maesttro 0.4.1 → 0.4.3

package/README.md

@@ -73,8 +73,9 @@ maesttro update                          # bump the package + rebuild image with
 
 Run `maesttro` from the root of a repository (git 2.48+ required). Each run is a
 **session** with its own isolated clone, `.worktrees/maesttro-<id>`, detached at
-`origin/<default branch>` and mounted at `/workspace`. That clone is the only
-part of the repo the container sees:
+`origin/<default branch>` and mounted at `/workspace`. The runner container is
+named `maesttro-<id>` too, so `docker ps` and `docker logs maesttro-<id>` line up
+with the session. That clone is the only part of the repo the container sees:
 
 - Your real `.git` is never mounted, and neither is your main checkout or any
   uncommitted work there. The container works in a `git clone --shared` that
@@ -188,7 +189,7 @@ Declining only skips it for that run; the next start asks again.
 |---|---|---|
 | `/home/agent` | `maesttro-home` named volume | Per-client session state. Survives across runs, lives only in Docker. Holds no GitHub credential. |
 | `/home/agent/.config/gh-maesttro` (read-only) | per-session temp dir on host | The session's GitHub token (`hosts.yml`). The CLI refreshes it before its 1 h expiry and revokes it on exit. Not mounted in `--strict` sessions, or when GitHub access is unavailable. |
-| `<repo>/.git/objects` (read-only, same absolute path) | your repo's object store | Base history, borrowed by the clone through its `alternates`. The real `.git` is never mounted. |
+| `/opt/maesttro-objects` (read-only) | your repo's `.git/objects` | Base history, borrowed by the clone through its `alternates`, which is pinned to this fixed path so it resolves the same on every host OS. The real `.git` is never mounted. |
 | `/workspace` | the session clone (`.worktrees/<id>`) | The working directory: a `git clone --shared` detached at the default branch. |
 | `/opt/maesttro`, `/opt/maesttro-host` (read-only) | this package; your instruction files | Used by `maesttro configure` at container start. |
 | `/home/agent/.claude/skills` (read-only) | `~/agent-shared/skills` on host, if present | Reusable skills/house-style files shared across sessions. Read-only. |

package/dist/maesttro.js

@@ -1279,7 +1279,7 @@ Usage:
 `;
 
 // src/launch.ts
-import { execSync as execSync3, spawn } from "node:child_process";
+import { execSync as execSync3, spawn, spawnSync as spawnSync2 } from "node:child_process";
 import { existsSync as existsSync4, rmSync as rmSync6 } from "node:fs";
 import { constants, homedir as homedir4 } from "node:os";
 import { join as join11 } from "node:path";
@@ -1611,7 +1611,10 @@ async function openGitHubSession({
     ...identityEnv(author, initial.committer)
   };
   return {
-    dockerArgs: withEnvFlags(["-v", `${dir.ghDir}:${CONTAINER_GH_CONFIG_DIR}:ro`], env),
+    dockerArgs: withEnvFlags([
+      "--mount",
+      `type=bind,source=${dir.ghDir},target=${CONTAINER_GH_CONFIG_DIR},readonly`
+    ], env),
     env,
     close: async () => {
       refresher.stop();
@@ -1642,7 +1645,8 @@ import {
   lstatSync,
   mkdirSync as mkdirSync9,
   readdirSync as readdirSync3,
-  readFileSync as readFileSync6
+  readFileSync as readFileSync6,
+  writeFileSync as writeFileSync7
 } from "node:fs";
 import { join as join9 } from "node:path";
 
@@ -1837,6 +1841,31 @@ function copyObjectFiles(fromDir, intoDir) {
     copyFileSync(join9(fromDir, entry.name), dest);
   }
 }
+function pinAlternates(clonePath, containerObjects) {
+  const gitDir = cloneGitDir(clonePath);
+  if (!gitDir)
+    return;
+  const objects = join9(gitDir, "objects");
+  const info = join9(objects, "info");
+  if (!realDir(objects) || !realDir(info)) {
+    throw new LaunchError(`Unsafe objects tree in the session clone: ${clonePath}`);
+  }
+  const alternates = join9(info, "alternates");
+  let stat;
+  try {
+    stat = lstatSync(alternates);
+  } catch {
+    return;
+  }
+  if (!stat.isFile()) {
+    throw new LaunchError(`Unsafe alternates file in the session clone: ${clonePath}`);
+  }
+  const desired = `${containerObjects}
+`;
+  if (readFileSync6(alternates, "utf8") !== desired) {
+    writeFileSync7(alternates, desired);
+  }
+}
 function importObjects(run, root, clonePath, tip) {
   const gitDir = cloneGitDir(clonePath);
   if (!gitDir)
@@ -1864,7 +1893,7 @@ import {
   readFileSync as readFileSync7,
   renameSync as renameSync4,
   rmSync as rmSync5,
-  writeFileSync as writeFileSync7
+  writeFileSync as writeFileSync8
 } from "node:fs";
 import { join as join10 } from "node:path";
 function newSessionId() {
@@ -1876,7 +1905,7 @@ function sessionsDir(home = maesttroHome()) {
 function saveSession(record, dir = sessionsDir()) {
   mkdirSync10(dir, { recursive: true, mode: 448 });
   const path = join10(dir, `${record.id}.json`);
-  writeFileSync7(`${path}.tmp`, `${JSON.stringify(record, null, 2)}
+  writeFileSync8(`${path}.tmp`, `${JSON.stringify(record, null, 2)}
 `);
   renameSync4(`${path}.tmp`, path);
 }
@@ -1929,6 +1958,7 @@ function workspaceAuthor(run, workspace) {
 // src/launch.ts
 var CONTAINER_REPO = "/workspace";
 var CONTAINER_PACKAGE = "/opt/maesttro";
+var CONTAINER_GIT_OBJECTS = "/opt/maesttro-objects";
 function resolveCommand(args) {
   const [first, ...rest] = args;
   if (first === undefined)
@@ -1951,8 +1981,8 @@ function sessionMounts({
 }) {
   const objects = join11(repoRoot, ".git", "objects");
   const mounts = [
-    { host: VOLUME, container: "/home/agent" },
-    { host: objects, container: objects, readOnly: true },
+    { host: VOLUME, container: "/home/agent", type: "volume" },
+    { host: objects, container: CONTAINER_GIT_OBJECTS, readOnly: true },
     { host: sessionDir, container: CONTAINER_REPO },
     { host: packageRoot, container: CONTAINER_PACKAGE, readOnly: true },
     ...stagedPaths.map((path) => ({
@@ -1979,16 +2009,18 @@ function dockerRunArgs({
   command,
   mounts,
   workdir,
-  extra = []
+  extra = [],
+  name
 }) {
-  const volumes = mounts.flatMap(({ host, container, readOnly }) => [
-    "-v",
-    `${host}:${container}${readOnly ? ":ro" : ""}`
+  const volumes = mounts.flatMap(({ host, container, readOnly, type = "bind" }) => [
+    "--mount",
+    `type=${type},source=${host},target=${container}${readOnly ? ",readonly" : ""}`
   ]);
   return [
     "run",
     "-it",
     "--rm",
+    ...name ? ["--name", name] : [],
     ...volumes,
     ...extra,
     "-w",
@@ -2016,6 +2048,9 @@ function ensureReady() {
     throw new LaunchError("Runner isn't set up yet. Run `maesttro setup` first.");
   }
 }
+function clearStaleContainer(id) {
+  spawnSync2("docker", ["rm", "-f", id], { stdio: "ignore" });
+}
 function sharedSkillsDir() {
   const dir = process.env.AGENT_SHARED_SKILLS ?? join11(homedir4(), "agent-shared", "skills");
   return existsSync4(dir) ? dir : undefined;
@@ -2216,10 +2251,13 @@ async function launch({
     "MAESTTRO_HOST_UID",
     "MAESTTRO_HOST_GID"
   ].concat(repo ? ["MAESTTRO_REPO"] : []).flatMap((name) => ["-e", name]);
+  clearStaleContainer(saved.id);
+  pinAlternates(saved.worktree, CONTAINER_GIT_OBJECTS);
   const child = spawn("docker", dockerRunArgs({
     command: containerCommand(resolveCommand(args)),
     mounts,
     workdir,
+    name: saved.id,
     extra: [...github.dockerArgs, ...envFlags]
   }), { stdio: "inherit", env: { ...process.env, ...sessionEnv } });
   const forward = (signal) => child.kill(signal);
@@ -2238,7 +2276,7 @@ async function launch({
 }
 
 // src/push.ts
-import { spawnSync as spawnSync2 } from "node:child_process";
+import { spawnSync as spawnSync3 } from "node:child_process";
 function pushCandidates(sessions) {
   const candidates = new Map;
   for (const session of sessions) {
@@ -2349,7 +2387,7 @@ Push? [y/N] `);
       return;
     }
   }
-  const pushed = spawnSync2("git", ["-C", root, "push", "origin", `${tip}:refs/heads/${branch}`], { stdio: "inherit" });
+  const pushed = spawnSync3("git", ["-C", root, "push", "origin", `${tip}:refs/heads/${branch}`], { stdio: "inherit" });
   if (pushed.status === 0) {
     console.log(`Pushed ${branch}. Base for comparison was ${baseSha.slice(0, 8)}.`);
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maesttro",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "description": "Isolated Docker runner for local coding agents (opencode, claude, ...) under a dedicated bot GitHub identity, with curated configs baked in per client.",
   "type": "module",
   "bin": {