@spotpatch/agent 1.0.0 → 1.2.0

package/dist/index.js

@@ -1,7 +1,7 @@
 // src/engine/execute-agent-change.ts
 import {
-  ERROR_CODES as ERROR_CODES18,
-  SpotPatchError as SpotPatchError18
+  ERROR_CODES as ERROR_CODES19,
+  SpotPatchError as SpotPatchError19
 } from "@spotpatch/shared";
 
 // src/provider/openai-compatible-provider.ts
@@ -69,7 +69,10 @@ function jsonStringifyToolOutput(value) {
 }
 
 // src/provider/provider-transport.ts
-import { ERROR_CODES as ERROR_CODES4, SpotPatchError as SpotPatchError4 } from "@spotpatch/shared";
+import {
+  ERROR_CODES as ERROR_CODES4,
+  SpotPatchError as SpotPatchError4
+} from "@spotpatch/shared";
 
 // src/provider/provider-credential.ts
 import { ERROR_CODES as ERROR_CODES2, SpotPatchError as SpotPatchError2 } from "@spotpatch/shared";
@@ -239,6 +242,19 @@ async function readSseEvents(stream, options) {
 }
 
 // src/provider/provider-transport.ts
+function createProviderHeaders(authentication, credential) {
+  const headers = new Headers({
+    Accept: "text/event-stream",
+    "Content-Type": "application/json"
+  });
+  const value = readProviderCredential(credential);
+  if (authentication === "x-api-key") {
+    headers.set("x-api-key", value);
+  } else {
+    headers.set("Authorization", `Bearer ${value}`);
+  }
+  return headers;
+}
 function mapStatus(status) {
   if (status === 401 || status === 403) {
     return new SpotPatchError4(ERROR_CODES4.PROVIDER_AUTH_FAILED);
@@ -278,11 +294,7 @@ async function postProviderStream(options) {
     try {
       response = await options.fetch(options.url, {
         method: "POST",
-        headers: {
-          Accept: "text/event-stream",
-          Authorization: `Bearer ${readProviderCredential(options.credential)}`,
-          "Content-Type": "application/json"
-        },
+        headers: createProviderHeaders(options.authentication, options.credential),
         body: JSON.stringify(options.body),
         redirect: "error",
         signal: requestController.signal
@@ -475,6 +487,7 @@ function createChatCompletionsSession(options) {
       }
       const parsed = parseChatEvents(
         await postProviderStream({
+          authentication: options.provider.authentication,
           body: {
             model: options.model.model,
             messages,
@@ -646,6 +659,7 @@ function createResponsesSession(options) {
       };
       const parsed = parseResponsesEvents(
         await postProviderStream({
+          authentication: options.provider.authentication,
           body,
           credential: options.credential,
           fetch,
@@ -702,7 +716,7 @@ var PROTECTED_FILE_NAMES = /* @__PURE__ */ new Set([
   "yarn.lock"
 ]);
 function deny() {
-  throw new SpotPatchError8(ERROR_CODES8.TOOL_DENIED);
+  throw new SpotPatchError8(ERROR_CODES8.TOOL_PATH_DENIED);
 }
 function hasControlCharacter(value) {
   for (let index = 0; index < value.length; index += 1) {
@@ -807,13 +821,13 @@ async function readAgentTextFile(root, relativePath, maximumBytes) {
   }
   const bytes = await readFile(absolutePath);
   if (bytes.includes(0)) {
-    throw new SpotPatchError9(ERROR_CODES9.TOOL_DENIED);
+    throw new SpotPatchError9(ERROR_CODES9.TOOL_PATH_DENIED);
   }
   let content;
   try {
     content = utf8Decoder.decode(bytes);
   } catch {
-    throw new SpotPatchError9(ERROR_CODES9.TOOL_DENIED);
+    throw new SpotPatchError9(ERROR_CODES9.TOOL_PATH_DENIED);
   }
   return Object.freeze({ content, relativePath, size: metadata.size });
 }
@@ -826,7 +840,7 @@ function encodeUtf8Text(content, includeByteOrderMark) {
 }
 async function writeAgentTextFileIfContentMatches(root, relativePath, expectedContent, nextContent, maximumBytes) {
   if (nextContent.includes("\0")) {
-    throw new SpotPatchError9(ERROR_CODES9.TOOL_DENIED);
+    throw new SpotPatchError9(ERROR_CODES9.TOOL_INPUT_INVALID);
   }
   const absolutePath = await resolveExistingAgentPath(root, relativePath);
   const [metadata, currentBytes] = await Promise.all([
@@ -840,7 +854,7 @@ async function writeAgentTextFileIfContentMatches(root, relativePath, expectedCo
   try {
     currentContent = utf8Decoder.decode(currentBytes);
   } catch {
-    throw new SpotPatchError9(ERROR_CODES9.TOOL_DENIED);
+    throw new SpotPatchError9(ERROR_CODES9.TOOL_PATH_DENIED);
   }
   if (currentBytes.includes(0) || currentContent !== expectedContent) {
     throw new SpotPatchError9(ERROR_CODES9.PATCH_REJECTED);
@@ -1099,7 +1113,7 @@ async function runConfiguredCheck(options) {
 function requireConfiguredCheck(checkId, checks) {
   const check = checks[checkId];
   if (check === void 0) {
-    throw new SpotPatchError10(ERROR_CODES10.TOOL_DENIED);
+    throw new SpotPatchError10(ERROR_CODES10.TOOL_INPUT_INVALID);
   }
   return check;
 }
@@ -1294,9 +1308,16 @@ async function applyAgentPatch(worktreeRoot, patch, limits, signal) {
     throw new SpotPatchError13(ERROR_CODES13.AGENT_LIMIT_EXCEEDED);
   }
   await Promise.all(
-    files.map(
-      async (file) => resolveWritableAgentPath(worktreeRoot, file.relativePath)
-    )
+    files.map(async (file) => {
+      await resolveWritableAgentPath(worktreeRoot, file.relativePath);
+      if (file.kind !== "added") {
+        await readAgentTextFile(
+          worktreeRoot,
+          file.relativePath,
+          limits.maxReadBytesPerFile
+        );
+      }
+    })
   );
   await runGitCommand({
     cwd: worktreeRoot,
@@ -1410,7 +1431,7 @@ var MAX_DISCOVERED_FILES = 2e4;
 var TEXT_SAMPLE_BYTES = 8192;
 function compileGlob(glob) {
   if (glob.length === 0 || glob.length > 256 || glob.includes("\0") || glob.includes("\\") || glob.startsWith("/") || ["[", "]", "{", "}", "(", ")", "!"].some((character) => glob.includes(character)) || glob.split("/").some((segment) => segment === "..")) {
-    throw new SpotPatchError14(ERROR_CODES14.TOOL_DENIED);
+    throw new SpotPatchError14(ERROR_CODES14.TOOL_INPUT_INVALID);
   }
   let expression = "^";
   for (let index = 0; index < glob.length; index += 1) {
@@ -1649,7 +1670,7 @@ var runCheckSchema = z.strictObject({
   checkId: z.string().min(1).max(64).regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/u)
 });
 function invalidTool() {
-  throw new SpotPatchError15(ERROR_CODES15.TOOL_DENIED);
+  throw new SpotPatchError15(ERROR_CODES15.TOOL_INPUT_INVALID);
 }
 function parseArguments(schema, value) {
   const parsed = schema.safeParse(value);
@@ -1946,67 +1967,354 @@ function createAgentToolExecutor(options) {
 }
 
 // src/worktree/git-worktree.ts
-import { lstat as lstat3, mkdtemp, realpath as realpath2, rm as rm2 } from "fs/promises";
+import {
+  copyFile,
+  lstat as lstat4,
+  mkdir,
+  mkdtemp,
+  readFile as readFile2,
+  realpath as realpath3,
+  rm as rm2
+} from "fs/promises";
+import { createHash as createHash2 } from "crypto";
 import os from "os";
+import path6 from "path";
+import {
+  ERROR_CODES as ERROR_CODES17,
+  SpotPatchError as SpotPatchError17
+} from "@spotpatch/shared";
+
+// src/worktree/workspace-health.ts
+import { lstat as lstat3, realpath as realpath2 } from "fs/promises";
 import path5 from "path";
-import { ERROR_CODES as ERROR_CODES16, SpotPatchError as SpotPatchError16 } from "@spotpatch/shared";
-async function assertCleanGitBaseline(options) {
-  const root = await realpath2(options.root).catch(() => {
-    throw new SpotPatchError16(ERROR_CODES16.WORKTREE_DIRTY);
+import {
+  AGENT_WORKSPACE_SNAPSHOT_LIMITS,
+  ERROR_CODES as ERROR_CODES16,
+  SpotPatchError as SpotPatchError16
+} from "@spotpatch/shared";
+var CONFLICTED_STATUSES = /* @__PURE__ */ new Set(["DD", "AU", "UD", "UA", "DU", "AA", "UU"]);
+var OPERATION_MARKERS = Object.freeze([
+  "MERGE_HEAD",
+  "CHERRY_PICK_HEAD",
+  "REVERT_HEAD",
+  "rebase-apply",
+  "rebase-merge"
+]);
+function emptyChanges() {
+  return Object.freeze({
+    staged: 0,
+    unstaged: 0,
+    untracked: 0,
+    conflicted: 0,
+    total: 0
+  });
+}
+function blockedHealth(errorCode) {
+  return Object.freeze({
+    state: "blocked",
+    checkedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    changes: emptyChanges(),
+    canIncludeLocalChanges: false,
+    errorCode
+  });
+}
+function parsePorcelainStatus(value) {
+  const records = value.split("\0");
+  const untrackedPaths = [];
+  let staged = 0;
+  let unstaged = 0;
+  let conflicted = 0;
+  let total = 0;
+  for (let index = 0; index < records.length; index += 1) {
+    const record = records[index] ?? "";
+    if (record.length === 0) {
+      continue;
+    }
+    if (record.length < 4 || record[2] !== " ") {
+      throw new SpotPatchError16(ERROR_CODES16.WORKTREE_LOCAL_CHANGES_UNSUPPORTED);
+    }
+    const status = record.slice(0, 2);
+    const relativePath = record.slice(3);
+    if (relativePath.length === 0) {
+      throw new SpotPatchError16(ERROR_CODES16.WORKTREE_LOCAL_CHANGES_UNSUPPORTED);
+    }
+    total += 1;
+    if (status === "??") {
+      untrackedPaths.push(relativePath);
+      continue;
+    }
+    const indexStatus = status[0] ?? " ";
+    const worktreeStatus = status[1] ?? " ";
+    if (CONFLICTED_STATUSES.has(status) || indexStatus === "U" || worktreeStatus === "U") {
+      conflicted += 1;
+    }
+    if (indexStatus !== " ") {
+      staged += 1;
+    }
+    if (worktreeStatus !== " ") {
+      unstaged += 1;
+    }
+    if (indexStatus === "R" || indexStatus === "C") {
+      index += 1;
+      if ((records[index] ?? "").length === 0) {
+        throw new SpotPatchError16(ERROR_CODES16.WORKTREE_LOCAL_CHANGES_UNSUPPORTED);
+      }
+    }
+  }
+  return Object.freeze({
+    changes: Object.freeze({
+      staged,
+      unstaged,
+      untracked: untrackedPaths.length,
+      conflicted,
+      total
+    }),
+    untrackedPaths: Object.freeze(untrackedPaths)
   });
-  const topLevel = (await runGitCommand({
+}
+async function operationInProgress(root, signal) {
+  for (const marker of OPERATION_MARKERS) {
+    const markerPath = (await runGitCommand({
+      cwd: root,
+      args: ["rev-parse", "--git-path", marker],
+      errorCode: ERROR_CODES16.WORKTREE_NOT_REPOSITORY,
+      ...signal === void 0 ? {} : { signal }
+    })).trim();
+    if (await lstat3(path5.resolve(root, markerPath)).catch(() => void 0) !== void 0) {
+      return true;
+    }
+  }
+  return false;
+}
+async function inspectUntrackedFiles(root, relativePaths) {
+  if (relativePaths.length > AGENT_WORKSPACE_SNAPSHOT_LIMITS.maxUntrackedFiles) {
+    return ERROR_CODES16.WORKTREE_LOCAL_CHANGES_TOO_LARGE;
+  }
+  let totalBytes = 0;
+  for (const relativePath of relativePaths) {
+    const absolutePath = path5.resolve(root, relativePath);
+    const relative = path5.relative(root, absolutePath);
+    if (relative === ".." || relative.startsWith(`..${path5.sep}`) || path5.isAbsolute(relative)) {
+      return ERROR_CODES16.WORKTREE_UNTRACKED_UNSUPPORTED;
+    }
+    const metadata = await lstat3(absolutePath).catch(() => void 0);
+    if (metadata === void 0 || !metadata.isFile() || metadata.isSymbolicLink()) {
+      return ERROR_CODES16.WORKTREE_UNTRACKED_UNSUPPORTED;
+    }
+    totalBytes += metadata.size;
+    if (totalBytes > AGENT_WORKSPACE_SNAPSHOT_LIMITS.maxUntrackedBytes) {
+      return ERROR_CODES16.WORKTREE_LOCAL_CHANGES_TOO_LARGE;
+    }
+  }
+  return void 0;
+}
+async function inspectGitWorkspace(rootValue, signal) {
+  const root = await realpath2(rootValue).catch(() => {
+    throw new SpotPatchError16(ERROR_CODES16.WORKTREE_NOT_REPOSITORY);
+  });
+  const topLevelResult = await runRawGitCommand({
     cwd: root,
     args: ["rev-parse", "--show-toplevel"],
-    errorCode: ERROR_CODES16.WORKTREE_DIRTY,
-    ...options.signal === void 0 ? {} : { signal: options.signal }
-  })).trim();
+    ...signal === void 0 ? {} : { signal }
+  });
+  if (topLevelResult.exitCode !== 0 || topLevelResult.cancelled || topLevelResult.timedOut) {
+    throw new SpotPatchError16(ERROR_CODES16.WORKTREE_NOT_REPOSITORY);
+  }
+  const topLevel = topLevelResult.stdout.trim();
   if (!samePath(root, topLevel)) {
-    throw new SpotPatchError16(ERROR_CODES16.WORKTREE_DIRTY);
+    throw new SpotPatchError16(ERROR_CODES16.WORKTREE_NOT_REPOSITORY);
   }
   const head = (await runGitCommand({
     cwd: root,
     args: ["rev-parse", "--verify", "HEAD"],
-    errorCode: ERROR_CODES16.WORKTREE_DIRTY,
-    ...options.signal === void 0 ? {} : { signal: options.signal }
+    errorCode: ERROR_CODES16.WORKTREE_NOT_REPOSITORY,
+    ...signal === void 0 ? {} : { signal }
   })).trim();
-  if (options.expectedHead !== void 0 && head !== options.expectedHead) {
-    throw new SpotPatchError16(ERROR_CODES16.APPLY_CONFLICT);
+  const parsed = parsePorcelainStatus(
+    await runGitCommand({
+      cwd: root,
+      args: ["status", "--porcelain=v1", "-z", "--untracked-files=all"],
+      errorCode: ERROR_CODES16.WORKTREE_NOT_REPOSITORY,
+      ...signal === void 0 ? {} : { signal }
+    })
+  );
+  const operationActive = await operationInProgress(root, signal);
+  const untrackedError = await inspectUntrackedFiles(root, parsed.untrackedPaths);
+  const errorCode = operationActive ? ERROR_CODES16.WORKTREE_OPERATION_IN_PROGRESS : parsed.changes.conflicted > 0 ? ERROR_CODES16.WORKTREE_CONFLICTED : untrackedError;
+  const health = Object.freeze({
+    state: errorCode !== void 0 ? "blocked" : parsed.changes.total === 0 ? "ready" : "consent-required",
+    checkedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    changes: parsed.changes,
+    canIncludeLocalChanges: errorCode === void 0 && parsed.changes.total > 0,
+    ...errorCode === void 0 ? {} : { errorCode }
+  });
+  return Object.freeze({
+    root,
+    head,
+    health,
+    untrackedPaths: parsed.untrackedPaths
+  });
+}
+async function inspectAgentWorkspace(root, signal) {
+  try {
+    return (await inspectGitWorkspace(root, signal)).health;
+  } catch (error) {
+    if (error instanceof SpotPatchError16) {
+      return blockedHealth(error.code);
+    }
+    return blockedHealth(ERROR_CODES16.INTERNAL_ERROR);
   }
-  const status = await runGitCommand({
-    cwd: root,
-    args: ["status", "--porcelain=v1", "-z", "--untracked-files=all"],
-    errorCode: ERROR_CODES16.WORKTREE_DIRTY,
-    ...options.signal === void 0 ? {} : { signal: options.signal }
+}
+
+// src/worktree/git-worktree.ts
+function workspacePath(root, relativePath) {
+  const candidate = path6.resolve(root, relativePath);
+  const relative = path6.relative(root, candidate);
+  if (relative === ".." || relative.startsWith(`..${path6.sep}`) || path6.isAbsolute(relative)) {
+    throw new SpotPatchError17(ERROR_CODES17.WORKTREE_LOCAL_CHANGES_UNSUPPORTED);
+  }
+  return candidate;
+}
+async function fileDigest(filePath) {
+  return createHash2("sha256").update(await readFile2(filePath)).digest("hex");
+}
+async function copyUntrackedFiles(sourceRoot, worktreeRoot, relativePaths) {
+  for (const relativePath of relativePaths) {
+    const sourcePath = workspacePath(sourceRoot, relativePath);
+    const targetPath = workspacePath(worktreeRoot, relativePath);
+    const metadata = await lstat4(sourcePath).catch(() => void 0);
+    if (metadata === void 0 || !metadata.isFile() || metadata.isSymbolicLink()) {
+      throw new SpotPatchError17(ERROR_CODES17.WORKTREE_LOCAL_CHANGES_UNSUPPORTED);
+    }
+    await mkdir(path6.dirname(targetPath), { recursive: true });
+    await copyFile(sourcePath, targetPath);
+    const [sourceDigest, targetDigest] = await Promise.all([
+      fileDigest(sourcePath),
+      fileDigest(targetPath)
+    ]).catch(() => {
+      throw new SpotPatchError17(ERROR_CODES17.APPLY_CONFLICT);
+    });
+    if (sourceDigest !== targetDigest) {
+      throw new SpotPatchError17(ERROR_CODES17.APPLY_CONFLICT);
+    }
+  }
+}
+async function assertUntrackedFilesUnchanged(sourceRoot, worktreeRoot, relativePaths) {
+  for (const relativePath of relativePaths) {
+    const sourcePath = workspacePath(sourceRoot, relativePath);
+    const targetPath = workspacePath(worktreeRoot, relativePath);
+    const [sourceDigest, targetDigest] = await Promise.all([
+      fileDigest(sourcePath),
+      fileDigest(targetPath)
+    ]).catch(() => {
+      throw new SpotPatchError17(ERROR_CODES17.APPLY_CONFLICT);
+    });
+    if (sourceDigest !== targetDigest) {
+      throw new SpotPatchError17(ERROR_CODES17.APPLY_CONFLICT);
+    }
+  }
+}
+async function materializeLocalBaseline(sourceRoot, worktreeRoot, expectedHead, untrackedPaths, signal) {
+  const sourceDiff = await runGitCommand({
+    cwd: sourceRoot,
+    args: [
+      "diff",
+      "--binary",
+      "--full-index",
+      "--no-ext-diff",
+      "--no-color",
+      "--no-renames",
+      "HEAD",
+      "--"
+    ],
+    signal,
+    errorCode: ERROR_CODES17.WORKTREE_LOCAL_CHANGES_UNSUPPORTED
   });
-  if (status.length > 0) {
-    throw new SpotPatchError16(
-      options.expectedHead === void 0 ? ERROR_CODES16.WORKTREE_DIRTY : ERROR_CODES16.APPLY_CONFLICT
-    );
+  if (sourceDiff.length > 0) {
+    await runGitCommand({
+      cwd: worktreeRoot,
+      args: ["apply", "--binary", "--whitespace=nowarn", "-"],
+      stdin: sourceDiff,
+      signal,
+      errorCode: ERROR_CODES17.WORKTREE_LOCAL_CHANGES_UNSUPPORTED
+    });
   }
-  return Object.freeze({ root, head });
+  await copyUntrackedFiles(sourceRoot, worktreeRoot, untrackedPaths);
+  const confirmation = await inspectGitWorkspace(sourceRoot, signal);
+  const confirmationDiff = await runGitCommand({
+    cwd: sourceRoot,
+    args: [
+      "diff",
+      "--binary",
+      "--full-index",
+      "--no-ext-diff",
+      "--no-color",
+      "--no-renames",
+      "HEAD",
+      "--"
+    ],
+    signal,
+    errorCode: ERROR_CODES17.APPLY_CONFLICT
+  });
+  if (confirmation.head !== expectedHead || confirmationDiff !== sourceDiff || confirmation.untrackedPaths.length !== untrackedPaths.length || confirmation.untrackedPaths.some((value, index) => value !== untrackedPaths[index])) {
+    throw new SpotPatchError17(ERROR_CODES17.APPLY_CONFLICT);
+  }
+  await assertUntrackedFilesUnchanged(sourceRoot, worktreeRoot, untrackedPaths);
+  await runGitCommand({
+    cwd: worktreeRoot,
+    args: ["add", "--all"],
+    signal,
+    errorCode: ERROR_CODES17.WORKTREE_LOCAL_CHANGES_UNSUPPORTED
+  });
+  await runGitCommand({
+    cwd: worktreeRoot,
+    args: [
+      "-c",
+      "user.name=SpotPatch Agent",
+      "-c",
+      "user.email=spotpatch-agent@example.invalid",
+      "commit",
+      "--quiet",
+      "-m",
+      "SpotPatch local workspace baseline"
+    ],
+    signal,
+    errorCode: ERROR_CODES17.WORKTREE_LOCAL_CHANGES_UNSUPPORTED
+  });
 }
 async function defaultTemporaryBase(root) {
-  const dependencyDirectory = path5.join(root, "node_modules");
+  const dependencyDirectory = path6.join(root, "node_modules");
   try {
-    const stats = await lstat3(dependencyDirectory);
+    const stats = await lstat4(dependencyDirectory);
     if (!stats.isDirectory() || stats.isSymbolicLink()) {
       return os.tmpdir();
     }
-    return await realpath2(dependencyDirectory);
+    return await realpath3(dependencyDirectory);
   } catch {
     return os.tmpdir();
   }
 }
 async function createIsolatedGitWorktree(options) {
-  const baseline = await assertCleanGitBaseline({
-    root: options.root,
-    signal: options.signal
+  const workingTreeMode = options.workingTreeMode ?? "require-clean";
+  const inspection = await inspectGitWorkspace(options.root, options.signal);
+  if (inspection.health.state === "blocked") {
+    throw new SpotPatchError17(
+      inspection.health.errorCode ?? ERROR_CODES17.WORKTREE_LOCAL_CHANGES_UNSUPPORTED
+    );
+  }
+  if (inspection.health.state === "consent-required" && workingTreeMode === "require-clean") {
+    throw new SpotPatchError17(ERROR_CODES17.WORKTREE_DIRTY);
+  }
+  const baseline = Object.freeze({
+    root: inspection.root,
+    head: inspection.head,
+    workingTreeMode
   });
   const temporaryBase = options.temporaryBase ?? await defaultTemporaryBase(baseline.root);
   const temporaryDirectory = await mkdtemp(
-    path5.join(temporaryBase, "spotpatch-agent-")
+    path6.join(temporaryBase, "spotpatch-agent-")
   );
-  const worktreePath = path5.join(temporaryDirectory, "worktree");
+  const worktreePath = path6.join(temporaryDirectory, "worktree");
   let registered = false;
   let cleaned = false;
   const cleanup = async () => {
@@ -2021,7 +2329,7 @@ async function createIsolatedGitWorktree(options) {
         timeoutMs: 3e4
       }).catch(() => void 0);
     }
-    if (path5.basename(temporaryDirectory).startsWith("spotpatch-agent-")) {
+    if (path6.basename(temporaryDirectory).startsWith("spotpatch-agent-")) {
       await rm2(temporaryDirectory, { recursive: true, force: true }).catch(
         () => void 0
       );
@@ -2031,12 +2339,12 @@ async function createIsolatedGitWorktree(options) {
     await runGitCommand({
       cwd: baseline.root,
       args: ["worktree", "add", "--detach", worktreePath, baseline.head],
-      errorCode: ERROR_CODES16.INTERNAL_ERROR,
+      errorCode: ERROR_CODES17.INTERNAL_ERROR,
       signal: options.signal,
       timeoutMs: 3e4
     });
     registered = true;
-    const worktreeRoot = await realpath2(worktreePath);
+    const worktreeRoot = await realpath3(worktreePath);
     const actualHead = (await runGitCommand({
       cwd: worktreeRoot,
       args: ["rev-parse", "--verify", "HEAD"],
@@ -2048,7 +2356,16 @@ async function createIsolatedGitWorktree(options) {
       signal: options.signal
     })).trim();
     if (actualHead !== baseline.head || !samePath(actualRoot, worktreeRoot)) {
-      throw new SpotPatchError16(ERROR_CODES16.INTERNAL_ERROR);
+      throw new SpotPatchError17(ERROR_CODES17.INTERNAL_ERROR);
+    }
+    if (inspection.health.state === "consent-required") {
+      await materializeLocalBaseline(
+        baseline.root,
+        worktreeRoot,
+        baseline.head,
+        inspection.untrackedPaths,
+        options.signal
+      );
     }
     return Object.freeze({ baseline, root: worktreeRoot, cleanup });
   } catch (error) {
@@ -2058,17 +2375,19 @@ async function createIsolatedGitWorktree(options) {
 }
 
 // src/worktree/prepared-change.ts
-import { createHash as createHash2 } from "crypto";
-import { lstat as lstat4, readFile as readFile2 } from "fs/promises";
-import { ERROR_CODES as ERROR_CODES17, SpotPatchError as SpotPatchError17 } from "@spotpatch/shared";
+import { createHash as createHash3 } from "crypto";
+import { lstat as lstat5, readFile as readFile3 } from "fs/promises";
+import { ERROR_CODES as ERROR_CODES18, SpotPatchError as SpotPatchError18 } from "@spotpatch/shared";
 var privateChanges = /* @__PURE__ */ new WeakMap();
 var DELETED_HASH = "<deleted>";
 function createPreparedAgentChange(options) {
   const touchedPaths = Object.freeze(
     options.result.files.map((file) => file.relativePath)
   );
-  if (options.expectedHashes.size !== touchedPaths.length || touchedPaths.some((relativePath) => !options.expectedHashes.has(relativePath))) {
-    throw new SpotPatchError17(ERROR_CODES17.INTERNAL_ERROR);
+  if (options.baselineHashes.size !== touchedPaths.length || options.expectedHashes.size !== touchedPaths.length || touchedPaths.some(
+    (relativePath) => !options.baselineHashes.has(relativePath) || !options.expectedHashes.has(relativePath)
+  )) {
+    throw new SpotPatchError18(ERROR_CODES18.INTERNAL_ERROR);
   }
   const change = Object.freeze({
     kind: "prepared-agent-change",
@@ -2078,6 +2397,7 @@ function createPreparedAgentChange(options) {
   });
   privateChanges.set(change, {
     baselineHead: options.baselineHead,
+    baselineHashes: new Map(options.baselineHashes),
     diff: options.result.diff,
     expectedHashes: new Map(options.expectedHashes),
     root: options.root,
@@ -2089,28 +2409,30 @@ function createPreparedAgentChange(options) {
 function requirePrivateChange(change) {
   const privateChange = privateChanges.get(change);
   if (privateChange === void 0) {
-    throw new SpotPatchError17(ERROR_CODES17.INTERNAL_ERROR);
+    throw new SpotPatchError18(ERROR_CODES18.INTERNAL_ERROR);
   }
   return privateChange;
 }
-async function currentHead(root) {
-  return (await runGitCommand({
-    cwd: root,
-    args: ["rev-parse", "--verify", "HEAD"],
-    errorCode: ERROR_CODES17.APPLY_CONFLICT
-  })).trim();
+async function assertWorkspaceOperationSafe(root, expectedHead) {
+  const inspection = await inspectGitWorkspace(root).catch(() => {
+    throw new SpotPatchError18(ERROR_CODES18.APPLY_CONFLICT);
+  });
+  const blockingOperation = inspection.health.errorCode === ERROR_CODES18.WORKTREE_OPERATION_IN_PROGRESS || inspection.health.errorCode === ERROR_CODES18.WORKTREE_CONFLICTED;
+  if (inspection.head !== expectedHead || blockingOperation) {
+    throw new SpotPatchError18(ERROR_CODES18.APPLY_CONFLICT);
+  }
 }
 async function fileHash(root, relativePath) {
   const normalized = assertAgentPathAllowed(relativePath);
   const absolutePath = await resolveWritableAgentPath(root, normalized);
-  const metadata = await lstat4(absolutePath).catch(() => void 0);
+  const metadata = await lstat5(absolutePath).catch(() => void 0);
   if (metadata === void 0) {
     return DELETED_HASH;
   }
   if (!metadata.isFile() || metadata.isSymbolicLink()) {
-    throw new SpotPatchError17(ERROR_CODES17.APPLY_CONFLICT);
+    throw new SpotPatchError18(ERROR_CODES18.APPLY_CONFLICT);
   }
-  return createHash2("sha256").update(await readFile2(absolutePath)).digest("hex");
+  return createHash3("sha256").update(await readFile3(absolutePath)).digest("hex");
 }
 async function captureAgentFileHashes(root, paths) {
   const entries = await Promise.all(
@@ -2126,34 +2448,38 @@ function hashesMatch(expected, actual) {
 async function applyPreparedAgentChange(change) {
   const privateChange = requirePrivateChange(change);
   if (privateChange.state !== "prepared" || !change.validationPassed || privateChange.diff.length === 0) {
-    throw new SpotPatchError17(
-      change.validationPassed ? ERROR_CODES17.APPLY_CONFLICT : ERROR_CODES17.VALIDATION_FAILED
+    throw new SpotPatchError18(
+      change.validationPassed ? ERROR_CODES18.APPLY_CONFLICT : ERROR_CODES18.VALIDATION_FAILED
     );
   }
   privateChange.state = "applying";
   try {
-    await assertCleanGitBaseline({
-      root: privateChange.root,
-      expectedHead: privateChange.baselineHead
-    });
+    await assertWorkspaceOperationSafe(privateChange.root, privateChange.baselineHead);
+    const currentHashes = await captureAgentFileHashes(
+      privateChange.root,
+      privateChange.touchedPaths
+    );
+    if (!hashesMatch(privateChange.baselineHashes, currentHashes)) {
+      throw new SpotPatchError18(ERROR_CODES18.APPLY_CONFLICT);
+    }
     await runGitCommand({
       cwd: privateChange.root,
       args: ["apply", "--check", "--whitespace=error-all", "-"],
       stdin: privateChange.diff,
-      errorCode: ERROR_CODES17.APPLY_CONFLICT
+      errorCode: ERROR_CODES18.APPLY_CONFLICT
     });
     await runGitCommand({
       cwd: privateChange.root,
       args: ["apply", "--whitespace=error-all", "-"],
       stdin: privateChange.diff,
-      errorCode: ERROR_CODES17.APPLY_CONFLICT
+      errorCode: ERROR_CODES18.APPLY_CONFLICT
     });
     const appliedHashes = await captureAgentFileHashes(
       privateChange.root,
       privateChange.touchedPaths
     );
     if (!hashesMatch(privateChange.expectedHashes, appliedHashes)) {
-      throw new SpotPatchError17(ERROR_CODES17.APPLY_CONFLICT);
+      throw new SpotPatchError18(ERROR_CODES18.APPLY_CONFLICT);
     }
     privateChange.appliedHashes = appliedHashes;
     privateChange.state = "applied";
@@ -2165,34 +2491,39 @@ async function applyPreparedAgentChange(change) {
 async function revertPreparedAgentChange(change) {
   const privateChange = requirePrivateChange(change);
   if (privateChange.state !== "applied" || privateChange.appliedHashes === void 0) {
-    throw new SpotPatchError17(ERROR_CODES17.APPLY_CONFLICT);
+    throw new SpotPatchError18(ERROR_CODES18.APPLY_CONFLICT);
   }
   privateChange.state = "reverting";
   try {
-    if (await currentHead(privateChange.root) !== privateChange.baselineHead) {
-      throw new SpotPatchError17(ERROR_CODES17.APPLY_CONFLICT);
-    }
+    await assertWorkspaceOperationSafe(privateChange.root, privateChange.baselineHead);
     const currentHashes = await captureAgentFileHashes(
       privateChange.root,
       privateChange.touchedPaths
     );
     for (const [relativePath, expectedHash] of privateChange.appliedHashes) {
       if (currentHashes.get(relativePath) !== expectedHash) {
-        throw new SpotPatchError17(ERROR_CODES17.APPLY_CONFLICT);
+        throw new SpotPatchError18(ERROR_CODES18.APPLY_CONFLICT);
       }
     }
     await runGitCommand({
       cwd: privateChange.root,
       args: ["apply", "--reverse", "--check", "--whitespace=error-all", "-"],
       stdin: privateChange.diff,
-      errorCode: ERROR_CODES17.APPLY_CONFLICT
+      errorCode: ERROR_CODES18.APPLY_CONFLICT
     });
     await runGitCommand({
       cwd: privateChange.root,
       args: ["apply", "--reverse", "--whitespace=error-all", "-"],
       stdin: privateChange.diff,
-      errorCode: ERROR_CODES17.APPLY_CONFLICT
+      errorCode: ERROR_CODES18.APPLY_CONFLICT
     });
+    const revertedHashes = await captureAgentFileHashes(
+      privateChange.root,
+      privateChange.touchedPaths
+    );
+    if (!hashesMatch(privateChange.baselineHashes, revertedHashes)) {
+      throw new SpotPatchError18(ERROR_CODES18.APPLY_CONFLICT);
+    }
     privateChange.state = "reverted";
   } catch (error) {
     privateChange.state = "applied";
@@ -2374,11 +2705,11 @@ function isRetryableToolFailure(result) {
     return false;
   }
   const candidate = output;
-  return candidate.errorCode === ERROR_CODES18.PATCH_REJECTED && candidate.retryable === true;
+  return candidate.errorCode === ERROR_CODES19.PATCH_REJECTED && candidate.retryable === true;
 }
 function throwIfCancelled(signal) {
   if (signal.aborted) {
-    throw new SpotPatchError18(ERROR_CODES18.AGENT_CANCELLED);
+    throw new SpotPatchError19(ERROR_CODES19.AGENT_CANCELLED);
   }
 }
 function linkSignal(source, target) {
@@ -2416,6 +2747,7 @@ async function executeAgentChange(options) {
     worktree = await createIsolatedGitWorktree({
       root: options.root,
       signal: controller.signal,
+      workingTreeMode: options.workingTreeMode ?? "require-clean",
       ...options.temporaryBase === void 0 ? {} : { temporaryBase: options.temporaryBase }
     });
     options.callbacks?.onPhase?.(
@@ -2457,7 +2789,7 @@ async function executeAgentChange(options) {
       }
       toolCallCount += response.toolCalls.length;
       if (toolCallCount > options.execution.limits.maxToolCalls) {
-        throw new SpotPatchError18(ERROR_CODES18.AGENT_LIMIT_EXCEEDED);
+        throw new SpotPatchError19(ERROR_CODES19.AGENT_LIMIT_EXCEEDED);
       }
       const results = [];
       for (const call of response.toolCalls) {
@@ -2492,7 +2824,7 @@ async function executeAgentChange(options) {
       pendingResults = Object.freeze(results);
     }
     if (summary === void 0) {
-      throw new SpotPatchError18(ERROR_CODES18.AGENT_LIMIT_EXCEEDED);
+      throw new SpotPatchError19(ERROR_CODES19.AGENT_LIMIT_EXCEEDED);
     }
     options.callbacks?.onPhase?.(
       Object.freeze({
@@ -2525,7 +2857,7 @@ async function executeAgentChange(options) {
         controller.signal
       );
       if (afterCheck.diff !== initialChangeSet.diff) {
-        throw new SpotPatchError18(ERROR_CODES18.VALIDATION_FAILED);
+        throw new SpotPatchError19(ERROR_CODES19.VALIDATION_FAILED);
       }
     }
     const validationPassed = finalChecks.every((check) => check.status === "passed");
@@ -2541,9 +2873,14 @@ async function executeAgentChange(options) {
       worktree.root,
       initialChangeSet.touchedPaths
     );
+    const baselineHashes = await captureAgentFileHashes(
+      worktree.baseline.root,
+      initialChangeSet.touchedPaths
+    );
     return createPreparedAgentChange({
       autoApplyEligible,
       baselineHead: worktree.baseline.head,
+      baselineHashes,
       expectedHashes,
       result,
       root: worktree.baseline.root,
@@ -2551,15 +2888,15 @@ async function executeAgentChange(options) {
     });
   } catch (error) {
     if (options.signal.aborted) {
-      throw new SpotPatchError18(ERROR_CODES18.AGENT_CANCELLED);
+      throw new SpotPatchError19(ERROR_CODES19.AGENT_CANCELLED);
     }
     if (hasJobTimedOut()) {
-      throw new SpotPatchError18(ERROR_CODES18.AGENT_LIMIT_EXCEEDED);
+      throw new SpotPatchError19(ERROR_CODES19.AGENT_LIMIT_EXCEEDED);
     }
-    if (error instanceof SpotPatchError18) {
+    if (error instanceof SpotPatchError19) {
       throw error;
     }
-    throw new SpotPatchError18(ERROR_CODES18.INTERNAL_ERROR);
+    throw new SpotPatchError19(ERROR_CODES19.INTERNAL_ERROR);
   } finally {
     clearTimeout(timeout);
     unlink();
@@ -2569,15 +2906,15 @@ async function executeAgentChange(options) {
 
 // src/provider/capability-probe.ts
 import {
-  ERROR_CODES as ERROR_CODES19,
-  SpotPatchError as SpotPatchError19
+  ERROR_CODES as ERROR_CODES20,
+  SpotPatchError as SpotPatchError20
 } from "@spotpatch/shared";
 var PROBE_TOOL_NAME = "spotpatch_capability_probe";
 var PROBE_TOKEN = "spotpatch-ready-v1";
 async function probeProviderCapability(options) {
   const model = options.provider.models[options.modelProfileId];
   if (model === void 0) {
-    throw new SpotPatchError19(ERROR_CODES19.MODEL_NOT_ALLOWED);
+    throw new SpotPatchError20(ERROR_CODES20.MODEL_NOT_ALLOWED);
   }
   const credential = options.credential ?? resolveProviderCredential(options.provider.apiKeyEnv, options.environment);
   const session = createOpenAICompatibleProviderSession({
@@ -2606,7 +2943,7 @@ async function probeProviderCapability(options) {
   const first = await session.next(void 0, options.signal);
   const probeCall = first.toolCalls[0];
   if (first.toolCalls.length !== 1 || probeCall?.name !== PROBE_TOOL_NAME || probeCall.arguments.token !== PROBE_TOKEN) {
-    throw new SpotPatchError19(ERROR_CODES19.MODEL_TOOL_CALL_UNSUPPORTED);
+    throw new SpotPatchError20(ERROR_CODES20.MODEL_TOOL_CALL_UNSUPPORTED);
   }
   const second = await session.next(
     Object.freeze([
@@ -2618,7 +2955,7 @@ async function probeProviderCapability(options) {
     options.signal
   );
   if (second.toolCalls.length !== 0 || second.finalText.trim().length === 0) {
-    throw new SpotPatchError19(ERROR_CODES19.MODEL_TOOL_CALL_UNSUPPORTED);
+    throw new SpotPatchError20(ERROR_CODES20.MODEL_TOOL_CALL_UNSUPPORTED);
   }
   return Object.freeze({
     providerProfileId: options.provider.id,
@@ -2640,6 +2977,7 @@ export {
   createOpenAICompatibleProviderSession,
   createProviderCredential,
   executeAgentChange,
+  inspectAgentWorkspace,
   probeProviderCapability,
   resolveProviderCredential,
   revertPreparedAgentChange