maesttro 0.4.2 → 0.4.4

package/README.md

@@ -61,8 +61,11 @@ maesttro opencode                        # same, with opencode
 maesttro --strict [client]               # same, with no GitHub token in the runner (no `gh`)
 maesttro bash                            # plain shell inside the runner, for debugging
 maesttro sessions                        # list this repo's kept sessions
+maesttro sessions remove <id>            # drop one (preserves branches; --force discards unbranched commits)
+maesttro sessions remove --all           # drop all of this repo's sessions
 maesttro resume <id>                     # continue one, in the mode it started with
 maesttro push [branch]                   # push a branch a session created (shows what goes out, asks first)
+maesttro push [branch] --force           # same, as a force push
 
 maesttro update                          # bump the package + rebuild image with refreshed configs
 ```
@@ -189,7 +192,7 @@ Declining only skips it for that run; the next start asks again.
 |---|---|---|
 | `/home/agent` | `maesttro-home` named volume | Per-client session state. Survives across runs, lives only in Docker. Holds no GitHub credential. |
 | `/home/agent/.config/gh-maesttro` (read-only) | per-session temp dir on host | The session's GitHub token (`hosts.yml`). The CLI refreshes it before its 1 h expiry and revokes it on exit. Not mounted in `--strict` sessions, or when GitHub access is unavailable. |
-| `<repo>/.git/objects` (read-only, same absolute path) | your repo's object store | Base history, borrowed by the clone through its `alternates`. The real `.git` is never mounted. |
+| `/opt/maesttro-objects` (read-only) | your repo's `.git/objects` | Base history, borrowed by the clone through its `alternates`, which is pinned to this fixed path so it resolves the same on every host OS. The real `.git` is never mounted. |
 | `/workspace` | the session clone (`.worktrees/<id>`) | The working directory: a `git clone --shared` detached at the default branch. |
 | `/opt/maesttro`, `/opt/maesttro-host` (read-only) | this package; your instruction files | Used by `maesttro configure` at container start. |
 | `/home/agent/.claude/skills` (read-only) | `~/agent-shared/skills` on host, if present | Reusable skills/house-style files shared across sessions. Read-only. |

package/dist/maesttro.js

@@ -1265,8 +1265,14 @@ Usage:
                           Same, in strict mode: no GitHub token reaches the runner, so \`gh\` is off
   maesttro resume <id>     Continue a kept session in its clone, in the mode it started with
                           (\`--strict\` or \`--no-strict\` after the id changes it)
-  maesttro sessions        List this repo's sessions (\`sessions remove <id>\` to drop one)
-  maesttro push [branch]   Push a branch a session created, after showing what goes out
+  maesttro sessions        List this repo's sessions
+  maesttro sessions remove <id>
+                          Drop one. Preserves its branches; asks before discarding commits that
+                          aren't on a branch (--force skips the ask)
+  maesttro sessions remove --all
+                          Drop all of this repo's sessions
+  maesttro push [branch] [--force]
+                          Push a branch a session created, after showing what goes out
   maesttro list            Show available clients
   maesttro setup           One-time: build image, create volume, log in to GitHub
   maesttro login           Log in to GitHub (device flow) so sessions get repo access
@@ -1611,7 +1617,10 @@ async function openGitHubSession({
     ...identityEnv(author, initial.committer)
   };
   return {
-    dockerArgs: withEnvFlags(["-v", `${dir.ghDir}:${CONTAINER_GH_CONFIG_DIR}:ro`], env),
+    dockerArgs: withEnvFlags([
+      "--mount",
+      `type=bind,source=${dir.ghDir},target=${CONTAINER_GH_CONFIG_DIR},readonly`
+    ], env),
     env,
     close: async () => {
       refresher.stop();
@@ -1642,7 +1651,8 @@ import {
   lstatSync,
   mkdirSync as mkdirSync9,
   readdirSync as readdirSync3,
-  readFileSync as readFileSync6
+  readFileSync as readFileSync6,
+  writeFileSync as writeFileSync7
 } from "node:fs";
 import { join as join9 } from "node:path";
 
@@ -1837,6 +1847,31 @@ function copyObjectFiles(fromDir, intoDir) {
     copyFileSync(join9(fromDir, entry.name), dest);
   }
 }
+function pinAlternates(clonePath, containerObjects) {
+  const gitDir = cloneGitDir(clonePath);
+  if (!gitDir)
+    return;
+  const objects = join9(gitDir, "objects");
+  const info = join9(objects, "info");
+  if (!realDir(objects) || !realDir(info)) {
+    throw new LaunchError(`Unsafe objects tree in the session clone: ${clonePath}`);
+  }
+  const alternates = join9(info, "alternates");
+  let stat;
+  try {
+    stat = lstatSync(alternates);
+  } catch {
+    return;
+  }
+  if (!stat.isFile()) {
+    throw new LaunchError(`Unsafe alternates file in the session clone: ${clonePath}`);
+  }
+  const desired = `${containerObjects}
+`;
+  if (readFileSync6(alternates, "utf8") !== desired) {
+    writeFileSync7(alternates, desired);
+  }
+}
 function importObjects(run, root, clonePath, tip) {
   const gitDir = cloneGitDir(clonePath);
   if (!gitDir)
@@ -1864,7 +1899,7 @@ import {
   readFileSync as readFileSync7,
   renameSync as renameSync4,
   rmSync as rmSync5,
-  writeFileSync as writeFileSync7
+  writeFileSync as writeFileSync8
 } from "node:fs";
 import { join as join10 } from "node:path";
 function newSessionId() {
@@ -1876,7 +1911,7 @@ function sessionsDir(home = maesttroHome()) {
 function saveSession(record, dir = sessionsDir()) {
   mkdirSync10(dir, { recursive: true, mode: 448 });
   const path = join10(dir, `${record.id}.json`);
-  writeFileSync7(`${path}.tmp`, `${JSON.stringify(record, null, 2)}
+  writeFileSync8(`${path}.tmp`, `${JSON.stringify(record, null, 2)}
 `);
   renameSync4(`${path}.tmp`, path);
 }
@@ -1929,6 +1964,7 @@ function workspaceAuthor(run, workspace) {
 // src/launch.ts
 var CONTAINER_REPO = "/workspace";
 var CONTAINER_PACKAGE = "/opt/maesttro";
+var CONTAINER_GIT_OBJECTS = "/opt/maesttro-objects";
 function resolveCommand(args) {
   const [first, ...rest] = args;
   if (first === undefined)
@@ -1951,8 +1987,8 @@ function sessionMounts({
 }) {
   const objects = join11(repoRoot, ".git", "objects");
   const mounts = [
-    { host: VOLUME, container: "/home/agent" },
-    { host: objects, container: objects, readOnly: true },
+    { host: VOLUME, container: "/home/agent", type: "volume" },
+    { host: objects, container: CONTAINER_GIT_OBJECTS, readOnly: true },
     { host: sessionDir, container: CONTAINER_REPO },
     { host: packageRoot, container: CONTAINER_PACKAGE, readOnly: true },
     ...stagedPaths.map((path) => ({
@@ -1982,9 +2018,9 @@ function dockerRunArgs({
   extra = [],
   name
 }) {
-  const volumes = mounts.flatMap(({ host, container, readOnly }) => [
-    "-v",
-    `${host}:${container}${readOnly ? ":ro" : ""}`
+  const volumes = mounts.flatMap(({ host, container, readOnly, type = "bind" }) => [
+    "--mount",
+    `type=${type},source=${host},target=${container}${readOnly ? ",readonly" : ""}`
   ]);
   return [
     "run",
@@ -2222,6 +2258,7 @@ async function launch({
     "MAESTTRO_HOST_GID"
   ].concat(repo ? ["MAESTTRO_REPO"] : []).flatMap((name) => ["-e", name]);
   clearStaleContainer(saved.id);
+  pinAlternates(saved.worktree, CONTAINER_GIT_OBJECTS);
   const child = spawn("docker", dockerRunArgs({
     command: containerCommand(resolveCommand(args)),
     mounts,
@@ -2246,6 +2283,32 @@ async function launch({
 
 // src/push.ts
 import { spawnSync as spawnSync3 } from "node:child_process";
+var CONFIRM_FLAGS = new Set(["--yes", "-y"]);
+var FORWARDED_GIT_FLAGS = new Set(["--force"]);
+function parsePushArgs(args) {
+  const positionals = args.filter((arg) => !arg.startsWith("-"));
+  if (positionals.length > 1) {
+    return {
+      ok: false,
+      reason: `Expected at most one branch, got ${positionals.join(", ")}.`
+    };
+  }
+  const flags = args.filter((arg) => arg.startsWith("-"));
+  const unsupported = flags.filter((flag) => !CONFIRM_FLAGS.has(flag) && !FORWARDED_GIT_FLAGS.has(flag));
+  if (unsupported.length > 0) {
+    return {
+      ok: false,
+      reason: `maesttro push doesn't accept ${unsupported.join(", ")}; it takes --yes and --force.`
+    };
+  }
+  const [requested] = positionals;
+  return {
+    ok: true,
+    ...requested === undefined ? {} : { requested },
+    yes: flags.some((flag) => CONFIRM_FLAGS.has(flag)),
+    gitFlags: flags.filter((flag) => FORWARDED_GIT_FLAGS.has(flag))
+  };
+}
 function pushCandidates(sessions) {
   const candidates = new Map;
   for (const session of sessions) {
@@ -2297,7 +2360,7 @@ async function choose(candidates) {
   const answer = await ask("Branch to push: ");
   return candidates[Number(answer) - 1];
 }
-function describe(run, root, branch, base, tip) {
+function describe(run, root, branch, base, tip, gitFlags) {
   const commits = git(run, root, [
     "log",
     "--format=  %h %s (%an / %cn)",
@@ -2305,7 +2368,7 @@ function describe(run, root, branch, base, tip) {
   ]).out;
   const stat = git(run, root, ["diff", "--stat", `${base}...${tip}`]).out;
   return [
-    `Pushing ${branch} to origin (compared with ${base}):`,
+    `Pushing ${branch} to origin${gitFlags.length ? ` with ${gitFlags.join(" ")}` : ""} (compared with ${base}):`,
     stripControl(commits) || "  (no new commits)",
     stat ? `
 ${stripControl(stat)}` : ""
@@ -2314,8 +2377,13 @@ ${stripControl(stat)}` : ""
 }
 async function push({ args }) {
   const run = runCommand;
-  const yes = args.includes("--yes") || args.includes("-y");
-  const requested = args.find((arg) => !arg.startsWith("-"));
+  const parsed = parsePushArgs(args);
+  if (!parsed.ok) {
+    console.error(parsed.reason);
+    process.exitCode = 1;
+    return;
+  }
+  const { requested, yes, gitFlags } = parsed;
   let root;
   try {
     root = repoRoot(run, process.cwd());
@@ -2342,7 +2410,7 @@ async function push({ args }) {
     return;
   }
   git(run, root, ["update-ref", `refs/maesttro/${sessionId}/${branch}`, tip]);
-  console.log(describe(run, root, branch, base, tip));
+  console.log(describe(run, root, branch, base, tip, gitFlags));
   if (!yes) {
     if (!process.stdin.isTTY) {
       console.error("Not a terminal; re-run with --yes to push without confirming.");
@@ -2356,7 +2424,7 @@ Push? [y/N] `);
       return;
     }
   }
-  const pushed = spawnSync3("git", ["-C", root, "push", "origin", `${tip}:refs/heads/${branch}`], { stdio: "inherit" });
+  const pushed = spawnSync3("git", ["-C", root, "push", ...gitFlags, "origin", `${tip}:refs/heads/${branch}`], { stdio: "inherit" });
   if (pushed.status === 0) {
     console.log(`Pushed ${branch}. Base for comparison was ${baseSha.slice(0, 8)}.`);
   }
@@ -2365,32 +2433,88 @@ Push? [y/N] `);
 
 // src/sessions-command.ts
 import { existsSync as existsSync5, rmSync as rmSync7 } from "node:fs";
-function sessionsCommand({ args }) {
+function parseRemoveArgs(args) {
+  let all = false;
+  let force = false;
+  let id;
+  for (const arg of args) {
+    if (arg === "--all")
+      all = true;
+    else if (arg === "--force")
+      force = true;
+    else if (id === undefined)
+      id = arg;
+  }
+  return { all, force, id };
+}
+async function removeSession(run, session, force, ask, interactive) {
+  if (existsSync5(session.worktree)) {
+    const preserved = preserveBranches(run, session);
+    const head = cloneHead(session.worktree);
+    const unbranched = preserved.length === 0 && head?.detached !== undefined && head.detached !== session.baseSha;
+    if (unbranched && !force) {
+      let proceed;
+      if (interactive) {
+        const answer = await ask(`Session ${session.id} has commits on a detached HEAD not on any branch. Removing it discards them. Remove anyway? [y/N] `);
+        proceed = /^(y(es)?)?$/i.test(answer);
+      } else {
+        proceed = false;
+        console.error(`Session ${session.id} has commits on a detached HEAD not on any branch. Resume and create a branch, or re-run with --force.`);
+      }
+      if (!proceed) {
+        console.log(`Kept session ${session.id}.`);
+        return "kept";
+      }
+    }
+    rmSync7(session.worktree, { recursive: true, force: true });
+    const kept = preserved.length > 0 ? ` Its branches are kept as refs/maesttro/${session.id}/*.` : "";
+    console.log(`Removed session ${session.id}.${kept}`);
+  } else {
+    console.log(`Removed session ${session.id}.`);
+  }
+  deleteSession(session.id);
+  return "removed";
+}
+async function sessionsCommand({
+  args,
+  ask: ask2 = ask,
+  interactive = process.stdin.isTTY === true
+}) {
   const run = runCommand;
   const root = repoRoot(run, process.cwd());
-  const [action, id] = args;
+  const [action, ...rest] = args;
   if (action === "remove") {
-    const session = id ? readSession(id) : undefined;
-    if (!session || session.repoRoot !== root) {
-      console.error(`No session ${id ?? "(missing id)"} in this repo.`);
-      process.exitCode = 1;
-      return;
-    }
-    if (existsSync5(session.worktree)) {
-      const preserved = preserveBranches(run, session);
-      const head = cloneHead(session.worktree);
-      if (preserved.length === 0 && head?.detached !== undefined && head.detached !== session.baseSha) {
-        console.error(`${session.id} has commits on a detached HEAD not on any branch; resume and create a branch first.`);
+    const { all, force, id } = parseRemoveArgs(rest);
+    if (all) {
+      if (id !== undefined) {
+        console.error("`maesttro sessions remove` takes either `--all` or a session id, not both.");
         process.exitCode = 1;
         return;
       }
-      rmSync7(session.worktree, { recursive: true, force: true });
-      const kept = preserved.length > 0 ? ` Its branches are kept as refs/maesttro/${session.id}/*.` : "";
-      console.log(`Removed session ${session.id}.${kept}`);
-    } else {
-      console.log(`Removed session ${session.id}.`);
+      const sessions = sessionsForRepo(root);
+      if (sessions.length === 0) {
+        console.log("No maesttro sessions in this repo.");
+        return;
+      }
+      for (const session of sessions) {
+        await removeSession(run, session, force, ask2, interactive);
+      }
+      return;
     }
-    deleteSession(session.id);
+    if (id === undefined) {
+      console.error("Usage: maesttro sessions remove <id> | maesttro sessions remove --all");
+      process.exitCode = 1;
+      return;
+    }
+    const session = readSession(id);
+    if (!session || session.repoRoot !== root) {
+      console.error(`No session ${id} in this repo.`);
+      process.exitCode = 1;
+      return;
+    }
+    const result = await removeSession(run, session, force, ask2, interactive);
+    if (result === "kept")
+      process.exitCode = 1;
     return;
   }
   const sessions = sessionsForRepo(root);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maesttro",
-  "version": "0.4.2",
+  "version": "0.4.4",
   "description": "Isolated Docker runner for local coding agents (opencode, claude, ...) under a dedicated bot GitHub identity, with curated configs baked in per client.",
   "type": "module",
   "bin": {