@spotpatch/agent 1.1.0 → 1.2.0

package/dist/index.cjs

@@ -34,6 +34,7 @@ __export(index_exports, {
   createOpenAICompatibleProviderSession: () => createOpenAICompatibleProviderSession,
   createProviderCredential: () => createProviderCredential,
   executeAgentChange: () => executeAgentChange,
+  inspectAgentWorkspace: () => inspectAgentWorkspace,
   probeProviderCapability: () => probeProviderCapability,
   resolveProviderCredential: () => resolveProviderCredential,
   revertPreparedAgentChange: () => revertPreparedAgentChange
@@ -41,7 +42,7 @@ __export(index_exports, {
 module.exports = __toCommonJS(index_exports);
 
 // src/engine/execute-agent-change.ts
-var import_shared19 = require("@spotpatch/shared");
+var import_shared20 = require("@spotpatch/shared");
 
 // src/provider/openai-compatible-provider.ts
 var import_shared7 = require("@spotpatch/shared");
@@ -752,7 +753,7 @@ var PROTECTED_FILE_NAMES = /* @__PURE__ */ new Set([
   "yarn.lock"
 ]);
 function deny() {
-  throw new import_shared8.SpotPatchError(import_shared8.ERROR_CODES.TOOL_DENIED);
+  throw new import_shared8.SpotPatchError(import_shared8.ERROR_CODES.TOOL_PATH_DENIED);
 }
 function hasControlCharacter(value) {
   for (let index = 0; index < value.length; index += 1) {
@@ -854,13 +855,13 @@ async function readAgentTextFile(root, relativePath, maximumBytes) {
   }
   const bytes = await (0, import_promises2.readFile)(absolutePath);
   if (bytes.includes(0)) {
-    throw new import_shared9.SpotPatchError(import_shared9.ERROR_CODES.TOOL_DENIED);
+    throw new import_shared9.SpotPatchError(import_shared9.ERROR_CODES.TOOL_PATH_DENIED);
   }
   let content;
   try {
     content = utf8Decoder.decode(bytes);
   } catch {
-    throw new import_shared9.SpotPatchError(import_shared9.ERROR_CODES.TOOL_DENIED);
+    throw new import_shared9.SpotPatchError(import_shared9.ERROR_CODES.TOOL_PATH_DENIED);
   }
   return Object.freeze({ content, relativePath, size: metadata.size });
 }
@@ -873,7 +874,7 @@ function encodeUtf8Text(content, includeByteOrderMark) {
 }
 async function writeAgentTextFileIfContentMatches(root, relativePath, expectedContent, nextContent, maximumBytes) {
   if (nextContent.includes("\0")) {
-    throw new import_shared9.SpotPatchError(import_shared9.ERROR_CODES.TOOL_DENIED);
+    throw new import_shared9.SpotPatchError(import_shared9.ERROR_CODES.TOOL_INPUT_INVALID);
   }
   const absolutePath = await resolveExistingAgentPath(root, relativePath);
   const [metadata, currentBytes] = await Promise.all([
@@ -887,7 +888,7 @@ async function writeAgentTextFileIfContentMatches(root, relativePath, expectedCo
   try {
     currentContent = utf8Decoder.decode(currentBytes);
   } catch {
-    throw new import_shared9.SpotPatchError(import_shared9.ERROR_CODES.TOOL_DENIED);
+    throw new import_shared9.SpotPatchError(import_shared9.ERROR_CODES.TOOL_PATH_DENIED);
   }
   if (currentBytes.includes(0) || currentContent !== expectedContent) {
     throw new import_shared9.SpotPatchError(import_shared9.ERROR_CODES.PATCH_REJECTED);
@@ -1142,7 +1143,7 @@ async function runConfiguredCheck(options) {
 function requireConfiguredCheck(checkId, checks) {
   const check = checks[checkId];
   if (check === void 0) {
-    throw new import_shared10.SpotPatchError(import_shared10.ERROR_CODES.TOOL_DENIED);
+    throw new import_shared10.SpotPatchError(import_shared10.ERROR_CODES.TOOL_INPUT_INVALID);
   }
   return check;
 }
@@ -1331,9 +1332,16 @@ async function applyAgentPatch(worktreeRoot, patch, limits, signal) {
     throw new import_shared13.SpotPatchError(import_shared13.ERROR_CODES.AGENT_LIMIT_EXCEEDED);
   }
   await Promise.all(
-    files.map(
-      async (file) => resolveWritableAgentPath(worktreeRoot, file.relativePath)
-    )
+    files.map(async (file) => {
+      await resolveWritableAgentPath(worktreeRoot, file.relativePath);
+      if (file.kind !== "added") {
+        await readAgentTextFile(
+          worktreeRoot,
+          file.relativePath,
+          limits.maxReadBytesPerFile
+        );
+      }
+    })
   );
   await runGitCommand({
     cwd: worktreeRoot,
@@ -1447,7 +1455,7 @@ var MAX_DISCOVERED_FILES = 2e4;
 var TEXT_SAMPLE_BYTES = 8192;
 function compileGlob(glob) {
   if (glob.length === 0 || glob.length > 256 || glob.includes("\0") || glob.includes("\\") || glob.startsWith("/") || ["[", "]", "{", "}", "(", ")", "!"].some((character) => glob.includes(character)) || glob.split("/").some((segment) => segment === "..")) {
-    throw new import_shared14.SpotPatchError(import_shared14.ERROR_CODES.TOOL_DENIED);
+    throw new import_shared14.SpotPatchError(import_shared14.ERROR_CODES.TOOL_INPUT_INVALID);
   }
   let expression = "^";
   for (let index = 0; index < glob.length; index += 1) {
@@ -1686,7 +1694,7 @@ var runCheckSchema = import_zod.z.strictObject({
   checkId: import_zod.z.string().min(1).max(64).regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/u)
 });
 function invalidTool() {
-  throw new import_shared15.SpotPatchError(import_shared15.ERROR_CODES.TOOL_DENIED);
+  throw new import_shared15.SpotPatchError(import_shared15.ERROR_CODES.TOOL_INPUT_INVALID);
 }
 function parseArguments(schema, value) {
   const parsed = schema.safeParse(value);
@@ -1983,67 +1991,339 @@ function createAgentToolExecutor(options) {
 }
 
 // src/worktree/git-worktree.ts
-var import_promises5 = require("fs/promises");
+var import_promises6 = require("fs/promises");
+var import_node_crypto3 = require("crypto");
 var import_node_os = __toESM(require("os"), 1);
+var import_node_path6 = __toESM(require("path"), 1);
+var import_shared17 = require("@spotpatch/shared");
+
+// src/worktree/workspace-health.ts
+var import_promises5 = require("fs/promises");
 var import_node_path5 = __toESM(require("path"), 1);
 var import_shared16 = require("@spotpatch/shared");
-async function assertCleanGitBaseline(options) {
-  const root = await (0, import_promises5.realpath)(options.root).catch(() => {
-    throw new import_shared16.SpotPatchError(import_shared16.ERROR_CODES.WORKTREE_DIRTY);
+var CONFLICTED_STATUSES = /* @__PURE__ */ new Set(["DD", "AU", "UD", "UA", "DU", "AA", "UU"]);
+var OPERATION_MARKERS = Object.freeze([
+  "MERGE_HEAD",
+  "CHERRY_PICK_HEAD",
+  "REVERT_HEAD",
+  "rebase-apply",
+  "rebase-merge"
+]);
+function emptyChanges() {
+  return Object.freeze({
+    staged: 0,
+    unstaged: 0,
+    untracked: 0,
+    conflicted: 0,
+    total: 0
+  });
+}
+function blockedHealth(errorCode) {
+  return Object.freeze({
+    state: "blocked",
+    checkedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    changes: emptyChanges(),
+    canIncludeLocalChanges: false,
+    errorCode
   });
-  const topLevel = (await runGitCommand({
+}
+function parsePorcelainStatus(value) {
+  const records = value.split("\0");
+  const untrackedPaths = [];
+  let staged = 0;
+  let unstaged = 0;
+  let conflicted = 0;
+  let total = 0;
+  for (let index = 0; index < records.length; index += 1) {
+    const record = records[index] ?? "";
+    if (record.length === 0) {
+      continue;
+    }
+    if (record.length < 4 || record[2] !== " ") {
+      throw new import_shared16.SpotPatchError(import_shared16.ERROR_CODES.WORKTREE_LOCAL_CHANGES_UNSUPPORTED);
+    }
+    const status = record.slice(0, 2);
+    const relativePath = record.slice(3);
+    if (relativePath.length === 0) {
+      throw new import_shared16.SpotPatchError(import_shared16.ERROR_CODES.WORKTREE_LOCAL_CHANGES_UNSUPPORTED);
+    }
+    total += 1;
+    if (status === "??") {
+      untrackedPaths.push(relativePath);
+      continue;
+    }
+    const indexStatus = status[0] ?? " ";
+    const worktreeStatus = status[1] ?? " ";
+    if (CONFLICTED_STATUSES.has(status) || indexStatus === "U" || worktreeStatus === "U") {
+      conflicted += 1;
+    }
+    if (indexStatus !== " ") {
+      staged += 1;
+    }
+    if (worktreeStatus !== " ") {
+      unstaged += 1;
+    }
+    if (indexStatus === "R" || indexStatus === "C") {
+      index += 1;
+      if ((records[index] ?? "").length === 0) {
+        throw new import_shared16.SpotPatchError(import_shared16.ERROR_CODES.WORKTREE_LOCAL_CHANGES_UNSUPPORTED);
+      }
+    }
+  }
+  return Object.freeze({
+    changes: Object.freeze({
+      staged,
+      unstaged,
+      untracked: untrackedPaths.length,
+      conflicted,
+      total
+    }),
+    untrackedPaths: Object.freeze(untrackedPaths)
+  });
+}
+async function operationInProgress(root, signal) {
+  for (const marker of OPERATION_MARKERS) {
+    const markerPath = (await runGitCommand({
+      cwd: root,
+      args: ["rev-parse", "--git-path", marker],
+      errorCode: import_shared16.ERROR_CODES.WORKTREE_NOT_REPOSITORY,
+      ...signal === void 0 ? {} : { signal }
+    })).trim();
+    if (await (0, import_promises5.lstat)(import_node_path5.default.resolve(root, markerPath)).catch(() => void 0) !== void 0) {
+      return true;
+    }
+  }
+  return false;
+}
+async function inspectUntrackedFiles(root, relativePaths) {
+  if (relativePaths.length > import_shared16.AGENT_WORKSPACE_SNAPSHOT_LIMITS.maxUntrackedFiles) {
+    return import_shared16.ERROR_CODES.WORKTREE_LOCAL_CHANGES_TOO_LARGE;
+  }
+  let totalBytes = 0;
+  for (const relativePath of relativePaths) {
+    const absolutePath = import_node_path5.default.resolve(root, relativePath);
+    const relative = import_node_path5.default.relative(root, absolutePath);
+    if (relative === ".." || relative.startsWith(`..${import_node_path5.default.sep}`) || import_node_path5.default.isAbsolute(relative)) {
+      return import_shared16.ERROR_CODES.WORKTREE_UNTRACKED_UNSUPPORTED;
+    }
+    const metadata = await (0, import_promises5.lstat)(absolutePath).catch(() => void 0);
+    if (metadata === void 0 || !metadata.isFile() || metadata.isSymbolicLink()) {
+      return import_shared16.ERROR_CODES.WORKTREE_UNTRACKED_UNSUPPORTED;
+    }
+    totalBytes += metadata.size;
+    if (totalBytes > import_shared16.AGENT_WORKSPACE_SNAPSHOT_LIMITS.maxUntrackedBytes) {
+      return import_shared16.ERROR_CODES.WORKTREE_LOCAL_CHANGES_TOO_LARGE;
+    }
+  }
+  return void 0;
+}
+async function inspectGitWorkspace(rootValue, signal) {
+  const root = await (0, import_promises5.realpath)(rootValue).catch(() => {
+    throw new import_shared16.SpotPatchError(import_shared16.ERROR_CODES.WORKTREE_NOT_REPOSITORY);
+  });
+  const topLevelResult = await runRawGitCommand({
     cwd: root,
     args: ["rev-parse", "--show-toplevel"],
-    errorCode: import_shared16.ERROR_CODES.WORKTREE_DIRTY,
-    ...options.signal === void 0 ? {} : { signal: options.signal }
-  })).trim();
+    ...signal === void 0 ? {} : { signal }
+  });
+  if (topLevelResult.exitCode !== 0 || topLevelResult.cancelled || topLevelResult.timedOut) {
+    throw new import_shared16.SpotPatchError(import_shared16.ERROR_CODES.WORKTREE_NOT_REPOSITORY);
+  }
+  const topLevel = topLevelResult.stdout.trim();
   if (!samePath(root, topLevel)) {
-    throw new import_shared16.SpotPatchError(import_shared16.ERROR_CODES.WORKTREE_DIRTY);
+    throw new import_shared16.SpotPatchError(import_shared16.ERROR_CODES.WORKTREE_NOT_REPOSITORY);
   }
   const head = (await runGitCommand({
     cwd: root,
     args: ["rev-parse", "--verify", "HEAD"],
-    errorCode: import_shared16.ERROR_CODES.WORKTREE_DIRTY,
-    ...options.signal === void 0 ? {} : { signal: options.signal }
+    errorCode: import_shared16.ERROR_CODES.WORKTREE_NOT_REPOSITORY,
+    ...signal === void 0 ? {} : { signal }
   })).trim();
-  if (options.expectedHead !== void 0 && head !== options.expectedHead) {
-    throw new import_shared16.SpotPatchError(import_shared16.ERROR_CODES.APPLY_CONFLICT);
+  const parsed = parsePorcelainStatus(
+    await runGitCommand({
+      cwd: root,
+      args: ["status", "--porcelain=v1", "-z", "--untracked-files=all"],
+      errorCode: import_shared16.ERROR_CODES.WORKTREE_NOT_REPOSITORY,
+      ...signal === void 0 ? {} : { signal }
+    })
+  );
+  const operationActive = await operationInProgress(root, signal);
+  const untrackedError = await inspectUntrackedFiles(root, parsed.untrackedPaths);
+  const errorCode = operationActive ? import_shared16.ERROR_CODES.WORKTREE_OPERATION_IN_PROGRESS : parsed.changes.conflicted > 0 ? import_shared16.ERROR_CODES.WORKTREE_CONFLICTED : untrackedError;
+  const health = Object.freeze({
+    state: errorCode !== void 0 ? "blocked" : parsed.changes.total === 0 ? "ready" : "consent-required",
+    checkedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    changes: parsed.changes,
+    canIncludeLocalChanges: errorCode === void 0 && parsed.changes.total > 0,
+    ...errorCode === void 0 ? {} : { errorCode }
+  });
+  return Object.freeze({
+    root,
+    head,
+    health,
+    untrackedPaths: parsed.untrackedPaths
+  });
+}
+async function inspectAgentWorkspace(root, signal) {
+  try {
+    return (await inspectGitWorkspace(root, signal)).health;
+  } catch (error) {
+    if (error instanceof import_shared16.SpotPatchError) {
+      return blockedHealth(error.code);
+    }
+    return blockedHealth(import_shared16.ERROR_CODES.INTERNAL_ERROR);
   }
-  const status = await runGitCommand({
-    cwd: root,
-    args: ["status", "--porcelain=v1", "-z", "--untracked-files=all"],
-    errorCode: import_shared16.ERROR_CODES.WORKTREE_DIRTY,
-    ...options.signal === void 0 ? {} : { signal: options.signal }
+}
+
+// src/worktree/git-worktree.ts
+function workspacePath(root, relativePath) {
+  const candidate = import_node_path6.default.resolve(root, relativePath);
+  const relative = import_node_path6.default.relative(root, candidate);
+  if (relative === ".." || relative.startsWith(`..${import_node_path6.default.sep}`) || import_node_path6.default.isAbsolute(relative)) {
+    throw new import_shared17.SpotPatchError(import_shared17.ERROR_CODES.WORKTREE_LOCAL_CHANGES_UNSUPPORTED);
+  }
+  return candidate;
+}
+async function fileDigest(filePath) {
+  return (0, import_node_crypto3.createHash)("sha256").update(await (0, import_promises6.readFile)(filePath)).digest("hex");
+}
+async function copyUntrackedFiles(sourceRoot, worktreeRoot, relativePaths) {
+  for (const relativePath of relativePaths) {
+    const sourcePath = workspacePath(sourceRoot, relativePath);
+    const targetPath = workspacePath(worktreeRoot, relativePath);
+    const metadata = await (0, import_promises6.lstat)(sourcePath).catch(() => void 0);
+    if (metadata === void 0 || !metadata.isFile() || metadata.isSymbolicLink()) {
+      throw new import_shared17.SpotPatchError(import_shared17.ERROR_CODES.WORKTREE_LOCAL_CHANGES_UNSUPPORTED);
+    }
+    await (0, import_promises6.mkdir)(import_node_path6.default.dirname(targetPath), { recursive: true });
+    await (0, import_promises6.copyFile)(sourcePath, targetPath);
+    const [sourceDigest, targetDigest] = await Promise.all([
+      fileDigest(sourcePath),
+      fileDigest(targetPath)
+    ]).catch(() => {
+      throw new import_shared17.SpotPatchError(import_shared17.ERROR_CODES.APPLY_CONFLICT);
+    });
+    if (sourceDigest !== targetDigest) {
+      throw new import_shared17.SpotPatchError(import_shared17.ERROR_CODES.APPLY_CONFLICT);
+    }
+  }
+}
+async function assertUntrackedFilesUnchanged(sourceRoot, worktreeRoot, relativePaths) {
+  for (const relativePath of relativePaths) {
+    const sourcePath = workspacePath(sourceRoot, relativePath);
+    const targetPath = workspacePath(worktreeRoot, relativePath);
+    const [sourceDigest, targetDigest] = await Promise.all([
+      fileDigest(sourcePath),
+      fileDigest(targetPath)
+    ]).catch(() => {
+      throw new import_shared17.SpotPatchError(import_shared17.ERROR_CODES.APPLY_CONFLICT);
+    });
+    if (sourceDigest !== targetDigest) {
+      throw new import_shared17.SpotPatchError(import_shared17.ERROR_CODES.APPLY_CONFLICT);
+    }
+  }
+}
+async function materializeLocalBaseline(sourceRoot, worktreeRoot, expectedHead, untrackedPaths, signal) {
+  const sourceDiff = await runGitCommand({
+    cwd: sourceRoot,
+    args: [
+      "diff",
+      "--binary",
+      "--full-index",
+      "--no-ext-diff",
+      "--no-color",
+      "--no-renames",
+      "HEAD",
+      "--"
+    ],
+    signal,
+    errorCode: import_shared17.ERROR_CODES.WORKTREE_LOCAL_CHANGES_UNSUPPORTED
   });
-  if (status.length > 0) {
-    throw new import_shared16.SpotPatchError(
-      options.expectedHead === void 0 ? import_shared16.ERROR_CODES.WORKTREE_DIRTY : import_shared16.ERROR_CODES.APPLY_CONFLICT
-    );
+  if (sourceDiff.length > 0) {
+    await runGitCommand({
+      cwd: worktreeRoot,
+      args: ["apply", "--binary", "--whitespace=nowarn", "-"],
+      stdin: sourceDiff,
+      signal,
+      errorCode: import_shared17.ERROR_CODES.WORKTREE_LOCAL_CHANGES_UNSUPPORTED
+    });
   }
-  return Object.freeze({ root, head });
+  await copyUntrackedFiles(sourceRoot, worktreeRoot, untrackedPaths);
+  const confirmation = await inspectGitWorkspace(sourceRoot, signal);
+  const confirmationDiff = await runGitCommand({
+    cwd: sourceRoot,
+    args: [
+      "diff",
+      "--binary",
+      "--full-index",
+      "--no-ext-diff",
+      "--no-color",
+      "--no-renames",
+      "HEAD",
+      "--"
+    ],
+    signal,
+    errorCode: import_shared17.ERROR_CODES.APPLY_CONFLICT
+  });
+  if (confirmation.head !== expectedHead || confirmationDiff !== sourceDiff || confirmation.untrackedPaths.length !== untrackedPaths.length || confirmation.untrackedPaths.some((value, index) => value !== untrackedPaths[index])) {
+    throw new import_shared17.SpotPatchError(import_shared17.ERROR_CODES.APPLY_CONFLICT);
+  }
+  await assertUntrackedFilesUnchanged(sourceRoot, worktreeRoot, untrackedPaths);
+  await runGitCommand({
+    cwd: worktreeRoot,
+    args: ["add", "--all"],
+    signal,
+    errorCode: import_shared17.ERROR_CODES.WORKTREE_LOCAL_CHANGES_UNSUPPORTED
+  });
+  await runGitCommand({
+    cwd: worktreeRoot,
+    args: [
+      "-c",
+      "user.name=SpotPatch Agent",
+      "-c",
+      "user.email=spotpatch-agent@example.invalid",
+      "commit",
+      "--quiet",
+      "-m",
+      "SpotPatch local workspace baseline"
+    ],
+    signal,
+    errorCode: import_shared17.ERROR_CODES.WORKTREE_LOCAL_CHANGES_UNSUPPORTED
+  });
 }
 async function defaultTemporaryBase(root) {
-  const dependencyDirectory = import_node_path5.default.join(root, "node_modules");
+  const dependencyDirectory = import_node_path6.default.join(root, "node_modules");
   try {
-    const stats = await (0, import_promises5.lstat)(dependencyDirectory);
+    const stats = await (0, import_promises6.lstat)(dependencyDirectory);
     if (!stats.isDirectory() || stats.isSymbolicLink()) {
       return import_node_os.default.tmpdir();
     }
-    return await (0, import_promises5.realpath)(dependencyDirectory);
+    return await (0, import_promises6.realpath)(dependencyDirectory);
   } catch {
     return import_node_os.default.tmpdir();
   }
 }
 async function createIsolatedGitWorktree(options) {
-  const baseline = await assertCleanGitBaseline({
-    root: options.root,
-    signal: options.signal
+  const workingTreeMode = options.workingTreeMode ?? "require-clean";
+  const inspection = await inspectGitWorkspace(options.root, options.signal);
+  if (inspection.health.state === "blocked") {
+    throw new import_shared17.SpotPatchError(
+      inspection.health.errorCode ?? import_shared17.ERROR_CODES.WORKTREE_LOCAL_CHANGES_UNSUPPORTED
+    );
+  }
+  if (inspection.health.state === "consent-required" && workingTreeMode === "require-clean") {
+    throw new import_shared17.SpotPatchError(import_shared17.ERROR_CODES.WORKTREE_DIRTY);
+  }
+  const baseline = Object.freeze({
+    root: inspection.root,
+    head: inspection.head,
+    workingTreeMode
   });
   const temporaryBase = options.temporaryBase ?? await defaultTemporaryBase(baseline.root);
-  const temporaryDirectory = await (0, import_promises5.mkdtemp)(
-    import_node_path5.default.join(temporaryBase, "spotpatch-agent-")
+  const temporaryDirectory = await (0, import_promises6.mkdtemp)(
+    import_node_path6.default.join(temporaryBase, "spotpatch-agent-")
   );
-  const worktreePath = import_node_path5.default.join(temporaryDirectory, "worktree");
+  const worktreePath = import_node_path6.default.join(temporaryDirectory, "worktree");
   let registered = false;
   let cleaned = false;
   const cleanup = async () => {
@@ -2058,8 +2338,8 @@ async function createIsolatedGitWorktree(options) {
         timeoutMs: 3e4
       }).catch(() => void 0);
     }
-    if (import_node_path5.default.basename(temporaryDirectory).startsWith("spotpatch-agent-")) {
-      await (0, import_promises5.rm)(temporaryDirectory, { recursive: true, force: true }).catch(
+    if (import_node_path6.default.basename(temporaryDirectory).startsWith("spotpatch-agent-")) {
+      await (0, import_promises6.rm)(temporaryDirectory, { recursive: true, force: true }).catch(
         () => void 0
       );
     }
@@ -2068,12 +2348,12 @@ async function createIsolatedGitWorktree(options) {
     await runGitCommand({
       cwd: baseline.root,
       args: ["worktree", "add", "--detach", worktreePath, baseline.head],
-      errorCode: import_shared16.ERROR_CODES.INTERNAL_ERROR,
+      errorCode: import_shared17.ERROR_CODES.INTERNAL_ERROR,
       signal: options.signal,
       timeoutMs: 3e4
     });
     registered = true;
-    const worktreeRoot = await (0, import_promises5.realpath)(worktreePath);
+    const worktreeRoot = await (0, import_promises6.realpath)(worktreePath);
     const actualHead = (await runGitCommand({
       cwd: worktreeRoot,
       args: ["rev-parse", "--verify", "HEAD"],
@@ -2085,7 +2365,16 @@ async function createIsolatedGitWorktree(options) {
       signal: options.signal
     })).trim();
     if (actualHead !== baseline.head || !samePath(actualRoot, worktreeRoot)) {
-      throw new import_shared16.SpotPatchError(import_shared16.ERROR_CODES.INTERNAL_ERROR);
+      throw new import_shared17.SpotPatchError(import_shared17.ERROR_CODES.INTERNAL_ERROR);
+    }
+    if (inspection.health.state === "consent-required") {
+      await materializeLocalBaseline(
+        baseline.root,
+        worktreeRoot,
+        baseline.head,
+        inspection.untrackedPaths,
+        options.signal
+      );
     }
     return Object.freeze({ baseline, root: worktreeRoot, cleanup });
   } catch (error) {
@@ -2095,17 +2384,19 @@ async function createIsolatedGitWorktree(options) {
 }
 
 // src/worktree/prepared-change.ts
-var import_node_crypto3 = require("crypto");
-var import_promises6 = require("fs/promises");
-var import_shared17 = require("@spotpatch/shared");
+var import_node_crypto4 = require("crypto");
+var import_promises7 = require("fs/promises");
+var import_shared18 = require("@spotpatch/shared");
 var privateChanges = /* @__PURE__ */ new WeakMap();
 var DELETED_HASH = "<deleted>";
 function createPreparedAgentChange(options) {
   const touchedPaths = Object.freeze(
     options.result.files.map((file) => file.relativePath)
   );
-  if (options.expectedHashes.size !== touchedPaths.length || touchedPaths.some((relativePath) => !options.expectedHashes.has(relativePath))) {
-    throw new import_shared17.SpotPatchError(import_shared17.ERROR_CODES.INTERNAL_ERROR);
+  if (options.baselineHashes.size !== touchedPaths.length || options.expectedHashes.size !== touchedPaths.length || touchedPaths.some(
+    (relativePath) => !options.baselineHashes.has(relativePath) || !options.expectedHashes.has(relativePath)
+  )) {
+    throw new import_shared18.SpotPatchError(import_shared18.ERROR_CODES.INTERNAL_ERROR);
   }
   const change = Object.freeze({
     kind: "prepared-agent-change",
@@ -2115,6 +2406,7 @@ function createPreparedAgentChange(options) {
   });
   privateChanges.set(change, {
     baselineHead: options.baselineHead,
+    baselineHashes: new Map(options.baselineHashes),
     diff: options.result.diff,
     expectedHashes: new Map(options.expectedHashes),
     root: options.root,
@@ -2126,28 +2418,30 @@ function createPreparedAgentChange(options) {
 function requirePrivateChange(change) {
   const privateChange = privateChanges.get(change);
   if (privateChange === void 0) {
-    throw new import_shared17.SpotPatchError(import_shared17.ERROR_CODES.INTERNAL_ERROR);
+    throw new import_shared18.SpotPatchError(import_shared18.ERROR_CODES.INTERNAL_ERROR);
   }
   return privateChange;
 }
-async function currentHead(root) {
-  return (await runGitCommand({
-    cwd: root,
-    args: ["rev-parse", "--verify", "HEAD"],
-    errorCode: import_shared17.ERROR_CODES.APPLY_CONFLICT
-  })).trim();
+async function assertWorkspaceOperationSafe(root, expectedHead) {
+  const inspection = await inspectGitWorkspace(root).catch(() => {
+    throw new import_shared18.SpotPatchError(import_shared18.ERROR_CODES.APPLY_CONFLICT);
+  });
+  const blockingOperation = inspection.health.errorCode === import_shared18.ERROR_CODES.WORKTREE_OPERATION_IN_PROGRESS || inspection.health.errorCode === import_shared18.ERROR_CODES.WORKTREE_CONFLICTED;
+  if (inspection.head !== expectedHead || blockingOperation) {
+    throw new import_shared18.SpotPatchError(import_shared18.ERROR_CODES.APPLY_CONFLICT);
+  }
 }
 async function fileHash(root, relativePath) {
   const normalized = assertAgentPathAllowed(relativePath);
   const absolutePath = await resolveWritableAgentPath(root, normalized);
-  const metadata = await (0, import_promises6.lstat)(absolutePath).catch(() => void 0);
+  const metadata = await (0, import_promises7.lstat)(absolutePath).catch(() => void 0);
   if (metadata === void 0) {
     return DELETED_HASH;
   }
   if (!metadata.isFile() || metadata.isSymbolicLink()) {
-    throw new import_shared17.SpotPatchError(import_shared17.ERROR_CODES.APPLY_CONFLICT);
+    throw new import_shared18.SpotPatchError(import_shared18.ERROR_CODES.APPLY_CONFLICT);
   }
-  return (0, import_node_crypto3.createHash)("sha256").update(await (0, import_promises6.readFile)(absolutePath)).digest("hex");
+  return (0, import_node_crypto4.createHash)("sha256").update(await (0, import_promises7.readFile)(absolutePath)).digest("hex");
 }
 async function captureAgentFileHashes(root, paths) {
   const entries = await Promise.all(
@@ -2163,34 +2457,38 @@ function hashesMatch(expected, actual) {
 async function applyPreparedAgentChange(change) {
   const privateChange = requirePrivateChange(change);
   if (privateChange.state !== "prepared" || !change.validationPassed || privateChange.diff.length === 0) {
-    throw new import_shared17.SpotPatchError(
-      change.validationPassed ? import_shared17.ERROR_CODES.APPLY_CONFLICT : import_shared17.ERROR_CODES.VALIDATION_FAILED
+    throw new import_shared18.SpotPatchError(
+      change.validationPassed ? import_shared18.ERROR_CODES.APPLY_CONFLICT : import_shared18.ERROR_CODES.VALIDATION_FAILED
     );
   }
   privateChange.state = "applying";
   try {
-    await assertCleanGitBaseline({
-      root: privateChange.root,
-      expectedHead: privateChange.baselineHead
-    });
+    await assertWorkspaceOperationSafe(privateChange.root, privateChange.baselineHead);
+    const currentHashes = await captureAgentFileHashes(
+      privateChange.root,
+      privateChange.touchedPaths
+    );
+    if (!hashesMatch(privateChange.baselineHashes, currentHashes)) {
+      throw new import_shared18.SpotPatchError(import_shared18.ERROR_CODES.APPLY_CONFLICT);
+    }
     await runGitCommand({
       cwd: privateChange.root,
       args: ["apply", "--check", "--whitespace=error-all", "-"],
       stdin: privateChange.diff,
-      errorCode: import_shared17.ERROR_CODES.APPLY_CONFLICT
+      errorCode: import_shared18.ERROR_CODES.APPLY_CONFLICT
     });
     await runGitCommand({
       cwd: privateChange.root,
       args: ["apply", "--whitespace=error-all", "-"],
       stdin: privateChange.diff,
-      errorCode: import_shared17.ERROR_CODES.APPLY_CONFLICT
+      errorCode: import_shared18.ERROR_CODES.APPLY_CONFLICT
     });
     const appliedHashes = await captureAgentFileHashes(
       privateChange.root,
       privateChange.touchedPaths
     );
     if (!hashesMatch(privateChange.expectedHashes, appliedHashes)) {
-      throw new import_shared17.SpotPatchError(import_shared17.ERROR_CODES.APPLY_CONFLICT);
+      throw new import_shared18.SpotPatchError(import_shared18.ERROR_CODES.APPLY_CONFLICT);
     }
     privateChange.appliedHashes = appliedHashes;
     privateChange.state = "applied";
@@ -2202,34 +2500,39 @@ async function applyPreparedAgentChange(change) {
 async function revertPreparedAgentChange(change) {
   const privateChange = requirePrivateChange(change);
   if (privateChange.state !== "applied" || privateChange.appliedHashes === void 0) {
-    throw new import_shared17.SpotPatchError(import_shared17.ERROR_CODES.APPLY_CONFLICT);
+    throw new import_shared18.SpotPatchError(import_shared18.ERROR_CODES.APPLY_CONFLICT);
   }
   privateChange.state = "reverting";
   try {
-    if (await currentHead(privateChange.root) !== privateChange.baselineHead) {
-      throw new import_shared17.SpotPatchError(import_shared17.ERROR_CODES.APPLY_CONFLICT);
-    }
+    await assertWorkspaceOperationSafe(privateChange.root, privateChange.baselineHead);
     const currentHashes = await captureAgentFileHashes(
       privateChange.root,
       privateChange.touchedPaths
     );
     for (const [relativePath, expectedHash] of privateChange.appliedHashes) {
       if (currentHashes.get(relativePath) !== expectedHash) {
-        throw new import_shared17.SpotPatchError(import_shared17.ERROR_CODES.APPLY_CONFLICT);
+        throw new import_shared18.SpotPatchError(import_shared18.ERROR_CODES.APPLY_CONFLICT);
       }
     }
     await runGitCommand({
       cwd: privateChange.root,
       args: ["apply", "--reverse", "--check", "--whitespace=error-all", "-"],
       stdin: privateChange.diff,
-      errorCode: import_shared17.ERROR_CODES.APPLY_CONFLICT
+      errorCode: import_shared18.ERROR_CODES.APPLY_CONFLICT
     });
     await runGitCommand({
       cwd: privateChange.root,
       args: ["apply", "--reverse", "--whitespace=error-all", "-"],
       stdin: privateChange.diff,
-      errorCode: import_shared17.ERROR_CODES.APPLY_CONFLICT
+      errorCode: import_shared18.ERROR_CODES.APPLY_CONFLICT
     });
+    const revertedHashes = await captureAgentFileHashes(
+      privateChange.root,
+      privateChange.touchedPaths
+    );
+    if (!hashesMatch(privateChange.baselineHashes, revertedHashes)) {
+      throw new import_shared18.SpotPatchError(import_shared18.ERROR_CODES.APPLY_CONFLICT);
+    }
     privateChange.state = "reverted";
   } catch (error) {
     privateChange.state = "applied";
@@ -2238,7 +2541,7 @@ async function revertPreparedAgentChange(change) {
 }
 
 // src/engine/agent-prompt.ts
-var import_shared18 = require("@spotpatch/shared");
+var import_shared19 = require("@spotpatch/shared");
 var AGENT_SYSTEM_INSTRUCTIONS = `You are editing code only inside a disposable, isolated Git worktree.
 
 Follow these rules exactly:
@@ -2255,7 +2558,7 @@ Follow these rules exactly:
 function redactedJson(value) {
   return JSON.stringify(
     value,
-    (_key, item) => typeof item === "string" ? (0, import_shared18.redactSensitiveText)(item) : item,
+    (_key, item) => typeof item === "string" ? (0, import_shared19.redactSensitiveText)(item) : item,
     2
   );
 }
@@ -2332,7 +2635,7 @@ function createBoundedTarget(target, maximumCharacters) {
 function composeBoundedContext(annotation, maximumCharacters) {
   const page = Object.freeze({
     ...annotation.page,
-    url: (0, import_shared18.sanitizeUrl)(annotation.page.url, "http://spotpatch.invalid")
+    url: (0, import_shared19.sanitizeUrl)(annotation.page.url, "http://spotpatch.invalid")
   });
   const fixedCharacters = redactedJson({
     page,
@@ -2388,7 +2691,7 @@ function composeAgentUserPrompt(annotation, maximumCharacters) {
   const minimumContextCharacters = 1024;
   const request = annotation.targets.map(
     (target, index) => `Target ${String(index + 1)}:
-${(0, import_shared18.redactSensitiveText)(target.instruction.trim())}`
+${(0, import_shared19.redactSensitiveText)(target.instruction.trim())}`
   ).join("\n\n");
   const prefix = `${requestPrefix}${request}${contextPrefix}`;
   if (prefix.length + suffix.length + minimumContextCharacters > maximumCharacters) {
@@ -2408,11 +2711,11 @@ function isRetryableToolFailure(result) {
     return false;
   }
   const candidate = output;
-  return candidate.errorCode === import_shared19.ERROR_CODES.PATCH_REJECTED && candidate.retryable === true;
+  return candidate.errorCode === import_shared20.ERROR_CODES.PATCH_REJECTED && candidate.retryable === true;
 }
 function throwIfCancelled(signal) {
   if (signal.aborted) {
-    throw new import_shared19.SpotPatchError(import_shared19.ERROR_CODES.AGENT_CANCELLED);
+    throw new import_shared20.SpotPatchError(import_shared20.ERROR_CODES.AGENT_CANCELLED);
   }
 }
 function linkSignal(source, target) {
@@ -2450,6 +2753,7 @@ async function executeAgentChange(options) {
     worktree = await createIsolatedGitWorktree({
       root: options.root,
       signal: controller.signal,
+      workingTreeMode: options.workingTreeMode ?? "require-clean",
       ...options.temporaryBase === void 0 ? {} : { temporaryBase: options.temporaryBase }
     });
     options.callbacks?.onPhase?.(
@@ -2491,7 +2795,7 @@ async function executeAgentChange(options) {
       }
       toolCallCount += response.toolCalls.length;
       if (toolCallCount > options.execution.limits.maxToolCalls) {
-        throw new import_shared19.SpotPatchError(import_shared19.ERROR_CODES.AGENT_LIMIT_EXCEEDED);
+        throw new import_shared20.SpotPatchError(import_shared20.ERROR_CODES.AGENT_LIMIT_EXCEEDED);
       }
       const results = [];
       for (const call of response.toolCalls) {
@@ -2526,7 +2830,7 @@ async function executeAgentChange(options) {
       pendingResults = Object.freeze(results);
     }
     if (summary === void 0) {
-      throw new import_shared19.SpotPatchError(import_shared19.ERROR_CODES.AGENT_LIMIT_EXCEEDED);
+      throw new import_shared20.SpotPatchError(import_shared20.ERROR_CODES.AGENT_LIMIT_EXCEEDED);
     }
     options.callbacks?.onPhase?.(
       Object.freeze({
@@ -2559,7 +2863,7 @@ async function executeAgentChange(options) {
         controller.signal
       );
       if (afterCheck.diff !== initialChangeSet.diff) {
-        throw new import_shared19.SpotPatchError(import_shared19.ERROR_CODES.VALIDATION_FAILED);
+        throw new import_shared20.SpotPatchError(import_shared20.ERROR_CODES.VALIDATION_FAILED);
       }
     }
     const validationPassed = finalChecks.every((check) => check.status === "passed");
@@ -2575,9 +2879,14 @@ async function executeAgentChange(options) {
       worktree.root,
       initialChangeSet.touchedPaths
     );
+    const baselineHashes = await captureAgentFileHashes(
+      worktree.baseline.root,
+      initialChangeSet.touchedPaths
+    );
     return createPreparedAgentChange({
       autoApplyEligible,
       baselineHead: worktree.baseline.head,
+      baselineHashes,
       expectedHashes,
       result,
       root: worktree.baseline.root,
@@ -2585,15 +2894,15 @@ async function executeAgentChange(options) {
     });
   } catch (error) {
     if (options.signal.aborted) {
-      throw new import_shared19.SpotPatchError(import_shared19.ERROR_CODES.AGENT_CANCELLED);
+      throw new import_shared20.SpotPatchError(import_shared20.ERROR_CODES.AGENT_CANCELLED);
     }
     if (hasJobTimedOut()) {
-      throw new import_shared19.SpotPatchError(import_shared19.ERROR_CODES.AGENT_LIMIT_EXCEEDED);
+      throw new import_shared20.SpotPatchError(import_shared20.ERROR_CODES.AGENT_LIMIT_EXCEEDED);
     }
-    if (error instanceof import_shared19.SpotPatchError) {
+    if (error instanceof import_shared20.SpotPatchError) {
       throw error;
     }
-    throw new import_shared19.SpotPatchError(import_shared19.ERROR_CODES.INTERNAL_ERROR);
+    throw new import_shared20.SpotPatchError(import_shared20.ERROR_CODES.INTERNAL_ERROR);
   } finally {
     clearTimeout(timeout);
     unlink();
@@ -2602,13 +2911,13 @@ async function executeAgentChange(options) {
 }
 
 // src/provider/capability-probe.ts
-var import_shared20 = require("@spotpatch/shared");
+var import_shared21 = require("@spotpatch/shared");
 var PROBE_TOOL_NAME = "spotpatch_capability_probe";
 var PROBE_TOKEN = "spotpatch-ready-v1";
 async function probeProviderCapability(options) {
   const model = options.provider.models[options.modelProfileId];
   if (model === void 0) {
-    throw new import_shared20.SpotPatchError(import_shared20.ERROR_CODES.MODEL_NOT_ALLOWED);
+    throw new import_shared21.SpotPatchError(import_shared21.ERROR_CODES.MODEL_NOT_ALLOWED);
   }
   const credential = options.credential ?? resolveProviderCredential(options.provider.apiKeyEnv, options.environment);
   const session = createOpenAICompatibleProviderSession({
@@ -2637,7 +2946,7 @@ async function probeProviderCapability(options) {
   const first = await session.next(void 0, options.signal);
   const probeCall = first.toolCalls[0];
   if (first.toolCalls.length !== 1 || probeCall?.name !== PROBE_TOOL_NAME || probeCall.arguments.token !== PROBE_TOKEN) {
-    throw new import_shared20.SpotPatchError(import_shared20.ERROR_CODES.MODEL_TOOL_CALL_UNSUPPORTED);
+    throw new import_shared21.SpotPatchError(import_shared21.ERROR_CODES.MODEL_TOOL_CALL_UNSUPPORTED);
   }
   const second = await session.next(
     Object.freeze([
@@ -2649,7 +2958,7 @@ async function probeProviderCapability(options) {
     options.signal
   );
   if (second.toolCalls.length !== 0 || second.finalText.trim().length === 0) {
-    throw new import_shared20.SpotPatchError(import_shared20.ERROR_CODES.MODEL_TOOL_CALL_UNSUPPORTED);
+    throw new import_shared21.SpotPatchError(import_shared21.ERROR_CODES.MODEL_TOOL_CALL_UNSUPPORTED);
   }
   return Object.freeze({
     providerProfileId: options.provider.id,
@@ -2672,6 +2981,7 @@ async function probeProviderCapability(options) {
   createOpenAICompatibleProviderSession,
   createProviderCredential,
   executeAgentChange,
+  inspectAgentWorkspace,
   probeProviderCapability,
   resolveProviderCredential,
   revertPreparedAgentChange