@staix/agent-hub 0.16.0 → 0.18.0

package/src/hub/settings.ts

@@ -1,3 +1,4 @@
+import { operationalRosterSetting, operationalSetting } from "./operational-authority.ts";
 import { ACTION_CLASSES } from "./action-class.ts";
 import { definitionOf, type KindMap, type ProjectAdapterCatalog, ADAPTERS, PLANNER_PEERS, SUPPORTED_PEERS, START_MODE_PEERS } from "../adapters/registry.ts";
 import { createHash } from "node:crypto";
@@ -193,12 +194,15 @@ export function parseSettingText(def: SettingDef, text: string): unknown {
 }
 export const settingText = (value: unknown): string => value === null || value === undefined ? "(not set)" : Array.isArray(value) ? value.join(",") || "(none)" : String(value);
 
+export type SettingSource = "dashboard" | "terminal" | "conductor";
+export type SettingWriteOptions = { preserveUndo?: boolean };
 /** `ordinary`: a dashboard session from `ahub ui`. `settings`: one from `ahub ui --settings`. `terminal`: `ahub settings`. */
-export type SettingAuthority = "ordinary" | "settings" | "terminal";
+export type SettingAuthority = "ordinary" | "settings" | "terminal" | "conductor";
 /** Why this authority may not set this value, or undefined. Removing a stored value can raise, so it counts as one. */
 export function settingRefusal(def: SettingDef | string, value: SettingValue, authority: SettingAuthority): string | undefined {
   if (typeof def === "string") return def || "invalid setting definition";
   if (def.locked) return def.locked;
+  if (authority === "conductor") return operationalSetting(def) || operationalRosterSetting(def) ? undefined : `${def.key} is not an operational conductor setting`;
   if (def.risk === "safe" || authority !== "ordinary") return undefined;
   if (value !== null && value === def.floor) return undefined;
   return `${def.key} can widen what agents do without asking: open a settings session with ahub ui --settings, or use ahub settings in a terminal`;
@@ -244,10 +248,12 @@ function refuseTracked(cwd: string, file: StoredFile): void {
   // Unknown is not untracked where there is a repository to ask; only a project outside git has nothing tracked.
   if (tracked === undefined && configRepositoryPresent(cwd)) throw new Error(`git could not confirm that .agenthub/${file} is untracked; nothing was written`);
 }
-/** Keeps the one previous version, then replaces (or removes) the file. */
-function store(cwd: string, stateDir: string, file: StoredFile, key: string, previous: string | null, next: string | null): void {
+/** Person writes keep the one previous version; conductor writes preserve that existing receipt. */
+function store(cwd: string, stateDir: string, file: StoredFile, key: string, previous: string | null, next: string | null, options: SettingWriteOptions = {}): void {
   refuseTracked(cwd, file);
   replaceFile(join(cwd, ".agenthub", file), file, next);
+  // A conductor write never replaces, deletes or rebases the person's undo receipt. The ordinary digest fence still applies.
+  if(options.preserveUndo)return;
   // The record follows the file: a write that failed leaves the earlier record valid, because the file is as it left it.
   const record: UndoRecord = { file, key, previous, written: digest(next), at: Date.now() };
   try {
@@ -282,7 +288,7 @@ export function valueAt(doc: unknown, path: readonly string[]): unknown {
  * Sets (or with null removes) one key of `.agenthub/config.local.json`. `validate` gets a scratch project that holds
  * the shared config and the candidate, and throws when the hub's own loader would refuse it: nothing is written then.
  */
-export function writeConfigSetting(cwd: string, stateDir: string, def: SettingDef, value: SettingValue, validate: (scratch: string) => unknown): boolean {
+export function writeConfigSetting(cwd: string, stateDir: string, def: SettingDef, value: SettingValue, validate: (scratch: string) => unknown, options: SettingWriteOptions = {}): boolean {
   const file = join(cwd, ".agenthub", CONFIG_LOCAL);
   const before = readText(file);
   const doc = before === null ? {} : parseObject(before, CONFIG_LOCAL);
@@ -315,7 +321,7 @@ export function writeConfigSetting(cwd: string, stateDir: string, def: SettingDe
   } else node[leaf] = value;
   const text = `${JSON.stringify(doc, null, 2)}\n`;
   checkConfigText(cwd, text, validate);
-  store(cwd, stateDir, CONFIG_LOCAL, def.key, before, text);
+  store(cwd, stateDir, CONFIG_LOCAL, def.key, before, text, options);
   return true;
 }
 /** Runs `validate` on a scratch project holding the shared config and this candidate for the machine-local one. */

package/src/hub/snapshots.ts

@@ -546,6 +546,66 @@ export interface TurnRecord {
   native: string | null;
 }
 
+/**
+ * Parse `git status --porcelain=v2 -z` output into the paths of dirty submodules (#798 D2). A submodule's
+ * uncommitted edits never move the superproject's gitlink, so a diff of two snapshot trees cannot see them.
+ * Submodule entries are the only ones whose mode field starts with `S`; `N` (normal) entries never qualify.
+ */
+export function parseDirtySubmodules(z: string): string[] {
+  const entries = z.split("\0");
+  const found = new Set<string>();
+  for (let i = 0; i < entries.length; i++) {
+    const entry = entries[i]!;
+    if (entry === "") continue;
+    const kind = entry[0];
+    if (kind === "1") {
+      // `1 XY SUB mH mI mW hH hI PATH`: the rest carries 7 spaces, so the path starts after the last one.
+      const rest = entry.slice(2);
+      const cut = nthSpace(rest, 6);
+      const path = cut < 0 ? "" : rest.slice(cut + 1);
+      if (path && submoduleField(rest.slice(0, cut))) found.add(path);
+    } else if (kind === "2") {
+      // `2 XY SUB mH mI mW hH hI Xscore PATH`, then the next entry is the original path: skip it.
+      const rest = entry.slice(2);
+      const cut = nthSpace(rest, 7);
+      const path = cut < 0 ? "" : rest.slice(cut + 1);
+      if (path && submoduleField(rest.slice(0, cut))) found.add(path);
+      i++;
+    } else if (kind === "u") {
+      // `u XY SUB m1 m2 m3 mW h1 h2 h3 PATH`: nine spaces in the rest, then the path.
+      const rest = entry.slice(2);
+      const cut = nthSpace(rest, 8);
+      const path = cut < 0 ? "" : rest.slice(cut + 1);
+      if (path && submoduleField(rest.slice(0, cut))) found.add(path);
+    }
+    // `?`, `!` and `#` entries carry no mode field: ignore them.
+  }
+  return [...found].sort();
+}
+
+/** porcelain-v2 fields are `XY SUB ...`: the submodule marker is the first character of the second field. */
+const submoduleField = (fields: string): boolean => fields.slice(3, 4) === "S";
+/** Index of the nth space (0-based) after the leading kind character, or -1 when the entry is malformed. */
+function nthSpace(rest: string, n: number): number {
+  let at = -1;
+  for (let seen = 0; seen <= n; seen++) {
+    at = rest.indexOf(" ", at + 1);
+    if (at < 0) return -1;
+  }
+  return at;
+}
+
+/**
+ * Dirty submodules of a repository: modified, untracked or new commits inside a submodule worktree are invisible
+ * to snapshot tree diffs (#798 D2). Returns undefined when git cannot answer. A project without `.gitmodules`
+ * pays no git call at all (D4).
+ */
+export function dirtySubmodules(repo: Repo, budget?: SnapshotBudget): string[] | undefined {
+  if (repo.shadow || !existsSync(join(repo.top, ".gitmodules"))) return [];
+  const result = git(repo, ["status", "--porcelain=v2", "-z", "--ignore-submodules=none", "--", scope(repo)], { GIT_OPTIONAL_LOCKS: "0" }, budget, 1024 * 1024);
+  return result.status === 0 ? parseDirtySubmodules(result.stdout) : undefined;
+}
+
 /** Turn records in hub.db: the daemon writes them, `ahub turns` and `ahub undo` read them. */
 export class Turns {
   private readonly db: Database;

package/src/hub/task-repository.ts

@@ -1,7 +1,9 @@
+import { spawnSync } from "node:child_process";
 import { statSync } from "node:fs";
 import { dirname, isAbsolute, relative, resolve } from "node:path";
 import type { TaskPlan, TaskRefs } from "./board.ts";
-import { hubGitSync } from "./git.ts";
+import { hubGitArgv, hubGitEnv, hubGitSync } from "./git.ts";
+import { hostExecutable } from "./host-executable.ts";
 import { canonicalPath, realPath } from "./project.ts";
 import { isGitHubRepository } from "./spec-read.ts";
 
@@ -22,6 +24,33 @@ function slug(value: string): string | undefined {
   } catch { return undefined; }
 }
 
+/** Share the advisory reader's bounds; only authority reads pin Git and isolate the actual checkout. */
+function boundedGit(dir: string, args: string[], isolated = false): string | undefined {
+  try {
+    const options = { encoding: "utf8" as const, timeout: GIT_TIMEOUT_MS, maxBuffer: GIT_MAX_BYTES };
+    const argv = ["-C", dir, ...args];
+    const found = isolated
+      ? spawnSync(hostExecutable("git", dir), hubGitArgv(argv).slice(1), { ...options, cwd: dir, env: hubGitEnv(process.env, { repositoryIsolation: true }) })
+      : hubGitSync(argv, options);
+    return found.status === 0 && typeof found.stdout === "string" && found.stdout.trim() ? isolated ? found.stdout : found.stdout.trim() : undefined;
+  } catch { return undefined; } // Unknown identity never grants; never log remote URLs or stderr.
+}
+
+/** Actual project-local GitHub origin only, never task refs, a bare slug or global-config fallback. */
+export function githubOriginRepository(cwd: string): string | undefined {
+  let root: string;
+  try { root = realPath(cwd); } catch { return undefined; }
+  const reply = boundedGit(root, ["config", "--show-scope", "--get", "remote.origin.url"], true);
+  const remote = reply && /^(?:local|worktree)\t([^\r\n]+)\n$/.exec(reply)?.[1];
+  if (!remote || /[\s?#]/.test(remote)) return undefined;
+  const scp = /^(?:[^/@:]+@)?github\.com:[^/]+\/[^/]+\/?$/i.test(remote);
+  if (!scp) {
+    if (!/^(?:https?|ssh):\/\/(?:[^/@]+@)?github\.com(?::[0-9]+)?\//i.test(remote)) return undefined;
+    try { const url = new URL(remote); if (url.search || url.hash) return undefined; } catch { return undefined; }
+  }
+  return slug(remote);
+}
+
 /** Repository metadata is advisory, never an execution root or a grant. Git reads are bounded, local and cached. */
 export class TaskRepositories {
   readonly project: TaskRepository;
@@ -37,10 +66,7 @@ export class TaskRepositories {
     this.roots.set(root, this.project);
   }
   private git(dir: string, args: string[]): string | undefined {
-    try {
-      const found = hubGitSync(["-C", dir, ...args], { encoding: "utf8", timeout: GIT_TIMEOUT_MS, maxBuffer: GIT_MAX_BYTES });
-      return found.status === 0 && typeof found.stdout === "string" && found.stdout.trim() ? found.stdout.trim() : undefined;
-    } catch { return undefined; } // Unknown identity keeps a path key; never log remote URLs or stderr.
+    return boundedGit(dir, args);
   }
   private directory(path: string): string {
     let cursor = resolve(path);