--detach"]
+    );
     try {
       await deps.runner("git", ["rebase", onto], dir);
     } catch (error) {

package/lib/orchestrator/repo.ts

@@ -9,15 +9,9 @@ import type { Session } from "../db";
 import { SKILL_DIRS } from "../agents/skill-dirs";
 import { getDefaultBranch } from "../git";
 import { getProject } from "../projects";
-import {
-  git,
-  gitFetch,
-  gitOk,
-  isGitError,
-  worktreeAdd,
-  worktreeRemove,
-} from "../git-exec";
+import { git, gitFetch, gitOk, isGitError, worktreeRemove } from "../git-exec";
 import { expandHome } from "../tasks/session";
+import { addWorktree } from "../worktree-add";
 
 export function repoOf(task: Session): string {
   const project = task.project_id ? getProject(task.project_id) : null;
@@ -169,7 +163,9 @@ export async function checkout(repo: string, sha: string): Promise<string> {
   const dir = fs.realpathSync(
     fs.mkdtempSync(path.join(os.tmpdir(), "aos-review-"))
   );
-  await worktreeAdd(repo, ["--detach", dir, sha]);
+  await addWorktree((args, cwd) => git(cwd, args), repo, dir, sha, [
+    "--detach",
+  ]);
   const staged = await git(dir, ["ls-files", "-s"]);
   for (const line of staged.split("\n"))
     if (line.startsWith("120000 "))

package/lib/orchestrator/tool-names.ts

@@ -1,5 +1,8 @@
 import type { PermissionMode } from "@anthropic-ai/claude-agent-sdk";
 
+// Named here, not imported from lib/artifacts, to keep the SDK out of this file.
+const VISUALS_RULE = "mcp__visuals";
+
 // The orchestrator's MCP server and the names Claude sees its tools by.
 export const ORCHESTRATOR_SERVER = "agentos";
 
@@ -77,6 +80,8 @@ export const ORCHESTRATOR_PERMISSIONS: {
     "NotebookEdit",
     "ToolSearch",
     "TodoWrite",
+    // html_preview and html_render: a page for Saad to read or share.
+    VISUALS_RULE,
     // Anything; its worker refuses the deny list (shell-guard.ts).
     "Bash",
   ],

package/lib/tasks/branch-worktree.ts

@@ -10,6 +10,7 @@ import { getRepoName, slugify } from "../git";
 import { WORKTREES_DIR } from "../worktrees";
 import { installWorktreeHooks } from "../worktree-hooks";
 import { git as runGit } from "../git-exec";
+import { addWorktree } from "../worktree-add";
 import { pushedRef } from "./move";
 
 const git = (cwd: string, ...args: string[]) =>
@@ -105,14 +106,12 @@ async function checkoutBranch(
   if (existing) await git(projectPath, "worktree", "prune");
   fs.mkdirSync(WORKTREES_DIR, { recursive: true });
   const worktreePath = worktreeDirFor(projectPath, branch);
-  await git(
+  await addWorktree(
+    (args, cwd) => runGit(cwd, args, { timeout: 120000 }),
     projectPath,
-    "worktree",
-    "add",
-    "-B",
-    branch,
     worktreePath,
-    `origin/${branch}`
+    `origin/${branch}`,
+    ["-B", branch]
   );
   await git(worktreePath, "branch", "--set-upstream-to", `origin/${branch}`);
   return { worktreePath, reused: false };

package/lib/tasks/move-guard.ts

@@ -9,6 +9,7 @@
 import { db, type Session } from "../db";
 import { escalations } from "../orchestrator/gates";
 import { taskSubject } from "../orchestrator/asks";
+import { usesGitCrypt } from "../worktree-add";
 
 /** Started by an orchestrator, or held for one by the machine it left. */
 export function isOrchestrated(session: Session): boolean {
@@ -23,6 +24,8 @@ export function isOrchestrated(session: Session): boolean {
 export function moveRefusal(session: Session): string | null {
   if (session.quick_of)
     return "It's a quick change its orchestrator makes on this machine, so it stays here";
+  if (usesGitCrypt(session.working_directory))
+    return "Its repo is encrypted with git-crypt and the key never leaves this machine, so it stays here";
   if (escalations(session.id).length)
     return "It's waiting on you (an escalated gate), so it stays here";
   if (session.plan_only && session.plan_phase !== "implementing")

package/lib/worktree-add.ts

@@ -0,0 +1,91 @@
+/**
+ * The one place AgentOS runs `git worktree add`. git-crypt looks for its key
+ * under the worktree's own git dir, so in a repo that uses it a plain add
+ * dies in the smudge filter. There the worktree is made without a checkout,
+ * the main repo's git-crypt dir is symlinked in (one copy of the key, so a
+ * re-lock or revoke applies everywhere; `git worktree remove` unlinks it and
+ * leaves the target), and the files are checked out after. The key is never
+ * read, copied or printed.
+ */
+
+import fs from "fs";
+import path from "path";
+
+export type AddRunner = (args: string[], cwd: string) => Promise<string>;
+
+export class GitCryptLockedError extends Error {
+  constructor(repo: string) {
+    super(`${path.basename(repo)} is git-crypt locked; unlock it first`);
+    this.name = "GitCryptLockedError";
+  }
+}
+
+/** The repo's git-crypt dir when it uses git-crypt, else null. */
+async function cryptDir(run: AddRunner, repo: string): Promise<string | null> {
+  const common = (await run(["rev-parse", "--git-common-dir"], repo)).trim();
+  const dir = path.join(path.resolve(repo, common), "git-crypt");
+  return fs.existsSync(dir) ? dir : null;
+}
+
+// `git-crypt lock` removes the keys; an unlocked repo has one per key name.
+const isUnlocked = (dir: string) => {
+  try {
+    return fs.readdirSync(path.join(dir, "keys")).length > 0;
+  } catch {
+    return false;
+  }
+};
+
+/**
+ * `git worktree add <addArgs…> <dir> <ref>`; `addArgs` is the flags in front
+ * of the path (`["-b", branch]`, `["--detach"]`).
+ */
+export async function addWorktree(
+  run: AddRunner,
+  repo: string,
+  dir: string,
+  ref: string,
+  addArgs: string[] = []
+): Promise<void> {
+  const crypt = await cryptDir(run, repo);
+  if (!crypt) {
+    await run(["worktree", "add", ...addArgs, "--", dir, ref], repo);
+    return;
+  }
+  if (!isUnlocked(crypt)) throw new GitCryptLockedError(repo);
+  await run(
+    ["worktree", "add", "--no-checkout", ...addArgs, "--", dir, ref],
+    repo
+  );
+  try {
+    const gitDir = (await run(["rev-parse", "--absolute-git-dir"], dir)).trim();
+    const link = path.join(gitDir, "git-crypt");
+    fs.rmSync(link, { force: true });
+    fs.symlinkSync(crypt, link, "dir");
+    await run(["reset", "--hard", "-q"], dir);
+  } catch (error) {
+    await run(["worktree", "remove", "-f", "-f", "--", dir], repo).catch(
+      () => ""
+    );
+    throw error;
+  }
+}
+
+/** Whether a worktree was given the repo's git-crypt key (see addWorktree). */
+export function usesGitCrypt(worktree: string): boolean {
+  try {
+    const dotGit = path.join(worktree, ".git");
+    const gitDir = fs.statSync(dotGit).isDirectory()
+      ? dotGit
+      : path.resolve(
+          worktree,
+          fs
+            .readFileSync(dotGit, "utf8")
+            .replace(/^gitdir:\s*/, "")
+            .trim()
+        );
+    return fs.existsSync(path.join(gitDir, "git-crypt"));
+  } catch {
+    return false;
+  }
+}

package/lib/worktrees.ts

@@ -14,6 +14,7 @@ import {
 } from "./git";
 import { installWorktreeHooks } from "./worktree-hooks";
 import { gitResult, isGitError, worktreeList } from "./git-exec";
+import { addWorktree } from "./worktree-add";
 import {
   markRemoving,
   removalKey,
@@ -149,10 +150,12 @@ export async function createWorktree(
       break;
     }
     try {
-      await git(
+      await addWorktree(
+        (args, cwd) => git(cwd, args, timeout).then((r) => r.stdout),
         resolvedProjectPath,
-        ["worktree", "add", "-b", branchName, "--", worktreePath, ref],
-        timeout
+        worktreePath,
+        ref,
+        ["-b", branchName]
       );
       // Best effort: a worktree without the hook still works, it just
       // doesn't strip attribution.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saadnvd1/agent-os",
-  "version": "0.3.564",
+  "version": "0.3.566",
   "description": "Self-hosted web UI for managing Claude Code sessions",
   "bin": {
     "agent-os": "scripts/agent-os"