@saadnvd1/agent-os 0.3.664 → 0.3.672

package/lib/workspaces.ts

@@ -8,10 +8,11 @@ import { db, type Workspace } from "./db";
 
 type WorkspaceRow = Omit<
   Workspace,
-  "collapsed" | "wake_tasks_on_pr" | "orch_mcp_servers"
+  "collapsed" | "wake_tasks_on_pr" | "orch_mcp_servers" | "orch_full_access"
 > & {
   collapsed: number;
   wake_tasks_on_pr: number;
+  orch_full_access: number;
   orch_mcp_servers: string;
 };
 
@@ -38,6 +39,7 @@ const toWorkspace = (row: WorkspaceRow): Workspace => ({
   ...row,
   collapsed: !!row.collapsed,
   wake_tasks_on_pr: !!row.wake_tasks_on_pr,
+  orch_full_access: !!row.orch_full_access,
   orch_mcp_servers: parseServers(row.orch_mcp_servers),
 });
 
@@ -86,6 +88,7 @@ export function updateWorkspace(
     sortOrder?: number;
     maxRunningTasks?: number | null;
     wakeTasksOnPR?: boolean;
+    orchFullAccess?: boolean;
     mcpServers?: string[];
   }
 ): Workspace | null {
@@ -93,13 +96,14 @@ export function updateWorkspace(
   if (!existing) return null;
   const name = updates.name?.trim() || existing.name;
   db.prepare(
-    `UPDATE workspaces SET name = ?, collapsed = ?, sort_order = ?, max_running_tasks = ?, wake_tasks_on_pr = ?, orch_mcp_servers = ? WHERE id = ?`
+    `UPDATE workspaces SET name = ?, collapsed = ?, sort_order = ?, max_running_tasks = ?, wake_tasks_on_pr = ?, orch_full_access = ?, orch_mcp_servers = ? WHERE id = ?`
   ).run(
     name,
     (updates.collapsed ?? existing.collapsed) ? 1 : 0,
     updates.sortOrder ?? existing.sort_order,
     taskLimit(updates.maxRunningTasks, existing.max_running_tasks),
     (updates.wakeTasksOnPR ?? existing.wake_tasks_on_pr) ? 1 : 0,
+    (updates.orchFullAccess ?? existing.orch_full_access) ? 1 : 0,
     JSON.stringify(serverNames(updates.mcpServers, existing.orch_mcp_servers)),
     id
   );

package/lib/worktree-sweep/caches.ts

@@ -10,6 +10,7 @@ import fs from "fs";
 import path from "path";
 import { execFile } from "child_process";
 import { SESSION_TMP_PREFIX, tmpName } from "../sessions/leftovers";
+import { isTestTempName } from "./testTemp";
 import type { Candidate, SweepSkipped } from "./types";
 
 const DAY_MS = 24 * 3600_000;
@@ -92,6 +93,11 @@ export async function findCacheLeftovers(deps: CacheDeps): Promise<{
   const livePrefixes = [...deps.liveIds].map(tmpName);
   for (const dir of subdirs(deps.tmpRoot)) {
     const name = path.basename(dir);
+    if (isTestTempName(name)) {
+      if (deps.now - mtime(dir) >= DAY_MS)
+        await add(dir, "test-temp", "left behind by a test run");
+      continue;
+    }
     const isSession = name.startsWith(SESSION_TMP_PREFIX);
     if (!isSession && !name.startsWith("agentos-preview-")) continue;
     if (deps.now - mtime(dir) < DAY_MS) continue;

package/lib/worktree-sweep/extras.ts

@@ -69,6 +69,18 @@ export async function cachedRootSize(
 
 export const forgetRootSizes = () => rootSizes.clear();
 
+// Removes a folder directly inside one of the roots, and nothing else.
+export async function dropFolderIn(
+  roots: string[],
+  folder: string
+): Promise<boolean> {
+  const target = path.resolve(folder);
+  if (!roots.some((r) => r && path.dirname(target) === path.resolve(r)))
+    return false;
+  await fs.promises.rm(target, { recursive: true, force: true });
+  return !fs.existsSync(target);
+}
+
 export async function defaultExtras(
   opts: { fresh?: boolean } = {}
 ): Promise<Extras> {
@@ -108,14 +120,10 @@ export async function defaultExtras(
       count: dirCount(SPARE_ROOT),
       bytes: await cachedRootSize(SPARE_ROOT, size, !!opts.fresh),
     },
-    drop: async (c) => {
-      if (c.kind === "database") return dropTaskDatabase(c, froms);
-      const target = path.resolve(c.path);
-      if (!roots.some((r) => r && path.dirname(target) === path.resolve(r)))
-        return false;
-      await fs.promises.rm(target, { recursive: true, force: true });
-      return !fs.existsSync(target);
-    },
+    drop: async (c) =>
+      c.kind === "database"
+        ? dropTaskDatabase(c, froms)
+        : dropFolderIn(roots, c.path),
   };
 }
 

package/lib/worktree-sweep/report.ts

@@ -21,6 +21,7 @@ const TITLES: Record<SweepKind, string> = {
   database: "Task databases",
   spare: "Dependency spares",
   temp: "Temp folders",
+  "test-temp": "Test temp folders",
   "derived-data": "Xcode build folders of removed worktrees",
 };
 

package/lib/worktree-sweep/settings.ts

@@ -83,8 +83,8 @@ export function projectSweepOverrides(): Array<{
 }
 
 // The full clean-up (test leftovers, task databases, spares, temp folders,
-// build caches) removes nothing until a person turns it on for this machine,
-// after reading what a dry run found.
+// build caches) removes nothing until Saad turns it on for this machine, or
+// the orchestrator does on his word after a dry run from the last hour.
 const ARMED_KEY = "worktree_sweep.reaper";
 
 export function reaperArmed(): boolean {

package/lib/worktree-sweep/testTemp.ts

@@ -0,0 +1,113 @@
+// Folders the test suite makes in the OS temp folder, by name. The sweep
+// takes only these, never another aos-… or agent-os-… folder, so AgentOS's
+// own temp folders (aos-review-, aos-rebase-…) and a person's are safe.
+// lib/test-temp.test.ts fails when a test uses a prefix missing here.
+export const TEST_TEMP_PREFIXES: readonly string[] = [
+  "agent-os-git-",
+  "agent-os-home-",
+  "agent-os-kept-",
+  "agent-os-limits-",
+  "agent-os-session-logs-",
+  "agent-os-test-",
+  "aos-acc-",
+  "aos-add-",
+  "aos-armed-repo-",
+  "aos-art-",
+  "aos-autodeploy-",
+  "aos-caches-",
+  "aos-channel-",
+  "aos-clone-",
+  "aos-config-",
+  "aos-crypt-",
+  "aos-db-",
+  "aos-db-drops-",
+  "aos-db-wt-",
+  "aos-decl-",
+  "aos-device-keys-",
+  "aos-done-home-",
+  "aos-done-repo-",
+  "aos-env-",
+  "aos-fast-",
+  "aos-files-",
+  "aos-git-",
+  "aos-gr-",
+  "aos-heavy-",
+  "aos-init-route-",
+  "aos-install-",
+  "aos-kind-",
+  "aos-launch-plain-",
+  "aos-launch-repo-",
+  "aos-limits-",
+  "aos-mcp-",
+  "aos-merge-policy-",
+  "aos-mig-",
+  "aos-move-",
+  "aos-no-approvals-",
+  "aos-nogit-",
+  "aos-notify-",
+  "aos-orch-act-",
+  "aos-orch-add-",
+  "aos-orch-approve-",
+  "aos-orch-armed-",
+  "aos-orch-asks-",
+  "aos-orch-brakes-",
+  "aos-orch-ext-repo-",
+  "aos-orch-external-",
+  "aos-orch-home-",
+  "aos-orch-move-",
+  "aos-orch-plain-",
+  "aos-orch-questions-",
+  "aos-orch-recipes-",
+  "aos-orch-remind-",
+  "aos-orch-repo-",
+  "aos-orch-rules-",
+  "aos-orch-settle-",
+  "aos-orch-signoff-",
+  "aos-orch-sweep-",
+  "aos-origin-",
+  "aos-path-",
+  "aos-plain-",
+  "aos-plan-",
+  "aos-ports-",
+  "aos-pr-",
+  "aos-pr-async-",
+  "aos-pr-create-",
+  "aos-pr-gen-",
+  "aos-pr-route-",
+  "aos-prompts-",
+  "aos-quick-",
+  "aos-quick-repo-",
+  "aos-relay-",
+  "aos-relay-none-",
+  "aos-report-",
+  "aos-resurrect-claude-",
+  "aos-resurrect-home-",
+  "aos-run-",
+  "aos-runner-",
+  "aos-sec-",
+  "aos-shot-",
+  "aos-sim-",
+  "aos-spare-",
+  "aos-stack-",
+  "aos-start-opts-",
+  "aos-start-plain-",
+  "aos-sweep-own-",
+  "aos-t-",
+  "aos-task-diff-",
+  "aos-temp-helper-",
+  "aos-tmux-",
+  "aos-transcripts-",
+  "aos-ui-",
+  "aos-upd-",
+  "aos-usage-",
+  "aos-wg-",
+  "aos-wg-path-",
+  "aos-wl-",
+  "aos-worker-env-",
+  "aos-worker-tmux-",
+  "aos-wsl-",
+  "aos-wt-",
+];
+
+export const isTestTempName = (name: string) =>
+  TEST_TEMP_PREFIXES.some((p) => name.startsWith(p));

package/lib/worktree-sweep/types.ts

@@ -6,6 +6,7 @@ export type SweepKind =
   | "database"
   | "spare"
   | "temp"
+  | "test-temp"
   | "derived-data";
 
 // Kinds that go only once the full clean-up is turned on.
@@ -14,6 +15,7 @@ export const ARMED_KINDS: ReadonlySet<SweepKind> = new Set([
   "database",
   "spare",
   "temp",
+  "test-temp",
   "derived-data",
 ]);
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saadnvd1/agent-os",
-  "version": "0.3.664",
+  "version": "0.3.672",
   "description": "Self-hosted web UI for managing Claude Code sessions",
   "bin": {
     "agent-os": "scripts/agent-os"

package/scripts/autodeploy.test.ts

@@ -1,8 +1,8 @@
 import { execFileSync } from "child_process";
 import * as fs from "fs";
-import * as os from "os";
 import * as path from "path";
 import { describe, expect, it } from "vitest";
+import { tempDir } from "@/lib/test-temp";
 
 // Runs the real scripts/autodeploy in a scratch clone with a stub redeploy
 // (a pull) and wait-quiet, against a scratch origin and HOME.
@@ -11,7 +11,7 @@ const sh = (cwd: string, ...args: string[]) =>
   execFileSync("git", args, { cwd, encoding: "utf-8" }).trim();
 
 function setup() {
-  const root = fs.mkdtempSync(path.join(os.tmpdir(), "aos-autodeploy-"));
+  const root = tempDir("aos-autodeploy-");
   const origin = path.join(root, "origin.git");
   const work = path.join(root, "work");
   const clone = path.join(root, "live");

package/scripts/check-bundle.test.ts

@@ -1,13 +1,13 @@
 import { describe, expect, it } from "vitest";
 import { spawnSync } from "child_process";
 import fs from "fs";
-import os from "os";
 import path from "path";
+import { tempDir } from "@/lib/test-temp";
 
 const script = path.join(__dirname, "check-bundle.mjs");
 
 function run(stats: unknown) {
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "bundle-"));
+  const dir = tempDir("bundle-");
   const file = path.join(dir, "stats.json");
   fs.writeFileSync(file, JSON.stringify(stats));
   const r = spawnSync(process.execPath, [script, file], { encoding: "utf-8" });

package/scripts/hooks/banned-terms.test.ts

@@ -4,11 +4,12 @@ import fs from "fs";
 import os from "os";
 import path from "path";
 import { GENERIC_TERMS, loadTerms, matcher, scanTree } from "./banned-terms";
+import { tempDir } from "@/lib/test-temp";
 
 const generic = GENERIC_TERMS[0];
 
 function tempRepo() {
-  const repo = fs.mkdtempSync(path.join(os.tmpdir(), "banned-terms-"));
+  const repo = tempDir("banned-terms-");
   const git = (...args: string[]) =>
     execFileSync("git", args, { cwd: repo, stdio: "pipe" });
   git("init", "-q");
@@ -22,7 +23,7 @@ describe("loadTerms", () => {
   });
 
   it("adds the private regexes, skipping blanks and comments", () => {
-    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "banned-names-"));
+    const dir = tempDir("banned-names-");
     const file = path.join(dir, "banned-names");
     fs.writeFileSync(file, "# names\nacme[ -]?widgets\n\n  zorp  \n");
     try {

package/scripts/hooks/staged-secrets.test.ts

@@ -1,9 +1,9 @@
 import { describe, expect, it } from "vitest";
 import { execFileSync, spawnSync } from "child_process";
 import fs from "fs";
-import os from "os";
 import path from "path";
 import { scanDiff } from "./staged-secrets";
+import { tempDir } from "@/lib/test-temp";
 
 // Fakes are built here, never written whole: a literal would be the very
 // thing this scan (and the merge gate) refuses.
@@ -62,7 +62,7 @@ describe("scanDiff", () => {
   });
 
   it("fails the commit on a staged secret, and passes once it's gone", () => {
-    const repo = fs.mkdtempSync(path.join(os.tmpdir(), "staged-secrets-"));
+    const repo = tempDir("staged-secrets-");
     const git = (...args: string[]) =>
       execFileSync("git", args, { cwd: repo, stdio: "pipe" });
     const scan = () =>

package/scripts/lib/build-swap.test.ts

@@ -2,15 +2,14 @@ import { spawnSync } from "node:child_process";
 import {
   existsSync,
   mkdirSync,
-  mkdtempSync,
   readFileSync,
   rmSync,
   utimesSync,
   writeFileSync,
 } from "node:fs";
-import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { tempDir } from "@/lib/test-temp";
 
 const LIB = join(import.meta.dirname, "build-swap.sh");
 
@@ -41,7 +40,7 @@ const BUILD = `
 `;
 
 beforeEach(() => {
-  dir = mkdtempSync(join(tmpdir(), "build-swap-"));
+  dir = tempDir("build-swap-");
   mkdirSync(join(dir, ".next/cache/turbopack"), { recursive: true });
   writeFileSync(join(dir, ".next/BUILD_ID"), "old\n");
   writeFileSync(join(dir, ".next/cache/turbopack/db"), "cache\n");

package/scripts/lib/wsl.test.ts

@@ -3,15 +3,14 @@ import {
   chmodSync,
   existsSync,
   mkdirSync,
-  mkdtempSync,
   readFileSync,
   rmSync,
   symlinkSync,
   writeFileSync,
 } from "node:fs";
-import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { tempDir } from "@/lib/test-temp";
 
 // The installer's WSL paths, run on any OS: `uname`, `ps`, the browser
 // openers and the package managers are fakes, and the kernel release is a
@@ -60,7 +59,7 @@ function run(
 }
 
 beforeEach(() => {
-  dir = mkdtempSync(join(tmpdir(), "aos-wsl-"));
+  dir = tempDir("aos-wsl-");
   mkdirSync(join(dir, "bin"));
   for (const tool of TOOLS) {
     const real = ["/usr/bin", "/bin"]

package/scripts/update-run.test.ts

@@ -1,16 +1,16 @@
 import { execFile } from "child_process";
 import fs from "fs";
-import os from "os";
 import path from "path";
 import { promisify } from "util";
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { tempDir } from "@/lib/test-temp";
 
 const exec = promisify(execFile);
 const runner = path.join(__dirname, "update-run.mjs");
 
 let dir: string;
 beforeEach(() => {
-  dir = fs.mkdtempSync(path.join(os.tmpdir(), "aos-runner-"));
+  dir = tempDir("aos-runner-");
   fs.writeFileSync(
     path.join(dir, "state.json"),
     JSON.stringify({ id: "r1", phase: "starting", from: "a" })