@saeed42/worktree-worker 1.0.0 → 1.1.0

package/README.md

@@ -1,15 +1,19 @@
-# @orgn/worktree-worker
+# @saeed42/worktree-worker
 
 Git worktree management service for AI agent trials. Runs as an npm package in CodeSandbox or any Node.js environment.
 
+## Security
+
+**GitHub tokens are NEVER persisted to disk.** All authenticated operations require the token to be passed in the request body. This is critical for sandbox environments where credentials should not be stored.
+
 ## Installation
 
 ```bash
 # Install globally
-npm install -g @orgn/worktree-worker
+npm install -g @saeed42/worktree-worker
 
 # Or add to your project
-npm install @orgn/worktree-worker
+npm install @saeed42/worktree-worker
 ```
 
 ## Quick Start
@@ -32,7 +36,7 @@ Add to your `package.json`:
 ```json
 {
   "dependencies": {
-    "@orgn/worktree-worker": "^1.0.0"
+    "@saeed42/worktree-worker": "^1.0.0"
   },
   "scripts": {
     "worktree-worker": "worktree-worker"
@@ -43,13 +47,13 @@ Add to your `package.json`:
 Or run directly:
 
 ```bash
-npx @orgn/worktree-worker
+npx @saeed42/worktree-worker
 ```
 
 ### Run Programmatically
 
 ```typescript
-import { app } from '@orgn/worktree-worker';
+import { app } from '@saeed42/worktree-worker';
 
 // The app is a Hono instance
 // You can extend it or use it as middleware
@@ -133,10 +137,13 @@ curl -X POST http://localhost:8787/v1/trials/abc123/worktree/reset \
   -H "Content-Type: application/json" \
   -d '{
     "baseBranch": "main",
-    "trialBranch": "feature/my-feature"
+    "trialBranch": "feature/my-feature",
+    "githubToken": "ghp_xxx"
   }'
 ```
 
+> **Note:** `githubToken` is required for private repositories. The token is used inline and **never stored on disk**.
+
 Response:
 
 ```json
@@ -165,6 +172,20 @@ curl -X POST http://localhost:8787/v1/trials/abc123/worktree/commit \
   }'
 ```
 
+### Push Changes
+
+```bash
+curl -X POST http://localhost:8787/v1/trials/abc123/worktree/push \
+  -H "Authorization: Bearer your-token" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "githubToken": "ghp_xxx",
+    "force": false
+  }'
+```
+
+> **Note:** `githubToken` is **required** for push operations. The token is used inline and **never stored on disk**.
+
 ## Development
 
 ```bash

package/dist/main.js

@@ -188,13 +188,36 @@ var GitService = class {
     return result.stdout.trim();
   }
   /**
-   * Fetch from remote
+   * Build authenticated URL (token is NEVER persisted)
    */
-  async fetch(remote = "origin", cwd) {
+  buildAuthUrl(repoUrl, githubToken) {
+    if (!githubToken) return repoUrl;
+    const urlWithoutProtocol = repoUrl.replace(/^https?:\/\//, "");
+    return `https://x-access-token:${githubToken}@${urlWithoutProtocol}`;
+  }
+  /**
+   * Get remote URL and inject auth if token provided
+   */
+  async getAuthenticatedRemoteUrl(remote, cwd, githubToken) {
+    const url = await this.getRemoteUrl(remote, cwd);
+    if (!url) return null;
+    return githubToken ? this.buildAuthUrl(url, githubToken) : url;
+  }
+  /**
+   * Fetch from remote (token used inline, never persisted)
+   */
+  async fetch(remote = "origin", cwd, auth) {
+    if (auth?.githubToken) {
+      const authUrl = await this.getAuthenticatedRemoteUrl(remote, cwd || env.BASE_WORKSPACE_DIR, auth.githubToken);
+      if (authUrl) {
+        await this.execOrThrow(["fetch", authUrl], cwd);
+        return;
+      }
+    }
     await this.execOrThrow(["fetch", remote], cwd);
   }
   /**
-   * Clone a repository
+   * Clone a repository (token used inline, never persisted)
    */
   async cloneRepo(repoUrl, targetDir, options) {
     const args = ["clone"];
@@ -206,7 +229,8 @@ var GitService = class {
     if (options?.branch) {
       args.push("--branch", options.branch);
     }
-    args.push(repoUrl, targetDir);
+    const cloneUrl = options?.githubToken ? this.buildAuthUrl(repoUrl, options.githubToken) : repoUrl;
+    args.push(cloneUrl, targetDir);
     const parentDir = targetDir.split("/").slice(0, -1).join("/") || "/";
     await this.execOrThrow(args, parentDir);
   }
@@ -329,9 +353,18 @@ var GitService = class {
     return this.getHeadSha(cwd);
   }
   /**
-   * Push
+   * Push (token used inline, never persisted)
    */
-  async push(remote, branch, force = false, cwd) {
+  async push(remote, branch, force = false, cwd, auth) {
+    if (auth?.githubToken) {
+      const authUrl = await this.getAuthenticatedRemoteUrl(remote, cwd || env.BASE_WORKSPACE_DIR, auth.githubToken);
+      if (authUrl) {
+        const args2 = ["push", authUrl, branch];
+        if (force) args2.push("--force");
+        await this.execOrThrow(args2, cwd);
+        return;
+      }
+    }
     const args = ["push", remote, branch];
     if (force) args.push("--force");
     await this.execOrThrow(args, cwd);
@@ -417,7 +450,7 @@ import { Hono as Hono2 } from "hono";
 import { z } from "zod";
 
 // src/services/repo.service.ts
-import { mkdir as mkdir2, rm, stat as stat2, writeFile } from "fs/promises";
+import { mkdir as mkdir2, readdir, rm, stat as stat2 } from "fs/promises";
 var RepoService = class {
   /**
    * Check if the repository is initialized
@@ -467,71 +500,113 @@ var RepoService = class {
   }
   /**
    * Initialize/clone the repository
+   * SECURITY: githubToken is used inline and NEVER persisted
+   * 
+   * Smart init logic:
+   * - No repo exists → Clone it
+   * - Repo exists, same URL → Fetch latest (idempotent)
+   * - Repo exists, different URL, force=false → Error
+   * - Repo exists, different URL, force=true → Clean all worktrees → Delete repo → Re-clone
    */
   async initRepo(options) {
     const log = logger.child({ service: "repo", action: "init" });
     const repoRoot = env.BASE_WORKSPACE_DIR;
+    const auth = options.githubToken ? { githubToken: options.githubToken } : void 0;
+    const normalizeUrl = (url) => {
+      return url.replace(/^https:\/\/[^@]+@/, "https://").replace(/\.git$/, "").replace(/\/$/, "").toLowerCase();
+    };
+    const requestedUrl = normalizeUrl(options.repoUrl);
     log.info("Initializing repository", {
       repoUrl: options.repoUrl.replace(/ghp_[a-zA-Z0-9]+/, "ghp_***"),
       branch: options.branch,
-      force: options.force
+      force: options.force,
+      hasToken: !!options.githubToken
     });
     const status = await this.getStatus();
-    if (status.initialized && !options.force) {
-      log.info("Repository already initialized");
-      return {
-        path: repoRoot,
-        branch: status.branch || env.DEFAULT_BRANCH,
-        headSha: status.headSha || "",
-        remote: status.remote
-      };
-    }
-    if (options.force && status.initialized) {
-      log.info("Force flag set, removing existing repo");
+    if (status.initialized) {
+      const currentUrl = normalizeUrl(status.remote || "");
+      const isSameRepo = currentUrl === requestedUrl;
+      if (isSameRepo) {
+        log.info("Repository already initialized with same URL, fetching latest");
+        await gitService.fetch("origin", repoRoot, auth);
+        const targetBranch = options.branch || env.DEFAULT_BRANCH;
+        const currentBranch = status.branch || "";
+        if (targetBranch !== currentBranch) {
+          log.info("Switching to requested branch", { from: currentBranch, to: targetBranch });
+          const checkoutResult = await gitService.exec(["checkout", targetBranch], repoRoot);
+          if (checkoutResult.code !== 0) {
+            await gitService.exec(["checkout", "-b", targetBranch, `origin/${targetBranch}`], repoRoot);
+          }
+        }
+        const headSha2 = await gitService.getHeadSha(repoRoot);
+        const branch2 = await gitService.getCurrentBranch(repoRoot);
+        return { path: repoRoot, branch: branch2, headSha: headSha2, remote: status.remote };
+      }
+      if (!options.force) {
+        throw new Error(
+          `Repository already initialized with different URL. Current: ${currentUrl}, Requested: ${requestedUrl}. Use force=true to re-initialize (this will delete all worktrees).`
+        );
+      }
+      log.warn("Force re-init: cleaning all worktrees and repo");
+      await this.cleanAllWorktrees();
       await rm(repoRoot, { recursive: true, force: true });
     }
     const parentDir = repoRoot.split("/").slice(0, -1).join("/");
     await mkdir2(parentDir, { recursive: true });
     await mkdir2(env.TRIALS_WORKSPACE_DIR, { recursive: true });
-    let cloneUrl = options.repoUrl;
-    if (options.githubToken) {
-      const urlWithoutProtocol = options.repoUrl.replace(/^https?:\/\//, "");
-      cloneUrl = `https://x-access-token:${options.githubToken}@${urlWithoutProtocol}`;
-    }
     const branch = options.branch || env.DEFAULT_BRANCH;
     log.info("Cloning repository", { branch });
-    await gitService.cloneRepo(cloneUrl, repoRoot, {
+    await gitService.cloneRepo(options.repoUrl, repoRoot, {
       branch,
-      blobless: true
+      blobless: true,
+      githubToken: options.githubToken
     });
     await gitService.exec(["config", "--local", "user.name", "origin-agent[bot]"], repoRoot);
     await gitService.exec(["config", "--local", "user.email", "origin-agent[bot]@users.noreply.github.com"], repoRoot);
     await gitService.exec(["config", "--local", "safe.directory", repoRoot], repoRoot);
     const cleanUrl = options.repoUrl.replace(/^https:\/\/[^@]+@/, "https://");
     await gitService.exec(["remote", "set-url", "origin", cleanUrl], repoRoot);
-    if (options.githubToken) {
-      await this.updateCredentials(options.githubToken);
-    }
     const headSha = await gitService.getHeadSha(repoRoot);
     const remote = await gitService.getRemoteUrl("origin", repoRoot);
     log.info("Repository initialized", { branch, headSha });
     return { path: repoRoot, branch, headSha, remote };
   }
+  /**
+   * Clean all worktrees (used before force re-init)
+   */
+  async cleanAllWorktrees() {
+    const log = logger.child({ service: "repo", action: "cleanAllWorktrees" });
+    try {
+      const entries = await readdir(env.TRIALS_WORKSPACE_DIR, { withFileTypes: true });
+      for (const entry of entries) {
+        if (entry.isDirectory()) {
+          const worktreePath = `${env.TRIALS_WORKSPACE_DIR}/${entry.name}`;
+          log.info("Removing worktree", { path: worktreePath });
+          await rm(worktreePath, { recursive: true, force: true });
+        }
+      }
+      await gitService.pruneWorktrees(env.BASE_WORKSPACE_DIR).catch(() => {
+      });
+      log.info("All worktrees cleaned");
+    } catch (err) {
+      log.debug("No worktrees to clean", { error: err.message });
+    }
+  }
   /**
    * Update/pull the repository
+   * SECURITY: githubToken is used inline and NEVER persisted
    */
   async updateRepo(options) {
     const log = logger.child({ service: "repo", action: "update" });
     const repoRoot = env.BASE_WORKSPACE_DIR;
+    const auth = options?.githubToken ? { githubToken: options.githubToken } : void 0;
     const status = await this.getStatus();
     if (!status.initialized) {
       throw new Error("Repository not initialized");
     }
-    if (options?.githubToken) {
-      await this.updateCredentials(options.githubToken);
-    }
+    log.info("Updating repository", { hasToken: !!options?.githubToken });
     log.info("Fetching from remote");
-    await gitService.fetch("origin", repoRoot);
+    await gitService.fetch("origin", repoRoot, auth);
     if (options?.branch && options.branch !== status.branch) {
       log.info("Checking out branch", { branch: options.branch });
       await gitService.execOrThrow(["checkout", options.branch], repoRoot);
@@ -545,19 +620,6 @@ var RepoService = class {
     const remote = await gitService.getRemoteUrl("origin", repoRoot);
     return { path: repoRoot, branch, headSha, remote };
   }
-  /**
-   * Update git credentials
-   */
-  async updateCredentials(githubToken) {
-    const log = logger.child({ service: "repo", action: "updateCredentials" });
-    const repoRoot = env.BASE_WORKSPACE_DIR;
-    await gitService.exec(["config", "--global", "credential.helper", "store --file=/tmp/.git-credentials"], repoRoot);
-    await gitService.exec(["config", "--global", "core.askPass", ""], repoRoot);
-    const credentialsContent = `https://x-access-token:${githubToken}@github.com
-`;
-    await writeFile("/tmp/.git-credentials", credentialsContent, { mode: 384 });
-    log.info("Credentials updated");
-  }
   /**
    * List branches
    */
@@ -651,7 +713,7 @@ import { Hono as Hono3 } from "hono";
 import { z as z2 } from "zod";
 
 // src/services/worktree.service.ts
-import { mkdir as mkdir3, rm as rm2, stat as stat3, readdir } from "fs/promises";
+import { mkdir as mkdir3, rm as rm2, stat as stat3, readdir as readdir2 } from "fs/promises";
 var WorktreeService = class {
   /**
    * Get the isolated workspace directory for a specific trial.
@@ -674,6 +736,7 @@ var WorktreeService = class {
   }
   /**
    * Reset or create a worktree for a trial
+   * SECURITY: githubToken is used inline and NEVER persisted
    */
   async resetWorktree(trialId, options) {
     const log = logger.child({ trialId, service: "worktree" });
@@ -681,11 +744,13 @@ var WorktreeService = class {
     const worktreePath = this.getWorktreePath(trialId, branchName);
     const baseBranch = options.baseBranch || env.DEFAULT_BRANCH;
     const baseRepoDir = env.BASE_WORKSPACE_DIR;
+    const auth = options.githubToken ? { githubToken: options.githubToken } : void 0;
     log.info("Starting worktree reset (v3 architecture)", {
       worktreePath,
       branchName,
       baseBranch,
-      baseRepoDir
+      baseRepoDir,
+      hasToken: !!options.githubToken
     });
     await mkdir3(env.TRIALS_WORKSPACE_DIR, { recursive: true });
     try {
@@ -694,7 +759,7 @@ var WorktreeService = class {
         const gitFile = await stat3(`${worktreePath}/.git`).catch(() => null);
         if (gitFile) {
           log.info("Worktree already exists, fetching latest");
-          await gitService.fetch("origin", worktreePath).catch(() => {
+          await gitService.fetch("origin", worktreePath, auth).catch(() => {
           });
           const headSha2 = await gitService.getHeadSha(worktreePath);
           return { worktreePath, branch: branchName, headSha: headSha2 };
@@ -703,7 +768,7 @@ var WorktreeService = class {
     } catch {
     }
     log.info("Fetching from remote");
-    await gitService.fetch("origin", baseRepoDir);
+    await gitService.fetch("origin", baseRepoDir, auth);
     try {
       await gitService.removeWorktree(worktreePath, true, baseRepoDir);
     } catch {
@@ -848,12 +913,14 @@ var WorktreeService = class {
   }
   /**
    * Push branch
+   * SECURITY: githubToken is used inline and NEVER persisted
    */
-  async pushBranch(trialId, remote = "origin", force = false, trialBranch) {
+  async pushBranch(trialId, remote = "origin", force = false, trialBranch, githubToken) {
     const branchName = trialBranch || this.getBranchName(trialId);
     const worktreePath = this.getWorktreePath(trialId, branchName);
+    const auth = githubToken ? { githubToken } : void 0;
     const branch = await gitService.getCurrentBranch(worktreePath);
-    await gitService.push(remote, branch, force, worktreePath);
+    await gitService.push(remote, branch, force, worktreePath, auth);
     return { branch, pushed: true };
   }
   /**
@@ -865,7 +932,7 @@ var WorktreeService = class {
     const errors = [];
     const cutoffTime = Date.now() - env.CLEANUP_AFTER_HOURS * 60 * 60 * 1e3;
     try {
-      const entries = await readdir(env.TRIALS_WORKSPACE_DIR, { withFileTypes: true });
+      const entries = await readdir2(env.TRIALS_WORKSPACE_DIR, { withFileTypes: true });
       for (const entry of entries) {
         if (!entry.isDirectory()) continue;
         const worktreePath = `${env.TRIALS_WORKSPACE_DIR}/${entry.name}`;
@@ -897,18 +964,23 @@ var worktree = new Hono3();
 var resetWorktreeSchema = z2.object({
   baseBranch: z2.string().default("main"),
   trialBranch: z2.string().optional(),
-  force: z2.boolean().default(false)
+  force: z2.boolean().default(false),
+  githubToken: z2.string().optional()
+  // Required for private repos
 });
 var commitSchema = z2.object({
   message: z2.string().min(1),
   author: z2.object({
     name: z2.string(),
     email: z2.string().email()
-  }).optional()
+  }).optional(),
+  trialBranch: z2.string().optional()
 });
 var pushSchema = z2.object({
   remote: z2.string().default("origin"),
-  force: z2.boolean().default(false)
+  force: z2.boolean().default(false),
+  githubToken: z2.string().min(1, "GitHub token is required for push operations"),
+  trialBranch: z2.string().optional()
 });
 worktree.post("/trials/:trialId/worktree/reset", async (c) => {
   const trialId = c.req.param("trialId");
@@ -926,12 +998,14 @@ worktree.post("/trials/:trialId/worktree/reset", async (c) => {
     log.info("Creating/resetting worktree", {
       baseBranch: input.baseBranch,
       trialBranch: input.trialBranch,
-      force: input.force
+      force: input.force,
+      hasToken: !!input.githubToken
     });
     const result = await worktreeService.resetWorktree(trialId, {
       baseBranch: input.baseBranch,
       trialBranch: input.trialBranch,
-      force: input.force
+      force: input.force,
+      githubToken: input.githubToken
     });
     return c.json({ success: true, data: result });
   } catch (err) {
@@ -942,10 +1016,11 @@ worktree.post("/trials/:trialId/worktree/reset", async (c) => {
 });
 worktree.delete("/trials/:trialId/worktree", async (c) => {
   const trialId = c.req.param("trialId");
-  const log = logger.child({ route: "worktree/delete", trialId });
+  const trialBranch = c.req.query("trialBranch");
+  const log = logger.child({ route: "worktree/delete", trialId, trialBranch });
   try {
     log.info("Deleting worktree");
-    await worktreeService.deleteWorktree(trialId);
+    await worktreeService.deleteWorktree(trialId, trialBranch);
     return c.json({ success: true, data: { deleted: true } });
   } catch (err) {
     const error = err;
@@ -955,9 +1030,10 @@ worktree.delete("/trials/:trialId/worktree", async (c) => {
 });
 worktree.get("/trials/:trialId/worktree/status", async (c) => {
   const trialId = c.req.param("trialId");
-  const log = logger.child({ route: "worktree/status", trialId });
+  const trialBranch = c.req.query("trialBranch");
+  const log = logger.child({ route: "worktree/status", trialId, trialBranch });
   try {
-    const status = await worktreeService.getWorktreeStatus(trialId);
+    const status = await worktreeService.getWorktreeStatus(trialId, trialBranch);
     return c.json({ success: true, data: status });
   } catch (err) {
     const error = err;
@@ -967,9 +1043,10 @@ worktree.get("/trials/:trialId/worktree/status", async (c) => {
 });
 worktree.get("/trials/:trialId/worktree/diff", async (c) => {
   const trialId = c.req.param("trialId");
-  const log = logger.child({ route: "worktree/diff", trialId });
+  const trialBranch = c.req.query("trialBranch");
+  const log = logger.child({ route: "worktree/diff", trialId, trialBranch });
   try {
-    const diff = await worktreeService.getWorktreeDiff(trialId);
+    const diff = await worktreeService.getWorktreeDiff(trialId, trialBranch);
     return c.json({ success: true, data: diff });
   } catch (err) {
     const error = err;
@@ -989,11 +1066,15 @@ worktree.post("/trials/:trialId/worktree/commit", async (c) => {
         400
       );
     }
-    log.info("Committing changes", { message: parsed.data.message.slice(0, 50) });
+    log.info("Committing changes", {
+      message: parsed.data.message.slice(0, 50),
+      trialBranch: parsed.data.trialBranch
+    });
     const result = await worktreeService.commitChanges(
       trialId,
       parsed.data.message,
-      parsed.data.author
+      parsed.data.author,
+      parsed.data.trialBranch
     );
     return c.json({ success: true, data: result });
   } catch (err) {
@@ -1014,11 +1095,17 @@ worktree.post("/trials/:trialId/worktree/push", async (c) => {
         400
       );
     }
-    log.info("Pushing to remote", { remote: parsed.data.remote, force: parsed.data.force });
+    log.info("Pushing to remote", {
+      remote: parsed.data.remote,
+      force: parsed.data.force,
+      trialBranch: parsed.data.trialBranch
+    });
     const result = await worktreeService.pushBranch(
       trialId,
       parsed.data.remote,
-      parsed.data.force
+      parsed.data.force,
+      parsed.data.trialBranch,
+      parsed.data.githubToken
     );
     return c.json({ success: true, data: result });
   } catch (err) {

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@saeed42/worktree-worker",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "Git worktree management service for AI agent trials",
   "type": "module",
   "main": "dist/main.js",
   "bin": {
-    "opencode-ai": "./dist/main.js"
+    "worktree-worker": "./dist/main.js"
   },
   "scripts": {
     "build": "tsup",