Job 0454f10d-60c0-4f27-9d83-bc225bf10b06

{"path": ".", "recursive": true}

/project/README.md
/project/cmd
/project/cmd/zoo
/project/cmd/zoo/main.go
/project/docker
/project/docker/Dockerfile
/project/docker/group
/project/docker/passwd
/project/docker/shadow
/project/docker/uid1000-sudo
/project/go.mod
/project/go.sum
/project/internal
/project/internal/agentrun
/project/internal/agentrun/context.go
/project/internal/agentrun/docker.go
/project/internal/agentrun/docker_integration_test.go
/project/internal/agentrun/forgejo.go
/project/internal/agentrun/loop.go
/project/internal/agentrun/roster.go
/project/internal/agentrun/roster_test.go
/project/internal/agentrun/run.go
/project/internal/agentrun/sandboxgit.go
/project/internal/agentrun/sandboxgit_test.go
/project/internal/agentrun/seed_test.go
/project/internal/agentrun/system.md
/project/internal/config
/project/internal/config/config.go
/project/internal/config/config_test.go
/project/internal/forgejo
/project/internal/forgejo/client.go
/project/internal/forgejo/client_test.go
/project/internal/forgejo/event.go
/project/internal/forgejo/poll.go
/project/internal/forgejo/poll_test.go
/project/internal/forgejo/repo_filter.go
/project/internal/forgejo/repo_filter_test.go
/project/internal/forgejo/watcher.go
/project/internal/forgejo/watcher_test.go
/project/internal/forgejo/webhook.go
/project/internal/forgejo/webhook_test.go
/project/internal/livelog
/project/internal/livelog/hub.go
/project/internal/livelog/hub_test.go
/project/internal/llm
/project/internal/llm/client.go
/project/internal/llm/streamer.go
/project/internal/llm/streamer_test.go
/project/internal/llm/types.go
/project/internal/scheduler
/project/internal/scheduler/scheduler.go
/project/internal/scheduler/scheduler_test.go
/project/internal/store
/project/internal/store/schema.sql
/project/internal/store/store.go
/project/internal/store/store_test.go
/project/internal/tools
/project/internal/tools/bash.go
/project/internal/tools/context.go
/project/internal/tools/edit-file.go
/project/internal/tools/forgejo.go
/project/internal/tools/grep_search.go
/project/internal/tools/list_files.go
/project/internal/tools/move_file.go
/project/internal/tools/read_file.go
/project/internal/tools/registry.go
/project/internal/tools/remove_file.go
/project/internal/tools/shell.go
/project/internal/tools/tools_test.go
/project/internal/tools/write_file.go
/project/internal/web
/project/internal/web/templates.go
/project/internal/web/web.go
/project/internal/web/web_test.go
/project/zoo.hcl.example

{"command": "cd /project && git log --oneline -10 && git branch -a"}

98298f6 Merge pull request 'Fix excessive vertical space in job view blocks (#53)' (#55) from issue-53-greg into main
b75b64d Fix excessive vertical space in job view blocks
10c3dce Better Docker/git inter.
315f993 Add docker image build.
5717258 Merge pull request 'forgejo: repository allowlist with wildcard patterns' (#40) from issue-39-greg into main
823ae62 fix(forgejo): resolve test helper collision after merging main
bccf930 Merge branch 'main' into issue-39-greg
1365ea8 Merge pull request 'Pass the agent's git credential to the sandbox, clone inside it' (#49) from issue-48-greg into main
7c60789 Remove the git tool and Context.Git per review
c3d3720 Pass the agent's git credential to the sandbox, clone inside it
* issue-56-greg
  main
  remotes/origin/main

{"path": "internal/agentrun/sandboxgit.go", "start_line": 1, "end_line": 200}

{"path":"internal/agentrun/sandboxgit.go","content":"package agentrun\n\nimport (\n\t\"context\"\n\t\"encoding/base64\"\n\t\"fmt\"\n\t\"net/url\"\n\t\"strings\"\n)\n\n// This file makes git \"just work\" inside the agent's container: the\n// initial clone happens in the sandbox, and the sandbox's git\n// credential is written to the container's system gitconfig so every\n// subsequent remote operation (pull, fetch, push, ...) authenticates\n// without any per-invocation plumbing. Zoo itself never runs git\n// outside the sandbox.\n\n// shellQuote wraps s in single quotes for safe interpolation into a\n// `sh -c` command string, escaping any embedded single quotes.\nfunc shellQuote(s string) string {\n\treturn \"'\" + strings.ReplaceAll(s, \"'\", `'\\''`) + \"'\"\n}\n\n// shellGitCmd renders `git \u003cargs...\u003e` as one sh -c command line with\n// every argument quoted, for docker exec.\nfunc shellGitCmd(args ...string) string {\n\tparts := make([]string, 0, len(args)+1)\n\tparts = append(parts, \"git\")\n\n\tfor _, a := range args {\n\t\tparts = append(parts, shellQuote(a))\n\t}\n\n\treturn strings.Join(parts, \" \")\n}\n\n// runSandboxGit runs `git \u003cargs...\u003e` inside containerID (in its\n// working directory, /project) and returns its combined output. A\n// non-zero exit code is an error carrying the output.\nfunc runSandboxGit(ctx context.Context, rt *dockerRuntime, containerID string, args ...string) (string, error) {\n\tout, exitCode, err := rt.exec(ctx, containerID, shellGitCmd(args...))\n\tif err != nil {\n\t\treturn out, err\n\t}\n\n\tif exitCode != 0 {\n\t\treturn out, fmt.Errorf(\"git %s: exit %d: %s\", args[0], exitCode, out)\n\t}\n\n\treturn out, nil\n}\n\n// gitAuthHeader returns the value of an Authorization header that\n// authenticates git's smart-HTTP requests as user with token.\nfunc gitAuthHeader(user, token string) string {\n\tauth := base64.StdEncoding.EncodeToString([]byte(user + \":\" + token))\n\n\treturn \"Authorization: Basic \" + auth\n}\n\n// forgeHost returns the scheme+host prefix of cloneURL, e.g.\n// \"https://code.stdio.dk\" for \"https://code.stdio.dk/abrander/zoo.git\".\n// On a parse failure it falls back to the full URL, which is a valid\n// (narrower) prefix match too.\nfunc forgeHost(cloneURL string) string {\n\tu, err := url.Parse(cloneURL)\n\tif err != nil || u.Host == \"\" {\n\t\treturn cloneURL\n\t}\n\n\treturn u.Scheme + \"://\" + u.Host\n}\n\n// configureSandboxGit writes the container's system gitconfig so git\n// works inside the sandbox without further setup:\n//\n//   - safe.directory '*', so the bind-mounted /project is accepted\n//     regardless of which UID the container runs git as;\n//   - user.name / user.email, so commits are attributed to the agent;\n//   - http.\u003chost\u003e.extraHeader carrying the run's Forgejo credential,\n//     scoped to the forge host the repository lives on, so\n//     clone/fetch/pull/push all authenticate transparently — including\n//     for submodules and other repos on the same forge. The token is\n//     only valid on that forge anyway, so the host scope grants no\n//     extra access; git never sends it anywhere else;\n//   - push.autoSetupRemote, so a bare `git push` on the fresh working\n//     branch pushes it to origin and sets the upstream — after which\n//     a bare `git pull` works too.\n//\n// The credential lives in the container's own filesystem (ephemeral,\n// torn down with the container), never in the bind-mounted working\n// tree: the origin remote keeps the plain cloneURL, so the token can't\n// leak into the repo's .git/config, into a work dir zoo keeps on\n// failure, or anywhere the host can read it back.\nfunc configureSandboxGit(ctx context.Context, rt *dockerRuntime, containerID, cloneURL, user, token, name, email string) error {\n\tif _, err := runSandboxGit(ctx, rt, containerID, \"config\", \"--global\", \"--add\", \"safe.directory\", \"*\"); err != nil {\n\t\treturn fmt.Errorf(\"configure safe.directory: %w\", err)\n\t}\n\n\tif _, err := runSandboxGit(ctx, rt, containerID, \"config\", \"--global\", \"user.name\", name); err != nil {\n\t\treturn fmt.Errorf(\"configure user.name: %w\", err)\n\t}\n\n\tif _, err := runSandboxGit(ctx, rt, containerID, \"config\", \"--global\", \"user.email\", email); err != nil {\n\t\treturn fmt.Errorf(\"configure user.email: %w\", err)\n\t}\n\n\tif _, err := runSandboxGit(ctx, rt, containerID, \"config\", \"--global\", \"http.\"+forgeHost(cloneURL)+\".extraHeader\", gitAuthHeader(user, token)); err != nil {\n\t\treturn fmt.Errorf(\"configure git credential: %w\", err)\n\t}\n\n\tif _, err := runSandboxGit(ctx, rt, containerID, \"config\", \"--global\", \"push.autoSetupRemote\", \"true\"); err != nil {\n\t\treturn fmt.Errorf(\"configure push.autoSetupRemote: %w\", err)\n\t}\n\n\treturn nil\n}\n\n// cloneAndBranch clones cloneURL into /project inside the container\n// and checks out a fresh branch off defaultBranch. The clone\n// authenticates via the http.\u003chost\u003e.extraHeader configured by\n// configureSandboxGit, and the origin remote is left with the plain\n// cloneURL: no credential ends up in the working tree.\nfunc cloneAndBranch(ctx context.Context, rt *dockerRuntime, containerID, cloneURL, defaultBranch, branch string) error {\n\tif _, err := runSandboxGit(ctx, rt, containerID, \"clone\", \"--branch\", defaultBranch, \"--single-branch\", cloneURL, \"/project\"); err != nil {\n\t\treturn fmt.Errorf(\"clone: %w\", err)\n\t}\n\n\tif _, err := runSandboxGit(ctx, rt, containerID, \"checkout\", \"-b\", branch); err != nil {\n\t\treturn fmt.Errorf(\"checkout branch %q: %w\", branch, err)\n\t}\n\n\treturn nil\n}\n\n// clonePRHead clones cloneURL into /project inside the container and\n// checks out the pull request's head as a local branch named headRef,\n// so commits the agent makes push straight to the PR. The head is\n// fetched via the PR's refs/pull/\u003cn\u003e/head ref rather than by branch\n// name, which also works for PRs opened from a fork, where the head\n// branch doesn't exist in the base repo.\nfunc clonePRHead(ctx context.Context, rt *dockerRuntime, containerID, cloneURL, defaultBranch, headRef string, index int64) error {\n\tif _, err := runSandboxGit(ctx, rt, containerID, \"clone\", \"--branch\", defaultBranch, \"--single-branch\", cloneURL, \"/project\"); err != nil {\n\t\treturn fmt.Errorf(\"clone: %w\", err)\n\t}\n\n\tfetchRef := fmt.Sprintf(\"refs/pull/%d/head\", index)\n\n\tif _, err := runSandboxGit(ctx, rt, containerID, \"fetch\", \"--no-tags\", \"origin\", fetchRef); err != nil {\n\t\treturn fmt.Errorf(\"fetch PR %d head: %w\", index, err)\n\t}\n\n\tif _, err := runSandboxGit(ctx, rt, containerID, \"checkout\", \"-B\", headRef, \"FETCH_HEAD\"); err != nil {\n\t\treturn fmt.Errorf(\"checkout PR head %q: %w\", headRef, err)\n\t}\n\n\treturn nil\n}","start_line":1,"end_line":158,"total_lines":158,"truncated":false}

{"path": "internal/agentrun/docker.go", "start_line": 1, "end_line": 250}

{"path":"internal/agentrun/docker.go","content":"package agentrun\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\t\"io\"\n\t\"time\"\n\n\t\"github.com/docker/docker/api/types/container\"\n\t\"github.com/docker/docker/client\"\n)\n\n// containerCPUs and containerMemory bound each agent container's\n// resource usage; there's no per-agent config knob for this yet (see\n// TODO.md), so every run gets the same sane default.\nconst (\n\tcontainerNanoCPUs = 2_000_000_000 // 2 CPUs\n\tcontainerMemory   = 2 \u003c\u003c 30       // 2 GiB\n)\n\ntype dockerRuntime struct {\n\tcli *client.Client\n}\n\nfunc newDockerRuntime() (*dockerRuntime, error) {\n\tcli, err := client.NewClientWithOpts(client.FromEnv, client.WithAPIVersionNegotiation())\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"docker client: %w\", err)\n\t}\n\n\treturn \u0026dockerRuntime{cli: cli}, nil\n}\n\n// createContainer creates and starts a container from image with the\n// given bind mounts, kept alive with `sleep infinity` regardless of the\n// image's own entrypoint so it can be repeatedly `exec`'d into.\nfunc (d *dockerRuntime) createContainer(ctx context.Context, image string, binds []string, name string) (string, error) {\n\tresp, err := d.cli.ContainerCreate(ctx,\n\t\t\u0026container.Config{\n\t\t\tImage:      image,\n\t\t\tEntrypoint: []string{\"sleep\"},\n\t\t\tCmd:        []string{\"infinity\"},\n\t\t\tWorkingDir: \"/project\",\n\t\t},\n\t\t\u0026container.HostConfig{\n\t\t\tBinds: binds,\n\t\t\tResources: container.Resources{\n\t\t\t\tNanoCPUs: containerNanoCPUs,\n\t\t\t\tMemory:   containerMemory,\n\t\t\t},\n\t\t},\n\t\tnil, nil, name)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"create container: %w\", err)\n\t}\n\n\tif err := d.cli.ContainerStart(ctx, resp.ID, container.StartOptions{}); err != nil {\n\t\treturn \"\", fmt.Errorf(\"start container: %w\", err)\n\t}\n\n\treturn resp.ID, nil\n}\n\n// exec runs command via `sh -c` inside containerID and returns its\n// combined stdout+stderr (a TTY is attached so the two streams merge\n// without needing to demultiplex Docker's stdcopy framing) plus its exit\n// code.\nfunc (d *dockerRuntime) exec(ctx context.Context, containerID, command string) (string, int, error) {\n\tcreated, err := d.cli.ContainerExecCreate(ctx, containerID, container.ExecOptions{\n\t\tCmd: []string{\"sh\", \"-c\", command},\n\t\t// A TTY is attached (see doc comment above), which makes git's\n\t\t// isatty-based color.ui=auto default to enabling ANSI color codes\n\t\t// that pollute the captured job log. NO_COLOR covers tools that\n\t\t// honor that convention; the GIT_CONFIG_* override forces git's\n\t\t// own color.ui to \"never\" regardless of tty detection, since git\n\t\t// does not honor NO_COLOR itself.\n\t\t//\n\t\t// The same isatty check makes git launch a pager for diff/log/show,\n\t\t// and the pager (waiting on a stdin nothing ever attaches or\n\t\t// closes) then blocks forever with no way to time it out — see\n\t\t// exec's read loop below. GIT_PAGER/PAGER=cat disable that.\n\t\t// GIT_TERMINAL_PROMPT=0 closes the same class of hang for\n\t\t// credential prompts on a private remote.\n\t\tEnv: []string{\n\t\t\t\"NO_COLOR=1\",\n\t\t\t\"GIT_CONFIG_COUNT=1\",\n\t\t\t\"GIT_CONFIG_KEY_0=color.ui\",\n\t\t\t\"GIT_CONFIG_VALUE_0=never\",\n\t\t\t\"GIT_PAGER=cat\",\n\t\t\t\"PAGER=cat\",\n\t\t\t\"GIT_TERMINAL_PROMPT=0\",\n\t\t},\n\t\tTty:          true,\n\t\tAttachStdout: true,\n\t\tAttachStderr: true,\n\t})\n\tif err != nil {\n\t\treturn \"\", 0, fmt.Errorf(\"exec create: %w\", err)\n\t}\n\n\tattached, err := d.cli.ContainerExecAttach(ctx, created.ID, container.ExecAttachOptions{Tty: true})\n\tif err != nil {\n\t\treturn \"\", 0, fmt.Errorf(\"exec attach: %w\", err)\n\t}\n\tdefer attached.Close()\n\n\t// Once hijacked, this stream is a raw connection that ctx cancellation\n\t// no longer reaches — a wedged child process (pager, credential\n\t// prompt, anything else reading a stdin nobody attaches) would\n\t// otherwise block this read forever, past the run's deadline, with no\n\t// way to recover the job. Race the read against ctx and force-remove\n\t// the container to sever the connection if it fires.\n\ttype readResult struct {\n\t\toutput []byte\n\t\terr    error\n\t}\n\n\treadDone := make(chan readResult, 1)\n\n\tgo func() {\n\t\toutput, err := io.ReadAll(attached.Reader)\n\t\treadDone \u003c- readResult{output, err}\n\t}()\n\n\tvar output []byte\n\n\tselect {\n\tcase res := \u003c-readDone:\n\t\tif res.err != nil {\n\t\t\treturn \"\", 0, fmt.Errorf(\"exec read output: %w\", res.err)\n\t\t}\n\n\t\toutput = res.output\n\n\tcase \u003c-ctx.Done():\n\t\tkillCtx, cancel := context.WithTimeout(context.Background(), 10*time.Second)\n\t\tdefer cancel()\n\n\t\t_ = d.cli.ContainerRemove(killCtx, containerID, container.RemoveOptions{Force: true})\n\t\t\u003c-readDone\n\n\t\treturn \"\", 0, ctx.Err()\n\t}\n\n\tinspect, err := d.cli.ContainerExecInspect(ctx, created.ID)\n\tif err != nil {\n\t\treturn string(output), 0, fmt.Errorf(\"exec inspect: %w\", err)\n\t}\n\n\treturn string(output), inspect.ExitCode, nil\n}\n\n// remove force-stops and removes containerID, ignoring \"already gone\"\n// errors so cleanup is safe to call unconditionally.\nfunc (d *dockerRuntime) remove(ctx context.Context, containerID string) error {\n\ttimeout := 5\n\t_ = d.cli.ContainerStop(ctx, containerID, container.StopOptions{Timeout: \u0026timeout})\n\n\tif err := d.cli.ContainerRemove(ctx, containerID, container.RemoveOptions{Force: true}); err != nil {\n\t\treturn fmt.Errorf(\"remove container: %w\", err)\n\t}\n\n\treturn nil\n}\n\nfunc (d *dockerRuntime) kill(ctx context.Context, containerID string) {\n\t_ = d.cli.ContainerKill(ctx, containerID, \"KILL\")\n}","start_line":1,"end_line":168,"total_lines":168,"truncated":false}

{"path": "internal/agentrun/run.go", "start_line": 1, "end_line": 250}

{"path":"internal/agentrun/run.go","content":"// Package agentrun creates the throwaway per-job environment an agent\n// runs in: a Docker container with the agent's git working tree cloned\n// inside it (authenticated with the agent's own Forgejo token), the\n// triggering event written to /event, and the tool-calling loop\n// (internal/llm + internal/tools) driven against it.\npackage agentrun\n\nimport (\n\t\"context\"\n\t_ \"embed\"\n\t\"encoding/json\"\n\t\"fmt\"\n\t\"log/slog\"\n\t\"os\"\n\t\"path/filepath\"\n\t\"strings\"\n\t\"sync\"\n\t\"time\"\n\n\t\"github.com/abrander/zoo/internal/config\"\n\t\"github.com/abrander/zoo/internal/forgejo\"\n\t\"github.com/abrander/zoo/internal/livelog\"\n\t\"github.com/abrander/zoo/internal/llm\"\n\t\"github.com/abrander/zoo/internal/store\"\n)\n\n//go:embed system.md\nvar defaultSystemPrompt string\n\n// DefaultTimeout bounds a single agent run's wall-clock time if the\n// caller doesn't override it.\nconst DefaultTimeout = 120 * time.Minute\n\ntype Runner struct {\n\tdocker        *dockerRuntime\n\tforgejo       *forgejo.Client\n\tstore         *store.Store\n\thub           *livelog.Hub\n\tcfg           *config.Config\n\tlogger        *slog.Logger\n\ttimeout       time.Duration\n\tkeepOnFailure bool\n\n\tagentClientsMu sync.Mutex\n\tagentClients   map[string]*forgejo.Client\n}\n\nfunc NewRunner(cfg *config.Config, fg *forgejo.Client, st *store.Store, hub *livelog.Hub, logger *slog.Logger, timeout time.Duration, keepOnFailure bool) (*Runner, error) {\n\tdocker, err := newDockerRuntime()\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tif timeout \u003c= 0 {\n\t\ttimeout = DefaultTimeout\n\t}\n\n\treturn \u0026Runner{\n\t\tdocker:        docker,\n\t\tforgejo:       fg,\n\t\tstore:         st,\n\t\thub:           hub,\n\t\tcfg:           cfg,\n\t\tlogger:        logger,\n\t\ttimeout:       timeout,\n\t\tkeepOnFailure: keepOnFailure,\n\t\tagentClients:  make(map[string]*forgejo.Client),\n\t}, nil\n}\n\n// forgejoAs returns a Forgejo client that authenticates as the given\n// agent (using the agent's own token from config). This lets each agent\n// act as themselves on Forgejo without needing a global token with sudo\n// privileges. Clients are built once per agent and cached, since\n// constructing one costs an extra API round trip.\n//\n// If the agent has no token configured, falls back to the shared zoo\n// identity so existing deployments without per-agent tokens still work.\nfunc (r *Runner) forgejoAs(agentName, token string) *forgejo.Client {\n\tr.agentClientsMu.Lock()\n\tdefer r.agentClientsMu.Unlock()\n\n\tif c, ok := r.agentClients[agentName]; ok {\n\t\treturn c\n\t}\n\n\tvar c *forgejo.Client\n\tif token != \"\" {\n\t\tc = r.forgejo.As(token)\n\t} else {\n\t\t// Fallback: use shared identity. Optionally log a warning\n\t\t// if we ever want to enforce per-agent tokens.\n\t\tc = r.forgejo\n\t}\n\n\tr.agentClients[agentName] = c\n\n\treturn c\n}\n\n// Run implements scheduler.Runner.\nfunc (r *Runner) Run(ctx context.Context, jobID string, agent config.AgentConfig, llmCfg config.LLM, dockerImage string, ev forgejo.Event) error {\n\tctx, cancel := context.WithTimeout(ctx, r.timeout)\n\tdefer cancel()\n\n\tlogger := r.logger.With(\"job\", jobID, \"agent\", agent.Name)\n\n\trepoInfo, err := r.forgejo.RepositoryInfo(ev.Owner, ev.Repo)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"look up repository: %w\", err)\n\t}\n\n\tworkDir, err := os.MkdirTemp(\"\", \"zoo-run-*\")\n\tif err != nil {\n\t\treturn fmt.Errorf(\"create work dir: %w\", err)\n\t}\n\n\tsucceeded := false\n\n\tdefer func() {\n\t\tif succeeded || !r.keepOnFailure {\n\t\t\tos.RemoveAll(workDir)\n\t\t} else {\n\t\t\tlogger.Warn(\"keeping work dir after failure\", \"dir\", workDir)\n\t\t}\n\t}()\n\n\t// The container bind-mounts projectDir as /project and does the\n\t// initial clone into it, so the (empty) directory must exist on the\n\t// host before the container is created — otherwise Docker would\n\t// create it itself, root-owned.\n\tprojectDir := filepath.Join(workDir, \"project\")\n\n\tif err := os.MkdirAll(projectDir, 0o755); err != nil {\n\t\treturn fmt.Errorf(\"create project dir: %w\", err)\n\t}\n\n\t// A pr:review run works on the PR's own head branch, so the agent's\n\t// commits push straight to the PR. Every other event kind branches\n\t// off the default branch as usual.\n\tvar review *forgejo.ReviewDetail\n\tbranch := fmt.Sprintf(\"issue-%d-%s\", ev.Index, agent.Name)\n\n\tif ev.Kind == forgejo.EventPRReview {\n\t\t// Always fetch the current head ref, not just when the event\n\t\t// lacks one (the polling path doesn't carry it): the webhook's\n\t\t// copy could be stale if the PR's head branch was renamed since\n\t\t// the review, and the push target depends on it.\n\t\theadRef := ev.HeadRef\n\n\t\tif prInfo, err := r.forgejo.PullRequestInfo(ev.Owner, ev.Repo, ev.Index); err != nil {\n\t\t\tlogger.Warn(\"fetch pull request head failed; falling back to the event's head ref\", \"error\", err)\n\t\t} else if prInfo.HeadRef != \"\" {\n\t\t\theadRef = prInfo.HeadRef\n\t\t}\n\n\t\tif headRef == \"\" {\n\t\t\treturn fmt.Errorf(\"pr:review event has no pull request head branch to check out\")\n\t\t}\n\n\t\tbranch = headRef\n\n\t\t// Fetch the full review (verdict, body, inline comments) so the\n\t\t// agent sees all the feedback, not just the triggering event. A\n\t\t// failure degrades to no review detail rather than failing the\n\t\t// run: the agent can still do its job, just without the inline\n\t\t// comments.\n\t\treview, err = r.forgejo.ReviewDetail(ev.Owner, ev.Repo, ev.Index, ev.ReviewID)\n\t\tif err != nil {\n\t\t\tlogger.Warn(\"fetch review detail failed; agent will not see inline review comments\", \"error\", err)\n\t\t\treview = nil\n\t\t}\n\t}\n\n\troster := buildRoster(r.forgejo, r.cfg.Agents, logger)\n\tgitName, gitEmail := gitIdentity(agent.Name, roster)\n\n\t// The credential the sandbox's git uses for remote operations: the\n\t// agent's own Forgejo token when configured, so its git activity is\n\t// attributed to its own account, falling back to the shared zoo\n\t// identity for deployments without per-agent tokens (mirroring\n\t// forgejoAs).\n\tgitUser, gitToken := \"zoo\", r.forgejo.Token()\n\n\tif agent.Token != \"\" {\n\t\tgitUser, gitToken = agent.Name, agent.Token\n\t}\n\n\teventPath := filepath.Join(workDir, \"event.json\")\n\tif err := os.WriteFile(eventPath, ev.Raw, 0o644); err != nil {\n\t\treturn fmt.Errorf(\"write event file: %w\", err)\n\t}\n\n\tcontainerID, err := r.docker.createContainer(ctx, dockerImage, []string{\n\t\tprojectDir + \":/project\",\n\t\teventPath + \":/event:ro\",\n\t}, fmt.Sprintf(\"zoo-issue-%d-%s\", ev.Index, agent.Name))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"start container: %w\", err)\n\t}\n\n\tdefer func() {\n\t\tcleanupCtx, cleanupCancel := context.WithTimeout(context.Background(), 30*time.Second)\n\t\tdefer cleanupCancel()\n\t\tif err := r.docker.remove(cleanupCtx, containerID); err != nil {\n\t\t\tlogger.Warn(\"failed to remove container\", \"container\", containerID, \"error\", err)\n\t\t}\n\t}()\n\n\t// Git must simply work inside the sandbox: safe.directory, commit\n\t// identity, and the remote credential all go into the container's\n\t// system gitconfig (see configureSandboxGit).\n\tif err := configureSandboxGit(ctx, r.docker, containerID, repoInfo.CloneURL, gitUser, gitToken, gitName, gitEmail); err != nil {\n\t\treturn fmt.Errorf(\"configure git in container: %w\", err)\n\t}\n\n\t// The initial clone happens inside the sandbox, so the working tree\n\t// is owned by the container's user and git never runs on the host.\n\tif ev.Kind == forgejo.EventPRReview {\n\t\tif err := clonePRHead(ctx, r.docker, containerID, repoInfo.CloneURL, repoInfo.DefaultBranch, branch, ev.Index); err != nil {\n\t\t\treturn fmt.Errorf(\"prepare git working tree: %w\", err)\n\t\t}\n\t} else {\n\t\tif err := cloneAndBranch(ctx, r.docker, containerID, repoInfo.CloneURL, repoInfo.DefaultBranch, branch); err != nil {\n\t\t\treturn fmt.Errorf(\"prepare git working tree: %w\", err)\n\t\t}\n\t}\n\n\tlogAppend := func(stream, line string) {\n\t\tif err := r.store.AppendLog(context.Background(), jobID, stream, line); err != nil {\n\t\t\tlogger.Warn(\"failed to append log\", \"error\", err)\n\t\t}\n\t}\n\n\trunCtx := \u0026runContext{\n\t\tdocker:      r.docker,\n\t\tcontainerID: containerID,\n\t\tforgejo: \u0026runForgejoActions{\n\t\t\tclient: r.forgejoAs(agent.Name, agent.Token),\n\t\t\towner:  ev.Owner,\n\t\t\trepo:   ev.Repo,\n\t\t\tindex:  ev.Index,\n\t\t\tlogger: logger,\n\t\t},\n\t}\n\n\tllmClient := llm.NewClient(llmCfg)\n\n\tsystemPrompt := defaultSystemPrompt + identitySection(agent.Name, roster)\n","start_line":1,"end_line":250,"total_lines":437,"truncated":true}

{"path": "internal/config/config.go", "start_line": 1, "end_line": 250}

{"path":"internal/config/config.go","content":"// Package config loads and validates zoo's HCL configuration file.\npackage config\n\nimport (\n\t\"fmt\"\n\t\"strings\"\n\n\t\"github.com/hashicorp/hcl/v2/hclsimple\"\n)\n\n// Known event kinds. issue:assigned and pr:review are resolved\n// dynamically (agent name must match the Forgejo assignee's username,\n// or the pull request author's username, respectively) so they never\n// carry an `agent` attribute; the rest map statically to one\n// configured agent.\nconst (\n\tEventIssueNew      = \"issue:new\"\n\tEventIssueComment  = \"issue:comment\"\n\tEventIssueAssigned = \"issue:assigned\"\n\tEventPRNew         = \"pr:new\"\n\tEventPRReview      = \"pr:review\"\n)\n\nvar staticEventKinds = map[string]bool{\n\tEventIssueNew:     true,\n\tEventIssueComment: true,\n\tEventPRNew:        true,\n}\n\ntype Config struct {\n\tLLMs        []LLM       `hcl:\"llm,block\"`\n\tForgejo     Forgejo     `hcl:\"forgejo,block\"`\n\tEnvironment Environment `hcl:\"environment,block\"`\n\tAgents      []Agent     `hcl:\"agent,block\"`\n\tEvents      []Event     `hcl:\"event,block\"`\n\tWeb         *Web        `hcl:\"web,block\"`\n}\n\n// Web configures the dashboard's optional bearer-token gate. Leave the\n// block out of zoo.hcl entirely to run without one (fine on localhost;\n// put a real gate or a proxy in front for anything else).\ntype Web struct {\n\tToken string `hcl:\"token,optional\"`\n}\n\ntype LLM struct {\n\tName   string `hcl:\"name,label\"`\n\tOpenAI string `hcl:\"openai\"`\n\tToken  string `hcl:\"token\"`\n\tModel  string `hcl:\"model\"`\n}\n\ntype Forgejo struct {\n\tURL           string `hcl:\"url\"`\n\tToken         string `hcl:\"token\"`\n\tWebhookSecret string `hcl:\"webhook_secret,optional\"`\n\n\t// Repos is the allowlist of repository patterns to watch, e.g.\n\t// [\"acme/*\", \"acme/widgets\"]. Patterns are \"owner/repo\" pairs with\n\t// glob wildcards; \"*\" watches everything on the instance. An empty\n\t// list keeps the historical behavior of watching every repository\n\t// the token can see.\n\tRepos []string `hcl:\"repos,optional\"`\n}\n\ntype Environment struct {\n\tDockerImage string `hcl:\"docker_image\"`\n\tMaxLive     int    `hcl:\"max_live_agents\"`\n}\n\ntype Agent struct {\n\tName  string `hcl:\"name,label\"`\n\tLLM   string `hcl:\"llm\"`\n\tToken string `hcl:\"token,optional\"`\n}\n\ntype Event struct {\n\tKind         string `hcl:\"name,label\"`\n\tAgent        string `hcl:\"agent,optional\"`\n\tInstructions string `hcl:\"instructions,optional\"`\n}\n\n// Load reads and validates the config file at path.\nfunc Load(path string) (*Config, error) {\n\tvar cfg Config\n\n\tif err := hclsimple.DecodeFile(path, nil, \u0026cfg); err != nil {\n\t\treturn nil, fmt.Errorf(\"parse config: %w\", err)\n\t}\n\n\tif err := cfg.Validate(); err != nil {\n\t\treturn nil, fmt.Errorf(\"invalid config: %w\", err)\n\t}\n\n\treturn \u0026cfg, nil\n}\n\n// Validate checks that the config is internally consistent: every\n// reference between blocks resolves, and required values are set.\nfunc (c *Config) Validate() error {\n\tllmNames := make(map[string]bool, len(c.LLMs))\n\tfor _, l := range c.LLMs {\n\t\tif l.OpenAI == \"\" || l.Token == \"\" || l.Model == \"\" {\n\t\t\treturn fmt.Errorf(\"llm %q: openai, token, and model are required\", l.Name)\n\t\t}\n\t\tllmNames[l.Name] = true\n\t}\n\n\tif c.Forgejo.URL == \"\" || c.Forgejo.Token == \"\" {\n\t\treturn fmt.Errorf(\"forgejo: url and token are required\")\n\t}\n\n\tfor _, p := range c.Forgejo.Repos {\n\t\tif err := validRepoPattern(p); err != nil {\n\t\t\treturn fmt.Errorf(\"forgejo: %w\", err)\n\t\t}\n\t}\n\n\tif c.Environment.MaxLive \u003c 1 {\n\t\treturn fmt.Errorf(\"environment: max_live_agents must be \u003e= 1, got %d\", c.Environment.MaxLive)\n\t}\n\n\tif c.Environment.DockerImage == \"\" {\n\t\treturn fmt.Errorf(\"environment: docker_image is required\")\n\t}\n\n\tagentNames := make(map[string]bool, len(c.Agents))\n\tfor _, a := range c.Agents {\n\t\tif !llmNames[a.LLM] {\n\t\t\treturn fmt.Errorf(\"agent %q: references undeclared llm %q\", a.Name, a.LLM)\n\t\t}\n\t\tagentNames[a.Name] = true\n\t}\n\n\tseenEventKinds := make(map[string]bool, len(c.Events))\n\tfor _, e := range c.Events {\n\t\tif seenEventKinds[e.Kind] {\n\t\t\treturn fmt.Errorf(\"event %q: declared more than once\", e.Kind)\n\t\t}\n\t\tseenEventKinds[e.Kind] = true\n\n\t\tswitch {\n\t\tcase e.Kind == EventIssueAssigned:\n\t\t\tif e.Agent != \"\" {\n\t\t\t\treturn fmt.Errorf(\"event %q: must not set agent; the agent whose name matches the Forgejo assignee's username is triggered dynamically\", e.Kind)\n\t\t\t}\n\n\t\tcase e.Kind == EventPRReview:\n\t\t\tif e.Agent != \"\" {\n\t\t\t\treturn fmt.Errorf(\"event %q: must not set agent; the agent whose name matches the pull request author's username is triggered dynamically\", e.Kind)\n\t\t\t}\n\n\t\tcase staticEventKinds[e.Kind]:\n\t\t\tif e.Agent == \"\" {\n\t\t\t\treturn fmt.Errorf(\"event %q: agent is required\", e.Kind)\n\t\t\t}\n\t\t\tif !agentNames[e.Agent] {\n\t\t\t\treturn fmt.Errorf(\"event %q: references undeclared agent %q\", e.Kind, e.Agent)\n\t\t\t}\n\n\t\tdefault:\n\t\t\treturn fmt.Errorf(\"event %q: unknown event kind\", e.Kind)\n\t\t}\n\t}\n\n\treturn nil\n}\n\n// validRepoPattern checks the shape of a forgejo `repos` entry. It must\n// be a non-empty \"owner/repo\" pair (or a bare owner name, or \"*\") — at\n// most one slash, none at either end. Glob syntax within the segments\n// is validated later by forgejo.NewRepoFilter.\nfunc validRepoPattern(p string) error {\n\tif p == \"\" {\n\t\treturn fmt.Errorf(\"repos: pattern must not be empty\")\n\t}\n\n\tif strings.Count(p, \"/\") \u003e 1 {\n\t\treturn fmt.Errorf(\"repos: pattern %q must be \\\"owner/repo\\\" (at most one \\\"/\\\")\", p)\n\t}\n\n\tif strings.HasPrefix(p, \"/\") || strings.HasSuffix(p, \"/\") {\n\t\treturn fmt.Errorf(\"repos: pattern %q must not start or end with \\\"/\\\"\", p)\n\t}\n\n\treturn nil\n}\n\n// AgentConfig holds an agent's full configuration including its\n// Forgejo token (if configured).\ntype AgentConfig struct {\n\tName  string\n\tLLM   string\n\tToken string\n}\n\n// AgentByName returns the agent config with the given name, if declared.\nfunc (c *Config) AgentByName(name string) (AgentConfig, bool) {\n\tfor _, a := range c.Agents {\n\t\tif a.Name == name {\n\t\t\treturn AgentConfig{\n\t\t\t\tName:  a.Name,\n\t\t\t\tLLM:   a.LLM,\n\t\t\t\tToken: a.Token,\n\t\t\t}, true\n\t\t}\n\t}\n\n\treturn AgentConfig{}, false\n}\n\n// LLMByName returns the llm config with the given name, if declared.\nfunc (c *Config) LLMByName(name string) (LLM, bool) {\n\tfor _, l := range c.LLMs {\n\t\tif l.Name == name {\n\t\t\treturn l, true\n\t\t}\n\t}\n\n\treturn LLM{}, false\n}\n\n// EventAgent returns the statically configured agent name for the given\n// event kind, if one is declared and set.\nfunc (c *Config) EventAgent(kind string) (string, bool) {\n\tfor _, e := range c.Events {\n\t\tif e.Kind == kind {\n\t\t\treturn e.Agent, e.Agent != \"\"\n\t\t}\n\t}\n\n\treturn \"\", false\n}\n\n// EventInstructions returns the configured freeform instructions for the\n// given event kind, e.g. \"Please review this pull request and respond\n// appropriately.\" Returns \"\" if the event isn't declared or has none.\nfunc (c *Config) EventInstructions(kind string) string {\n\tfor _, e := range c.Events {\n\t\tif e.Kind == kind {\n\t\t\treturn e.Instructions\n\t\t}\n\t}\n\n\treturn \"\"\n}","start_line":1,"end_line":246,"total_lines":246,"truncated":false}

{"end_line": 437, "path": "internal/agentrun/run.go", "start_line": 250}

{"path":"internal/agentrun/run.go","content":"\n\tinstructions := r.cfg.EventInstructions(ev.Kind)\n\n\t// Fetch the full comment thread so the agent sees everything that's\n\t// been said on the issue/PR, not just the triggering event (which\n\t// only carries the latest comment, if any). A failure degrades to\n\t// no comments rather than failing the run: the agent can still do\n\t// its job, just without prior context.\n\tcomments, err := r.forgejo.ListIssueComments(ev.Owner, ev.Repo, ev.Index)\n\tif err != nil {\n\t\tlogger.Warn(\"fetch issue comments failed; agent will not see prior comments\", \"error\", err)\n\t\tcomments = nil\n\t}\n\n\tmessages := []llm.Message{\n\t\t{Role: \"system\", Content: systemPrompt},\n\t\t{Role: \"user\", Content: seedMessage(ev, branch, repoInfo.DefaultBranch, instructions, comments, review)},\n\t}\n\n\thooks := r.streamHooks(jobID, logAppend)\n\n\t_, err = runLoop(ctx, llmClient, runCtx, messages, hooks)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"agent loop: %w\", err)\n\t}\n\n\tsucceeded = true\n\n\treturn nil\n}\n\n// streamHooks builds the Hooks a single Run passes to runLoop: every\n// delta is published live to the hub for connected dashboard viewers,\n// and once a reasoning/content block or tool call is complete, it's\n// persisted to the store as one row and the hub's replay buffer for\n// jobID is checkpointed — so a viewer connecting from this point on\n// sees it via the persisted history instead of a live replay, and is\n// never shown it twice.\nfunc (r *Runner) streamHooks(jobID string, logAppend func(stream, line string)) Hooks {\n\tvar reasoningBuf, contentBuf strings.Builder\n\n\treasoningOpen, contentOpen := false, false\n\n\treturn Hooks{\n\t\tOnReasoningDelta: func(delta string) {\n\t\t\tif !reasoningOpen {\n\t\t\t\treasoningOpen = true\n\t\t\t\treasoningBuf.Reset()\n\t\t\t\tr.hub.Publish(jobID, livelog.Event{Type: livelog.ReasoningStart})\n\t\t\t}\n\n\t\t\treasoningBuf.WriteString(delta)\n\t\t\tr.hub.Publish(jobID, livelog.Event{Type: livelog.ReasoningDelta, Text: delta})\n\t\t},\n\t\tOnContentDelta: func(delta string) {\n\t\t\tif !contentOpen {\n\t\t\t\tcontentOpen = true\n\t\t\t\tcontentBuf.Reset()\n\t\t\t\tr.hub.Publish(jobID, livelog.Event{Type: livelog.ContentStart})\n\t\t\t}\n\n\t\t\tcontentBuf.WriteString(delta)\n\t\t\tr.hub.Publish(jobID, livelog.Event{Type: livelog.ContentDelta, Text: delta})\n\t\t},\n\t\tOnTurnEnd: func() {\n\t\t\tif reasoningOpen {\n\t\t\t\tr.hub.Publish(jobID, livelog.Event{Type: livelog.ReasoningEnd})\n\t\t\t\tlogAppend(\"reasoning\", reasoningBuf.String())\n\t\t\t\tr.hub.Checkpoint(jobID)\n\t\t\t\treasoningOpen = false\n\t\t\t}\n\n\t\t\tif contentOpen {\n\t\t\t\tr.hub.Publish(jobID, livelog.Event{Type: livelog.ContentEnd})\n\t\t\t\tlogAppend(\"content\", contentBuf.String())\n\t\t\t\tr.hub.Checkpoint(jobID)\n\t\t\t\tcontentOpen = false\n\t\t\t}\n\t\t},\n\t\tOnTool: func(name, arguments, result string, toolErr bool) {\n\t\t\tr.hub.Publish(jobID, livelog.Event{\n\t\t\t\tType:      livelog.Tool,\n\t\t\t\tName:      name,\n\t\t\t\tArguments: arguments,\n\t\t\t\tResult:    result,\n\t\t\t\tError:     toolErr,\n\t\t\t})\n\n\t\t\tline, err := json.Marshal(store.ToolLogEntry{Name: name, Arguments: arguments, Result: result, Error: toolErr})\n\t\t\tif err != nil {\n\t\t\t\tr.logger.Warn(\"failed to marshal tool log entry\", \"job\", jobID, \"error\", err)\n\t\t\t} else {\n\t\t\t\tlogAppend(\"tool\", string(line))\n\t\t\t}\n\n\t\t\tr.hub.Checkpoint(jobID)\n\t\t},\n\t}\n}\n\nfunc seedMessage(ev forgejo.Event, branch, defaultBranch, instructions string, comments []forgejo.IssueComment, review *forgejo.ReviewDetail) string {\n\traw, _ := json.MarshalIndent(json.RawMessage(ev.Raw), \"\", \"  \")\n\n\tvar instructionsSection string\n\tif instructions != \"\" {\n\t\tinstructionsSection = fmt.Sprintf(\"Instructions for this event, from zoo.hcl:\\n%s\\n\\n\", instructions)\n\t}\n\n\t// A pr:review run works on the PR's own head branch, not a fresh\n\t// branch off the default branch.\n\tbranchLine := fmt.Sprintf(\"Your working branch is %q, checked out from the default branch %q.\\n\\n\", branch, defaultBranch)\n\tif ev.Kind == forgejo.EventPRReview {\n\t\tbranchLine = fmt.Sprintf(\"Your working branch is %q, the pull request's head branch — commits you push here update the pull request directly.\\n\\n\", branch)\n\t}\n\n\tvar reviewSection string\n\tif review != nil {\n\t\treviewSection = renderReviewSection(review)\n\t}\n\n\tvar commentsSection string\n\tif len(comments) \u003e 0 {\n\t\tvar b strings.Builder\n\t\tfmt.Fprintf(\u0026b, \"Comments (%d):\\n\\n\", len(comments))\n\n\t\tfor i, c := range comments {\n\t\t\tfmt.Fprintf(\u0026b, \"%d. %s (%s):\\n%s\\n\\n\", i+1, c.Author, c.Created.Format(time.RFC3339), c.Body)\n\t\t}\n\n\t\tcommentsSection = b.String()\n\t}\n\n\treturn fmt.Sprintf(\n\t\t\"You were triggered by a %q event on %s/%s.\\n\\n\"+\n\t\t\t\"%s%s\"+\n\t\t\t\"%sTitle: %s\\n\\nBody:\\n%s\\n\\n%sFull event payload:\\n```json\\n%s\\n```\",\n\t\tev.Kind, ev.Owner, ev.Repo, instructionsSection, branchLine, reviewSection, ev.Title, ev.Body, commentsSection, raw)\n}\n\n// renderReviewSection renders the submitted review as a briefing\n// section: the verdict, the review body, and each inline comment with\n// its location and id (the id lets the agent refer to a specific\n// comment in its reply).\nfunc renderReviewSection(review *forgejo.ReviewDetail) string {\n\tvar b strings.Builder\n\n\tfmt.Fprintf(\u0026b, \"Review submitted by %s:\\n\", review.Reviewer)\n\tfmt.Fprintf(\u0026b, \"  Verdict: %s\\n\", humanReviewState(review.State))\n\n\tif review.Body != \"\" {\n\t\tb.WriteString(\"  Review body:\\n\")\n\t\tfor _, line := range strings.Split(review.Body, \"\\n\") {\n\t\t\tfmt.Fprintf(\u0026b, \"  %s\\n\", line)\n\t\t}\n\t}\n\n\tif len(review.Comments) \u003e 0 {\n\t\tfmt.Fprintf(\u0026b, \"  Inline comments (%d):\\n\", len(review.Comments))\n\n\t\tfor i, c := range review.Comments {\n\t\t\twhere := c.Path\n\t\t\tif c.Line \u003e 0 {\n\t\t\t\twhere = fmt.Sprintf(\"%s:%d\", c.Path, c.Line)\n\t\t\t}\n\n\t\t\tfmt.Fprintf(\u0026b, \"  %d. [%s] %s (comment id %d):\\n\", i+1, where, c.Author, c.ID)\n\t\t\tfor _, line := range strings.Split(c.Body, \"\\n\") {\n\t\t\t\tfmt.Fprintf(\u0026b, \"     %s\\n\", line)\n\t\t\t}\n\t\t}\n\t}\n\n\treturn b.String() + \"\\n\"\n}\n\n// humanReviewState maps a Forgejo review state to a readable verdict.\nfunc humanReviewState(state string) string {\n\tswitch state {\n\tcase \"APPROVED\":\n\t\treturn \"approved\"\n\tcase \"REQUEST_CHANGES\":\n\t\treturn \"changes requested\"\n\tcase \"COMMENT\":\n\t\treturn \"comment\"\n\tdefault:\n\t\treturn state\n\t}\n}","start_line":250,"end_line":437,"total_lines":437,"truncated":false}

{"path": "internal/agentrun/sandboxgit_test.go", "start_line": 1, "end_line": 200}

{"path":"internal/agentrun/sandboxgit_test.go","content":"package agentrun\n\nimport (\n\t\"encoding/base64\"\n\t\"strings\"\n\t\"testing\"\n)\n\nfunc TestSandboxShellQuote(t *testing.T) {\n\tcases := map[string]string{\n\t\t\"simple\":            \"'simple'\",\n\t\t\"it's a branch\":     `'it'\\''s a branch'`,\n\t\t\"with space\":        \"'with space'\",\n\t\t\"$(rm -rf /)\":       \"'$(rm -rf /)'\",\n\t\t\"a\\\"b\\\\c\":           \"'a\\\"b\\\\c'\",\n\t\t\"\":                  \"''\",\n\t\t\"HEAD~1\":            \"'HEAD~1'\",\n\t\t\"https://h/a/b.git\": \"'https://h/a/b.git'\",\n\t}\n\n\tfor in, want := range cases {\n\t\tif got := shellQuote(in); got != want {\n\t\t\tt.Errorf(\"shellQuote(%q) = %q, want %q\", in, got, want)\n\t\t}\n\t}\n}\n\nfunc TestShellGitCmdQuotesEveryArg(t *testing.T) {\n\tgot := shellGitCmd(\"clone\", \"--branch\", \"main\", \"--single-branch\", \"https://h/a/b.git\", \"/project\")\n\n\twant := \"git 'clone' '--branch' 'main' '--single-branch' 'https://h/a/b.git' '/project'\"\n\n\tif got != want {\n\t\tt.Fatalf(\"shellGitCmd = %q, want %q\", got, want)\n\t}\n}\n\nfunc TestShellGitCmdSubcommandWithArgs(t *testing.T) {\n\tgot := shellGitCmd(\"commit\", \"-m\", \"fix: handle it's edge case\")\n\n\tif !strings.HasPrefix(got, \"git 'commit' '-m' \") {\n\t\tt.Fatalf(\"shellGitCmd = %q, want prefix git 'commit' '-m' \", got)\n\t}\n\n\t// The message must be one quoted word with the embedded quote\n\t// escaped, so sh passes it through verbatim.\n\tif want := `'fix: handle it'\\''s edge case'`; !strings.HasSuffix(got, want) {\n\t\tt.Fatalf(\"shellGitCmd = %q, want suffix %q\", got, want)\n\t}\n}\n\nfunc TestForgeHost(t *testing.T) {\n\tcases := map[string]string{\n\t\t\"https://code.stdio.dk/abrander/zoo.git\": \"https://code.stdio.dk\",\n\t\t\"http://forgejo.local:3000/acme/widgets\": \"http://forgejo.local:3000\",\n\t\t\"https://h/a/b.git?x=1\":                  \"https://h\",\n\t\t// Not a URL with a host: fall back to the full string, which is\n\t\t// still a valid (narrower) prefix match.\n\t\t\"/bare\":     \"/bare\",\n\t\t\"not a url\": \"not a url\",\n\t}\n\n\tfor in, want := range cases {\n\t\tif got := forgeHost(in); got != want {\n\t\t\tt.Errorf(\"forgeHost(%q) = %q, want %q\", in, got, want)\n\t\t}\n\t}\n}\n\nfunc TestGitAuthHeader(t *testing.T) {\n\tgot := gitAuthHeader(\"greg\", \"s3cr3t\")\n\n\twant := \"Authorization: Basic \" + base64.StdEncoding.EncodeToString([]byte(\"greg:s3cr3t\"))\n\n\tif got != want {\n\t\tt.Fatalf(\"gitAuthHeader = %q, want %q\", got, want)\n\t}\n}","start_line":1,"end_line":78,"total_lines":78,"truncated":false}

{"path": "internal/forgejo/client.go", "start_line": 1, "end_line": 150}

{"path":"internal/forgejo/client.go","content":"// Package forgejo wraps the Forgejo SDK and turns webhook deliveries and\n// polling results into a common Event stream for the scheduler.\npackage forgejo\n\nimport (\n\t\"fmt\"\n\t\"time\"\n\n\tsdk \"codeberg.org/mvdkleijn/forgejo-sdk/forgejo/v2\"\n\n\t\"github.com/abrander/zoo/internal/config\"\n)\n\n// Client is zoo's single shared Forgejo identity, used both for the\n// event sources (webhook/poll) and for actions agents/scheduler take\n// (comments, labels, PRs).\ntype Client struct {\n\tsdk *sdk.Client\n\n\tbaseURL string\n\ttoken   string\n}\n\nfunc NewClient(cfg config.Forgejo) (*Client, error) {\n\tc, err := sdk.NewClient(cfg.URL, sdk.SetToken(cfg.Token))\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"forgejo client: %w\", err)\n\t}\n\n\treturn \u0026Client{sdk: c, baseURL: cfg.URL, token: cfg.Token}, nil\n}\n\n// Token returns the shared zoo Forgejo identity's token, e.g. for\n// authenticating a host-side git clone/push against Forgejo (see\n// internal/agentrun) without ever writing the credential into a working\n// tree an agent's container can read.\nfunc (c *Client) Token() string {\n\treturn c.token\n}\n\n// As returns a new Client that authenticates as the given token.\n// This is used to create per-agent clients so each agent acts as\n// themselves on Forgejo, without needing a global token with sudo\n// privileges.\nfunc (c *Client) As(token string) *Client {\n\tclient, _ := sdk.NewClient(c.baseURL, sdk.SetToken(token))\n\treturn \u0026Client{sdk: client, baseURL: c.baseURL, token: token}\n}\n\n// Sudo returns a new Client that impersonates username (via Forgejo's\n// \"Sudo:\" header) on every API call it makes, using the same underlying\n// token. Actions an agent takes through it — comments, labels, PRs,\n// assignment — are attributed to that agent's own Forgejo account\n// instead of the shared zoo identity. The token must belong to a user\n// with sudo scope/admin rights for this to work; Forgejo rejects the\n// header otherwise.\n//\n// Deprecated: use As(token) with a per-agent token instead. Kept for\n// backward compatibility during migration.\nfunc (c *Client) Sudo(username string) (*Client, error) {\n\tsudoClient, err := sdk.NewClient(c.baseURL, sdk.SetToken(c.token), sdk.SetSudo(username))\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"forgejo client sudo %q: %w\", username, err)\n\t}\n\n\treturn \u0026Client{sdk: sudoClient, baseURL: c.baseURL, token: c.token}, nil\n}\n\n// CreateIssueComment posts a comment on the given issue or pull request\n// (Forgejo/Gitea treat PRs as issues for commenting purposes).\nfunc (c *Client) CreateIssueComment(owner, repo string, index int64, body string) error {\n\t_, _, err := c.sdk.CreateIssueComment(owner, repo, index, sdk.CreateIssueCommentOption{Body: body})\n\tif err != nil {\n\t\treturn fmt.Errorf(\"comment on %s/%s#%d: %w\", owner, repo, index, err)\n\t}\n\n\treturn nil\n}\n\n// IssueComment is one comment on an issue or pull request, in the\n// shape zoo needs when briefing an agent: who said what, and when.\ntype IssueComment struct {\n\tAuthor  string\n\tBody    string\n\tCreated time.Time\n}\n\n// ListIssueComments fetches every comment on the given issue or pull\n// request, oldest first. PRs are issues under the hood in Forgejo, so\n// the same endpoint serves both. Pages are walked until exhausted so\n// the result isn't capped by the server's default page size.\nfunc (c *Client) ListIssueComments(owner, repo string, index int64) ([]IssueComment, error) {\n\tconst pageSize = 50\n\n\tvar all []*sdk.Comment\n\n\tfor page := 1; ; page++ {\n\t\tbatch, _, err := c.sdk.ListIssueComments(owner, repo, index, sdk.ListIssueCommentOptions{\n\t\t\tListOptions: sdk.ListOptions{Page: page, PageSize: pageSize},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"list comments on %s/%s#%d (page %d): %w\", owner, repo, index, page, err)\n\t\t}\n\n\t\tall = append(all, batch...)\n\n\t\tif len(batch) \u003c pageSize {\n\t\t\tbreak\n\t\t}\n\t}\n\n\tout := make([]IssueComment, 0, len(all))\n\tfor _, cm := range all {\n\t\tauthor := \"\"\n\t\tif cm.Poster != nil {\n\t\t\tauthor = cm.Poster.UserName\n\t\t}\n\n\t\tout = append(out, IssueComment{Author: author, Body: cm.Body, Created: cm.Created})\n\t}\n\n\treturn out, nil\n}\n\n// AddLabel attaches the label with the given name to an issue/PR,\n// creating the label (with a default color) on the repo first if it\n// doesn't already exist.\nfunc (c *Client) AddLabel(owner, repo string, index int64, name string) error {\n\tid, err := c.labelID(owner, repo, name)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\t_, _, err = c.sdk.AddIssueLabels(owner, repo, index, sdk.IssueLabelsOption{Labels: []int64{id}})\n\tif err != nil {\n\t\treturn fmt.Errorf(\"add label %q to %s/%s#%d: %w\", name, owner, repo, index, err)\n\t}\n\n\treturn nil\n}\n\n// RemoveLabel detaches the label with the given name from an issue/PR, if\n// both the label and the attachment exist.\nfunc (c *Client) RemoveLabel(owner, repo string, index int64, name string) error {\n\tlabels, _, err := c.sdk.GetIssueLabels(owner, repo, index, sdk.ListLabelsOptions{})\n\tif err != nil {\n\t\treturn fmt.Errorf(\"list labels on %s/%s#%d: %w\", owner, repo, index, err)\n\t}\n\n\tfor _, l := range labels {","start_line":1,"end_line":150,"total_lines":432,"truncated":true}

{"path": "docker/Dockerfile", "start_line": 1, "end_line": 100}

{"path":"docker/Dockerfile","content":"FROM debian:unstable\n\nRUN apt-get update \u0026\u0026 \\\n    apt-get install -y --no-install-recommends \\\n        ca-certificates \\\n        clang \\\n        cpp \\\n        curl \\\n        forgejo-cli \\\n        g++ \\\n        gcc \\\n        git \\\n        gnupg \\\n        golang-go \\\n        libc6-dev \\\n        make \\\n        mercurial \\\n        netbase \\\n        openssh-client \\\n        pkg-config \\\n        procps \\\n        sq \\\n        subversion \\\n        sudo \\\n        wget \\\n    \u0026\u0026 \\\n    rm -rf /var/lib/apt/lists/*\n\nADD --chmod=0644 passwd /etc/passwd\nADD --chmod=0644 group /etc/group\nADD --chmod=0640 shadow /etc/shadow\nADD --chmod=0644 uid1000-sudo /etc/sudoers.d/uid1000\n\nRUN mkdir -p /home/user \u0026\u0026 \\\n    chown 1000:1000 /home/user\n\nUSER 1000:1000","start_line":1,"end_line":37,"total_lines":37,"truncated":false}

{"end_line": 432, "path": "internal/forgejo/client.go", "start_line": 150}

{"path":"internal/forgejo/client.go","content":"\tfor _, l := range labels {\n\t\tif l.Name == name {\n\t\t\t_, err := c.sdk.DeleteIssueLabel(owner, repo, index, l.ID)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"remove label %q from %s/%s#%d: %w\", name, owner, repo, index, err)\n\t\t\t}\n\t\t\treturn nil\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc (c *Client) labelID(owner, repo, name string) (int64, error) {\n\tlabels, _, err := c.sdk.ListRepoLabels(owner, repo, sdk.ListLabelsOptions{})\n\tif err != nil {\n\t\treturn 0, fmt.Errorf(\"list labels on %s/%s: %w\", owner, repo, err)\n\t}\n\n\tfor _, l := range labels {\n\t\tif l.Name == name {\n\t\t\treturn l.ID, nil\n\t\t}\n\t}\n\n\tcreated, _, err := c.sdk.CreateLabel(owner, repo, sdk.CreateLabelOption{\n\t\tName:  name,\n\t\tColor: \"#ee0000\",\n\t})\n\tif err != nil {\n\t\treturn 0, fmt.Errorf(\"create label %q on %s/%s: %w\", name, owner, repo, err)\n\t}\n\n\treturn created.ID, nil\n}\n\n// CreatePullRequest opens a PR from head into base.\nfunc (c *Client) CreatePullRequest(owner, repo, head, base, title, body string) error {\n\t_, _, err := c.sdk.CreatePullRequest(owner, repo, sdk.CreatePullRequestOption{\n\t\tHead:  head,\n\t\tBase:  base,\n\t\tTitle: title,\n\t\tBody:  body,\n\t})\n\tif err != nil {\n\t\treturn fmt.Errorf(\"create pull request %s/%s %s-\u003e%s: %w\", owner, repo, head, base, err)\n\t}\n\n\treturn nil\n}\n\n// RequestReview asks the given users to review the pull request.\nfunc (c *Client) RequestReview(owner, repo string, index int64, reviewers []string) error {\n\t_, err := c.sdk.CreateReviewRequests(owner, repo, index, sdk.PullReviewRequestOptions{Reviewers: reviewers})\n\tif err != nil {\n\t\treturn fmt.Errorf(\"request review on %s/%s#%d: %w\", owner, repo, index, err)\n\t}\n\n\treturn nil\n}\n\n// Review states an agent can submit, in the friendly names the tools\n// expose. SubmitReview maps them onto the SDK's ReviewStateType.\nconst (\n\tReviewStateApproved       = \"approved\"\n\tReviewStateChangesRequest = \"changes_requested\"\n\tReviewStateComment        = \"comment\"\n)\n\n// SubmitReview submits a review on the pull request with the given\n// verdict and body. state is one of ReviewStateApproved,\n// ReviewStateChangesRequest, or ReviewStateComment. A body is required\n// for anything other than an approval (Forgejo enforces this too).\nfunc (c *Client) SubmitReview(owner, repo string, index int64, state, body string) error {\n\tvar sdkState sdk.ReviewStateType\n\n\tswitch state {\n\tcase ReviewStateApproved:\n\t\tsdkState = sdk.ReviewStateApproved\n\tcase ReviewStateChangesRequest:\n\t\tsdkState = sdk.ReviewStateRequestChanges\n\tcase ReviewStateComment:\n\t\tsdkState = sdk.ReviewStateComment\n\tdefault:\n\t\treturn fmt.Errorf(\"submit review on %s/%s#%d: unknown review state %q\", owner, repo, index, state)\n\t}\n\n\tif _, _, err := c.sdk.CreatePullReview(owner, repo, index, sdk.CreatePullReviewOptions{State: sdkState, Body: body}); err != nil {\n\t\treturn fmt.Errorf(\"submit review on %s/%s#%d: %w\", owner, repo, index, err)\n\t}\n\n\treturn nil\n}\n\n// ReviewCommentDetail is one inline comment on a pull request review,\n// in the shape zoo needs when briefing an agent: where it points, what\n// it says, and its id (so the agent can refer to it in its reply).\ntype ReviewCommentDetail struct {\n\tID     int64\n\tPath   string\n\tLine   int\n\tBody   string\n\tAuthor string\n}\n\n// ReviewDetail is the review context zoo briefs an agent with when a\n// pr:review event fires: the review's verdict and body, plus its inline\n// comments.\ntype ReviewDetail struct {\n\tID       int64\n\tState    string\n\tBody     string\n\tReviewer string\n\tComments []ReviewCommentDetail\n}\n\n// ReviewDetail fetches a pull request review and its inline comments.\n// The webhook payload carries the review but not its inline comments,\n// so this is how a reacting agent gets the full feedback.\nfunc (c *Client) ReviewDetail(owner, repo string, index, reviewID int64) (*ReviewDetail, error) {\n\treview, _, err := c.sdk.GetPullReview(owner, repo, index, reviewID)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"get review %d on %s/%s#%d: %w\", reviewID, owner, repo, index, err)\n\t}\n\n\tcomments, _, err := c.sdk.ListPullReviewComments(owner, repo, index, reviewID)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"list comments on review %d of %s/%s#%d: %w\", reviewID, owner, repo, index, err)\n\t}\n\n\tdetail := \u0026ReviewDetail{\n\t\tID:    review.ID,\n\t\tState: string(review.State),\n\t\tBody:  review.Body,\n\t}\n\n\tif review.Reviewer != nil {\n\t\tdetail.Reviewer = review.Reviewer.UserName\n\t}\n\n\tfor _, cm := range comments {\n\t\tauthor := \"\"\n\t\tif cm.Reviewer != nil {\n\t\t\tauthor = cm.Reviewer.UserName\n\t\t}\n\n\t\tline := int(cm.LineNum)\n\t\tif cm.OldLineNum != 0 \u0026\u0026 cm.LineNum == 0 {\n\t\t\tline = int(cm.OldLineNum)\n\t\t}\n\n\t\tdetail.Comments = append(detail.Comments, ReviewCommentDetail{\n\t\t\tID:     cm.ID,\n\t\t\tPath:   cm.Path,\n\t\t\tLine:   line,\n\t\t\tBody:   cm.Body,\n\t\t\tAuthor: author,\n\t\t})\n\t}\n\n\treturn detail, nil\n}\n\n// PullRequestInfo is the branch metadata agentrun needs to check out a\n// pull request's head.\ntype PullRequestInfo struct {\n\tHeadRef string\n\tBaseRef string\n}\n\n// PullRequestInfo returns the pull request's head and base branch refs.\nfunc (c *Client) PullRequestInfo(owner, repo string, index int64) (PullRequestInfo, error) {\n\tpr, _, err := c.sdk.GetPullRequest(owner, repo, index)\n\tif err != nil {\n\t\treturn PullRequestInfo{}, fmt.Errorf(\"get pull request %s/%s#%d: %w\", owner, repo, index, err)\n\t}\n\n\tinfo := PullRequestInfo{}\n\tif pr.Head != nil {\n\t\tinfo.HeadRef = pr.Head.Ref\n\t}\n\tif pr.Base != nil {\n\t\tinfo.BaseRef = pr.Base.Ref\n\t}\n\n\treturn info, nil\n}\n\n// CloseIssue closes the given issue or pull request.\nfunc (c *Client) CloseIssue(owner, repo string, index int64) error {\n\treturn c.setIssueState(owner, repo, index, sdk.StateClosed)\n}\n\n// ReopenIssue reopens the given issue or pull request.\nfunc (c *Client) ReopenIssue(owner, repo string, index int64) error {\n\treturn c.setIssueState(owner, repo, index, sdk.StateOpen)\n}\n\n// RepositoryInfo returns the pieces of repo metadata agentrun needs to\n// clone and branch off of the right place.\ntype RepositoryInfo struct {\n\tDefaultBranch string\n\tCloneURL      string\n}\n\nfunc (c *Client) RepositoryInfo(owner, repo string) (RepositoryInfo, error) {\n\tr, _, err := c.sdk.GetRepo(owner, repo)\n\tif err != nil {\n\t\treturn RepositoryInfo{}, fmt.Errorf(\"get repo %s/%s: %w\", owner, repo, err)\n\t}\n\n\treturn RepositoryInfo{DefaultBranch: r.DefaultBranch, CloneURL: r.CloneURL}, nil\n}\n\nfunc (c *Client) setIssueState(owner, repo string, index int64, state sdk.StateType) error {\n\t_, _, err := c.sdk.EditIssue(owner, repo, index, sdk.EditIssueOption{State: \u0026state})\n\tif err != nil {\n\t\treturn fmt.Errorf(\"set state %q on %s/%s#%d: %w\", state, owner, repo, index, err)\n\t}\n\n\treturn nil\n}\n\n// AgentProfile is what zoo reads off an agent's Forgejo account: its bio\n// (surfaced in the system prompt), the name/email used to set git commit\n// authorship inside that agent's container, and its avatar URL (surfaced\n// on the dashboard).\ntype AgentProfile struct {\n\tDescription string\n\tFullName    string\n\tEmail       string\n\tAvatarURL   string\n}\n\n// AgentProfile fetches the Forgejo profile of the user account named\n// username. Agent config labels double as their Forgejo usernames (see\n// issue:assigned resolution), so this is how an agent's \"what it does\"\n// text, and its commit identity, are authored: by editing that account's\n// profile on Forgejo, not in zoo.hcl.\nfunc (c *Client) AgentProfile(username string) (AgentProfile, error) {\n\tu, _, err := c.sdk.GetUserInfo(username)\n\tif err != nil {\n\t\treturn AgentProfile{}, fmt.Errorf(\"get user %q: %w\", username, err)\n\t}\n\n\tp := AgentProfile{\n\t\tDescription: u.Description,\n\t\tFullName:    u.FullName,\n\t\tEmail:       u.Email,\n\t\tAvatarURL:   u.AvatarURL,\n\t}\n\n\treturn p, nil\n}\n\n// AssignIssue sets the sole assignee of an issue/PR to username. Used by\n// the assign_issue tool so agents can hand work off to each other: the\n// resulting issue:assigned event (webhook or poll) triggers whichever\n// agent's config label matches username.\nfunc (c *Client) AssignIssue(owner, repo string, index int64, username string) error {\n\t_, _, err := c.sdk.EditIssue(owner, repo, index, sdk.EditIssueOption{Assignees: []string{username}})\n\tif err != nil {\n\t\treturn fmt.Errorf(\"assign %s/%s#%d to %q: %w\", owner, repo, index, username, err)\n\t}\n\n\treturn nil\n}\n\n// IssueTitle fetches the title of an issue or pull request from Forgejo.\n// Returns an empty string (not an error) if the client is nil or the\n// issue cannot be fetched — the caller should degrade gracefully.\nfunc (c *Client) IssueTitle(owner, repo string, index int64) string {\n\tif c == nil || c.sdk == nil {\n\t\treturn \"\"\n\t}\n\n\tissue, _, err := c.sdk.GetIssue(owner, repo, index)\n\tif err != nil {\n\t\treturn \"\"\n\t}\n\n\treturn issue.Title\n}","start_line":150,"end_line":432,"total_lines":432,"truncated":false}

{"path": "internal/agentrun/docker_integration_test.go", "start_line": 1, "end_line": 200}

{"path":"internal/agentrun/docker_integration_test.go","content":"//go:build docker\n\n// Run with: go test -tags docker ./internal/agentrun/...\n// Requires a reachable Docker daemon (DOCKER_HOST or the default socket).\npackage agentrun\n\nimport (\n\t\"context\"\n\t\"os\"\n\t\"os/exec\"\n\t\"path/filepath\"\n\t\"strings\"\n\t\"testing\"\n\t\"time\"\n)\n\nfunc TestDockerRuntimeExecRoundTrip(t *testing.T) {\n\trt, err := newDockerRuntime()\n\tif err != nil {\n\t\tt.Fatalf(\"docker client: %v\", err)\n\t}\n\n\tctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)\n\tdefer cancel()\n\n\tcontainerID, err := rt.createContainer(ctx, \"debian:unstable\", nil, \"zoo-test-run\")\n\tif err != nil {\n\t\tt.Fatalf(\"create container: %v\", err)\n\t}\n\tdefer rt.remove(context.Background(), containerID)\n\n\toutput, exitCode, err := rt.exec(ctx, containerID, \"echo hello-from-zoo\")\n\tif err != nil {\n\t\tt.Fatalf(\"exec: %v\", err)\n\t}\n\tif exitCode != 0 {\n\t\tt.Fatalf(\"expected exit code 0, got %d\", exitCode)\n\t}\n\tif !strings.Contains(output, \"hello-from-zoo\") {\n\t\tt.Fatalf(\"unexpected output: %q\", output)\n\t}\n\n\t_, exitCode, err = rt.exec(ctx, containerID, \"exit 3\")\n\tif err != nil {\n\t\tt.Fatalf(\"exec: %v\", err)\n\t}\n\tif exitCode != 3 {\n\t\tt.Fatalf(\"expected exit code 3, got %d\", exitCode)\n\t}\n}\n\n// TestDockerRuntimeGitSafeDirectory reproduces the \"detected dubious\n// ownership\" error git raises against a bind-mounted repo owned by a\n// different UID than the container runs as, and confirms the `git\n// config --system --add safe.directory '*'` fix Run() applies (see\n// run.go) actually clears it, against the same golang:latest image\n// zoo.hcl now defaults to.\nfunc TestDockerRuntimeGitSafeDirectory(t *testing.T) {\n\tprojectDir := t.TempDir()\n\n\tfor _, args := range [][]string{\n\t\t{\"init\", \"-q\", projectDir},\n\t\t{\"-C\", projectDir, \"commit\", \"-q\", \"--allow-empty\", \"-m\", \"init\"},\n\t} {\n\t\tif out, err := exec.Command(\"git\", args...).CombinedOutput(); err != nil {\n\t\t\tt.Fatalf(\"git %v: %v: %s\", args, err, out)\n\t\t}\n\t}\n\n\trt, err := newDockerRuntime()\n\tif err != nil {\n\t\tt.Fatalf(\"docker client: %v\", err)\n\t}\n\n\tctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)\n\tdefer cancel()\n\n\tcontainerID, err := rt.createContainer(ctx, \"golang:latest\", []string{projectDir + \":/project\"}, \"zoo-test-git\")\n\tif err != nil {\n\t\tt.Fatalf(\"create container: %v\", err)\n\t}\n\tdefer rt.remove(context.Background(), containerID)\n\n\toutput, _, err := rt.exec(ctx, containerID, \"git status\")\n\tif err != nil {\n\t\tt.Fatalf(\"exec: %v\", err)\n\t}\n\tif !strings.Contains(output, \"dubious ownership\") {\n\t\tt.Fatalf(\"expected the bind mount to reproduce dubious ownership before the fix, got: %s\", output)\n\t}\n\n\toutput, exitCode, err := rt.exec(ctx, containerID, \"git config --system --add safe.directory '*'\")\n\tif err != nil || exitCode != 0 {\n\t\tt.Fatalf(\"configure safe.directory: err=%v exit=%d: %s\", err, exitCode, output)\n\t}\n\n\toutput, exitCode, err = rt.exec(ctx, containerID, \"git status\")\n\tif err != nil {\n\t\tt.Fatalf(\"exec: %v\", err)\n\t}\n\tif exitCode != 0 || strings.Contains(output, \"dubious ownership\") {\n\t\tt.Fatalf(\"expected git status to succeed after the fix, got exit=%d: %s\", exitCode, output)\n\t}\n}\n\n// TestDockerRuntimeSandboxGit exercises the in-sandbox git setup\n// Run() performs (see sandboxgit.go): the system gitconfig round-trip\n// (including the http.\u003curl\u003e.extraHeader key whose subsection is a URL\n// full of dots and colons), the initial clone + branch done inside the\n// container, the commit identity taken from the system gitconfig, and\n// that the credential never lands in the bind-mounted working tree.\n// The clone uses a local path remote (no http involved), so the test\n// needs no reachable Forgejo; the header mechanism itself is core git\n// behavior.\nfunc TestDockerRuntimeSandboxGit(t *testing.T) {\n\ttmp := t.TempDir()\n\n\t// A bare \"remote\" on the host, plus the empty directory the\n\t// container will clone into (Run() creates it before the container\n\t// exists, for the same reason).\n\tseedDir := filepath.Join(tmp, \"seed\")\n\tbareDir := filepath.Join(tmp, \"remote.git\")\n\tprojectDir := filepath.Join(tmp, \"project\")\n\n\trun := func(dir string, args ...string) {\n\t\tcmd := exec.Command(\"git\", args...)\n\t\tcmd.Dir = dir\n\n\t\tif out, err := cmd.CombinedOutput(); err != nil {\n\t\t\tt.Fatalf(\"git %v: %v: %s\", args, err, out)\n\t\t}\n\t}\n\n\trun(\"\", \"init\", \"-q\", \"-b\", \"main\", seedDir)\n\trun(seedDir, \"config\", \"user.name\", \"zoo-test\")\n\trun(seedDir, \"config\", \"user.email\", \"zoo@test\")\n\n\tif err := os.WriteFile(filepath.Join(seedDir, \"file.txt\"), []byte(\"hello\\n\"), 0o644); err != nil {\n\t\tt.Fatalf(\"write seed file: %v\", err)\n\t}\n\n\trun(seedDir, \"add\", \".\")\n\trun(seedDir, \"commit\", \"-q\", \"-m\", \"init\")\n\trun(\"\", \"clone\", \"-q\", \"--bare\", seedDir, bareDir)\n\n\tif err := os.MkdirAll(projectDir, 0o755); err != nil {\n\t\tt.Fatalf(\"create project dir: %v\", err)\n\t}\n\n\trt, err := newDockerRuntime()\n\tif err != nil {\n\t\tt.Fatalf(\"docker client: %v\", err)\n\t}\n\n\tctx, cancel := context.WithTimeout(context.Background(), 120*time.Second)\n\tdefer cancel()\n\n\tcontainerID, err := rt.createContainer(ctx, \"golang:latest\", []string{\n\t\tbareDir + \":/bare\",\n\t\tprojectDir + \":/project\",\n\t}, \"zoo-test-sandbox-git\")\n\tif err != nil {\n\t\tt.Fatalf(\"create container: %v\", err)\n\t}\n\tdefer rt.remove(context.Background(), containerID)\n\n\tconst (\n\t\tcloneURL = \"https://forgejo.example/acme/widgets.git\"\n\t\tuser     = \"greg\"\n\t\ttoken    = \"super-secret-token\"\n\t)\n\n\tif err := configureSandboxGit(ctx, rt, containerID, cloneURL, user, token, \"Greg Coolio\", \"greg@noreply.localhost\"); err != nil {\n\t\tt.Fatalf(\"configureSandboxGit: %v\", err)\n\t}\n\n\t// The credential must round-trip through the system gitconfig,\n\t// which is what makes plain `git pull`/`git push` authenticate.\n\twantHeader := gitAuthHeader(user, token)\n\n\tout, err := runSandboxGit(ctx, rt, containerID, \"config\", \"--system\", \"--get\", \"http.\"+forgeHost(cloneURL)+\".extraHeader\")\n\tif err != nil {\n\t\tt.Fatalf(\"read back credential: %v\", err)\n\t}\n\tif got := strings.TrimSpace(out); got != wantHeader {\n\t\tt.Fatalf(\"credential round-trip = %q, want %q\", got, wantHeader)\n\t}\n\n\tif err := cloneAndBranch(ctx, rt, containerID, \"/bare\", \"main\", \"issue-1-greg\"); err != nil {\n\t\tt.Fatalf(\"cloneAndBranch: %v\", err)\n\t}\n\n\t// The clone happened inside the container: the fresh branch is\n\t// checked out in /project.\n\tout, err = runSandboxGit(ctx, rt, containerID, \"branch\", \"--show-current\")\n\tif err != nil {\n\t\tt.Fatalf(\"branch --show-current: %v\", err)\n\t}\n\tif got := strings.TrimSpace(out); got != \"issue-1-greg\" {\n\t\tt.Fatalf(\"branch = %q, want issue-1-greg\", got)","start_line":1,"end_line":200,"total_lines":224,"truncated":true}

{"end_line": 224, "path": "internal/agentrun/docker_integration_test.go", "start_line": 200}

{"path":"internal/agentrun/docker_integration_test.go","content":"\t\tt.Fatalf(\"branch = %q, want issue-1-greg\", got)\n\t}\n\n\t// Commits must pick up the identity from the system gitconfig.\n\tif _, exitCode, err := rt.exec(ctx, containerID, \"echo more \u003e\u003e file.txt \u0026\u0026 git add file.txt \u0026\u0026 git commit -qm 'from sandbox'\"); err != nil || exitCode != 0 {\n\t\tt.Fatalf(\"commit in sandbox: err=%v exit=%d\", err, exitCode)\n\t}\n\n\tout, err = runSandboxGit(ctx, rt, containerID, \"log\", \"-1\", \"--format=%an %ae\")\n\tif err != nil {\n\t\tt.Fatalf(\"log: %v\", err)\n\t}\n\tif got := strings.TrimSpace(out); got != \"Greg Coolio greg@noreply.localhost\" {\n\t\tt.Fatalf(\"commit author = %q, want %q\", got, \"Greg Coolio greg@noreply.localhost\")\n\t}\n\n\t// The token must not leak into the bind-mounted working tree.\n\tout, _, err = rt.exec(ctx, containerID, \"grep -r super-secret-token /project || true\")\n\tif err != nil {\n\t\tt.Fatalf(\"grep: %v\", err)\n\t}\n\tif strings.Contains(out, \"super-secret-token\") {\n\t\tt.Fatalf(\"token leaked into the working tree: %s\", out)\n\t}\n}","start_line":200,"end_line":224,"total_lines":224,"truncated":false}

{"path": "README.md", "start_line": 1, "end_line": 200}

{"path":"README.md","content":"# 🐾 Zoo\n\n**Autonomous AI agents that work your Forgejo issues \u0026 pull requests.**\n\nZoo watches a [Forgejo](https://codeberg.org/forgejo/forgejo) instance for issue and pull request events, then dispatches them to configured AI agents running in isolated Docker containers. Each agent has its own role, LLM model, and personality — like a menagerie working together to keep your projects moving.\n\n---\n\n## ✨ Features\n\n- **Multi-agent orchestration** — Assign different tasks to specialized agents (reviewers, managers, developers).\n- **Event-driven routing** — Configure which agent handles `issue:new`, `pr:new`, `issue:comment`, `issue:assigned`, and more.\n- **LLM flexibility** — Plug in any OpenAI-compatible API; each agent gets its own model choice.\n- **Isolated execution** — Agents run in Docker containers with full filesystem access but no persistence between runs.\n- **Live dashboard** — Real-time web UI showing active agents, logs, and job history.\n- **Webhook \u0026 polling support** — React to events instantly via webhooks, or fall back to polling.\n\n---\n\n## 🚀 Quick Start\n\n### Prerequisites\n\n| Requirement | Version |\n|-------------|---------|\n| Go          | 1.26+   |\n| Docker      | Latest  |\n| Forgejo     | Any (self-hosted or codeberg.dk) |\n| LLM endpoint | OpenAI-compatible API |\n\n### Configuration\n\nCopy the example config and customize it:\n\n```bash\ncp zoo.hcl.example zoo.hcl\n```\n\nEdit `zoo.hcl` with your Forgejo credentials, LLM tokens, and agent definitions. See the [configuration reference](#-configuration-reference) below.\n\n### Running\n\n```bash\ngo build -o zoo ./cmd/zoo\n./zoo\n```\n\nThe daemon starts on port `:8080` by default. Open your browser to see the dashboard.\n\n---\n\n## 👥 Meet the Agents\n\nThe example configuration includes four agents, each with a distinct role:\n\n| Agent    | Role                  | Suggested LLM       | Handles                          |\n|----------|-----------------------|---------------------|----------------------------------|\n| **leon** | Engineering Manager   | Qwen 3.8            | New issues, comments             |\n| **greg** | Senior Developer      | Qwen 3.8            | Pull request reviews             |\n| **anna** | UI/UX Designer        | Qwen 3.6            | Design-related issues \u0026 PRs      |\n| **mika** | Junior Developer      | Qwen 3.6            | Assigned issues                  |\n\nYou can add, remove, or reassign agents freely in your `zoo.hcl`.\n\n---\n\n## ⚙️ Configuration Reference\n\nAll settings live in a single HCL file (`zoo.hcl`). Here's what each section controls:\n\n### LLM Definitions\n\nDefine one or more LLM endpoints. Agents reference these by name.\n\n```hcl\nllm \"Qwen 3.6\" {\n    openai = \"https://your-llm-endpoint\"\n    token  = \"YOUR_API_TOKEN\"\n    model  = \"model-name\"\n}\n```\n\n### Forgejo Connection\n\n```hcl\nforgejo {\n    url            = \"https://code.stdio.dk\"\n    token          = \"ZOO_SERVICE_TOKEN\"\n    webhook_secret = \"SHARED_SECRET\"  # optional if using polling\n}\n```\n\n### Environment\n\n```hcl\nenvironment {\n    docker_image    = \"golang:latest\"   # base image for agent containers\n    max_live_agents = 5                 # concurrent agent limit\n}\n```\n\n### Agent Definition\n\n```hcl\nagent \"anna\" {\n    llm   = \"Qwen 3.6\"\n    token = \"ANNA_FORGEJO_TOKEN\"\n}\n```\n\nThe optional `token` is the agent's own Forgejo token. When set, the\nagent acts as itself on Forgejo (comments, PRs, ...) and its sandbox's\ngit authenticates with it too — the initial clone and all remote git\noperations (pull, push, ...) run inside the container with that\ncredential. Without it, the shared `forgejo.token` is used.\n\n### Event Routing\n\nMap event types to agents with optional custom instructions:\n\n```hcl\nevent \"issue:new\" {\n    agent        = \"leon\"\n    instructions = \"Triage this issue.\"\n}\n\nevent \"issue:assigned\" {\n    // No `agent` — dynamically matches the assignee's username\n    instructions = \"Please handle this issue.\"\n}\n\nevent \"pr:new\" {\n    agent        = \"greg\"\n    instructions = \"Review this pull request.\"\n}\n```\n\n---\n\n## 🔧 Command-Line Flags\n\n| Flag              | Default         | Description                                  |\n|-------------------|-----------------|----------------------------------------------|\n| `-config`         | `zoo.hcl`       | Path to the configuration file               |\n| `-db`             | `zoo.db`        | SQLite database path                         |\n| `-listen`         | `:8080`         | HTTP listen address                          |\n| `-run-timeout`    | (see source)    | Max wall-clock time per agent run            |\n| `-keep-on-failure`| `false`         | Preserve container after failure for debugging |\n\n---\n\n## 📁 Project Structure\n\n```\n├── cmd/zoo/main.go           # Entry point\n├── internal/\n│   ├── agentrun/             # Docker-based agent execution\n│   ├── config/               # HCL config loader \u0026 validator\n│   ├── forgejo/              # Webhook receiver \u0026 event poller\n│   ├── livelog/              # Real-time log streaming hub\n│   ├── llm/                  # LLM client \u0026 streaming\n│   ├── scheduler/            # Event-to-agent dispatcher\n│   ├── store/                # SQLite state management\n│   ├── tools/                # Agent tool registry\n│   └── web/                  # Dashboard HTTP server\n└── zoo.hcl.example           # Configuration template\n```\n\n---\n\n## 🛠 Development\n\n### Running Tests\n\n```bash\ngo test ./...\n```\n\n### Adding a New Agent\n\n1. Define the agent in `zoo.hcl`:\n\n   ```hcl\n   agent \"newagent\" {\n       llm   = \"Qwen 3.6\"\n       token = \"NEW_AGENT_TOKEN\"\n   }\n   ```\n\n2. Add an event route:\n\n   ```hcl\n   event \"issue:new\" {\n       agent = \"newagent\"\n   }\n   ```\n\n3. Update your Forgejo profile with the agent's role description.\n\n### Adding a New Tool","start_line":1,"end_line":200,"total_lines":223,"truncated":true}

{"end_line": 223, "path": "README.md", "start_line": 200}

{"path":"README.md","content":"### Adding a New Tool\n\nTools are registered in `internal/tools/registry.go`. Each tool is a Go function that operates on the agent's `/project` directory. See existing tools for patterns.\n\n---\n\n## 🤝 Contributing\n\nContributions are welcome! Please:\n\n1. Fork the repository\n2. Create a feature branch\n3. Make your changes\n4. Open a pull request\n\n---\n\n## 📄 License\n\nThis project is available as open source under the terms of the [MIT License](LICENSE).\n\n---\n\n*Made with ❤️ by the [zoo](https://code.stdio.dk/abrander/zoo) team.*","start_line":200,"end_line":223,"total_lines":223,"truncated":false}

{"command": "cd /project && ls -la && cat TODO.md 2>/dev/null; grep -rn \"extraHeader\\|gitAuthHeader\\|Token()\" --include=\"*.go\" . | grep -v \"_test.go\""}

total 64
drwxr-xr-x  6 user user  4096 Aug 25 21:55 .
drwxr-xr-x  1 root root  4096 Aug 25 21:55 ..
drwxr-xr-x  7 user user  4096 Aug 25 21:55 .git
-rw-r--r--  1 user user    22 Aug 25 21:55 .gitignore
-rw-r--r--  1 user user  6387 Aug 25 21:55 README.md
drwxr-xr-x  3 user user  4096 Aug 25 21:55 cmd
drwxr-xr-x  2 user user  4096 Aug 25 21:55 docker
-rw-r--r--  1 user user  2628 Aug 25 21:55 go.mod
-rw-r--r--  1 user user 16578 Aug 25 21:55 go.sum
drwxr-xr-x 11 user user  4096 Aug 25 21:55 internal
-rw-r--r--  1 user user  3092 Aug 25 21:55 zoo.hcl.example
./internal/forgejo/client.go:37:func (c *Client) Token() string {
./internal/agentrun/sandboxgit.go:53:// gitAuthHeader returns the value of an Authorization header that
./internal/agentrun/sandboxgit.go:55:func gitAuthHeader(user, token string) string {
./internal/agentrun/sandboxgit.go:80://   - http.<host>.extraHeader carrying the run's Forgejo credential,
./internal/agentrun/sandboxgit.go:108:	if _, err := runSandboxGit(ctx, rt, containerID, "config", "--global", "http."+forgeHost(cloneURL)+".extraHeader", gitAuthHeader(user, token)); err != nil {
./internal/agentrun/sandboxgit.go:121:// authenticates via the http.<host>.extraHeader configured by
./internal/agentrun/run.go:183:	gitUser, gitToken := "zoo", r.forgejo.Token()

{"command": "cd /project && go version && git --version && (docker info >/dev/null 2>&1 && echo \"docker: available\" || echo \"docker: NOT available\") && which git http-backend 2>/dev/null; git http-backend --help 2>&1 | head -3"}

go version go1.26.7 linux/amd64
git version 2.55.0
docker: NOT available
/usr/bin/git
warning: failed to exec 'man': No such file or directory
fatal: no man viewer handled the request

{"command": "cd /project && grep -rn \"system\\|global\" internal/agentrun/sandboxgit.go internal/agentrun/docker_integration_test.go | grep -n \"config\" ; grep -rn \"git\" README.md | head -20"}

1:internal/agentrun/sandboxgit.go:13:// credential is written to the container's system gitconfig so every
2:internal/agentrun/sandboxgit.go:74:// configureSandboxGit writes the container's system gitconfig so git
4:internal/agentrun/sandboxgit.go:96:	if _, err := runSandboxGit(ctx, rt, containerID, "config", "--global", "--add", "safe.directory", "*"); err != nil {
5:internal/agentrun/sandboxgit.go:100:	if _, err := runSandboxGit(ctx, rt, containerID, "config", "--global", "user.name", name); err != nil {
6:internal/agentrun/sandboxgit.go:104:	if _, err := runSandboxGit(ctx, rt, containerID, "config", "--global", "user.email", email); err != nil {
7:internal/agentrun/sandboxgit.go:108:	if _, err := runSandboxGit(ctx, rt, containerID, "config", "--global", "http."+forgeHost(cloneURL)+".extraHeader", gitAuthHeader(user, token)); err != nil {
8:internal/agentrun/sandboxgit.go:112:	if _, err := runSandboxGit(ctx, rt, containerID, "config", "--global", "push.autoSetupRemote", "true"); err != nil {
9:internal/agentrun/docker_integration_test.go:55:// config --system --add safe.directory '*'` fix Run() applies (see
10:internal/agentrun/docker_integration_test.go:92:	output, exitCode, err := rt.exec(ctx, containerID, "git config --system --add safe.directory '*'")
11:internal/agentrun/docker_integration_test.go:107:// Run() performs (see sandboxgit.go): the system gitconfig round-trip
12:internal/agentrun/docker_integration_test.go:110:// container, the commit identity taken from the system gitconfig, and
13:internal/agentrun/docker_integration_test.go:177:	// The credential must round-trip through the system gitconfig,
14:internal/agentrun/docker_integration_test.go:181:	out, err := runSandboxGit(ctx, rt, containerID, "config", "--system", "--get", "http."+forgeHost(cloneURL)+".extraHeader")
15:internal/agentrun/docker_integration_test.go:203:	// Commits must pick up the identity from the system gitconfig.
113:git authenticates with it too — the initial clone and all remote git

{"command": "cd /tmp && mkdir -p mechcheck && cd mechcheck && git init -q -b main seed && cd seed && echo hello > f.txt && git add . && git -c user.name=t -c user.email=t@t commit -qm init && cd .. && git clone -q --bare seed forge/acme/widgets.git && ls forge/acme/widgets.git | head -5 && echo \"--- http-backend probe ---\" && GIT_PROJECT_ROOT=/tmp/mechcheck/forge GIT_HTTP_EXPORT_ALL=1 PATH_INFO=/acme/widgets.git/info/refs REQUEST_METHOD=GET QUERY_STRING=\"service=git-upload-pack\" git http-backend 2>&1 | head -8"}

HEAD
config
description
hooks
info
--- http-backend probe ---
Expires: Fri, 01 Jan 1980 00:00:00 GMT
Pragma: no-cache
Cache-Control: no-cache, max-age=0, must-revalidate
Content-Type: application/x-git-upload-pack-advertisement

001e# service=git-upload-pack
000001111548be5aa66c87a059be2218043e9db498aaf5d0 HEAD�multi_ack thin-pack side-band side-band-64k ofs-delta shallow deepen-since deepen-not deepen-relative no-progress include-tag multi_ack_detailed no-done symref=HEAD:refs/heads/main object-format=sha1 agent=git/2.55.0-Linux
003d1548be5aa66c87a059be2218043e9db498aaf5d0 refs/heads/main

{"path": "/tmp/mechcheck/main.go", "content": "package main\n\nimport (\n\t\"fmt\"\n\t\"log\"\n\t\"net\"\n\t\"net/http\"\n\t\"net/http/httputil\"\n\t\"net/url\"\n\t\"os\"\n\t\"os/exec\"\n\t\"strconv\"\n\t\"strings\"\n\t\"bufio\"\n\t\"bytes\"\n)\n\nfunc main() {\n\tprojectRoot := \"/tmp/mechcheck/forge\"\n\tsockPath := \"/tmp/mechcheck/proxy.sock\"\n\tos.Remove(sockPath)\n\n\t// Fake forge: git http-backend as CGI.\n\tforge := http.NewServeMux()\n\tforge.HandleFunc(\"/\", func(w http.ResponseWriter, r *http.Request) {\n\t\tcmd := exec.Command(\"git\", \"http-backend\")\n\t\tcmd.Env = append(os.Environ(),\n\t\t\t\"REQUEST_METHOD=\"+r.Method,\n\t\t\t\"PATH_INFO=\"+r.URL.Path,\n\t\t\t\"QUERY_STRING=\"+r.RawQuery,\n\t\t\t\"GIT_PROJECT_ROOT=\"+projectRoot,\n\t\t\t\"GIT_HTTP_EXPORT_ALL=1\",\n\t\t\t\"REMOTE_ADDR=\"+r.RemoteAddr,\n\t\t)\n\t\tif r.ContentLength > 0 {\n\t\t\tcmd.Env = append(cmd.Env, \"CONTENT_LENGTH=\"+strconv.FormatInt(r.ContentLength, 10))\n\t\t}\n\t\tfor k, vs := range r.Header {\n\t\t\tcmd.Env = append(cmd.Env, \"HTTP_\"+strings.ToUpper(strings.ReplaceAll(k, \"-\", \"_\"))+\"=\"+strings.Join(vs, \",\"))\n\t\t}\n\t\tcmd.Stdin = r.Body\n\t\tvar out, errb bytes.Buffer\n\t\tcmd.Stdout, cmd.Stderr = &out, &errb\n\t\tif err := cmd.Run(); err != nil {\n\t\t\tfmt.Println(\"backend err:\", err, errb.String())\n\t\t\thttp.Error(w, \"backend failed\", 502)\n\t\t\treturn\n\t\t}\n\t\tresp, err := http.ReadResponse(bufio.NewReader(bytes.NewReader(out.Bytes())), r)\n\t\tif err != nil {\n\t\t\thttp.Error(w, \"parse: \"+err.Error(), 502)\n\t\t\treturn\n\t\t}\n\t\tdefer resp.Body.Close()\n\t\tfor k, vv := range resp.Header {\n\t\t\tfor _, v := range vv {\n\t\t\t\tw.Header().Add(k, v)\n\t\t\t}\n\t\t}\n\t\tw.WriteHeader(resp.StatusCode)\n\t\tbuf := new(bytes.Buffer)\n\t\tbuf.ReadFrom(resp.Body)\n\t\tw.Write(buf.Bytes())\n\t})\n\n\tln, err := net.Listen(\"tcp\", \"127.0.0.1:0\")\n\tif err != nil {\n\t\tlog.Fatal(err)\n\t}\n\tforgeAddr := ln.Addr().String()\n\tgo http.Serve(ln, forge)\n\tforgeURL := \"http://\" + forgeAddr\n\tfmt.Println(\"forge at\", forgeURL)\n\n\t// Proxy on a unix socket: only forwards git smart-HTTP paths, injects auth.\n\tpln, err := net.Listen(\"unix\", sockPath)\n\tif err != nil {\n\t\tlog.Fatal(err)\n\t}\n\tos.Chmod(sockPath, 0o777)\n\n\ttarget, _ := url.Parse(forgeURL)\n\trp := &httputil.ReverseProxy{\n\t\tDirector: func(req *http.Request) {\n\t\t\treq.URL.Scheme = target.Scheme\n\t\t\treq.URL.Host = target.Host\n\t\t\treq.Host = target.Host\n\t\t\treq.Header.Del(\"Authorization\")\n\t\t\treq.Header.Set(\"Authorization\", \"Basic Z3JlZzp0b2tlbg==\")\n\t\t},\n\t}\n\tgo http.Serve(pln, rp)\n\n\t// Now: real git clone through the proxy.\n\tcloneURL := forgeURL + \"/acme/widgets.git\"\n\tgitcfg := \"/tmp/mechcheck/gitconfig\"\n\thost := target.Scheme + \"://\" + target.Host\n\tos.WriteFile(gitcfg, []byte(fmt.Sprintf(\"[http \\\"%s\\\"]\\n\\tproxy = http+unix://%s\\n\", host, sockPath)), 0o600)\n\n\tcmd := exec.Command(\"git\", \"clone\", \"-v\", cloneURL, \"/tmp/mechcheck/clone\")\n\tcmd.Env = append(os.Environ(), \"GIT_CONFIG_GLOBAL=\"+gitcfg, \"GIT_CONFIG_SYSTEM=/tmp/mechcheck/nosys\")\n\tout, err := cmd.CombinedOutput()\n\tfmt.Println(string(out))\n\tif err != nil {\n\t\tlog.Fatal(\"clone failed:\", err)\n\t}\n\tfmt.Println(\"CLONE OK\")\n\n\t// And a push back.\n\tcmd = exec.Command(\"git\", \"-C\", \"/tmp/mechcheck/clone\", \"push\", \"-v\", \"origin\", \"HEAD:refs/heads/pushed\")\n\tcmd.Env = append(os.Environ(), \"GIT_CONFIG_GLOBAL=\"+gitcfg, \"GIT_CONFIG_SYSTEM=/tmp/mechcheck/nosys\")\n\tout, err = cmd.CombinedOutput()\n\tfmt.Println(string(out))\n\tif err != nil {\n\t\tlog.Fatal(\"push failed:\", err)\n\t}\n\tfmt.Println(\"PUSH OK\")\n}\n"}

OK

{"command": "cd /tmp/mechcheck && go mod init mechcheck >/dev/null 2>&1; go run main.go 2>&1 | tail -20"}

# command-line-arguments
./main.go:30:22: r.RawQuery undefined (type *http.Request has no field or method RawQuery)

{"path": "/tmp/mechcheck/main.go", "find": "\"QUERY_STRING=\"+r.RawQuery,", "replace": "\"QUERY_STRING=\"+r.URL.RawQuery,"}

1 occurrences replaced

{"command": "cd /tmp/mechcheck && go run main.go 2>&1 | tail -25"}

forge at http://127.0.0.1:44265
Cloning into '/tmp/mechcheck/clone'...
fatal: Invalid proxy URL 'http+unix:///tmp/mechcheck/proxy.sock': unsupported proxy scheme 'http+unix'
fatal: remote helper 'http' aborted session

2026/08/25 22:07:29 clone failed:exit status 128
exit status 1

{"command": "strings /usr/bin/git | grep -B2 -A2 \"unsupported proxy\" ; echo ===; strings /usr/bin/git | grep -E \"^(socks5|socks5h|http|https|http\\+)\" | sort -u | head; echo ===; strings /usr/bin/git | grep -i \"proxy\" | grep -iv \"proxyCommand\\|proxy command\" | head -30"}

===
http-backend-info-refs
http.<url>.*
http.cookieFile
http.curloptResolve
http.delegation
http.emptyAuth
http.extraHeader
http.followRedirects
http.keepAliveCount
http.keepAliveIdle
===
core.gitProxy
http.proxy
http.proxyAuthMethod
http.proxySSLCAInfo
http.proxySSLCert
http.proxySSLKey
remote.<name>.proxy
remote.<name>.proxyAuthMethod
core.gitproxy
GIT_PROXY_COMMAND
cannot start proxy %s
proxyauthmethod
http.proxySSLCertPasswordProtected

{"command": "cd /tmp && timeout 30 git clone -q --depth 1 https://github.com/git/git.git gitsrc 2>&1 | head -3; ls gitsrc/http.c 2>/dev/null && grep -n \"unsupported proxy scheme\" -B 30 gitsrc/http.c | grep -E \"strncasecmp|scheme|die\" | head -20"}

gitsrc/http.c
1309:			die("Invalid proxy URL '%s': unsupported proxy scheme '%s'",

{"command": "cd /tmp/gitsrc && grep -n \"set_curl_proxy_type\" -A 25 http.c | head -40"}

795:static int set_curl_proxy_type(CURL *result, const char *protocol)
796-{
797-	const struct socks_proxy_type *socks_proxy_type;
798-
799-	if (!protocol || !strcmp(protocol, "http"))
800-		return 0;
801-
802-	socks_proxy_type = find_socks_proxy_type(protocol);
803-	if (socks_proxy_type) {
804-		curl_easy_setopt(result, CURLOPT_PROXYTYPE, socks_proxy_type->curlsym);
805-		return 0;
806-	}
807-
808-	if (!strcmp(protocol, "https")) {
809-		curl_easy_setopt(result, CURLOPT_PROXYTYPE, (long)CURLPROXY_HTTPS);
810-
811-		if (http_proxy_ssl_cert)
812-			curl_easy_setopt(result, CURLOPT_PROXY_SSLCERT,
813-					 http_proxy_ssl_cert);
814-
815-		if (http_proxy_ssl_key)
816-			curl_easy_setopt(result, CURLOPT_PROXY_SSLKEY,
817-					 http_proxy_ssl_key);
818-
819-		if (has_proxy_cert_password())
820-			curl_easy_setopt(result, CURLOPT_PROXY_KEYPASSWD,
--
1308:		if (set_curl_proxy_type(result, proxy_auth.protocol) < 0)
1309-			die("Invalid proxy URL '%s': unsupported proxy scheme '%s'",
1310-			    curl_http_proxy, proxy_auth.protocol);
1311-
1312-		if (!proxy_auth.host)
1313-			die("Invalid proxy URL '%s'", curl_http_proxy);
1314-
1315-		strbuf_addstr(&proxy, proxy_auth.host);
1316-		if (proxy_auth.path) {
1317-			curl_version_info_data *ver = curl_version_info(CURLVERSION_NOW);
1318-
1319-			if (ver->version_num < 0x075400)
1320-				die("libcurl 7.84 or later is required to support paths in proxy URLs");

{"content": "package main\n\nimport (\n\t\"bufio\"\n\t\"bytes\"\n\t\"fmt\"\n\t\"log\"\n\t\"net\"\n\t\"net/http\"\n\t\"net/http/httputil\"\n\t\"net/url\"\n\t\"os\"\n\t\"os/exec\"\n\t\"strconv\"\n\t\"strings\"\n\t\"time\"\n)\n\nfunc main() {\n\tprojectRoot := \"/tmp/mechcheck/forge\"\n\n\t// Fake forge: git http-backend as CGI.\n\tforgeMux := http.NewServeMux()\n\tforgeMux.HandleFunc(\"/\", func(w http.ResponseWriter, r *http.Request) {\n\t\tfmt.Println(\"FORGE GOT:\", r.Method, r.URL.RequestURI(), \"auth=\"+r.Header.Get(\"Authorization\"), \"x-zoo-run=\"+r.Header.Get(\"X-Zoo-Run\"))\n\t\tcmd := exec.Command(\"git\", \"http-backend\")\n\t\tcmd.Env = append(os.Environ(),\n\t\t\t\"REQUEST_METHOD=\"+r.Method,\n\t\t\t\"PATH_INFO=\"+r.URL.Path,\n\t\t\t\"QUERY_STRING=\"+r.URL.RawQuery,\n\t\t\t\"GIT_PROJECT_ROOT=\"+projectRoot,\n\t\t\t\"GIT_HTTP_EXPORT_ALL=1\",\n\t\t\t\"REMOTE_ADDR=\"+r.RemoteAddr,\n\t\t)\n\t\tif r.ContentLength > 0 {\n\t\t\tcmd.Env = append(cmd.Env, \"CONTENT_LENGTH=\"+strconv.FormatInt(r.ContentLength, 10))\n\t\t}\n\t\tfor k, vs := range r.Header {\n\t\t\tcmd.Env = append(cmd.Env, \"HTTP_\"+strings.ToUpper(strings.ReplaceAll(k, \"-\", \"_\"))+\"=\"+strings.Join(vs, \",\"))\n\t\t}\n\t\tcmd.Stdin = r.Body\n\t\tvar out, errb bytes.Buffer\n\t\tcmd.Stdout, cmd.Stderr = &out, &errb\n\t\tif err := cmd.Run(); err != nil {\n\t\t\tfmt.Println(\"backend err:\", err, errb.String())\n\t\t\thttp.Error(w, \"backend failed\", 502)\n\t\t\treturn\n\t\t}\n\t\tresp, err := http.ReadResponse(bufio.NewReader(bytes.NewReader(out.Bytes())), r)\n\t\tif err != nil {\n\t\t\thttp.Error(w, \"parse: \"+err.Error(), 502)\n\t\t\treturn\n\t\t}\n\t\tdefer resp.Body.Close()\n\t\tfor k, vv := range resp.Header {\n\t\t\tfor _, v := range vv {\n\t\t\t\tw.Header().Add(k, v)\n\t\t\t}\n\t\t}\n\t\tw.WriteHeader(resp.StatusCode)\n\t\tbuf := new(bytes.Buffer)\n\t\tbuf.ReadFrom(resp.Body)\n\t\tw.Write(buf.Bytes())\n\t})\n\n\tfln, err := net.Listen(\"tcp\", \"127.0.0.1:0\")\n\tif err != nil {\n\t\tlog.Fatal(err)\n\t}\n\tforgeAddr := fln.Addr().String()\n\tgo http.Serve(fln, forgeMux)\n\tforgeURL := \"http://\" + forgeAddr\n\tfmt.Println(\"forge at\", forgeURL)\n\n\t// TCP proxy with per-run secret gate + auth injection.\n\tpln, err := net.Listen(\"tcp\", \"127.0.0.1:0\")\n\tif err != nil {\n\t\tlog.Fatal(err)\n\t}\n\tproxyAddr := pln.Addr().String()\n\tfmt.Println(\"proxy at\", proxyAddr)\n\n\tconst runSecret = \"run-secret-123\"\n\ttarget, _ := url.Parse(forgeURL)\n\trp := &httputil.ReverseProxy{\n\t\tDirector: func(req *http.Request) {\n\t\t\tif req.Header.Get(\"X-Zoo-Run\") != runSecret {\n\t\t\t\treturn // handled in wrapper below\n\t\t\t}\n\t\t\treq.URL.Scheme = target.Scheme\n\t\t\treq.URL.Host = target.Host\n\t\t\treq.Host = target.Host\n\t\t\treq.Header.Del(\"Authorization\")\n\t\t\treq.Header.Del(\"X-Zoo-Run\")\n\t\t\treq.Header.Set(\"Authorization\", \"Basic Z3JlZzp0b2tlbg==\")\n\t\t},\n\t}\n\twrapper := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {\n\t\tif r.Header.Get(\"X-Zoo-Run\") != runSecret {\n\t\t\thttp.Error(w, \"forbidden\", http.StatusForbidden)\n\t\t\treturn\n\t\t}\n\t\trp.ServeHTTP(w, r)\n\t})\n\tsrv := &http.Server{Handler: wrapper, ReadHeaderTimeout: 10 * time.Second}\n\tgo srv.Serve(pln)\n\n\t// Real git clone+push through the proxy.\n\tcloneURL := forgeURL + \"/acme/widgets.git\"\n\tgitcfg := \"/tmp/mechcheck/gitconfig\"\n\thost := target.Scheme + \"://\" + target.Host\n\tos.WriteFile(gitcfg, []byte(fmt.Sprintf(\n\t\t\"[http \\\"%s\\\"]\\n\\tproxy = http://%s\\n\\textraHeader = X-Zoo-Run: %s\\n\", host, proxyAddr, runSecret)), 0o600)\n\n\tenv := append(os.Environ(), \"GIT_CONFIG_GLOBAL=\"+gitcfg, \"GIT_CONFIG_SYSTEM=/tmp/mechcheck/nosys\")\n\n\tcmd := exec.Command(\"git\", \"clone\", \"-v\", cloneURL, \"/tmp/mechcheck/clone\")\n\tcmd.Env = env\n\tout, err := cmd.CombinedOutput()\n\tfmt.Println(string(out))\n\tif err != nil {\n\t\tlog.Fatal(\"clone failed:\", err)\n\t}\n\tfmt.Println(\"CLONE OK\")\n\n\tcmd = exec.Command(\"git\", \"-C\", \"/tmp/mechcheck/clone\", \"push\", \"-v\", \"origin\", \"HEAD:refs/heads/pushed\")\n\tcmd.Env = env\n\tout, err = cmd.CombinedOutput()\n\tfmt.Println(string(out))\n\tif err != nil {\n\t\tlog.Fatal(\"push failed:\", err)\n\t}\n\tfmt.Println(\"PUSH OK\")\n\n\t// Negative: request without the secret must be rejected.\n\tresp, err := http.Get(forgeURL + \"/api/v1/repos\")\n\tif err != nil {\n\t\tlog.Fatal(err)\n\t}\n\tfmt.Println(\"direct forge api (no proxy):\", resp.StatusCode) // forge itself has no auth gate in this mock\n\n\t// Negative: through proxy but wrong secret.\n\treq, _ := http.NewRequest(\"GET\", forgeURL+\"/acme/widgets.git/info/refs?service=git-upload-pack\", nil)\n\treq.Header.Set(\"X-Zoo-Run\", \"wrong\")\n\tc := &http.Client{Transport: &http.Transport{Proxy: http.ProxyURL(mustURL(\"http://\" + proxyAddr))}}\n\tresp2, err := c.Do(req)\n\tif err != nil {\n\t\tlog.Fatal(err)\n\t}\n\tfmt.Println(\"proxy with wrong secret:\", resp2.StatusCode)\n}\n\nfunc mustURL(s string) *url.URL {\n\tu, err := url.Parse(s)\n\tif err != nil {\n\t\tpanic(err)\n\t}\n\treturn u\n}\n", "path": "/tmp/mechcheck/main.go"}

OK

{"command": "cd /tmp/mechcheck && rm -rf clone && go run main.go 2>&1 | tail -25"}

forge at http://127.0.0.1:45869
proxy at 127.0.0.1:41805
FORGE GOT: GET /acme/widgets.git/info/refs?service=git-upload-pack auth=Basic Z3JlZzp0b2tlbg== x-zoo-run=
Cloning into '/tmp/mechcheck/clone'...
remote: parse: malformed HTTP status code "Fri,"
fatal: unable to access 'http://127.0.0.1:45869/acme/widgets.git/': The requested URL returned error: 502

2026/08/25 22:13:46 clone failed:exit status 128
exit status 1

{"find": "\t\tresp, err := http.ReadResponse(bufio.NewReader(bytes.NewReader(out.Bytes())), r)\n\t\tif err != nil {\n\t\t\thttp.Error(w, \"parse: \"+err.Error(), 502)\n\t\t\treturn\n\t\t}\n\t\tdefer resp.Body.Close()\n\t\tfor k, vv := range resp.Header {\n\t\t\tfor _, v := range vv {\n\t\t\t\tw.Header().Add(k, v)\n\t\t\t}\n\t\t}\n\t\tw.WriteHeader(resp.StatusCode)\n\t\tbuf := new(bytes.Buffer)\n\t\tbuf.ReadFrom(resp.Body)\n\t\tw.Write(buf.Bytes())", "path": "/tmp/mechcheck/main.go", "replace": "\t\t// Parse CGI output: headers (optional Status:) until blank line, then body.\n\t\treader := bufio.NewReader(bytes.NewReader(out.Bytes()))\n\t\tstatus := 200\n\t\thdr := http.Header{}\n\t\tfor {\n\t\t\tline, err := reader.ReadString('\\n')\n\t\t\tif err != nil {\n\t\t\t\tbreak\n\t\t\t}\n\t\t\tline = strings.TrimRight(line, \"\\r\\n\")\n\t\t\tif line == \"\" {\n\t\t\t\tbreak\n\t\t\t}\n\t\t\tk, v, ok := strings.Cut(line, \":\")\n\t\t\tif !ok {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tk, v = strings.TrimSpace(k), strings.TrimSpace(v)\n\t\t\tif strings.EqualFold(k, \"Status\") {\n\t\t\t\tif parts := strings.SplitN(v, \" \", 2); len(parts) > 0 {\n\t\t\t\t\tstatus, _ = strconv.Atoi(parts[0])\n\t\t\t\t}\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\thdr.Add(k, v)\n\t\t}\n\t\tfor k, vv := range hdr {\n\t\t\tfor _, v := range vv {\n\t\t\t\tw.Header().Add(k, v)\n\t\t\t}\n\t\t}\n\t\tw.WriteHeader(status)\n\t\tio.Copy(w, reader)"}

1 occurrences replaced

{"command": "cd /tmp/mechcheck && head -15 main.go"}

package main

import (
	"bufio"
	"bytes"
	"fmt"
	"log"
	"net"
	"net/http"
	"net/http/httputil"
	"net/url"
	"os"
	"os/exec"
	"strconv"
	"strings"

{"find": "\t\"fmt\"\n\t\"log\"\n\t\"net\"", "path": "/tmp/mechcheck/main.go", "replace": "\t\"fmt\"\n\t\"io\"\n\t\"log\"\n\t\"net\""}

1 occurrences replaced

{"command": "cd /tmp/mechcheck && rm -rf clone && go run main.go 2>&1 | tail -30"}

forge at http://127.0.0.1:42077
proxy at 127.0.0.1:36707
FORGE GOT: GET /acme/widgets.git/info/refs?service=git-upload-pack auth=Basic Z3JlZzp0b2tlbg== x-zoo-run=
FORGE GOT: POST /acme/widgets.git/git-upload-pack auth=Basic Z3JlZzp0b2tlbg== x-zoo-run=
Cloning into '/tmp/mechcheck/clone'...
POST git-upload-pack (181 bytes)
error: RPC failed; HTTP 415 curl 22 The requested URL returned error: 415
fatal: expected flush after ref listing

2026/08/25 22:14:35 clone failed:exit status 128
exit status 1

{"find": "\t\tif r.ContentLength > 0 {\n\t\t\tcmd.Env = append(cmd.Env, \"CONTENT_LENGTH=\"+strconv.FormatInt(r.ContentLength, 10))\n\t\t}\n\t\tfor k, vs := range r.Header {\n\t\t\tcmd.Env = append(cmd.Env, \"HTTP_\"+strings.ToUpper(strings.ReplaceAll(k, \"-\", \"_\"))+\"=\"+strings.Join(vs, \",\"))\n\t\t}", "path": "/tmp/mechcheck/main.go", "replace": "\t\tif r.ContentLength > 0 {\n\t\t\tcmd.Env = append(cmd.Env, \"CONTENT_LENGTH=\"+strconv.FormatInt(r.ContentLength, 10))\n\t\t}\n\t\tif ct := r.Header.Get(\"Content-Type\"); ct != \"\" {\n\t\t\tcmd.Env = append(cmd.Env, \"CONTENT_TYPE=\"+ct)\n\t\t}\n\t\tfor k, vs := range r.Header {\n\t\t\tif k == \"Content-Type\" || k == \"Content-Length\" {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tcmd.Env = append(cmd.Env, \"HTTP_\"+strings.ToUpper(strings.ReplaceAll(k, \"-\", \"_\"))+\"=\"+strings.Join(vs, \",\"))\n\t\t}"}

1 occurrences replaced

{"command": "cd /tmp/mechcheck && rm -rf clone && go run main.go 2>&1 | tail -30"}

forge at http://127.0.0.1:45525
proxy at 127.0.0.1:36777
FORGE GOT: GET /acme/widgets.git/info/refs?service=git-upload-pack auth=Basic Z3JlZzp0b2tlbg== x-zoo-run=
FORGE GOT: POST /acme/widgets.git/git-upload-pack auth=Basic Z3JlZzp0b2tlbg== x-zoo-run=
FORGE GOT: POST /acme/widgets.git/git-upload-pack auth=Basic Z3JlZzp0b2tlbg== x-zoo-run=
Cloning into '/tmp/mechcheck/clone'...
POST git-upload-pack (181 bytes)
POST git-upload-pack (223 bytes)

CLONE OK
FORGE GOT: GET /acme/widgets.git/info/refs?service=git-receive-pack auth=Basic Z3JlZzp0b2tlbg== x-zoo-run=
Pushing to http://127.0.0.1:45525/acme/widgets.git
fatal: unable to access 'http://127.0.0.1:45525/acme/widgets.git/': The requested URL returned error: 403

2026/08/25 22:15:05 push failed:exit status 128
exit status 1

{"find": "\t\t\t\"GIT_PROJECT_ROOT=\"+projectRoot,\n\t\t\t\"GIT_HTTP_EXPORT_ALL=1\",", "path": "/tmp/mechcheck/main.go", "replace": "\t\t\t\"GIT_PROJECT_ROOT=\"+projectRoot,\n\t\t\t\"GIT_HTTP_EXPORT_ALL=1\",\n\t\t\t\"GIT_HTTP_RECEIVE_PACK=1\","}

1 occurrences replaced

{"command": "cd /tmp/mechcheck && rm -rf clone && go run main.go 2>&1 | tail -22"}

forge at http://127.0.0.1:41029
proxy at 127.0.0.1:41301
FORGE GOT: GET /acme/widgets.git/info/refs?service=git-upload-pack auth=Basic Z3JlZzp0b2tlbg== x-zoo-run=
FORGE GOT: POST /acme/widgets.git/git-upload-pack auth=Basic Z3JlZzp0b2tlbg== x-zoo-run=
FORGE GOT: POST /acme/widgets.git/git-upload-pack auth=Basic Z3JlZzp0b2tlbg== x-zoo-run=
Cloning into '/tmp/mechcheck/clone'...
POST git-upload-pack (181 bytes)
POST git-upload-pack (223 bytes)

CLONE OK
FORGE GOT: GET /acme/widgets.git/info/refs?service=git-receive-pack auth=Basic Z3JlZzp0b2tlbg== x-zoo-run=
Pushing to http://127.0.0.1:41029/acme/widgets.git
fatal: unable to access 'http://127.0.0.1:41029/acme/widgets.git/': The requested URL returned error: 403

2026/08/25 22:15:19 push failed:exit status 128
exit status 1

{"command": "cd /tmp/gitsrc && grep -n \"receive-pack\\|receive_pack\\|RECEIVE\" http-backend.c | head -20"}

44:	{ "receive-pack", "receivepack", 0, -1 },
746:	{"POST", "/git-receive-pack$", service_rpc}

{"command": "cd /tmp/gitsrc && sed -n '30,60p' http-backend.c && grep -n \"http.receivepack\\|check_service\\|403\" http-backend.c | head"}

static int getanyfile = 1;
static unsigned long max_request_buffer = 10 * 1024 * 1024;

static struct string_list *query_params;

struct rpc_service {
	const char *name;
	const char *config_name;
	unsigned buffer_input : 1;
	signed enabled : 2;
};

static struct rpc_service rpc_service[] = {
	{ "upload-pack", "uploadpack", 1, 1 },
	{ "receive-pack", "receivepack", 0, -1 },
	{ "upload-archive", "uploadarchive", 0, -1 },
};

static struct string_list *get_parameters(void)
{
	if (!query_params) {
		const char *query = getenv("QUERY_STRING");

		CALLOC_ARRAY(query_params, 1);
		while (query && *query) {
			char *name = url_decode_parameter_name(&query);
			char *value = url_decode_parameter_value(&query);
			struct string_list_item *i;

			i = string_list_lookup(query_params, name);
			if (!i)
160:	http_status(hdr, 403, "Forbidden");

{"find": "\t\t\t\"GIT_PROJECT_ROOT=\"+projectRoot,\n\t\t\t\"GIT_HTTP_EXPORT_ALL=1\",\n\t\t\t\"GIT_HTTP_RECEIVE_PACK=1\",", "path": "/tmp/mechcheck/main.go", "replace": "\t\t\t\"GIT_PROJECT_ROOT=\"+projectRoot,\n\t\t\t\"GIT_HTTP_EXPORT_ALL=1\","}

1 occurrences replaced

{"command": "cd /tmp/mechcheck && git -C forge/acme/widgets.git config http.receivepack true && rm -rf clone && go run main.go 2>&1 | tail -22"}

forge at http://127.0.0.1:39053
proxy at 127.0.0.1:37743
FORGE GOT: GET /acme/widgets.git/info/refs?service=git-upload-pack auth=Basic Z3JlZzp0b2tlbg== x-zoo-run=
FORGE GOT: POST /acme/widgets.git/git-upload-pack auth=Basic Z3JlZzp0b2tlbg== x-zoo-run=
FORGE GOT: POST /acme/widgets.git/git-upload-pack auth=Basic Z3JlZzp0b2tlbg== x-zoo-run=
Cloning into '/tmp/mechcheck/clone'...
POST git-upload-pack (181 bytes)
POST git-upload-pack (223 bytes)

CLONE OK
FORGE GOT: GET /acme/widgets.git/info/refs?service=git-receive-pack auth=Basic Z3JlZzp0b2tlbg== x-zoo-run=
FORGE GOT: POST /acme/widgets.git/git-receive-pack auth=Basic Z3JlZzp0b2tlbg== x-zoo-run=
Pushing to http://127.0.0.1:39053/acme/widgets.git
POST git-receive-pack (219 bytes)
To http://127.0.0.1:39053/acme/widgets.git
 * [new branch]      HEAD -> pushed
updating local tracking ref 'refs/remotes/origin/pushed'

PUSH OK
FORGE GOT: GET /api/v1/repos auth= x-zoo-run=
direct forge api (no proxy): 404
proxy with wrong secret: 403

{"command": "cd /project && grep -rn \"token\\|Token\" internal/agentrun/*.go | grep -v \"_test.go\" | grep -vi \"llm\" | head -30; echo ===; cat internal/agentrun/context.go | head -60"}

internal/agentrun/run.go:3:// inside it (authenticated with the agent's own Forgejo token), the
internal/agentrun/run.go:72:// agent (using the agent's own token from config). This lets each agent
internal/agentrun/run.go:73:// act as themselves on Forgejo without needing a global token with sudo
internal/agentrun/run.go:77:// If the agent has no token configured, falls back to the shared zoo
internal/agentrun/run.go:78:// identity so existing deployments without per-agent tokens still work.
internal/agentrun/run.go:79:func (r *Runner) forgejoAs(agentName, token string) *forgejo.Client {
internal/agentrun/run.go:88:	if token != "" {
internal/agentrun/run.go:89:		c = r.forgejo.As(token)
internal/agentrun/run.go:92:		// if we ever want to enforce per-agent tokens.
internal/agentrun/run.go:179:	// agent's own Forgejo token when configured, so its git activity is
internal/agentrun/run.go:181:	// identity for deployments without per-agent tokens (mirroring
internal/agentrun/run.go:183:	gitUser, gitToken := "zoo", r.forgejo.Token()
internal/agentrun/run.go:185:	if agent.Token != "" {
internal/agentrun/run.go:186:		gitUser, gitToken = agent.Name, agent.Token
internal/agentrun/run.go:213:	if err := configureSandboxGit(ctx, r.docker, containerID, repoInfo.CloneURL, gitUser, gitToken, gitName, gitEmail); err != nil {
internal/agentrun/run.go:239:			client: r.forgejoAs(agent.Name, agent.Token),
internal/agentrun/sandboxgit.go:54:// authenticates git's smart-HTTP requests as user with token.
internal/agentrun/sandboxgit.go:55:func gitAuthHeader(user, token string) string {
internal/agentrun/sandboxgit.go:56:	auth := base64.StdEncoding.EncodeToString([]byte(user + ":" + token))
internal/agentrun/sandboxgit.go:83://     for submodules and other repos on the same forge. The token is
internal/agentrun/sandboxgit.go:92:// tree: the origin remote keeps the plain cloneURL, so the token can't
internal/agentrun/sandboxgit.go:95:func configureSandboxGit(ctx context.Context, rt *dockerRuntime, containerID, cloneURL, user, token, name, email string) error {
internal/agentrun/sandboxgit.go:108:	if _, err := runSandboxGit(ctx, rt, containerID, "config", "--global", "http."+forgeHost(cloneURL)+".extraHeader", gitAuthHeader(user, token)); err != nil {
===
package agentrun

import (
	"context"
	"fmt"

	"github.com/abrander/zoo/internal/tools"
)

// runContext implements tools.Context for a single agent run, executing
// shell commands via docker exec against the run's container, and
// binding Forgejo actions to the triggering issue/PR.
type runContext struct {
	docker      *dockerRuntime
	containerID string
	forgejo     tools.ForgejoActions
}

func (c *runContext) Exec(ctx context.Context, command string) (string, error) {
	output, exitCode, err := c.docker.exec(ctx, c.containerID, command)

	if err != nil {
		return output, err
	}

	if exitCode != 0 {
		return output, fmt.Errorf("command exited with status %d", exitCode)
	}

	return output, nil
}

func (c *runContext) Forgejo() tools.ForgejoActions {
	return c.forgejo
}

{"content": "package agentrun\n\nimport (\n\t\"crypto/rand\"\n\t\"crypto/subtle\"\n\t\"encoding/base64\"\n\t\"encoding/hex\"\n\t\"fmt\"\n\t\"log/slog\"\n\t\"net\"\n\t\"net/http\"\n\t\"net/http/httputil\"\n\t\"net/url\"\n\t\"strings\"\n\t\"time\"\n)\n\n// This file keeps the run's Forgejo credential out of the agent's\n// container.\n//\n// The sandbox's git must authenticate for clone/fetch/pull/push, but\n// the token it would need can do everything on the Forgejo instance —\n// handing it to a container an LLM runs arbitrary commands in is a\n// standing invitation to prompt-injection exfiltration.\n//\n// Git can only be told to route its HTTP traffic through a TCP proxy\n// (http.<url>.proxy; git supports http/https/socks5 proxies, not unix\n// sockets), so zoo runs a tiny per-run HTTP proxy next to the\n// container and points the sandbox's git at it. The proxy:\n//\n//   - only accepts requests addressed to the forge host the run's\n//     repository lives on, and only for git's smart-HTTP endpoints\n//     (info/refs, git-upload-pack, git-receive-pack) — the Forgejo\n//     API and everything else is refused;\n//   - only accepts requests carrying the run's secret, a random\n//     per-run value the sandbox's git sends as an extra header — so\n//     other processes on the host or in other containers can't ride\n//     the proxy;\n//   - strips any client-supplied Authorization header and injects the\n//     run's own credential, which therefore exists only in zoo's\n//     process on the host.\n//\n// The sandbox can read its own run secret (it lives in the\n// container's gitconfig), but the secret only buys git smart-HTTP\n// against the forge — the same scope the agent's git operations\n// already have. The token itself never enters the container: not on\n// disk, not in the environment, not in any process's memory. When the\n// run ends the proxy is closed and the secret is dead, even in a\n// container kept around for debugging.\n\n// gitProxyRunHeader is the header the sandbox's git sends on every\n// request to the forge, carrying the per-run secret.\nconst gitProxyRunHeader = \"X-Zoo-Run\"\n\n// gitProxyEndpoint is one (bind address, address the sandbox dials)\n// pair the proxy can be started on.\ntype gitProxyEndpoint struct {\n\t// bind is the host address the proxy listens on, e.g. the\n\t// container's network gateway or \"0.0.0.0\".\n\tbind string\n\t// containerHost is the address the sandbox's git is told to use\n\t// to reach the proxy, e.g. the same gateway or\n\t// \"host.docker.internal\".\n\tcontainerHost string\n}\n\ntype gitProxy struct {\n\tsrv         *http.Server\n\tln          net.Listener\n\taddr        string // host:port the sandbox's git dials\n\tforgeURL    *url.URL\n\tauthHeader  string\n\trunSecret   string\n\tproxy       *httputil.ReverseProxy\n\tlogger      *slog.Logger\n}\n\n// newGitProxy starts a per-run git proxy. endpoints are tried in\n// order until one binds; the one that does determines the address the\n// sandbox's git is told to use. forgeURL is the forge the proxy\n// forwards to (the run's repository's clone URL).\nfunc newGitProxy(endpoints []gitProxyEndpoint, forgeURL, user, token string, logger *slog.Logger) (*gitProxy, error) {\n\tu, err := url.Parse(forgeURL)\n\tif err != nil || u.Host == \"\" || (u.Scheme != \"http\" && u.Scheme != \"https\") {\n\t\treturn nil, fmt.Errorf(\"git proxy: unsupported forge URL %q\", forgeURL)\n\t}\n\n\tsecret, err := randomHex(16)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"git proxy: generate run secret: %w\", err)\n\t}\n\n\tp := &gitProxy{\n\t\tforgeURL:   u,\n\t\tauthHeader: gitAuthHeader(user, token),\n\t\trunSecret:  secret,\n\t\tlogger:     logger,\n\t\tproxy: &httputil.ReverseProxy{\n\t\t\tDirector: func(req *http.Request) {\n\t\t\t\t// The request arrives in absolute form (git talks\n\t\t\t\t// to a proxy); the host was validated in\n\t\t\t\t// ServeHTTP, so pin the target here.\n\t\t\t\treq.URL.Scheme = u.Scheme\n\t\t\t\treq.URL.Host = u.Host\n\t\t\t\treq.Host = u.Host\n\t\t\t},\n\t\t\tErrorHandler: func(w http.ResponseWriter, req *http.Request, err error) {\n\t\t\t\tlogger.Error(\"git proxy: forwarding failed\", \"path\", req.URL.Path, \"error\", err)\n\t\t\t\thttp.Error(w, \"git proxy: upstream error\", http.StatusBadGateway)\n\t\t\t},\n\t\t},\n\t}\n\n\tvar lastErr error\n\n\tfor _, ep := range endpoints {\n\t\tln, err := net.Listen(\"tcp\", net.JoinHostPort(ep.bind, \"0\"))\n\t\tif err != nil {\n\t\t\tlastErr = err\n\t\t\tcontinue\n\t\t}\n\n\t\tp.ln = ln\n\t\tp.addr = net.JoinHostPort(ep.containerHost, ln.Addr().(*net.TCPAddr).Port)\n\t\tp.srv = &http.Server{Handler: p, ReadHeaderTimeout: 10 * time.Second}\n\t\tgo p.srv.Serve(ln)\n\n\t\treturn p, nil\n\t}\n\n\treturn nil, fmt.Errorf(\"git proxy: no endpoint could bind (last error: %w)\", lastErr)\n}\n\n// ProxyValue is the value of the sandbox's http.<host>.proxy git\n// setting: the address of this proxy, as the container reaches it.\nfunc (p *gitProxy) ProxyValue() string {\n\treturn \"http://\" + p.addr\n}\n\n// RunSecretHeader is the value of the sandbox's http.<host>.extraHeader\n// git setting: the per-run secret, sent on every request to the forge.\nfunc (p *gitProxy) RunSecretHeader() string {\n\treturn gitProxyRunHeader + \": \" + p.runSecret\n}\n\n// Close stops the proxy and frees its port.\nfunc (p *gitProxy) Close() error {\n\treturn p.srv.Close()\n}\n\n// ServeHTTP gates and forwards one request from the sandbox's git.\nfunc (p *gitProxy) ServeHTTP(w http.ResponseWriter, r *http.Request) {\n\tif subtle.ConstantTimeCompare([]byte(r.Header.Get(gitProxyRunHeader)), []byte(p.runSecret)) != 1 {\n\t\tp.reject(w, r, \"missing or invalid run secret\")\n\n\t\treturn\n\t}\n\n\t// The request is in absolute form (git talks to a proxy), so the\n\t// addressed host is in the URL. Only the forge the run's\n\t// repository lives on may be addressed.\n\tu := r.URL\n\n\tif u.Scheme != p.forgeURL.Scheme || !strings.EqualFold(u.Host, p.forgeURL.Host) {\n\t\tp.reject(w, r, \"not the run's forge host\")\n\n\t\treturn\n\t}\n\n\tif !isGitSmartHTTPRequest(u.Path, u.RawQuery) {\n\t\tp.reject(w, r, \"not a git smart-HTTP endpoint\")\n\n\t\treturn\n\t}\n\n\t// The client's own credentials (if any) and the run secret are\n\t// stripped; the run's credential is injected here, on the host.\n\tr.Header.Del(\"Authorization\")\n\tr.Header.Del(\"Proxy-Authorization\")\n\tr.Header.Del(gitProxyRunHeader)\n\tr.Header.Set(\"Authorization\", p.authHeader)\n\n\tp.proxy.ServeHTTP(w, r)\n}\n\nfunc (p *gitProxy) reject(w http.ResponseWriter, r *http.Request, reason string) {\n\tp.logger.Warn(\"git proxy: rejected request\", \"reason\", reason, \"path\", r.URL.Path)\n\thttp.Error(w, \"zoo git proxy: \"+reason, http.StatusForbidden)\n}\n\n// gitSmartHTTPEndpoints are the endpoints of git's smart-HTTP\n// protocol: the ref advertisement, and the pack transfer endpoints\n// for fetch (upload-pack) and push (receive-pack).\nvar gitSmartHTTPEndpoints = map[string]bool{\n\t\"info/refs\":        true,\n\t\"git-upload-pack\":  true,\n\t\"git-receive-pack\": true,\n}\n\n// isGitSmartHTTPRequest reports whether a request for path (with the\n// given raw query string) is one of git's smart-HTTP endpoints on a\n// repository: /owner/repo(.git)?/<endpoint>.\nfunc isGitSmartHTTPRequest(path, rawQuery string) bool {\n\tsegments := strings.Split(strings.Trim(path, \"/\"), \"/\")\n\tif len(segments) != 3 || segments[0] == \"\" || segments[1] == \"\" {\n\t\treturn false\n\t}\n\n\tendpoint := segments[2]\n\tif !gitSmartHTTPEndpoints[endpoint] {\n\t\treturn false\n\t}\n\n\t// The ref advertisement only means anything to git with a\n\t// service parameter naming the pack protocol; a bare info/refs is\n\t// the dumb-HTTP protocol, which git clients don't use.\n\tif endpoint != \"info/refs\" {\n\t\treturn true\n\t}\n\n\tq, err := url.ParseQuery(rawQuery)\n\tif err != nil {\n\t\treturn false\n\t}\n\n\tswitch q.Get(\"service\") {\n\tcase \"git-upload-pack\", \"git-receive-pack\":\n\t\treturn true\n\t}\n\n\treturn false\n}\n\n// gitAuthHeader returns the value of an Authorization header that\n// authenticates git's smart-HTTP requests as user with token.\nfunc gitAuthHeader(user, token string) string {\n\treturn \"Basic \" + base64.StdEncoding.EncodeToString([]byte(user+\":\"+token))\n}\n\n// randomHex returns n random bytes as a hex string.\nfunc randomHex(n int) (string, error) {\n\tb := make([]byte, n)\n\tif _, err := rand.Read(b); err != nil {\n\t\treturn \"\", err\n\t}\n\n\treturn hex.EncodeToString(b), nil\n}\n", "path": "internal/agentrun/gitproxy.go"}

OK

{"find": "// This file makes git \"just work\" inside the agent's container: the\n// initial clone happens in the sandbox, and the sandbox's git\n// credential is written to the container's system gitconfig so every\n// subsequent remote operation (pull, fetch, push, ...) authenticates\n// without any per-invocation plumbing. Zoo itself never runs git\n// outside the sandbox.", "path": "internal/agentrun/sandboxgit.go", "replace": "// This file makes git \"just work\" inside the agent's container: the\n// initial clone happens in the sandbox, and the sandbox's git is\n// pointed at the per-run git proxy (see gitproxy.go) so every\n// subsequent remote operation (pull, fetch, push, ...) authenticates\n// without any per-invocation plumbing. The run's Forgejo credential\n// is injected by the proxy on the host side and never enters the\n// container. Zoo itself never runs git outside the sandbox."}

1 occurrences replaced

{"find": "// gitAuthHeader returns the value of an Authorization header that\n// authenticates git's smart-HTTP requests as user with token.\nfunc gitAuthHeader(user, token string) string {\n\tauth := base64.StdEncoding.EncodeToString([]byte(user + \":\" + token))\n\n\treturn \"Authorization: Basic \" + auth\n}\n\n// forgeHost returns", "path": "internal/agentrun/sandboxgit.go", "replace": "// forgeHost returns"}

1 occurrences replaced

{"find": "// configureSandboxGit writes the container's system gitconfig so git\n// works inside the sandbox without further setup:\n//\n//   - safe.directory '*', so the bind-mounted /project is accepted\n//     regardless of which UID the container runs git as;\n//   - user.name / user.email, so commits are attributed to the agent;\n//   - http.<host>.extraHeader carrying the run's Forgejo credential,\n//     scoped to the forge host the repository lives on, so\n//     clone/fetch/pull/push all authenticate transparently — including\n//     for submodules and other repos on the same forge. The token is\n//     only valid on that forge anyway, so the host scope grants no\n//     extra access; git never sends it anywhere else;\n//   - push.autoSetupRemote, so a bare `git push` on the fresh working\n//     branch pushes it to origin and sets the upstream — after which\n//     a bare `git pull` works too.\n//\n// The credential lives in the container's own filesystem (ephemeral,\n// torn down with the container), never in the bind-mounted working\n// tree: the origin remote keeps the plain cloneURL, so the token can't\n// leak into the repo's .git/config, into a work dir zoo keeps on\n// failure, or anywhere the host can read it back.\nfunc configureSandboxGit(ctx context.Context, rt *dockerRuntime, containerID, cloneURL, user, token, name, email string) error {\n\tif _, err := runSandboxGit(ctx, rt, containerID, \"config\", \"--global\", \"--add\", \"safe.directory\", \"*\"); err != nil {\n\t\treturn fmt.Errorf(\"configure safe.directory: %w\", err)\n\t}\n\n\tif _, err := runSandboxGit(ctx, rt, containerID, \"config\", \"--global\", \"user.name\", name); err != nil {\n\t\treturn fmt.Errorf(\"configure user.name: %w\", err)\n\t}\n\n\tif _, err := runSandboxGit(ctx, rt, containerID, \"config\", \"--global\", \"user.email\", email); err != nil {\n\t\treturn fmt.Errorf(\"configure user.email: %w\", err)\n\t}\n\n\tif _, err := runSandboxGit(ctx, rt, containerID, \"config\", \"--global\", \"http.\"+forgeHost(cloneURL)+\".extraHeader\", gitAuthHeader(user, token)); err != nil {\n\t\treturn fmt.Errorf(\"configure git credential: %w\", err)\n\t}\n\n\tif _, err := runSandboxGit(ctx, rt, containerID, \"config\", \"--global\", \"push.autoSetupRemote\", \"true\"); err != nil {\n\t\treturn fmt.Errorf(\"configure push.autoSetupRemote: %w\", err)\n\t}\n\n\treturn nil\n}\n\n// cloneAndBranch clones cloneURL into /project inside the container\n// and checks out a fresh branch off defaultBranch. The clone\n// authenticates via the http.<host>.extraHeader configured by\n// configureSandboxGit, and the origin remote is left with the plain\n// cloneURL: no credential ends up in the working tree.", "path": "internal/agentrun/sandboxgit.go", "replace": "// configureSandboxGit writes the container's gitconfig so git works\n// inside the sandbox without further setup:\n//\n//   - safe.directory '*', so the bind-mounted /project is accepted\n//     regardless of which UID the container runs git as;\n//   - user.name / user.email, so commits are attributed to the agent;\n//   - http.<host>.proxy pointing at the per-run git proxy (see\n//     gitproxy.go) and http.<host>.extraHeader carrying the run\n//     secret, both scoped to the forge host the repository lives on:\n//     every remote operation (clone/fetch/pull/push) is routed through\n//     the proxy, which injects the run's credential on the host side —\n//     the token never enters the container. The host scope keeps\n//     submodules and other repos on the same forge working; git never\n//     sends the secret anywhere else;\n//   - push.autoSetupRemote, so a bare `git push` on the fresh working\n//     branch pushes it to origin and sets the upstream — after which\n//     a bare `git pull` works too.\n//\n// The run secret lives in the container's own filesystem (ephemeral,\n// torn down with the container), never in the bind-mounted working\n// tree: the origin remote keeps the plain cloneURL, so nothing\n// credential-shaped leaks into the repo's .git/config, into a work dir\n// zoo keeps on failure, or anywhere the host can read it back.\nfunc configureSandboxGit(ctx context.Context, rt *dockerRuntime, containerID, cloneURL, proxyValue, runSecretHeader, name, email string) error {\n\tif _, err := runSandboxGit(ctx, rt, containerID, \"config\", \"--global\", \"--add\", \"safe.directory\", \"*\"); err != nil {\n\t\treturn fmt.Errorf(\"configure safe.directory: %w\", err)\n\t}\n\n\tif _, err := runSandboxGit(ctx, rt, containerID, \"config\", \"--global\", \"user.name\", name); err != nil {\n\t\treturn fmt.Errorf(\"configure user.name: %w\", err)\n\t}\n\n\tif _, err := runSandboxGit(ctx, rt, containerID, \"config\", \"--global\", \"user.email\", email); err != nil {\n\t\treturn fmt.Errorf(\"configure user.email: %w\", err)\n\t}\n\n\tif _, err := runSandboxGit(ctx, rt, containerID, \"config\", \"--global\", \"http.\"+forgeHost(cloneURL)+\".proxy\", proxyValue); err != nil {\n\t\treturn fmt.Errorf(\"configure git proxy: %w\", err)\n\t}\n\n\tif _, err := runSandboxGit(ctx, rt, containerID, \"config\", \"--global\", \"http.\"+forgeHost(cloneURL)+\".extraHeader\", runSecretHeader); err != nil {\n\t\treturn fmt.Errorf(\"configure git run secret: %w\", err)\n\t}\n\n\tif _, err := runSandboxGit(ctx, rt, containerID, \"config\", \"--global\", \"push.autoSetupRemote\", \"true\"); err != nil {\n\t\treturn fmt.Errorf(\"configure push.autoSetupRemote: %w\", err)\n\t}\n\n\treturn nil\n}\n\n// cloneAndBranch clones cloneURL into /project inside the container\n// and checks out a fresh branch off defaultBranch. The clone\n// authenticates via the per-run git proxy configured by\n// configureSandboxGit, and the origin remote is left with the plain\n// cloneURL: no credential ends up in the working tree."}

1 occurrences replaced

{"end_line": 15, "path": "internal/agentrun/sandboxgit.go", "start_line": 1}

{"path":"internal/agentrun/sandboxgit.go","content":"package agentrun\n\nimport (\n\t\"context\"\n\t\"encoding/base64\"\n\t\"fmt\"\n\t\"net/url\"\n\t\"strings\"\n)\n\n// This file makes git \"just work\" inside the agent's container: the\n// initial clone happens in the sandbox, and the sandbox's git is\n// pointed at the per-run git proxy (see gitproxy.go) so every\n// subsequent remote operation (pull, fetch, push, ...) authenticates\n// without any per-invocation plumbing. The run's Forgejo credential","start_line":1,"end_line":15,"total_lines":157,"truncated":true}

{"find": "import (\n\t\"context\"\n\t\"encoding/base64\"\n\t\"fmt\"\n\t\"net/url\"\n\t\"strings\"\n)", "path": "internal/agentrun/sandboxgit.go", "replace": "import (\n\t\"context\"\n\t\"fmt\"\n\t\"net/url\"\n\t\"strings\"\n)"}

1 occurrences replaced

{"find": "// exec runs command via `sh -c` inside containerID and returns its", "path": "internal/agentrun/docker.go", "replace": "// containerGateway returns the gateway IP of the container's network:\n// the address the container uses to reach the host. It's how the\n// per-run git proxy (see gitproxy.go) finds an address it can bind to\n// that the container can dial. Empty string if the container has no\n// network with a gateway.\nfunc (d *dockerRuntime) containerGateway(ctx context.Context, containerID string) (string, error) {\n\tinsp, err := d.cli.ContainerInspect(ctx, containerID)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"inspect container: %w\", err)\n\t}\n\n\tfor _, n := range insp.NetworkSettings.Networks {\n\t\tif n.Gateway != \"\" {\n\t\t\treturn n.Gateway, nil\n\t\t}\n\t}\n\n\treturn \"\", nil\n}\n\n// exec runs command via `sh -c` inside containerID and returns its"}

1 occurrences replaced

{"find": "// Package agentrun creates the throwaway per-job environment an agent\n// runs in: a Docker container with the agent's git working tree cloned\n// inside it (authenticated with the agent's own Forgejo token), the\n// triggering event written to /event, and the tool-calling loop\n// (internal/llm + internal/tools) driven against it.", "path": "internal/agentrun/run.go", "replace": "// Package agentrun creates the throwaway per-job environment an agent\n// runs in: a Docker container with the agent's git working tree cloned\n// inside it (git traffic routed through a per-run proxy that injects\n// the agent's Forgejo credential on the host side, so the token never\n// enters the container — see gitproxy.go), the triggering event\n// written to /event, and the tool-calling loop (internal/llm +\n// internal/tools) driven against it."}

1 occurrences replaced

{"find": "\tdefer func() {\n\t\tcleanupCtx, cleanupCancel := context.WithTimeout(context.Background(), 30*time.Second)\n\t\tdefer cleanupCancel()\n\t\tif err := r.docker.remove(cleanupCtx, containerID); err != nil {\n\t\t\tlogger.Warn(\"failed to remove container\", \"container\", containerID, \"error\", err)\n\t\t}\n\t}()\n\n\t// Git must simply work inside the sandbox: safe.directory, commit\n\t// identity, and the remote credential all go into the container's\n\t// system gitconfig (see configureSandboxGit).\n\tif err := configureSandboxGit(ctx, r.docker, containerID, repoInfo.CloneURL, gitUser, gitToken, gitName, gitEmail); err != nil {\n\t\treturn fmt.Errorf(\"configure git in container: %w\", err)\n\t}", "path": "internal/agentrun/run.go", "replace": "\tdefer func() {\n\t\tcleanupCtx, cleanupCancel := context.WithTimeout(context.Background(), 30*time.Second)\n\t\tdefer cleanupCancel()\n\t\tif err := r.docker.remove(cleanupCtx, containerID); err != nil {\n\t\t\tlogger.Warn(\"failed to remove container\", \"container\", containerID, \"error\", err)\n\t\t}\n\t}()\n\n\t// The git proxy stands between the sandbox's git and the forge,\n\t// injecting the run's credential on the host side so the token\n\t// never enters the container (see gitproxy.go). The container\n\t// reaches it over TCP: prefer the container's network gateway,\n\t// which is a local host address on a local Docker daemon; if that\n\t// doesn't bind (e.g. Docker Desktop, where the daemon runs in a\n\t// VM) fall back to all interfaces, which the container dials via\n\t// host.docker.internal.\n\tendpoints := []gitProxyEndpoint{{bind: \"0.0.0.0\", containerHost: \"host.docker.internal\"}}\n\n\tif gw, err := r.docker.containerGateway(ctx, containerID); err != nil {\n\t\tlogger.Warn(\"could not determine container gateway; git proxy will bind to all interfaces\", \"error\", err)\n\t} else if gw != \"\" {\n\t\tendpoints = append([]gitProxyEndpoint{{bind: gw, containerHost: gw}}, endpoints...)\n\t}\n\n\tgitProxy, err := newGitProxy(endpoints, repoInfo.CloneURL, gitUser, gitToken, logger)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"start git proxy: %w\", err)\n\t}\n\n\tdefer func() {\n\t\tif err := gitProxy.Close(); err != nil {\n\t\t\tlogger.Warn(\"failed to close git proxy\", \"error\", err)\n\t\t}\n\t}()\n\n\t// Git must simply work inside the sandbox: safe.directory, commit\n\t// identity, and the route to the git proxy all go into the\n\t// container's gitconfig (see configureSandboxGit).\n\tif err := configureSandboxGit(ctx, r.docker, containerID, repoInfo.CloneURL, gitProxy.ProxyValue(), gitProxy.RunSecretHeader(), gitName, gitEmail); err != nil {\n\t\treturn fmt.Errorf(\"configure git in container: %w\", err)\n\t}"}

1 occurrences replaced

{"find": "// Token returns the shared zoo Forgejo identity's token, e.g. for\n// authenticating a host-side git clone/push against Forgejo (see\n// internal/agentrun) without ever writing the credential into a working\n// tree an agent's container can read.", "path": "internal/forgejo/client.go", "replace": "// Token returns the shared zoo Forgejo identity's token. The git proxy\n// (internal/agentrun) uses it to authenticate the sandbox's git\n// operations on the host side, so the credential never enters a\n// container."}

1 occurrences replaced

{"find": "import (\n\t\"encoding/base64\"\n\t\"strings\"\n\t\"testing\"\n)", "path": "internal/agentrun/sandboxgit_test.go", "replace": "import (\n\t\"strings\"\n\t\"testing\"\n)"}

1 occurrences replaced