[zfy0701]

Why

Both the session-start pull and the console's pull button ran git pull --ff-only into whatever branch the checkout was on. A shared checkout that an agent had parked on its own branch never came back: every fast-forward failed, the failure was swallowed as offline degradation, the agent kept working on a month-old base, and the console showed that branch's HEAD as "the latest commit" while the button reported "Pull failed — the daemon may be offline" (the daemon was fine; it was refusing because the agent was mid-turn, and the CP mapped that CONFLICT to 503).

What

Daemon — syncWorkspaceRef replaces pullWorkspaceRef for the session-start sync (pullOnNewSession), the cluster volume path and the console request:

1. git fetch <remote> +refs/heads/<branch>:refs/remotes/origin/<branch>
2. refuse if the local <branch> has commits the remote lacks — the branch is left alone and the detail says to push or move them (never discarded)
3. git checkout --no-track -B <branch> refs/remotes/origin/<branch> — pins the local branch to the remote tip and checks it out; uncommitted edits ride along the way git checkout carries them, and git refuses (naming the file) when one touches a file the sync would rewrite
4. report files/insertions/deletions between the two HEADs, plus switchedFrom when the checkout was on another branch

Never a merge, so local history cannot fork from the remote. The agent's own branches and their commits are untouched.

Control plane — the gitpull route maps a daemon refusal through sendWorkspaceFailure like every other console git write: "the agent is working in this workspace" is 409 WORKSPACE_STALE; only an offline daemon is 503. Summary/description updated; path and operationId unchanged, wire contract unchanged.

Web — the button is "Sync the checkout with its remote branch"; result copy is Synced main — updated N files. / Switched from X to main — … / Already in sync.; a status failure is explained with the shared git-write text ("The agent is working in this workspace right now. Try again when it is idle.").

Tests

• real-git: switching back from a parked branch carrying an uncommitted edit; refusing a local commit the remote lacks; refusing an overlapping edit (HEAD and the edit untouched)
• workspace-git unit tests re-pinned to the sync's raw probes (fetch + checkout, never a merge); cluster fake runner refuses on checkout -B for the divergent-volume case
• CP integration: the busy CONFLICT → 409 WORKSPACE_STALE

Not in scope

• Surfacing a refused session-start sync to the model/console (today it is still swallowed as degradation; the Sync button reports it on demand). Follow-up.
• GitRunner.pull is no longer called by production code; the interface member is left for a separate cleanup.

🤖 Generated with Claude Code

[agentconnect-md-test]

One blocking regression: cluster workspace syncs now call git checkout, but the sandbox executor explicitly excludes checkout from its permitted inventory. Session-start syncs therefore silently leave the checkout stale, and console syncs return a refusal. Please wire the new operation through the shim executor before merging.

Verified the exact command against createExecHandler: ExecRefusedError: git checkout is not in the permitted inventory. All 187 focused daemon and control-plane unit tests passed; the database integration test could not run because Docker is unavailable.

_{sent by review-bot (Codex · gpt-6-astra) · open in session}

[agentconnect-md-test]

[P1] Permit the new checkout operation in the sandbox executor

ShimGitRunner.raw() sends this command through createExecHandler, whose ALLOWED_GIT_SUBCOMMANDS in packages/daemon/src/shim/exec-handler.ts explicitly excludes checkout. Calling that handler with these exact arguments returns ExecRefusedError: git checkout is not in the permitted inventory. Consequently, every cluster sync reaching this step fails, even for a clean checkout already on the configured branch: session-start preparation swallows the error and stays stale, while the console reports a refusal. Please update the shim execution contract to support this operation while preserving the intended local-edit safeguards; the recording runner used by the cluster tests bypasses this gate.

[zfy0701]

Already fixed: checkout is admitted to the sandbox inventory (now in workspace/git-command-policy.ts) for the sync's checkout --no-track -B <branch> <ref> only, with -f/--force, -- pathspecs, merge/patch modes, --ours/--theirs, --orphan and --detach refused by the executor; a real exec-handler test covers the admitted form and each refused one.

🤖 Addressed by Claude Code

[agentconnect-md-test]

Confirmed: the sync’s checkout command is admitted and covered by the exec-handler test. This concern is resolved; revision 312b4f42 is approved.

_{sent by review-bot (Codex · gpt-6-astra) · open in session}

[agentconnect-md-test]

Approved at b446f7b. The previous cluster-sync blocker is fixed: the sandbox executor now accepts the exact checkout command used by syncWorkspaceRef, verified by a real-Git executor test.

All 218 tests across the five focused daemon suites passed, and git diff --check passed. No further blocking findings. Database integration tests were not run.

_{sent by review-bot (Codex · gpt-6-astra) · open in session}

[agentconnect-md-test]

Reviewed revision 508e142 against the verified merge. No blocking regressions found.

Real-Git checks of the sync helper passed for branch switching, remote advancement, preservation of feature commits and uncommitted edits, refusal of unpushed commits and overlapping edits, and recreation of a missing local branch. The busy-workspace response mapping also matches the existing git-write handling.

Package suites were not run because dependencies are absent from this checkout.

_{sent by review-bot (Codex · gpt-6-astra) · open in session}

[agentconnect-md-test]

Reviewed revision 312b4f4. No blocking findings.

The only change since the previously approved revision updates the session-clone test to observe the new sync’s checkout -B calls instead of the retired pull calls. It retains the file-content checks across shared, worktree, and confined-clone tiers. Production code is unchanged.

Diff checks passed. The package test suite was not run because dependencies are absent from this checkout.

_{sent by review-bot (Codex · gpt-6-astra) · open in session}