maesttro 0.6.0 → 0.6.1

package/README.md

@@ -153,8 +153,8 @@ config on top (`$MAESTTRO_URL`, default `http://100.64.0.2`). Only the result
 is mounted into the runner, read-only, and copied into place at start. Your
 raw config never enters the container, and your host's config is never written.
 
-Injected: a `maesttro` provider (Orchestrate) at `/v1`, a `dgx-spark` provider
-(lorem direct on the DGX), compaction, default model `maesttro/maesttro`, and
+Injected: a `esatto` provider (Maesttro) at `/v1`, a `dgx-spark` provider
+(lorem direct on the DGX), compaction, default model `esatto/maesttro`, and
 thinking blocks shown. The two providers replace yours of the same name; the
 rest (`mcp`, `plugin`, other providers) is merged. Removed secrets are listed
 at launch by path. `{env:X}` / `$X` references are kept.

package/dist/maesttro.js

@@ -1871,15 +1871,14 @@ function isClientKey(value) {
 
 // src/configure.ts
 import {
-  cpSync as cpSync2,
   existsSync as existsSync3,
-  mkdirSync as mkdirSync9,
-  readdirSync as readdirSync3,
+  mkdirSync as mkdirSync10,
+  readdirSync as readdirSync4,
   readFileSync as readFileSync10,
   writeFileSync as writeFileSync9
 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
-import { dirname as dirname6, join as join10 } from "node:path";
+import { dirname as dirname7, join as join11 } from "node:path";
 
 // src/claude-state.ts
 import { readFileSync as readFileSync8, renameSync as renameSync6, writeFileSync as writeFileSync7 } from "node:fs";
@@ -1924,17 +1923,52 @@ function seedClaudeState({
 
 // src/client-configs.ts
 import {
-  chmodSync as chmodSync4,
-  cpSync,
+  chmodSync as chmodSync5,
   existsSync as existsSync2,
-  mkdirSync as mkdirSync8,
+  mkdirSync as mkdirSync9,
   mkdtempSync as mkdtempSync2,
   readFileSync as readFileSync9,
-  rmSync as rmSync6,
+  rmSync as rmSync7,
   writeFileSync as writeFileSync8
 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { dirname as dirname5, join as join9 } from "node:path";
+import { dirname as dirname6, join as join10 } from "node:path";
+
+// src/copy-tree.ts
+import {
+  chmodSync as chmodSync4,
+  copyFileSync,
+  lstatSync as lstatSync4,
+  mkdirSync as mkdirSync8,
+  readdirSync as readdirSync3,
+  readlinkSync,
+  rmSync as rmSync6,
+  symlinkSync
+} from "node:fs";
+import { dirname as dirname5, isAbsolute, join as join9, resolve as resolve2 } from "node:path";
+function copyTree(source, target, filter = () => true) {
+  mkdirSync8(target, { recursive: true });
+  for (const name of readdirSync3(source)) {
+    const from = join9(source, name);
+    if (!filter(from))
+      continue;
+    const to = join9(target, name);
+    const stat = lstatSync4(from);
+    if (stat.isSymbolicLink()) {
+      const link = readlinkSync(from);
+      rmSync6(to, { force: true });
+      symlinkSync(isAbsolute(link) ? link : resolve2(dirname5(from), link), to);
+      continue;
+    }
+    if (stat.isDirectory()) {
+      copyTree(from, to, filter);
+      continue;
+    }
+    rmSync6(to, { force: true });
+    copyFileSync(from, to);
+    chmodSync4(to, stat.mode & 511);
+  }
+}
 
 // src/maesttro-endpoint.ts
 var DEFAULT_MAESTTRO_URL = "http://100.64.0.2";
@@ -1967,7 +2001,7 @@ async function fetchOrchestratorWindow({
 }
 
 // src/provider-configs.ts
-var PROVIDER_ID = "maesttro";
+var PROVIDER_ID = "esatto";
 var MAESTTRO_API_KEY = "maesttro";
 var DGX_SPARK_PROVIDER_ID = "dgx-spark";
 var DGX_SPARK_URL = "http://100.64.0.1:8001";
@@ -1994,7 +2028,7 @@ function opencodeProviders(url) {
       name: "Maesttro",
       options: { baseURL: `${url}/v1`, apiKey: MAESTTRO_API_KEY },
       models: {
-        [ORCHESTRATOR_MODEL]: { name: "Orchestrate", ...IMAGE_INPUT }
+        [ORCHESTRATOR_MODEL]: { name: "Maesttro", ...IMAGE_INPUT }
       }
     },
     [DGX_SPARK_PROVIDER_ID]: {
@@ -2011,10 +2045,11 @@ function opencodeProviders(url) {
     }
   };
 }
-function opencodeConfig(base, url) {
+function opencodeConfig(base, url, isStrict = false) {
   const merged = mergeJson({ $schema: "https://opencode.ai/config.json", ...base }, {
     model: `${PROVIDER_ID}/${ORCHESTRATOR_MODEL}`,
-    compaction: { auto: true, keep: { tokens: 24000 }, buffer: 32000 }
+    compaction: { auto: true, keep: { tokens: 24000 }, buffer: 32000 },
+    ...isStrict ? {} : { permission: "allow" }
   });
   const enabled = stringList(base.enabled_providers);
   const disabled = stringList(base.disabled_providers);
@@ -2037,7 +2072,8 @@ function opencodeConfig(base, url) {
 }
 function claudeSettings({
   url,
-  orchestratorWindow
+  orchestratorWindow,
+  isStrict
 }) {
   return {
     env: {
@@ -2046,7 +2082,8 @@ function claudeSettings({
       ANTHROPIC_CUSTOM_MODEL_OPTION_NAME: "Maesttro",
       ANTHROPIC_CUSTOM_MODEL_OPTION_DESCRIPTION: "Maesttro orchestrator",
       ...orchestratorWindow ? { CLAUDE_CODE_MAX_CONTEXT_TOKENS: String(orchestratorWindow) } : {}
-    }
+    },
+    ...isStrict ? {} : { permissions: { defaultMode: "bypassPermissions" } }
   };
 }
 
@@ -2148,7 +2185,7 @@ function readHostFile({
   parse,
   warn
 }) {
-  const path = join9(home, file);
+  const path = join10(home, file);
   if (!existsSync2(path))
     return {};
   try {
@@ -2173,29 +2210,30 @@ function json(value) {
 function buildClientConfigs({
   host,
   url,
-  orchestratorWindow
+  orchestratorWindow,
+  isStrict
 }) {
   const opencode = redactSecrets(opencodeHostBase(host.opencode));
   return {
     files: {
-      [OPENCODE_CONFIG]: json(opencodeConfig(opencode.value, url)),
-      [CLAUDE_SETTINGS]: json(claudeSettings({ url, orchestratorWindow }))
+      [OPENCODE_CONFIG]: json(opencodeConfig(opencode.value, url, isStrict)),
+      [CLAUDE_SETTINGS]: json(claudeSettings({ url, orchestratorWindow, isStrict }))
     },
     removed: opencode.removed.map((path) => `opencode ${path}`)
   };
 }
 function writeClientConfigDir(files, parent = tmpdir2()) {
-  const root = mkdtempSync2(join9(parent, "maesttro-clients-"));
-  chmodSync4(root, 448);
-  const dir = join9(root, "home");
+  const root = mkdtempSync2(join10(parent, "maesttro-clients-"));
+  chmodSync5(root, 448);
+  const dir = join10(root, "home");
   for (const [file, content] of Object.entries(files)) {
-    const path = join9(dir, file);
-    mkdirSync8(dirname5(path), { recursive: true, mode: 493 });
+    const path = join10(dir, file);
+    mkdirSync9(dirname6(path), { recursive: true, mode: 493 });
     writeFileSync8(path, content);
-    chmodSync4(path, 420);
+    chmodSync5(path, 420);
   }
-  chmodSync4(dir, 493);
-  return { dir, remove: () => rmSync6(root, { recursive: true, force: true }) };
+  chmodSync5(dir, 493);
+  return { dir, remove: () => rmSync7(root, { recursive: true, force: true }) };
 }
 function installClientConfigs({
   home,
@@ -2203,23 +2241,19 @@ function installClientConfigs({
 }) {
   if (!existsSync2(source))
     return false;
-  const merged = MERGED_INTO_HOME.map((file) => join9(source, file));
-  cpSync(source, home, {
-    recursive: true,
-    force: true,
-    filter: (path) => !merged.includes(path)
-  });
+  const merged = MERGED_INTO_HOME.map((file) => join10(source, file));
+  copyTree(source, home, (path) => !merged.includes(path));
   for (const file of MERGED_INTO_HOME) {
-    const staged = join9(source, file);
+    const staged = join10(source, file);
     if (!existsSync2(staged))
       continue;
-    const target = join9(home, file);
+    const target = join10(home, file);
     writeJson(target, mergeJson(readJson(target), readJson(staged)));
   }
   return true;
 }
 function injectOpencodeTuiState({ home }) {
-  const path = join9(home, OPENCODE_TUI_STATE);
+  const path = join10(home, OPENCODE_TUI_STATE);
   writeJson(path, mergeJson(readJson(path), CURATED_OPENCODE_TUI_STATE));
   return path;
 }
@@ -2316,22 +2350,22 @@ function withoutComments(value) {
 }
 function applyProviderConfigs({
   home,
-  configsDir = join10(DOCKERFILE_DIR, "configs")
+  configsDir = join11(DOCKERFILE_DIR, "configs")
 }) {
   const written = [];
   for (const [key, client] of Object.entries(CLIENTS)) {
-    const source = join10(configsDir, key);
+    const source = join11(configsDir, key);
     if (!existsSync3(source))
       continue;
-    const targetDir = join10(home, client.configDir.replace(/^\/home\/agent\/?/, ""));
-    for (const name of readdirSync3(source)) {
+    const targetDir = join11(home, client.configDir.replace(/^\/home\/agent\/?/, ""));
+    for (const name of readdirSync4(source)) {
       if (!name.endsWith(".json"))
         continue;
-      const curated = withoutComments(readJson(join10(source, name)));
+      const curated = withoutComments(readJson(join11(source, name)));
       if (Object.keys(curated).length === 0)
         continue;
-      const target = join10(targetDir, name);
-      mkdirSync9(targetDir, { recursive: true });
+      const target = join11(targetDir, name);
+      mkdirSync10(targetDir, { recursive: true });
       const merged = mergeJson(readJson(target), curated);
       writeFileSync9(target, `${JSON.stringify(merged, null, 2)}
 `);
@@ -2346,19 +2380,19 @@ function stageHostInstructions({
   context
 }) {
   for (const directory of STAGED_DIRECTORIES) {
-    const source = join10(staging, directory);
+    const source = join11(staging, directory);
     if (!existsSync3(source))
       continue;
     try {
-      cpSync2(source, join10(home, directory), { recursive: true, force: true });
+      copyTree(source, join11(home, directory));
     } catch {}
   }
   const instructions = runnerInstructions(context);
   for (const file of INSTRUCTION_FILES) {
-    const source = join10(staging, file);
+    const source = join11(staging, file);
     const hostCopy = existsSync3(source) ? readFileSync10(source, "utf8") : "";
-    const target = join10(home, file);
-    mkdirSync9(dirname6(target), { recursive: true });
+    const target = join11(home, file);
+    mkdirSync10(dirname7(target), { recursive: true });
     writeFileSync9(target, hostCopy ? `${hostCopy.trimEnd()}
 
 ${instructions}` : instructions);
@@ -2483,8 +2517,8 @@ async function reachable(host, port, {
 }
 
 // src/repo.ts
-import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync10, realpathSync } from "node:fs";
-import { join as join11 } from "node:path";
+import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync11, realpathSync } from "node:fs";
+import { join as join12 } from "node:path";
 var MINIMUM_GIT = [2, 48];
 var WORKTREES_DIR = ".worktrees";
 
@@ -2527,7 +2561,7 @@ function repoRoot(run, cwd) {
     "--git-common-dir"
   ]).out;
   const root = realpathSync(top.out);
-  if (realpathSync(commonDir) !== join11(root, ".git")) {
+  if (realpathSync(commonDir) !== join12(root, ".git")) {
     throw new LaunchError("This is a git worktree. Run maesttro from the main checkout; each session gets its own isolated clone.");
   }
   if (realpathSync(cwd) !== root) {
@@ -2554,12 +2588,12 @@ function defaultBranch(run, root) {
   throw new LaunchError("Can't find the default branch of origin. Run `git remote set-head origin --auto`.");
 }
 function ensureWorktreesDir(run, root) {
-  mkdirSync10(join11(root, WORKTREES_DIR), { recursive: true });
+  mkdirSync11(join12(root, WORKTREES_DIR), { recursive: true });
   if (git(run, root, ["check-ignore", "-q", `${WORKTREES_DIR}/`]).ok)
     return;
-  const info = join11(root, ".git", "info");
-  mkdirSync10(info, { recursive: true });
-  appendFileSync2(join11(info, "exclude"), `
+  const info = join12(root, ".git", "info");
+  mkdirSync11(info, { recursive: true });
+  appendFileSync2(join12(info, "exclude"), `
 ${WORKTREES_DIR}/
 `);
 }
@@ -2837,20 +2871,20 @@ Usage:
 
 // src/launch.ts
 import { execSync as execSync3, spawn as spawn2, spawnSync as spawnSync3 } from "node:child_process";
-import { existsSync as existsSync5, rmSync as rmSync9 } from "node:fs";
+import { existsSync as existsSync5, rmSync as rmSync10 } from "node:fs";
 import { constants as constants2, homedir as homedir3 } from "node:os";
-import { join as join15 } from "node:path";
+import { join as join16 } from "node:path";
 
 // src/backup.ts
 import { createHash } from "node:crypto";
-import { mkdirSync as mkdirSync11, readdirSync as readdirSync4, rmSync as rmSync7 } from "node:fs";
-import { basename, join as join12 } from "node:path";
+import { mkdirSync as mkdirSync12, readdirSync as readdirSync5, rmSync as rmSync8 } from "node:fs";
+import { basename, join as join13 } from "node:path";
 var BACKUPS_KEPT = 5;
 function shortHash(value) {
   return createHash("sha256").update(value).digest("hex").slice(0, 8);
 }
 function backupDir(repoRoot, home = maesttroHome()) {
-  return join12(home, "backups", `${basename(repoRoot)}-${shortHash(repoRoot)}`);
+  return join13(home, "backups", `${basename(repoRoot)}-${shortHash(repoRoot)}`);
 }
 function refsFingerprint(refs) {
   const sorted = Object.keys(refs).sort().map((ref) => `${ref} ${refs[ref]}`);
@@ -2868,40 +2902,40 @@ function backupRepo({
 }) {
   if (Object.keys(refs).length === 0)
     return;
-  mkdirSync11(dir, { recursive: true, mode: 448 });
+  mkdirSync12(dir, { recursive: true, mode: 448 });
   const fingerprint = refsFingerprint(refs);
-  const existing = readdirSync4(dir).filter((name) => name.endsWith(".bundle")).sort();
+  const existing = readdirSync5(dir).filter((name) => name.endsWith(".bundle")).sort();
   const latest = existing.at(-1);
   if (latest?.endsWith(`-${fingerprint}.bundle`)) {
-    return { path: join12(dir, latest), reused: true };
+    return { path: join13(dir, latest), reused: true };
   }
   const stamp = now.toISOString().replace(/[:.]/g, "-");
-  const path = join12(dir, `${stamp}-${sessionId}-${fingerprint}.bundle`);
+  const path = join13(dir, `${stamp}-${sessionId}-${fingerprint}.bundle`);
   if (!git(run, repoRoot, ["bundle", "create", "--quiet", path, "--all"]).ok) {
     return;
   }
   for (const stale of [...existing, basename(path)].sort().slice(0, -keep)) {
-    rmSync7(join12(dir, stale), { force: true });
+    rmSync8(join13(dir, stale), { force: true });
   }
   return { path, reused: false };
 }
 
 // src/session-dir.ts
 import {
-  chmodSync as chmodSync5,
-  mkdirSync as mkdirSync12,
+  chmodSync as chmodSync6,
+  mkdirSync as mkdirSync13,
   mkdtempSync as mkdtempSync3,
   renameSync as renameSync7,
-  rmSync as rmSync8,
+  rmSync as rmSync9,
   writeFileSync as writeFileSync10
 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
-import { join as join13 } from "node:path";
+import { join as join14 } from "node:path";
 var CONTAINER_GH_CONFIG_DIR = "/home/agent/.config/gh-maesttro";
 function writeAtomically(path, content) {
   const temporary = `${path}.tmp`;
   writeFileSync10(temporary, content, { mode: 420 });
-  chmodSync5(temporary, 420);
+  chmodSync6(temporary, 420);
   renameSync7(temporary, path);
 }
 function hostsYaml(token, user) {
@@ -2915,19 +2949,19 @@ function hostsYaml(token, user) {
 `);
 }
 function createSessionDir(parent = tmpdir3()) {
-  const root = mkdtempSync3(join13(parent, "maesttro-"));
-  chmodSync5(root, 448);
-  const ghDir = join13(root, "gh");
-  mkdirSync12(ghDir);
-  chmodSync5(ghDir, 493);
-  writeAtomically(join13(ghDir, "config.yml"), `version: "1"
+  const root = mkdtempSync3(join14(parent, "maesttro-"));
+  chmodSync6(root, 448);
+  const ghDir = join14(root, "gh");
+  mkdirSync13(ghDir);
+  chmodSync6(ghDir, 493);
+  writeAtomically(join14(ghDir, "config.yml"), `version: "1"
 `);
   return {
     ghDir,
-    writeToken: (token, user) => writeAtomically(join13(ghDir, "hosts.yml"), hostsYaml(token, user)),
-    writeStatus: (status) => writeAtomically(join13(ghDir, "status"), `${status}
+    writeToken: (token, user) => writeAtomically(join14(ghDir, "hosts.yml"), hostsYaml(token, user)),
+    writeStatus: (status) => writeAtomically(join14(ghDir, "status"), `${status}
 `),
-    remove: () => rmSync8(root, { recursive: true, force: true })
+    remove: () => rmSync9(root, { recursive: true, force: true })
   };
 }
 
@@ -3078,15 +3112,15 @@ function ask(question) {
 
 // src/session-clone.ts
 import {
-  copyFileSync,
+  copyFileSync as copyFileSync2,
   existsSync as existsSync4,
-  lstatSync as lstatSync4,
-  mkdirSync as mkdirSync13,
-  readdirSync as readdirSync5,
+  lstatSync as lstatSync5,
+  mkdirSync as mkdirSync14,
+  readdirSync as readdirSync6,
   readFileSync as readFileSync11,
   writeFileSync as writeFileSync11
 } from "node:fs";
-import { join as join14 } from "node:path";
+import { join as join15 } from "node:path";
 
 // src/sanitize.ts
 function stripControl(text) {
@@ -3173,25 +3207,25 @@ function createSessionClone(run, root, clonePath, baseSha) {
 }
 function realDir(path) {
   try {
-    return lstatSync4(path).isDirectory();
+    return lstatSync5(path).isDirectory();
   } catch {
     return false;
   }
 }
 function dirents(dir) {
   try {
-    return readdirSync5(dir, { withFileTypes: true });
+    return readdirSync6(dir, { withFileTypes: true });
   } catch {
     return [];
   }
 }
 function cloneGitDir(clonePath) {
-  const gitDir = join14(clonePath, ".git");
+  const gitDir = join15(clonePath, ".git");
   return realDir(gitDir) ? gitDir : undefined;
 }
 function readSha(path) {
   try {
-    if (!lstatSync4(path).isFile())
+    if (!lstatSync5(path).isFile())
       return;
     const text = readFileSync11(path, "utf8").trim();
     return SHA.test(text) ? text : undefined;
@@ -3203,7 +3237,7 @@ function packedRefs(gitDir) {
   const refs = new Map;
   let text;
   try {
-    text = readFileSync11(join14(gitDir, "packed-refs"), "utf8");
+    text = readFileSync11(join15(gitDir, "packed-refs"), "utf8");
   } catch {
     return refs;
   }
@@ -3228,12 +3262,12 @@ function cloneBranches(clonePath) {
         continue;
       const name = prefix ? `${prefix}/${entry.name}` : entry.name;
       if (entry.isDirectory())
-        walk(join14(dir, entry.name), name);
+        walk(join15(dir, entry.name), name);
       else if (entry.isFile())
         names.add(name);
     }
   };
-  walk(join14(gitDir, "refs", "heads"), "");
+  walk(join15(gitDir, "refs", "heads"), "");
   for (const ref of packedRefs(gitDir).keys()) {
     if (ref.startsWith(HEADS_PREFIX))
       names.add(ref.slice(HEADS_PREFIX.length));
@@ -3246,7 +3280,7 @@ function branchTip(clonePath, branch) {
   const gitDir = cloneGitDir(clonePath);
   if (!gitDir)
     return;
-  return readSha(join14(gitDir, "refs", "heads", branch)) ?? packedRefs(gitDir).get(`${HEADS_PREFIX}${branch}`);
+  return readSha(join15(gitDir, "refs", "heads", branch)) ?? packedRefs(gitDir).get(`${HEADS_PREFIX}${branch}`);
 }
 function cloneHead(clonePath) {
   const gitDir = cloneGitDir(clonePath);
@@ -3254,9 +3288,9 @@ function cloneHead(clonePath) {
     return;
   let text;
   try {
-    if (!lstatSync4(join14(gitDir, "HEAD")).isFile())
+    if (!lstatSync5(join15(gitDir, "HEAD")).isFile())
       return;
-    text = readFileSync11(join14(gitDir, "HEAD"), "utf8").trim();
+    text = readFileSync11(join15(gitDir, "HEAD"), "utf8").trim();
   } catch {
     return;
   }
@@ -3277,29 +3311,29 @@ function copyObjectFiles(fromDir, intoDir) {
   for (const entry of dirents(fromDir)) {
     if (!entry.isFile())
       continue;
-    const dest = join14(intoDir, entry.name);
+    const dest = join15(intoDir, entry.name);
     if (existsSync4(dest))
       continue;
     if (!created) {
-      mkdirSync13(intoDir, { recursive: true });
+      mkdirSync14(intoDir, { recursive: true });
       created = true;
     }
-    copyFileSync(join14(fromDir, entry.name), dest);
+    copyFileSync2(join15(fromDir, entry.name), dest);
   }
 }
 function pinAlternates(clonePath, containerObjects) {
   const gitDir = cloneGitDir(clonePath);
   if (!gitDir)
     return;
-  const objects = join14(gitDir, "objects");
-  const info = join14(objects, "info");
+  const objects = join15(gitDir, "objects");
+  const info = join15(objects, "info");
   if (!realDir(objects) || !realDir(info)) {
     throw new LaunchError(`Unsafe objects tree in the session clone: ${clonePath}`);
   }
-  const alternates = join14(info, "alternates");
+  const alternates = join15(info, "alternates");
   let stat;
   try {
-    stat = lstatSync4(alternates);
+    stat = lstatSync5(alternates);
   } catch {
     return;
   }
@@ -3316,17 +3350,17 @@ function importObjects(run, root, clonePath, tip) {
   const gitDir = cloneGitDir(clonePath);
   if (!gitDir)
     return false;
-  const objects = join14(gitDir, "objects");
+  const objects = join15(gitDir, "objects");
   if (!realDir(objects))
     return false;
-  const into = join14(root, ".git", "objects");
+  const into = join15(root, ".git", "objects");
   for (const entry of dirents(objects)) {
     if (entry.name === "info" || entry.isSymbolicLink() || !entry.isDirectory()) {
       continue;
     }
     if (!OBJECT_SUBDIR.test(entry.name) && entry.name !== "pack")
       continue;
-    copyObjectFiles(join14(objects, entry.name), join14(into, entry.name));
+    copyObjectFiles(join15(objects, entry.name), join15(into, entry.name));
   }
   return git(run, root, ["cat-file", "-e", `${tip}^{commit}`]).ok;
 }
@@ -3381,6 +3415,20 @@ function resolveCommand(args) {
 function containerCommand(command) {
   return `node ${CONTAINER_PACKAGE}/dist/maesttro.js configure || echo "maesttro: in-container setup failed" >&2; ${command}`;
 }
+function sessionEnvFlags({ repo }) {
+  const names = [
+    "MAESTTRO_SESSION_ID",
+    "MAESTTRO_BASE",
+    "MAESTTRO_GITHUB",
+    "MAESTTRO_HOST_UID",
+    "MAESTTRO_HOST_GID",
+    ...repo ? ["MAESTTRO_REPO"] : [],
+    "COLORTERM",
+    "TERM_PROGRAM",
+    "TERM=xterm-256color"
+  ];
+  return names.flatMap((name) => ["-e", name]);
+}
 function sessionMounts({
   repoRoot,
   sessionDir,
@@ -3392,7 +3440,7 @@ function sessionMounts({
   home,
   claudeDir
 }) {
-  const objects = join15(repoRoot, ".git", "objects");
+  const objects = join16(repoRoot, ".git", "objects");
   const mounts = [
     { host: home, container: "/home/agent" },
     { host: claudeDir, container: "/home/agent/.claude" },
@@ -3400,7 +3448,7 @@ function sessionMounts({
     { host: sessionDir, container: CONTAINER_REPO },
     { host: packageRoot, container: CONTAINER_PACKAGE, readOnly: true },
     ...stagedPaths.map((path) => ({
-      host: join15(hostHome, path),
+      host: join16(hostHome, path),
       container: `${HOST_STAGING_DIR}/${path}`,
       readOnly: true
     })),
@@ -3503,7 +3551,7 @@ async function establishClaudeCredentials({
   }
 }
 function sharedSkillsDir() {
-  const dir = process.env.AGENT_SHARED_SKILLS ?? join15(homedir3(), "agent-shared", "skills");
+  const dir = process.env.AGENT_SHARED_SKILLS ?? join16(homedir3(), "agent-shared", "skills");
   return existsSync5(dir) ? dir : undefined;
 }
 async function resolveAuthor(workspace) {
@@ -3533,7 +3581,7 @@ function startSession(run, root) {
   if (!baseSha)
     throw new LaunchError(`Can't resolve ${base}.`);
   const id = newSessionId();
-  const sessionDir = join15(root, WORKTREES_DIR, id);
+  const sessionDir = join16(root, WORKTREES_DIR, id);
   createSessionClone(run, root, sessionDir, baseSha);
   return {
     id,
@@ -3579,7 +3627,7 @@ function finishSession(run, session) {
   }
   const preserved = preserveBranches(run, session);
   if (!cloneHasWork(session.worktree, session.baseSha)) {
-    rmSync9(session.worktree, { recursive: true, force: true });
+    rmSync10(session.worktree, { recursive: true, force: true });
     deleteSession(session.id);
     return;
   }
@@ -3751,7 +3799,8 @@ Interrupted; cleaning up session ${saved.id}…`);
   const clientConfigs = buildClientConfigs({
     host: readHostClientConfigs({ home: hostHome }),
     url,
-    orchestratorWindow
+    orchestratorWindow,
+    isStrict: strict
   });
   if (clientConfigs.removed.length > 0) {
     console.log(`Kept out of the runner as secrets: ${clientConfigs.removed.join(", ")}`);
@@ -3762,7 +3811,7 @@ Interrupted; cleaning up session ${saved.id}…`);
     sessionDir: saved.worktree,
     packageRoot: PACKAGE_ROOT,
     hostHome,
-    stagedPaths: STAGED_PATHS.filter((path) => existsSync5(join15(hostHome, path))),
+    stagedPaths: STAGED_PATHS.filter((path) => existsSync5(join16(hostHome, path))),
     clientConfigs: clientConfigDir.dir,
     sharedSkills: sharedSkillsDir(),
     home,
@@ -3776,13 +3825,6 @@ Interrupted; cleaning up session ${saved.id}…`);
     ...hostIdentityEnv(),
     ...repo ? { MAESTTRO_REPO: repo } : {}
   };
-  const envFlags = [
-    "MAESTTRO_SESSION_ID",
-    "MAESTTRO_BASE",
-    "MAESTTRO_GITHUB",
-    "MAESTTRO_HOST_UID",
-    "MAESTTRO_HOST_GID"
-  ].concat(repo ? ["MAESTTRO_REPO"] : []).flatMap((name) => ["-e", name]);
   clearStaleContainer(saved.id);
   pinAlternates(saved.worktree, CONTAINER_GIT_OBJECTS);
   const child = spawn2("docker", dockerRunArgs({
@@ -3790,7 +3832,7 @@ Interrupted; cleaning up session ${saved.id}…`);
     mounts,
     workdir,
     name: saved.id,
-    extra: [...github.dockerArgs, ...envFlags]
+    extra: [...github.dockerArgs, ...sessionEnvFlags({ repo })]
   }), { stdio: "inherit", env: { ...process.env, ...sessionEnv } });
   interrupts.dispose();
   claudeNotices.quiet();
@@ -5019,7 +5061,7 @@ async function push({ args }) {
 }
 
 // src/sessions-command.ts
-import { existsSync as existsSync6, rmSync as rmSync10 } from "node:fs";
+import { existsSync as existsSync6, rmSync as rmSync11 } from "node:fs";
 function parseRemoveArgs(args) {
   let all = false;
   let force = false;
@@ -5053,7 +5095,7 @@ async function removeSession(run, session, force, ask, interactive) {
         return "kept";
       }
     }
-    rmSync10(session.worktree, { recursive: true, force: true });
+    rmSync11(session.worktree, { recursive: true, force: true });
     const kept = preserved.length > 0 ? ` Its branches are kept as refs/maesttro/${session.id}/*.` : "";
     console.log(`Removed session ${session.id}.${kept}`);
   } else {
@@ -5245,10 +5287,10 @@ function removeStaleRunnerImages({
 // src/version-check.ts
 import { execFile } from "node:child_process";
 import { existsSync as existsSync7, readFileSync as readFileSync12 } from "node:fs";
-import { join as join16 } from "node:path";
+import { join as join17 } from "node:path";
 var LOOKUP_TIMEOUT_MS = 3000;
 function installedManifest() {
-  return JSON.parse(readFileSync12(join16(PACKAGE_ROOT, "package.json"), "utf8"));
+  return JSON.parse(readFileSync12(join17(PACKAGE_ROOT, "package.json"), "utf8"));
 }
 function canOfferUpdate({
   interactive = Boolean(process.stdin.isTTY && process.stdout.isTTY),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maesttro",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Isolated Docker runner for local coding agents (opencode, claude, ...) under a dedicated bot GitHub identity, with curated configs baked in per client.",
   "type": "module",
   "bin": {