feat: 工作区缓存层 + Agent 自动重启，确保 CLAUDE.md 正确加载

[lishuceo]

Summary

• Agent 自动重启机制：当 setup_workspace MCP tool 在 query 运行中切换工作目录后，自动以新 cwd 发起第二次 query，确保 CLAUDE.md 从一开始就生效
• Bare clone 缓存层：维护本地 bare clone 镜像，readonly/writable 模式都通过 local clone 获得独立工作树，秒级完成
• readonly/writable 模式：Claude 根据语义自主选择 mode 参数，只读分析不创建分支，修改代码才创建 feature branch
• 安全加固：git clone/fetch 禁用 hooks/submodules/file 协议，URL 路径穿越校验，认证信息剥离
• taskQueue 集成：修复同一 chat 的 query 未串行化的并发问题

Changes

文件	说明
src/workspace/cache.ts	新增：bare clone 缓存管理（URL 解析、路径穿越校验、缓存 CRUD、原子创建、过期清理）
src/workspace/manager.ts	增加 mode 参数，接入缓存层，writable 模式剥离 URL 认证信息
src/workspace/tool.ts	MCP tool schema 增加 mode 参数
src/claude/executor.ts	ExecuteOptions、restart 信号、disableWorkspaceTool、system prompt mode 引导
src/claude/types.ts	ClaudeResult 增加 restart 字段、新增 ExecuteOptions
src/feishu/event-handler.ts	taskQueue 集成、restart 逻辑、sendResultCard 提取
src/config.ts	新增 repoCache 配置组
src/index.ts	启动时清理 tmp、定时清理过期缓存
docs/workspace-cache-and-restart.md	设计文档

Follow-up

以下运维健壮性增强项留作后续实现：

• flock 并发控制（fetch 与 clone 互斥）
• 基于总大小的 LRU 缓存清理（REPO_CACHE_MAX_SIZE_GB）
• session 过期联动删除工作区磁盘目录

Test plan

• 112 个单元测试全部通过（新增 52 个）
• TypeScript 类型检查通过
• 手动验证：发送包含 GitHub URL 的消息，确认 workspace setup → restart → CLAUDE.md 加载
• 手动验证：readonly 模式不创建 feature branch
• 手动验证：第二次访问同一仓库走 bare cache（秒级 clone）

🤖 Generated with Claude Code

[claude]

Claude finished @lishuceo's task in 6m 5s —— View job

---

Code Review: ⚠️ Issues Found

Reviewed all 16 changed files across the bare clone cache layer, agent restart mechanism, and taskQueue integration.

---

Issues

• 🔴 Unhandled promise rejection in event-handler.ts (Confidence: 90) — taskQueue.enqueue() returns a Promise that is never awaited or .catch()-ed. When the task rejects, this causes an unhandled promise rejection that can crash the Node.js process. See comment →

• 🟡 Cache cleanup operates at wrong directory level in cache.ts (Confidence: 80) — cleanupExpiredCaches() only descends 2 levels (host/owner), but cache paths are 3 levels deep (host/owner/repo.git). This causes cleanup to check the owner directory's atime instead of individual repo caches, potentially deleting all repos under an owner or missing stale individual repos. See comment →

• 🟡 Dead code / inconsistent branch value in manager.ts (Confidence: 85) — The branch variable (line 109) is computed but unused in the writable path (shadowed by branchName on line 159). The readonly return uses 'default' instead of the computed 'HEAD', creating an inconsistency. See comment →

---

Overall Assessment

The architecture is well-designed — the bare clone cache layer, atomic creation with tmp+rename, and the restart mechanism for CLAUDE.md loading are solid patterns. The security hardening (hooks disabled, submodules blocked, path traversal checks, credential stripping) is thorough. The sendResultCard extraction and cost/duration merging across restart queries are clean.

The critical issue is the unhandled promise rejection which can crash the process in production. The cache cleanup granularity bug would cause incorrect cleanup behavior but is lower severity since it only affects the periodic maintenance path. Both should be fixed before merge.

[claude]

Claude finished @lishuceo's task in 3m 4s —— View job

---

Code Review: ✅ All Previous Issues Fixed

Reviewed all 16 changed files after the latest commit (0fa5f71).

---

Previous Issues — All Resolved

Issue	Status
🔴 Unhandled promise rejection in event-handler.ts	✅ Fixed — .catch(() => {}) added at line 189
🟡 Cache cleanup at wrong directory level in cache.ts	✅ Fixed — recursive cleanupExpiredRecursive now correctly identifies .git directories as cache units
🟡 Dead code / inconsistent branch in manager.ts	✅ Fixed — unused branch variable removed, readonly path returns `sourceBranch

New Issues

No new issues found with confidence ≥ 75.

Overall Assessment

All three issues from the previous review have been properly addressed. The code is clean:

• Restart mechanism (event-handler.ts): The two-phase query flow with disableWorkspaceTool to prevent infinite loops, session status checks before restart, and cost/duration merging across queries is well-implemented.
• Bare clone cache (cache.ts): Atomic creation via tmp+rename, path traversal protection, recursive cleanup targeting .git directories, and stale-fetch tolerance are all solid.
• Security (manager.ts, cache.ts): Git hooks disabled, submodules blocked, file protocol restricted, credential stripping via sanitizeRepoUrl, branch name validation — thorough coverage.
• Queue integration (event-handler.ts, queue.ts): Promise rejection properly handled, processQueue drains correctly via .finally() chaining.

This PR is ready for merge from a code quality perspective.

[claude]

Claude finished @lishuceo's task in 2m 8s —— View job

---

Code Review: ✅ No Issues Found

• Check and resolve previous review comments
• Read current diff and all changed files
• Review for bugs, security, architecture issues
• Post final summary

---

Reviewed all changed source files across the bare clone cache layer (cache.ts, git-security.ts), workspace manager (manager.ts, tool.ts), agent restart mechanism (executor.ts, event-handler.ts), queue integration (queue.ts), and configuration (config.ts, index.ts, types.ts).

Previous Issues — All Resolved

3 previous issues fixed and threads resolved:

Issue	Status
🔴 Unhandled promise rejection in event-handler.ts	✅ Fixed — .catch(() => {}) added
🟡 Cache cleanup at wrong directory level in cache.ts	✅ Fixed — recursive cleanup targets .git directories
🟡 Dead code / inconsistent branch in manager.ts	✅ Fixed — unused variable removed

New Issues

No new issues found with confidence ≥ 75.

Assessment

The merged code is clean. Key observations:

• Queue serialization (event-handler.ts:86-98): processQueue correctly uses dequeue's running guard + .finally() chaining to ensure one-at-a-time execution per chat, with the next task picked up automatically.
• Restart loop prevention (executor.ts:99-101): disableWorkspaceTool completely removes the MCP tool on restart, making infinite loops impossible.
• Atomic cache creation (cache.ts:130-158): tmp directory + renameSync pattern is solid. Concurrent bare clones for the same repo would result in one overwriting the other via atomic rename (safe on Linux), and the follow-up notes flock for optimization.
• Security (git-security.ts, cache.ts:64-70, manager.ts:84-91): execFileSync prevents command injection, path traversal is guarded at multiple layers (segment validation + resolve prefix check + realpathSync for symlinks), credentials are stripped from logged/stored URLs.
• Cost merging (event-handler.ts:522-523): Correctly handles undefined costs with ?? 0 fallback across both query phases.