@saadnvd1/agent-os 0.3.657 → 0.3.659

package/lib/agents/launch.ts

@@ -10,6 +10,7 @@ import { runInBackground } from "../async-operations";
 import { trustPromptKeys } from "../tasks/state";
 import { BUS_BRIEF } from "./brief";
 import { selfUrl } from "./self-env";
+import { sessionPath } from "./tool-path";
 import { autoCompactEnv } from "../chat/refresh";
 import { subagentEnv } from "../models/subagents";
 import { COMPACT_BRIEF } from "../chat/working-state";
@@ -43,7 +44,7 @@ export function agentEnv(sessionId: string): Record<string, string> {
     ...subagentEnv(),
     AGENTOS_SESSION_ID: sessionId,
     AGENTOS_URL: selfUrl(),
-    PATH: `${AOS_BIN_DIR}:${process.env.PATH ?? ""}`,
+    PATH: `${AOS_BIN_DIR}:${sessionPath()}`,
   };
 }
 

package/lib/agents/tool-path.ts

@@ -0,0 +1,61 @@
+import fs from "fs";
+import os from "os";
+import path from "path";
+
+// Where Saad's language version managers and user-level tools put their
+// binaries, in the order they should win. A shell's rc files normally add
+// these; a session AgentOS starts doesn't read them, so `bin/rails` would
+// find the system Ruby. Built in code so it is fast and the same on the Mac
+// and the Linux box (missing dirs are skipped).
+const USER_TOOL_DIRS = [
+  ".rbenv/shims",
+  ".local/share/mise/shims",
+  ".asdf/shims",
+  ".pyenv/shims",
+  ".local/bin",
+  ".bun/bin",
+  ".cargo/bin",
+];
+const SYSTEM_TOOL_DIRS = ["/opt/homebrew/bin", "/opt/homebrew/sbin"];
+
+function isDir(p: string): boolean {
+  try {
+    return fs.statSync(p).isDirectory();
+  } catch {
+    return false;
+  }
+}
+
+// `npm run` puts every node_modules/.bin from the server's directory upward on
+// PATH; for a session in another repo those would shadow the project's tools.
+function serverBinDirs(cwd: string): Set<string> {
+  const dirs = new Set<string>();
+  for (let d = path.resolve(cwd); ; d = path.dirname(d)) {
+    dirs.add(path.join(d, "node_modules", ".bin"));
+    if (path.dirname(d) === d) break;
+  }
+  return dirs;
+}
+
+export function sessionPath(
+  inherited: string | undefined = process.env.PATH,
+  home: string = os.homedir(),
+  cwd: string = process.cwd()
+): string {
+  const drop = serverBinDirs(cwd);
+  const out: string[] = [];
+  const seen = new Set<string>();
+  const add = (dir: string) => {
+    if (!dir || seen.has(dir)) return;
+    seen.add(dir);
+    out.push(dir);
+  };
+  for (const d of [
+    ...USER_TOOL_DIRS.map((d) => path.join(home, d)),
+    ...SYSTEM_TOOL_DIRS,
+  ])
+    if (isDir(d)) add(d);
+  for (const d of (inherited ?? "").split(path.delimiter))
+    if (!drop.has(d)) add(d);
+  return out.join(path.delimiter);
+}

package/lib/dev-instance/liveServer.ts

@@ -34,6 +34,17 @@ export function writeLiveRecord(
   fs.renameSync(tmp, recordPath(home));
 }
 
+// The recorded checkout the live server runs from, even when its process is
+// gone (mid-restart).
+export function liveCheckout(home = agentOsHome()): string | null {
+  try {
+    const rec = JSON.parse(fs.readFileSync(recordPath(home), "utf8"));
+    return typeof rec?.cwd === "string" && rec.cwd ? rec.cwd : null;
+  } catch {
+    return null;
+  }
+}
+
 export function readLiveRecord(home = agentOsHome()): InstanceRecord | null {
   try {
     const rec = JSON.parse(fs.readFileSync(recordPath(home), "utf8"));

package/lib/orchestrator/brief.ts

@@ -160,7 +160,7 @@ Acting:
 
 The MCP servers this workspace allows (Settings → Workspaces) are yours to use through their own tools, for reading and for additive, reversible changes. Anything outbound through them (sending a message, an email, a post) is a hard line: park it with \`ask_saad\`.
 
-Act through these tools, not the shell: they're scoped to this workspace and braked. The shell runs anything without asking (Saad chose this on 2026-10-11), so use it to read and investigate yourself: \`gh pr list\`, \`gh run view --log-failed\`, \`gh api\` GETs, \`curl\`, \`sqlite3 -readonly\`, git in any repository, a skill's scripts, pipes and chains. Never use it to get around the tools. A deny list refuses, naming the tool to use instead: merging, closing or retargeting a PR (\`${TOOL_NAMES.sign_off}\`, \`${TOOL_NAMES.arm}\`, \`${TOOL_NAMES.land}\`, \`${TOOL_NAMES.drop}\`), \`git push\` (\`${TOOL_NAMES.quick_pr}\`), writing in a project repository or task worktree other than your own quick changes (\`${TOOL_NAMES.start_task}\`, \`${TOOL_NAMES.quick_change}\`), writing AgentOS's state (sqlite3 without \`-readonly\`, or files in ~/.agent-os outside your folder), stopping or restarting AgentOS or its tmux, and reading secret files (env files, keys, ~/.ssh, ~/.aws). Tokenvault is available through \`tv\`: use a token inside the command that needs it (e.g. \`FOO="\$(tv get <project> <desc>)" cmd\`), never print, echo or log a value, and never send one off the machine except to the service it's for. The list catches honest mistakes, not a determined bypass: a script or \`python -c\` could do any of these unseen, and doing so would break Saad's trust in every gate. \`aos notify "<text>"\` pushes a message to Saad's phone. Use it for what he'd want to see now and asked for: the morning report, a real milestone (a stack landed, a blocker only he can clear). Never for routine status: one a minute at most, and he reads the rest here. You can read files anywhere (Read, Grep, Glob), and write them (Write, Edit, NotebookEdit) anywhere except: a project repository or task worktree other than your own open quick changes' worktrees (start a task, or a quick change for a small edit, so the change goes through CI, review and scope), AgentOS's own state in ~/.agent-os outside your folder, secret files (.env, keys, ~/.ssh, ~/.aws, tokenvault and the like), and files that make something run: dotfiles and dot-folders at the top of your home (shell, git, Claude and tool config), ~/Library and /Library's launch agents, git's core.hooksPath folders, the folders on PATH, and any .git, .claude, .mcp.json, CLAUDE.md or AGENTS.md, which would hand you a shell or run code around the gates. Each write is checked before it runs, on the path with symlinks and \`..\` resolved; a refused one says why.
+Act through these tools, not the shell: they're scoped to this workspace and braked. The shell runs anything without asking (Saad chose this on 2026-10-11), so use it to read and investigate yourself: \`gh pr list\`, \`gh run view --log-failed\`, \`gh api\` GETs, \`curl\`, \`sqlite3 -readonly\`, git in any repository, a skill's scripts, pipes and chains. Never use it to get around the tools. A deny list refuses, naming the tool to use instead: merging, closing or retargeting a PR (\`${TOOL_NAMES.sign_off}\`, \`${TOOL_NAMES.arm}\`, \`${TOOL_NAMES.land}\`, \`${TOOL_NAMES.drop}\`), \`git push\` (\`${TOOL_NAMES.quick_pr}\`), writing in a project repository or task worktree other than your own quick changes, except in a project checkout of your own workspace, where you may update and move the branch: \`git pull\` in any form, \`merge\`, \`reset\` (even \`--hard\`), \`checkout\`, \`switch\` and \`rebase\` (also as \`git -C <path>\`), then \`bundle install\`, \`npm install\` or \`bin/rails db:prepare\`. Commits, \`stash\`, \`clean\`, \`restore\` and file edits there still go through tasks and quick changes, and other workspaces' repositories, task worktrees and AgentOS's own live checkout (autodeploy deploys it) are refused for all of it are refused (\`${TOOL_NAMES.start_task}\`, \`${TOOL_NAMES.quick_change}\`), writing AgentOS's state (sqlite3 without \`-readonly\`, or files in ~/.agent-os outside your folder), stopping or restarting AgentOS or its tmux, and reading secret files (env files, keys, ~/.ssh, ~/.aws). Tokenvault is available through \`tv\`: use a token inside the command that needs it (e.g. \`FOO="\$(tv get <project> <desc>)" cmd\`), never print, echo or log a value, and never send one off the machine except to the service it's for. The list catches honest mistakes, not a determined bypass: a script or \`python -c\` could do any of these unseen, and doing so would break Saad's trust in every gate. \`aos notify "<text>"\` pushes a message to Saad's phone. Use it for what he'd want to see now and asked for: the morning report, a real milestone (a stack landed, a blocker only he can clear). Never for routine status: one a minute at most, and he reads the rest here. You can read files anywhere (Read, Grep, Glob), and write them (Write, Edit, NotebookEdit) anywhere except: a project repository or task worktree other than your own open quick changes' worktrees (start a task, or a quick change for a small edit, so the change goes through CI, review and scope), AgentOS's own state in ~/.agent-os outside your folder, secret files (.env, keys, ~/.ssh, ~/.aws, tokenvault and the like), and files that make something run: dotfiles and dot-folders at the top of your home (shell, git, Claude and tool config), ~/Library and /Library's launch agents, git's core.hooksPath folders, the folders on PATH, and any .git, .claude, .mcp.json, CLAUDE.md or AGENTS.md, which would hand you a shell or run code around the gates. Each write is checked before it runs, on the path with symlinks and \`..\` resolved; a refused one says why.
 
 ## Untrusted text
 

package/lib/orchestrator/shell-guard.ts

@@ -29,6 +29,10 @@ export interface ShellContext {
   // Whether this path is under ~/.agent-os/audits, where reports go and
   // nothing may be made executable.
   inAudits?: (p: string) => Promise<boolean>;
+  // What a folder is for fast-forwarding: a project checkout of this
+  // workspace ("own"), the checkout AgentOS's live server and autodeploy run
+  // from ("live"), or anything else.
+  checkoutKind?: (dir: string) => Promise<"own" | "live" | "other">;
   // AgentOS's server and the tmux servers it runs sessions in.
   protectedPids: () => Promise<Set<number>>;
 }
@@ -324,22 +328,40 @@ const GIT_WRITES = new Set([
 
 const READ_ONLY_STASH = new Set(["list", "show"]);
 
+// What an orchestrator may do to a project checkout of its own workspace:
+// bring it up to date and move its branch (Saad, 2026-10-18). Commits, stash,
+// clean and file edits still go through tasks and quick changes.
+const CHECKOUT_UPDATES = new Set([
+  "pull",
+  "merge",
+  "reset",
+  "checkout",
+  "switch",
+  "rebase",
+]);
+
 async function gitRefusal(
-  args: string[],
+  inv: Invocation,
   ctx: ShellContext,
   cwd: string
 ): Promise<string | null> {
+  const args = inv.args;
+  // Every repository the command names: the folder after each -C, and each
+  // git dir and work tree, by option or environment.
+  const named = new Set<string>();
   let dir = cwd;
   let i = 0;
   for (; i < args.length; i++) {
     const a = args[i];
     if (a === "-C" || a === "--git-dir" || a === "--work-tree") {
-      dir = path.resolve(dir, args[++i] ?? "");
+      const to = path.resolve(dir, args[++i] ?? "");
+      if (a === "-C") dir = to;
+      named.add(to);
       continue;
     }
     const eq = /^--(git-dir|work-tree)=(.*)$/.exec(a);
     if (eq) {
-      dir = path.resolve(dir, eq[2]);
+      named.add(path.resolve(dir, eq[2]));
       continue;
     }
     if (a === "-c" || a === "--namespace" || a === "--exec-path") {
@@ -349,17 +371,28 @@ async function gitRefusal(
     if (a.startsWith("-")) continue;
     break;
   }
+  named.add(dir);
+  for (const w of inv.cmd.words) {
+    const env = /^GIT_(?:DIR|WORK_TREE)=(.*)$/.exec(w);
+    if (env) named.add(path.resolve(cwd, env[1]));
+  }
   const sub = args[i];
   if (sub === "push")
     return `Refused: ${T.quick_pr} pushes a quick change's branch and opens its PR, and tasks push their own; nothing pushes from the orchestrator's shell.`;
   if (!GIT_WRITES.has(sub)) return null;
   if (sub === "stash" && READ_ONLY_STASH.has(args[i + 1])) return null;
-  if (has(dir))
-    return `Refused: git ${sub} in a folder only the shell knows (${show(dir)}); name the folder.`;
-  const why = await ctx.writeRefusal(dir);
-  return why
-    ? `Refused: git ${sub} in ${dir}. Orchestrators don't change project checkouts (autodeploy runs from them). To see current code: \`git -C ${dir} fetch\` then \`git -C ${dir} show origin/main:<path>\` or \`git -C ${dir} log origin/main\`.`
-    : null;
+  for (const d of named) {
+    if (has(d))
+      return `Refused: git ${sub} in a folder only the shell knows (${show(d)}); name the folder.`;
+    if (!(await ctx.writeRefusal(d))) continue;
+    const kind = (await ctx.checkoutKind?.(d)) ?? "other";
+    const updates = CHECKOUT_UPDATES.has(sub);
+    if (kind === "live" && updates)
+      return `Refused: git ${sub} in ${d}. This is the checkout AgentOS's live server runs from; autodeploy deploys it (restart gap and health check), and changing it here would swap the code under the running server. For a manual deploy use scripts/redeploy.`;
+    if (kind === "own" && updates) continue;
+    return `Refused: git ${sub} in ${d}. Orchestrators don't change project checkouts except to update them: in a project checkout of your own workspace you may \`git pull\` (any form), \`merge\`, \`reset\`, \`checkout\`, \`switch\` and \`rebase\`. Commits, \`stash\`, \`clean\`, \`restore\` and file edits go through ${T.start_task} or ${T.quick_change}; other workspaces' repositories, task worktrees and AgentOS's live checkout are never changed from here. To see current code: \`git -C ${d} fetch\` then \`git -C ${d} show origin/main:<path>\` or \`git -C ${d} log origin/main\`.`;
+  }
+  return null;
 }
 
 // Commands whose every non-option argument is a file they change, and
@@ -557,7 +590,7 @@ export async function shellRefusal(
         (inv.name === "gh" ? ghRefusal(inv.args) : null) ??
         (inv.name === "curl" ? curlRefusal(inv.args) : null) ??
         (inv.name === "aos" ? aosRefusal(inv.args) : null) ??
-        (inv.name === "git" ? await gitRefusal(inv.args, ctx, cwd) : null) ??
+        (inv.name === "git" ? await gitRefusal(inv, ctx, cwd) : null) ??
         (inv.name === "sqlite3"
           ? await sqliteRefusal(inv, ctx, cwd, command)
           : null) ??

package/lib/orchestrator/write-guard.ts

@@ -24,6 +24,7 @@ import { orchestratorDir } from "./home";
 import { LIMITS_FILE } from "./usage";
 import { quickWorktrees } from "./quick-store";
 import { shellRefusal } from "./shell-guard";
+import { liveCheckout } from "../dev-instance/liveServer";
 
 // The tools that write a file, and the argument naming it.
 export const WRITE_TOOLS: Record<string, string> = {
@@ -398,10 +399,61 @@ async function commandRefusal(
         : [];
       return roots.some((r) => within(p, r));
     },
+    checkoutKind: (dir) => checkoutKind(session, dir),
     protectedPids,
   });
 }
 
+// Whether a folder is a project checkout of the session's own workspace
+// (where it may update and move the branch), a checkout AgentOS's live
+// server or autodeploy runs from (never), or neither. The live ones are the
+// server's folder, the one live-server.json recorded (known even while the
+// server restarts), and any main checkout holding scripts/autodeploy, since
+// that script deploys the folder it sits in (a task worktree has a .git
+// file, not a folder).
+export async function checkoutKind(
+  session: Session,
+  dir: string
+): Promise<"own" | "live" | "other"> {
+  const real = await physicalPath(dir);
+  const roots = async (paths: (string | undefined)[]) =>
+    Promise.all(
+      paths
+        .filter((p): p is string => !!p)
+        .flatMap((p) => [path.resolve(p), p])
+        .map((p) => physicalPath(p))
+    );
+  const live = await roots([process.cwd(), liveCheckout() ?? undefined]);
+  if (live.some((r) => within(real, r)) || deploysFrom(real)) return "live";
+  if (!session.workspace_id) return "other";
+  const own = db
+    .prepare(
+      `SELECT working_directory AS dir FROM projects
+        WHERE workspace_id = ? AND is_uncategorized = 0 AND host_id = 'local'
+       UNION SELECT r.path FROM project_repositories r
+         JOIN projects p ON p.id = r.project_id
+        WHERE p.workspace_id = ? AND p.host_id = 'local'`
+    )
+    .all(session.workspace_id, session.workspace_id) as { dir: string }[];
+  const mine = await roots(own.map((p) => expandHome(p.dir)).filter(Boolean));
+  return mine.some((r) => within(real, r)) ? "own" : "other";
+}
+
+function deploysFrom(real: string): boolean {
+  for (let at = real; ; at = path.dirname(at)) {
+    try {
+      if (
+        fs.statSync(path.join(at, "scripts", "autodeploy")).isFile() &&
+        fs.statSync(path.join(at, ".git")).isDirectory()
+      )
+        return true;
+    } catch {
+      // Not here; look higher.
+    }
+    if (path.dirname(at) === at) return false;
+  }
+}
+
 // AgentOS's server (whatever listens on its port), the tmux servers its
 // sessions run in, and this worker. A lookup that fails refuses the kill.
 async function protectedPids(): Promise<Set<number>> {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saadnvd1/agent-os",
-  "version": "0.3.657",
+  "version": "0.3.659",
   "description": "Self-hosted web UI for managing Claude Code sessions",
   "bin": {
     "agent-os": "scripts/agent-os"