Git-sourced deploys never materialized a checkout: sourcePath was
build_path resolved against the server cwd, so builds consumed the
backend's own directory. Remote placement could only run
registry-pulled images.
- internal/source: per-deployment checkout (init/fetch/checkout) at
branch or commit; GIT_ASKPASS keeps tokens out of argv, .git/config,
and the build context; dumb-transport and SHA-refusal fallbacks;
build_path validated inside the checkout.
- BuildManager.PackageContext: produces the same tar context Build
ships to the daemon — generated Dockerfile at tar root, .git
excluded. Fixes nixpacks passing the Dockerfile path as content.
- Agent artifact endpoint: GET /api/agents/artifacts/:id streams
build contexts and docker-save tarballs behind agent-token auth;
hex-validated ids, per-deployment cleanup, boot-time purge.
- Agent commands: build_image (docker build -, --build-arg values via
process env, not argv) and load_image (docker load for containr-*
rollback tags no registry serves).
- Deployment flow: remote git builds package context → artifact →
node docker-builds the deployment tag; remote rollbacks of local
tags export via SaveImage → artifact → node docker-loads.
Verified end-to-end: agent-pinned git service built on the node
(build_image → create_container → deployed) and rollback shipped a
docker-save tarball (load_image → deployed). Artifact auth returns
401/404 correctly; workspaces and blobs are removed after deploy.
Authored By: TDvorak <[email protected]>
