@veris-ai/daytona-opencode 0.1.0

package/.opencode/plugin/daytona/git/host-git-manager.ts

@@ -0,0 +1,372 @@
+/**
+ * Copyright Daytona Platforms Inc.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { logger } from '../core/logger'
+import { spawnSync } from 'child_process'
+import { realpathSync } from 'fs'
+import { isAbsolute, resolve as pathResolve } from 'path'
+
+type ExecResult = {
+  ok: boolean
+  stdout: string
+  stderr: string
+  status: number | null
+}
+
+type ExecOptions = {
+  cwd?: string
+  env?: NodeJS.ProcessEnv
+}
+
+// Runs git with an explicit argument vector and no shell, so interpolated values
+// (SSH URLs, refs, remote names) can never be interpreted as shell syntax.
+function execGit(args: string[], options: ExecOptions = {}): ExecResult {
+  const res = spawnSync('git', args, {
+    stdio: ['ignore', 'pipe', 'pipe'],
+    encoding: 'utf8',
+    ...options,
+  })
+  if (res.error) {
+    return { ok: false, stdout: '', stderr: res.error.message, status: null }
+  }
+  const status = typeof res.status === 'number' ? res.status : null
+  return { ok: status === 0, stdout: res.stdout ?? '', stderr: res.stderr ?? '', status }
+}
+
+// POSIX sh single-quoting (close, escape, reopen): GIT_SSH_COMMAND is parsed by the
+// shell, so an unquoted known_hosts path containing spaces would split into ssh args.
+function shellQuote(value: string): string {
+  return `'${value.replace(/'/g, `'\\''`)}'`
+}
+
+// When DAYTONA_SSH_KNOWN_HOSTS names a known_hosts file with the ssh.app.daytona.io
+// host keys, pin host verification to it for sandbox git transfers. This lets the
+// first noninteractive sync succeed without trust-on-first-use, and without changing
+// SSH behavior for any other remote. Unset means inherited SSH behavior, as before.
+//
+// The value crosses two parsers. sh splits GIT_SSH_COMMAND into ssh's argv (outer
+// single quotes), then OpenSSH splits the UserKnownHostsFile VALUE on whitespace as
+// a file list (inner double quotes keep a spaced path as one file). OpenSSH's config
+// grammar has no escape for a literal double quote inside a quoted value, so such
+// paths are rejected instead of being silently mis-pinned.
+function networkEnv(): NodeJS.ProcessEnv | undefined {
+  const knownHosts = process.env.DAYTONA_SSH_KNOWN_HOSTS?.trim()
+  if (!knownHosts) return undefined
+  if (knownHosts.includes('"')) {
+    throw new Error('DAYTONA_SSH_KNOWN_HOSTS must not contain a double quote (") character')
+  }
+  return {
+    ...process.env,
+    // GlobalKnownHostsFile=/dev/null: otherwise a matching entry in the system-wide
+    // /etc/ssh/ssh_known_hosts would also be accepted and verification would not be
+    // pinned to the configured file alone.
+    GIT_SSH_COMMAND: `ssh -o ${shellQuote(`UserKnownHostsFile="${knownHosts}"`)} -o GlobalKnownHostsFile=/dev/null -o StrictHostKeyChecking=yes`,
+  }
+}
+
+export class HostGitManager {
+  // Per-repo serialization: one queue per git-common-dir. Linked worktrees (git worktree
+  // add) of the same repo share `.git/config` and refs, so they must share a queue to
+  // avoid racing on `remote add/remove` and `.git/config.lock`. Different repos still
+  // proceed in parallel.
+  private static operationQueues = new Map<string, Promise<void>>()
+
+  // cwd → queue-key cache. `git rev-parse --git-common-dir` shells out; caching avoids
+  // running it on every enqueue. Repo layout doesn't move at runtime, so this is stable.
+  private static queueKeyCache = new Map<string, string>()
+
+  /**
+   * Resolve the serialization key for a worktree: the CANONICAL absolute path of its
+   * shared git dir (common across linked worktrees of the same repo). Canonicalizing
+   * with realpath collapses symlinked aliases onto the same key, so two callers
+   * reaching the same repo via different symlink paths still share a queue and can't
+   * race on `.git/config`. Falls back to (canonical) cwd if git can't identify a repo.
+   */
+  private static queueKeyFor(cwd: string): string {
+    const cached = HostGitManager.queueKeyCache.get(cwd)
+    if (cached) return cached
+    const res = execGit(['rev-parse', '--git-common-dir'], { cwd })
+    const rawPath = !res.ok
+      ? cwd
+      : (() => {
+          const out = res.stdout.trim()
+          return isAbsolute(out) ? out : pathResolve(cwd, out)
+        })()
+    let key: string
+    try {
+      key = realpathSync(rawPath)
+    } catch {
+      // Path may have been deleted between git resolution and our stat; use as-is
+      key = rawPath
+    }
+    HostGitManager.queueKeyCache.set(cwd, key)
+    return key
+  }
+
+  /**
+   * Chain `fn` onto the queue for the repo containing `cwd`. The stored promise is
+   * always-resolves so a failure doesn't poison the chain; callers still see errors via
+   * `await` on the returned promise. Cleared from the map when the tail settles to avoid
+   * leaking entries for repos that are no longer active.
+   */
+  private static enqueue<T>(cwd: string, fn: () => Promise<T>): Promise<T> {
+    const queueKey = HostGitManager.queueKeyFor(cwd)
+    const prev = HostGitManager.operationQueues.get(queueKey) ?? Promise.resolve()
+    const operation = prev.then(fn)
+    const stored: Promise<void> = operation.then(
+      () => undefined,
+      () => undefined,
+    )
+    HostGitManager.operationQueues.set(queueKey, stored)
+    stored.then(() => {
+      if (HostGitManager.operationQueues.get(queueKey) === stored) {
+        HostGitManager.operationQueues.delete(queueKey)
+      }
+    })
+    return operation
+  }
+
+  /** Cached OID of an empty commit used to reserve branch refs (branches must point at commits, not blobs). */
+  private emptyCommitOidCache = new Map<string, string>()
+
+  /**
+   * Checks if a git repository exists in the current directory
+   * @returns true if a git repo exists, false otherwise
+   */
+  hasRepo(cwd?: string): boolean {
+    return execGit(['rev-parse', '--is-inside-work-tree'], cwd ? { cwd } : {}).ok
+  }
+
+  /**
+   * Allocates the next available opencode/N branch number by scanning local refs and
+   * reserving the chosen number by creating the ref immediately.
+   *
+   * This avoids relying on OpenCode's project ID and works even in repos with no commits.
+   */
+  allocateAndReserveBranchNumber(cwd: string, prefix = 'opencode'): number {
+    const start = Date.now()
+    if (!this.hasRepo(cwd)) {
+      throw new Error('No local git repository found.')
+    }
+
+    const base = `refs/heads/${prefix}/`
+    const listRes = execGit(['for-each-ref', '--format=%(refname:strip=3)', base], { cwd })
+    if (!listRes.ok) throw new Error(listRes.stderr)
+    const list = listRes.stdout.trim()
+    const nums =
+      list.length === 0
+        ? []
+        : list
+            .split('\n')
+            .map((s) => s.trim())
+            .filter(Boolean)
+            .map((s) => Number.parseInt(s, 10))
+            .filter((n) => Number.isFinite(n) && n > 0)
+
+    let n = (nums.length ? Math.max(...nums) : 0) + 1
+    const maxAttempts = 50 // Circuit-breaker
+    let attempts = 0
+    while (n < 1_000_000 && attempts < maxAttempts) {
+      attempts++
+      const ref = `${base}${n}`
+      if (this.refExists(cwd, ref)) {
+        n++
+        continue
+      }
+      const oid = this.getOrCreateEmptyCommitOid(cwd)
+      const result = execGit(['update-ref', ref, oid], { cwd })
+      if (result.ok) {
+        logger.info(`[branch-alloc] reserved ${prefix}/${n} in ${Date.now() - start}ms`)
+        return n
+      } else {
+        // If we raced or hit an edge case, try the next number.
+        n++
+      }
+    }
+    const oid = this.getOrCreateEmptyCommitOid(cwd)
+    const last = execGit(['update-ref', `${base}${n}`, oid], { cwd })
+    if (last.ok) {
+      logger.info(`[branch-alloc] reserved ${prefix}/${n} in ${Date.now() - start}ms`)
+      return n
+    }
+    throw new Error(`Failed to allocate branch number after ${attempts} attempts. Last error: ${last.stderr}`)
+  }
+
+  private refExists(cwd: string, ref: string): boolean {
+    return execGit(['show-ref', '--verify', '--quiet', ref], { cwd }).ok
+  }
+
+  /** Commit OID a local ref points at, or '' if the ref does not exist. */
+  getRefOid(cwd: string, ref: string): string {
+    const res = execGit(['rev-parse', '--verify', '--quiet', ref], { cwd })
+    return res.ok ? res.stdout.trim() : ''
+  }
+
+  /**
+   * Returns a commit OID that branch refs can point at. Uses HEAD if the repo has commits,
+   * otherwise creates and caches an empty commit (empty tree + commit). Branch refs must
+   * point at commits, not blobs.
+   */
+  private getOrCreateEmptyCommitOid(cwd: string): string {
+    const cached = this.emptyCommitOidCache.get(cwd)
+    if (cached) return cached
+    const headRes = execGit(['rev-parse', 'HEAD'], { cwd })
+    const head = headRes.ok ? headRes.stdout.trim() : ''
+    if (head) {
+      this.emptyCommitOidCache.set(cwd, head)
+      return head
+    }
+
+    // Create an empty tree (idempotent) then a commit pointing at it.
+    const treeResult = spawnSync('git', ['hash-object', '-t', 'tree', '-w', '--stdin'], {
+      input: '',
+      cwd,
+      encoding: 'utf8',
+    })
+    const treeOid = treeResult.stdout?.trim()
+    if (treeResult.status !== 0 || !treeOid) {
+      const errorMsg =
+        treeResult.stderr?.toString() || treeResult.error?.message || String(treeResult.error || 'unknown')
+      throw new Error(`Failed to create empty tree: ${errorMsg}`)
+    }
+
+    // Provide a default identity for reservation commits when repo has no user.name/user.email (e.g. CI).
+    const reservationCommitName = 'OpenCode Plugin'
+    const reservationCommitEmail = 'opencode@daytona.io'
+    const reservationCommitMessage = 'OpenCode reservation'
+    const commitEnv = {
+      ...process.env,
+      GIT_AUTHOR_NAME: reservationCommitName,
+      GIT_AUTHOR_EMAIL: reservationCommitEmail,
+      GIT_COMMITTER_NAME: reservationCommitName,
+      GIT_COMMITTER_EMAIL: reservationCommitEmail,
+    }
+
+    const commitRes = execGit(['commit-tree', treeOid, '-m', reservationCommitMessage], { cwd, env: commitEnv })
+    if (!commitRes.ok) throw new Error(`Failed to create empty commit: ${commitRes.stderr}`)
+    const commitOid = commitRes.stdout.trim()
+    this.emptyCommitOidCache.set(cwd, commitOid)
+    return commitOid
+  }
+
+  /**
+   * Pushes local changes to the sandbox remote.
+   * @param remoteName Numbered remote (e.g. sandbox-2) matching opencode/N.
+   * @param sshUrl The SSH URL of the sandbox remote.
+   * @param branch The branch to push to.
+   * @param cwd Worktree path to run git in.
+   * @returns true if push succeeded, false if no repo exists. Throws if the push fails.
+   */
+  async pushLocalToSandboxRemote(remoteName: string, sshUrl: string, branch: string, cwd: string): Promise<boolean> {
+    if (!this.hasRepo(cwd)) {
+      logger.warn('No local git repository found. Skipping push to sandbox.')
+      return false
+    }
+    logger.info(`Pushing to ${remoteName} (${sshUrl}) on branch ${branch}`)
+    await HostGitManager.enqueue(cwd, async () => {
+      const statusRes = execGit(['status', '--porcelain'], { cwd })
+      if (!statusRes.ok) {
+        throw new Error(statusRes.stderr)
+      }
+      if (statusRes.stdout.trim().length > 0) {
+        logger.warn('Local repository has uncommitted changes; pushing HEAD only (no auto-commit).')
+      }
+
+      this.setRemote(remoteName, sshUrl, cwd)
+      let attempts = 0
+      while (attempts < 3) {
+        const pushRes = execGit(['push', remoteName, `HEAD:${branch}`], { cwd, env: networkEnv() })
+        if (pushRes.ok) {
+          logger.info(`✓ Pushed local changes to ${remoteName}`)
+          return
+        }
+        attempts++
+        if (attempts >= 3) {
+          logger.error(`Error pushing to ${remoteName} after 3 attempts: ${pushRes.stderr}`)
+          throw new Error(pushRes.stderr)
+        }
+        logger.warn(`Push attempt ${attempts} failed, retrying...`)
+      }
+    })
+    return true
+  }
+
+  private setRemote(remoteName: string, sshUrl: string, cwd: string): void {
+    // Remote may not exist yet — ignore this result. `remote add` below is the check that matters.
+    execGit(['remote', 'remove', remoteName], { cwd })
+    const addRes = execGit(['remote', 'add', remoteName, sshUrl], { cwd })
+    if (!addRes.ok) {
+      throw new Error(`Failed to configure sandbox remote '${remoteName}': ${addRes.stderr}`)
+    }
+  }
+
+  async pull(remoteName: string, sshUrl: string, branch: string, cwd: string, localBranch?: string): Promise<void> {
+    await HostGitManager.enqueue(cwd, async () => {
+      this.setRemote(remoteName, sshUrl, cwd)
+      let attempts = 0
+      let lastError: unknown = undefined
+      // The first pull attempt sometimes fails. I'm not sure what the cause is.
+      while (attempts < 3) {
+        try {
+          if (localBranch) {
+            // Fetch into FETCH_HEAD only (never into refs/heads) so we don't hit
+            // "refusing to fetch into branch checked out" when this branch is checked out.
+            const fetchRes = execGit(['fetch', remoteName, branch], { cwd, env: networkEnv() })
+            if (!fetchRes.ok) throw new Error(fetchRes.stderr)
+
+            const updateRefRes = execGit(['update-ref', `refs/heads/${localBranch}`, 'FETCH_HEAD'], { cwd })
+            if (!updateRefRes.ok) throw new Error(updateRefRes.stderr)
+
+            // Only reset working directory if we're currently on this branch
+            const currentBranchRes = execGit(['rev-parse', '--abbrev-ref', 'HEAD'], { cwd })
+            const currentBranch = currentBranchRes.ok ? currentBranchRes.stdout.trim() : ''
+            if (currentBranch === localBranch) {
+              const resetRes = execGit(['reset', '--hard', `refs/heads/${localBranch}`], { cwd })
+              if (!resetRes.ok) throw new Error(resetRes.stderr)
+            }
+
+            logger.info(`✓ Force pulled latest changes from sandbox into ${localBranch}`)
+          } else {
+            const pullRes = execGit(['pull', remoteName, branch], { cwd, env: networkEnv() })
+            if (!pullRes.ok) throw new Error(pullRes.stderr)
+            logger.info('✓ Pulled latest changes from sandbox')
+          }
+          return
+        } catch (e) {
+          lastError = e
+          attempts++
+          if (attempts >= 3) {
+            logger.error(`Error pulling from sandbox after 3 attempts: ${e}`)
+          } else {
+            logger.warn(`Pull attempt ${attempts} failed, retrying...`)
+          }
+        }
+      }
+
+      // If we got here, all attempts failed.
+      throw lastError ?? new Error('Pull failed after 3 attempts')
+    })
+  }
+
+  async push(remoteName: string, sshUrl: string, branch: string, cwd: string): Promise<void> {
+    await HostGitManager.enqueue(cwd, async () => {
+      this.setRemote(remoteName, sshUrl, cwd)
+      let attempts = 0
+      while (attempts < 3) {
+        const pushRes = execGit(['push', remoteName, `HEAD:${branch}`], { cwd, env: networkEnv() })
+        if (pushRes.ok) {
+          logger.info('✓ Pushed changes to sandbox')
+          return
+        }
+        attempts++
+        if (attempts >= 3) {
+          logger.error(`Error pushing to sandbox after 3 attempts: ${pushRes.stderr}`)
+          throw new Error(pushRes.stderr)
+        }
+        logger.warn(`Push attempt ${attempts} failed, retrying...`)
+      }
+    })
+  }
+}

package/.opencode/plugin/daytona/git/index.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Copyright Daytona Platforms Inc.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export { SessionGitManager } from './session-git-manager';

package/.opencode/plugin/daytona/git/index.js

@@ -0,0 +1,6 @@
+/**
+ * Copyright Daytona Platforms Inc.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export { SessionGitManager } from './session-git-manager';
+//# sourceMappingURL=index.js.map

package/.opencode/plugin/daytona/git/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA"}

package/.opencode/plugin/daytona/git/index.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Daytona Platforms Inc.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+export { SessionGitManager } from './session-git-manager'

package/.opencode/plugin/daytona/git/sandbox-git-manager.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Copyright Daytona Platforms Inc.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { Sandbox } from '@daytona/sdk';
+export declare class DaytonaSandboxGitManager {
+    private readonly sandbox;
+    private readonly repoPath;
+    constructor(sandbox: Sandbox, repoPath: string);
+    ensureDirectory(): Promise<void>;
+    private runGitCommand;
+    ensureRepo(): Promise<void>;
+    autoCommit(): Promise<boolean>;
+    getCurrentBranch(): Promise<string>;
+    /**
+     * Commit OID of the sandbox HEAD, or '' on an unborn branch (no commits yet).
+     * Any other git failure throws: callers use '' as "nothing to pull", and the delete
+     * path acts on it, so a masked error here could destroy unsynced commits.
+     */
+    getHeadOid(): Promise<string>;
+    resetToRemote(branch: string): Promise<void>;
+}

package/.opencode/plugin/daytona/git/sandbox-git-manager.js

@@ -0,0 +1,80 @@
+/**
+ * Copyright Daytona Platforms Inc.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { logger } from '../core/logger';
+export class DaytonaSandboxGitManager {
+    sandbox;
+    repoPath;
+    constructor(sandbox, repoPath) {
+        this.sandbox = sandbox;
+        this.repoPath = repoPath;
+    }
+    async ensureDirectory() {
+        await this.sandbox.fs.createFolder(this.repoPath, '755');
+    }
+    async runGitCommand(command) {
+        const result = await this.sandbox.process.executeCommand(command, this.repoPath);
+        const output = result.result.trim();
+        if (result.exitCode !== undefined && result.exitCode !== 0) {
+            const installHint = output.includes('git: command not found')
+                ? '\nHint: git is not installed in this sandbox. Rebuild the sandbox image with git installed.'
+                : '';
+            throw new Error(`Git command failed: ${command}\nOutput: ${output || '(no output)'}${installHint}`);
+        }
+        return result.result;
+    }
+    async ensureRepo() {
+        await this.ensureDirectory();
+        const isGit = await this.runGitCommand('if [ -e .git ]; then git rev-parse --is-inside-work-tree; else echo false; fi');
+        if (isGit.trim() !== 'true') {
+            await this.runGitCommand('git init');
+            await this.runGitCommand('git config user.email "sandbox@example.com"');
+            await this.runGitCommand('git config user.name "Daytona Sandbox"');
+            logger.info(`Initialized git repo in sandbox at ${this.repoPath}`);
+        }
+    }
+    async autoCommit() {
+        // Check if there are any changes to commit
+        const status = await this.runGitCommand('git status --porcelain');
+        if (!status.trim()) {
+            logger.info(`No changes to commit in sandbox at ${this.repoPath}`);
+            return false;
+        }
+        await this.runGitCommand('git add .');
+        await this.runGitCommand('git commit -am "Auto-commit from Daytona plugin"');
+        logger.info(`Auto-committed changes in sandbox at ${this.repoPath}`);
+        return true;
+    }
+    async getCurrentBranch() {
+        const branch = await this.runGitCommand('git rev-parse --abbrev-ref HEAD');
+        return branch.trim();
+    }
+    /**
+     * Commit OID of the sandbox HEAD, or '' on an unborn branch (no commits yet).
+     * Any other git failure throws: callers use '' as "nothing to pull", and the delete
+     * path acts on it, so a masked error here could destroy unsynced commits.
+     */
+    async getHeadOid() {
+        const out = await this.runGitCommand('if oid=$(git rev-parse --verify --quiet HEAD); then echo "$oid"; else git rev-parse --is-inside-work-tree > /dev/null && echo UNBORN; fi');
+        const trimmed = out.trim();
+        return trimmed === 'UNBORN' ? '' : trimmed;
+    }
+    async resetToRemote(branch) {
+        // Check out the branch the host just pushed. Using -f (not -B) checks out the
+        // pushed commit instead of resetting the branch ref to the sandbox's current HEAD.
+        const checkout = await this.runGitCommand(`git checkout -f ${branch}`);
+        logger.info(`Checked out branch '${branch}': ${checkout}`);
+        await this.runGitCommand('git reset --hard');
+        await this.runGitCommand('git clean -fd');
+        logger.info('Reset sandbox worktree to pushed state.');
+        const status = await this.runGitCommand('git status --porcelain');
+        if (status.trim()) {
+            logger.warn(`Sandbox has uncommitted changes after reset:\n${status}`);
+        }
+        else {
+            logger.info('No uncommitted changes in sandbox after reset.');
+        }
+    }
+}
+//# sourceMappingURL=sandbox-git-manager.js.map

package/.opencode/plugin/daytona/git/sandbox-git-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-git-manager.js","sourceRoot":"","sources":["sandbox-git-manager.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAEvC,MAAM,OAAO,wBAAwB;IAEhB;IACA;IAFnB,YACmB,OAAgB,EAChB,QAAgB;QADhB,YAAO,GAAP,OAAO,CAAS;QAChB,aAAQ,GAAR,QAAQ,CAAQ;IAChC,CAAC;IAEJ,KAAK,CAAC,eAAe;QACnB,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;IAC1D,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,OAAe;QACzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAA;QAChF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAA;QAEnC,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC3D,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,wBAAwB,CAAC;gBAC3D,CAAC,CAAC,6FAA6F;gBAC/F,CAAC,CAAC,EAAE,CAAA;YACN,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,aAAa,MAAM,IAAI,aAAa,GAAG,WAAW,EAAE,CAAC,CAAA;QACrG,CAAC;QAED,OAAO,MAAM,CAAC,MAAM,CAAA;IACtB,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,IAAI,CAAC,eAAe,EAAE,CAAA;QAC5B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CACpC,+EAA+E,CAChF,CAAA;QACD,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;YAC5B,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,CAAA;YACpC,MAAM,IAAI,CAAC,aAAa,CAAC,6CAA6C,CAAC,CAAA;YACvE,MAAM,IAAI,CAAC,aAAa,CAAC,wCAAwC,CAAC,CAAA;YAClE,MAAM,CAAC,IAAI,CAAC,sCAAsC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;QACpE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU;QACd,2CAA2C;QAC3C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,wBAAwB,CAAC,CAAA;QACjE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,sCAAsC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;YAClE,OAAO,KAAK,CAAA;QACd,CAAC;QACD,MAAM,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAA;QACrC,MAAM,IAAI,CAAC,aAAa,CAAC,kDAAkD,CAAC,CAAA;QAC5E,MAAM,CAAC,IAAI,CAAC,wCAAwC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;QACpE,OAAO,IAAI,CAAA;IACb,CAAC;IAED,KAAK,CAAC,gBAAgB;QACpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,iCAAiC,CAAC,CAAA;QAC1E,OAAO,MAAM,CAAC,IAAI,EAAE,CAAA;IACtB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU;QACd,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAClC,0IAA0I,CAC3I,CAAA;QACD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAA;QAC1B,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAA;IAC5C,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,MAAc;QAChC,8EAA8E;QAC9E,mFAAmF;QACnF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,mBAAmB,MAAM,EAAE,CAAC,CAAA;QACtE,MAAM,CAAC,IAAI,CAAC,uBAAuB,MAAM,MAAM,QAAQ,EAAE,CAAC,CAAA;QAC1D,MAAM,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC,CAAA;QAC5C,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,CAAA;QACzC,MAAM,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAA;QACtD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,wBAAwB,CAAC,CAAA;QACjE,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YAClB,MAAM,CAAC,IAAI,CAAC,iDAAiD,MAAM,EAAE,CAAC,CAAA;QACxE,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAA;QAC/D,CAAC;IACH,CAAC;CACF"}

package/.opencode/plugin/daytona/git/sandbox-git-manager.ts

@@ -0,0 +1,92 @@
+/**
+ * Copyright Daytona Platforms Inc.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import type { Sandbox } from '@daytona/sdk'
+import { logger } from '../core/logger'
+
+export class DaytonaSandboxGitManager {
+  constructor(
+    private readonly sandbox: Sandbox,
+    private readonly repoPath: string,
+  ) {}
+
+  async ensureDirectory(): Promise<void> {
+    await this.sandbox.fs.createFolder(this.repoPath, '755')
+  }
+
+  private async runGitCommand(command: string): Promise<string> {
+    const result = await this.sandbox.process.executeCommand(command, this.repoPath)
+    const output = result.result.trim()
+
+    if (result.exitCode !== undefined && result.exitCode !== 0) {
+      const installHint = output.includes('git: command not found')
+        ? '\nHint: git is not installed in this sandbox. Rebuild the sandbox image with git installed.'
+        : ''
+      throw new Error(`Git command failed: ${command}\nOutput: ${output || '(no output)'}${installHint}`)
+    }
+
+    return result.result
+  }
+
+  async ensureRepo(): Promise<void> {
+    await this.ensureDirectory()
+    const isGit = await this.runGitCommand(
+      'if [ -e .git ]; then git rev-parse --is-inside-work-tree; else echo false; fi',
+    )
+    if (isGit.trim() !== 'true') {
+      await this.runGitCommand('git init')
+      await this.runGitCommand('git config user.email "sandbox@example.com"')
+      await this.runGitCommand('git config user.name "Daytona Sandbox"')
+      logger.info(`Initialized git repo in sandbox at ${this.repoPath}`)
+    }
+  }
+
+  async autoCommit(): Promise<boolean> {
+    // Check if there are any changes to commit
+    const status = await this.runGitCommand('git status --porcelain')
+    if (!status.trim()) {
+      logger.info(`No changes to commit in sandbox at ${this.repoPath}`)
+      return false
+    }
+    await this.runGitCommand('git add .')
+    await this.runGitCommand('git commit -am "Auto-commit from Daytona plugin"')
+    logger.info(`Auto-committed changes in sandbox at ${this.repoPath}`)
+    return true
+  }
+
+  async getCurrentBranch(): Promise<string> {
+    const branch = await this.runGitCommand('git rev-parse --abbrev-ref HEAD')
+    return branch.trim()
+  }
+
+  /**
+   * Commit OID of the sandbox HEAD, or '' on an unborn branch (no commits yet).
+   * Any other git failure throws: callers use '' as "nothing to pull", and the delete
+   * path acts on it, so a masked error here could destroy unsynced commits.
+   */
+  async getHeadOid(): Promise<string> {
+    const out = await this.runGitCommand(
+      'if oid=$(git rev-parse --verify --quiet HEAD); then echo "$oid"; else git rev-parse --is-inside-work-tree > /dev/null && echo UNBORN; fi',
+    )
+    const trimmed = out.trim()
+    return trimmed === 'UNBORN' ? '' : trimmed
+  }
+
+  async resetToRemote(branch: string): Promise<void> {
+    // Check out the branch the host just pushed. Using -f (not -B) checks out the
+    // pushed commit instead of resetting the branch ref to the sandbox's current HEAD.
+    const checkout = await this.runGitCommand(`git checkout -f ${branch}`)
+    logger.info(`Checked out branch '${branch}': ${checkout}`)
+    await this.runGitCommand('git reset --hard')
+    await this.runGitCommand('git clean -fd')
+    logger.info('Reset sandbox worktree to pushed state.')
+    const status = await this.runGitCommand('git status --porcelain')
+    if (status.trim()) {
+      logger.warn(`Sandbox has uncommitted changes after reset:\n${status}`)
+    } else {
+      logger.info('No uncommitted changes in sandbox after reset.')
+    }
+  }
+}

package/.opencode/plugin/daytona/git/session-git-manager.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Copyright Daytona Platforms Inc.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { Sandbox } from '@daytona/sdk';
+import type { PluginInput } from '@opencode-ai/plugin';
+/**
+ * SessionGitManager: Combines DaytonaSandboxGitManager and HostGitManager for session lifecycle git operations.
+ */
+export declare class SessionGitManager {
+    private readonly sandboxGit;
+    private readonly hostGit;
+    private readonly sandbox;
+    private readonly repoPath;
+    private readonly worktree;
+    private readonly branch;
+    private readonly localBranch;
+    /** Numbered remote (sandbox-2) matches localBranch (opencode/2) */
+    private readonly remoteName;
+    constructor(sandbox: Sandbox, repoPath: string, worktree: string, branchNumber: number);
+    /**
+     * Allocate and reserve the next opencode/N number in the local repo at `worktree`.
+     * This keeps all host-git concerns inside the git manager layer.
+     */
+    static allocateAndReserveBranchNumber(worktree: string, prefix?: string): number;
+    private static pendingSyncs;
+    /**
+     * Run `fn` after any in-flight sync for this session and track it until it settles.
+     * The caller of this invocation sees failures; waiters only observe completion.
+     */
+    static enqueueSessionSync<T>(sessionId: string, fn: () => Promise<T>): Promise<T>;
+    /** Resolves when the session has no in-flight sync. Never rejects. */
+    static waitForPendingSync(sessionId: string): Promise<void>;
+    /**
+     * Resolves when no session has an in-flight sync, or when `timeoutMs` elapses first
+     * (returns false in that case). Never rejects. The bound exists for shutdown, where a
+     * sync stalled on an unreachable sandbox must not wedge process exit; the delete path
+     * intentionally waits unbounded instead, because deleting mid-sync loses data.
+     */
+    static waitForAllPendingSyncs(timeoutMs?: number): Promise<boolean>;
+    private getSshUrl;
+    hasLocalRepo(): boolean;
+    /**
+     * Initialize git in the sandbox and sync with host
+     * Used when a new sandbox is created for a session
+     */
+    initializeAndSync(pluginCtx?: PluginInput): Promise<void>;
+    /**
+     * Auto-commit in the sandbox and pull latest from host
+     * Used on session idle
+     * Returns true if changes were synced, false if no changes or no local repo
+     */
+    autoCommitAndPull(pluginCtx?: PluginInput): Promise<boolean>;
+}