@staix/agent-hub 0.19.0 → 0.20.0

package/src/hub/tasks.ts

@@ -49,6 +49,7 @@ import { coverageGap, renderReviewBrief, type ReviewBrief } from "./review-brief
 import { definitionOf as builtinDefinitionOf } from "../adapters/registry.ts";
 import { ADAPTERS, DEFAULT_REVIEW_POOL, definitionOf, familyOf, type ProjectAdapterCatalog } from "../adapters/registry.ts";
 import { plannerGrooming, nextSweep, taskSweepConfig, type TaskSweepConfig, type SweepRecord } from "./task-sweep.ts";
+import { CiWatchers, pollCi, type CiOutcome, type CiWatch } from "./ci-watch.ts";
 import { planningIssueReceipt, linkedReceipt, openPrFor, readPrCostHistory, readReviewReadiness, reviewReadinessFromEvidence, type PrEvidence, type ReviewReadiness, readPlanIssueMetadata, canonicalStage, checklistOf, readSdlcPr, readSpecEdit, sdlcConfig, sdlcReceipt, sdlcStatus, specState, SPEC_STATE_TEXT, stageDefinition, lifecycleStage, type SdlcConfig, type MergeRecord, type PlanIssueMetadata, sdlcGh, type SdlcGh, type SdlcStatus, type SpecEdit, type SpecState } from "./sdlc.ts";
 
 export type TaskAssignmentRole = "owner" | "reviewer" | "planner";
@@ -98,6 +99,10 @@ export interface TasksDeps {
   /** Host-verified existing symbols at this task's admitted completion head; never plan guesses. */
   memorySymbolNodes?: (task: Task) => MemorySymbolNodes | undefined;
   sdlc?: { config: () => SdlcConfig; gh?: SdlcGh };
+  /** #785 P1b: the per-head CI watcher's bounds; tests shorten them, the defaults are `CI_WATCH_*` in `ci-watch.ts`. */
+  ciWatch?: { deadlineMs?: number; pollMs?: number };
+  /** #785 P1c: `tasks.auto_pull`, read at each capacity release so a reload applies to the next one; absent or false pulls nothing. */
+  autoPull?: () => boolean;
   briefs?: Briefs;
   /** Screened live fail notes directly intersecting the task plan or refs; read-only advice. */
   planFails?: (task: Task) => NativeItem[];
@@ -207,6 +212,7 @@ const QUIET_EVENTS = new Set(["answer", "reviewer changed", "idle sweep", "memor
 QUIET_EVENTS.add("ready held"); // #655: the hub's note that a ready task waits for its reserved owner's WIP slot.
 QUIET_EVENTS.add("plan observed"); // Host observation does not move the task or replace completion intent.
 QUIET_EVENTS.add("planner changed"); // Planning authority does not move the execution owner or revoke its handoff.
+QUIET_EVENTS.add("shell branch bound"); // #880: the hub's host-observed branch binding (#845) is bookkeeping; it neither moves nor settles the task.
 /** The records of the `done (checking)` entry a passed check now completes: what the owner delivered then (#509a). */
 const latestPendingDeliverables = (task: Task): DeliverableRecord[] | undefined => {
   const checking = task.history.findLastIndex(entry => entry.event === "done (checking)");
@@ -354,8 +360,17 @@ export class Tasks {
   private sweepConfig: TaskSweepConfig;
   private readonly noWriteTurns = new NoWriteTurns();
   private sweeping = false;
+  /** #785 P1b: one bounded CI watcher per exact PR head, and the reviews the hub held as premature, by task id. */
+  private readonly ciWatchers: CiWatchers;
+  private readonly heldReviews = new Map<number, { head: string; reviewer: PeerId; revision: number }>();
 
   constructor(private readonly d: TasksDeps) {
+    this.ciWatchers = new CiWatchers({
+      ...d.ciWatch,
+      poll: watch => pollCi(watch, watch.head, d.sdlc?.config().requiredChecks ?? [], d.sdlc?.gh ?? sdlcGh),
+      current: watch => this.ciWatchCurrent(watch),
+      finish: (watch, outcome) => this.ciCompleted(watch, outcome),
+    });
     d.board.trackPlanRevisions = () => (d.sdlc?.config().mode ?? "off") !== "off";
     this.repositories = new TaskRepositories(d.cwd, d.repository);
     d.board.proposalPlanner = task => this.proposalPlanner(task);
@@ -1092,7 +1107,8 @@ export class Tasks {
         if (id !== undefined) change.ready.add(id);
         changes.set(planner, change);
       };
-      for (const [peer, used] of before) if (this.wip(peer) < used) for (const planner of this.taskPlanner(task)) add(planner, peer);
+      const released = new Set<PeerId>();
+      for (const [peer, used] of before) if (this.wip(peer) < used) { released.add(peer); for (const planner of this.taskPlanner(task)) add(planner, peer); }
       if (approved) for (const card of this.d.board.list("backlog")) {
         if (card.deps?.includes(task.id) && !this.waitsFor(card).length) for (const planner of this.taskPlanner(card)) add(planner, undefined, card.id);
       }
@@ -1107,9 +1123,7 @@ export class Tasks {
         }
         const lines: string[] = [];
         for (const peer of change.capacity) {
-          const top = this.d.board.list().filter(card => ["backlog", "proposed"].includes(card.state) && !card.owner && card.reserved === peer
-            && this.taskPlanner(card).includes(planner) && !card.pinned && taskCanPlan(card) && !this.waitsFor(card).length && !this.excluded(card).includes(peer)
-            && (card.release == null || ["planning", "active"].includes(this.d.board.release(card.release)?.state ?? ""))).sort(this.readyOrder)[0];
+          const top = this.topReservedReady(peer, planner);
           lines.push(`capacity_released: ${peer} WIP ${this.wip(peer)}; reserved ready ${top ? `#${top.id}` : "none"}`);
         }
         for (const id of change.ready) {
@@ -1121,9 +1135,54 @@ export class Tasks {
         const env = newEnvelope(HUB, sanitize(`Planner work ready:\n${lines.join("\n")}\nRead the current board before planning or pulling work.`), { to: [planner], kind: "task" });
         if (!this.d.bus.publish(env).includes(planner)) throw new Error("the notice was not queued");
       });
+      // #785 P1c: only this write's own release, never a merged earlier one, and only when the person turned it on.
+      if (this.d.autoPull?.() === true) this.queueAutoPulls(released);
     });
   }
 
+  /** The top card explicitly reserved for `peer` that this planner may pull now; the notice and the opt-in pull read the same rule. `pullable` keeps the staged backlog cards only. */
+  private topReservedReady(peer: PeerId, planner?: PeerId, pullable = false): Task | undefined {
+    return this.d.board.list().filter(card => (pullable ? card.state === "backlog" : ["backlog", "proposed"].includes(card.state)) && !card.owner && card.reserved === peer
+      && (planner === undefined || this.taskPlanner(card).includes(planner)) && !(pullable && this.isPii(card)) && !card.pinned && taskCanPlan(card) && !this.waitsFor(card).length && !this.excluded(card).includes(peer)
+      && (card.release == null || ["planning", "active"].includes(this.d.board.release(card.release)?.state ?? ""))).sort(this.readyOrder)[0];
+  }
+
+  /**
+   * #785 P1c: `tasks.auto_pull`. A slot freed for a peer pulls the one top backlog card explicitly reserved for it, through `pullPlanned` as the hub acting for that card's planner of
+   * record: revision, dependency, reservation, pinned, frozen-release, P0 order and WIP checks all run there unchanged. One card per release. Never an unreserved card, never PII.
+   * Serialized on one chain, so two releases cannot pick the same card; each job re-reads the board, so a card that moved meanwhile is skipped.
+   */
+  private autoPulls: Promise<void> = Promise.resolve();
+  private autoPullsOpen = 0;
+  /** Queued or running auto pulls, so a recovery commit waits for them the way it waits for `checksPending` (#785 P1c): one that is mid-admission would otherwise write after the commit's digest. */
+  autoPullsPending = (): number => this.autoPullsOpen;
+  private queueAutoPulls(released: ReadonlySet<PeerId>): void {
+    for (const peer of released) {
+      this.autoPullsOpen++;
+      this.autoPulls = this.autoPulls.then(() => this.autoPull(peer)).catch(() => { /* autoPull reports its own refusals */ }).finally(() => { this.autoPullsOpen--; });
+    }
+  }
+  /** Whether the hub may still start work on its own: the setting is on, and no recovery, shutdown or storage hold is active. Read at entry and again right before the assignment write. */
+  private autoPullAdmitted(): boolean {
+    return this.d.autoPull?.() === true && !this.d.sweepHeld?.() && !this.d.bus.isRecoveryHeld && !this.d.bus.storageError;
+  }
+  private async autoPull(peer: PeerId): Promise<void> {
+    if (!this.autoPullAdmitted()) return;
+    const card = this.topReservedReady(peer, undefined, true);
+    if (!card) return;
+    // The planner of record is the card's own: its bound planner, else the first current holder, and it must be rostered. A private card never gets here (topReservedReady skips it).
+    const planner = this.taskPlanner(card)[0];
+    if (!planner || !this.d.bus.isRostered(planner)) return;
+    const reason = `auto_pull: capacity released for ${peer}; hub acted for planner ${planner}`;
+    try {
+      await this.pullPlanned(HUB, { id: card.id, revision: card.planningRevision ?? 0, reason }, { onBehalfOf: planner, guard: () => { if (!this.autoPullAdmitted()) throw new PreEffectToolRefusal("auto pull is no longer admitted: tasks.auto_pull was turned off or a recovery, shutdown or storage hold began"); } });
+    } catch (e) {
+      // A guard refusal is the setting or a hold doing its job, not a failure to report.
+      if (!this.autoPullAdmitted()) return;
+      this.releaseNotice(`task ${this.publicTitle(card)}: auto_pull for ${peer} refused: ${e instanceof Error ? e.message : String(e)}`);
+    }
+  }
+
   /** #784 AC3: the read-only breakdown of `wip` for status, the console and the dashboard: one grouped query for every peer. Admission still reads `wip()`. */
   wipBreakdown(peers: readonly PeerId[]): Record<string, { wip: number; active: number; reviewWait: number; reserved: number; wipLimit: number }> {
     const grouped = this.d.board.plannerWipBreakdown();
@@ -1165,15 +1224,20 @@ export class Tasks {
     return assign({ ...task, state: "proposed" }, states, routing, { exclude: this.excluded(task), excludeOwners: full, ...(reservedOnly && task.reserved ? { candidates: [task.reserved], namedOwner: task.reserved } : {}), waitsFor: this.waitsFor(task), ...this.weights(task.class, task) });
   }
 
-  async pullPlanned(by: PeerId, input: { id: number; revision: number; reason: string }): Promise<Task> {
+  async pullPlanned(by: PeerId, input: { id: number; revision: number; reason: string }, opts: { onBehalfOf?: PeerId; guard?: () => void } = {}): Promise<Task> {
     // #455: one authority check, made before the screen and again after it (a person may move the planner meanwhile).
-    const authorized = () => this.planningAuthority(by);
+    // #785 P1c: `by` is the actor the history records; the hub's opt-in auto pull names the planner it acts for, and that planner's authority is what is checked.
+    if (opts.onBehalfOf !== undefined && by !== HUB) throw new PreEffectToolRefusal("only the hub pulls on a planner's behalf");
+    const planner = opts.onBehalfOf ?? by;
+    // `opts.guard` (the auto pull's own admission, #785 P1c) throws a PreEffectToolRefusal once the pull is no longer wanted; it runs wherever authority is rechecked, so it
+    // also runs after the awaited PII screen and right before the assignment write, where a setting turned off or a recovery that began meanwhile must still stop it.
+    const authorized = () => { this.planningAuthority(planner); opts.guard?.(); };
     authorized();
     if (!Number.isSafeInteger(input.id) || input.id <= 0 || !Number.isSafeInteger(input.revision) || input.revision < 0 || typeof input.reason !== "string" || !input.reason.trim() || input.reason.length > 1000) throw new PreEffectToolRefusal("planner pull needs an id, revision and bounded reason");
     const validate = () => {
       const task = this.d.board.get(input.id);
       if (!task || (task.planningRevision ?? 0) !== input.revision || task.state !== "backlog" || task.owner || !taskCanPlan(task) || task.pinned) throw new PreEffectToolRefusal("planner pull changed, pinned or already started");
-      this.planningAuthority(by, task);
+      this.planningAuthority(planner, task);
       const release = task.release == null ? undefined : this.d.board.release(task.release);
       if (task.release != null && (!release || ["frozen", "shipped", "dropped"].includes(release.state))) throw new PreEffectToolRefusal("planner pull requires unfrozen release scope");
       if (this.waitsFor(task).length) throw new PreEffectToolRefusal("planner pull waits for dependency approval");
@@ -1207,6 +1271,7 @@ export class Tasks {
           if (checked.task.history.length !== current.task.history.length || checked.owner !== current.owner) throw new PreEffectToolRefusal("planner pull changed during admission");
         } } });
     }
+    opts.guard?.();
     const pulled = this.d.board.pullPlanned(current.task.id, by, current.owner, input.revision, input.reason.trim(), withheld, this.plannerBinding(current.task, current.assignment, true));
     this.planningRecorded({ by, task: pulled.id, fields: ["pull", "reserved"], revision: pulled.planningRevision! });
     return pulled;
@@ -2705,6 +2770,7 @@ export class Tasks {
     if (task.history.length !== revision) throw new PreEffectToolRefusal("task flow revision changed");
     const cancelled = { reason: input.reason.trim(), ...(input.supersededBy ? { supersededBy: input.supersededBy.trim() } : {}), flowRevision: revision + 1, ...(withheld ? { withheld: true as const } : {}) };
     const capacity = this.capacityBefore(task);
+    this.ciWatchers.cancel(task.id); this.heldReviews.delete(task.id);
     const next = this.d.board.update(task.id, by, "cancelled", { state: "cancelled", reserved: null, cancelled }, cancelled.reason, { ...(withheld ? { withheld: true as const } : {}) }, revision);
     this.writePlannerNotices(next, capacity);
     this.releaseNotice(`task #${task.id}: cancellation cohort cleanup unavailable`, () => this.cohorts.leave(task.id));
@@ -4139,6 +4205,7 @@ export class Tasks {
     const capacity = this.capacityBefore(task);
     const next = this.d.board.update(task.id, by, "done", { codeSymbols: this.observedCodeSymbols({ ...task, refs: { ...task.refs, ...completedRefs } }), state: reviewer ? "in_review" : "approved", ...(selection ? { reviewer: reviewer ?? USER } : {}), ...(task.sdlc ? { sdlc: { ...task.sdlc, stage: lifecycleStage(this.d.sdlc?.config() ?? sdlcConfig(undefined), reviewer ? "review" : "merge") } } : {}), refs: completedRefs }, checkOutput ? `${routedSummary ?? ""}\n${checkOutput}`.trim() : routedSummary, { ...this.planObservation(task), withheld: withheld || undefined, ...(noWrites ? { noWrites: true as const } : {}), ...this.reviewMetadata(selection), ...(reviewCost ? { reviewCost } : {}), ...(records ? { deliverables: records } : {}) }, task.history.length, HOST_CODE_SYMBOLS);
     this.writePlannerNotices(next, capacity, next.state === "approved");
+    this.ciWatchers.cancel(next.id); this.heldReviews.delete(next.id); // a newer head or a move ends the old head's watcher (#785 P1b)
     this.cohorts.closed(next.id); // its owner's next native turn end settles it in its cohort (issue #107)
     const memorySymbols = this.completionMemorySymbols(next);
     this.note(next, by, "finding", `Task #${next.id} done by ${by}: ${next.title}\nChanged-symbol memory anchors: ${memorySymbols.state === "known" ? memorySymbols.nodes.length : "unknown (no complete code facts)"}\n${summary ?? ""}`, withheld, memorySymbols);
@@ -4151,6 +4218,7 @@ export class Tasks {
     }
     else if (reviewer === USER) this.releaseNotice(`task ${this.publicTitle(next)} done by ${by}: review it in the ahub console (Tasks, select #${next.id}, press r) or with ahub review ${next.id} approved|changes_requested [note]`);
     else this.releaseNotice(`task ${this.publicTitle(next)}: could not send the review request to ${reviewer}`, () => this.sendReview(next, reviewer, "", admission));
+    if (reviewer && !(admission?.ready && admission.head === this.reviewHead(next))) this.watchCi(next);
     return next;
   }
 
@@ -4316,6 +4384,7 @@ export class Tasks {
     if (mode === "enforce" && !admission?.ready) {
       // Background roster/quota role changes are retained, but never invent a remotely admitted review request.
       this.releaseNotice(`task ${this.publicTitle(task)}: premature review held; retry the reviewer assignment after current CI and bot replies are verified`);
+      this.holdReview(task, reviewer);
       return false;
     }
 
@@ -4395,6 +4464,67 @@ export class Tasks {
     return this.d.bus.publish(newEnvelope(HUB, body, { to: [reviewer], kind: "review", priority: "important", refs: { ...r, ...(this.reviewHead(task) ? { commit: this.reviewHead(task)! } : {}), task: String(task.id), reviewRevision: String(this.reviewRequestRevision(task)) }, ...(this.isPii(task) ? { private: true } : {}) })).includes(reviewer);
   }
 
+  /** #785 P1b: remember a review the hub held as premature, so a green CI at this exact head can re-offer it once. Also watches that head. */
+  private holdReview(task: Task, reviewer: PeerId): void {
+    try {
+      const head = this.reviewHead(task);
+      if (this.isPii(task) || !head || reviewer === USER) return;
+      this.heldReviews.set(task.id, { head, reviewer, revision: this.reviewRequestRevision(task) });
+      this.watchCi(task);
+    } catch { /* optional bookkeeping never fails a review path */ }
+  }
+
+  /** #785 P1b AC3: start the one watcher for this task's exact head. Not for private work, an unlinked PR or a lifecycle that is off; never throws. */
+  private watchCi(task: Task): void {
+    try {
+      const head = this.reviewHead(task), repo = task.sdlc?.repo, pr = task.sdlc?.pr;
+      if (!this.d.sdlc || this.d.sdlc.config().mode === "off" || this.isPii(task) || task.state !== "in_review" || !head || !/^[0-9a-f]{40}$/.test(head) || !repo || !pr) return;
+      this.ciWatchers.start({ id: task.id, head, repo, pr });
+    } catch { /* a watcher that cannot start leaves the review path as it was */ }
+  }
+
+  /** The watcher's own check before every read and every notice: the task must still be in review at this exact head and PR. */
+  private ciWatchCurrent(watch: CiWatch): boolean {
+    const task = this.d.board.get(watch.id);
+    return !!task && task.state === "in_review" && !this.isPii(task) && this.reviewHead(task) === watch.head && task.sdlc?.repo === watch.repo && task.sdlc?.pr === watch.pr
+      && (this.d.sdlc?.config().mode ?? "off") !== "off";
+  }
+
+  /**
+   * #785 P1b: the result of the exact head's CI, told once to the owner and the reviewer (one ids-only task envelope each, `status` weight: `fyi` is recorded but never delivered to the peer),
+   * then a review held as premature is offered once more after a fresh readiness read. A deadline tells the console only.
+   */
+  private async ciCompleted(watch: CiWatch, outcome: CiOutcome): Promise<void> {
+    const task = this.d.board.get(watch.id);
+    if (!task || !this.ciWatchCurrent(watch)) return;
+    const label = `#${task.id} head ${watch.head.slice(0, 12)}`;
+    if (outcome === "deadline") { this.releaseNotice(`task ${label}: CI did not finish within the watch deadline; no further reads`); return; }
+    const line = `ci_completed: ${label} ${outcome}`;
+    for (const peer of new Set([task.owner, task.reviewer])) {
+      if (!peer || peer === HUB) continue;
+      if (peer === USER) { this.releaseNotice(`task ${label}: CI ${outcome} at its exact head`); continue; }
+      this.releaseNotice(`task ${label}: could not tell ${peer} the CI result`, () => this.d.bus.publish(newEnvelope(HUB, `${line}\nRead hub_task_show for the task before acting.`, { to: [peer], kind: "task", priority: "status", refs: { task: String(task.id), commit: watch.head } })));
+    }
+    if (outcome === "failed") return;
+    await this.reofferHeldReview(task, watch);
+  }
+
+  /** The held review of this exact head and request, once: only while it is still the same reviewer, head and revision, and a fresh admission says it is ready. */
+  private async reofferHeldReview(task: Task, watch: CiWatch): Promise<void> {
+    const held = this.heldReviews.get(task.id);
+    if (!held || held.head !== watch.head || task.reviewer !== held.reviewer || this.reviewRequestRevision(task) !== held.revision) return;
+    this.heldReviews.delete(task.id); // once: a later hold needs a new head or a new request
+    try {
+      const admission = await this.reviewRequestAdmission(task, undefined, false, task.owner ?? USER);
+      const current = this.d.board.get(task.id);
+      if (!admission?.ready || !current || !this.ciWatchCurrent(watch) || current.reviewer !== held.reviewer || this.reviewRequestRevision(current) !== held.revision) return;
+      this.releaseNotice(`task ${this.publicTitle(current)}: could not re-offer the held review to ${held.reviewer}`, () => this.sendReview(current, held.reviewer, "(Held earlier because exact-head CI was not green; it is green now.)", admission));
+    } catch { /* still not ready: the hold notice already named why; a reviewer reassignment retries it */ }
+  }
+
+  /** Daemon shutdown: no watcher outlives the hub. */
+  stopCiWatchers(): void { this.ciWatchers.stopAll(); this.heldReviews.clear(); }
+
   private reviewRequestRevision(task: Task): number {
     // Role changes fence older requests; bookkeeping appended after the request does not.
     return task.history.findLastIndex(entry => ["done", "reviewer changed", "reviewer unavailable"].includes(entry.event) || OWNERSHIP_EVENTS.has(entry.event)) + 1;
@@ -4643,6 +4773,7 @@ export class Tasks {
     const flag = { ...this.planObservation(task), withheld: withheld || undefined, ...(report ? { reviewFindings: report } : {}), ...(unmetCriteria.length ? { unmetCriteria } : {}), ...(boundDeliverables ? { deliverables: boundDeliverables } : {}), ...(reviewContext ? { reviewContext } : {}), ...(codeScope ? { reviewScope: "code" as const } : {}), ...(evidenceOnly ? { evidenceOnly: true as const } : {}), ...(reviewerFamily ? { reviewerFamily } : {}), ...(reviewerReason ? { reviewerReason } : {}) };
     if (verdict === "approved") {
       const capacity = this.capacityBefore(task);
+      this.ciWatchers.cancel(task.id); this.heldReviews.delete(task.id);
       const next = this.d.board.update(task.id, by, "approved", { state: "approved", rejections: 0, ...(reviewedHead && task.sdlc ? { sdlc: { ...task.sdlc, reviewedHead, stage: lifecycleStage(this.d.sdlc?.config() ?? sdlcConfig(undefined), "merge") } } : {}) }, note, flag);
       this.writePlannerNotices(next, capacity, next.state === "approved");
       if (next.owner) {
@@ -4663,6 +4794,7 @@ export class Tasks {
       this.releaseNotice(`task #${next.id}: review saved but recurring-finding proposal unavailable`, () => this.proposeRecurringFindings(next, by, parsed, withheld));
       return next;
     }
+    this.ciWatchers.cancel(task.id); this.heldReviews.delete(task.id);
     const rejected = this.d.board.update(task.id, by, "changes_requested", { state: "changes_requested", rejections: evidenceOnly ? task.rejections : task.rejections + 1 }, note, flag);
     void this.mirrorVerdict(rejected, by, "changes_requested", reviewedHead ?? rejected.sdlc?.reviewedHead, note, withheld);
     if (!evidenceOnly) this.releaseNotice(`task #${rejected.id}: review saved but recurring-finding proposal unavailable`, () => this.proposeRecurringFindings(rejected, by, parsed, withheld));

package/src/local/deny.ts

@@ -163,6 +163,27 @@ export function hubWriteRegexes(root: string, gitDirs: string[] = [], moduleGit:
   ];
 }
 
+/**
+ * Full SBPL rule lines for the shared object store `<common>/objects` (#864). Every checkout of the repository, and the hub's own host add/commit/push (#845), trusts what is
+ * there without rehashing it, so a sandboxed command may only ADD loose objects: `git add` and `git commit` keep working, and git skips writing an object that exists. Refused:
+ * every write under `objects/info` (alternates, http-alternates, commit-graph) and `objects/pack` (a new pack wins over a loose copy of the same id, since git reads packs
+ * first); the `objects`, `objects/info` and `objects/pack` entries themselves (no rename, replace or removal); removing or renaming a fan-out directory; and changing,
+ * removing, chmod-ing or renaming over an existing loose object. The cost: `git gc`, `git repack`, `git fetch`, `git maintenance` and `git commit-graph write` do not run in
+ * the sandbox. A hardlink to an existing loose object is refused under these rules (verified, into the project and into the command's own temp dir). Residual: an object id
+ * that does not exist yet can be planted before git writes it (the attacker must predict its exact content); a local checkout shows it, a push of it is rejected by the
+ * receiving side's rehash. Seatbelt ignores `{n}`
+ * repeats, so the two fan-out hex digits are written out (verified with the real sandbox-exec).
+ */
+export function objectStoreRules(common: string): string[] {
+  const objects = `${common}/objects`, o = sbplEscape(objects);
+  const re = (s: string) => `(regex ${sbplString(s)})`;
+  return [
+    `(deny file-write* (subpath ${sbplString(`${objects}/info`)}) (subpath ${sbplString(`${objects}/pack`)}) ${[objects, `${objects}/info`, `${objects}/pack`].map((p) => `(literal ${sbplString(p)})`).join(" ")})`,
+    `(deny file-write-unlink ${re(`^${o}/[0-9a-f][0-9a-f]$`)})`,
+    `(deny file-write-data file-write-unlink file-write-mode file-write-flags ${re(`^${o}/[0-9a-f][0-9a-f]/[0-9a-f]+$`)})`,
+  ];
+}
+
 /**
  * Seatbelt regex filters equivalent to isDenied. Seatbelt sees absolute paths, so the `local.deny` substrings are
  * anchored under the project root: a bare "private/" would otherwise match /private/var/... and deny the whole temp tree.

package/src/local/sandbox.ts

@@ -4,7 +4,7 @@ import { homedir, tmpdir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { realPath } from "../hub/project.ts";
 import { hubGitSync } from "../hub/git.ts";
-import { denyRegexes, hubWriteRegexes, sbplString } from "./deny.ts";
+import { denyRegexes, hubWriteRegexes, objectStoreRules, sbplString } from "./deny.ts";
 
 const SANDBOX_EXEC = "/usr/bin/sandbox-exec";
 export const OUTPUT_CAP = 20_000;
@@ -184,6 +184,8 @@ export function profile(cwd: string, network: SandboxNetwork, readAllow: string[
     // .git/modules/ are refused at the depth submodules nest (#281), and the external git dirs get folded
     // hooks/config rules (#270). The cost: git init, clone and worktree add no longer run inside the sandbox.
     `(deny file-write* ${hubWriteRegexes(root, gitDirs, moduleGit, worktrees).join(" ")})`,
+    // The shared object store: only new loose objects may be added (#864).
+    ...(worktrees ? objectStoreRules(dirname(worktrees)) : []),
     `(deny file-read* file-write* ${creds.map((c) => `(subpath ${q(join(home, c))})`).join(" ")})`,
     `(deny file-read* file-write* ${denyRegexes(root, deny).join(" ")})`,
     // Python's own CA bundle (certifi, which pip vendors too): pip, requests and httpx read it instead of the system's (#64).