[saucam]

What this adds

A worktree codeoid creates (forks, compare, routine worktrees) can now actually build and run tests. Until now it carried tracked files only, so .env and installed dependencies were missing and checks failed for reasons unrelated to the change being tested (docs/loop-engineering-design.md §12.7).

A repo can declare .codeoid/setup.yaml:

• copy: gitignored files to copy from the primary checkout, for example .env.
• share: directories to link from the primary checkout, for example node_modules. A share is a writable link back into the primary checkout, and config directories such as .claude, .vscode and .git* are refused.
• command: an optional setup command such as bun install --ignore-scripts.

Running the command is something you opt into, and it is pinned:

• It runs only with worktree.setup.runCommands: trusted-repos, and only for a recipe you trusted with codeoid worktree trust. Trust is recorded against the recipe's content hash and for your user.
• Change the command and it stops running until you re-trust it.
• It runs only on committed content, before the fork's uncommitted edits are applied.
• It runs only when the worktree's base commit is already on the primary checkout's history. A fork of an agent's branch, a codeoid branch or an unmerged PR ref runs no command. Copy and share still apply.
• Delegated tokens can't change these settings or grant trust, and refusals are audited.

What setup copied or linked is kept out of checkpoints and out of the branch a destroyed fork leaves behind. A failed setup is reported as an infrastructure problem, not the agent's.

Review

Two independent security and correctness audit rounds, all findings folded in.

• Round 1 fixed:
  • the command running agent-edited scripts with no approval gate;
  • trust tied to a path instead of to content;
  • delegated tokens able to enable command execution;
  • leftover processes;
  • config-directory shares;
  • fail-open checkpoint exclusion;
  • unredacted output;
  • hard-link and symlink copy races.
• Round 2 fixed:
  • commands running on unreviewed commits (base-commit ancestry check);
  • a stale policy snapshot;
  • half-applied carries;
  • reads during preparation;
  • per-owner trust.

Full suite: 3803 pass / 0 fail.

For agents: implementation

• src/daemon/workspace-setup.ts:
  • The recipe is read from HEAD with ls-tree/cat-file, through a zod schema.
  • Copy plans use realpath containment, O_NOFOLLOW plus fstat, and skip files with nlink>1; destinations are opened O_EXCL and must be ignored where they land.
  • Share plans include the config-directory refusals.
  • The command runs in a process group, with the stripped env and a redacted output tail.
  • Before running it, trustDecision checks the base blob hash and merge-base --is-ancestor.
• git-worktree.ts: createForkWorktree({ deferCarry }) with applyCarriedState (restored to HEAD on failure).
• session-manager.ts:
  • fork, compare and the routine host call prepareWorktree;
  • the worktree.trust handler refuses delegated tokens and audits refusals;
  • the policy is snapshotted once per fork.
• session.ts: setup notices, plus #pendingSetup refusing fs, fork and rewind while preparing.
• checkpoints.ts: fail-closed exclusion of setup paths.
• Config and settings: worktree.setup.runCommands; trustedRepos entries are {path, recipeHash, trustedBy}.
• Protocol: worktree-trust.ts. CLI: codeoid worktree trust [dir] [--off] [--yes]. Docs: CONFIGURATION.md.

🤖 Generated with Claude Code