fix: bound remote agent execution and secure demo state

.gitignore

@@ -7,4 +7,5 @@ releases/
 experiments/agent-changes/.wrangler/
 experiments/agent-changes/worker-configuration.d.ts
 experiments/agent-changes/.dev.vars
+experiments/agent-changes/.dev.vars.*
 experiments/agent-changes/.env*

experiments/agent-changes/README.md

@@ -22,7 +22,9 @@ pnpm wrangler secret put DEMO_TOKEN
 pnpm deploy
 ```
 
-Generate a long random `DEMO_TOKEN` and enter it using Wrangler's secret prompt. **Never place it in source, `.env`, a URL parameter, or commit history.** The browser prompts for the token and retains it in `sessionStorage` for the current tab session. A demo token gates all `/api/*` endpoints; this is intentionally not multi-user authentication.
+Generate a long random `DEMO_TOKEN` and enter it using Wrangler's secret prompt. **Never place it in source, `.env`, a URL parameter, or commit history.** The browser keeps this token only in React memory until page refresh. A demo token gates all `/api/*` endpoints; this is intentionally not multi-user authentication.
+
+For local development, create an ignored `experiments/agent-changes/.dev.vars` file containing `DEMO_TOKEN=your-local-token`, run `pnpm build`, and then `pnpm dev`. Local Durable Object state is not shared with deployed state, but the Artifacts binding uses `remote: true`: local requests still create repositories in the *real* `devspace-agent-changes` namespace. Use disposable repositories and clean up any test repos manually in Wrangler or the Cloudflare dashboard. `wrangler secret put` applies to the remote deployment and may publish a Worker version; it does not configure local secrets.
 
 If `wrangler artifacts namespaces list` reports **10004 Access denied**, first resolve Artifacts availability/permission on the account. No subsequent steps can validate real repository operations until this works.
 
@@ -52,15 +54,15 @@ All `/api/*` routes require `Authorization: Bearer <DEMO_TOKEN>`.
 | `POST /api/projects/:id/accept` | `{ "taskId": "..." }`, merges one completed proposal |
 | `GET /health` | Unauthenticated health response |
 
-Project IDs are durable and are kept in the browser URL (`?project=<id>`). All runnable task contexts are assigned their own DO storage. Only **two agents and one comparison per project** are supported in v0. Diff previews are capped at 32 KB; agent turns are capped at eight, and the Worker does not expose Git tokens in API responses.
+Project IDs are durable and are kept in the browser URL (`?project=<id>`). All runnable task contexts are assigned their own DO storage. Only **two agents and one comparison per project** are supported in v0. Diff previews are capped at 32 KB; agent turns are capped at eight, with a maximum of 24 tool calls and a four-minute deadline checked between turns. In-flight shell execution can exceed that deadline. The Worker does not expose Git tokens in API responses.
 
 ## Intentional limits
 
 - No GitHub OAuth, private-repository import, external GitHub publishing, or end-user accounts.
 - No persisted full agent transcript or live tool-call log in the UI. Agent summaries and committed Git changes are exposed.
 - Automated test outcomes are **not recorded** as a verified separate artifact. The UI says so rather than claiming tests passed.
 - No AI conflict resolution. Accepting an outdated proposal returns an error; genuine cherry-pick conflicts remain local to the integration directory.
-- Compute retry/restart recovery, timeouts, quota enforcement, cleanup of stale forks, and private execution isolation need substantial hardening before any production use.
+- Agent execution can continue across container replacement because files live in Computer's DO-backed filesystem, but autonomous recovery of interrupted model loops is not implemented. In-flight shell commands can outlast the four-minute turn deadline; quota enforcement, fork garbage collection, and production-grade isolation need further hardening.
 - Cloudflare resource usage and Workers AI inference are billable. Do not expose this demo token publicly or use it with repositories containing secrets.
 
 The Workers AI transport adapter in `src/workers-ai.ts` is adapted from the MIT-licensed [`cloudflare/computer` pi-ai example](https://github.com/cloudflare/computer/tree/main/examples/pi-ai); the `Dockerfile` is based on its MIT-licensed Think/Linux example.

experiments/agent-changes/package.json

@@ -24,12 +24,11 @@
     "@vitejs/plugin-react": "^6.0.0",
     "@types/react": "^19.2.0",
     "@types/react-dom": "^19.2.0",
-    "@cloudflare/workers-types": "5.20261009.1",
     "@types/node": "^26.6.4",
     "tsx": "^4.22.3",
     "typescript": "^6.0.3",
     "tailwindcss": "^4.1.0",
     "vite": "^8.0.0",
-    "wrangler": "^4.137.0"
+    "wrangler": "^4.145.0"
   }
 }

experiments/agent-changes/src/domain.ts

@@ -29,29 +29,32 @@ export interface ProposalDiff {
   truncated: boolean;
 }
 
+export class InputError extends Error {}
+
 export function publicGitUrl(value: unknown): string {
-  if (typeof value !== "string") throw new Error("sourceUrl must be a public HTTPS Git URL");
-  const url = new URL(value);
+  if (typeof value !== "string") throw new InputError("sourceUrl must be a public HTTPS Git URL");
+  let url: URL;
+  try { url = new URL(value); } catch { throw new InputError("sourceUrl must be a public HTTPS Git URL"); }
   if (url.protocol !== "https:" || url.username || url.password || url.port || !url.hostname ||
     /^(localhost|127\.|10\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.|169\.254\.|\[)/i.test(url.hostname)) {
-    throw new Error("sourceUrl must be a public HTTPS Git URL");
+    throw new InputError("sourceUrl must be a public HTTPS Git URL");
   }
   // V0 intentionally supports GitHub public repositories only; no server-side arbitrary URL fetches.
   if (url.hostname !== "github.com" || !/^\/[\w.-]+\/[\w.-]+(?:\.git)?\/?$/.test(url.pathname)) {
-    throw new Error("V0 accepts public github.com repository URLs only");
+    throw new InputError("V0 accepts public github.com repository URLs only");
   }
   return url.toString();
 }
 
 export function repoName(id: string, suffix?: string): string {
   const raw = `dsa-${id}${suffix ? `-${suffix}` : ""}`.toLowerCase();
-  if (!/^[a-z0-9-]{1,64}$/.test(raw)) throw new Error("Invalid repository identifier");
+  if (!/^[a-z0-9-]{1,64}$/.test(raw)) throw new InputError("Invalid repository identifier");
   return raw;
 }
 
 export function requirePrompt(value: unknown): string {
   if (typeof value !== "string" || !value.trim() || value.length > 2000) {
-    throw new Error("Task must contain 1–2000 characters");
+    throw new InputError("Task must contain 1–2000 characters");
   }
   return value.trim();
 }

experiments/agent-changes/src/git-integration.ts

@@ -0,0 +1,63 @@
+/** Quote interpolations as single POSIX shell arguments, including Git bearer credentials. */
+function sh(parts: TemplateStringsArray, ...values: unknown[]): string {
+  return parts.reduce((command, part, index) => {
+    const arg = index < values.length
+      ? `'${String(values[index]).replaceAll("'", "'\\''")}'`
+      : "";
+    return command + part + arg;
+  }, "");
+}
+
+export interface GitIntegrationInput {
+  baseRemote: string;
+  forkRemote: string;
+  baseCommit: string;
+  headCommit: string;
+  branch: string;
+  baseToken: string;
+  forkToken: string;
+}
+
+export interface GitCommandResult { exitCode: number; stdout: string }
+
+/** An isolated, one-shot Git operation. The checkout is always removed, even on failure. */
+export async function integrateGit(
+  input: GitIntegrationInput,
+  dir: string,
+  run: (command: string) => Promise<GitCommandResult>,
+): Promise<{ status: "merged" | "conflicted"; commit?: string }> {
+  if (![input.baseCommit, input.headCommit].every((sha) => /^[a-f0-9]{40}$/.test(sha))) {
+    throw new Error("Invalid proposal commit");
+  }
+  if (!/^\/workspace\/integration-[a-f0-9-]+$/.test(dir) && !/^\/tmp\/agent-integration-[a-f0-9-]+$/.test(dir)) {
+    throw new Error("Invalid integration directory");
+  }
+  const baseAuth = `http.extraHeader=Authorization: Bearer ${input.baseToken}`;
+  const forkAuth = `http.extraHeader=Authorization: Bearer ${input.forkToken}`;
+  const checked = async (command: string): Promise<string> => {
+    const result = await run(command);
+    if (result.exitCode !== 0) throw new Error("Git integration command failed");
+    return result.stdout.trim();
+  };
+
+  try {
+    await checked(sh`git -c ${baseAuth} clone ${input.baseRemote} ${dir}`);
+    const current = await checked(sh`git -C ${dir} rev-parse HEAD`);
+    if (current !== input.baseCommit) throw new Error("Project baseline has changed");
+
+    await checked(sh`git -C ${dir} -c ${forkAuth} fetch ${input.forkRemote} ${input.branch}`);
+    const applied = await run(sh`git -C ${dir} -c ${"user.name=DevSpace Integrator"} -c ${"user.email=merge@devspace.invalid"} cherry-pick ${input.headCommit}`);
+    if (applied.exitCode !== 0) {
+      const conflicts = await checked(sh`git -C ${dir} diff --name-only --diff-filter=U`);
+      if (conflicts) return { status: "conflicted" };
+      throw new Error("Git integration command failed");
+    }
+
+    const commit = await checked(sh`git -C ${dir} rev-parse HEAD`);
+    await checked(sh`git -C ${dir} -c ${baseAuth} push origin ${`HEAD:${input.branch}`}`);
+    return { status: "merged", commit };
+  } finally {
+    // Never let a leftover checkout turn a transient failure into a permanent one.
+    try { await run(sh`rm -rf -- ${dir}`); } catch { /* Best-effort cleanup. */ }
+  }
+}

experiments/agent-changes/src/project.ts

@@ -1,5 +1,12 @@
 import { DurableObject } from "cloudflare:workers";
-import type { Project, Task } from "./domain.js";
+import { InputError, type Project, type Task } from "./domain.js";
+
+interface Comparison {
+  prompts: [string, string];
+  taskIds: [string, string];
+  phase: "preparing" | "ready";
+  leaseUntil: number;
+}
 
 /** The per-project Durable Object is the authority for task and proposal metadata. */
 export class ProjectCoordinator extends DurableObject {
@@ -15,8 +22,50 @@ export class ProjectCoordinator extends DurableObject {
     return (await this.ctx.storage.get<Project>("project")) ?? null;
   }
 
+  /** Stable task IDs make a failed second fork resumable without launching a third agent. */
+  async beginComparison(prompts: [string, string], newTaskIds: [string, string]): Promise<
+    { state: "busy" | "ready" | "claimed"; taskIds: [string, string] }
+  > {
+    return this.ctx.storage.transaction(async (storage) => {
+      const current = await storage.get<Comparison>("comparison");
+      if (current && current.prompts.some((p, index) => p !== prompts[index])) {
+        throw new InputError("This project already has a different comparison");
+      }
+      if (current?.phase === "ready") return { state: "ready", taskIds: current.taskIds };
+      if (current && current.leaseUntil > Date.now()) return { state: "busy", taskIds: current.taskIds };
+      const taskIds = current?.taskIds ?? newTaskIds;
+      await storage.put("comparison", {
+        prompts, taskIds, phase: "preparing", leaseUntil: Date.now() + 120_000,
+      } satisfies Comparison);
+      return { state: "claimed", taskIds };
+    });
+  }
+
+  async finishComparison(success: boolean): Promise<void> {
+    await this.ctx.storage.transaction(async (storage) => {
+      const current = await storage.get<Comparison>("comparison");
+      if (!current) return;
+      await storage.put("comparison", {
+        ...current, phase: success ? "ready" : "preparing", leaseUntil: 0,
+      } satisfies Comparison);
+    });
+  }
+
+  async claimIntegration(): Promise<boolean> {
+    return this.ctx.storage.transaction(async (storage) => {
+      const lease = await storage.get<number>("integration:lease");
+      if (lease && lease > Date.now()) return false;
+      await storage.put("integration:lease", Date.now() + 10 * 60_000);
+      return true;
+    });
+  }
+
+  async releaseIntegration(): Promise<void> {
+    await this.ctx.storage.delete("integration:lease");
+  }
+
   async addTask(task: Task): Promise<void> {
-    if (await this.ctx.storage.get(`task:${task.id}`)) throw new Error("Duplicate task");
+    if (await this.ctx.storage.get(`task:${task.id}`)) return;
     await this.ctx.storage.put(`task:${task.id}`, task);
   }
 
@@ -29,7 +78,7 @@ export class ProjectCoordinator extends DurableObject {
   }
 
   async tasks(): Promise<Task[]> {
-    const entries = await this.ctx.storage.list<Task>({ prefix: "task:", limit: 20 });
+    const entries = await this.ctx.storage.list<Task>({ prefix: "task:", limit: 2 });
     return [...entries.values()];
   }