factory-ai 1.3.0 → 1.5.0

package/src/workspace-tools.js

@@ -5,6 +5,7 @@ import { run } from "./process.js";
 
 const ALLOWED_COMMANDS = new Set(["git", "ls", "node", "npm", "npx", "pwd", "rg"]);
 const DENIED_GIT_OPERATIONS = new Set(["credential", "push", "remote"]);
+const READ_ONLY_GIT_OPERATIONS = new Set(["diff", "grep", "log", "ls-files", "rev-parse", "show", "status"]);
 
 function lexicalPath(root, requested) {
   const target = path.resolve(root, requested);
@@ -43,10 +44,11 @@ async function walk(directory, root, output, limit) {
   }
 }
 
-export function createWorkspaceTools(rootInput, { execute = run } = {}) {
+export function createWorkspaceTools(rootInput, { execute = run, mutable = true, allowTests = false } = {}) {
   const root = realpathSync(path.resolve(rootInput));
-  return {
+  const tools = {
     read_file: {
+      parallelSafe: true,
       description: "Read a bounded UTF-8 line range inside the assigned workspace. Use offsetLine/limitLines instead of rereading large files.",
       parameters: {
         type: "object",
@@ -69,6 +71,7 @@ export function createWorkspaceTools(rootInput, { execute = run } = {}) {
       },
     },
     write_file: {
+      parallelSafe: false,
       description: "Atomically replace a UTF-8 file inside the assigned workspace.",
       parameters: {
         type: "object",
@@ -86,6 +89,7 @@ export function createWorkspaceTools(rootInput, { execute = run } = {}) {
       },
     },
     list_files: {
+      parallelSafe: true,
       description: "List files recursively inside the assigned workspace.",
       parameters: {
         type: "object",
@@ -101,6 +105,7 @@ export function createWorkspaceTools(rootInput, { execute = run } = {}) {
       },
     },
     run_command: {
+      parallelSafe: false,
       description: "Run an allowlisted noninteractive development command in the assigned workspace.",
       parameters: {
         type: "object",
@@ -113,7 +118,10 @@ export function createWorkspaceTools(rootInput, { execute = run } = {}) {
       },
       execute: async ({ command, args }) => {
         if (!ALLOWED_COMMANDS.has(command)) throw new Error(`Command not allowed: ${command}`);
-        if (command === "git" && DENIED_GIT_OPERATIONS.has(args[0])) throw new Error(`Git operation not allowed: ${args[0]}`);
+        const testCommand = allowTests && ((command === "npm" && ["test", "run"].includes(args[0])) || (command === "node" && args[0] === "--test") || (command === "npx" && args[0] === "--no-install"));
+        if (!mutable && !testCommand && !["git", "ls", "pwd", "rg"].includes(command)) throw new Error(`Command not allowed for read-only role: ${command}`);
+        if (command === "git" && (args.some((item) => DENIED_GIT_OPERATIONS.has(item)) || args.some((item) => ["-c", "--config-env", "--exec-path"].includes(item)))) throw new Error("Git operation not allowed");
+        if (!mutable && command === "git" && (args[0]?.startsWith("-") || !READ_ONLY_GIT_OPERATIONS.has(args[0]))) throw new Error(`Git operation not allowed for read-only role: ${args[0]}`);
         if (command === "npx" && args[0] !== "--no-install") throw new Error("npx requires --no-install");
         const result = await execute(command, args, {
           cwd: root,
@@ -127,4 +135,6 @@ export function createWorkspaceTools(rootInput, { execute = run } = {}) {
       },
     },
   };
+  if (!mutable) delete tools.write_file;
+  return tools;
 }

package/src/workspace.js

@@ -45,10 +45,18 @@ export class WorkspaceManager {
 
   async prepareTask(objective, task, dependencyCommits = []) {
     const directory = this.taskDirectory(objective.id, task.id);
-    if (await exists(directory)) return directory;
+    const branch = `factory-ai/${objective.id}/${task.id}`;
+    if (await exists(directory)) {
+      const current = (await run("git", ["-C", directory, "branch", "--show-current"])).stdout.trim();
+      if (current !== branch) throw new Error(`Existing task workspace is on unexpected branch: ${current}`);
+      for (const commit of dependencyCommits) {
+        const ancestor = await run("git", ["-C", directory, "merge-base", "--is-ancestor", commit, "HEAD"], { allowExitCodes: [0, 1] });
+        if (ancestor.code !== 0) throw new Error(`Existing task workspace is missing dependency commit: ${commit}`);
+      }
+      return directory;
+    }
     await mkdir(path.dirname(directory), { recursive: true, mode: 0o750 });
     const base = dependencyCommits[0] ?? `origin/${objective.baseBranch}`;
-    const branch = `factory-ai/${objective.id}/${task.id}`;
     await run("git", ["clone", objective.repository, directory], { timeoutMs: this.timeoutMs });
     await run("git", ["-C", directory, "config", "user.name", "Factory AI"]);
     await run("git", ["-C", directory, "config", "user.email", "factory-ai@localhost"]);
@@ -60,6 +68,13 @@ export class WorkspaceManager {
     return directory;
   }
 
+  async recoveryContext(directory) {
+    const status = (await run("git", ["-C", directory, "status", "--short"], { maxOutputBytes: 50_000 })).stdout.trim();
+    if (!status) return "";
+    const summary = (await run("git", ["-C", directory, "diff", "--stat"], { maxOutputBytes: 50_000 })).stdout.trim();
+    return `RECOVERED DURABLE WORKTREE CHECKPOINT\nA previous attempt changed these files. Inspect and continue rather than repeating completed work.\n${status}${summary ? `\n\n${summary}` : ""}`;
+  }
+
   async checkpoint(directory, objective, task) {
     await run("git", ["-C", directory, "add", "-A"]);
     const diff = await run("git", ["-C", directory, "diff", "--cached", "--quiet"], { allowExitCodes: [0, 1] });
@@ -75,4 +90,9 @@ export class WorkspaceManager {
     return { commit, branch };
   }
 
+  async reference(directory, objective, task) {
+    const { stdout } = await run("git", ["-C", directory, "rev-parse", "HEAD"]);
+    return { commit: stdout.trim(), branch: `factory-ai/${objective.id}/${task.id}` };
+  }
+
 }

package/templates/AGENTS.md

@@ -0,0 +1,15 @@
+# Project Agent Instructions
+
+## Working Agreement
+
+- Make the smallest correct change that satisfies the objective.
+- Read existing code and tests before editing. Preserve established architecture and style.
+- Never read, print, persist, or commit credentials or local environment files.
+- Keep changes inside this repository. Do not push, deploy, or mutate external systems.
+- Add or update focused tests for behavior changes.
+- Run the project's documented format, typecheck, lint, test, and build gates before claiming completion.
+- Report commands run, results, remaining risks, and any assumptions.
+
+## Project Commands
+
+Record project-specific commands and constraints in `.agent-factory/commands.md` and `.agent-factory/project.md`.