Harden Aider workspace handoff

src/lai_automation/agent.py

@@ -16,17 +16,7 @@ class AiderAgent:
         task_file = workspace / ".git" / "failure-task.txt"
         task_file.write_text(task)
         task_file.chmod(0o600)
-        command = [
-            self.settings.agent_command,
-            "--model",
-            self.settings.agent_model,
-            "--message-file",
-            str(task_file),
-            "--yes",
-            "--no-auto-commits",
-            "--no-dirty-commits",
-            "--no-stream",
-        ]
+        command = self.command(task_file)
         coder = pwd.getpwnam("coder")
         os.chown(task_file, coder.pw_uid, coder.pw_gid)
         for path in workspace.rglob("*"):
@@ -47,16 +37,39 @@ class AiderAgent:
             os.setgid(coder.pw_gid)
             os.setuid(coder.pw_uid)
 
-        result = subprocess.run(
-            command,
-            cwd=workspace,
-            env=environment,
-            text=True,
-            capture_output=True,
-            check=False,
-            preexec_fn=drop_privileges,
-            timeout=3600,
-        )
+        try:
+            result = subprocess.run(
+                command,
+                cwd=workspace,
+                env=environment,
+                text=True,
+                capture_output=True,
+                check=False,
+                preexec_fn=drop_privileges,
+                timeout=900,
+            )
+        finally:
+            os.chown(workspace, 0, coder.pw_gid, follow_symlinks=False)
+            workspace.chmod(0o775)
         if result.returncode != 0:
             raise RuntimeError(f"Aider failed ({result.returncode}): {result.stderr[-4000:]}")
         return result.stdout[-12_000:]
+
+    def command(self, task_file: Path) -> list[str]:
+        return [
+            self.settings.agent_command,
+            "--model",
+            self.settings.agent_model,
+            "--message-file",
+            str(task_file),
+            "--yes",
+            "--no-auto-commits",
+            "--no-dirty-commits",
+            "--no-stream",
+            "--no-gitignore",
+            "--chat-history-file",
+            "/dev/null",
+            "--input-history-file",
+            "/dev/null",
+            "--no-analytics",
+        ]

src/lai_automation/git.py

@@ -37,6 +37,8 @@ class GitWorkspace:
         shutil.rmtree(self.path, ignore_errors=True)
         self.path.parent.mkdir(parents=True, exist_ok=True)
         self._git("clone", "--branch", self.settings.source_branch, "--single-branch", self.settings.source_repository, str(self.path), cwd=self.path.parent)
+        self._git("config", "user.name", "LAI Automation")
+        self._git("config", "user.email", "automation@localhost")
         self._git("checkout", "-b", self.branch)
 
     def run(