maesttro 0.4.2 → 0.4.3

package/README.md

@@ -189,7 +189,7 @@ Declining only skips it for that run; the next start asks again.
 |---|---|---|
 | `/home/agent` | `maesttro-home` named volume | Per-client session state. Survives across runs, lives only in Docker. Holds no GitHub credential. |
 | `/home/agent/.config/gh-maesttro` (read-only) | per-session temp dir on host | The session's GitHub token (`hosts.yml`). The CLI refreshes it before its 1 h expiry and revokes it on exit. Not mounted in `--strict` sessions, or when GitHub access is unavailable. |
-| `<repo>/.git/objects` (read-only, same absolute path) | your repo's object store | Base history, borrowed by the clone through its `alternates`. The real `.git` is never mounted. |
+| `/opt/maesttro-objects` (read-only) | your repo's `.git/objects` | Base history, borrowed by the clone through its `alternates`, which is pinned to this fixed path so it resolves the same on every host OS. The real `.git` is never mounted. |
 | `/workspace` | the session clone (`.worktrees/<id>`) | The working directory: a `git clone --shared` detached at the default branch. |
 | `/opt/maesttro`, `/opt/maesttro-host` (read-only) | this package; your instruction files | Used by `maesttro configure` at container start. |
 | `/home/agent/.claude/skills` (read-only) | `~/agent-shared/skills` on host, if present | Reusable skills/house-style files shared across sessions. Read-only. |

package/dist/maesttro.js

@@ -1611,7 +1611,10 @@ async function openGitHubSession({
     ...identityEnv(author, initial.committer)
   };
   return {
-    dockerArgs: withEnvFlags(["-v", `${dir.ghDir}:${CONTAINER_GH_CONFIG_DIR}:ro`], env),
+    dockerArgs: withEnvFlags([
+      "--mount",
+      `type=bind,source=${dir.ghDir},target=${CONTAINER_GH_CONFIG_DIR},readonly`
+    ], env),
     env,
     close: async () => {
       refresher.stop();
@@ -1642,7 +1645,8 @@ import {
   lstatSync,
   mkdirSync as mkdirSync9,
   readdirSync as readdirSync3,
-  readFileSync as readFileSync6
+  readFileSync as readFileSync6,
+  writeFileSync as writeFileSync7
 } from "node:fs";
 import { join as join9 } from "node:path";
 
@@ -1837,6 +1841,31 @@ function copyObjectFiles(fromDir, intoDir) {
     copyFileSync(join9(fromDir, entry.name), dest);
   }
 }
+function pinAlternates(clonePath, containerObjects) {
+  const gitDir = cloneGitDir(clonePath);
+  if (!gitDir)
+    return;
+  const objects = join9(gitDir, "objects");
+  const info = join9(objects, "info");
+  if (!realDir(objects) || !realDir(info)) {
+    throw new LaunchError(`Unsafe objects tree in the session clone: ${clonePath}`);
+  }
+  const alternates = join9(info, "alternates");
+  let stat;
+  try {
+    stat = lstatSync(alternates);
+  } catch {
+    return;
+  }
+  if (!stat.isFile()) {
+    throw new LaunchError(`Unsafe alternates file in the session clone: ${clonePath}`);
+  }
+  const desired = `${containerObjects}
+`;
+  if (readFileSync6(alternates, "utf8") !== desired) {
+    writeFileSync7(alternates, desired);
+  }
+}
 function importObjects(run, root, clonePath, tip) {
   const gitDir = cloneGitDir(clonePath);
   if (!gitDir)
@@ -1864,7 +1893,7 @@ import {
   readFileSync as readFileSync7,
   renameSync as renameSync4,
   rmSync as rmSync5,
-  writeFileSync as writeFileSync7
+  writeFileSync as writeFileSync8
 } from "node:fs";
 import { join as join10 } from "node:path";
 function newSessionId() {
@@ -1876,7 +1905,7 @@ function sessionsDir(home = maesttroHome()) {
 function saveSession(record, dir = sessionsDir()) {
   mkdirSync10(dir, { recursive: true, mode: 448 });
   const path = join10(dir, `${record.id}.json`);
-  writeFileSync7(`${path}.tmp`, `${JSON.stringify(record, null, 2)}
+  writeFileSync8(`${path}.tmp`, `${JSON.stringify(record, null, 2)}
 `);
   renameSync4(`${path}.tmp`, path);
 }
@@ -1929,6 +1958,7 @@ function workspaceAuthor(run, workspace) {
 // src/launch.ts
 var CONTAINER_REPO = "/workspace";
 var CONTAINER_PACKAGE = "/opt/maesttro";
+var CONTAINER_GIT_OBJECTS = "/opt/maesttro-objects";
 function resolveCommand(args) {
   const [first, ...rest] = args;
   if (first === undefined)
@@ -1951,8 +1981,8 @@ function sessionMounts({
 }) {
   const objects = join11(repoRoot, ".git", "objects");
   const mounts = [
-    { host: VOLUME, container: "/home/agent" },
-    { host: objects, container: objects, readOnly: true },
+    { host: VOLUME, container: "/home/agent", type: "volume" },
+    { host: objects, container: CONTAINER_GIT_OBJECTS, readOnly: true },
     { host: sessionDir, container: CONTAINER_REPO },
     { host: packageRoot, container: CONTAINER_PACKAGE, readOnly: true },
     ...stagedPaths.map((path) => ({
@@ -1982,9 +2012,9 @@ function dockerRunArgs({
   extra = [],
   name
 }) {
-  const volumes = mounts.flatMap(({ host, container, readOnly }) => [
-    "-v",
-    `${host}:${container}${readOnly ? ":ro" : ""}`
+  const volumes = mounts.flatMap(({ host, container, readOnly, type = "bind" }) => [
+    "--mount",
+    `type=${type},source=${host},target=${container}${readOnly ? ",readonly" : ""}`
   ]);
   return [
     "run",
@@ -2222,6 +2252,7 @@ async function launch({
     "MAESTTRO_HOST_GID"
   ].concat(repo ? ["MAESTTRO_REPO"] : []).flatMap((name) => ["-e", name]);
   clearStaleContainer(saved.id);
+  pinAlternates(saved.worktree, CONTAINER_GIT_OBJECTS);
   const child = spawn("docker", dockerRunArgs({
     command: containerCommand(resolveCommand(args)),
     mounts,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maesttro",
-  "version": "0.4.2",
+  "version": "0.4.3",
   "description": "Isolated Docker runner for local coding agents (opencode, claude, ...) under a dedicated bot GitHub identity, with curated configs baked in per client.",
   "type": "module",
   "bin": {