Merge pull request #850 from Automattic/fix/issue-845-agent-task-patch-materialization

Capture raw sandbox input mount diffs

Author: chubes4

packages/cli/src/agent-code.ts

@@ -94,6 +94,7 @@ function agentChatTaskCode(options: AgentSandboxCodeOptions): string {
   const timeoutLimit = Number.isFinite(timeoutSeconds) && timeoutSeconds > 0 ? timeoutSeconds : 0
   const agentBundles = normalizeAgentBundleSpecs(options.agentBundles ?? [])
   const runtimeTask = normalizeRuntimeTask(options.runtimeTask, input)
+  const sandboxWorkspaceJson = JSON.stringify(sandboxWorkspace ?? null)
 
   return `
 if (function_exists('wp_set_current_user')) {
@@ -119,19 +120,35 @@ add_filter('datamachine_code_remote_workspace_backend_should_handle', '__return_
 
 $sandbox_workspace_adoptions = array();
 if (function_exists('wp_get_ability')) {
-    $sandbox_adopt_callback = static function () use (&$sandbox_workspace_adoptions): void {
+    $sandbox_workspace_contract = json_decode(${JSON.stringify(sandboxWorkspaceJson)}, true);
+    $sandbox_repo_backed_mounts = array();
+    if (is_array($sandbox_workspace_contract) && is_array($sandbox_workspace_contract['mounts'] ?? null)) {
+        foreach ($sandbox_workspace_contract['mounts'] as $sandbox_mount) {
+            if (!is_array($sandbox_mount)) {
+                continue;
+            }
+            $sandbox_mount_target = rtrim((string) ($sandbox_mount['target'] ?? ''), '/');
+            if ('' === $sandbox_mount_target) {
+                continue;
+            }
+            if ('repo-backed' === (string) ($sandbox_mount['sourceMode'] ?? '')) {
+                $sandbox_repo_backed_mounts[$sandbox_mount_target] = true;
+            }
+        }
+    }
+    $sandbox_adopt_callback = static function () use (&$sandbox_workspace_adoptions, $sandbox_repo_backed_mounts): void {
         $sandbox_adopt_ability = wp_get_ability('datamachine-code/workspace-adopt') ?: wp_get_ability('datamachine/workspace-adopt');
         if (!$sandbox_adopt_ability || !method_exists($sandbox_adopt_ability, 'execute')) {
             return;
         }
         foreach (glob(rtrim(DATAMACHINE_WORKSPACE_PATH, '/') . '/*', GLOB_ONLYDIR) ?: array() as $sandbox_workspace_dir) {
             $sandbox_workspace_name = basename($sandbox_workspace_dir);
-            if (is_file($sandbox_workspace_dir . '/.git')) {
+            if (is_file($sandbox_workspace_dir . '/.git') || isset($sandbox_repo_backed_mounts[rtrim($sandbox_workspace_dir, '/')])) {
                 $sandbox_workspace_adoptions[$sandbox_workspace_name] = array(
                     'success' => true,
                     'skipped' => true,
-                    'reason' => 'linked_worktree_mount',
-                    'message' => 'Mounted linked worktrees are treated as sandbox workspaces, not Data Machine primary checkouts.',
+                    'reason' => 'repo_backed_mount',
+                    'message' => 'Mounted repo-backed workspaces are treated as sandbox workspaces, not Data Machine primary checkouts.',
                 );
                 continue;
             }

packages/cli/src/commands/recipe-run.ts

@@ -1,7 +1,8 @@
 import { createHash } from "node:crypto"
-import { readdir, readFile, stat, writeFile } from "node:fs/promises"
+import { cp, mkdtemp, readdir, readFile, rm, stat, writeFile } from "node:fs/promises"
+import { tmpdir } from "node:os"
 import { basename, dirname, join, resolve } from "node:path"
-import { DEFAULT_WORDPRESS_VERSION, artifactBundleRunRef, artifactManifestFile, createBenchResultsJsonSchema, createRuntime, refreshArtifactManifestFileSha256s, stripUndefined, upsertArtifactManifestFiles, type ArtifactBundle, type ArtifactManifest, type ArtifactManifestFile, type BenchmarkArtifactRef, type BenchResults, type ExecutionResult, type Runtime, type RuntimeAssetSpec, type RuntimePreviewSpec, type RuntimeRunRecord, type RuntimeRunRegistry, type WorkspaceRecipe, type WorkspaceRecipeDeclaredArtifact, type WorkspaceRecipeFixtureDatabase, type WorkspaceRecipePluginRuntimeHealthProbe, type WorkspaceRecipeProbe, type WorkspaceRecipeSiteSeed } from "@automattic/wp-codebox-core"
+import { DEFAULT_WORDPRESS_VERSION, artifactBundleRunRef, artifactManifestFile, createBenchResultsJsonSchema, createRuntime, refreshArtifactManifestFileSha256s, stripUndefined, upsertArtifactManifestFiles, type ArtifactBundle, type ArtifactManifest, type ArtifactManifestFile, type BenchmarkArtifactRef, type BenchResults, type ExecutionResult, type Runtime, type RuntimeAssetSpec, type RuntimePreviewSpec, type RuntimeRunRecord, type RuntimeRunRegistry, type WorkspaceRecipe, type WorkspaceRecipeDeclaredArtifact, type WorkspaceRecipeFixtureDatabase, type WorkspaceRecipeMount, type WorkspaceRecipePluginRuntimeHealthProbe, type WorkspaceRecipeProbe, type WorkspaceRecipeSiteSeed } from "@automattic/wp-codebox-core"
 import { createPlaygroundRuntimeBackend } from "@automattic/wp-codebox-playground"
 import { Ajv2020 } from "ajv/dist/2020.js"
 import { recipeExecutionSpec, sandboxWorkspaceContract } from "../agent-sandbox.js"
@@ -125,6 +126,7 @@ async function runRecipe(options: RecipeRunOptions, interruption?: RecipeInterru
   let dependencyOverlays: PreparedDependencyOverlay[] = []
   let stagedFiles: PreparedStagedFile[] = []
   let overlays: PreparedRuntimeOverlay[] = []
+  const inputMountBaselinePaths: string[] = []
   let backendPackage: PreparedRuntimeBackendPackage | undefined
   let runtime: Awaited<ReturnType<typeof createRuntime>> | undefined
   const executions: RecipeExecutionResult[] = []
@@ -308,12 +310,13 @@ async function runRecipe(options: RecipeRunOptions, interruption?: RecipeInterru
 
     for (const mount of recipe.inputs?.mounts ?? []) {
       const source = resolve(recipeDirectory, mount.source)
+      const metadata = await inputMountMetadataWithBaseline(source, mount, inputMountBaselinePaths)
       await awaitRecipe(`input.mount:${mount.target}`, runtime.mount({
         type: await recipeMountType(source, mount.type),
         source,
         target: mount.target,
         mode: mount.mode ?? "readwrite",
-        metadata: mount.metadata,
+        metadata,
       }))
       interruption?.throwIfInterrupted()
     }
@@ -416,6 +419,7 @@ async function runRecipe(options: RecipeRunOptions, interruption?: RecipeInterru
     cleanupEvidence = await runRecipeCleanup(runRegistry, runRecord, async () => {
       await awaitRecipe("runtime.release", releaseRuntime(activeRuntime, successfulRecipe ? options.previewHoldSeconds : 0))
       await cleanupRecipePreparedSources(workspaceMounts, extraPlugins, stagedFiles, overlays, dependencyOverlays)
+      await cleanupInputMountBaselines(inputMountBaselinePaths)
     })
     runRecord = await runRegistry.read(runRecord.runId)
     interruption?.throwIfInterrupted()
@@ -529,7 +533,10 @@ async function runRecipe(options: RecipeRunOptions, interruption?: RecipeInterru
       }
     }
 
-    cleanupEvidence = await runRecipeCleanup(runRegistry, runRecord, () => cleanupRecipePreparedSources(workspaceMounts, extraPlugins, stagedFiles, overlays, dependencyOverlays))
+    cleanupEvidence = await runRecipeCleanup(runRegistry, runRecord, async () => {
+      await cleanupRecipePreparedSources(workspaceMounts, extraPlugins, stagedFiles, overlays, dependencyOverlays)
+      await cleanupInputMountBaselines(inputMountBaselinePaths)
+    })
     runRecord = await runRegistry.read(runRecord.runId)
     const serializedError = interruption?.metadata ? recipeInterruptionSerializedError(interruption.metadata) : serializeRecipeRunError(error)
     runRecord = await runRegistry.update(runRecord.runId, {
@@ -1644,6 +1651,59 @@ function recipeRunMetadata(recipe: WorkspaceRecipe, recipePath: string, workspac
   }
 }
 
+async function inputMountMetadataWithBaseline(source: string, mount: WorkspaceRecipeMount, cleanupPaths: string[]): Promise<Record<string, unknown> | undefined> {
+  const metadata = mount.metadata ? { ...mount.metadata } : {}
+  if ((mount.mode ?? "readwrite") !== "readwrite") {
+    return Object.keys(metadata).length > 0 ? metadata : undefined
+  }
+  if (typeof metadata.baselineSource === "string" && metadata.baselineSource.length > 0) {
+    return metadata
+  }
+
+  let sourceStats
+  try {
+    sourceStats = await stat(source)
+  } catch {
+    return Object.keys(metadata).length > 0 ? metadata : undefined
+  }
+  if (!sourceStats.isDirectory() || await hasGitMetadata(source)) {
+    return Object.keys(metadata).length > 0 ? metadata : undefined
+  }
+
+  const baselineSource = await mkdtemp(join(tmpdir(), "wp-codebox-input-mount-baseline-"))
+  cleanupPaths.push(baselineSource)
+  await cp(source, baselineSource, {
+    recursive: true,
+    filter: (entry) => shouldCopyInputMountBaselineEntry(source, entry),
+  })
+  metadata.baselineSource = baselineSource
+  metadata.baselineStrategy = "input-mount-snapshot"
+  return metadata
+}
+
+async function cleanupInputMountBaselines(paths: string[]): Promise<void> {
+  await Promise.all(paths.map((path) => rm(path, { recursive: true, force: true })))
+  paths.length = 0
+}
+
+async function hasGitMetadata(directory: string): Promise<boolean> {
+  try {
+    await stat(join(directory, ".git"))
+    return true
+  } catch {
+    return false
+  }
+}
+
+function shouldCopyInputMountBaselineEntry(sourceRoot: string, entry: string): boolean {
+  const relativePath = entry.slice(sourceRoot.length).replace(/^\/+/, "")
+  if (!relativePath) {
+    return true
+  }
+  const firstSegment = relativePath.split("/")[0]
+  return firstSegment !== ".git" && firstSegment !== "node_modules"
+}
+
 function recipeRunDependencyOverlay(overlay: PreparedDependencyOverlay): Record<string, unknown> {
   return {
     source: overlay.source,

packages/runtime-playground/src/artifacts.ts

@@ -152,7 +152,7 @@ interface RedactionResult {
 
 export const MAX_CAPTURED_MOUNT_FILES = 200
 export const MAX_CAPTURED_MOUNT_FILE_BYTES = 1024 * 1024
-export const SKIPPED_CAPTURE_DIRECTORIES = new Set([".git", "node_modules"])
+export const SKIPPED_CAPTURE_DIRECTORIES = new Set([".git", "node_modules", "target"])
 
 const packageRequire = createRequire(import.meta.url)
 

packages/runtime-playground/src/mount-materialization.ts

@@ -116,7 +116,7 @@ export function vfsMountSnapshotPhp(hostSnapshots: HostMountSnapshot[]): string
   const payload = JSON.stringify(JSON.stringify({ mounts: hostSnapshots }))
   return `<?php
 $payload = json_decode(${payload}, true);
-$skip = array_fill_keys(array('.git', 'node_modules'), true);
+$skip = array_fill_keys(array('.git', 'node_modules', 'target'), true);
 
 function wp_codebox_vfs_mount_files(string $root, array $host_hashes, array $skip): array {
     $files = array();

scripts/agent-sandbox-code-smoke.ts

@@ -107,8 +107,9 @@ async function main() {
   assert.doesNotMatch(code, /Bounded tree/, "sandbox chat should not inject Data Machine directive tree output")
   assert.match(code, /datamachine_code_remote_workspace_backend_should_handle/, "sandbox mode should use the mounted workspace backend")
   assert.match(code, /is_file\(\$sandbox_workspace_dir \. '\/.git'\)/, "sandbox setup should detect linked worktree mounts")
-  assert.match(code, /linked_worktree_mount/, "sandbox setup should report linked worktree mounts as non-fatal diagnostics")
-  assert.ok(code.indexOf("linked_worktree_mount") < code.indexOf("$sandbox_adopt_result = $sandbox_adopt_ability->execute"), "linked worktree mounts should be skipped before Data Machine workspace adoption")
+  assert.match(code, /\$sandbox_repo_backed_mounts/, "sandbox setup should track repo-backed mounts from the workspace contract")
+  assert.match(code, /repo_backed_mount/, "sandbox setup should report repo-backed mounts as non-fatal diagnostics")
+  assert.ok(code.indexOf("repo_backed_mount") < code.indexOf("$sandbox_adopt_result = $sandbox_adopt_ability->execute"), "repo-backed mounts should be skipped before Data Machine workspace adoption")
   assert.match(code, /\\"tool_policy\\":\{\\"mode\\":\\"allow\\",\\"tools\\":\[\\"workspace_read\\",\\"workspace_write\\",\\"workspace_edit\\"\]/, "sandbox agent tool policy should include only sandbox-visible runtime tool ids")
   assert.match(code, /wp_codebox_import_sandbox_agent_bundles/, "sandbox setup should import declared runtime agent bundles")
   assert.match(code, /wp_agent_import_runtime_bundles/, "sandbox setup should consume the generic runtime bundle helper")