Job 7bf1c880-afc0-47b3-9434-25d595fae212

{"path": ".", "recursive": true}

/project/README.md
/project/cmd
/project/cmd/zoo
/project/cmd/zoo/main.go
/project/go.mod
/project/go.sum
/project/internal
/project/internal/agentrun
/project/internal/agentrun/clone.go
/project/internal/agentrun/context.go
/project/internal/agentrun/docker.go
/project/internal/agentrun/docker_integration_test.go
/project/internal/agentrun/forgejo.go
/project/internal/agentrun/loop.go
/project/internal/agentrun/roster.go
/project/internal/agentrun/roster_test.go
/project/internal/agentrun/run.go
/project/internal/agentrun/seed_test.go
/project/internal/agentrun/system.md
/project/internal/config
/project/internal/config/config.go
/project/internal/config/config_test.go
/project/internal/forgejo
/project/internal/forgejo/client.go
/project/internal/forgejo/client_test.go
/project/internal/forgejo/event.go
/project/internal/forgejo/poll.go
/project/internal/forgejo/poll_test.go
/project/internal/forgejo/watcher.go
/project/internal/forgejo/webhook.go
/project/internal/forgejo/webhook_test.go
/project/internal/livelog
/project/internal/livelog/hub.go
/project/internal/livelog/hub_test.go
/project/internal/llm
/project/internal/llm/client.go
/project/internal/llm/streamer.go
/project/internal/llm/streamer_test.go
/project/internal/llm/types.go
/project/internal/scheduler
/project/internal/scheduler/scheduler.go
/project/internal/scheduler/scheduler_test.go
/project/internal/store
/project/internal/store/schema.sql
/project/internal/store/store.go
/project/internal/store/store_test.go
/project/internal/tools
/project/internal/tools/bash.go
/project/internal/tools/context.go
/project/internal/tools/edit-file.go
/project/internal/tools/forgejo.go
/project/internal/tools/git.go
/project/internal/tools/grep_search.go
/project/internal/tools/list_files.go
/project/internal/tools/move_file.go
/project/internal/tools/read_file.go
/project/internal/tools/registry.go
/project/internal/tools/remove_file.go
/project/internal/tools/shell.go
/project/internal/tools/tools_test.go
/project/internal/tools/write_file.go
/project/internal/web
/project/internal/web/templates.go
/project/internal/web/web.go
/project/internal/web/web_test.go
/project/zoo.hcl.example

{"command": "cd /project && git log --oneline -5 && git status"}

f083eae (HEAD -> issue-48-greg, origin/main, origin/HEAD, main) Merge pull request 'Add pr:review event so agents react to PR reviews' (#37) from issue-36-greg into main
2b59027 Merge branch 'main' into issue-36-greg
c6a6304 Merge pull request 'docs: add comprehensive README for Zoo' (#44) from issue-43-anna into main
438a663 docs: clarify agents are in example config, not pre-configured
884245c Merge branch 'main' into issue-36-greg
On branch issue-48-greg
nothing to commit, working tree clean

{"path": "internal/agentrun/clone.go", "start_line": 1, "end_line": 200}

{"path":"internal/agentrun/clone.go","content":"package agentrun\r\n\r\nimport (\r\n\t\"context\"\r\n\t\"encoding/base64\"\r\n\t\"fmt\"\r\n\t\"os/exec\"\r\n\t\"strings\"\r\n)\r\n\r\n// gitAuthArgs returns the `-c http.extraHeader=...` global git arguments\r\n// that authenticate a single invocation as the shared zoo Forgejo\r\n// identity. Unlike embedding the token in the remote URL, a `-c`\r\n// override lives only for the lifetime of that one process and is never\r\n// written to .git/config on disk — where the container bind-mounting\r\n// this working tree (and any command an agent runs inside it via the\r\n// bash tool) could otherwise read it straight back out.\r\nfunc gitAuthArgs(token string) []string {\r\n\tauth := base64.StdEncoding.EncodeToString([]byte(\"zoo:\" + token))\r\n\r\n\treturn []string{\"-c\", \"http.extraHeader=Authorization: Basic \" + auth}\r\n}\r\n\r\n// cloneAndBranch clones cloneURL into dir, authenticating the clone\r\n// itself with token (see gitAuthArgs), and checks out a new branch off\r\n// of defaultBranch. token never ends up in the resulting working tree:\r\n// the origin remote is left with the plain cloneURL.\r\nfunc cloneAndBranch(ctx context.Context, cloneURL, token, defaultBranch, branch, dir string) error {\r\n\targs := append(gitAuthArgs(token), \"clone\", \"--branch\", defaultBranch, \"--single-branch\", cloneURL, dir)\r\n\tif out, err := runGit(ctx, \"\", args...); err != nil {\r\n\t\treturn fmt.Errorf(\"clone: %w: %s\", err, out)\r\n\t}\r\n\r\n\tif out, err := runGit(ctx, dir, \"checkout\", \"-b\", branch); err != nil {\r\n\t\treturn fmt.Errorf(\"checkout branch %q: %w: %s\", branch, err, out)\r\n\t}\r\n\r\n\treturn nil\r\n}\r\n\r\n// clonePRHead clones cloneURL into dir and checks out the pull request's\r\n// head as a local branch named headRef, so commits the agent makes push\r\n// straight to the PR. The head is fetched via the PR's refs/pull/\u003cn\u003e/head\r\n// ref rather than by branch name, which also works for PRs opened from a\r\n// fork, where the head branch doesn't exist in the base repo.\r\nfunc clonePRHead(ctx context.Context, cloneURL, token, defaultBranch, headRef string, index int64, dir string) error {\r\n\targs := append(gitAuthArgs(token), \"clone\", \"--branch\", defaultBranch, \"--single-branch\", cloneURL, dir)\r\n\tif out, err := runGit(ctx, \"\", args...); err != nil {\r\n\t\treturn fmt.Errorf(\"clone: %w: %s\", err, out)\r\n\t}\r\n\r\n\tfetchArgs := append(gitAuthArgs(token), \"fetch\", \"--no-tags\", \"origin\", fmt.Sprintf(\"refs/pull/%d/head\", index))\r\n\tif out, err := runGit(ctx, dir, fetchArgs...); err != nil {\r\n\t\treturn fmt.Errorf(\"fetch PR %d head: %w: %s\", index, err, out)\r\n\t}\r\n\r\n\tif out, err := runGit(ctx, dir, \"checkout\", \"-B\", headRef, \"FETCH_HEAD\"); err != nil {\r\n\t\treturn fmt.Errorf(\"checkout PR head %q: %w: %s\", headRef, err, out)\r\n\t}\r\n\r\n\treturn nil\r\n}\r\n\r\n// runGit runs a git subcommand on the host (not inside any container)\r\n// with no Forgejo credential attached.\r\nfunc runGit(ctx context.Context, dir string, args ...string) (string, error) {\r\n\tcmd := exec.CommandContext(ctx, \"git\", args...)\r\n\tif dir != \"\" {\r\n\t\tcmd.Dir = dir\r\n\t}\r\n\r\n\tout, err := cmd.CombinedOutput()\r\n\r\n\treturn strings.TrimSpace(string(out)), err\r\n}\r\n\r\n// runGitAuthed is runGit with token attached via gitAuthArgs, for the\r\n// one subcommand (push) that needs to authenticate against Forgejo.\r\nfunc runGitAuthed(ctx context.Context, dir, token string, args ...string) (string, error) {\r\n\treturn runGit(ctx, dir, append(gitAuthArgs(token), args...)...)\r\n}\r","start_line":1,"end_line":81,"total_lines":81,"truncated":false}

{"path": "internal/agentrun/docker.go", "start_line": 1, "end_line": 300}

{"path":"internal/agentrun/docker.go","content":"package agentrun\r\n\r\nimport (\r\n\t\"context\"\r\n\t\"fmt\"\r\n\t\"io\"\r\n\t\"time\"\r\n\r\n\t\"github.com/docker/docker/api/types/container\"\r\n\t\"github.com/docker/docker/client\"\r\n)\r\n\r\n// containerCPUs and containerMemory bound each agent container's\r\n// resource usage; there's no per-agent config knob for this yet (see\r\n// TODO.md), so every run gets the same sane default.\r\nconst (\r\n\tcontainerNanoCPUs = 2_000_000_000 // 2 CPUs\r\n\tcontainerMemory   = 2 \u003c\u003c 30       // 2 GiB\r\n)\r\n\r\ntype dockerRuntime struct {\r\n\tcli *client.Client\r\n}\r\n\r\nfunc newDockerRuntime() (*dockerRuntime, error) {\r\n\tcli, err := client.NewClientWithOpts(client.FromEnv, client.WithAPIVersionNegotiation())\r\n\tif err != nil {\r\n\t\treturn nil, fmt.Errorf(\"docker client: %w\", err)\r\n\t}\r\n\r\n\treturn \u0026dockerRuntime{cli: cli}, nil\r\n}\r\n\r\n// createContainer creates and starts a container from image with the\r\n// given bind mounts, kept alive with `sleep infinity` regardless of the\r\n// image's own entrypoint so it can be repeatedly `exec`'d into.\r\nfunc (d *dockerRuntime) createContainer(ctx context.Context, image string, binds []string, name string) (string, error) {\r\n\tresp, err := d.cli.ContainerCreate(ctx,\r\n\t\t\u0026container.Config{\r\n\t\t\tImage:      image,\r\n\t\t\tEntrypoint: []string{\"sleep\"},\r\n\t\t\tCmd:        []string{\"infinity\"},\r\n\t\t\tWorkingDir: \"/project\",\r\n\t\t},\r\n\t\t\u0026container.HostConfig{\r\n\t\t\tBinds: binds,\r\n\t\t\tResources: container.Resources{\r\n\t\t\t\tNanoCPUs: containerNanoCPUs,\r\n\t\t\t\tMemory:   containerMemory,\r\n\t\t\t},\r\n\t\t},\r\n\t\tnil, nil, name)\r\n\tif err != nil {\r\n\t\treturn \"\", fmt.Errorf(\"create container: %w\", err)\r\n\t}\r\n\r\n\tif err := d.cli.ContainerStart(ctx, resp.ID, container.StartOptions{}); err != nil {\r\n\t\treturn \"\", fmt.Errorf(\"start container: %w\", err)\r\n\t}\r\n\r\n\treturn resp.ID, nil\r\n}\r\n\r\n// exec runs command via `sh -c` inside containerID and returns its\r\n// combined stdout+stderr (a TTY is attached so the two streams merge\r\n// without needing to demultiplex Docker's stdcopy framing) plus its exit\r\n// code.\r\nfunc (d *dockerRuntime) exec(ctx context.Context, containerID, command string) (string, int, error) {\r\n\tcreated, err := d.cli.ContainerExecCreate(ctx, containerID, container.ExecOptions{\r\n\t\tCmd: []string{\"sh\", \"-c\", command},\r\n\t\t// A TTY is attached (see doc comment above), which makes git's\r\n\t\t// isatty-based color.ui=auto default to enabling ANSI color codes\r\n\t\t// that pollute the captured job log. NO_COLOR covers tools that\r\n\t\t// honor that convention; the GIT_CONFIG_* override forces git's\r\n\t\t// own color.ui to \"never\" regardless of tty detection, since git\r\n\t\t// does not honor NO_COLOR itself.\r\n\t\t//\r\n\t\t// The same isatty check makes git launch a pager for diff/log/show,\r\n\t\t// and the pager (waiting on a stdin nothing ever attaches or\r\n\t\t// closes) then blocks forever with no way to time it out — see\r\n\t\t// exec's read loop below. GIT_PAGER/PAGER=cat disable that.\r\n\t\t// GIT_TERMINAL_PROMPT=0 closes the same class of hang for\r\n\t\t// credential prompts on a private remote.\r\n\t\tEnv: []string{\r\n\t\t\t\"NO_COLOR=1\",\r\n\t\t\t\"GIT_CONFIG_COUNT=1\",\r\n\t\t\t\"GIT_CONFIG_KEY_0=color.ui\",\r\n\t\t\t\"GIT_CONFIG_VALUE_0=never\",\r\n\t\t\t\"GIT_PAGER=cat\",\r\n\t\t\t\"PAGER=cat\",\r\n\t\t\t\"GIT_TERMINAL_PROMPT=0\",\r\n\t\t},\r\n\t\tTty:          true,\r\n\t\tAttachStdout: true,\r\n\t\tAttachStderr: true,\r\n\t})\r\n\tif err != nil {\r\n\t\treturn \"\", 0, fmt.Errorf(\"exec create: %w\", err)\r\n\t}\r\n\r\n\tattached, err := d.cli.ContainerExecAttach(ctx, created.ID, container.ExecAttachOptions{Tty: true})\r\n\tif err != nil {\r\n\t\treturn \"\", 0, fmt.Errorf(\"exec attach: %w\", err)\r\n\t}\r\n\tdefer attached.Close()\r\n\r\n\t// Once hijacked, this stream is a raw connection that ctx cancellation\r\n\t// no longer reaches — a wedged child process (pager, credential\r\n\t// prompt, anything else reading a stdin nobody attaches) would\r\n\t// otherwise block this read forever, past the run's deadline, with no\r\n\t// way to recover the job. Race the read against ctx and force-remove\r\n\t// the container to sever the connection if it fires.\r\n\ttype readResult struct {\r\n\t\toutput []byte\r\n\t\terr    error\r\n\t}\r\n\r\n\treadDone := make(chan readResult, 1)\r\n\r\n\tgo func() {\r\n\t\toutput, err := io.ReadAll(attached.Reader)\r\n\t\treadDone \u003c- readResult{output, err}\r\n\t}()\r\n\r\n\tvar output []byte\r\n\r\n\tselect {\r\n\tcase res := \u003c-readDone:\r\n\t\tif res.err != nil {\r\n\t\t\treturn \"\", 0, fmt.Errorf(\"exec read output: %w\", res.err)\r\n\t\t}\r\n\r\n\t\toutput = res.output\r\n\r\n\tcase \u003c-ctx.Done():\r\n\t\tkillCtx, cancel := context.WithTimeout(context.Background(), 10*time.Second)\r\n\t\tdefer cancel()\r\n\r\n\t\t_ = d.cli.ContainerRemove(killCtx, containerID, container.RemoveOptions{Force: true})\r\n\t\t\u003c-readDone\r\n\r\n\t\treturn \"\", 0, ctx.Err()\r\n\t}\r\n\r\n\tinspect, err := d.cli.ContainerExecInspect(ctx, created.ID)\r\n\tif err != nil {\r\n\t\treturn string(output), 0, fmt.Errorf(\"exec inspect: %w\", err)\r\n\t}\r\n\r\n\treturn string(output), inspect.ExitCode, nil\r\n}\r\n\r\n// remove force-stops and removes containerID, ignoring \"already gone\"\r\n// errors so cleanup is safe to call unconditionally.\r\nfunc (d *dockerRuntime) remove(ctx context.Context, containerID string) error {\r\n\ttimeout := 5\r\n\t_ = d.cli.ContainerStop(ctx, containerID, container.StopOptions{Timeout: \u0026timeout})\r\n\r\n\tif err := d.cli.ContainerRemove(ctx, containerID, container.RemoveOptions{Force: true}); err != nil {\r\n\t\treturn fmt.Errorf(\"remove container: %w\", err)\r\n\t}\r\n\r\n\treturn nil\r\n}\r\n\r\nfunc (d *dockerRuntime) kill(ctx context.Context, containerID string) {\r\n\t_ = d.cli.ContainerKill(ctx, containerID, \"KILL\")\r\n}\r","start_line":1,"end_line":168,"total_lines":168,"truncated":false}

{"path": "internal/agentrun/run.go", "start_line": 1, "end_line": 400}

{"path":"internal/agentrun/run.go","content":"// Package agentrun creates the throwaway per-job environment an agent\r\n// runs in: a git clone + branch bind-mounted into a Docker container,\r\n// the triggering event written to /event, and the tool-calling loop\r\n// (internal/llm + internal/tools) driven against it.\r\npackage agentrun\r\n\r\nimport (\r\n\t\"context\"\r\n\t_ \"embed\"\r\n\t\"encoding/json\"\r\n\t\"fmt\"\r\n\t\"log/slog\"\r\n\t\"os\"\r\n\t\"path/filepath\"\r\n\t\"strings\"\r\n\t\"sync\"\r\n\t\"time\"\r\n\r\n\t\"github.com/abrander/zoo/internal/config\"\r\n\t\"github.com/abrander/zoo/internal/forgejo\"\r\n\t\"github.com/abrander/zoo/internal/livelog\"\r\n\t\"github.com/abrander/zoo/internal/llm\"\r\n\t\"github.com/abrander/zoo/internal/store\"\r\n)\r\n\r\n//go:embed system.md\r\nvar defaultSystemPrompt string\r\n\r\n// DefaultTimeout bounds a single agent run's wall-clock time if the\r\n// caller doesn't override it.\r\nconst DefaultTimeout = 120 * time.Minute\r\n\r\ntype Runner struct {\r\n\tdocker        *dockerRuntime\r\n\tforgejo       *forgejo.Client\r\n\tstore         *store.Store\r\n\thub           *livelog.Hub\r\n\tcfg           *config.Config\r\n\tlogger        *slog.Logger\r\n\ttimeout       time.Duration\r\n\tkeepOnFailure bool\r\n\r\n\tagentClientsMu sync.Mutex\r\n\tagentClients   map[string]*forgejo.Client\r\n}\r\n\r\nfunc NewRunner(cfg *config.Config, fg *forgejo.Client, st *store.Store, hub *livelog.Hub, logger *slog.Logger, timeout time.Duration, keepOnFailure bool) (*Runner, error) {\r\n\tdocker, err := newDockerRuntime()\r\n\tif err != nil {\r\n\t\treturn nil, err\r\n\t}\r\n\r\n\tif timeout \u003c= 0 {\r\n\t\ttimeout = DefaultTimeout\r\n\t}\r\n\r\n\treturn \u0026Runner{\r\n\t\tdocker:        docker,\r\n\t\tforgejo:       fg,\r\n\t\tstore:         st,\r\n\t\thub:           hub,\r\n\t\tcfg:           cfg,\r\n\t\tlogger:        logger,\r\n\t\ttimeout:       timeout,\r\n\t\tkeepOnFailure: keepOnFailure,\r\n\t\tagentClients:  make(map[string]*forgejo.Client),\r\n\t}, nil\r\n}\r\n\r\n// forgejoAs returns a Forgejo client that authenticates as the given\r\n// agent (using the agent's own token from config). This lets each agent\r\n// act as themselves on Forgejo without needing a global token with sudo\r\n// privileges. Clients are built once per agent and cached, since\r\n// constructing one costs an extra API round trip.\r\n//\r\n// If the agent has no token configured, falls back to the shared zoo\r\n// identity so existing deployments without per-agent tokens still work.\r\nfunc (r *Runner) forgejoAs(agentName, token string) *forgejo.Client {\r\n\tr.agentClientsMu.Lock()\r\n\tdefer r.agentClientsMu.Unlock()\r\n\r\n\tif c, ok := r.agentClients[agentName]; ok {\r\n\t\treturn c\r\n\t}\r\n\r\n\tvar c *forgejo.Client\r\n\tif token != \"\" {\r\n\t\tc = r.forgejo.As(token)\r\n\t} else {\r\n\t\t// Fallback: use shared identity. Optionally log a warning\r\n\t\t// if we ever want to enforce per-agent tokens.\r\n\t\tc = r.forgejo\r\n\t}\r\n\r\n\tr.agentClients[agentName] = c\r\n\r\n\treturn c\r\n}\r\n\r\n// Run implements scheduler.Runner.\r\nfunc (r *Runner) Run(ctx context.Context, jobID string, agent config.AgentConfig, llmCfg config.LLM, dockerImage string, ev forgejo.Event) error {\r\n\tctx, cancel := context.WithTimeout(ctx, r.timeout)\r\n\tdefer cancel()\r\n\r\n\tlogger := r.logger.With(\"job\", jobID, \"agent\", agent.Name)\r\n\r\n\trepoInfo, err := r.forgejo.RepositoryInfo(ev.Owner, ev.Repo)\r\n\tif err != nil {\r\n\t\treturn fmt.Errorf(\"look up repository: %w\", err)\r\n\t}\r\n\r\n\tworkDir, err := os.MkdirTemp(\"\", \"zoo-run-*\")\r\n\tif err != nil {\r\n\t\treturn fmt.Errorf(\"create work dir: %w\", err)\r\n\t}\r\n\r\n\tsucceeded := false\r\n\r\n\tdefer func() {\r\n\t\tif succeeded || !r.keepOnFailure {\r\n\t\t\tos.RemoveAll(workDir)\r\n\t\t} else {\r\n\t\t\tlogger.Warn(\"keeping work dir after failure\", \"dir\", workDir)\r\n\t\t}\r\n\t}()\r\n\r\n\tprojectDir := filepath.Join(workDir, \"project\")\r\n\r\n\t// A pr:review run works on the PR's own head branch, so the agent's\r\n\t// commits push straight to the PR. Every other event kind branches\r\n\t// off the default branch as usual.\r\n\tvar review *forgejo.ReviewDetail\r\n\tbranch := fmt.Sprintf(\"issue-%d-%s\", ev.Index, agent.Name)\r\n\r\n\tif ev.Kind == forgejo.EventPRReview {\r\n\t\t// Always fetch the current head ref, not just when the event\r\n\t\t// lacks one (the polling path doesn't carry it): the webhook's\r\n\t\t// copy could be stale if the PR's head branch was renamed since\r\n\t\t// the review, and the push target depends on it.\r\n\t\theadRef := ev.HeadRef\r\n\r\n\t\tif prInfo, err := r.forgejo.PullRequestInfo(ev.Owner, ev.Repo, ev.Index); err != nil {\r\n\t\t\tlogger.Warn(\"fetch pull request head failed; falling back to the event's head ref\", \"error\", err)\r\n\t\t} else if prInfo.HeadRef != \"\" {\r\n\t\t\theadRef = prInfo.HeadRef\r\n\t\t}\r\n\r\n\t\tif headRef == \"\" {\r\n\t\t\treturn fmt.Errorf(\"pr:review event has no pull request head branch to check out\")\r\n\t\t}\r\n\r\n\t\tif err := clonePRHead(ctx, repoInfo.CloneURL, r.forgejo.Token(), repoInfo.DefaultBranch, headRef, ev.Index, projectDir); err != nil {\r\n\t\t\treturn fmt.Errorf(\"prepare git working tree: %w\", err)\r\n\t\t}\r\n\r\n\t\tbranch = headRef\r\n\r\n\t\t// Fetch the full review (verdict, body, inline comments) so the\r\n\t\t// agent sees all the feedback, not just the triggering event. A\r\n\t\t// failure degrades to no review detail rather than failing the\r\n\t\t// run: the agent can still do its job, just without the inline\r\n\t\t// comments.\r\n\t\treview, err = r.forgejo.ReviewDetail(ev.Owner, ev.Repo, ev.Index, ev.ReviewID)\r\n\t\tif err != nil {\r\n\t\t\tlogger.Warn(\"fetch review detail failed; agent will not see inline review comments\", \"error\", err)\r\n\t\t\treview = nil\r\n\t\t}\r\n\t} else {\r\n\t\tif err := cloneAndBranch(ctx, repoInfo.CloneURL, r.forgejo.Token(), repoInfo.DefaultBranch, branch, projectDir); err != nil {\r\n\t\t\treturn fmt.Errorf(\"prepare git working tree: %w\", err)\r\n\t\t}\r\n\t}\r\n\r\n\troster := buildRoster(r.forgejo, r.cfg.Agents, logger)\r\n\tgitName, gitEmail := gitIdentity(agent.Name, roster)\r\n\r\n\t// Local (not --global) scope, so this identity lives in\r\n\t// projectDir/.git/config: the one place both this host-side clone\r\n\t// and the container it's bind-mounted into (as /project) actually\r\n\t// share.\r\n\tif out, err := runGit(ctx, projectDir, \"config\", \"user.name\", gitName); err != nil {\r\n\t\treturn fmt.Errorf(\"configure git user.name: %w: %s\", err, out)\r\n\t}\r\n\tif out, err := runGit(ctx, projectDir, \"config\", \"user.email\", gitEmail); err != nil {\r\n\t\treturn fmt.Errorf(\"configure git user.email: %w: %s\", err, out)\r\n\t}\r\n\r\n\teventPath := filepath.Join(workDir, \"event.json\")\r\n\tif err := os.WriteFile(eventPath, ev.Raw, 0o644); err != nil {\r\n\t\treturn fmt.Errorf(\"write event file: %w\", err)\r\n\t}\r\n\r\n\tcontainerID, err := r.docker.createContainer(ctx, dockerImage, []string{\r\n\t\tprojectDir + \":/project\",\r\n\t\teventPath + \":/event:ro\",\r\n\t}, fmt.Sprintf(\"zoo-issue-%d-%s\", ev.Index, agent.Name))\r\n\tif err != nil {\r\n\t\treturn fmt.Errorf(\"start container: %w\", err)\r\n\t}\r\n\r\n\tdefer func() {\r\n\t\tcleanupCtx, cleanupCancel := context.WithTimeout(context.Background(), 30*time.Second)\r\n\t\tdefer cleanupCancel()\r\n\t\tif err := r.docker.remove(cleanupCtx, containerID); err != nil {\r\n\t\t\tlogger.Warn(\"failed to remove container\", \"container\", containerID, \"error\", err)\r\n\t\t}\r\n\t}()\r\n\r\n\t// /project is bind-mounted from the host, so it's owned by the host\r\n\t// UID that ran the clone, not whatever UID runs inside the\r\n\t// container (usually root) — git's ownership check rejects that by\r\n\t// default (\"detected dubious ownership\") unless told otherwise.\r\n\t// --system (not --global) so this holds regardless of which user\r\n\t// subsequent `docker exec` calls run as. Commit identity is\r\n\t// configured host-side, above, with --local scope so it's visible\r\n\t// from both sides of the bind mount without needing --global here.\r\n\tout, exitCode, err := r.docker.exec(ctx, containerID, \"git config --system --add safe.directory '*'\")\r\n\tif err != nil {\r\n\t\treturn fmt.Errorf(\"configure git safe.directory in container: %w: %s\", err, out)\r\n\t}\r\n\tif exitCode != 0 {\r\n\t\treturn fmt.Errorf(\"configure git safe.directory in container: exit %d: %s\", exitCode, out)\r\n\t}\r\n\r\n\tlogAppend := func(stream, line string) {\r\n\t\tif err := r.store.AppendLog(context.Background(), jobID, stream, line); err != nil {\r\n\t\t\tlogger.Warn(\"failed to append log\", \"error\", err)\r\n\t\t}\r\n\t}\r\n\r\n\trunCtx := \u0026runContext{\r\n\t\tdocker:      r.docker,\r\n\t\tcontainerID: containerID,\r\n\t\tprojectDir:  projectDir,\r\n\t\ttoken:       r.forgejo.Token(),\r\n\t\tforgejo: \u0026runForgejoActions{\r\n\t\t\tclient: r.forgejoAs(agent.Name, agent.Token),\r\n\t\t\towner:  ev.Owner,\r\n\t\t\trepo:   ev.Repo,\r\n\t\t\tindex:  ev.Index,\r\n\t\t\tlogger: logger,\r\n\t\t},\r\n\t}\r\n\r\n\tllmClient := llm.NewClient(llmCfg)\r\n\r\n\tsystemPrompt := defaultSystemPrompt + identitySection(agent.Name, roster)\r\n\r\n\tinstructions := r.cfg.EventInstructions(ev.Kind)\r\n\r\n\t// Fetch the full comment thread so the agent sees everything that's\r\n\t// been said on the issue/PR, not just the triggering event (which\r\n\t// only carries the latest comment, if any). A failure degrades to\r\n\t// no comments rather than failing the run: the agent can still do\r\n\t// its job, just without prior context.\r\n\tcomments, err := r.forgejo.ListIssueComments(ev.Owner, ev.Repo, ev.Index)\r\n\tif err != nil {\r\n\t\tlogger.Warn(\"fetch issue comments failed; agent will not see prior comments\", \"error\", err)\r\n\t\tcomments = nil\r\n\t}\r\n\r\n\tmessages := []llm.Message{\r\n\t\t{Role: \"system\", Content: systemPrompt},\r\n\t\t{Role: \"user\", Content: seedMessage(ev, branch, repoInfo.DefaultBranch, instructions, comments, review)},\r\n\t}\r\n\r\n\thooks := r.streamHooks(jobID, logAppend)\r\n\r\n\t_, err = runLoop(ctx, llmClient, runCtx, messages, hooks)\r\n\tif err != nil {\r\n\t\treturn fmt.Errorf(\"agent loop: %w\", err)\r\n\t}\r\n\r\n\tsucceeded = true\r\n\r\n\treturn nil\r\n}\r\n\r\n// streamHooks builds the Hooks a single Run passes to runLoop: every\r\n// delta is published live to the hub for connected dashboard viewers,\r\n// and once a reasoning/content block or tool call is complete, it's\r\n// persisted to the store as one row and the hub's replay buffer for\r\n// jobID is checkpointed — so a viewer connecting from this point on\r\n// sees it via the persisted history instead of a live replay, and is\r\n// never shown it twice.\r\nfunc (r *Runner) streamHooks(jobID string, logAppend func(stream, line string)) Hooks {\r\n\tvar reasoningBuf, contentBuf strings.Builder\r\n\r\n\treasoningOpen, contentOpen := false, false\r\n\r\n\treturn Hooks{\r\n\t\tOnReasoningDelta: func(delta string) {\r\n\t\t\tif !reasoningOpen {\r\n\t\t\t\treasoningOpen = true\r\n\t\t\t\treasoningBuf.Reset()\r\n\t\t\t\tr.hub.Publish(jobID, livelog.Event{Type: livelog.ReasoningStart})\r\n\t\t\t}\r\n\r\n\t\t\treasoningBuf.WriteString(delta)\r\n\t\t\tr.hub.Publish(jobID, livelog.Event{Type: livelog.ReasoningDelta, Text: delta})\r\n\t\t},\r\n\t\tOnContentDelta: func(delta string) {\r\n\t\t\tif !contentOpen {\r\n\t\t\t\tcontentOpen = true\r\n\t\t\t\tcontentBuf.Reset()\r\n\t\t\t\tr.hub.Publish(jobID, livelog.Event{Type: livelog.ContentStart})\r\n\t\t\t}\r\n\r\n\t\t\tcontentBuf.WriteString(delta)\r\n\t\t\tr.hub.Publish(jobID, livelog.Event{Type: livelog.ContentDelta, Text: delta})\r\n\t\t},\r\n\t\tOnTurnEnd: func() {\r\n\t\t\tif reasoningOpen {\r\n\t\t\t\tr.hub.Publish(jobID, livelog.Event{Type: livelog.ReasoningEnd})\r\n\t\t\t\tlogAppend(\"reasoning\", reasoningBuf.String())\r\n\t\t\t\tr.hub.Checkpoint(jobID)\r\n\t\t\t\treasoningOpen = false\r\n\t\t\t}\r\n\r\n\t\t\tif contentOpen {\r\n\t\t\t\tr.hub.Publish(jobID, livelog.Event{Type: livelog.ContentEnd})\r\n\t\t\t\tlogAppend(\"content\", contentBuf.String())\r\n\t\t\t\tr.hub.Checkpoint(jobID)\r\n\t\t\t\tcontentOpen = false\r\n\t\t\t}\r\n\t\t},\r\n\t\tOnTool: func(name, arguments, result string, toolErr bool) {\r\n\t\t\tr.hub.Publish(jobID, livelog.Event{\r\n\t\t\t\tType:      livelog.Tool,\r\n\t\t\t\tName:      name,\r\n\t\t\t\tArguments: arguments,\r\n\t\t\t\tResult:    result,\r\n\t\t\t\tError:     toolErr,\r\n\t\t\t})\r\n\r\n\t\t\tline, err := json.Marshal(store.ToolLogEntry{Name: name, Arguments: arguments, Result: result, Error: toolErr})\r\n\t\t\tif err != nil {\r\n\t\t\t\tr.logger.Warn(\"failed to marshal tool log entry\", \"job\", jobID, \"error\", err)\r\n\t\t\t} else {\r\n\t\t\t\tlogAppend(\"tool\", string(line))\r\n\t\t\t}\r\n\r\n\t\t\tr.hub.Checkpoint(jobID)\r\n\t\t},\r\n\t}\r\n}\r\n\r\nfunc seedMessage(ev forgejo.Event, branch, defaultBranch, instructions string, comments []forgejo.IssueComment, review *forgejo.ReviewDetail) string {\r\n\traw, _ := json.MarshalIndent(json.RawMessage(ev.Raw), \"\", \"  \")\r\n\r\n\tvar instructionsSection string\r\n\tif instructions != \"\" {\r\n\t\tinstructionsSection = fmt.Sprintf(\"Instructions for this event, from zoo.hcl:\\n%s\\n\\n\", instructions)\r\n\t}\r\n\r\n\t// A pr:review run works on the PR's own head branch, not a fresh\r\n\t// branch off the default branch.\r\n\tbranchLine := fmt.Sprintf(\"Your working branch is %q, checked out from the default branch %q.\\n\\n\", branch, defaultBranch)\r\n\tif ev.Kind == forgejo.EventPRReview {\r\n\t\tbranchLine = fmt.Sprintf(\"Your working branch is %q, the pull request's head branch — commits you push here update the pull request directly.\\n\\n\", branch)\r\n\t}\r\n\r\n\tvar reviewSection string\r\n\tif review != nil {\r\n\t\treviewSection = renderReviewSection(review)\r\n\t}\r\n\r\n\tvar commentsSection string\r\n\tif len(comments) \u003e 0 {\r\n\t\tvar b strings.Builder\r\n\t\tfmt.Fprintf(\u0026b, \"Comments (%d):\\n\\n\", len(comments))\r\n\r\n\t\tfor i, c := range comments {\r\n\t\t\tfmt.Fprintf(\u0026b, \"%d. %s (%s):\\n%s\\n\\n\", i+1, c.Author, c.Created.Format(time.RFC3339), c.Body)\r\n\t\t}\r\n\r\n\t\tcommentsSection = b.String()\r\n\t}\r\n\r\n\treturn fmt.Sprintf(\r\n\t\t\"You were triggered by a %q event on %s/%s.\\n\\n\"+\r\n\t\t\t\"%s%s\"+\r\n\t\t\t\"%sTitle: %s\\n\\nBody:\\n%s\\n\\n%sFull event payload:\\n```json\\n%s\\n```\",\r\n\t\tev.Kind, ev.Owner, ev.Repo, instructionsSection, branchLine, reviewSection, ev.Title, ev.Body, commentsSection, raw)\r\n}\r\n\r\n// renderReviewSection renders the submitted review as a briefing\r\n// section: the verdict, the review body, and each inline comment with\r\n// its location and id (the id lets the agent refer to a specific\r\n// comment in its reply).\r\nfunc renderReviewSection(review *forgejo.ReviewDetail) string {\r\n\tvar b strings.Builder\r\n\r\n\tfmt.Fprintf(\u0026b, \"Review submitted by %s:\\n\", review.Reviewer)\r\n\tfmt.Fprintf(\u0026b, \"  Verdict: %s\\n\", humanReviewState(review.State))\r\n\r\n\tif review.Body != \"\" {\r\n\t\tb.WriteString(\"  Review body:\\n\")\r\n\t\tfor _, line := range strings.Split(review.Body, \"\\n\") {\r\n\t\t\tfmt.Fprintf(\u0026b, \"  %s\\n\", line)\r","start_line":1,"end_line":400,"total_lines":435,"truncated":true}

{"path": "internal/agentrun/run.go", "start_line": 400, "end_line": 435}

{"path":"internal/agentrun/run.go","content":"\t\t\tfmt.Fprintf(\u0026b, \"  %s\\n\", line)\r\n\t\t}\r\n\t}\r\n\r\n\tif len(review.Comments) \u003e 0 {\r\n\t\tfmt.Fprintf(\u0026b, \"  Inline comments (%d):\\n\", len(review.Comments))\r\n\r\n\t\tfor i, c := range review.Comments {\r\n\t\t\twhere := c.Path\r\n\t\t\tif c.Line \u003e 0 {\r\n\t\t\t\twhere = fmt.Sprintf(\"%s:%d\", c.Path, c.Line)\r\n\t\t\t}\r\n\r\n\t\t\tfmt.Fprintf(\u0026b, \"  %d. [%s] %s (comment id %d):\\n\", i+1, where, c.Author, c.ID)\r\n\t\t\tfor _, line := range strings.Split(c.Body, \"\\n\") {\r\n\t\t\t\tfmt.Fprintf(\u0026b, \"     %s\\n\", line)\r\n\t\t\t}\r\n\t\t}\r\n\t}\r\n\r\n\treturn b.String() + \"\\n\"\r\n}\r\n\r\n// humanReviewState maps a Forgejo review state to a readable verdict.\r\nfunc humanReviewState(state string) string {\r\n\tswitch state {\r\n\tcase \"APPROVED\":\r\n\t\treturn \"approved\"\r\n\tcase \"REQUEST_CHANGES\":\r\n\t\treturn \"changes requested\"\r\n\tcase \"COMMENT\":\r\n\t\treturn \"comment\"\r\n\tdefault:\r\n\t\treturn state\r\n\t}\r\n}\r","start_line":400,"end_line":435,"total_lines":435,"truncated":false}

{"path": "internal/tools/git.go", "start_line": 1, "end_line": 200}

{"path":"internal/tools/git.go","content":"package tools\r\n\r\nimport (\r\n\t\"context\"\r\n\t\"fmt\"\r\n\t\"slices\"\r\n\t\"strings\"\r\n\r\n\t\"github.com/abrander/zoo/internal/llm\"\r\n)\r\n\r\n// gitAllowed intentionally excludes remote-mutating subcommands other\r\n// than push: agents are expected to commit and push their own branch,\r\n// not touch remotes/config/etc.\r\nvar gitAllowed = []string{\r\n\t\"add\",\r\n\t\"branch\",\r\n\t\"checkout\",\r\n\t\"commit\",\r\n\t\"diff\",\r\n\t\"fetch\",\r\n\t\"log\",\r\n\t\"ls-remote\",\r\n\t\"pull\",\r\n\t\"push\",\r\n\t\"show\",\r\n\t\"status\",\r\n\t\"rm\",\r\n}\r\n\r\ntype gitParams struct {\r\n\tSubcommand string   `json:\"subcommand\"`\r\n\tArgs       []string `json:\"args\"`\r\n}\r\n\r\nfunc init() {\r\n\ttool := llm.NewTool(\r\n\t\t\"git\",\r\n\t\t\"Run a git subcommand with optional arguments against the project's working tree\")\r\n\r\n\ttool.AddEnumProperty(\"subcommand\", \"The git subcommand to run\", gitAllowed, true)\r\n\ttool.AddStringArrayProperty(\"args\", \"Additional arguments to pass to the git subcommand, e.g. ['HEAD~1', 'HEAD']\", false)\r\n\r\n\tRegister(tool, git)\r\n}\r\n\r\n// git runs subcommand via Context.Git, which executes it outside the\r\n// container (see that method's doc comment for why): the container\r\n// itself is never given a credential capable of authenticating against\r\n// Forgejo, so pushing has to happen on the host side instead.\r\nfunc git(ctx Context, params gitParams) (string, error) {\r\n\tif !slices.Contains(gitAllowed, params.Subcommand) {\r\n\t\treturn \"\", fmt.Errorf(\"git subcommand '%s' is not allowed. Only %s are permitted\", params.Subcommand, strings.Join(gitAllowed, \", \"))\r\n\t}\r\n\r\n\toutput, err := ctx.Git(context.Background(), params.Subcommand, params.Args...)\r\n\tif err != nil {\r\n\t\treturn \"\", err\r\n\t}\r\n\r\n\tif output == \"\" {\r\n\t\tswitch params.Subcommand {\r\n\t\tcase \"diff\":\r\n\t\t\treturn \"No changes detected.\", nil\r\n\r\n\t\tcase \"status\":\r\n\t\t\treturn \"No status output.\", nil\r\n\t\t}\r\n\t}\r\n\r\n\treturn strings.TrimSpace(output), nil\r\n}\r","start_line":1,"end_line":72,"total_lines":72,"truncated":false}

{"path": "internal/tools/context.go", "start_line": 1, "end_line": 200}

{"path":"internal/tools/context.go","content":"// Package tools is the registry of functions an agent's tool-calling\r\n// loop can invoke, ported from ../a/tools but retargeted at a Docker\r\n// container (via Exec) and the Forgejo issue/PR that triggered the run\r\n// (via Forgejo()) instead of a local sandboxed filesystem.\r\npackage tools\r\n\r\nimport \"context\"\r\n\r\n// Context is bound to a single agent run (job), unlike ../a's single\r\n// global Context, since multiple agents run concurrently in zoo.\r\ntype Context interface {\r\n\t// Exec runs command inside the run's container via `sh -c` and\r\n\t// returns combined stdout+stderr. The container never holds a\r\n\t// Forgejo credential, so this cannot reach the Forgejo API or\r\n\t// authenticate git operations against it — see Git.\r\n\tExec(ctx context.Context, command string) (string, error)\r\n\r\n\t// Git runs a git subcommand against the run's working tree on the\r\n\t// host, outside the container, so that operations needing a Forgejo\r\n\t// credential (currently just push) can authenticate without that\r\n\t// credential ever being written to disk where the container (and\r\n\t// anything run inside it via Exec) could read it.\r\n\tGit(ctx context.Context, subcommand string, args ...string) (string, error)\r\n\r\n\t// Forgejo returns the actions bound to the issue/PR that triggered\r\n\t// this run, so tools don't need to be told which repo/issue to act\r\n\t// on.\r\n\tForgejo() ForgejoActions\r\n}\r\n\r\n// ForgejoActions are the actions available to an agent against the\r\n// triggering issue/PR. Implemented by internal/agentrun, backed by\r\n// internal/forgejo.Client plus the run's owner/repo/issue.\r\ntype ForgejoActions interface {\r\n\tComment(body string) error\r\n\tOpenPullRequest(head, base, title, body string) error\r\n\tRequestReview(reviewers []string) error\r\n\tAddLabel(name string) error\r\n\tRemoveLabel(name string) error\r\n\tCloseIssue() error\r\n\tReopenIssue() error\r\n\r\n\t// AssignIssue hands the triggering issue/PR off to another agent by\r\n\t// their name (which doubles as their Forgejo username); the\r\n\t// resulting issue:assigned event triggers that agent's run.\r\n\tAssignIssue(agentName string) error\r\n\r\n\t// SubmitReview submits a review on the triggering pull request with\r\n\t// the given verdict (forgejo.ReviewStateApproved,\r\n\t// ReviewStateChangesRequest, or ReviewStateComment) and body.\r\n\tSubmitReview(state, body string) error\r\n}\r","start_line":1,"end_line":52,"total_lines":52,"truncated":false}

{"path": "internal/tools/bash.go", "start_line": 1, "end_line": 100}

{"path":"internal/tools/bash.go","content":"package tools\r\n\r\nimport (\r\n\t\"context\"\r\n\t\"fmt\"\r\n\t\"time\"\r\n\r\n\t\"github.com/abrander/zoo/internal/llm\"\r\n)\r\n\r\nconst maxTimeout = 300\r\n\r\ntype bashParams struct {\r\n\tCommand string `json:\"command\"`\r\n\tTimeout int    `json:\"timeout,omitempty\"`\r\n}\r\n\r\nfunc init() {\r\n\ttool := llm.NewTool(\r\n\t\t\"bash\",\r\n\t\t\"Execute a shell command in the project container. Use this to run shell commands and scripts.\")\r\n\r\n\ttool.AddStringProperty(\"command\", \"The shell command to execute\", true)\r\n\ttool.AddIntegerProperty(\"timeout\", \"Optional timeout in seconds. Must not exceed 300 seconds.\", false)\r\n\r\n\tRegister(tool, bash)\r\n}\r\n\r\nfunc bash(ctx Context, params bashParams) (string, error) {\r\n\tif params.Timeout \u003c 0 {\r\n\t\treturn \"\", fmt.Errorf(\"timeout must not be negative\")\r\n\t}\r\n\r\n\tif params.Timeout \u003e maxTimeout {\r\n\t\treturn \"\", fmt.Errorf(\"timeout exceeds maximum of %d seconds\", maxTimeout)\r\n\t}\r\n\r\n\tvar execCtx context.Context\r\n\tvar cancel context.CancelFunc\r\n\r\n\tif params.Timeout \u003e 0 {\r\n\t\texecCtx, cancel = context.WithTimeout(context.Background(), time.Duration(params.Timeout)*time.Second)\r\n\t} else {\r\n\t\texecCtx, cancel = context.WithCancel(context.Background())\r\n\t}\r\n\tdefer cancel()\r\n\r\n\toutput, err := ctx.Exec(execCtx, params.Command)\r\n\tif err != nil {\r\n\t\tif execCtx.Err() == context.DeadlineExceeded {\r\n\t\t\treturn \"\", fmt.Errorf(\"command timed out after %d seconds\", params.Timeout)\r\n\t\t}\r\n\r\n\t\treturn \"\", fmt.Errorf(\"command failed: %w\", err)\r\n\t}\r\n\r\n\treturn output, nil\r\n}\r","start_line":1,"end_line":58,"total_lines":58,"truncated":false}

{"path": "internal/agentrun/context.go", "start_line": 1, "end_line": 250}

{"path":"internal/agentrun/context.go","content":"package agentrun\r\n\r\nimport (\r\n\t\"context\"\r\n\t\"fmt\"\r\n\r\n\t\"github.com/abrander/zoo/internal/tools\"\r\n)\r\n\r\n// runContext implements tools.Context for a single agent run, executing\r\n// shell commands via docker exec against the run's container, git\r\n// commands as the host process against the run's working tree (see\r\n// Git), and binding Forgejo actions to the triggering issue/PR.\r\ntype runContext struct {\r\n\tdocker      *dockerRuntime\r\n\tcontainerID string\r\n\tprojectDir  string\r\n\ttoken       string\r\n\tforgejo     tools.ForgejoActions\r\n}\r\n\r\nfunc (c *runContext) Exec(ctx context.Context, command string) (string, error) {\r\n\toutput, exitCode, err := c.docker.exec(ctx, c.containerID, command)\r\n\r\n\tif err != nil {\r\n\t\treturn output, err\r\n\t}\r\n\r\n\tif exitCode != 0 {\r\n\t\treturn output, fmt.Errorf(\"command exited with status %d\", exitCode)\r\n\t}\r\n\r\n\treturn output, nil\r\n}\r\n\r\n// Git implements tools.Context.Git by running git on the host against\r\n// c.projectDir rather than via docker exec. Only push needs to\r\n// authenticate against Forgejo, so only it carries the token, via a\r\n// per-invocation -c override that never touches .git/config (see\r\n// gitAuthArgs) — the container this same working tree is bind-mounted\r\n// into has no way to read it out.\r\nfunc (c *runContext) Git(ctx context.Context, subcommand string, args ...string) (string, error) {\r\n\tcmdArgs := append([]string{subcommand}, args...)\r\n\r\n\tif subcommand == \"push\" {\r\n\t\treturn runGitAuthed(ctx, c.projectDir, c.token, cmdArgs...)\r\n\t}\r\n\r\n\treturn runGit(ctx, c.projectDir, cmdArgs...)\r\n}\r\n\r\nfunc (c *runContext) Forgejo() tools.ForgejoActions {\r\n\treturn c.forgejo\r\n}\r","start_line":1,"end_line":54,"total_lines":54,"truncated":false}

{"path": "internal/agentrun/docker_integration_test.go", "start_line": 1, "end_line": 300}

{"path":"internal/agentrun/docker_integration_test.go","content":"//go:build docker\r\n\r\n// Run with: go test -tags docker ./internal/agentrun/...\r\n// Requires a reachable Docker daemon (DOCKER_HOST or the default socket).\r\npackage agentrun\r\n\r\nimport (\r\n\t\"context\"\r\n\t\"os/exec\"\r\n\t\"strings\"\r\n\t\"testing\"\r\n\t\"time\"\r\n)\r\n\r\nfunc TestDockerRuntimeExecRoundTrip(t *testing.T) {\r\n\trt, err := newDockerRuntime()\r\n\tif err != nil {\r\n\t\tt.Fatalf(\"docker client: %v\", err)\r\n\t}\r\n\r\n\tctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)\r\n\tdefer cancel()\r\n\r\n\tcontainerID, err := rt.createContainer(ctx, \"debian:unstable\", nil, \"zoo-test-run\")\r\n\tif err != nil {\r\n\t\tt.Fatalf(\"create container: %v\", err)\r\n\t}\r\n\tdefer rt.remove(context.Background(), containerID)\r\n\r\n\toutput, exitCode, err := rt.exec(ctx, containerID, \"echo hello-from-zoo\")\r\n\tif err != nil {\r\n\t\tt.Fatalf(\"exec: %v\", err)\r\n\t}\r\n\tif exitCode != 0 {\r\n\t\tt.Fatalf(\"expected exit code 0, got %d\", exitCode)\r\n\t}\r\n\tif !strings.Contains(output, \"hello-from-zoo\") {\r\n\t\tt.Fatalf(\"unexpected output: %q\", output)\r\n\t}\r\n\r\n\t_, exitCode, err = rt.exec(ctx, containerID, \"exit 3\")\r\n\tif err != nil {\r\n\t\tt.Fatalf(\"exec: %v\", err)\r\n\t}\r\n\tif exitCode != 3 {\r\n\t\tt.Fatalf(\"expected exit code 3, got %d\", exitCode)\r\n\t}\r\n}\r\n\r\n// TestDockerRuntimeGitSafeDirectory reproduces the \"detected dubious\r\n// ownership\" error git raises against a bind-mounted repo owned by a\r\n// different UID than the container runs as, and confirms the `git\r\n// config --system --add safe.directory '*'` fix Run() applies (see\r\n// run.go) actually clears it, against the same golang:latest image\r\n// zoo.hcl now defaults to.\r\nfunc TestDockerRuntimeGitSafeDirectory(t *testing.T) {\r\n\tprojectDir := t.TempDir()\r\n\r\n\tfor _, args := range [][]string{\r\n\t\t{\"init\", \"-q\", projectDir},\r\n\t\t{\"-C\", projectDir, \"commit\", \"-q\", \"--allow-empty\", \"-m\", \"init\"},\r\n\t} {\r\n\t\tif out, err := exec.Command(\"git\", args...).CombinedOutput(); err != nil {\r\n\t\t\tt.Fatalf(\"git %v: %v: %s\", args, err, out)\r\n\t\t}\r\n\t}\r\n\r\n\trt, err := newDockerRuntime()\r\n\tif err != nil {\r\n\t\tt.Fatalf(\"docker client: %v\", err)\r\n\t}\r\n\r\n\tctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)\r\n\tdefer cancel()\r\n\r\n\tcontainerID, err := rt.createContainer(ctx, \"golang:latest\", []string{projectDir + \":/project\"}, \"zoo-test-git\")\r\n\tif err != nil {\r\n\t\tt.Fatalf(\"create container: %v\", err)\r\n\t}\r\n\tdefer rt.remove(context.Background(), containerID)\r\n\r\n\toutput, _, err := rt.exec(ctx, containerID, \"git status\")\r\n\tif err != nil {\r\n\t\tt.Fatalf(\"exec: %v\", err)\r\n\t}\r\n\tif !strings.Contains(output, \"dubious ownership\") {\r\n\t\tt.Fatalf(\"expected the bind mount to reproduce dubious ownership before the fix, got: %s\", output)\r\n\t}\r\n\r\n\toutput, exitCode, err := rt.exec(ctx, containerID, \"git config --system --add safe.directory '*'\")\r\n\tif err != nil || exitCode != 0 {\r\n\t\tt.Fatalf(\"configure safe.directory: err=%v exit=%d: %s\", err, exitCode, output)\r\n\t}\r\n\r\n\toutput, exitCode, err = rt.exec(ctx, containerID, \"git status\")\r\n\tif err != nil {\r\n\t\tt.Fatalf(\"exec: %v\", err)\r\n\t}\r\n\tif exitCode != 0 || strings.Contains(output, \"dubious ownership\") {\r\n\t\tt.Fatalf(\"expected git status to succeed after the fix, got exit=%d: %s\", exitCode, output)\r\n\t}\r\n}\r","start_line":1,"end_line":102,"total_lines":102,"truncated":false}

{"path": "internal/config/config.go", "start_line": 1, "end_line": 250}

{"path":"internal/config/config.go","content":"// Package config loads and validates zoo's HCL configuration file.\r\npackage config\r\n\r\nimport (\r\n\t\"fmt\"\r\n\r\n\t\"github.com/hashicorp/hcl/v2/hclsimple\"\r\n)\r\n\r\n// Known event kinds. issue:assigned and pr:review are resolved\r\n// dynamically (agent name must match the Forgejo assignee's username,\r\n// or the pull request author's username, respectively) so they never\r\n// carry an `agent` attribute; the rest map statically to one\r\n// configured agent.\r\nconst (\r\n\tEventIssueNew      = \"issue:new\"\r\n\tEventIssueComment  = \"issue:comment\"\r\n\tEventIssueAssigned = \"issue:assigned\"\r\n\tEventPRNew         = \"pr:new\"\r\n\tEventPRReview      = \"pr:review\"\r\n)\r\n\r\nvar staticEventKinds = map[string]bool{\r\n\tEventIssueNew:     true,\r\n\tEventIssueComment: true,\r\n\tEventPRNew:        true,\r\n}\r\n\r\ntype Config struct {\r\n\tLLMs        []LLM       `hcl:\"llm,block\"`\r\n\tForgejo     Forgejo     `hcl:\"forgejo,block\"`\r\n\tEnvironment Environment `hcl:\"environment,block\"`\r\n\tAgents      []Agent     `hcl:\"agent,block\"`\r\n\tEvents      []Event     `hcl:\"event,block\"`\r\n\tWeb         *Web        `hcl:\"web,block\"`\r\n}\r\n\r\n// Web configures the dashboard's optional bearer-token gate. Leave the\r\n// block out of zoo.hcl entirely to run without one (fine on localhost;\r\n// put a real gate or a proxy in front for anything else).\r\ntype Web struct {\r\n\tToken string `hcl:\"token,optional\"`\r\n}\r\n\r\ntype LLM struct {\r\n\tName   string `hcl:\"name,label\"`\r\n\tOpenAI string `hcl:\"openai\"`\r\n\tToken  string `hcl:\"token\"`\r\n\tModel  string `hcl:\"model\"`\r\n}\r\n\r\ntype Forgejo struct {\r\n\tURL           string `hcl:\"url\"`\r\n\tToken         string `hcl:\"token\"`\r\n\tWebhookSecret string `hcl:\"webhook_secret,optional\"`\r\n}\r\n\r\ntype Environment struct {\r\n\tDockerImage string `hcl:\"docker_image\"`\r\n\tMaxLive     int    `hcl:\"max_live_agents\"`\r\n}\r\n\r\ntype Agent struct {\r\n\tName  string `hcl:\"name,label\"`\r\n\tLLM   string `hcl:\"llm\"`\r\n\tToken string `hcl:\"token,optional\"`\r\n}\r\n\r\ntype Event struct {\r\n\tKind         string `hcl:\"name,label\"`\r\n\tAgent        string `hcl:\"agent,optional\"`\r\n\tInstructions string `hcl:\"instructions,optional\"`\r\n}\r\n\r\n// Load reads and validates the config file at path.\r\nfunc Load(path string) (*Config, error) {\r\n\tvar cfg Config\r\n\r\n\tif err := hclsimple.DecodeFile(path, nil, \u0026cfg); err != nil {\r\n\t\treturn nil, fmt.Errorf(\"parse config: %w\", err)\r\n\t}\r\n\r\n\tif err := cfg.Validate(); err != nil {\r\n\t\treturn nil, fmt.Errorf(\"invalid config: %w\", err)\r\n\t}\r\n\r\n\treturn \u0026cfg, nil\r\n}\r\n\r\n// Validate checks that the config is internally consistent: every\r\n// reference between blocks resolves, and required values are set.\r\nfunc (c *Config) Validate() error {\r\n\tllmNames := make(map[string]bool, len(c.LLMs))\r\n\tfor _, l := range c.LLMs {\r\n\t\tif l.OpenAI == \"\" || l.Token == \"\" || l.Model == \"\" {\r\n\t\t\treturn fmt.Errorf(\"llm %q: openai, token, and model are required\", l.Name)\r\n\t\t}\r\n\t\tllmNames[l.Name] = true\r\n\t}\r\n\r\n\tif c.Forgejo.URL == \"\" || c.Forgejo.Token == \"\" {\r\n\t\treturn fmt.Errorf(\"forgejo: url and token are required\")\r\n\t}\r\n\r\n\tif c.Environment.MaxLive \u003c 1 {\r\n\t\treturn fmt.Errorf(\"environment: max_live_agents must be \u003e= 1, got %d\", c.Environment.MaxLive)\r\n\t}\r\n\r\n\tif c.Environment.DockerImage == \"\" {\r\n\t\treturn fmt.Errorf(\"environment: docker_image is required\")\r\n\t}\r\n\r\n\tagentNames := make(map[string]bool, len(c.Agents))\r\n\tfor _, a := range c.Agents {\r\n\t\tif !llmNames[a.LLM] {\r\n\t\t\treturn fmt.Errorf(\"agent %q: references undeclared llm %q\", a.Name, a.LLM)\r\n\t\t}\r\n\t\tagentNames[a.Name] = true\r\n\t}\r\n\r\n\tseenEventKinds := make(map[string]bool, len(c.Events))\r\n\tfor _, e := range c.Events {\r\n\t\tif seenEventKinds[e.Kind] {\r\n\t\t\treturn fmt.Errorf(\"event %q: declared more than once\", e.Kind)\r\n\t\t}\r\n\t\tseenEventKinds[e.Kind] = true\r\n\r\n\t\tswitch {\r\n\t\tcase e.Kind == EventIssueAssigned:\r\n\t\t\tif e.Agent != \"\" {\r\n\t\t\t\treturn fmt.Errorf(\"event %q: must not set agent; the agent whose name matches the Forgejo assignee's username is triggered dynamically\", e.Kind)\r\n\t\t\t}\r\n\r\n\t\tcase e.Kind == EventPRReview:\r\n\t\t\tif e.Agent != \"\" {\r\n\t\t\t\treturn fmt.Errorf(\"event %q: must not set agent; the agent whose name matches the pull request author's username is triggered dynamically\", e.Kind)\r\n\t\t\t}\r\n\r\n\t\tcase staticEventKinds[e.Kind]:\r\n\t\t\tif e.Agent == \"\" {\r\n\t\t\t\treturn fmt.Errorf(\"event %q: agent is required\", e.Kind)\r\n\t\t\t}\r\n\t\t\tif !agentNames[e.Agent] {\r\n\t\t\t\treturn fmt.Errorf(\"event %q: references undeclared agent %q\", e.Kind, e.Agent)\r\n\t\t\t}\r\n\r\n\t\tdefault:\r\n\t\t\treturn fmt.Errorf(\"event %q: unknown event kind\", e.Kind)\r\n\t\t}\r\n\t}\r\n\r\n\treturn nil\r\n}\r\n\r\n// AgentConfig holds an agent's full configuration including its\r\n// Forgejo token (if configured).\r\ntype AgentConfig struct {\r\n\tName  string\r\n\tLLM   string\r\n\tToken string\r\n}\r\n\r\n// AgentByName returns the agent config with the given name, if declared.\r\nfunc (c *Config) AgentByName(name string) (AgentConfig, bool) {\r\n\tfor _, a := range c.Agents {\r\n\t\tif a.Name == name {\r\n\t\t\treturn AgentConfig{\r\n\t\t\t\tName:  a.Name,\r\n\t\t\t\tLLM:   a.LLM,\r\n\t\t\t\tToken: a.Token,\r\n\t\t\t}, true\r\n\t\t}\r\n\t}\r\n\r\n\treturn AgentConfig{}, false\r\n}\r\n\r\n// LLMByName returns the llm config with the given name, if declared.\r\nfunc (c *Config) LLMByName(name string) (LLM, bool) {\r\n\tfor _, l := range c.LLMs {\r\n\t\tif l.Name == name {\r\n\t\t\treturn l, true\r\n\t\t}\r\n\t}\r\n\r\n\treturn LLM{}, false\r\n}\r\n\r\n// EventAgent returns the statically configured agent name for the given\r\n// event kind, if one is declared and set.\r\nfunc (c *Config) EventAgent(kind string) (string, bool) {\r\n\tfor _, e := range c.Events {\r\n\t\tif e.Kind == kind {\r\n\t\t\treturn e.Agent, e.Agent != \"\"\r\n\t\t}\r\n\t}\r\n\r\n\treturn \"\", false\r\n}\r\n\r\n// EventInstructions returns the configured freeform instructions for the\r\n// given event kind, e.g. \"Please review this pull request and respond\r\n// appropriately.\" Returns \"\" if the event isn't declared or has none.\r\nfunc (c *Config) EventInstructions(kind string) string {\r\n\tfor _, e := range c.Events {\r\n\t\tif e.Kind == kind {\r\n\t\t\treturn e.Instructions\r\n\t\t}\r\n\t}\r\n\r\n\treturn \"\"\r\n}\r","start_line":1,"end_line":212,"total_lines":212,"truncated":false}

{"path": "internal/agentrun/roster.go", "start_line": 1, "end_line": 150}

{"path":"internal/agentrun/roster.go","content":"package agentrun\r\n\r\nimport (\r\n\t\"fmt\"\r\n\t\"log/slog\"\r\n\t\"strings\"\r\n\r\n\t\"github.com/abrander/zoo/internal/config\"\r\n\t\"github.com/abrander/zoo/internal/forgejo\"\r\n)\r\n\r\n// agentInfo pairs a configured agent with its Forgejo profile: the bio\r\n// (what its account says it does) and the name/email used to set git\r\n// commit authorship inside its container.\r\ntype agentInfo struct {\r\n\tName        string\r\n\tDescription string\r\n\tFullName    string\r\n\tEmail       string\r\n}\r\n\r\n// buildRoster fetches every configured agent's Forgejo profile (agent\r\n// config labels double as Forgejo usernames). A per-agent lookup failure\r\n// is logged and that agent is included with an empty profile rather than\r\n// failing the whole run — one missing/unreachable profile shouldn't\r\n// block someone else's job.\r\nfunc buildRoster(fg *forgejo.Client, agents []config.Agent, logger *slog.Logger) []agentInfo {\r\n\troster := make([]agentInfo, 0, len(agents))\r\n\r\n\tfor _, a := range agents {\r\n\t\tprofile, err := fg.AgentProfile(a.Name)\r\n\t\tif err != nil {\r\n\t\t\tlogger.Warn(\"failed to fetch agent profile from forgejo\", \"agent\", a.Name, \"error\", err)\r\n\t\t}\r\n\r\n\t\troster = append(roster, agentInfo{Name: a.Name, Description: profile.Description, FullName: profile.FullName, Email: profile.Email})\r\n\t}\r\n\r\n\treturn roster\r\n}\r\n\r\n// gitIdentity returns the git commit author name/email to configure\r\n// inside self's container, from its Forgejo profile, falling back to\r\n// its agent name and a synthetic zoo.local address for whichever fields\r\n// its profile doesn't set.\r\nfunc gitIdentity(self string, roster []agentInfo) (name, email string) {\r\n\tfor _, a := range roster {\r\n\t\tif a.Name == self {\r\n\t\t\tname, email = a.FullName, a.Email\r\n\t\t\tbreak\r\n\t\t}\r\n\t}\r\n\r\n\tif name == \"\" {\r\n\t\tname = self\r\n\t}\r\n\r\n\tif email == \"\" {\r\n\t\temail = self + \"@zoo.local\"\r\n\t}\r\n\r\n\treturn name, email\r\n}\r\n\r\n// identitySection renders the \"who am I / who else is there\" prompt\r\n// section injected after the static system prompt: the agent's own\r\n// Forgejo profile description, and everyone else's, so it can decide\r\n// when a task is better handed off via the assign_issue tool.\r\nfunc identitySection(self string, roster []agentInfo) string {\r\n\tvar b strings.Builder\r\n\r\n\tvar selfDesc string\r\n\tvar others []agentInfo\r\n\r\n\tfor _, a := range roster {\r\n\t\tif a.Name == self {\r\n\t\t\tselfDesc = a.Description\r\n\t\t} else {\r\n\t\t\tothers = append(others, a)\r\n\t\t}\r\n\t}\r\n\r\n\tfmt.Fprintf(\u0026b, \"\\n\\n## Your identity\\n\\nYou are the agent %q.\", self)\r\n\r\n\tif selfDesc != \"\" {\r\n\t\tfmt.Fprintf(\u0026b, \" Your role, from your Forgejo profile description: %s\", selfDesc)\r\n\t} else {\r\n\t\tb.WriteString(\" Your Forgejo profile has no description set.\")\r\n\t}\r\n\r\n\tif len(others) \u003e 0 {\r\n\t\tb.WriteString(\"\\n\\n## Other agents\\n\\nIf this task is a better fit for another agent's role, use the assign_issue tool with their name to hand it off (this reassigns the issue/PR on Forgejo, which triggers their run):\\n\")\r\n\r\n\t\tfor _, a := range others {\r\n\t\t\tdesc := a.Description\r\n\t\t\tif desc == \"\" {\r\n\t\t\t\tdesc = \"(no description set)\"\r\n\t\t\t}\r\n\r\n\t\t\tfmt.Fprintf(\u0026b, \"### %s\\n\\n%s\\n\\n\", a.Name, desc)\r\n\t\t}\r\n\t}\r\n\r\n\treturn b.String()\r\n}\r","start_line":1,"end_line":105,"total_lines":105,"truncated":false}

{"query": "CloneURL", "context_after": 6}

/project/internal/forgejo/client.go:352:	CloneURL      string
/project/internal/forgejo/client.go-353-}
/project/internal/forgejo/client.go-354-
/project/internal/forgejo/client.go-355-func (c *Client) RepositoryInfo(owner, repo string) (RepositoryInfo, error) {
/project/internal/forgejo/client.go-356-	r, _, err := c.sdk.GetRepo(owner, repo)
/project/internal/forgejo/client.go-357-	if err != nil {
/project/internal/forgejo/client.go-358-		return RepositoryInfo{}, fmt.Errorf("get repo %s/%s: %w", owner, repo, err)
--
/project/internal/forgejo/client.go:361:	return RepositoryInfo{DefaultBranch: r.DefaultBranch, CloneURL: r.CloneURL}, nil
/project/internal/forgejo/client.go-362-}
/project/internal/forgejo/client.go-363-
/project/internal/forgejo/client.go-364-func (c *Client) setIssueState(owner, repo string, index int64, state sdk.StateType) error {
/project/internal/forgejo/client.go-365-	_, _, err := c.sdk.EditIssue(owner, repo, index, sdk.EditIssueOption{State: &state})
/project/internal/forgejo/client.go-366-	if err != nil {
/project/internal/forgejo/client.go-367-		return fmt.Errorf("set state %q on %s/%s#%d: %w", state, owner, repo, index, err)
--
/project/internal/agentrun/clone.go:24:// cloneAndBranch clones cloneURL into dir, authenticating the clone
/project/internal/agentrun/clone.go-25-// itself with token (see gitAuthArgs), and checks out a new branch off
/project/internal/agentrun/clone.go-26-// of defaultBranch. token never ends up in the resulting working tree:
/project/internal/agentrun/clone.go:27:// the origin remote is left with the plain cloneURL.
/project/internal/agentrun/clone.go:28:func cloneAndBranch(ctx context.Context, cloneURL, token, defaultBranch, branch, dir string) error {
/project/internal/agentrun/clone.go:29:	args := append(gitAuthArgs(token), "clone", "--branch", defaultBranch, "--single-branch", cloneURL, dir)
/project/internal/agentrun/clone.go-30-	if out, err := runGit(ctx, "", args...); err != nil {
/project/internal/agentrun/clone.go-31-		return fmt.Errorf("clone: %w: %s", err, out)
/project/internal/agentrun/clone.go-32-	}
/project/internal/agentrun/clone.go-33-
/project/internal/agentrun/clone.go-34-	if out, err := runGit(ctx, dir, "checkout", "-b", branch); err != nil {
/project/internal/agentrun/clone.go-35-		return fmt.Errorf("checkout branch %q: %w: %s", branch, err, out)
--
/project/internal/agentrun/clone.go:41:// clonePRHead clones cloneURL into dir and checks out the pull request's
/project/internal/agentrun/clone.go-42-// head as a local branch named headRef, so commits the agent makes push
/project/internal/agentrun/clone.go-43-// straight to the PR. The head is fetched via the PR's refs/pull/<n>/head
/project/internal/agentrun/clone.go-44-// ref rather than by branch name, which also works for PRs opened from a
/project/internal/agentrun/clone.go-45-// fork, where the head branch doesn't exist in the base repo.
/project/internal/agentrun/clone.go:46:func clonePRHead(ctx context.Context, cloneURL, token, defaultBranch, headRef string, index int64, dir string) error {
/project/internal/agentrun/clone.go:47:	args := append(gitAuthArgs(token), "clone", "--branch", defaultBranch, "--single-branch", cloneURL, dir)
/project/internal/agentrun/clone.go-48-	if out, err := runGit(ctx, "", args...); err != nil {
/project/internal/agentrun/clone.go-49-		return fmt.Errorf("clone: %w: %s", err, out)
/project/internal/agentrun/clone.go-50-	}
/project/internal/agentrun/clone.go-51-
/project/internal/agentrun/clone.go-52-	fetchArgs := append(gitAuthArgs(token), "fetch", "--no-tags", "origin", fmt.Sprintf("refs/pull/%d/head", index))
/project/internal/agentrun/clone.go-53-	if out, err := runGit(ctx, dir, fetchArgs...); err != nil {
--
/project/internal/agentrun/run.go:152:		if err := clonePRHead(ctx, repoInfo.CloneURL, r.forgejo.Token(), repoInfo.DefaultBranch, headRef, ev.Index, projectDir); err != nil {
/project/internal/agentrun/run.go-153-			return fmt.Errorf("prepare git working tree: %w", err)
/project/internal/agentrun/run.go-154-		}
/project/internal/agentrun/run.go-155-
/project/internal/agentrun/run.go-156-		branch = headRef
/project/internal/agentrun/run.go-157-
/project/internal/agentrun/run.go-158-		// Fetch the full review (verdict, body, inline comments) so the
--
/project/internal/agentrun/run.go:169:		if err := cloneAndBranch(ctx, repoInfo.CloneURL, r.forgejo.Token(), repoInfo.DefaultBranch, branch, projectDir); err != nil {
/project/internal/agentrun/run.go-170-			return fmt.Errorf("prepare git working tree: %w", err)
/project/internal/agentrun/run.go-171-		}
/project/internal/agentrun/run.go-172-	}
/project/internal/agentrun/run.go-173-
/project/internal/agentrun/run.go-174-	roster := buildRoster(r.forgejo, r.cfg.Agents, logger)
/project/internal/agentrun/run.go-175-	gitName, gitEmail := gitIdentity(agent.Name, roster)

{"path": "internal/agentrun/system.md", "start_line": 1, "end_line": 120}

{"path":"internal/agentrun/system.md","content":"You are an autonomous coding agent working inside `zoo`, a system that\r\ntriggers you from Forgejo (a Gitea-family forge) issue/PR events.\r\n\r\n**Your environment**\r\n\r\n- Your working tree is at `/project`, checked out on the working branch\r\n  named in your briefing below. For most events that's a fresh branch\r\n  off the repository's default branch; for a PR review event it's the\r\n  pull request's own head branch, so commits you push update the PR\r\n  directly. Only `/project` persists; nothing outside it survives\r\n  between tool calls.\r\n- The event that triggered you (issue or pull request JSON) is available\r\n  at `/event` inside the container, and is also included below.\r\n- You have a real git remote configured with push access. When you're\r\n  done, `git add`/`git commit`/`git push` your branch — that's how your\r\n  work gets saved. Nothing is persisted automatically.\r\n\r\n**Tools**\r\n\r\n- `bash`, `git`, `read_file`, `write_file`, `list_files`, `grep_search`,\r\n  `move_file`, `remove_file` operate on the project container.\r\n- `comment`, `open_pull_request`, `request_review`, `submit_review`,\r\n  `add_label`, `remove_label`, `close_issue`, `reopen_issue`,\r\n  `assign_issue` act directly on the Forgejo issue/PR that triggered\r\n  this run — use `comment` to report back to the person who filed it,\r\n  `open_pull_request` once you've pushed a branch with your changes,\r\n  and `submit_review` to leave a review verdict.\r\n\r\nBelow, in \"Your identity\" and \"Other agents\", you'll find your own role\r\n(from your Forgejo profile) and a roster of the other agents zoo runs,\r\neach with their own role. If a task in front of you clearly belongs to\r\nsomeone else's role, use `assign_issue` to hand it off rather than\r\ndoing it yourself.\r\n\r\n**Git**\r\n\r\nYou may use normal git commands to manage your working tree. For remote\r\n(pull, fetch, push, etc.) git operations, you can use the `git` tool.\r\n\r\n**Guidelines**\r\n\r\n- Make surgical changes: modify only what's necessary for the task in\r\n  the triggering event.\r\n- Before finishing, verify your changes (re-read the file, run tests or\r\n  a build if the project has them).\r\n- Always leave a `comment` summarizing what you did (or why you couldn't\r\n  finish), and use `open_pull_request` when you have a change ready for\r\n  review. Don't leave the issue without a response.\r","start_line":1,"end_line":48,"total_lines":48,"truncated":false}

{"path": "internal/agentrun/loop.go", "start_line": 1, "end_line": 120}

{"path":"internal/agentrun/loop.go","content":"package agentrun\r\n\r\nimport (\r\n\t\"context\"\r\n\t\"fmt\"\r\n\t\"io\"\r\n\r\n\t\"github.com/abrander/zoo/internal/llm\"\r\n\t\"github.com/abrander/zoo/internal/tools\"\r\n)\r\n\r\n// Hooks lets a caller observe a runLoop invocation live, as the model\r\n// streams and tool calls execute, in addition to the final []llm.Message\r\n// it returns. Any of these may be nil.\r\ntype Hooks struct {\r\n\t// OnReasoningDelta and OnContentDelta fire with just the newly\r\n\t// streamed text for the current turn, not the accumulated total.\r\n\tOnReasoningDelta func(delta string)\r\n\tOnContentDelta   func(delta string)\r\n\r\n\t// OnTurnEnd fires once per completed streamer round-trip, after the\r\n\t// model's message for that turn is fully received and before any of\r\n\t// its tool calls run.\r\n\tOnTurnEnd func()\r\n\r\n\t// OnTool fires once per tool call, after it has run.\r\n\tOnTool func(name, arguments, result string, toolErr bool)\r\n}\r\n\r\n// runLoop is a headless port of ../a's App.generate(): send messages +\r\n// tool defs, get a completion, run any tool_calls and append their\r\n// results, repeat until a plain finish or ctx is done.\r\nfunc runLoop(ctx context.Context, client *llm.Client, toolsCtx tools.Context, messages []llm.Message, hooks Hooks) ([]llm.Message, error) {\r\n\tfor {\r\n\t\tif err := ctx.Err(); err != nil {\r\n\t\t\treturn messages, err\r\n\t\t}\r\n\r\n\t\tstreamer, err := client.StreamChatCompletion(ctx, \u0026llm.ChatCompletionRequest{\r\n\t\t\tMessages: messages,\r\n\t\t\tStream:   true,\r\n\t\t\tTools:    tools.All(),\r\n\t\t})\r\n\t\tif err != nil {\r\n\t\t\treturn messages, fmt.Errorf(\"chat completion: %w\", err)\r\n\t\t}\r\n\r\n\t\tvar completion *llm.ChatCompletion\r\n\r\n\t\tvar prevContent, prevReasoning string\r\n\r\n\t\tfor {\r\n\t\t\tc, err := streamer.Get()\r\n\t\t\tif err == io.EOF {\r\n\t\t\t\tbreak\r\n\t\t\t}\r\n\r\n\t\t\tif err != nil {\r\n\t\t\t\treturn messages, fmt.Errorf(\"stream completion: %w\", err)\r\n\t\t\t}\r\n\r\n\t\t\tcompletion = c\r\n\r\n\t\t\tif len(c.Choices) \u003e 0 {\r\n\t\t\t\tmsg := c.Choices[0].Message\r\n\r\n\t\t\t\tif hooks.OnReasoningDelta != nil \u0026\u0026 len(msg.ReasoningContent) \u003e len(prevReasoning) {\r\n\t\t\t\t\thooks.OnReasoningDelta(msg.ReasoningContent[len(prevReasoning):])\r\n\t\t\t\t}\r\n\t\t\t\tprevReasoning = msg.ReasoningContent\r\n\r\n\t\t\t\tif hooks.OnContentDelta != nil \u0026\u0026 len(msg.Content) \u003e len(prevContent) {\r\n\t\t\t\t\thooks.OnContentDelta(msg.Content[len(prevContent):])\r\n\t\t\t\t}\r\n\t\t\t\tprevContent = msg.Content\r\n\t\t\t}\r\n\t\t}\r\n\r\n\t\tif hooks.OnTurnEnd != nil {\r\n\t\t\thooks.OnTurnEnd()\r\n\t\t}\r\n\r\n\t\tif completion == nil || len(completion.Choices) == 0 {\r\n\t\t\treturn messages, fmt.Errorf(\"model returned an empty completion\")\r\n\t\t}\r\n\r\n\t\tchoice := completion.Choices[0]\r\n\t\tmessages = append(messages, choice.Message)\r\n\r\n\t\tif choice.FinishReason != \"tool_calls\" || len(choice.Message.ToolCalls) == 0 {\r\n\t\t\treturn messages, nil\r\n\t\t}\r\n\r\n\t\tfor _, tc := range choice.Message.ToolCalls {\r\n\t\t\tif err := ctx.Err(); err != nil {\r\n\t\t\t\treturn messages, err\r\n\t\t\t}\r\n\r\n\t\t\tresult, err := tools.Call(toolsCtx, tc.FunctionCall)\r\n\r\n\t\t\ttoolErr := err != nil\r\n\t\t\tif toolErr {\r\n\t\t\t\tresult = fmt.Sprintf(\"ERROR CALLING TOOL: %s\", err.Error())\r\n\t\t\t}\r\n\r\n\t\t\tif hooks.OnTool != nil {\r\n\t\t\t\thooks.OnTool(tc.FunctionCall.Name, tc.FunctionCall.Arguments, result, toolErr)\r\n\t\t\t}\r\n\r\n\t\t\tmessages = append(messages, llm.Message{\r\n\t\t\t\tRole:       \"tool\",\r\n\t\t\t\tContent:    result,\r\n\t\t\t\tToolCallID: tc.Id,\r\n\t\t\t\tName:       tc.FunctionCall.Name,\r\n\t\t\t})\r\n\t\t}\r\n\t}\r\n}\r","start_line":1,"end_line":118,"total_lines":118,"truncated":false}

{"query": "func (c \\*Client) (As|Token)", "context_after": 10}

No matches found.

{"query": "func \\(c \\*Client\\)", "glob": "internal/forgejo/client.go", "context_after": 4}

No matches found.

{"query": "func \\(c \\*Client\\)", "glob": "*.go", "context_after": 3, "max_results": 60}

/project/internal/llm/client.go:30:func (c *Client) StreamChatCompletion(ctx context.Context, req *ChatCompletionRequest) (*Streamer, error) {
/project/internal/llm/client.go-31-	req2 := *req
/project/internal/llm/client.go-32-
/project/internal/llm/client.go-33-	if req2.Model == "" {
--
/project/internal/forgejo/client.go:37:func (c *Client) Token() string {
/project/internal/forgejo/client.go-38-	return c.token
/project/internal/forgejo/client.go-39-}
/project/internal/forgejo/client.go-40-
--
/project/internal/forgejo/client.go:45:func (c *Client) As(token string) *Client {
/project/internal/forgejo/client.go-46-	client, _ := sdk.NewClient(c.baseURL, sdk.SetToken(token))
/project/internal/forgejo/client.go-47-	return &Client{sdk: client, baseURL: c.baseURL, token: token}
/project/internal/forgejo/client.go-48-}
--
/project/internal/forgejo/client.go:60:func (c *Client) Sudo(username string) (*Client, error) {
/project/internal/forgejo/client.go-61-	sudoClient, err := sdk.NewClient(c.baseURL, sdk.SetToken(c.token), sdk.SetSudo(username))
/project/internal/forgejo/client.go-62-	if err != nil {
/project/internal/forgejo/client.go-63-		return nil, fmt.Errorf("forgejo client sudo %q: %w", username, err)
--
/project/internal/forgejo/client.go:71:func (c *Client) CreateIssueComment(owner, repo string, index int64, body string) error {
/project/internal/forgejo/client.go-72-	_, _, err := c.sdk.CreateIssueComment(owner, repo, index, sdk.CreateIssueCommentOption{Body: body})
/project/internal/forgejo/client.go-73-	if err != nil {
/project/internal/forgejo/client.go-74-		return fmt.Errorf("comment on %s/%s#%d: %w", owner, repo, index, err)
--
/project/internal/forgejo/client.go:92:func (c *Client) ListIssueComments(owner, repo string, index int64) ([]IssueComment, error) {
/project/internal/forgejo/client.go-93-	const pageSize = 50
/project/internal/forgejo/client.go-94-
/project/internal/forgejo/client.go-95-	var all []*sdk.Comment
--
/project/internal/forgejo/client.go:128:func (c *Client) AddLabel(owner, repo string, index int64, name string) error {
/project/internal/forgejo/client.go-129-	id, err := c.labelID(owner, repo, name)
/project/internal/forgejo/client.go-130-	if err != nil {
/project/internal/forgejo/client.go-131-		return err
--
/project/internal/forgejo/client.go:144:func (c *Client) RemoveLabel(owner, repo string, index int64, name string) error {
/project/internal/forgejo/client.go-145-	labels, _, err := c.sdk.GetIssueLabels(owner, repo, index, sdk.ListLabelsOptions{})
/project/internal/forgejo/client.go-146-	if err != nil {
/project/internal/forgejo/client.go-147-		return fmt.Errorf("list labels on %s/%s#%d: %w", owner, repo, index, err)
--
/project/internal/forgejo/client.go:163:func (c *Client) labelID(owner, repo, name string) (int64, error) {
/project/internal/forgejo/client.go-164-	labels, _, err := c.sdk.ListRepoLabels(owner, repo, sdk.ListLabelsOptions{})
/project/internal/forgejo/client.go-165-	if err != nil {
/project/internal/forgejo/client.go-166-		return 0, fmt.Errorf("list labels on %s/%s: %w", owner, repo, err)
--
/project/internal/forgejo/client.go:187:func (c *Client) CreatePullRequest(owner, repo, head, base, title, body string) error {
/project/internal/forgejo/client.go-188-	_, _, err := c.sdk.CreatePullRequest(owner, repo, sdk.CreatePullRequestOption{
/project/internal/forgejo/client.go-189-		Head:  head,
/project/internal/forgejo/client.go-190-		Base:  base,
--
/project/internal/forgejo/client.go:202:func (c *Client) RequestReview(owner, repo string, index int64, reviewers []string) error {
/project/internal/forgejo/client.go-203-	_, err := c.sdk.CreateReviewRequests(owner, repo, index, sdk.PullReviewRequestOptions{Reviewers: reviewers})
/project/internal/forgejo/client.go-204-	if err != nil {
/project/internal/forgejo/client.go-205-		return fmt.Errorf("request review on %s/%s#%d: %w", owner, repo, index, err)
--
/project/internal/forgejo/client.go:223:func (c *Client) SubmitReview(owner, repo string, index int64, state, body string) error {
/project/internal/forgejo/client.go-224-	var sdkState sdk.ReviewStateType
/project/internal/forgejo/client.go-225-
/project/internal/forgejo/client.go-226-	switch state {
--

{"path": "internal/tools/shell.go", "start_line": 1, "end_line": 60}

{"path":"internal/tools/shell.go","content":"package tools\r\n\r\nimport (\r\n\t\"context\"\r\n\t\"encoding/base64\"\r\n\t\"fmt\"\r\n\t\"strings\"\r\n)\r\n\r\n// shellQuote wraps s in single quotes for safe interpolation into a `sh\r\n// -c` command string, escaping any embedded single quotes.\r\nfunc shellQuote(s string) string {\r\n\treturn \"'\" + strings.ReplaceAll(s, \"'\", `'\\''`) + \"'\"\r\n}\r\n\r\nfunc resolvePath(path string) string {\r\n\tif path == \"\" {\r\n\t\treturn \"/project\"\r\n\t}\r\n\r\n\tif path == \".\" || path == \"./\" {\r\n\t\treturn \"/project\"\r\n\t}\r\n\r\n\tif strings.HasPrefix(path, \"/project/\") {\r\n\t\treturn path\r\n\t}\r\n\r\n\tif !strings.HasPrefix(path, \"/\") {\r\n\t\treturn \"/project/\" + strings.TrimPrefix(path, \"/\")\r\n\t}\r\n\r\n\treturn path\r\n}\r\n\r\nfunc shellReadFile(ctx Context, path string) ([]byte, error) {\r\n\tp := resolvePath(path)\r\n\r\n\t// We use base64 encoding to avoid issues with binary data and\r\n\t// special characters in the file content. The output of the command\r\n\t// will be base64-encoded, which we then decode in Go.\r\n\toutput, err := ctx.Exec(context.Background(), \"base64 \"+shellQuote(p))\r\n\tif err != nil {\r\n\t\treturn nil, err\r\n\t}\r\n\r\n\tdecoded, err := base64.StdEncoding.DecodeString(output)\r\n\tif err != nil {\r\n\t\treturn nil, fmt.Errorf(\"decode base64 output of %q: %w\", path, err)\r\n\t}\r\n\r\n\treturn decoded, nil\r\n}\r\n\r\nfunc shellWriteFile(ctx Context, path string, content []byte) error {\r\n\tp := resolvePath(path)\r\n\tencoded := base64.StdEncoding.EncodeToString(content)\r\n\r\n\tcmd := fmt.Sprintf(\r\n\t\t`mkdir -p \"$(dirname %s)\" \u0026\u0026 echo %s | base64 -d \u003e %s`,\r","start_line":1,"end_line":60,"total_lines":69,"truncated":true}

{"query": "git", "glob": "README.md", "context_after": 2, "max_results": 40}

No matches found.

{"path": "zoo.hcl.example", "start_line": 1, "end_line": 80}

{"path":"zoo.hcl.example","content":"# zoo.hcl - Configuration for the zoo daemon.\r\n#\r\n# Copy this file to zoo.hcl (gitignored) and fill in real values.\r\n\r\nllm \"Qwen 3.6\" {\r\n    openai = \"https://code.stdio.dk\"\r\n    token  = \"TOKEN\"\r\n    model  = \"Qwen3.6\"\r\n}\r\n\r\nllm \"Qwen 3.8\" {\r\n    openai = \"https://code.stdio.dk\"\r\n    token  = \"TOKEN\"\r\n    model  = \"Qwen3.8\"\r\n}\r\n\r\nforgejo {\r\n    url            = \"https://code.stdio.dk\"\r\n    token          = \"ZOO_SERVICE_TOKEN\"\r\n    # Shared secret configured on the Forgejo webhook. Required to accept\r\n    # webhook deliveries; polling works without it.\r\n    webhook_secret = \"EXAMPLE_WEBHOOK_SECRET\"\r\n}\r\n\r\nenvironment {\r\n    docker_image   = \"golang:latest\"\r\n    max_live_agents = 5\r\n}\r\n\r\nagent \"anna\" {\r\n    llm   = \"Qwen 3.6\"\r\n    token = \"ANNA_FORGEJO_TOKEN\"\r\n}\r\n\r\nagent \"greg\" {\r\n    llm   = \"Qwen 3.8\"\r\n    token = \"GREG_FORGEJO_TOKEN\"\r\n}\r\n\r\n# \"leon\" doubles as the expected Forgejo assignee username for\r\n# issue:assigned events - see the event block below.\r\nagent \"leon\" {\r\n    llm   = \"Qwen 3.8\"\r\n    token = \"LEON_FORGEJO_TOKEN\"\r\n}\r\n\r\nagent \"mika\" {\r\n    llm   = \"Qwen 3.6\"\r\n    token = \"MIKA_FORGEJO_TOKEN\"\r\n}\r\n\r\nevent \"issue:new\" {\r\n    agent = \"leon\"\r\n}\r\n\r\nevent \"issue:assigned\" {\r\n    // No `agent` here: the agent whose name matches the Forgejo\r\n    // assignee's username is triggered.\r\n    instructions = \"Please handle this issue.\"\r\n}\r\n\r\nevent \"issue:comment\" {\r\n    agent        = \"leon\"\r\n    instructions = \"Please review what this comment says and respond appropriately.\"\r\n}\r\n\r\nevent \"pr:new\" {\r\n    agent        = \"greg\"\r\n    instructions = \"Please review this pull request and respond appropriately.\"\r\n}\r\n\r\n# A review was submitted on a pull request (approved, changes requested,\r\n# or comment). The agent that opened the PR is triggered to handle it,\r\n# like issue:assigned: its working tree is checked out on the PR's head\r\n# branch, so changes it pushes update the PR directly. It should address\r\n# the feedback and reply to the review with a summary of what it\r\n# addressed. (Forgejo has no API to mark review comments resolved, so\r\n# that stays with the reviewer.)\r\nevent \"pr:review\" {\r\n    // No `agent` here: the agent whose name matches the pull request\r","start_line":1,"end_line":80,"total_lines":83,"truncated":true}

{"query": "sandbox|container|docker", "glob": "README.md", "context_after": 3, "max_results": 40}

/project/README.md:5:Zoo watches a [Forgejo](https://codeberg.org/forgejo/forgejo) instance for issue and pull request events, then dispatches them to configured AI agents running in isolated Docker containers. Each agent has its own role, LLM model, and personality — like a menagerie working together to keep your projects moving.
/project/README.md-6-
/project/README.md-7----
/project/README.md-8-
--
/project/README.md:14:- **Isolated execution** — Agents run in Docker containers with full filesystem access but no persistence between runs.
/project/README.md-15-- **Live dashboard** — Real-time web UI showing active agents, logs, and job history.
/project/README.md-16-- **Webhook & polling support** — React to events instantly via webhooks, or fall back to polling.
/project/README.md-17-
--
/project/README.md:27:| Docker      | Latest  |
/project/README.md-28-| Forgejo     | Any (self-hosted or codeberg.dk) |
/project/README.md-29-| LLM endpoint | OpenAI-compatible API |
/project/README.md-30-
--
/project/README.md:97:    docker_image    = "golang:latest"   # base image for agent containers
/project/README.md-98-    max_live_agents = 5                 # concurrent agent limit
/project/README.md-99-}
/project/README.md-100-```
--
/project/README.md:142:| `-keep-on-failure`| `false`         | Preserve container after failure for debugging |
/project/README.md-143-
/project/README.md-144----
/project/README.md-145-
--
/project/README.md:151:│   ├── agentrun/             # Docker-based agent execution
/project/README.md-152-│   ├── config/               # HCL config loader & validator
/project/README.md-153-│   ├── forgejo/              # Webhook receiver & event poller
/project/README.md-154-│   ├── livelog/              # Real-time log streaming hub

{"query": "token", "glob": "README.md", "context_after": 4, "max_results": 30}

/project/README.md:39:Edit `zoo.hcl` with your Forgejo credentials, LLM tokens, and agent definitions. See the [configuration reference](#-configuration-reference) below.
/project/README.md-40-
/project/README.md-41-### Running
/project/README.md-42-
/project/README.md-43-```bash
--
/project/README.md:78:    token  = "YOUR_API_TOKEN"
/project/README.md-79-    model  = "model-name"
/project/README.md-80-}
/project/README.md-81-```
/project/README.md-82-
--
/project/README.md:88:    token          = "ZOO_SERVICE_TOKEN"
/project/README.md-89-    webhook_secret = "SHARED_SECRET"  # optional if using polling
/project/README.md-90-}
/project/README.md-91-```
/project/README.md-92-
--
/project/README.md:107:    token = "ANNA_FORGEJO_TOKEN"
/project/README.md-108-}
/project/README.md-109-```
/project/README.md-110-
/project/README.md-111-### Event Routing
--
/project/README.md:180:       token = "NEW_AGENT_TOKEN"
/project/README.md-181-   }
/project/README.md-182-   ```
/project/README.md-183-
/project/README.md-184-2. Add an event route:

{"path": "internal/tools/tools_test.go", "start_line": 1, "end_line": 120}

{"path":"internal/tools/tools_test.go","content":"package tools\r\n\r\nimport (\r\n\t\"context\"\r\n\t\"fmt\"\r\n\t\"strings\"\r\n\t\"testing\"\r\n)\r\n\r\ntype fakeForgejoActions struct {\r\n\tcomments []string\r\n\tassigned []string\r\n\treviews  []string\r\n}\r\n\r\nfunc (f *fakeForgejoActions) Comment(body string) error {\r\n\tf.comments = append(f.comments, body)\r\n\treturn nil\r\n}\r\nfunc (f *fakeForgejoActions) OpenPullRequest(head, base, title, body string) error { return nil }\r\nfunc (f *fakeForgejoActions) RequestReview(reviewers []string) error               { return nil }\r\nfunc (f *fakeForgejoActions) AddLabel(name string) error                           { return nil }\r\nfunc (f *fakeForgejoActions) RemoveLabel(name string) error                        { return nil }\r\nfunc (f *fakeForgejoActions) CloseIssue() error                                    { return nil }\r\nfunc (f *fakeForgejoActions) ReopenIssue() error                                   { return nil }\r\nfunc (f *fakeForgejoActions) AssignIssue(agentName string) error {\r\n\tf.assigned = append(f.assigned, agentName)\r\n\treturn nil\r\n}\r\nfunc (f *fakeForgejoActions) SubmitReview(state, body string) error {\r\n\tf.reviews = append(f.reviews, state)\r\n\treturn nil\r\n}\r\n\r\ntype fakeContext struct {\r\n\tlastCmd string\r\n\toutput  string\r\n\terr     error\r\n\tfg      *fakeForgejoActions\r\n\r\n\tlastGitSubcommand string\r\n\tlastGitArgs       []string\r\n}\r\n\r\nfunc (f *fakeContext) Exec(ctx context.Context, command string) (string, error) {\r\n\tf.lastCmd = command\r\n\treturn f.output, f.err\r\n}\r\n\r\nfunc (f *fakeContext) Git(ctx context.Context, subcommand string, args ...string) (string, error) {\r\n\tf.lastGitSubcommand = subcommand\r\n\tf.lastGitArgs = args\r\n\treturn f.output, f.err\r\n}\r\n\r\nfunc (f *fakeContext) Forgejo() ForgejoActions {\r\n\treturn f.fg\r\n}\r\n\r\nfunc TestShellQuote(t *testing.T) {\r\n\tcases := map[string]string{\r\n\t\t\"simple\":     \"'simple'\",\r\n\t\t\"it's a dir\": `'it'\\''s a dir'`,\r\n\t}\r\n\tfor in, want := range cases {\r\n\t\tif got := shellQuote(in); got != want {\r\n\t\t\tt.Errorf(\"shellQuote(%q) = %q, want %q\", in, got, want)\r\n\t\t}\r\n\t}\r\n}\r\n\r\nfunc TestReadFileParsesMetaAndContent(t *testing.T) {\r\n\tfc := \u0026fakeContext{output: \"3\\nline one\\nline two\\nline three\\n\"}\r\n\r\n\tout, err := readFile(fc, readFileParams{Path: \"src/main.go\"})\r\n\tif err != nil {\r\n\t\tt.Fatal(err)\r\n\t}\r\n\r\n\tif !strings.Contains(fc.lastCmd, \"/project/src/main.go\") {\r\n\t\tt.Fatalf(\"expected command to reference /project/src/main.go, got %q\", fc.lastCmd)\r\n\t}\r\n\tif !strings.Contains(out, \"line one\") || !strings.Contains(out, `\"total_lines\":3`) {\r\n\t\tt.Fatalf(\"unexpected result: %s\", out)\r\n\t}\r\n\tif strings.Contains(out, `\"truncated\":true`) {\r\n\t\tt.Fatalf(\"full read should not be truncated: %s\", out)\r\n\t}\r\n}\r\n\r\nfunc TestGitRejectsDisallowedSubcommand(t *testing.T) {\r\n\tfc := \u0026fakeContext{}\r\n\r\n\t_, err := git(fc, gitParams{Subcommand: \"push-force\"})\r\n\tif err == nil {\r\n\t\tt.Fatal(\"expected error for disallowed subcommand\")\r\n\t}\r\n}\r\n\r\nfunc TestGitPassesSubcommandAndArgsThrough(t *testing.T) {\r\n\tfc := \u0026fakeContext{output: \"ok\"}\r\n\r\n\t_, err := git(fc, gitParams{Subcommand: \"commit\", Args: []string{\"-m\", \"fix: handle it's edge case\"}})\r\n\tif err != nil {\r\n\t\tt.Fatal(err)\r\n\t}\r\n\r\n\tif fc.lastGitSubcommand != \"commit\" {\r\n\t\tt.Fatalf(\"expected subcommand %q, got %q\", \"commit\", fc.lastGitSubcommand)\r\n\t}\r\n\tif len(fc.lastGitArgs) != 2 || fc.lastGitArgs[1] != \"fix: handle it's edge case\" {\r\n\t\tt.Fatalf(\"expected args passed through unescaped, got %v\", fc.lastGitArgs)\r\n\t}\r\n}\r\n\r\nfunc TestCommentToolCallsForgejo(t *testing.T) {\r\n\tfg := \u0026fakeForgejoActions{}\r\n\tfc := \u0026fakeContext{fg: fg}\r\n\r\n\tif _, err := comment(fc, commentParams{Body: \"hello\"}); err != nil {\r","start_line":1,"end_line":120,"total_lines":216,"truncated":true}

{"command": "docker version 2>&1 | head -5; echo \"---\"; which git; git --version"}

sh: 1: docker: not found
---
/usr/bin/git
git version 2.47.3

{"command": "cd /tmp && export HOME=/tmp/testhome && mkdir -p $HOME && git config --global http.\"https://code.stdio.dk/abrander/zoo.git\".extraHeader \"Authorization: Basic dGVzdA==\" && git config --global --get http.https://code.stdio.dk/abrander/zoo.git.extraHeader && echo OK-QUOTED; git config --global http.https://code.stdio.dk/abrander/zoo.git.extraHeader \"Authorization: Basic dGVzdDI=\" && git config --global --get http.https://code.stdio.dk/abrander/zoo.git.extraHeader && echo OK-UNQUOTED"}

Authorization: Basic dGVzdA==
OK-QUOTED
Authorization: Basic dGVzdDI=
OK-UNQUOTED

{"command": "which python3 && python3 --version"}

/usr/bin/python3
Python 3.13.5

{"command": "cd /tmp/gitauth-test && ls; git clone http://127.0.0.1:8931/bare.git noauth 2>&1 | head -5; echo \"exit: $?\""}

bare.git  seed	server.py
Cloning into 'noauth'...
fatal: unable to access 'http://127.0.0.1:8931/bare.git/': Failed to connect to 127.0.0.1 port 8931 after 0 ms: Could not connect to server
exit: 0

{"command": "set -x\ncd /tmp/gitauth-test\npython3 server.py & SERVER_PID=$!\nsleep 0.5\ncurl -s -o /dev/null -w \"%{http_code}\\n\" http://127.0.0.1:8931/bare.git/info/refs?service=git-upload-pack\ngit clone http://127.0.0.1:8931/bare.git noauth 2>&1 | tail -2\ngit -c http.127.0.0.1:8931/bare.git.extraHeader=\"Authorization: Basic c2VlZDpzM2NyZXQ=\" clone -q http://127.0.0.1:8931/bare.git authed && echo CLONE-OK\ncd authed\ngit config --local http.127.0.0.1:8931/bare.git.extraHeader \"Authorization: Basic c2VlZDpzM2NyZXQ=\"\necho change >> file.txt && git -c user.name=t -c user.email=t@t commit -qam \"second\"\ngit pull 2>&1 | tail -1\ngit push origin main 2>&1 | tail -2 && echo PUSH-OK\nkill $SERVER_PID 2>/dev/null", "timeout": 60}

+ cd /tmp/gitauth-test
+ SERVER_PID=289
+ sleep 0.5
+ python3 server.py
+ curl -s -o /dev/null -w %{http_code}\n http://127.0.0.1:8931/bare.git/info/refs?service=git-upload-pack
401
+ git clone http://127.0.0.1:8931/bare.git noauth
+ tail -2
Cloning into 'noauth'...
fatal: could not read Username for 'http://127.0.0.1:8931': terminal prompts disabled
+ git -c http.127.0.0.1:8931/bare.git.extraHeader=Authorization: Basic c2VlZDpzM2NyZXQ= clone -q http://127.0.0.1:8931/bare.git authed
fatal: could not read Username for 'http://127.0.0.1:8931': terminal prompts disabled
+ cd authed
sh: 8: cd: can't cd to authed
+ git config --local http.127.0.0.1:8931/bare.git.extraHeader Authorization: Basic c2VlZDpzM2NyZXQ=
fatal: --local can only be used inside a git repository
+ echo change
+ git -c user.name=t -c user.email=t@t commit -qam second
fatal: not a git repository (or any of the parent directories): .git
+ git pull
+ tail -1
fatal: not a git repository (or any of the parent directories): .git
+ git push origin main
+ tail -2
fatal: not a git repository (or any of the parent directories): .git
+ echo PUSH-OK
PUSH-OK
+ kill 289

{"command": "cd /tmp/gitauth-test\npython3 server.py & SERVER_PID=$!\nsleep 0.5\ngit -c 'http.http://127.0.0.1:8931/bare.git.extraHeader=Authorization: Basic c2VlZDpzM2NyZXQ=' clone -q http://127.0.0.1:8931/bare.git authed && echo CLONE-OK\ncd authed\ngit config --local 'http.http://127.0.0.1:8931/bare.git.extraHeader' \"Authorization: Basic c2VlZDpzM2NyZXQ=\"\necho change >> file.txt && git -c user.name=t -c user.email=t@t commit -qam \"second\"\ngit pull 2>&1 | tail -1\ngit push origin main 2>&1 | tail -2 && echo PUSH-OK\nkill $SERVER_PID 2>/dev/null", "timeout": 60}

error: RPC failed; HTTP 415 curl 22 The requested URL returned error: 415
fatal: the remote end hung up unexpectedly
sh: 5: cd: can't cd to authed
fatal: --local can only be used inside a git repository
fatal: not a git repository (or any of the parent directories): .git
fatal: not a git repository (or any of the parent directories): .git
fatal: not a git repository (or any of the parent directories): .git
PUSH-OK

{"command": "cd /tmp/gitauth-test\ncat > server.py <<'EOF'\nimport os, subprocess\nfrom http.server import BaseHTTPRequestHandler, HTTPServer\nfrom urllib.parse import urlparse, parse_qs\n\nclass H(BaseHTTPRequestHandler):\n    def _handle(self):\n        auth = self.headers.get(\"Authorization\", \"\")\n        if auth != \"Basic c2VlZDpzM2NyZXQ=\":\n            self.send_response(401)\n            self.send_header(\"WWW-Authenticate\", \"Basic\")\n            self.end_headers()\n            return\n        path = urlparse(self.path)\n        length = int(self.headers.get(\"Content-Length\") or 0)\n        body = self.rfile.read(length) if length else b\"\"\n        env = dict(os.environ)\n        env[\"REQUEST_METHOD\"] = self.command\n        env[\"GIT_PROJECT_ROOT\"] = \"/tmp/gitauth-test\"\n        env[\"GIT_HTTP_EXPORT_ALL\"] = \"1\"\n        env[\"PATH_INFO\"] = path.path\n        env[\"QUERY_STRING\"] = path.query\n        env[\"CONTENT_LENGTH\"] = str(length)\n        ct = self.headers.get(\"Content-Type\")\n        if ct:\n            env[\"CONTENT_TYPE\"] = ct\n        p = subprocess.run([\"git\", \"http-backend\"], env=env, input=body, capture_output=True)\n        out = p.stdout\n        head, _, payload = out.partition(b\"\\r\\n\\r\\n\")\n        status = \"200 OK\"\n        hdrs = {}\n        for line in head.decode().split(\"\\r\\n\"):\n            if \":\" in line:\n                k, v = line.split(\":\", 1)\n                if k.strip().lower() == \"status\":\n                    status = v.strip()\n                else:\n                    hdrs[k.strip()] = v.strip()\n        self.send_response(int(status.split()[0]))\n        for k, v in hdrs.items():\n            self.send_header(k, v)\n        self.end_headers()\n        self.wfile.write(payload)\n    do_GET = _handle\n    do_POST = _handle\n    def log_message(self, *a): pass\n\nHTTPServer((\"127.0.0.1\", 8931), H).serve_forever()\nEOF\npython3 server.py & SERVER_PID=$!\nsleep 0.5\ngit -c 'http.http://127.0.0.1:8931/bare.git.extraHeader=Authorization: Basic c2VlZDpzM2NyZXQ=' clone -q http://127.0.0.1:8931/bare.git authed && echo CLONE-OK\ncd authed\ngit config --local 'http.http://127.0.0.1:8931/bare.git.extraHeader' \"Authorization: Basic c2VlZDpzM2NyZXQ=\"\necho change >> file.txt && git -c user.name=t -c user.email=t@t commit -qam \"second\"\ngit pull 2>&1 | tail -1\ngit push origin main 2>&1 | tail -2 && echo PUSH-OK\ngit ls-remote origin 2>&1 | head -2 && echo LSREMOTE-OK\nkill $SERVER_PID 2>/dev/null", "timeout": 60}

CLONE-OK
Already up to date.
fatal: unable to access 'http://127.0.0.1:8931/bare.git/': The requested URL returned error: 403
PUSH-OK
34060c4d8576aa5812fa303ee9d0482845525c5d	HEAD
34060c4d8576aa5812fa303ee9d0482845525c5d	refs/heads/main
LSREMOTE-OK

{"command": "cd /tmp/gitauth-test\ngit -C bare.git config http.receivepack true\npython3 server.py & SERVER_PID=$!\nsleep 0.5\ncd authed\ngit push origin main 2>&1 | tail -2 && echo PUSH-OK\nkill $SERVER_PID 2>/dev/null", "timeout": 60}

To http://127.0.0.1:8931/bare.git
   34060c4..c74a626  main -> main
PUSH-OK

{"query": "runGit|gitAuthArgs|cloneAndBranch|clonePRHead|projectDir", "glob": "*.go", "max_results": 60}

/project/internal/agentrun/context.go:17:	projectDir  string
/project/internal/agentrun/context.go:37:// c.projectDir rather than via docker exec. Only push needs to
/project/internal/agentrun/context.go:40:// gitAuthArgs) — the container this same working tree is bind-mounted
/project/internal/agentrun/context.go:46:		return runGitAuthed(ctx, c.projectDir, c.token, cmdArgs...)
/project/internal/agentrun/context.go:49:	return runGit(ctx, c.projectDir, cmdArgs...)
/project/internal/agentrun/clone.go:11:// gitAuthArgs returns the `-c http.extraHeader=...` global git arguments
/project/internal/agentrun/clone.go:18:func gitAuthArgs(token string) []string {
/project/internal/agentrun/clone.go:24:// cloneAndBranch clones cloneURL into dir, authenticating the clone
/project/internal/agentrun/clone.go:25:// itself with token (see gitAuthArgs), and checks out a new branch off
/project/internal/agentrun/clone.go:28:func cloneAndBranch(ctx context.Context, cloneURL, token, defaultBranch, branch, dir string) error {
/project/internal/agentrun/clone.go:29:	args := append(gitAuthArgs(token), "clone", "--branch", defaultBranch, "--single-branch", cloneURL, dir)
/project/internal/agentrun/clone.go:30:	if out, err := runGit(ctx, "", args...); err != nil {
/project/internal/agentrun/clone.go:34:	if out, err := runGit(ctx, dir, "checkout", "-b", branch); err != nil {
/project/internal/agentrun/clone.go:41:// clonePRHead clones cloneURL into dir and checks out the pull request's
/project/internal/agentrun/clone.go:46:func clonePRHead(ctx context.Context, cloneURL, token, defaultBranch, headRef string, index int64, dir string) error {
/project/internal/agentrun/clone.go:47:	args := append(gitAuthArgs(token), "clone", "--branch", defaultBranch, "--single-branch", cloneURL, dir)
/project/internal/agentrun/clone.go:48:	if out, err := runGit(ctx, "", args...); err != nil {
/project/internal/agentrun/clone.go:52:	fetchArgs := append(gitAuthArgs(token), "fetch", "--no-tags", "origin", fmt.Sprintf("refs/pull/%d/head", index))
/project/internal/agentrun/clone.go:53:	if out, err := runGit(ctx, dir, fetchArgs...); err != nil {
/project/internal/agentrun/clone.go:57:	if out, err := runGit(ctx, dir, "checkout", "-B", headRef, "FETCH_HEAD"); err != nil {
/project/internal/agentrun/clone.go:64:// runGit runs a git subcommand on the host (not inside any container)
/project/internal/agentrun/clone.go:66:func runGit(ctx context.Context, dir string, args ...string) (string, error) {
/project/internal/agentrun/clone.go:77:// runGitAuthed is runGit with token attached via gitAuthArgs, for the
/project/internal/agentrun/clone.go:79:func runGitAuthed(ctx context.Context, dir, token string, args ...string) (string, error) {
/project/internal/agentrun/clone.go:80:	return runGit(ctx, dir, append(gitAuthArgs(token), args...)...)
/project/internal/agentrun/docker_integration_test.go:57:	projectDir := t.TempDir()
/project/internal/agentrun/docker_integration_test.go:60:		{"init", "-q", projectDir},
/project/internal/agentrun/docker_integration_test.go:61:		{"-C", projectDir, "commit", "-q", "--allow-empty", "-m", "init"},
/project/internal/agentrun/docker_integration_test.go:76:	containerID, err := rt.createContainer(ctx, "golang:latest", []string{projectDir + ":/project"}, "zoo-test-git")
/project/internal/agentrun/run.go:127:	projectDir := filepath.Join(workDir, "project")
/project/internal/agentrun/run.go:152:		if err := clonePRHead(ctx, repoInfo.CloneURL, r.forgejo.Token(), repoInfo.DefaultBranch, headRef, ev.Index, projectDir); err != nil {
/project/internal/agentrun/run.go:169:		if err := cloneAndBranch(ctx, repoInfo.CloneURL, r.forgejo.Token(), repoInfo.DefaultBranch, branch, projectDir); err != nil {
/project/internal/agentrun/run.go:178:	// projectDir/.git/config: the one place both this host-side clone
/project/internal/agentrun/run.go:181:	if out, err := runGit(ctx, projectDir, "config", "user.name", gitName); err != nil {
/project/internal/agentrun/run.go:184:	if out, err := runGit(ctx, projectDir, "config", "user.email", gitEmail); err != nil {
/project/internal/agentrun/run.go:194:		projectDir + ":/project",
/project/internal/agentrun/run.go:234:		projectDir:  projectDir,

{"path": "internal/agentrun/seed_test.go", "start_line": 1, "end_line": 60}

{"path":"internal/agentrun/seed_test.go","content":"package agentrun\r\n\r\nimport (\r\n\t\"strings\"\r\n\t\"testing\"\r\n\t\"time\"\r\n\r\n\t\"github.com/abrander/zoo/internal/forgejo\"\r\n)\r\n\r\nfunc TestSeedMessageIncludesInstructions(t *testing.T) {\r\n\tev := forgejo.Event{Kind: \"issue:comment\", Owner: \"acme\", Repo: \"widgets\", Index: 5, Title: \"t\", Body: \"b\", Raw: []byte(`{}`)}\r\n\r\n\tmsg := seedMessage(ev, \"issue-5-leon\", \"main\", \"Please review the comment and respond appropriately.\", nil, nil)\r\n\r\n\tif !strings.Contains(msg, \"Instructions for this event, from zoo.hcl:\\nPlease review the comment and respond appropriately.\") {\r\n\t\tt.Fatalf(\"expected instructions section, got: %s\", msg)\r\n\t}\r\n}\r\n\r\nfunc TestSeedMessageOmitsEmptyInstructions(t *testing.T) {\r\n\tev := forgejo.Event{Kind: \"pr:new\", Owner: \"acme\", Repo: \"widgets\", Index: 9, Raw: []byte(`{}`)}\r\n\r\n\tmsg := seedMessage(ev, \"issue-9-greg\", \"main\", \"\", nil, nil)\r\n\r\n\tif strings.Contains(msg, \"Instructions for this event\") {\r\n\t\tt.Fatalf(\"expected no instructions section, got: %s\", msg)\r\n\t}\r\n}\r\n\r\nfunc TestSeedMessageIncludesAllComments(t *testing.T) {\r\n\tev := forgejo.Event{Kind: \"issue:assigned\", Owner: \"acme\", Repo: \"widgets\", Index: 5, Title: \"t\", Body: \"b\", Raw: []byte(`{}`)}\r\n\r\n\tcomments := []forgejo.IssueComment{\r\n\t\t{Author: \"alice\", Body: \"Please also handle the edge case.\", Created: time.Date(2026, 8, 24, 9, 0, 0, 0, time.UTC)},\r\n\t\t{Author: \"bob\", Body: \"And add a test for it.\", Created: time.Date(2026, 8, 24, 9, 5, 0, 0, time.UTC)},\r\n\t}\r\n\r\n\tmsg := seedMessage(ev, \"issue-5-greg\", \"main\", \"\", comments, nil)\r\n\r\n\tfor _, want := range []string{\r\n\t\t\"Comments (2):\",\r\n\t\t\"1. alice (2026-08-24T09:00:00Z):\\nPlease also handle the edge case.\",\r\n\t\t\"2. bob (2026-08-24T09:05:00Z):\\nAnd add a test for it.\",\r\n\t} {\r\n\t\tif !strings.Contains(msg, want) {\r\n\t\t\tt.Fatalf(\"expected %q in seed message, got:\\n%s\", want, msg)\r\n\t\t}\r\n\t}\r\n\r\n\t// Comments come before the raw payload, so the agent reads them\r\n\t// as part of the briefing, not buried in JSON.\r\n\tif !strings.Contains(msg, \"Comments (2):\") ||\r\n\t\tstrings.Index(msg, \"Comments (2):\") \u003e strings.Index(msg, \"Full event payload:\") {\r\n\t\tt.Fatalf(\"expected comments section before the raw payload, got:\\n%s\", msg)\r\n\t}\r\n}\r\n\r\nfunc TestSeedMessageOmitsEmptyComments(t *testing.T) {\r\n\tev := forgejo.Event{Kind: \"issue:new\", Owner: \"acme\", Repo: \"widgets\", Index: 5, Title: \"t\", Body: \"b\", Raw: []byte(`{}`)}\r","start_line":1,"end_line":60,"total_lines":128,"truncated":true}

{"command": "cd /project && git mv internal/agentrun/clone.go internal/agentrun/sandboxgit.go"}

{"path": "internal/agentrun/sandboxgit.go", "content": "package agentrun\n\nimport (\n\t\"context\"\n\t\"encoding/base64\"\n\t\"fmt\"\n\t\"strings\"\n)\n\n// This file makes git \"just work\" inside the agent's container: the\n// initial clone happens in the sandbox, and the sandbox's git\n// credential is written to the container's system gitconfig so every\n// subsequent remote operation (pull, fetch, push, ...) authenticates\n// without any per-invocation plumbing. Zoo itself never runs git\n// outside the sandbox.\n\n// shellQuote wraps s in single quotes for safe interpolation into a\n// `sh -c` command string, escaping any embedded single quotes.\nfunc shellQuote(s string) string {\n\treturn \"'\" + strings.ReplaceAll(s, \"'\", `'\\''`) + \"'\"\n}\n\n// shellGitCmd renders `git <args...>` as one sh -c command line with\n// every argument quoted, for docker exec.\nfunc shellGitCmd(args ...string) string {\n\tparts := make([]string, 0, len(args)+1)\n\tparts = append(parts, \"git\")\n\n\tfor _, a := range args {\n\t\tparts = append(parts, shellQuote(a))\n\t}\n\n\treturn strings.Join(parts, \" \")\n}\n\n// runSandboxGit runs `git <args...>` inside containerID (in its\n// working directory, /project) and returns its combined output. A\n// non-zero exit code is an error carrying the output.\nfunc runSandboxGit(ctx context.Context, rt *dockerRuntime, containerID string, args ...string) (string, error) {\n\tout, exitCode, err := rt.exec(ctx, containerID, shellGitCmd(args...))\n\tif err != nil {\n\t\treturn out, err\n\t}\n\n\tif exitCode != 0 {\n\t\treturn out, fmt.Errorf(\"git %s: exit %d: %s\", args[0], exitCode, out)\n\t}\n\n\treturn out, nil\n}\n\n// gitAuthHeader returns the value of an Authorization header that\n// authenticates git's smart-HTTP requests as user with token.\nfunc gitAuthHeader(user, token string) string {\n\tauth := base64.StdEncoding.EncodeToString([]byte(user + \":\" + token))\n\n\treturn \"Authorization: Basic \" + auth\n}\n\n// configureSandboxGit writes the container's system gitconfig so git\n// works inside the sandbox without further setup:\n//\n//   - safe.directory '*', so the bind-mounted /project is accepted\n//     regardless of which UID the container runs git as;\n//   - user.name / user.email, so commits are attributed to the agent;\n//   - http.<cloneURL>.extraHeader carrying the run's Forgejo\n//     credential, scoped to this repository's URL, so clone/fetch/\n//     pull/push all authenticate transparently.\n//\n// The credential lives in the container's own filesystem (ephemeral,\n// torn down with the container), never in the bind-mounted working\n// tree: the origin remote keeps the plain cloneURL, so the token can't\n// leak into the repo's .git/config, into a work dir zoo keeps on\n// failure, or anywhere the host can read it back.\nfunc configureSandboxGit(ctx context.Context, rt *dockerRuntime, containerID, cloneURL, user, token, name, email string) error {\n\tif _, err := runSandboxGit(ctx, rt, containerID, \"config\", \"--system\", \"--add\", \"safe.directory\", \"*\"); err != nil {\n\t\treturn fmt.Errorf(\"configure safe.directory: %w\", err)\n\t}\n\n\tif _, err := runSandboxGit(ctx, rt, containerID, \"config\", \"--system\", \"user.name\", name); err != nil {\n\t\treturn fmt.Errorf(\"configure user.name: %w\", err)\n\t}\n\n\tif _, err := runSandboxGit(ctx, rt, containerID, \"config\", \"--system\", \"user.email\", email); err != nil {\n\t\treturn fmt.Errorf(\"configure user.email: %w\", err)\n\t}\n\n\tif _, err := runSandboxGit(ctx, rt, containerID, \"config\", \"--system\", \"http.\"+cloneURL+\".extraHeader\", gitAuthHeader(user, token)); err != nil {\n\t\treturn fmt.Errorf(\"configure git credential: %w\", err)\n\t}\n\n\treturn nil\n}\n\n// cloneAndBranch clones cloneURL into /project inside the container\n// and checks out a fresh branch off defaultBranch. The clone\n// authenticates via the http.<cloneURL>.extraHeader configured by\n// configureSandboxGit, and the origin remote is left with the plain\n// cloneURL: no credential ends up in the working tree.\nfunc cloneAndBranch(ctx context.Context, rt *dockerRuntime, containerID, cloneURL, defaultBranch, branch string) error {\n\tif _, err := runSandboxGit(ctx, rt, containerID, \"clone\", \"--branch\", defaultBranch, \"--single-branch\", cloneURL, \"/project\"); err != nil {\n\t\treturn fmt.Errorf(\"clone: %w\", err)\n\t}\n\n\tif _, err := runSandboxGit(ctx, rt, containerID, \"checkout\", \"-b\", branch); err != nil {\n\t\treturn fmt.Errorf(\"checkout branch %q: %w\", branch, err)\n\t}\n\n\treturn nil\n}\n\n// clonePRHead clones cloneURL into /project inside the container and\n// checks out the pull request's head as a local branch named headRef,\n// so commits the agent makes push straight to the PR. The head is\n// fetched via the PR's refs/pull/<n>/head ref rather than by branch\n// name, which also works for PRs opened from a fork, where the head\n// branch doesn't exist in the base repo.\nfunc clonePRHead(ctx context.Context, rt *dockerRuntime, containerID, cloneURL, defaultBranch, headRef string, index int64) error {\n\tif _, err := runSandboxGit(ctx, rt, containerID, \"clone\", \"--branch\", defaultBranch, \"--single-branch\", cloneURL, \"/project\"); err != nil {\n\t\treturn fmt.Errorf(\"clone: %w\", err)\n\t}\n\n\tfetchRef := fmt.Sprintf(\"refs/pull/%d/head\", index)\n\n\tif _, err := runSandboxGit(ctx, rt, containerID, \"fetch\", \"--no-tags\", \"origin\", fetchRef); err != nil {\n\t\treturn fmt.Errorf(\"fetch PR %d head: %w\", index, err)\n\t}\n\n\tif _, err := runSandboxGit(ctx, rt, containerID, \"checkout\", \"-B\", headRef, \"FETCH_HEAD\"); err != nil {\n\t\treturn fmt.Errorf(\"checkout PR head %q: %w\", headRef, err)\n\t}\n\n\treturn nil\n}\n"}

OK

{"content": "package agentrun\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\n\t\"github.com/abrander/zoo/internal/tools\"\n)\n\n// runContext implements tools.Context for a single agent run, executing\n// both shell commands and git commands via docker exec against the\n// run's container, and binding Forgejo actions to the triggering\n// issue/PR.\ntype runContext struct {\n\tdocker      *dockerRuntime\n\tcontainerID string\n\tforgejo     tools.ForgejoActions\n}\n\nfunc (c *runContext) Exec(ctx context.Context, command string) (string, error) {\n\toutput, exitCode, err := c.docker.exec(ctx, c.containerID, command)\n\n\tif err != nil {\n\t\treturn output, err\n\t}\n\n\tif exitCode != 0 {\n\t\treturn output, fmt.Errorf(\"command exited with status %d\", exitCode)\n\t}\n\n\treturn output, nil\n}\n\n// Git implements tools.Context.Git by running git inside the run's\n// container, in its /project working directory. Remote operations\n// (fetch, pull, push, ...) authenticate via the http.<url>.extraHeader\n// credential configureSandboxGit wrote to the container's system\n// gitconfig, so no per-invocation credential plumbing is needed.\nfunc (c *runContext) Git(ctx context.Context, subcommand string, args ...string) (string, error) {\n\tcmdArgs := append([]string{subcommand}, args...)\n\n\treturn c.Exec(ctx, shellGitCmd(cmdArgs...))\n}\n\nfunc (c *runContext) Forgejo() tools.ForgejoActions {\n\treturn c.forgejo\n}\n", "path": "internal/agentrun/context.go"}

OK

{"end_line": 250, "path": "internal/agentrun/run.go", "start_line": 100}

{"path":"internal/agentrun/run.go","content":"// Run implements scheduler.Runner.\r\nfunc (r *Runner) Run(ctx context.Context, jobID string, agent config.AgentConfig, llmCfg config.LLM, dockerImage string, ev forgejo.Event) error {\r\n\tctx, cancel := context.WithTimeout(ctx, r.timeout)\r\n\tdefer cancel()\r\n\r\n\tlogger := r.logger.With(\"job\", jobID, \"agent\", agent.Name)\r\n\r\n\trepoInfo, err := r.forgejo.RepositoryInfo(ev.Owner, ev.Repo)\r\n\tif err != nil {\r\n\t\treturn fmt.Errorf(\"look up repository: %w\", err)\r\n\t}\r\n\r\n\tworkDir, err := os.MkdirTemp(\"\", \"zoo-run-*\")\r\n\tif err != nil {\r\n\t\treturn fmt.Errorf(\"create work dir: %w\", err)\r\n\t}\r\n\r\n\tsucceeded := false\r\n\r\n\tdefer func() {\r\n\t\tif succeeded || !r.keepOnFailure {\r\n\t\t\tos.RemoveAll(workDir)\r\n\t\t} else {\r\n\t\t\tlogger.Warn(\"keeping work dir after failure\", \"dir\", workDir)\r\n\t\t}\r\n\t}()\r\n\r\n\tprojectDir := filepath.Join(workDir, \"project\")\r\n\r\n\t// A pr:review run works on the PR's own head branch, so the agent's\r\n\t// commits push straight to the PR. Every other event kind branches\r\n\t// off the default branch as usual.\r\n\tvar review *forgejo.ReviewDetail\r\n\tbranch := fmt.Sprintf(\"issue-%d-%s\", ev.Index, agent.Name)\r\n\r\n\tif ev.Kind == forgejo.EventPRReview {\r\n\t\t// Always fetch the current head ref, not just when the event\r\n\t\t// lacks one (the polling path doesn't carry it): the webhook's\r\n\t\t// copy could be stale if the PR's head branch was renamed since\r\n\t\t// the review, and the push target depends on it.\r\n\t\theadRef := ev.HeadRef\r\n\r\n\t\tif prInfo, err := r.forgejo.PullRequestInfo(ev.Owner, ev.Repo, ev.Index); err != nil {\r\n\t\t\tlogger.Warn(\"fetch pull request head failed; falling back to the event's head ref\", \"error\", err)\r\n\t\t} else if prInfo.HeadRef != \"\" {\r\n\t\t\theadRef = prInfo.HeadRef\r\n\t\t}\r\n\r\n\t\tif headRef == \"\" {\r\n\t\t\treturn fmt.Errorf(\"pr:review event has no pull request head branch to check out\")\r\n\t\t}\r\n\r\n\t\tif err := clonePRHead(ctx, repoInfo.CloneURL, r.forgejo.Token(), repoInfo.DefaultBranch, headRef, ev.Index, projectDir); err != nil {\r\n\t\t\treturn fmt.Errorf(\"prepare git working tree: %w\", err)\r\n\t\t}\r\n\r\n\t\tbranch = headRef\r\n\r\n\t\t// Fetch the full review (verdict, body, inline comments) so the\r\n\t\t// agent sees all the feedback, not just the triggering event. A\r\n\t\t// failure degrades to no review detail rather than failing the\r\n\t\t// run: the agent can still do its job, just without the inline\r\n\t\t// comments.\r\n\t\treview, err = r.forgejo.ReviewDetail(ev.Owner, ev.Repo, ev.Index, ev.ReviewID)\r\n\t\tif err != nil {\r\n\t\t\tlogger.Warn(\"fetch review detail failed; agent will not see inline review comments\", \"error\", err)\r\n\t\t\treview = nil\r\n\t\t}\r\n\t} else {\r\n\t\tif err := cloneAndBranch(ctx, repoInfo.CloneURL, r.forgejo.Token(), repoInfo.DefaultBranch, branch, projectDir); err != nil {\r\n\t\t\treturn fmt.Errorf(\"prepare git working tree: %w\", err)\r\n\t\t}\r\n\t}\r\n\r\n\troster := buildRoster(r.forgejo, r.cfg.Agents, logger)\r\n\tgitName, gitEmail := gitIdentity(agent.Name, roster)\r\n\r\n\t// Local (not --global) scope, so this identity lives in\r\n\t// projectDir/.git/config: the one place both this host-side clone\r\n\t// and the container it's bind-mounted into (as /project) actually\r\n\t// share.\r\n\tif out, err := runGit(ctx, projectDir, \"config\", \"user.name\", gitName); err != nil {\r\n\t\treturn fmt.Errorf(\"configure git user.name: %w: %s\", err, out)\r\n\t}\r\n\tif out, err := runGit(ctx, projectDir, \"config\", \"user.email\", gitEmail); err != nil {\r\n\t\treturn fmt.Errorf(\"configure git user.email: %w: %s\", err, out)\r\n\t}\r\n\r\n\teventPath := filepath.Join(workDir, \"event.json\")\r\n\tif err := os.WriteFile(eventPath, ev.Raw, 0o644); err != nil {\r\n\t\treturn fmt.Errorf(\"write event file: %w\", err)\r\n\t}\r\n\r\n\tcontainerID, err := r.docker.createContainer(ctx, dockerImage, []string{\r\n\t\tprojectDir + \":/project\",\r\n\t\teventPath + \":/event:ro\",\r\n\t}, fmt.Sprintf(\"zoo-issue-%d-%s\", ev.Index, agent.Name))\r\n\tif err != nil {\r\n\t\treturn fmt.Errorf(\"start container: %w\", err)\r\n\t}\r\n\r\n\tdefer func() {\r\n\t\tcleanupCtx, cleanupCancel := context.WithTimeout(context.Background(), 30*time.Second)\r\n\t\tdefer cleanupCancel()\r\n\t\tif err := r.docker.remove(cleanupCtx, containerID); err != nil {\r\n\t\t\tlogger.Warn(\"failed to remove container\", \"container\", containerID, \"error\", err)\r\n\t\t}\r\n\t}()\r\n\r\n\t// /project is bind-mounted from the host, so it's owned by the host\r\n\t// UID that ran the clone, not whatever UID runs inside the\r\n\t// container (usually root) — git's ownership check rejects that by\r\n\t// default (\"detected dubious ownership\") unless told otherwise.\r\n\t// --system (not --global) so this holds regardless of which user\r\n\t// subsequent `docker exec` calls run as. Commit identity is\r\n\t// configured host-side, above, with --local scope so it's visible\r\n\t// from both sides of the bind mount without needing --global here.\r\n\tout, exitCode, err := r.docker.exec(ctx, containerID, \"git config --system --add safe.directory '*'\")\r\n\tif err != nil {\r\n\t\treturn fmt.Errorf(\"configure git safe.directory in container: %w: %s\", err, out)\r\n\t}\r\n\tif exitCode != 0 {\r\n\t\treturn fmt.Errorf(\"configure git safe.directory in container: exit %d: %s\", exitCode, out)\r\n\t}\r\n\r\n\tlogAppend := func(stream, line string) {\r\n\t\tif err := r.store.AppendLog(context.Background(), jobID, stream, line); err != nil {\r\n\t\t\tlogger.Warn(\"failed to append log\", \"error\", err)\r\n\t\t}\r\n\t}\r\n\r\n\trunCtx := \u0026runContext{\r\n\t\tdocker:      r.docker,\r\n\t\tcontainerID: containerID,\r\n\t\tprojectDir:  projectDir,\r\n\t\ttoken:       r.forgejo.Token(),\r\n\t\tforgejo: \u0026runForgejoActions{\r\n\t\t\tclient: r.forgejoAs(agent.Name, agent.Token),\r\n\t\t\towner:  ev.Owner,\r\n\t\t\trepo:   ev.Repo,\r\n\t\t\tindex:  ev.Index,\r\n\t\t\tlogger: logger,\r\n\t\t},\r\n\t}\r\n\r\n\tllmClient := llm.NewClient(llmCfg)\r\n\r\n\tsystemPrompt := defaultSystemPrompt + identitySection(agent.Name, roster)\r\n\r\n\tinstructions := r.cfg.EventInstructions(ev.Kind)\r\n\r","start_line":100,"end_line":250,"total_lines":435,"truncated":true}

{"path": "internal/agentrun/run.go", "find": "\tprojectDir := filepath.Join(workDir, \"project\")\n\n\t// A pr:review run works on the PR's own head branch, so the agent's\n\t// commits push straight to the PR. Every other event kind branches\n\t// off the default branch as usual.\n\tvar review *forgejo.ReviewDetail\n\tbranch := fmt.Sprintf(\"issue-%d-%s\", ev.Index, agent.Name)\n\n\tif ev.Kind == forgejo.EventPRReview {\n\t\t// Always fetch the current head ref, not just when the event\n\t\t// lacks one (the polling path doesn't carry it): the webhook's\n\t\t// copy could be stale if the PR's head branch was renamed since\n\t\t// the review, and the push target depends on it.\n\t\theadRef := ev.HeadRef\n\n\t\tif prInfo, err := r.forgejo.PullRequestInfo(ev.Owner, ev.Repo, ev.Index); err != nil {\n\t\t\tlogger.Warn(\"fetch pull request head failed; falling back to the event's head ref\", \"error\", err)\n\t\t} else if prInfo.HeadRef != \"\" {\n\t\t\theadRef = prInfo.HeadRef\n\t\t}\n\n\t\tif headRef == \"\" {\n\t\t\treturn fmt.Errorf(\"pr:review event has no pull request head branch to check out\")\n\t\t}\n\n\t\tif err := clonePRHead(ctx, repoInfo.CloneURL, r.forgejo.Token(), repoInfo.DefaultBranch, headRef, ev.Index, projectDir); err != nil {\n\t\t\treturn fmt.Errorf(\"prepare git working tree: %w\", err)\n\t\t}\n\n\t\tbranch = headRef\n\n\t\t// Fetch the full review (verdict, body, inline comments) so the\n\t\t// agent sees all the feedback, not just the triggering event. A\n\t\t// failure degrades to no review detail rather than failing the\n\t\t// run: the agent can still do its job, just without the inline\n\t\t// comments.\n\t\treview, err = r.forgejo.ReviewDetail(ev.Owner, ev.Repo, ev.Index, ev.ReviewID)\n\t\tif err != nil {\n\t\t\tlogger.Warn(\"fetch review detail failed; agent will not see inline review comments\", \"error\", err)\n\t\t\treview = nil\n\t\t}\n\t} else {\n\t\tif err := cloneAndBranch(ctx, repoInfo.CloneURL, r.forgejo.Token(), repoInfo.DefaultBranch, branch, projectDir); err != nil {\n\t\t\treturn fmt.Errorf(\"prepare git working tree: %w\", err)\n\t\t}\n\t}\n\n\troster := buildRoster(r.forgejo, r.cfg.Agents, logger)\n\tgitName, gitEmail := gitIdentity(agent.Name, roster)\n\n\t// Local (not --global) scope, so this identity lives in\n\t// projectDir/.git/config: the one place both this host-side clone\n\t// and the container it's bind-mounted into (as /project) actually\n\t// share.\n\tif out, err := runGit(ctx, projectDir, \"config\", \"user.name\", gitName); err != nil {\n\t\treturn fmt.Errorf(\"configure git user.name: %w: %s\", err, out)\n\t}\n\tif out, err := runGit(ctx, projectDir, \"config\", \"user.email\", gitEmail); err != nil {\n\t\treturn fmt.Errorf(\"configure git user.email: %w: %s\", err, out)\n\t}\n\n\teventPath := filepath.Join(workDir, \"event.json\")\n\tif err := os.WriteFile(eventPath, ev.Raw, 0o644); err != nil {\n\t\treturn fmt.Errorf(\"write event file: %w\", err)\n\t}\n\n\tcontainerID, err := r.docker.createContainer(ctx, dockerImage, []string{\n\t\tprojectDir + \":/project\",\n\t\teventPath + \":/event:ro\",\n\t}, fmt.Sprintf(\"zoo-issue-%d-%s\", ev.Index, agent.Name))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"start container: %w\", err)\n\t}\n\n\tdefer func() {\n\t\tcleanupCtx, cleanupCancel := context.WithTimeout(context.Background(), 30*time.Second)\n\t\tdefer cleanupCancel()\n\t\tif err := r.docker.remove(cleanupCtx, containerID); err != nil {\n\t\t\tlogger.Warn(\"failed to remove container\", \"container\", containerID, \"error\", err)\n\t\t}\n\t}()\n\n\t// /project is bind-mounted from the host, so it's owned by the host\n\t// UID that ran the clone, not whatever UID runs inside the\n\t// container (usually root) — git's ownership check rejects that by\n\t// default (\"detected dubious ownership\") unless told otherwise.\n\t// --system (not --global) so this holds regardless of which user\n\t// subsequent `docker exec` calls run as. Commit identity is\n\t// configured host-side, above, with --local scope so it's visible\n\t// from both sides of the bind mount without needing --global here.\n\tout, exitCode, err := r.docker.exec(ctx, containerID, \"git config --system --add safe.directory '*'\")\n\tif err != nil {\n\t\treturn fmt.Errorf(\"configure git safe.directory in container: %w: %s\", err, out)\n\t}\n\tif exitCode != 0 {\n\t\treturn fmt.Errorf(\"configure git safe.directory in container: exit %d: %s\", exitCode, out)\n\t}", "replace": "\t// The container bind-mounts projectDir as /project and does the\n\t// initial clone into it, so the (empty) directory must exist on the\n\t// host before the container is created — otherwise Docker would\n\t// create it itself, root-owned.\n\tprojectDir := filepath.Join(workDir, \"project\")\n\n\tif err := os.MkdirAll(projectDir, 0o755); err != nil {\n\t\treturn fmt.Errorf(\"create project dir: %w\", err)\n\t}\n\n\t// A pr:review run works on the PR's own head branch, so the agent's\n\t// commits push straight to the PR. Every other event kind branches\n\t// off the default branch as usual.\n\tvar review *forgejo.ReviewDetail\n\tbranch := fmt.Sprintf(\"issue-%d-%s\", ev.Index, agent.Name)\n\n\tif ev.Kind == forgejo.EventPRReview {\n\t\t// Always fetch the current head ref, not just when the event\n\t\t// lacks one (the polling path doesn't carry it): the webhook's\n\t\t// copy could be stale if the PR's head branch was renamed since\n\t\t// the review, and the push target depends on it.\n\t\theadRef := ev.HeadRef\n\n\t\tif prInfo, err := r.forgejo.PullRequestInfo(ev.Owner, ev.Repo, ev.Index); err != nil {\n\t\t\tlogger.Warn(\"fetch pull request head failed; falling back to the event's head ref\", \"error\", err)\n\t\t} else if prInfo.HeadRef != \"\" {\n\t\t\theadRef = prInfo.HeadRef\n\t\t}\n\n\t\tif headRef == \"\" {\n\t\t\treturn fmt.Errorf(\"pr:review event has no pull request head branch to check out\")\n\t\t}\n\n\t\tbranch = headRef\n\n\t\t// Fetch the full review (verdict, body, inline comments) so the\n\t\t// agent sees all the feedback, not just the triggering event. A\n\t\t// failure degrades to no review detail rather than failing the\n\t\t// run: the agent can still do its job, just without the inline\n\t\t// comments.\n\t\treview, err = r.forgejo.ReviewDetail(ev.Owner, ev.Repo, ev.Index, ev.ReviewID)\n\t\tif err != nil {\n\t\t\tlogger.Warn(\"fetch review detail failed; agent will not see inline review comments\", \"error\", err)\n\t\t\treview = nil\n\t\t}\n\t}\n\n\troster := buildRoster(r.forgejo, r.cfg.Agents, logger)\n\tgitName, gitEmail := gitIdentity(agent.Name, roster)\n\n\t// The credential the sandbox's git uses for remote operations: the\n\t// agent's own Forgejo token when configured, so its git activity is\n\t// attributed to its own account, falling back to the shared zoo\n\t// identity for deployments without per-agent tokens (mirroring\n\t// forgejoAs).\n\tgitUser, gitToken := \"zoo\", r.forgejo.Token()\n\n\tif agent.Token != \"\" {\n\t\tgitUser, gitToken = agent.Name, agent.Token\n\t}\n\n\teventPath := filepath.Join(workDir, \"event.json\")\n\tif err := os.WriteFile(eventPath, ev.Raw, 0o644); err != nil {\n\t\treturn fmt.Errorf(\"write event file: %w\", err)\n\t}\n\n\tcontainerID, err := r.docker.createContainer(ctx, dockerImage, []string{\n\t\tprojectDir + \":/project\",\n\t\teventPath + \":/event:ro\",\n\t}, fmt.Sprintf(\"zoo-issue-%d-%s\", ev.Index, agent.Name))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"start container: %w\", err)\n\t}\n\n\tdefer func() {\n\t\tcleanupCtx, cleanupCancel := context.WithTimeout(context.Background(), 30*time.Second)\n\t\tdefer cleanupCancel()\n\t\tif err := r.docker.remove(cleanupCtx, containerID); err != nil {\n\t\t\tlogger.Warn(\"failed to remove container\", \"container\", containerID, \"error\", err)\n\t\t}\n\t}()\n\n\t// Git must simply work inside the sandbox: safe.directory, commit\n\t// identity, and the remote credential all go into the container's\n\t// system gitconfig (see configureSandboxGit).\n\tif err := configureSandboxGit(ctx, r.docker, containerID, repoInfo.CloneURL, gitUser, gitToken, gitName, gitEmail); err != nil {\n\t\treturn fmt.Errorf(\"configure git in container: %w\", err)\n\t}\n\n\t// The initial clone happens inside the sandbox, so the working tree\n\t// is owned by the container's user and git never runs on the host.\n\tif ev.Kind == forgejo.EventPRReview {\n\t\tif err := clonePRHead(ctx, r.docker, containerID, repoInfo.CloneURL, repoInfo.DefaultBranch, branch, ev.Index); err != nil {\n\t\t\treturn fmt.Errorf(\"prepare git working tree: %w\", err)\n\t\t}\n\t} else {\n\t\tif err := cloneAndBranch(ctx, r.docker, containerID, repoInfo.CloneURL, repoInfo.DefaultBranch, branch); err != nil {\n\t\t\treturn fmt.Errorf(\"prepare git working tree: %w\", err)\n\t\t}\n\t}"}

1 occurrences replaced

{"path": "internal/agentrun/run.go", "find": "// Package agentrun creates the throwaway per-job environment an agent\n// runs in: a git clone + branch bind-mounted into a Docker container,\n// the triggering event written to /event, and the tool-calling loop\n// (internal/llm + internal/tools) driven against it.", "replace": "// Package agentrun creates the throwaway per-job environment an agent\n// runs in: a Docker container with the agent's git working tree cloned\n// inside it (authenticated with the agent's own Forgejo token), the\n// triggering event written to /event, and the tool-calling loop\n// (internal/llm + internal/tools) driven against it."}

1 occurrences replaced

{"context_after": 10, "query": "runCtx := &runContext"}

/project/internal/agentrun/run.go:235:	runCtx := &runContext{
/project/internal/agentrun/run.go-236-		docker:      r.docker,
/project/internal/agentrun/run.go-237-		containerID: containerID,
/project/internal/agentrun/run.go-238-		projectDir:  projectDir,
/project/internal/agentrun/run.go-239-		token:       r.forgejo.Token(),
/project/internal/agentrun/run.go-240-		forgejo: &runForgejoActions{
/project/internal/agentrun/run.go-241-			client: r.forgejoAs(agent.Name, agent.Token),
/project/internal/agentrun/run.go-242-			owner:  ev.Owner,
/project/internal/agentrun/run.go-243-			repo:   ev.Repo,
/project/internal/agentrun/run.go-244-			index:  ev.Index,
/project/internal/agentrun/run.go-245-			logger: logger,

{"path": "internal/agentrun/run.go", "find": "\trunCtx := &runContext{\n\t\tdocker:      r.docker,\n\t\tcontainerID: containerID,\n\t\tprojectDir:  projectDir,\n\t\ttoken:       r.forgejo.Token(),\n\t\tforgejo: &runForgejoActions{", "replace": "\trunCtx := &runContext{\n\t\tdocker:      r.docker,\n\t\tcontainerID: containerID,\n\t\tforgejo: &runForgejoActions{"}

1 occurrences replaced

{"path": "internal/tools/context.go", "find": "// Context is bound to a single agent run (job), unlike ../a's single\n// global Context, since multiple agents run concurrently in zoo.\ntype Context interface {\n\t// Exec runs command inside the run's container via `sh -c` and\n\t// returns combined stdout+stderr. The container never holds a\n\t// Forgejo credential, so this cannot reach the Forgejo API or\n\t// authenticate git operations against it — see Git.\n\tExec(ctx context.Context, command string) (string, error)\n\n\t// Git runs a git subcommand against the run's working tree on the\n\t// host, outside the container, so that operations needing a Forgejo\n\t// credential (currently just push) can authenticate without that\n\t// credential ever being written to disk where the container (and\n\t// anything run inside it via Exec) could read it.\n\tGit(ctx context.Context, subcommand string, args ...string) (string, error)", "replace": "// Context is bound to a single agent run (job), unlike ../a's single\n// global Context, since multiple agents run concurrently in zoo.\ntype Context interface {\n\t// Exec runs command inside the run's container via `sh -c` and\n\t// returns combined stdout+stderr.\n\tExec(ctx context.Context, command string) (string, error)\n\n\t// Git runs a git subcommand against the run's working tree inside\n\t// the run's container. Remote operations (fetch, pull, push, ...)\n\t// authenticate via the Forgejo credential the run's setup wrote to\n\t// the container's system gitconfig, so they work without any\n\t// per-invocation plumbing.\n\tGit(ctx context.Context, subcommand string, args ...string) (string, error)"}

1 occurrences replaced

{"path": "internal/tools/git.go", "find": "// git runs subcommand via Context.Git, which executes it outside the\n// container (see that method's doc comment for why): the container\n// itself is never given a credential capable of authenticating against\n// Forgejo, so pushing has to happen on the host side instead.", "replace": "// git runs subcommand via Context.Git, which executes it inside the\n// run's container, where the run's Forgejo credential is configured\n// for git (see that method's doc comment) — remote operations like\n// push simply work."}

1 occurrences replaced

{"path": "internal/agentrun/system.md", "find": "**Git**\n\nYou may use normal git commands to manage your working tree. For remote\n(pull, fetch, push, etc.) git operations, you can use the `git` tool.", "replace": "**Git**\n\nYou may use normal git commands to manage your working tree. Remote\n(pull, fetch, push, etc.) git operations are authenticated for you and\nsimply work — through the `git` tool or plain `git` in `bash`."}

1 occurrences replaced

{"command": "cd /project && go build ./... && go vet ./... 2>&1 | head -20", "timeout": 180}

go: downloading github.com/docker/docker v28.5.2+incompatible
go: downloading github.com/hashicorp/hcl/v2 v2.24.0
go: downloading codeberg.org/mvdkleijn/forgejo-sdk/forgejo/v2 v2.2.0
go: downloading github.com/google/uuid v1.6.0
go: downloading modernc.org/sqlite v1.56.0
go: downloading github.com/docker/go-connections v0.8.1
go: downloading github.com/docker/go-units v0.5.0
go: downloading github.com/moby/docker-image-spec v1.3.1
go: downloading github.com/opencontainers/image-spec v1.1.1
go: downloading github.com/containerd/errdefs v1.0.0
go: downloading github.com/containerd/errdefs/pkg v0.3.0
go: downloading github.com/distribution/reference v0.6.0
go: downloading github.com/opencontainers/go-digest v1.0.0
go: downloading github.com/pkg/errors v0.9.1
go: downloading go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0
go: downloading go.opentelemetry.io/otel/trace v1.45.0
go: downloading go.opentelemetry.io/otel v1.45.0
go: downloading github.com/42wim/httpsig v1.2.3
go: downloading github.com/go-fed/httpsig v1.1.0
go: downloading github.com/hashicorp/go-version v1.7.0
go: downloading golang.org/x/crypto v0.39.0
go: downloading github.com/felixge/httpsnoop v1.1.0
go: downloading go.opentelemetry.io/otel/metric v1.45.0
go: downloading github.com/agext/levenshtein v1.2.1
go: downloading github.com/apparentlymart/go-textseg/v15 v15.0.0
go: downloading github.com/mitchellh/go-wordwrap v1.0.1
go: downloading github.com/zclconf/go-cty v1.16.3
go: downloading github.com/go-logr/logr v1.4.4
go: downloading golang.org/x/sys v0.47.0
go: downloading github.com/google/go-cmp v0.7.0
go: downloading github.com/go-logr/stdr v1.2.2
go: downloading go.opentelemetry.io/auto/sdk v1.2.1
go: downloading github.com/cespare/xxhash/v2 v2.3.0
go: downloading golang.org/x/text v0.40.0
go: downloading modernc.org/libc v1.74.4
go: downloading github.com/dustin/go-humanize v1.0.1
go: downloading modernc.org/mathutil v1.7.1
go: downloading modernc.org/memory v1.11.0
go: downloading github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec

{"command": "cd /project && go build ./... && echo BUILD-OK && go vet ./... && echo VET-OK", "timeout": 300}

BUILD-OK
VET-OK

{"content": "package agentrun\n\nimport (\n\t\"encoding/base64\"\n\t\"strings\"\n\t\"testing\"\n)\n\nfunc TestSandboxShellQuote(t *testing.T) {\n\tcases := map[string]string{\n\t\t\"simple\":          \"'simple'\",\n\t\t\"it's a branch\":   `'it'\\''s a branch'`,\n\t\t\"with space\":      \"'with space'\",\n\t\t\"$(rm -rf /)\":     \"'$(rm -rf /)'\",\n\t\t\"a\\\"b\\\\c\":         \"'a\\\"b\\\\c'\",\n\t\t\"\":                \"''\",\n\t\t\"HEAD~1\":          \"'HEAD~1'\",\n\t\t\"https://h/a/b.git\": \"'https://h/a/b.git'\",\n\t}\n\n\tfor in, want := range cases {\n\t\tif got := shellQuote(in); got != want {\n\t\t\tt.Errorf(\"shellQuote(%q) = %q, want %q\", in, got, want)\n\t\t}\n\t}\n}\n\nfunc TestShellGitCmdQuotesEveryArg(t *testing.T) {\n\tgot := shellGitCmd(\"clone\", \"--branch\", \"main\", \"--single-branch\", \"https://h/a/b.git\", \"/project\")\n\n\twant := \"git 'clone' '--branch' 'main' '--single-branch' 'https://h/a/b.git' '/project'\"\n\n\tif got != want {\n\t\tt.Fatalf(\"shellGitCmd = %q, want %q\", got, want)\n\t}\n}\n\nfunc TestShellGitCmdSubcommandWithArgs(t *testing.T) {\n\tgot := shellGitCmd(\"commit\", \"-m\", \"fix: handle it's edge case\")\n\n\tif !strings.HasPrefix(got, \"git 'commit' '-m' \") {\n\t\tt.Fatalf(\"shellGitCmd = %q, want prefix git 'commit' '-m' \", got)\n\t}\n\n\t// The message must be one quoted word with the embedded quote\n\t// escaped, so sh passes it through verbatim.\n\tif want := `'fix: handle it'\\''s edge case'`; !strings.HasSuffix(got, want) {\n\t\tt.Fatalf(\"shellGitCmd = %q, want suffix %q\", got, want)\n\t}\n}\n\nfunc TestGitAuthHeader(t *testing.T) {\n\tgot := gitAuthHeader(\"greg\", \"s3cr3t\")\n\n\twant := \"Authorization: Basic \" + base64.StdEncoding.EncodeToString([]byte(\"greg:s3cr3t\"))\n\n\tif got != want {\n\t\tt.Fatalf(\"gitAuthHeader = %q, want %q\", got, want)\n\t}\n}\n", "path": "internal/agentrun/sandboxgit_test.go"}

OK

{"path": "internal/agentrun/docker_integration_test.go", "find": "import (\n\t\"context\"\n\t\"os/exec\"\n\t\"strings\"\n\t\"testing\"\n\t\"time\"\n)", "replace": "import (\n\t\"context\"\n\t\"os\"\n\t\"os/exec\"\n\t\"path/filepath\"\n\t\"strings\"\n\t\"testing\"\n\t\"time\"\n)"}

1 occurrences replaced

{"end_line": 104, "path": "internal/agentrun/docker_integration_test.go", "start_line": 90}

{"path":"internal/agentrun/docker_integration_test.go","content":"\t}\r\n\r\n\toutput, exitCode, err := rt.exec(ctx, containerID, \"git config --system --add safe.directory '*'\")\r\n\tif err != nil || exitCode != 0 {\r\n\t\tt.Fatalf(\"configure safe.directory: err=%v exit=%d: %s\", err, exitCode, output)\r\n\t}\r\n\r\n\toutput, exitCode, err = rt.exec(ctx, containerID, \"git status\")\r\n\tif err != nil {\r\n\t\tt.Fatalf(\"exec: %v\", err)\r\n\t}\r\n\tif exitCode != 0 || strings.Contains(output, \"dubious ownership\") {\r\n\t\tt.Fatalf(\"expected git status to succeed after the fix, got exit=%d: %s\", exitCode, output)\r\n\t}\r\n}\r","start_line":90,"end_line":104,"total_lines":104,"truncated":false}

{"path": "internal/agentrun/docker_integration_test.go", "find": "\toutput, exitCode, err = rt.exec(ctx, containerID, \"git status\")\n\tif err != nil {\n\t\tt.Fatalf(\"exec: %v\", err)\n\t}\n\tif exitCode != 0 || strings.Contains(output, \"dubious ownership\") {\n\t\tt.Fatalf(\"expected git status to succeed after the fix, got exit=%d: %s\", exitCode, output)\n\t}\n}", "replace": "\toutput, exitCode, err = rt.exec(ctx, containerID, \"git status\")\n\tif err != nil {\n\t\tt.Fatalf(\"exec: %v\", err)\n\t}\n\tif exitCode != 0 || strings.Contains(output, \"dubious ownership\") {\n\t\tt.Fatalf(\"expected git status to succeed after the fix, got exit=%d: %s\", exitCode, output)\n\t}\n}\n\n// TestDockerRuntimeSandboxGit exercises the in-sandbox git setup\n// Run() performs (see sandboxgit.go): the system gitconfig round-trip\n// (including the http.<url>.extraHeader key whose subsection is a URL\n// full of dots and colons), the initial clone + branch done inside the\n// container, the commit identity taken from the system gitconfig, and\n// that the credential never lands in the bind-mounted working tree.\n// The clone uses a local path remote (no http involved), so the test\n// needs no reachable Forgejo; the header mechanism itself is core git\n// behavior.\nfunc TestDockerRuntimeSandboxGit(t *testing.T) {\n\ttmp := t.TempDir()\n\n\t// A bare \"remote\" on the host, plus the empty directory the\n\t// container will clone into (Run() creates it before the container\n\t// exists, for the same reason).\n\tseedDir := filepath.Join(tmp, \"seed\")\n\tbareDir := filepath.Join(tmp, \"remote.git\")\n\tprojectDir := filepath.Join(tmp, \"project\")\n\n\trun := func(dir string, args ...string) {\n\t\tcmd := exec.Command(\"git\", args...)\n\t\tcmd.Dir = dir\n\n\t\tif out, err := cmd.CombinedOutput(); err != nil {\n\t\t\tt.Fatalf(\"git %v: %v: %s\", args, err, out)\n\t\t}\n\t}\n\n\trun(\"\", \"init\", \"-q\", \"-b\", \"main\", seedDir)\n\trun(seedDir, \"config\", \"user.name\", \"zoo-test\")\n\trun(seedDir, \"config\", \"user.email\", \"zoo@test\")\n\n\tif err := os.WriteFile(filepath.Join(seedDir, \"file.txt\"), []byte(\"hello\\n\"), 0o644); err != nil {\n\t\tt.Fatalf(\"write seed file: %v\", err)\n\t}\n\n\trun(seedDir, \"add\", \".\")\n\trun(seedDir, \"commit\", \"-q\", \"-m\", \"init\")\n\trun(\"\", \"clone\", \"-q\", \"--bare\", seedDir, bareDir)\n\n\tif err := os.MkdirAll(projectDir, 0o755); err != nil {\n\t\tt.Fatalf(\"create project dir: %v\", err)\n\t}\n\n\trt, err := newDockerRuntime()\n\tif err != nil {\n\t\tt.Fatalf(\"docker client: %v\", err)\n\t}\n\n\tctx, cancel := context.WithTimeout(context.Background(), 120*time.Second)\n\tdefer cancel()\n\n\tcontainerID, err := rt.createContainer(ctx, \"golang:latest\", []string{\n\t\tbareDir + \":/bare\",\n\t\tprojectDir + \":/project\",\n\t}, \"zoo-test-sandbox-git\")\n\tif err != nil {\n\t\tt.Fatalf(\"create container: %v\", err)\n\t}\n\tdefer rt.remove(context.Background(), containerID)\n\n\tconst (\n\t\tcloneURL = \"https://forgejo.example/acme/widgets.git\"\n\t\tuser     = \"greg\"\n\t\ttoken    = \"super-secret-token\"\n\t)\n\n\tif err := configureSandboxGit(ctx, rt, containerID, cloneURL, user, token, \"Greg Coolio\", \"greg@noreply.localhost\"); err != nil {\n\t\tt.Fatalf(\"configureSandboxGit: %v\", err)\n\t}\n\n\t// The credential must round-trip through the system gitconfig,\n\t// which is what makes plain `git pull`/`git push` authenticate.\n\twantHeader := gitAuthHeader(user, token)\n\n\tout, err := runSandboxGit(ctx, rt, containerID, \"config\", \"--system\", \"--get\", \"http.\"+cloneURL+\".extraHeader\")\n\tif err != nil {\n\t\tt.Fatalf(\"read back credential: %v\", err)\n\t}\n\tif got := strings.TrimSpace(out); got != wantHeader {\n\t\tt.Fatalf(\"credential round-trip = %q, want %q\", got, wantHeader)\n\t}\n\n\tif err := cloneAndBranch(ctx, rt, containerID, \"/bare\", \"main\", \"issue-1-greg\"); err != nil {\n\t\tt.Fatalf(\"cloneAndBranch: %v\", err)\n\t}\n\n\t// The clone happened inside the container: the fresh branch is\n\t// checked out in /project.\n\tout, err = runSandboxGit(ctx, rt, containerID, \"branch\", \"--show-current\")\n\tif err != nil {\n\t\tt.Fatalf(\"branch --show-current: %v\", err)\n\t}\n\tif got := strings.TrimSpace(out); got != \"issue-1-greg\" {\n\t\tt.Fatalf(\"branch = %q, want issue-1-greg\", got)\n\t}\n\n\t// Commits must pick up the identity from the system gitconfig.\n\tif _, exitCode, err := rt.exec(ctx, containerID, \"echo more >> file.txt && git add file.txt && git commit -qm 'from sandbox'\"); err != nil || exitCode != 0 {\n\t\tt.Fatalf(\"commit in sandbox: err=%v exit=%d\", err, exitCode)\n\t}\n\n\tout, err = runSandboxGit(ctx, rt, containerID, \"log\", \"-1\", \"--format=%an %ae\")\n\tif err != nil {\n\t\tt.Fatalf(\"log: %v\", err)\n\t}\n\tif got := strings.TrimSpace(out); got != \"Greg Coolio greg@noreply.localhost\" {\n\t\tt.Fatalf(\"commit author = %q, want %q\", got, \"Greg Coolio greg@noreply.localhost\")\n\t}\n\n\t// The token must not leak into the bind-mounted working tree.\n\tout, _, err = rt.exec(ctx, containerID, \"grep -r super-secret-token /project || true\")\n\tif err != nil {\n\t\tt.Fatalf(\"grep: %v\", err)\n\t}\n\tif strings.Contains(out, \"super-secret-token\") {\n\t\tt.Fatalf(\"token leaked into the working tree: %s\", out)\n\t}\n}"}

1 occurrences replaced

{"command": "cd /project && go test ./... 2>&1 | tail -15 && go vet -tags docker ./internal/agentrun/ && echo VET-DOCKER-OK", "timeout": 300}

?   	github.com/abrander/zoo/cmd/zoo	[no test files]
ok  	github.com/abrander/zoo/internal/agentrun	0.024s
ok  	github.com/abrander/zoo/internal/config	0.024s
ok  	github.com/abrander/zoo/internal/forgejo	0.466s
ok  	github.com/abrander/zoo/internal/livelog	0.052s
ok  	github.com/abrander/zoo/internal/llm	0.003s
ok  	github.com/abrander/zoo/internal/scheduler	2.718s
ok  	github.com/abrander/zoo/internal/store	1.953s
ok  	github.com/abrander/zoo/internal/tools	0.003s
ok  	github.com/abrander/zoo/internal/web	0.795s
VET-DOCKER-OK

{"command": "cd /tmp/sim 2>/dev/null || { mkdir -p /tmp/sim/project && cd /tmp/sim; }\ncd /tmp/sim\nexport GIT_CONFIG_SYSTEM=/tmp/sim/gitconfig\nsh -c \"git 'config' '--system' '--add' 'safe.directory' '*'\" ; echo \"1: $?\"\nsh -c \"git 'config' '--system' 'user.name' 'Greg Coolio'\" ; echo \"2: $?\"\nsh -c \"git 'config' '--system' 'user.email' 'greg@noreply.localhost'\" ; echo \"3: $?\"\nsh -c \"git 'config' '--system' 'http.https://forgejo.example/acme/widgets.git.extraHeader' 'Authorization: Basic c3VwZXItc2VjcmV0LXRva2Vu'\" ; echo \"4: $?\"\nsh -c \"git 'config' '--system' '--get' 'http.https://forgejo.example/acme/widgets.git.extraHeader'\" ; echo \"5: $?\"", "timeout": 60}

1: 0
2: 0
3: 0
4: 0
Authorization: Basic c3VwZXItc2VjcmV0LXRva2Vu
5: 0

{"command": "cd /tmp/sim\ngit init -q -b main seed\ncd seed && git config user.name t && git config user.email t@t && echo hello > f.txt && git add . && git commit -qm init && cd ..\ngit clone -q --bare seed remote.git\nexport GIT_CONFIG_SYSTEM=/tmp/sim/gitconfig\nsh -c \"git 'clone' '--branch' 'main' '--single-branch' '/tmp/sim/remote.git' '/tmp/sim/project'\" ; echo \"clone: $?\"\ncd /tmp/sim/project\nsh -c \"git 'checkout' '-b' 'issue-1-greg'\" ; echo \"checkout: $?\"\nsh -c \"git 'branch' '--show-current'\"\necho more >> f.txt\nsh -c \"git 'add' 'f.txt'\" && sh -c \"git 'commit' '-qm' 'from sandbox'\" ; echo \"commit: $?\"\nsh -c \"git 'log' '-1' '--format=%an %ae'\"\nsh -c \"git 'pull'\" ; echo \"pull: $?\"\necho \"=== gitconfig ===\" && cat /tmp/sim/gitconfig\necho \"=== token in project? ===\" && (grep -r super-secret-token /tmp/sim/project || echo \"no leak\")", "timeout": 60}

warning: re-init: ignored --initial-branch=main
On branch main
nothing to commit, working tree clean
fatal: repository 'seed' does not exist
fatal: destination path '/tmp/sim/project' already exists and is not an empty directory.
clone: 128
Switched to a new branch 'issue-1-greg'
checkout: 0
issue-1-greg
commit: 0
Greg Coolio greg@noreply.localhost
Already up to date.
pull: 0
=== gitconfig ===
[safe]
	directory = *
	directory = *
[user]
	name = Greg Coolio
	email = greg@noreply.localhost
[http "https://forgejo.example/acme/widgets.git"]
	extraHeader = Authorization: Basic c3VwZXItc2VjcmV0LXRva2Vu
=== token in project? ===
no leak

{"command": "set -e\nrm -rf /tmp/sim2 && mkdir -p /tmp/sim2/project && cd /tmp/sim2\ngit init -q -b main seed\n(cd seed && git config user.name t && git config user.email t@t && echo hello > f.txt && git add . && git commit -qm init)\ngit clone -q --bare seed remote.git\nexport GIT_CONFIG_SYSTEM=/tmp/sim2/gitconfig\n# simulate docker exec: every command via sh -c, cwd = /project (container WorkingDir)\nsh -c \"git 'config' '--system' '--add' 'safe.directory' '*'\"\nsh -c \"git 'config' '--system' 'user.name' 'Greg Coolio'\"\nsh -c \"git 'config' '--system' 'user.email' 'greg@noreply.localhost'\"\nsh -c \"git 'config' '--system' 'http.https://forgejo.example/acme/widgets.git.extraHeader' 'Authorization: Basic c3VwZXItc2VjcmV0LXRva2Vu'\"\ncd /tmp/sim2/project\nsh -c \"git 'clone' '--branch' 'main' '--single-branch' '/tmp/sim2/remote.git' '/tmp/sim2/project'\"\nsh -c \"git 'checkout' '-b' 'issue-1-greg'\"\necho \"branch: $(sh -c \"git 'branch' '--show-current'\")\"\necho more >> f.txt\nsh -c \"git 'add' 'f.txt'\"\nsh -c \"git 'commit' '-qm' 'from sandbox'\"\necho \"author: $(sh -c \"git 'log' '-1' '--format=%an %ae'\")\"\nsh -c \"git 'pull'\"\necho \"token leak: $(grep -r super-secret-token /tmp/sim2/project || echo none)\"\necho ALL-OK", "timeout": 60}

Cloning into '/tmp/sim2/project'...
done.
Switched to a new branch 'issue-1-greg'
branch: issue-1-greg
author: Greg Coolio greg@noreply.localhost
Already up to date.
token leak: none
ALL-OK

{"end_line": 240, "path": "internal/agentrun/run.go", "start_line": 98}

{"path":"internal/agentrun/run.go","content":"\treturn c\r\n}\r\n\r\n// Run implements scheduler.Runner.\r\nfunc (r *Runner) Run(ctx context.Context, jobID string, agent config.AgentConfig, llmCfg config.LLM, dockerImage string, ev forgejo.Event) error {\r\n\tctx, cancel := context.WithTimeout(ctx, r.timeout)\r\n\tdefer cancel()\r\n\r\n\tlogger := r.logger.With(\"job\", jobID, \"agent\", agent.Name)\r\n\r\n\trepoInfo, err := r.forgejo.RepositoryInfo(ev.Owner, ev.Repo)\r\n\tif err != nil {\r\n\t\treturn fmt.Errorf(\"look up repository: %w\", err)\r\n\t}\r\n\r\n\tworkDir, err := os.MkdirTemp(\"\", \"zoo-run-*\")\r\n\tif err != nil {\r\n\t\treturn fmt.Errorf(\"create work dir: %w\", err)\r\n\t}\r\n\r\n\tsucceeded := false\r\n\r\n\tdefer func() {\r\n\t\tif succeeded || !r.keepOnFailure {\r\n\t\t\tos.RemoveAll(workDir)\r\n\t\t} else {\r\n\t\t\tlogger.Warn(\"keeping work dir after failure\", \"dir\", workDir)\r\n\t\t}\r\n\t}()\r\n\r\n\t// The container bind-mounts projectDir as /project and does the\r\n\t// initial clone into it, so the (empty) directory must exist on the\r\n\t// host before the container is created — otherwise Docker would\r\n\t// create it itself, root-owned.\r\n\tprojectDir := filepath.Join(workDir, \"project\")\r\n\r\n\tif err := os.MkdirAll(projectDir, 0o755); err != nil {\r\n\t\treturn fmt.Errorf(\"create project dir: %w\", err)\r\n\t}\r\n\r\n\t// A pr:review run works on the PR's own head branch, so the agent's\r\n\t// commits push straight to the PR. Every other event kind branches\r\n\t// off the default branch as usual.\r\n\tvar review *forgejo.ReviewDetail\r\n\tbranch := fmt.Sprintf(\"issue-%d-%s\", ev.Index, agent.Name)\r\n\r\n\tif ev.Kind == forgejo.EventPRReview {\r\n\t\t// Always fetch the current head ref, not just when the event\r\n\t\t// lacks one (the polling path doesn't carry it): the webhook's\r\n\t\t// copy could be stale if the PR's head branch was renamed since\r\n\t\t// the review, and the push target depends on it.\r\n\t\theadRef := ev.HeadRef\r\n\r\n\t\tif prInfo, err := r.forgejo.PullRequestInfo(ev.Owner, ev.Repo, ev.Index); err != nil {\r\n\t\t\tlogger.Warn(\"fetch pull request head failed; falling back to the event's head ref\", \"error\", err)\r\n\t\t} else if prInfo.HeadRef != \"\" {\r\n\t\t\theadRef = prInfo.HeadRef\r\n\t\t}\r\n\r\n\t\tif headRef == \"\" {\r\n\t\t\treturn fmt.Errorf(\"pr:review event has no pull request head branch to check out\")\r\n\t\t}\r\n\r\n\t\tbranch = headRef\r\n\r\n\t\t// Fetch the full review (verdict, body, inline comments) so the\r\n\t\t// agent sees all the feedback, not just the triggering event. A\r\n\t\t// failure degrades to no review detail rather than failing the\r\n\t\t// run: the agent can still do its job, just without the inline\r\n\t\t// comments.\r\n\t\treview, err = r.forgejo.ReviewDetail(ev.Owner, ev.Repo, ev.Index, ev.ReviewID)\r\n\t\tif err != nil {\r\n\t\t\tlogger.Warn(\"fetch review detail failed; agent will not see inline review comments\", \"error\", err)\r\n\t\t\treview = nil\r\n\t\t}\r\n\t}\r\n\r\n\troster := buildRoster(r.forgejo, r.cfg.Agents, logger)\r\n\tgitName, gitEmail := gitIdentity(agent.Name, roster)\r\n\r\n\t// The credential the sandbox's git uses for remote operations: the\r\n\t// agent's own Forgejo token when configured, so its git activity is\r\n\t// attributed to its own account, falling back to the shared zoo\r\n\t// identity for deployments without per-agent tokens (mirroring\r\n\t// forgejoAs).\r\n\tgitUser, gitToken := \"zoo\", r.forgejo.Token()\r\n\r\n\tif agent.Token != \"\" {\r\n\t\tgitUser, gitToken = agent.Name, agent.Token\r\n\t}\r\n\r\n\teventPath := filepath.Join(workDir, \"event.json\")\r\n\tif err := os.WriteFile(eventPath, ev.Raw, 0o644); err != nil {\r\n\t\treturn fmt.Errorf(\"write event file: %w\", err)\r\n\t}\r\n\r\n\tcontainerID, err := r.docker.createContainer(ctx, dockerImage, []string{\r\n\t\tprojectDir + \":/project\",\r\n\t\teventPath + \":/event:ro\",\r\n\t}, fmt.Sprintf(\"zoo-issue-%d-%s\", ev.Index, agent.Name))\r\n\tif err != nil {\r\n\t\treturn fmt.Errorf(\"start container: %w\", err)\r\n\t}\r\n\r\n\tdefer func() {\r\n\t\tcleanupCtx, cleanupCancel := context.WithTimeout(context.Background(), 30*time.Second)\r\n\t\tdefer cleanupCancel()\r\n\t\tif err := r.docker.remove(cleanupCtx, containerID); err != nil {\r\n\t\t\tlogger.Warn(\"failed to remove container\", \"container\", containerID, \"error\", err)\r\n\t\t}\r\n\t}()\r\n\r\n\t// Git must simply work inside the sandbox: safe.directory, commit\r\n\t// identity, and the remote credential all go into the container's\r\n\t// system gitconfig (see configureSandboxGit).\r\n\tif err := configureSandboxGit(ctx, r.docker, containerID, repoInfo.CloneURL, gitUser, gitToken, gitName, gitEmail); err != nil {\r\n\t\treturn fmt.Errorf(\"configure git in container: %w\", err)\r\n\t}\r\n\r\n\t// The initial clone happens inside the sandbox, so the working tree\r\n\t// is owned by the container's user and git never runs on the host.\r\n\tif ev.Kind == forgejo.EventPRReview {\r\n\t\tif err := clonePRHead(ctx, r.docker, containerID, repoInfo.CloneURL, repoInfo.DefaultBranch, branch, ev.Index); err != nil {\r\n\t\t\treturn fmt.Errorf(\"prepare git working tree: %w\", err)\r\n\t\t}\r\n\t} else {\r\n\t\tif err := cloneAndBranch(ctx, r.docker, containerID, repoInfo.CloneURL, repoInfo.DefaultBranch, branch); err != nil {\r\n\t\t\treturn fmt.Errorf(\"prepare git working tree: %w\", err)\r\n\t\t}\r\n\t}\r\n\r\n\tlogAppend := func(stream, line string) {\r\n\t\tif err := r.store.AppendLog(context.Background(), jobID, stream, line); err != nil {\r\n\t\t\tlogger.Warn(\"failed to append log\", \"error\", err)\r\n\t\t}\r\n\t}\r\n\r\n\trunCtx := \u0026runContext{\r\n\t\tdocker:      r.docker,\r\n\t\tcontainerID: containerID,\r\n\t\tforgejo: \u0026runForgejoActions{\r\n\t\t\tclient: r.forgejoAs(agent.Name, agent.Token),\r\n\t\t\towner:  ev.Owner,\r","start_line":98,"end_line":240,"total_lines":437,"truncated":true}

{"path": "internal/agentrun/sandboxgit.go", "find": "import (\n\t\"context\"\n\t\"encoding/base64\"\n\t\"fmt\"\n\t\"strings\"\n)", "replace": "import (\n\t\"context\"\n\t\"encoding/base64\"\n\t\"fmt\"\n\t\"net/url\"\n\t\"strings\"\n)"}

1 occurrences replaced

{"path": "internal/agentrun/sandboxgit.go", "find": "// gitAuthHeader returns the value of an Authorization header that\n// authenticates git's smart-HTTP requests as user with token.\nfunc gitAuthHeader(user, token string) string {\n\tauth := base64.StdEncoding.EncodeToString([]byte(user + \":\" + token))\n\n\treturn \"Authorization: Basic \" + auth\n}", "replace": "// gitAuthHeader returns the value of an Authorization header that\n// authenticates git's smart-HTTP requests as user with token.\nfunc gitAuthHeader(user, token string) string {\n\tauth := base64.StdEncoding.EncodeToString([]byte(user + \":\" + token))\n\n\treturn \"Authorization: Basic \" + auth\n}\n\n// forgeHost returns the scheme+host prefix of cloneURL, e.g.\n// \"https://code.stdio.dk\" for \"https://code.stdio.dk/abrander/zoo.git\".\n// On a parse failure it falls back to the full URL, which is a valid\n// (narrower) prefix match too.\nfunc forgeHost(cloneURL string) string {\n\tu, err := url.Parse(cloneURL)\n\tif err != nil || u.Host == \"\" {\n\t\treturn cloneURL\n\t}\n\n\treturn u.Scheme + \"://\" + u.Host\n}"}

1 occurrences replaced

{"path": "internal/agentrun/sandboxgit.go", "find": "//   - http.<cloneURL>.extraHeader carrying the run's Forgejo\n//     credential, scoped to this repository's URL, so clone/fetch/\n//     pull/push all authenticate transparently.", "replace": "//   - http.<host>.extraHeader carrying the run's Forgejo credential,\n//     scoped to the forge host the repository lives on, so\n//     clone/fetch/pull/push all authenticate transparently — including\n//     for submodules and other repos on the same forge. The token is\n//     only valid on that forge anyway, so the host scope grants no\n//     extra access; git never sends it anywhere else."}

1 occurrences replaced

{"path": "internal/agentrun/sandboxgit.go", "find": "\tif _, err := runSandboxGit(ctx, rt, containerID, \"config\", \"--system\", \"http.\"+cloneURL+\".extraHeader\", gitAuthHeader(user, token)); err != nil {\n\t\treturn fmt.Errorf(\"configure git credential: %w\", err)\n\t}", "replace": "\tif _, err := runSandboxGit(ctx, rt, containerID, \"config\", \"--system\", \"http.\"+forgeHost(cloneURL)+\".extraHeader\", gitAuthHeader(user, token)); err != nil {\n\t\treturn fmt.Errorf(\"configure git credential: %w\", err)\n\t}"}

1 occurrences replaced

{"path": "internal/agentrun/sandboxgit.go", "find": "// cloneAndBranch clones cloneURL into /project inside the container\n// and checks out a fresh branch off defaultBranch. The clone\n// authenticates via the http.<cloneURL>.extraHeader configured by\n// configureSandboxGit, and the origin remote is left with the plain\n// cloneURL: no credential ends up in the working tree.", "replace": "// cloneAndBranch clones cloneURL into /project inside the container\n// and checks out a fresh branch off defaultBranch. The clone\n// authenticates via the http.<host>.extraHeader configured by\n// configureSandboxGit, and the origin remote is left with the plain\n// cloneURL: no credential ends up in the working tree."}

1 occurrences replaced

{"path": "internal/agentrun/docker_integration_test.go", "find": "\t// The credential must round-trip through the system gitconfig,\n\t// which is what makes plain `git pull`/`git push` authenticate.\n\twantHeader := gitAuthHeader(user, token)\n\n\tout, err := runSandboxGit(ctx, rt, containerID, \"config\", \"--system\", \"--get\", \"http.\"+cloneURL+\".extraHeader\")", "replace": "\t// The credential must round-trip through the system gitconfig,\n\t// which is what makes plain `git pull`/`git push` authenticate.\n\twantHeader := gitAuthHeader(user, token)\n\n\tout, err := runSandboxGit(ctx, rt, containerID, \"config\", \"--system\", \"--get\", \"http.\"+forgeHost(cloneURL)+\".extraHeader\")"}

1 occurrences replaced

{"path": "internal/agentrun/sandboxgit_test.go", "find": "func TestGitAuthHeader(t *testing.T) {", "replace": "func TestForgeHost(t *testing.T) {\n\tcases := map[string]string{\n\t\t\"https://code.stdio.dk/abrander/zoo.git\": \"https://code.stdio.dk\",\n\t\t\"http://forgejo.local:3000/acme/widgets\":  \"http://forgejo.local:3000\",\n\t\t\"https://h/a/b.git?x=1\":                   \"https://h\",\n\t\t// Not a URL with a host: fall back to the full string, which is\n\t\t// still a valid (narrower) prefix match.\n\t\t\"/bare\":  \"/bare\",\n\t\t\"not a url\": \"not a url\",\n\t}\n\n\tfor in, want := range cases {\n\t\tif got := forgeHost(in); got != want {\n\t\t\tt.Errorf(\"forgeHost(%q) = %q, want %q\", in, got, want)\n\t\t}\n\t}\n}\n\nfunc TestGitAuthHeader(t *testing.T) {"}

1 occurrences replaced

{"command": "cd /project && gofmt -l . && go build ./... && go test ./... 2>&1 | tail -12 && go vet -tags docker ./internal/agentrun/ && echo ALL-OK", "timeout": 300}

internal/agentrun/sandboxgit_test.go
?   	github.com/abrander/zoo/cmd/zoo	[no test files]
ok  	github.com/abrander/zoo/internal/agentrun	0.004s
ok  	github.com/abrander/zoo/internal/config	(cached)
ok  	github.com/abrander/zoo/internal/forgejo	(cached)
ok  	github.com/abrander/zoo/internal/livelog	(cached)
ok  	github.com/abrander/zoo/internal/llm	(cached)
ok  	github.com/abrander/zoo/internal/scheduler	(cached)
ok  	github.com/abrander/zoo/internal/store	(cached)
ok  	github.com/abrander/zoo/internal/tools	(cached)
ok  	github.com/abrander/zoo/internal/web	(cached)
ALL-OK

{"command": "cd /project && gofmt -w internal/agentrun/sandboxgit_test.go && gofmt -l . ; go test ./internal/agentrun/ && echo OK", "timeout": 120}

ok  	github.com/abrander/zoo/internal/agentrun	(cached)
OK

{"command": "cd /tmp/gitauth-test\npython3 server.py & SERVER_PID=$!\nsleep 0.5\nrm -rf hostscoped\n# host-scoped key: http.http://127.0.0.1:8931.extraHeader (no path)\ngit -c 'http.http://127.0.0.1:8931.extraHeader=Authorization: Basic c2VlZDpzM2NyZXQ=' clone -q http://127.0.0.1:8931/bare.git hostscoped && echo HOST-SCOPED-CLONE-OK\ncd hostscoped\ngit config --local 'http.http://127.0.0.1:8931.extraHeader' \"Authorization: Basic c2VlZDpzM2NyZXQ=\"\ngit pull 2>&1 | tail -1\ngit ls-remote origin >/dev/null 2>&1 && echo HOST-SCOPED-LSREMOTE-OK\nkill $SERVER_PID 2>/dev/null", "timeout": 60}

HOST-SCOPED-CLONE-OK
Already up to date.
HOST-SCOPED-LSREMOTE-OK

{"command": "cd /project && git add -A && git diff --cached --stat && echo ================= && git diff --cached"}

 internal/agentrun/clone.go                   |  81 --------------
 internal/agentrun/context.go                 |  25 ++---
 internal/agentrun/docker_integration_test.go | 122 ++++++++++++++++++++++
 internal/agentrun/run.go                     |  70 +++++++------
 internal/agentrun/sandboxgit.go              | 151 +++++++++++++++++++++++++++
 internal/agentrun/sandboxgit_test.go         |  78 ++++++++++++++
 internal/agentrun/system.md                  |   5 +-
 internal/tools/context.go                    |  14 ++-
 internal/tools/git.go                        |   8 +-
 9 files changed, 409 insertions(+), 145 deletions(-)
=================
diff --git a/internal/agentrun/clone.go b/internal/agentrun/clone.go
deleted file mode 100644
index 2ae1adf..0000000
--- a/internal/agentrun/clone.go
+++ /dev/null
@@ -1,81 +0,0 @@
-package agentrun
-
-import (
-	"context"
-	"encoding/base64"
-	"fmt"
-	"os/exec"
-	"strings"
-)
-
-// gitAuthArgs returns the `-c http.extraHeader=...` global git arguments
-// that authenticate a single invocation as the shared zoo Forgejo
-// identity. Unlike embedding the token in the remote URL, a `-c`
-// override lives only for the lifetime of that one process and is never
-// written to .git/config on disk — where the container bind-mounting
-// this working tree (and any command an agent runs inside it via the
-// bash tool) could otherwise read it straight back out.
-func gitAuthArgs(token string) []string {
-	auth := base64.StdEncoding.EncodeToString([]byte("zoo:" + token))
-
-	return []string{"-c", "http.extraHeader=Authorization: Basic " + auth}
-}
-
-// cloneAndBranch clones cloneURL into dir, authenticating the clone
-// itself with token (see gitAuthArgs), and checks out a new branch off
-// of defaultBranch. token never ends up in the resulting working tree:
-// the origin remote is left with the plain cloneURL.
-func cloneAndBranch(ctx context.Context, cloneURL, token, defaultBranch, branch, dir string) error {
-	args := append(gitAuthArgs(token), "clone", "--branch", defaultBranch, "--single-branch", cloneURL, dir)
-	if out, err := runGit(ctx, "", args...); err != nil {
-		return fmt.Errorf("clone: %w: %s", err, out)
-	}
-
-	if out, err := runGit(ctx, dir, "checkout", "-b", branch); err != nil {
-		return fmt.Errorf("checkout branch %q: %w: %s", branch, err, out)
-	}
-
-	return nil
-}
-
-// clonePRHead clones cloneURL into dir and checks out the pull request's
-// head as a local branch named headRef, so commits the agent makes push
-// straight to the PR. The head is fetched via the PR's refs/pull/<n>/head
-// ref rather than by branch name, which also works for PRs opened from a
-// fork, where the head branch doesn't exist in the base repo.
-func clonePRHead(ctx context.Context, cloneURL, token, defaultBranch, headRef string, index int64, dir string) error {
-	args := append(gitAuthArgs(token), "clone", "--branch", defaultBranch, "--single-branch", cloneURL, dir)
-	if out, err := runGit(ctx, "", args...); err != nil {
-		return fmt.Errorf("clone: %w: %s", err, out)
-	}
-
-	fetchArgs := append(gitAuthArgs(token), "fetch", "--no-tags", "origin", fmt.Sprintf("refs/pull/%d/head", index))
-	if out, err := runGit(ctx, dir, fetchArgs...); err != nil {
-		return fmt.Errorf("fetch PR %d head: %w: %s", index, err, out)
-	}
-
-	if out, err := runGit(ctx, dir, "checkout", "-B", headRef, "FETCH_HEAD"); err != nil {
-		return fmt.Errorf("checkout PR head %q: %w: %s", headRef, err, out)
-	}
-
-	return nil
-}
-
-// runGit runs a git subcommand on the host (not inside any container)
-// with no Forgejo credential attached.
-func runGit(ctx context.Context, dir string, args ...string) (string, error) {
-	cmd := exec.CommandContext(ctx, "git", args...)
-	if dir != "" {
-		cmd.Dir = dir
-	}
-
-	out, err := cmd.CombinedOutput()
-
-	return strings.TrimSpace(string(out)), err
-}
-
-// runGitAuthed is runGit with token attached via gitAuthArgs, for the
-// one subcommand (push) that needs to authenticate against Forgejo.
-func runGitAuthed(ctx context.Context, dir, token string, args ...string) (string, error) {
-	return runGit(ctx, dir, append(gitAuthArgs(token), args...)...)
-}
diff --git a/internal/agentrun/context.go b/internal/agentrun/context.go
index 8d886fc..abf82bb 100644
--- a/internal/agentrun/context.go
+++ b/internal/agentrun/context.go
@@ -8,14 +8,12 @@ import (
 )
 
 // runContext implements tools.Context for a single agent run, executing
-// shell commands via docker exec against the run's container, git
-// commands as the host process against the run's working tree (see
-// Git), and binding Forgejo actions to the triggering issue/PR.
+// both shell commands and git commands via docker exec against the
+// run's container, and binding Forgejo actions to the triggering
+// issue/PR.
 type runContext struct {
 	docker      *dockerRuntime
 	containerID string
-	projectDir  string
-	token       string
 	forgejo     tools.ForgejoActions
 }
 
@@ -33,20 +31,15 @@ func (c *runContext) Exec(ctx context.Context, command string) (string, error) {
 	return output, nil
 }
 
-// Git implements tools.Context.Git by running git on the host against
-// c.projectDir rather than via docker exec. Only push needs to
-// authenticate against Forgejo, so only it carries the token, via a
-// per-invocation -c override that never touches .git/config (see
-// gitAuthArgs) — the container this same working tree is bind-mounted
-// into has no way to read it out.
+// Git implements tools.Context.Git by running git inside the run's
+// container, in its /project working directory. Remote operations
+// (fetch, pull, push, ...) authenticate via the http.<url>.extraHeader
+// credential configureSandboxGit wrote to the container's system
+// gitconfig, so no per-invocation credential plumbing is needed.
 func (c *runContext) Git(ctx context.Context, subcommand string, args ...string) (string, error) {
 	cmdArgs := append([]string{subcommand}, args...)
 
-	if subcommand == "push" {
-		return runGitAuthed(ctx, c.projectDir, c.token, cmdArgs...)
-	}
-
-	return runGit(ctx, c.projectDir, cmdArgs...)
+	return c.Exec(ctx, shellGitCmd(cmdArgs...))
 }
 
 func (c *runContext) Forgejo() tools.ForgejoActions {
diff --git a/internal/agentrun/docker_integration_test.go b/internal/agentrun/docker_integration_test.go
index 781528e..99102a8 100644
--- a/internal/agentrun/docker_integration_test.go
+++ b/internal/agentrun/docker_integration_test.go
@@ -6,7 +6,9 @@ package agentrun
 
 import (
 	"context"
+	"os"
 	"os/exec"
+	"path/filepath"
 	"strings"
 	"testing"
 	"time"
@@ -100,3 +102,123 @@ func TestDockerRuntimeGitSafeDirectory(t *testing.T) {
 		t.Fatalf("expected git status to succeed after the fix, got exit=%d: %s", exitCode, output)
 	}
 }
+
+// TestDockerRuntimeSandboxGit exercises the in-sandbox git setup
+// Run() performs (see sandboxgit.go): the system gitconfig round-trip
+// (including the http.<url>.extraHeader key whose subsection is a URL
+// full of dots and colons), the initial clone + branch done inside the
+// container, the commit identity taken from the system gitconfig, and
+// that the credential never lands in the bind-mounted working tree.
+// The clone uses a local path remote (no http involved), so the test
+// needs no reachable Forgejo; the header mechanism itself is core git
+// behavior.
+func TestDockerRuntimeSandboxGit(t *testing.T) {
+	tmp := t.TempDir()
+
+	// A bare "remote" on the host, plus the empty directory the
+	// container will clone into (Run() creates it before the container
+	// exists, for the same reason).
+	seedDir := filepath.Join(tmp, "seed")
+	bareDir := filepath.Join(tmp, "remote.git")
+	projectDir := filepath.Join(tmp, "project")
+
+	run := func(dir string, args ...string) {
+		cmd := exec.Command("git", args...)
+		cmd.Dir = dir
+
+		if out, err := cmd.CombinedOutput(); err != nil {
+			t.Fatalf("git %v: %v: %s", args, err, out)
+		}
+	}
+
+	run("", "init", "-q", "-b", "main", seedDir)
+	run(seedDir, "config", "user.name", "zoo-test")
+	run(seedDir, "config", "user.email", "zoo@test")
+
+	if err := os.WriteFile(filepath.Join(seedDir, "file.txt"), []byte("hello\n"), 0o644); err != nil {
+		t.Fatalf("write seed file: %v", err)
+	}
+
+	run(seedDir, "add", ".")
+	run(seedDir, "commit", "-q", "-m", "init")
+	run("", "clone", "-q", "--bare", seedDir, bareDir)
+
+	if err := os.MkdirAll(projectDir, 0o755); err != nil {
+		t.Fatalf("create project dir: %v", err)
+	}
+
+	rt, err := newDockerRuntime()
+	if err != nil {
+		t.Fatalf("docker client: %v", err)
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 120*time.Second)
+	defer cancel()
+
+	containerID, err := rt.createContainer(ctx, "golang:latest", []string{
+		bareDir + ":/bare",
+		projectDir + ":/project",
+	}, "zoo-test-sandbox-git")
+	if err != nil {
+		t.Fatalf("create container: %v", err)
+	}
+	defer rt.remove(context.Background(), containerID)
+
+	const (
+		cloneURL = "https://forgejo.example/acme/widgets.git"
+		user     = "greg"
+		token    = "super-secret-token"
+	)
+
+	if err := configureSandboxGit(ctx, rt, containerID, cloneURL, user, token, "Greg Coolio", "greg@noreply.localhost"); err != nil {
+		t.Fatalf("configureSandboxGit: %v", err)
+	}
+
+	// The credential must round-trip through the system gitconfig,
+	// which is what makes plain `git pull`/`git push` authenticate.
+	wantHeader := gitAuthHeader(user, token)
+
+	out, err := runSandboxGit(ctx, rt, containerID, "config", "--system", "--get", "http."+forgeHost(cloneURL)+".extraHeader")
+	if err != nil {
+		t.Fatalf("read back credential: %v", err)
+	}
+	if got := strings.TrimSpace(out); got != wantHeader {
+		t.Fatalf("credential round-trip = %q, want %q", got, wantHeader)
+	}
+
+	if err := cloneAndBranch(ctx, rt, containerID, "/bare", "main", "issue-1-greg"); err != nil {
+		t.Fatalf("cloneAndBranch: %v", err)
+	}
+
+	// The clone happened inside the container: the fresh branch is
+	// checked out in /project.
+	out, err = runSandboxGit(ctx, rt, containerID, "branch", "--show-current")
+	if err != nil {
+		t.Fatalf("branch --show-current: %v", err)
+	}
+	if got := strings.TrimSpace(out); got != "issue-1-greg" {
+		t.Fatalf("branch = %q, want issue-1-greg", got)
+	}
+
+	// Commits must pick up the identity from the system gitconfig.
+	if _, exitCode, err := rt.exec(ctx, containerID, "echo more >> file.txt && git add file.txt && git commit -qm 'from sandbox'"); err != nil || exitCode != 0 {
+		t.Fatalf("commit in sandbox: err=%v exit=%d", err, exitCode)
+	}
+
+	out, err = runSandboxGit(ctx, rt, containerID, "log", "-1", "--format=%an %ae")
+	if err != nil {
+		t.Fatalf("log: %v", err)
+	}
+	if got := strings.TrimSpace(out); got != "Greg Coolio greg@noreply.localhost" {
+		t.Fatalf("commit author = %q, want %q", got, "Greg Coolio greg@noreply.localhost")
+	}
+
+	// The token must not leak into the bind-mounted working tree.
+	out, _, err = rt.exec(ctx, containerID, "grep -r super-secret-token /project || true")
+	if err != nil {
+		t.Fatalf("grep: %v", err)
+	}
+	if strings.Contains(out, "super-secret-token") {
+		t.Fatalf("token leaked into the working tree: %s", out)
+	}
+}
diff --git a/internal/agentrun/run.go b/internal/agentrun/run.go
index 1e525b6..7d4dd9f 100644
--- a/internal/agentrun/run.go
+++ b/internal/agentrun/run.go
@@ -1,6 +1,7 @@
 // Package agentrun creates the throwaway per-job environment an agent
-// runs in: a git clone + branch bind-mounted into a Docker container,
-// the triggering event written to /event, and the tool-calling loop
+// runs in: a Docker container with the agent's git working tree cloned
+// inside it (authenticated with the agent's own Forgejo token), the
+// triggering event written to /event, and the tool-calling loop
 // (internal/llm + internal/tools) driven against it.
 package agentrun
 
@@ -124,8 +125,16 @@ func (r *Runner) Run(ctx context.Context, jobID string, agent config.AgentConfig
 		}
 	}()
 
+	// The container bind-mounts projectDir as /project and does the
+	// initial clone into it, so the (empty) directory must exist on the
+	// host before the container is created — otherwise Docker would
+	// create it itself, root-owned.
 	projectDir := filepath.Join(workDir, "project")
 
+	if err := os.MkdirAll(projectDir, 0o755); err != nil {
+		return fmt.Errorf("create project dir: %w", err)
+	}
+
 	// A pr:review run works on the PR's own head branch, so the agent's
 	// commits push straight to the PR. Every other event kind branches
 	// off the default branch as usual.
@@ -149,10 +158,6 @@ func (r *Runner) Run(ctx context.Context, jobID string, agent config.AgentConfig
 			return fmt.Errorf("pr:review event has no pull request head branch to check out")
 		}
 
-		if err := clonePRHead(ctx, repoInfo.CloneURL, r.forgejo.Token(), repoInfo.DefaultBranch, headRef, ev.Index, projectDir); err != nil {
-			return fmt.Errorf("prepare git working tree: %w", err)
-		}
-
 		branch = headRef
 
 		// Fetch the full review (verdict, body, inline comments) so the
@@ -165,24 +170,20 @@ func (r *Runner) Run(ctx context.Context, jobID string, agent config.AgentConfig
 			logger.Warn("fetch review detail failed; agent will not see inline review comments", "error", err)
 			review = nil
 		}
-	} else {
-		if err := cloneAndBranch(ctx, repoInfo.CloneURL, r.forgejo.Token(), repoInfo.DefaultBranch, branch, projectDir); err != nil {
-			return fmt.Errorf("prepare git working tree: %w", err)
-		}
 	}
 
 	roster := buildRoster(r.forgejo, r.cfg.Agents, logger)
 	gitName, gitEmail := gitIdentity(agent.Name, roster)
 
-	// Local (not --global) scope, so this identity lives in
-	// projectDir/.git/config: the one place both this host-side clone
-	// and the container it's bind-mounted into (as /project) actually
-	// share.
-	if out, err := runGit(ctx, projectDir, "config", "user.name", gitName); err != nil {
-		return fmt.Errorf("configure git user.name: %w: %s", err, out)
-	}
-	if out, err := runGit(ctx, projectDir, "config", "user.email", gitEmail); err != nil {
-		return fmt.Errorf("configure git user.email: %w: %s", err, out)
+	// The credential the sandbox's git uses for remote operations: the
+	// agent's own Forgejo token when configured, so its git activity is
+	// attributed to its own account, falling back to the shared zoo
+	// identity for deployments without per-agent tokens (mirroring
+	// forgejoAs).
+	gitUser, gitToken := "zoo", r.forgejo.Token()
+
+	if agent.Token != "" {
+		gitUser, gitToken = agent.Name, agent.Token
 	}
 
 	eventPath := filepath.Join(workDir, "event.json")
@@ -206,20 +207,23 @@ func (r *Runner) Run(ctx context.Context, jobID string, agent config.AgentConfig
 		}
 	}()
 
-	// /project is bind-mounted from the host, so it's owned by the host
-	// UID that ran the clone, not whatever UID runs inside the
-	// container (usually root) — git's ownership check rejects that by
-	// default ("detected dubious ownership") unless told otherwise.
-	// --system (not --global) so this holds regardless of which user
-	// subsequent `docker exec` calls run as. Commit identity is
-	// configured host-side, above, with --local scope so it's visible
-	// from both sides of the bind mount without needing --global here.
-	out, exitCode, err := r.docker.exec(ctx, containerID, "git config --system --add safe.directory '*'")
-	if err != nil {
-		return fmt.Errorf("configure git safe.directory in container: %w: %s", err, out)
+	// Git must simply work inside the sandbox: safe.directory, commit
+	// identity, and the remote credential all go into the container's
+	// system gitconfig (see configureSandboxGit).
+	if err := configureSandboxGit(ctx, r.docker, containerID, repoInfo.CloneURL, gitUser, gitToken, gitName, gitEmail); err != nil {
+		return fmt.Errorf("configure git in container: %w", err)
 	}
-	if exitCode != 0 {
-		return fmt.Errorf("configure git safe.directory in container: exit %d: %s", exitCode, out)
+
+	// The initial clone happens inside the sandbox, so the working tree
+	// is owned by the container's user and git never runs on the host.
+	if ev.Kind == forgejo.EventPRReview {
+		if err := clonePRHead(ctx, r.docker, containerID, repoInfo.CloneURL, repoInfo.DefaultBranch, branch, ev.Index); err != nil {
+			return fmt.Errorf("prepare git working tree: %w", err)
+		}
+	} else {
+		if err := cloneAndBranch(ctx, r.docker, containerID, repoInfo.CloneURL, repoInfo.DefaultBranch, branch); err != nil {
+			return fmt.Errorf("prepare git working tree: %w", err)
+		}
 	}
 
 	logAppend := func(stream, line string) {
@@ -231,8 +235,6 @@ func (r *Runner) Run(ctx context.Context, jobID string, agent config.AgentConfig
 	runCtx := &runContext{
 		docker:      r.docker,
 		containerID: containerID,
-		projectDir:  projectDir,
-		token:       r.forgejo.Token(),
 		forgejo: &runForgejoActions{
 			client: r.forgejoAs(agent.Name, agent.Token),
 			owner:  ev.Owner,
diff --git a/internal/agentrun/sandboxgit.go b/internal/agentrun/sandboxgit.go
new file mode 100644
index 0000000..015a805
--- /dev/null
+++ b/internal/agentrun/sandboxgit.go
@@ -0,0 +1,151 @@
+package agentrun
+
+import (
+	"context"
+	"encoding/base64"
+	"fmt"
+	"net/url"
+	"strings"
+)
+
+// This file makes git "just work" inside the agent's container: the
+// initial clone happens in the sandbox, and the sandbox's git
+// credential is written to the container's system gitconfig so every
+// subsequent remote operation (pull, fetch, push, ...) authenticates
+// without any per-invocation plumbing. Zoo itself never runs git
+// outside the sandbox.
+
+// shellQuote wraps s in single quotes for safe interpolation into a
+// `sh -c` command string, escaping any embedded single quotes.
+func shellQuote(s string) string {
+	return "'" + strings.ReplaceAll(s, "'", `'\''`) + "'"
+}
+
+// shellGitCmd renders `git <args...>` as one sh -c command line with
+// every argument quoted, for docker exec.
+func shellGitCmd(args ...string) string {
+	parts := make([]string, 0, len(args)+1)
+	parts = append(parts, "git")
+
+	for _, a := range args {
+		parts = append(parts, shellQuote(a))
+	}
+
+	return strings.Join(parts, " ")
+}
+
+// runSandboxGit runs `git <args...>` inside containerID (in its
+// working directory, /project) and returns its combined output. A
+// non-zero exit code is an error carrying the output.
+func runSandboxGit(ctx context.Context, rt *dockerRuntime, containerID string, args ...string) (string, error) {
+	out, exitCode, err := rt.exec(ctx, containerID, shellGitCmd(args...))
+	if err != nil {
+		return out, err
+	}
+
+	if exitCode != 0 {
+		return out, fmt.Errorf("git %s: exit %d: %s", args[0], exitCode, out)
+	}
+
+	return out, nil
+}
+
+// gitAuthHeader returns the value of an Authorization header that
+// authenticates git's smart-HTTP requests as user with token.
+func gitAuthHeader(user, token string) string {
+	auth := base64.StdEncoding.EncodeToString([]byte(user + ":" + token))
+
+	return "Authorization: Basic " + auth
+}
+
+// forgeHost returns the scheme+host prefix of cloneURL, e.g.
+// "https://code.stdio.dk" for "https://code.stdio.dk/abrander/zoo.git".
+// On a parse failure it falls back to the full URL, which is a valid
+// (narrower) prefix match too.
+func forgeHost(cloneURL string) string {
+	u, err := url.Parse(cloneURL)
+	if err != nil || u.Host == "" {
+		return cloneURL
+	}
+
+	return u.Scheme + "://" + u.Host
+}
+
+// configureSandboxGit writes the container's system gitconfig so git
+// works inside the sandbox without further setup:
+//
+//   - safe.directory '*', so the bind-mounted /project is accepted
+//     regardless of which UID the container runs git as;
+//   - user.name / user.email, so commits are attributed to the agent;
+//   - http.<host>.extraHeader carrying the run's Forgejo credential,
+//     scoped to the forge host the repository lives on, so
+//     clone/fetch/pull/push all authenticate transparently — including
+//     for submodules and other repos on the same forge. The token is
+//     only valid on that forge anyway, so the host scope grants no
+//     extra access; git never sends it anywhere else.
+//
+// The credential lives in the container's own filesystem (ephemeral,
+// torn down with the container), never in the bind-mounted working
+// tree: the origin remote keeps the plain cloneURL, so the token can't
+// leak into the repo's .git/config, into a work dir zoo keeps on
+// failure, or anywhere the host can read it back.
+func configureSandboxGit(ctx context.Context, rt *dockerRuntime, containerID, cloneURL, user, token, name, email string) error {
+	if _, err := runSandboxGit(ctx, rt, containerID, "config", "--system", "--add", "safe.directory", "*"); err != nil {
+		return fmt.Errorf("configure safe.directory: %w", err)
+	}
+
+	if _, err := runSandboxGit(ctx, rt, containerID, "config", "--system", "user.name", name); err != nil {
+		return fmt.Errorf("configure user.name: %w", err)
+	}
+
+	if _, err := runSandboxGit(ctx, rt, containerID, "config", "--system", "user.email", email); err != nil {
+		return fmt.Errorf("configure user.email: %w", err)
+	}
+
+	if _, err := runSandboxGit(ctx, rt, containerID, "config", "--system", "http."+forgeHost(cloneURL)+".extraHeader", gitAuthHeader(user, token)); err != nil {
+		return fmt.Errorf("configure git credential: %w", err)
+	}
+
+	return nil
+}
+
+// cloneAndBranch clones cloneURL into /project inside the container
+// and checks out a fresh branch off defaultBranch. The clone
+// authenticates via the http.<host>.extraHeader configured by
+// configureSandboxGit, and the origin remote is left with the plain
+// cloneURL: no credential ends up in the working tree.
+func cloneAndBranch(ctx context.Context, rt *dockerRuntime, containerID, cloneURL, defaultBranch, branch string) error {
+	if _, err := runSandboxGit(ctx, rt, containerID, "clone", "--branch", defaultBranch, "--single-branch", cloneURL, "/project"); err != nil {
+		return fmt.Errorf("clone: %w", err)
+	}
+
+	if _, err := runSandboxGit(ctx, rt, containerID, "checkout", "-b", branch); err != nil {
+		return fmt.Errorf("checkout branch %q: %w", branch, err)
+	}
+
+	return nil
+}
+
+// clonePRHead clones cloneURL into /project inside the container and
+// checks out the pull request's head as a local branch named headRef,
+// so commits the agent makes push straight to the PR. The head is
+// fetched via the PR's refs/pull/<n>/head ref rather than by branch
+// name, which also works for PRs opened from a fork, where the head
+// branch doesn't exist in the base repo.
+func clonePRHead(ctx context.Context, rt *dockerRuntime, containerID, cloneURL, defaultBranch, headRef string, index int64) error {
+	if _, err := runSandboxGit(ctx, rt, containerID, "clone", "--branch", defaultBranch, "--single-branch", cloneURL, "/project"); err != nil {
+		return fmt.Errorf("clone: %w", err)
+	}
+
+	fetchRef := fmt.Sprintf("refs/pull/%d/head", index)
+
+	if _, err := runSandboxGit(ctx, rt, containerID, "fetch", "--no-tags", "origin", fetchRef); err != nil {
+		return fmt.Errorf("fetch PR %d head: %w", index, err)
+	}
+
+	if _, err := runSandboxGit(ctx, rt, containerID, "checkout", "-B", headRef, "FETCH_HEAD"); err != nil {
+		return fmt.Errorf("checkout PR head %q: %w", headRef, err)
+	}
+
+	return nil
+}
diff --git a/internal/agentrun/sandboxgit_test.go b/internal/agentrun/sandboxgit_test.go
new file mode 100644
index 0000000..cbf2e2e
--- /dev/null
+++ b/internal/agentrun/sandboxgit_test.go
@@ -0,0 +1,78 @@
+package agentrun
+
+import (
+	"encoding/base64"
+	"strings"
+	"testing"
+)
+
+func TestSandboxShellQuote(t *testing.T) {
+	cases := map[string]string{
+		"simple":            "'simple'",
+		"it's a branch":     `'it'\''s a branch'`,
+		"with space":        "'with space'",
+		"$(rm -rf /)":       "'$(rm -rf /)'",
+		"a\"b\\c":           "'a\"b\\c'",
+		"":                  "''",
+		"HEAD~1":            "'HEAD~1'",
+		"https://h/a/b.git": "'https://h/a/b.git'",
+	}
+
+	for in, want := range cases {
+		if got := shellQuote(in); got != want {
+			t.Errorf("shellQuote(%q) = %q, want %q", in, got, want)
+		}
+	}
+}
+
+func TestShellGitCmdQuotesEveryArg(t *testing.T) {
+	got := shellGitCmd("clone", "--branch", "main", "--single-branch", "https://h/a/b.git", "/project")
+
+	want := "git 'clone' '--branch' 'main' '--single-branch' 'https://h/a/b.git' '/project'"
+
+	if got != want {
+		t.Fatalf("shellGitCmd = %q, want %q", got, want)
+	}
+}
+
+func TestShellGitCmdSubcommandWithArgs(t *testing.T) {
+	got := shellGitCmd("commit", "-m", "fix: handle it's edge case")
+
+	if !strings.HasPrefix(got, "git 'commit' '-m' ") {
+		t.Fatalf("shellGitCmd = %q, want prefix git 'commit' '-m' ", got)
+	}
+
+	// The message must be one quoted word with the embedded quote
+	// escaped, so sh passes it through verbatim.
+	if want := `'fix: handle it'\''s edge case'`; !strings.HasSuffix(got, want) {
+		t.Fatalf("shellGitCmd = %q, want suffix %q", got, want)
+	}
+}
+
+func TestForgeHost(t *testing.T) {
+	cases := map[string]string{
+		"https://code.stdio.dk/abrander/zoo.git": "https://code.stdio.dk",
+		"http://forgejo.local:3000/acme/widgets": "http://forgejo.local:3000",
+		"https://h/a/b.git?x=1":                  "https://h",
+		// Not a URL with a host: fall back to the full string, which is
+		// still a valid (narrower) prefix match.
+		"/bare":     "/bare",
+		"not a url": "not a url",
+	}
+
+	for in, want := range cases {
+		if got := forgeHost(in); got != want {
+			t.Errorf("forgeHost(%q) = %q, want %q", in, got, want)
+		}
+	}
+}
+
+func TestGitAuthHeader(t *testing.T) {
+	got := gitAuthHeader("greg", "s3cr3t")
+
+	want := "Authorization: Basic " + base64.StdEncoding.EncodeToString([]byte("greg:s3cr3t"))
+
+	if got != want {
+		t.Fatalf("gitAuthHeader = %q, want %q", got, want)
+	}
+}
diff --git a/internal/agentrun/system.md b/internal/agentrun/system.md
index 9de0799..1fe763a 100644
--- a/internal/agentrun/system.md
+++ b/internal/agentrun/system.md
@@ -34,8 +34,9 @@ doing it yourself.
 
 **Git**
 
-You may use normal git commands to manage your working tree. For remote
-(pull, fetch, push, etc.) git operations, you can use the `git` tool.
+You may use normal git commands to manage your working tree. Remote
+(pull, fetch, push, etc.) git operations are authenticated for you and
+simply work — through the `git` tool or plain `git` in `bash`.
 
 **Guidelines**
 
diff --git a/internal/tools/context.go b/internal/tools/context.go
index aea7030..30b5dd3 100644
--- a/internal/tools/context.go
+++ b/internal/tools/context.go
@@ -10,16 +10,14 @@ import "context"
 // global Context, since multiple agents run concurrently in zoo.
 type Context interface {
 	// Exec runs command inside the run's container via `sh -c` and
-	// returns combined stdout+stderr. The container never holds a
-	// Forgejo credential, so this cannot reach the Forgejo API or
-	// authenticate git operations against it — see Git.
+	// returns combined stdout+stderr.
 	Exec(ctx context.Context, command string) (string, error)
 
-	// Git runs a git subcommand against the run's working tree on the
-	// host, outside the container, so that operations needing a Forgejo
-	// credential (currently just push) can authenticate without that
-	// credential ever being written to disk where the container (and
-	// anything run inside it via Exec) could read it.
+	// Git runs a git subcommand against the run's working tree inside
+	// the run's container. Remote operations (fetch, pull, push, ...)
+	// authenticate via the Forgejo credential the run's setup wrote to
+	// the container's system gitconfig, so they work without any
+	// per-invocation plumbing.
 	Git(ctx context.Context, subcommand string, args ...string) (string, error)
 
 	// Forgejo returns the actions bound to the issue/PR that triggered
diff --git a/internal/tools/git.go b/internal/tools/git.go
index 0563788..5c38591 100644
--- a/internal/tools/git.go
+++ b/internal/tools/git.go
@@ -44,10 +44,10 @@ func init() {
 	Register(tool, git)
 }
 
-// git runs subcommand via Context.Git, which executes it outside the
-// container (see that method's doc comment for why): the container
-// itself is never given a credential capable of authenticating against
-// Forgejo, so pushing has to happen on the host side instead.
+// git runs subcommand via Context.Git, which executes it inside the
+// run's container, where the run's Forgejo credential is configured
+// for git (see that method's doc comment) — remote operations like
+// push simply work.
 func git(ctx Context, params gitParams) (string, error) {
 	if !slices.Contains(gitAllowed, params.Subcommand) {
 		return "", fmt.Errorf("git subcommand '%s' is not allowed. Only %s are permitted", params.Subcommand, strings.Join(gitAllowed, ", "))

{"end_line": 130, "path": "README.md", "start_line": 96}

{"path":"README.md","content":"environment {\r\n    docker_image    = \"golang:latest\"   # base image for agent containers\r\n    max_live_agents = 5                 # concurrent agent limit\r\n}\r\n```\r\n\r\n### Agent Definition\r\n\r\n```hcl\r\nagent \"anna\" {\r\n    llm   = \"Qwen 3.6\"\r\n    token = \"ANNA_FORGEJO_TOKEN\"\r\n}\r\n```\r\n\r\n### Event Routing\r\n\r\nMap event types to agents with optional custom instructions:\r\n\r\n```hcl\r\nevent \"issue:new\" {\r\n    agent        = \"leon\"\r\n    instructions = \"Triage this issue.\"\r\n}\r\n\r\nevent \"issue:assigned\" {\r\n    // No `agent` — dynamically matches the assignee's username\r\n    instructions = \"Please handle this issue.\"\r\n}\r\n\r\nevent \"pr:new\" {\r\n    agent        = \"greg\"\r\n    instructions = \"Review this pull request.\"\r\n}\r\n```\r","start_line":96,"end_line":130,"total_lines":217,"truncated":true}

{"path": "README.md", "find": "### Agent Definition\n\n```hcl\nagent \"anna\" {\n    llm   = \"Qwen 3.6\"\n    token = \"ANNA_FORGEJO_TOKEN\"\n}\n```", "replace": "### Agent Definition\n\n```hcl\nagent \"anna\" {\n    llm   = \"Qwen 3.6\"\n    token = \"ANNA_FORGEJO_TOKEN\"\n}\n```\n\nThe optional `token` is the agent's own Forgejo token. When set, the\nagent acts as itself on Forgejo (comments, PRs, ...) and its sandbox's\ngit authenticates with it too — the initial clone and all remote git\noperations (pull, push, ...) run inside the container with that\ncredential. Without it, the shared `forgejo.token` is used."}

1 occurrences replaced

{"path": "internal/agentrun/sandboxgit.go", "find": "//   - http.<host>.extraHeader carrying the run's Forgejo credential,\n//     scoped to the forge host the repository lives on, so\n//     clone/fetch/pull/push all authenticate transparently — including\n//     for submodules and other repos on the same forge. The token is\n//     only valid on that forge anyway, so the host scope grants no\n//     extra access; git never sends it anywhere else.", "replace": "//   - http.<host>.extraHeader carrying the run's Forgejo credential,\n//     scoped to the forge host the repository lives on, so\n//     clone/fetch/pull/push all authenticate transparently — including\n//     for submodules and other repos on the same forge. The token is\n//     only valid on that forge anyway, so the host scope grants no\n//     extra access; git never sends it anywhere else;\n//   - push.autoSetupRemote, so a bare `git push` on the fresh working\n//     branch pushes it to origin and sets the upstream — after which\n//     a bare `git pull` works too."}

1 occurrences replaced

{"path": "internal/agentrun/sandboxgit.go", "find": "\tif _, err := runSandboxGit(ctx, rt, containerID, \"config\", \"--system\", \"http.\"+forgeHost(cloneURL)+\".extraHeader\", gitAuthHeader(user, token)); err != nil {\n\t\treturn fmt.Errorf(\"configure git credential: %w\", err)\n\t}\n\n\treturn nil\n}", "replace": "\tif _, err := runSandboxGit(ctx, rt, containerID, \"config\", \"--system\", \"http.\"+forgeHost(cloneURL)+\".extraHeader\", gitAuthHeader(user, token)); err != nil {\n\t\treturn fmt.Errorf(\"configure git credential: %w\", err)\n\t}\n\n\tif _, err := runSandboxGit(ctx, rt, containerID, \"config\", \"--system\", \"push.autoSetupRemote\", \"true\"); err != nil {\n\t\treturn fmt.Errorf(\"configure push.autoSetupRemote: %w\", err)\n\t}\n\n\treturn nil\n}"}

1 occurrences replaced

{"command": "set -e\nrm -rf /tmp/sim3 && mkdir -p /tmp/sim3/project && cd /tmp/sim3\ngit init -q -b main seed\n(cd seed && git config user.name t && git config user.email t@t && echo hello > f.txt && git add . && git commit -qm init)\ngit clone -q --bare seed remote.git\nexport GIT_CONFIG_SYSTEM=/tmp/sim3/gitconfig\nsh -c \"git 'config' '--system' 'push.autoSetupRemote' 'true'\"\ncd /tmp/sim3/project\ngit clone -q --branch main --single-branch /tmp/sim3/remote.git /tmp/sim3/project\ngit checkout -qb issue-1-greg\necho more >> f.txt && git add f.txt && git -c user.name=t -c user.email=t@t commit -qm wip\n# bare push, no upstream set:\ngit push 2>&1 | tail -2\necho \"upstream: $(git rev-parse --abbrev-ref --symbolic-full-name @{u})\"\ngit pull 2>&1 | tail -1\necho ALL-OK", "timeout": 60}

 * [new branch]      issue-1-greg -> issue-1-greg
branch 'issue-1-greg' set up to track 'origin/issue-1-greg'.
fatal: upstream branch 'refs/heads/issue-1-greg' not stored as a remote-tracking branch
upstream: 
Already up to date.
ALL-OK

{"command": "cd /tmp/sim3/project && git status | head -3; git log --oneline -2; git branch -vv"}

On branch issue-1-greg
nothing to commit, working tree clean
c0a00f4 (HEAD -> issue-1-greg) wip
a0e4d42 (origin/main, origin/HEAD, main) init
* issue-1-greg c0a00f4 wip
  main         a0e4d42 [origin/main] init

{"command": "cd /tmp/sim3\ngit clone remote.git ahead 2>&1 | tail -2; echo \"clone: $?\"\ncd ahead 2>/dev/null && { git config user.name t; git config user.email t@t; echo remote-change > remote.txt; git add .; git commit -qm \"remote change\"; git push origin issue-1-greg 2>&1 | tail -2; echo \"push: $?\"; }", "timeout": 60}

fatal: destination path 'ahead' already exists and is not an empty directory.
clone: 0
On branch main
Your branch is ahead of 'origin/main' by 1 commit.
  (use "git push" to publish your local commits)

nothing to commit, working tree clean
error: src refspec issue-1-greg does not match any
error: failed to push some refs to '/tmp/sim3/remote.git'
push: 0

{"command": "cd /tmp/sim3/ahead\ngit fetch -q origin issue-1-greg\ngit checkout -qb issue-1-greg FETCH_HEAD\ngit config user.name t && git config user.email t@t\necho remote-change > remote.txt && git add . && git commit -qm \"remote change\"\ngit push -q origin issue-1-greg && echo REMOTE-AHEAD-SETUP-OK\ncd /tmp/sim3/project\necho \"--- bare git pull with remote ahead: ---\"\ngit pull 2>&1 | tail -3\nls remote.txt && echo PULL-FETCHED-OK\ngit log --oneline -2", "timeout": 60}

REMOTE-AHEAD-SETUP-OK
--- bare git pull with remote ahead: ---
 remote.txt | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 remote.txt
remote.txt
PULL-FETCHED-OK
06f6a79 (HEAD -> issue-1-greg) remote change
c0a00f4 wip

{"command": "cd /project && gofmt -l . ; go build ./... && go test ./... 2>&1 | grep -v \"no test files\" && go vet -tags docker ./... && echo ALL-OK", "timeout": 300}

ok  	github.com/abrander/zoo/internal/agentrun	(cached)
ok  	github.com/abrander/zoo/internal/config	(cached)
ok  	github.com/abrander/zoo/internal/forgejo	(cached)
ok  	github.com/abrander/zoo/internal/livelog	(cached)
ok  	github.com/abrander/zoo/internal/llm	(cached)
ok  	github.com/abrander/zoo/internal/scheduler	(cached)
ok  	github.com/abrander/zoo/internal/store	(cached)
ok  	github.com/abrander/zoo/internal/tools	(cached)
ok  	github.com/abrander/zoo/internal/web	(cached)
ALL-OK

{"path": "internal/agentrun/sandboxgit.go", "start_line": 1, "end_line": 160}

{"path":"internal/agentrun/sandboxgit.go","content":"package agentrun\r\n\r\nimport (\r\n\t\"context\"\r\n\t\"encoding/base64\"\r\n\t\"fmt\"\r\n\t\"net/url\"\r\n\t\"strings\"\r\n)\r\n\r\n// This file makes git \"just work\" inside the agent's container: the\r\n// initial clone happens in the sandbox, and the sandbox's git\r\n// credential is written to the container's system gitconfig so every\r\n// subsequent remote operation (pull, fetch, push, ...) authenticates\r\n// without any per-invocation plumbing. Zoo itself never runs git\r\n// outside the sandbox.\r\n\r\n// shellQuote wraps s in single quotes for safe interpolation into a\r\n// `sh -c` command string, escaping any embedded single quotes.\r\nfunc shellQuote(s string) string {\r\n\treturn \"'\" + strings.ReplaceAll(s, \"'\", `'\\''`) + \"'\"\r\n}\r\n\r\n// shellGitCmd renders `git \u003cargs...\u003e` as one sh -c command line with\r\n// every argument quoted, for docker exec.\r\nfunc shellGitCmd(args ...string) string {\r\n\tparts := make([]string, 0, len(args)+1)\r\n\tparts = append(parts, \"git\")\r\n\r\n\tfor _, a := range args {\r\n\t\tparts = append(parts, shellQuote(a))\r\n\t}\r\n\r\n\treturn strings.Join(parts, \" \")\r\n}\r\n\r\n// runSandboxGit runs `git \u003cargs...\u003e` inside containerID (in its\r\n// working directory, /project) and returns its combined output. A\r\n// non-zero exit code is an error carrying the output.\r\nfunc runSandboxGit(ctx context.Context, rt *dockerRuntime, containerID string, args ...string) (string, error) {\r\n\tout, exitCode, err := rt.exec(ctx, containerID, shellGitCmd(args...))\r\n\tif err != nil {\r\n\t\treturn out, err\r\n\t}\r\n\r\n\tif exitCode != 0 {\r\n\t\treturn out, fmt.Errorf(\"git %s: exit %d: %s\", args[0], exitCode, out)\r\n\t}\r\n\r\n\treturn out, nil\r\n}\r\n\r\n// gitAuthHeader returns the value of an Authorization header that\r\n// authenticates git's smart-HTTP requests as user with token.\r\nfunc gitAuthHeader(user, token string) string {\r\n\tauth := base64.StdEncoding.EncodeToString([]byte(user + \":\" + token))\r\n\r\n\treturn \"Authorization: Basic \" + auth\r\n}\r\n\r\n// forgeHost returns the scheme+host prefix of cloneURL, e.g.\r\n// \"https://code.stdio.dk\" for \"https://code.stdio.dk/abrander/zoo.git\".\r\n// On a parse failure it falls back to the full URL, which is a valid\r\n// (narrower) prefix match too.\r\nfunc forgeHost(cloneURL string) string {\r\n\tu, err := url.Parse(cloneURL)\r\n\tif err != nil || u.Host == \"\" {\r\n\t\treturn cloneURL\r\n\t}\r\n\r\n\treturn u.Scheme + \"://\" + u.Host\r\n}\r\n\r\n// configureSandboxGit writes the container's system gitconfig so git\r\n// works inside the sandbox without further setup:\r\n//\r\n//   - safe.directory '*', so the bind-mounted /project is accepted\r\n//     regardless of which UID the container runs git as;\r\n//   - user.name / user.email, so commits are attributed to the agent;\r\n//   - http.\u003chost\u003e.extraHeader carrying the run's Forgejo credential,\r\n//     scoped to the forge host the repository lives on, so\r\n//     clone/fetch/pull/push all authenticate transparently — including\r\n//     for submodules and other repos on the same forge. The token is\r\n//     only valid on that forge anyway, so the host scope grants no\r\n//     extra access; git never sends it anywhere else;\r\n//   - push.autoSetupRemote, so a bare `git push` on the fresh working\r\n//     branch pushes it to origin and sets the upstream — after which\r\n//     a bare `git pull` works too.\r\n//\r\n// The credential lives in the container's own filesystem (ephemeral,\r\n// torn down with the container), never in the bind-mounted working\r\n// tree: the origin remote keeps the plain cloneURL, so the token can't\r\n// leak into the repo's .git/config, into a work dir zoo keeps on\r\n// failure, or anywhere the host can read it back.\r\nfunc configureSandboxGit(ctx context.Context, rt *dockerRuntime, containerID, cloneURL, user, token, name, email string) error {\r\n\tif _, err := runSandboxGit(ctx, rt, containerID, \"config\", \"--system\", \"--add\", \"safe.directory\", \"*\"); err != nil {\r\n\t\treturn fmt.Errorf(\"configure safe.directory: %w\", err)\r\n\t}\r\n\r\n\tif _, err := runSandboxGit(ctx, rt, containerID, \"config\", \"--system\", \"user.name\", name); err != nil {\r\n\t\treturn fmt.Errorf(\"configure user.name: %w\", err)\r\n\t}\r\n\r\n\tif _, err := runSandboxGit(ctx, rt, containerID, \"config\", \"--system\", \"user.email\", email); err != nil {\r\n\t\treturn fmt.Errorf(\"configure user.email: %w\", err)\r\n\t}\r\n\r\n\tif _, err := runSandboxGit(ctx, rt, containerID, \"config\", \"--system\", \"http.\"+forgeHost(cloneURL)+\".extraHeader\", gitAuthHeader(user, token)); err != nil {\r\n\t\treturn fmt.Errorf(\"configure git credential: %w\", err)\r\n\t}\r\n\r\n\tif _, err := runSandboxGit(ctx, rt, containerID, \"config\", \"--system\", \"push.autoSetupRemote\", \"true\"); err != nil {\r\n\t\treturn fmt.Errorf(\"configure push.autoSetupRemote: %w\", err)\r\n\t}\r\n\r\n\treturn nil\r\n}\r\n\r\n// cloneAndBranch clones cloneURL into /project inside the container\r\n// and checks out a fresh branch off defaultBranch. The clone\r\n// authenticates via the http.\u003chost\u003e.extraHeader configured by\r\n// configureSandboxGit, and the origin remote is left with the plain\r\n// cloneURL: no credential ends up in the working tree.\r\nfunc cloneAndBranch(ctx context.Context, rt *dockerRuntime, containerID, cloneURL, defaultBranch, branch string) error {\r\n\tif _, err := runSandboxGit(ctx, rt, containerID, \"clone\", \"--branch\", defaultBranch, \"--single-branch\", cloneURL, \"/project\"); err != nil {\r\n\t\treturn fmt.Errorf(\"clone: %w\", err)\r\n\t}\r\n\r\n\tif _, err := runSandboxGit(ctx, rt, containerID, \"checkout\", \"-b\", branch); err != nil {\r\n\t\treturn fmt.Errorf(\"checkout branch %q: %w\", branch, err)\r\n\t}\r\n\r\n\treturn nil\r\n}\r\n\r\n// clonePRHead clones cloneURL into /project inside the container and\r\n// checks out the pull request's head as a local branch named headRef,\r\n// so commits the agent makes push straight to the PR. The head is\r\n// fetched via the PR's refs/pull/\u003cn\u003e/head ref rather than by branch\r\n// name, which also works for PRs opened from a fork, where the head\r\n// branch doesn't exist in the base repo.\r\nfunc clonePRHead(ctx context.Context, rt *dockerRuntime, containerID, cloneURL, defaultBranch, headRef string, index int64) error {\r\n\tif _, err := runSandboxGit(ctx, rt, containerID, \"clone\", \"--branch\", defaultBranch, \"--single-branch\", cloneURL, \"/project\"); err != nil {\r\n\t\treturn fmt.Errorf(\"clone: %w\", err)\r\n\t}\r\n\r\n\tfetchRef := fmt.Sprintf(\"refs/pull/%d/head\", index)\r\n\r\n\tif _, err := runSandboxGit(ctx, rt, containerID, \"fetch\", \"--no-tags\", \"origin\", fetchRef); err != nil {\r\n\t\treturn fmt.Errorf(\"fetch PR %d head: %w\", index, err)\r\n\t}\r\n\r\n\tif _, err := runSandboxGit(ctx, rt, containerID, \"checkout\", \"-B\", headRef, \"FETCH_HEAD\"); err != nil {\r\n\t\treturn fmt.Errorf(\"checkout PR head %q: %w\", headRef, err)\r\n\t}\r\n\r\n\treturn nil\r\n}\r","start_line":1,"end_line":158,"total_lines":158,"truncated":false}

{"command": "cd /project && git add -A && git commit -m \"Pass the agent's git credential to the sandbox, clone inside it\n\nGit now simply works inside the agent's container:\n\n- The sandbox's git authenticates via an http.<host>.extraHeader entry\n  in the container's system gitconfig, scoped to the forge host. It\n  carries the agent's own Forgejo token when configured (so git\n  activity is attributed to the agent's account), falling back to the\n  shared zoo identity. Clone, fetch, pull, push, and ls-remote all\n  authenticate transparently — no per-invocation plumbing.\n- The initial clone (and the PR-head fetch for pr:review runs) now\n  happens inside the container, so the working tree is owned by the\n  container's user and zoo never runs git on the host.\n- The git tool now executes inside the container (shell-quoted args),\n  and push.autoSetupRemote makes a bare 'git push' — and the 'git\n  pull' that follows it — work on the fresh working branch.\n- The credential lives only in the container's ephemeral filesystem;\n  the origin remote keeps the plain clone URL, so the token never\n  lands in the bind-mounted working tree or the host's work dir.\n\nVerified against a local smart-HTTP git server: clone/pull/push/\nls-remote all authenticate via the gitconfig header.\" && git log --oneline -2"}

[issue-48-greg c3d3720] Pass the agent's git credential to the sandbox, clone inside it
 10 files changed, 422 insertions(+), 145 deletions(-)
 delete mode 100644 internal/agentrun/clone.go
 create mode 100644 internal/agentrun/sandboxgit.go
 create mode 100644 internal/agentrun/sandboxgit_test.go
c3d3720 (HEAD -> issue-48-greg) Pass the agent's git credential to the sandbox, clone inside it
f083eae (origin/main, origin/HEAD, main) Merge pull request 'Add pr:review event so agents react to PR reviews' (#37) from issue-36-greg into main

{"command": "cd /project && git push -u origin issue-48-greg 2>&1 | tail -3"}

fatal: could not read Username for 'https://code.stdio.dk': terminal prompts disabled

{"subcommand": "push", "args": ["-u", "origin", "issue-48-greg"]}

To https://code.stdio.dk/abrander/zoo.git
 * [new branch]      issue-48-greg -> issue-48-greg
branch 'issue-48-greg' set up to track 'origin/issue-48-greg'.

{"head": "issue-48-greg", "base": "main", "title": "Pass the agent's git credential to the sandbox, clone inside it", "body": "Closes #48.\n\nGit now simply works inside the agent's container — zoo no longer runs git on the host at all.\n\n## How\n\n**Credential in the sandbox's gitconfig.** When the container is created, zoo writes the container's *system* gitconfig (`/etc/gitconfig`) via `docker exec`:\n\n- `safe.directory *` (as before),\n- `user.name` / `user.email` (the agent's Forgejo identity, previously set host-side in `.git/config`),\n- `http.<host>.extraHeader = Authorization: Basic base64(user:token)` — the run's Forgejo credential, scoped to the forge host (scheme+host of the clone URL), so it covers the repo, its submodules, and any other repo on the same forge, but is never sent to any other host,\n- `push.autoSetupRemote = true`, so a bare `git push` on the fresh working branch pushes to origin and sets the upstream — after which a bare `git pull` works too.\n\nThe token used is **the agent's own Forgejo token** when configured (so its git activity is attributed to its own account), falling back to the shared zoo identity — mirroring the existing `forgejoAs` fallback.\n\n**Clone inside the sandbox.** The host only creates the empty bind-mount source; the container does `git clone` (+ branch checkout, or the `refs/pull/<n>/head` fetch for pr:review runs) itself. The working tree is owned by the container's user, and the origin remote keeps the plain clone URL — **no credential ever lands in the bind-mounted working tree** or the host's work dir. The credential lives only in the container's ephemeral filesystem, torn down with the container.\n\n**`git` tool runs in the sandbox.** `runContext.Git` now executes via `docker exec` with shell-quoted args (new `shellQuote`/`shellGitCmd` helpers), instead of on the host with per-invocation `-c http.extraHeader` for push.\n\n## Verification\n\n- `go build`, `go vet` (incl. `-tags docker`), `gofmt`, and the full unit test suite pass; new unit tests cover the quoting, header construction, and host extraction.\n- The auth mechanism was verified end-to-end against a local smart-HTTP git server (CGI `git http-backend` requiring Basic auth): clone, `git pull`, `git push`, and `git ls-remote` all authenticate via the gitconfig header; host-scoped prefix matching confirmed; bare `git push` → bare `git pull` round-trip confirmed.\n- New `docker`-tagged integration test `TestDockerRuntimeSandboxGit` covers the container flow: gitconfig round-trip (including the URL-subsection key), in-sandbox clone + branch, commit identity from the system gitconfig, and no token leak into the working tree. (No Docker daemon in this sandbox, so it runs in CI.)\n\n## Notes\n\n- `push.autoSetupRemote` requires git ≥ 2.37 — fine for the `golang:latest`/Debian-based images zoo uses.\n- The system prompt and README were updated to match (remote git ops are authenticated for the agent; the agent `token` now also authenticates its sandbox's git)."}

Pull request opened

{"body": "Done — PR opened against `main`. Git now simply works inside the sandbox, and zoo no longer runs git on the host at all.\n\n**What changed**\n\n1. **The agent's token is passed to the sandbox** — when the container starts, zoo writes the container's *system* gitconfig (`/etc/gitconfig`) with `http.<forge-host>.extraHeader = Authorization: Basic …`, carrying the agent's own Forgejo token (falling back to the shared zoo identity when the agent has no token, same fallback as the Forgejo API client). Scoped to the forge host, so it covers the repo, submodules, and any other repo on that forge — and is never sent anywhere else.\n2. **The initial clone happens inside the sandbox** — the host only creates the empty bind-mount source; the container clones (and, for pr:review, fetches `refs/pull/<n>/head`) itself. The working tree is owned by the container's user, and the origin remote keeps the plain clone URL, so the token never lands in the working tree or the host's work dir — only in the container's ephemeral filesystem.\n3. **`git pull` just works** — that's the `.gitconfig` approach you suspected: with the extraHeader in place, `git pull`/`push`/`fetch`/`ls-remote` authenticate transparently. As a bonus, `push.autoSetupRemote = true` makes a bare `git push` set the upstream, so the bare `git pull` that follows works too. The `git` tool now also executes inside the container (shell-quoted args) instead of on the host.\n\n**Verification** — I stood up a local smart-HTTP git server requiring Basic auth and confirmed clone, pull, push, and ls-remote all authenticate via the gitconfig header (including host-scoped prefix matching and the bare-push → bare-pull round-trip). Unit tests cover the quoting/header/host helpers, and a new `docker`-tagged integration test covers the full container flow (gitconfig round-trip, in-sandbox clone + branch, commit identity, no token leak into the working tree) for CI."}

Comment posted