@testchimp/cli 0.1.76 → 0.1.78

package/dist/chimphands/run.js

@@ -6,6 +6,7 @@
 import { execSync, spawn } from "node:child_process";
 import { mkdirSync, openSync, writeFileSync } from "node:fs";
 import fs from "node:fs/promises";
+import { tmpdir } from "node:os";
 import path from "node:path";
 import http from "node:http";
 import https from "node:https";
@@ -15,6 +16,9 @@ import { isChimphandsLlmRetryEnabled, startLlmRetryProxy } from "./llmRetryProxy
 import { midTurnSteeringKey, releaseUnansweredMidTurnMessages, } from "./midTurnSteering.js";
 import { runSteeringSidecarReply } from "./steeringSidecar.js";
 import { ensureAgentSessionBranch, ensurePullRequest, isAgentBranchName, isPrOnlyMode, resolveSessionBaseBranch, runGit, } from "./agentBranch.js";
+import { isChimpHandsInternalCommitPath, resolveCommitPaths, } from "./worktreeCommitPaths.js";
+/** Runner logs live outside the git worktree so they never enter commit status. */
+const OPENCODE_SERVER_LOG_PATH = path.join(tmpdir(), "chimphands-opencode-server.log");
 const ROLE_ASSISTANT = "CHIMPHANDS_MESSAGE_ROLE_ASSISTANT";
 const ROLE_TOOL = "CHIMPHANDS_MESSAGE_ROLE_TOOL";
 const ROLE_REASONING = "CHIMPHANDS_MESSAGE_ROLE_REASONING";
@@ -98,7 +102,7 @@ const CHIMPHANDS_AGENT_PROMPT = `You are ChimpHands, TestChimp's coding agent. Y
 
 ## CI runner hygiene (GitHub Actions)
 - On hosted runners: load skill \`references/chimphands-ci-runner.md\` before compile, Docker builds, or large installs.
-- Never \`git fetch origin\` (full fetch) — shallow single-branch fetch only; branch names are in \`.chimphands/remote-branch-names.txt\`.
+- Never \`git fetch origin\` (full fetch) — shallow single-branch fetch only; branch names are in \`/tmp/chimphands/remote-branch-names.txt\` (or \`$CHIMPHANDS_REMOTE_BRANCH_NAMES\`).
 - Reclaim disk between heavy phases (\`docker builder prune -af\` after image builds, stop compile daemons, delete temp/test artifacts). One reclaim+retry on ENOSPC — no blind loops.
 
 ## Honesty
@@ -1101,6 +1105,10 @@ function writeOpencodeConfig(backend, apiKey, boot, llmBaseOverride) {
         TESTCHIMP_EXECUTION_SOURCE: "CLOUD_AGENT",
         CHIMPHANDS_UI_ATTACHED: uiAttached ? "true" : "false",
     };
+    if (sessionId) {
+        mcpEnv.SESSION_ID = sessionId;
+        mcpEnv.CHIMPHANDS_SESSION_ID = sessionId;
+    }
     const serviceUserId = bootStr(boot, "chimphands_service_account_user_id", "chimphandsServiceAccountUserId");
     if (serviceUserId) {
         mcpEnv.TESTCHIMP_USER_ID = serviceUserId;
@@ -1312,7 +1320,7 @@ async function restartLocalOpencodeServer(attachUrl) {
     const port = u.port || (u.protocol === "https:" ? "443" : "80");
     killListenersOnPort(port);
     await sleep(300);
-    const logFd = openSync("opencode-server.log", "a");
+    const logFd = openSync(OPENCODE_SERVER_LOG_PATH, "a");
     const child = spawn("opencode", ["serve", "--port", port, "--hostname", hostname], {
         detached: true,
         stdio: ["ignore", logFd, logFd],
@@ -1327,6 +1335,7 @@ async function restartLocalOpencodeServer(attachUrl) {
             /* best effort */
         }
     }
+    console.error(`ChimpHands opencode serve log: ${OPENCODE_SERVER_LOG_PATH}`);
     console.error(`ChimpHands restarted OpenCode serve on ${hostname}:${port} (pid ${child.pid ?? "?"})`);
     await waitForOpencodeHttp(attachUrl, 60_000);
 }
@@ -1627,8 +1636,13 @@ async function ackWorktreeFileWrite(backend, apiKey, sessionId, requestId, ok, e
         requestId,
         ok,
     };
-    if (errorMessage)
-        body.errorMessage = errorMessage.slice(0, 2000);
+    if (errorMessage) {
+        body.errorMessage = errorMessage
+            .replace(/[\r\n\t]+/g, " ")
+            .replace(/ +/g, " ")
+            .trim()
+            .slice(0, 2000);
+    }
     await postJson(backend, apiKey, "/api/chimphands/ack_worktree_file_write", body).catch((err) => {
         console.error(`ChimpHands ack_worktree_file_write failed: ${err instanceof Error ? err.message : String(err)}`);
     });
@@ -1651,7 +1665,9 @@ async function applyUserFileEdit(backend, apiKey, sessionId, edit, turnActive) {
             await ackWorktreeFileWrite(backend, apiKey, sessionId, edit.requestId, true);
             return;
         }
-        const pushed = await commitAndPushDirtyWorktree("User Update");
+        const pushed = await commitAndPushDirtyWorktree("User Update", {
+            paths: [relative],
+        });
         if (!pushed.ok) {
             await ackWorktreeFileWrite(backend, apiKey, sessionId, edit.requestId, false, pushed.error || "commit/push failed");
             return;
@@ -2180,6 +2196,8 @@ export async function runChimphands(opts) {
         TESTCHIMP_API_KEY: apiKey,
         TESTCHIMP_BACKEND_URL: backend,
         TESTCHIMP_EXECUTION_SOURCE: "CLOUD_AGENT",
+        SESSION_ID: sessionId,
+        CHIMPHANDS_SESSION_ID: sessionId,
     };
     if (userId)
         childEnv.TESTCHIMP_USER_ID = userId;
@@ -2509,41 +2527,15 @@ function startRuntimeHeartbeat(backend, apiKey, runtimeId, onUiAttached) {
         stopped = true;
     };
 }
-/** Paths ChimpHands writes on the runner — never commit into the agent branch. */
-const CHIMPHANDS_COMMIT_EXCLUDE_PATHSPECS = [
-    ":(exclude)opencode.json",
-    ":(exclude)opencode-server.log",
-    ":(exclude)chimphands-run.log",
-    ":(exclude)remote-branches.txt",
-    ":(exclude)remote-branch-names.txt",
-    ":(exclude)gha-creds*",
-    ":(exclude)**/gha-creds*",
-    ":(exclude).chimphands",
-    ":(exclude).chimphands/**",
-    ":(exclude).agents",
-    ":(exclude).agents/**",
-];
-function isChimpHandsInternalCommitPath(filePath) {
-    let normalized = filePath.replace(/\\/g, "/").toLowerCase();
-    while (normalized.startsWith("./"))
-        normalized = normalized.slice(2);
-    const slash = normalized.lastIndexOf("/");
-    const name = slash >= 0 ? normalized.slice(slash + 1) : normalized;
-    if (name === "opencode.json" ||
-        name === "opencode-server.log" ||
-        name === "chimphands-run.log" ||
-        name === "remote-branches.txt" ||
-        name === "remote-branch-names.txt" ||
-        name.startsWith("gha-creds")) {
-        return true;
-    }
-    return (normalized === ".chimphands" ||
-        normalized.startsWith(".chimphands/") ||
-        normalized === ".agents" ||
-        normalized.startsWith(".agents/"));
-}
-/** Commit+push dirty worktree on the session agent branch before idle/teardown. */
-async function commitAndPushDirtyWorktree(message) {
+/**
+ * Commit+push product changes on the session agent branch.
+ *
+ * Policy: allowlist staging from `git status` (never `git add -A` / exclude pathspecs).
+ * Runner scaffolding is filtered out; anything already staged by the agent that is
+ * scaffolding is unstaged before commit. Session logs are written under os.tmpdir(),
+ * not the worktree.
+ */
+async function commitAndPushDirtyWorktree(message, opts) {
     const run = (args, env) => runGit(args, env);
     try {
         const branch = await run(["rev-parse", "--abbrev-ref", "HEAD"]);
@@ -2567,35 +2559,16 @@ async function commitAndPushDirtyWorktree(message) {
             console.error(`ChimpHands git status failed: ${error}`);
             return { ok: false, error };
         }
-        if (!status.out.trim()) {
-            return { ok: true };
-        }
-        const add = await run([
-            "add",
-            "-A",
-            "--",
-            ".",
-            ...CHIMPHANDS_COMMIT_EXCLUDE_PATHSPECS,
-        ]);
-        if (add.code !== 0) {
-            const error = add.err || add.out || "git add failed";
-            console.error(`ChimpHands git add failed: ${error}`);
-            return { ok: false, error };
+        const toStage = resolveCommitPaths(status.out, opts?.paths);
+        if (toStage.length) {
+            const add = await run(["add", "--", ...toStage]);
+            if (add.code !== 0) {
+                const error = add.err || add.out || "git add failed";
+                console.error(`ChimpHands git add failed: ${error}`);
+                return { ok: false, error };
+            }
         }
-        // Drop already-tracked scaffolding that may still be staged from older commits.
-        await run([
-            "reset",
-            "-q",
-            "HEAD",
-            "--",
-            "opencode.json",
-            "opencode-server.log",
-            "chimphands-run.log",
-            "remote-branches.txt",
-            "remote-branch-names.txt",
-            ".chimphands",
-            ".agents",
-        ]);
+        // Drop scaffolding the agent may have staged (git add -A, etc.).
         const staged = await run(["diff", "--cached", "--name-only"]);
         if (staged.code !== 0) {
             const error = staged.err || staged.out || "git diff --cached failed";
@@ -2611,7 +2584,13 @@ async function commitAndPushDirtyWorktree(message) {
             await run(["reset", "-q", "HEAD", "--", ...internalStaged]);
         }
         const keepStaged = stagedPaths.filter((p) => !isChimpHandsInternalCommitPath(p));
-        if (!keepStaged.length) {
+        const pathScoped = !!opts?.paths?.length;
+        if (pathScoped) {
+            if (!toStage.length) {
+                return { ok: true };
+            }
+        }
+        else if (!keepStaged.length) {
             return { ok: true };
         }
         const commitEnv = {
@@ -2620,7 +2599,30 @@ async function commitAndPushDirtyWorktree(message) {
             GIT_COMMITTER_NAME: process.env.GIT_COMMITTER_NAME || "ChimpHands",
             GIT_COMMITTER_EMAIL: process.env.GIT_COMMITTER_EMAIL || "chimphands@testchimp.io",
         };
-        const commit = await run(["-c", "user.name=ChimpHands", "-c", "user.email=chimphands@testchimp.io", "commit", "-m", message], commitEnv);
+        // Pathspec form is `git commit --only` — commits just those paths even if
+        // the index has other staged product files.
+        const commitArgs = pathScoped
+            ? [
+                "-c",
+                "user.name=ChimpHands",
+                "-c",
+                "user.email=chimphands@testchimp.io",
+                "commit",
+                "-m",
+                message,
+                "--",
+                ...toStage,
+            ]
+            : [
+                "-c",
+                "user.name=ChimpHands",
+                "-c",
+                "user.email=chimphands@testchimp.io",
+                "commit",
+                "-m",
+                message,
+            ];
+        const commit = await run(commitArgs, commitEnv);
         if (commit.code !== 0) {
             const error = commit.err || commit.out || "git commit failed";
             console.error(`ChimpHands git commit: ${error}`);

package/dist/chimphands/worktreeCommitPaths.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Paths that must not be committed on the agent branch.
+ *
+ * Worktree-resident (needed at runtime, never product):
+ * - opencode.json, .agents/**
+ *
+ * Legacy / accidental worktree pollution (now written under /tmp when possible):
+ * - *.log runner logs, .chimphands/**, remote-branch*.txt, gha-creds*
+ */
+export declare function isChimpHandsInternalCommitPath(filePath: string): boolean;
+/** Parse paths from `git status --porcelain` (newline form, not -z). */
+export declare function pathsFromGitPorcelain(porcelain: string): string[];
+/** Dirty worktree paths that are eligible to commit on the agent branch. */
+export declare function commitCandidatePathsFromPorcelain(porcelain: string): string[];
+export declare function normalizeWorktreePath(filePath: string): string;
+/** Intersect status candidates with an optional path allowlist (e.g. a single UI save). */
+export declare function resolveCommitPaths(porcelain: string, onlyPaths?: string[]): string[];

package/dist/chimphands/worktreeCommitPaths.js

@@ -0,0 +1,72 @@
+/**
+ * Paths that must not be committed on the agent branch.
+ *
+ * Worktree-resident (needed at runtime, never product):
+ * - opencode.json, .agents/**
+ *
+ * Legacy / accidental worktree pollution (now written under /tmp when possible):
+ * - *.log runner logs, .chimphands/**, remote-branch*.txt, gha-creds*
+ */
+export function isChimpHandsInternalCommitPath(filePath) {
+    let normalized = filePath.replace(/\\/g, "/").toLowerCase();
+    while (normalized.startsWith("./"))
+        normalized = normalized.slice(2);
+    const slash = normalized.lastIndexOf("/");
+    const name = slash >= 0 ? normalized.slice(slash + 1) : normalized;
+    if (name === "opencode.json" ||
+        name === "opencode-server.log" ||
+        name === "chimphands-run.log" ||
+        name === "remote-branches.txt" ||
+        name === "remote-branch-names.txt" ||
+        name.startsWith("gha-creds")) {
+        return true;
+    }
+    return (normalized === ".chimphands" ||
+        normalized.startsWith(".chimphands/") ||
+        normalized === ".agents" ||
+        normalized.startsWith(".agents/"));
+}
+/** Parse paths from `git status --porcelain` (newline form, not -z). */
+export function pathsFromGitPorcelain(porcelain) {
+    const paths = [];
+    for (const raw of porcelain.split("\n")) {
+        if (!raw || raw.length < 4)
+            continue;
+        let body = raw.slice(3);
+        if (body.includes(" -> ")) {
+            body = body.slice(body.lastIndexOf(" -> ") + 4);
+        }
+        if (body.startsWith('"') && body.endsWith('"')) {
+            body = body
+                .slice(1, -1)
+                .replace(/\\([\\"nt])/g, (_m, c) => {
+                if (c === "n")
+                    return "\n";
+                if (c === "t")
+                    return "\t";
+                return c;
+            });
+        }
+        if (body)
+            paths.push(body);
+    }
+    return paths;
+}
+/** Dirty worktree paths that are eligible to commit on the agent branch. */
+export function commitCandidatePathsFromPorcelain(porcelain) {
+    return pathsFromGitPorcelain(porcelain).filter((p) => !isChimpHandsInternalCommitPath(p));
+}
+export function normalizeWorktreePath(filePath) {
+    let normalized = filePath.replace(/\\/g, "/");
+    while (normalized.startsWith("./"))
+        normalized = normalized.slice(2);
+    return normalized;
+}
+/** Intersect status candidates with an optional path allowlist (e.g. a single UI save). */
+export function resolveCommitPaths(porcelain, onlyPaths) {
+    const candidates = commitCandidatePathsFromPorcelain(porcelain);
+    if (!onlyPaths?.length)
+        return candidates;
+    const want = new Set(onlyPaths.map(normalizeWorktreePath));
+    return candidates.filter((p) => want.has(normalizeWorktreePath(p)));
+}

package/dist/chimphands/worktreeCommitPaths.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/chimphands/worktreeCommitPaths.test.js

@@ -0,0 +1,28 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import { commitCandidatePathsFromPorcelain, isChimpHandsInternalCommitPath, pathsFromGitPorcelain, resolveCommitPaths, } from "./worktreeCommitPaths.js";
+describe("worktreeCommitPaths", () => {
+    it("parses porcelain paths and rename destinations", () => {
+        assert.deepEqual(pathsFromGitPorcelain([" M ui/plans/foo.md", "?? chimphands-run.log", "R  old.md -> new.md"].join("\n")), ["ui/plans/foo.md", "chimphands-run.log", "new.md"]);
+    });
+    it("allowlists only product paths for commit", () => {
+        assert.deepEqual(commitCandidatePathsFromPorcelain([
+            " M ui/plans/stories/x.md",
+            "?? chimphands-run.log",
+            "?? opencode-server.log",
+            "?? opencode.json",
+            " M src/app.ts",
+            "?? .agents/skills/testchimp/SKILL.md",
+        ].join("\n")), ["ui/plans/stories/x.md", "src/app.ts"]);
+    });
+    it("can narrow commit to an explicit path set", () => {
+        const porcelain = [" M ui/plans/a.md", " M src/app.ts"].join("\n");
+        assert.deepEqual(resolveCommitPaths(porcelain, ["ui/plans/a.md"]), ["ui/plans/a.md"]);
+        assert.deepEqual(resolveCommitPaths(porcelain), ["ui/plans/a.md", "src/app.ts"]);
+    });
+    it("recognizes internal commit paths", () => {
+        assert.equal(isChimpHandsInternalCommitPath("chimphands-run.log"), true);
+        assert.equal(isChimpHandsInternalCommitPath(".chimphands/tmp"), true);
+        assert.equal(isChimpHandsInternalCommitPath("ui/plans/x.md"), false);
+    });
+});

package/dist/core/tools.js

@@ -1045,8 +1045,13 @@ export const TOOL_DEFINITIONS = [
         inputSchema: S.reportAgentActionInput,
         execute: async (args, { postMcp }) => {
             const a = args;
-            const actorRaw = (a.actorType ?? "local-agent").toString();
-            const actorType = actorRaw.toUpperCase().replace(/-/g, "_") === "CLOUD_AGENT" ? "CLOUD_AGENT" : "LOCAL_AGENT";
+            const sessionId = (process.env.SESSION_ID ||
+                process.env.CHIMPHANDS_SESSION_ID ||
+                "").trim();
+            const actorRaw = (a.actorType ?? (sessionId ? "cloud-agent" : "local-agent")).toString();
+            const actorType = actorRaw.toUpperCase().replace(/-/g, "_") === "CLOUD_AGENT" || sessionId
+                ? "CLOUD_AGENT"
+                : "LOCAL_AGENT";
             const actionNorm = a.actionType.toString().toUpperCase().replace(/-/g, "_");
             let actionType = actionNorm;
             if (actionNorm === "COMPLETED" || actionNorm === "ACTION_COMPLETED") {
@@ -1062,6 +1067,8 @@ export const TOOL_DEFINITIONS = [
                 actorType,
                 entityType: a.entityType,
             };
+            if (sessionId)
+                body.chimphandsSessionId = sessionId;
             if (a.policyFile)
                 body.policyFile = a.policyFile;
             if (a.policyVersion)
@@ -1071,8 +1078,10 @@ export const TOOL_DEFINITIONS = [
                 body.gitSha = gitSha;
             if (a.userId)
                 body.userId = a.userId;
-            else if (process.env.TESTCHIMP_USER_ID)
+            else if (!sessionId && process.env.TESTCHIMP_USER_ID) {
+                // ChimpHands: server resolves responsible user from SESSION_ID; do not stamp service account.
                 body.userId = process.env.TESTCHIMP_USER_ID;
+            }
             if (a.branchName)
                 body.branchName = a.branchName;
             // Nested traceability wins for agentModel / skillVersion / cliVersion;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@testchimp/cli",
-  "version": "0.1.76",
+  "version": "0.1.78",
   "description": "TestChimp CLI and MCP server — coverage, plans, EaaS, TrueCoverage, API operations (calls /api/mcp/*)",
   "type": "module",
   "main": "dist/bin/testchimp.js",
@@ -13,7 +13,7 @@
   ],
   "scripts": {
     "build": "tsc",
-    "test": "npm run build && node --test dist/chimphands/llmRetryProxy.test.js dist/chimphands/midTurnSteering.test.js dist/chimphands/steeringSidecar.test.js dist/chimphands/agentBranch.test.js",
+    "test": "npm run build && node --test dist/chimphands/llmRetryProxy.test.js dist/chimphands/midTurnSteering.test.js dist/chimphands/steeringSidecar.test.js dist/chimphands/agentBranch.test.js dist/chimphands/worktreeCommitPaths.test.js",
     "watch": "tsc --watch",
     "start": "node dist/bin/testchimp.js",
     "prepublishOnly": "npm run build"