@codedology/code-forge 0.5.1 → 0.6.0

package/src/cli/block.mjs

@@ -2,7 +2,7 @@
  * `code-forge block open|attempt|rebase|claim|close|stop` (plan §4.9). The skill calls
  * `block open` before every spawn in every engine; it prints the brief pointer (≤ 200 bytes).
  *
- *   block open <id> --run <r> --level L<n> --owned <paths…> --acceptance <file>
+ *   block open <id> --run <r> [--level L<n>] --owned <paths…> --acceptance <file>
  *              [--brief <file>] [--attempt <n>] [--base <sha>] [--lines <forecast>] [--kind code|docs|contract]
  *   block attempt <id> --run <r>
  *   block rebase <id> --run <r> [--head <ref>]
@@ -33,6 +33,11 @@
  * FAILED: no review-file ticket id for <files>` (skipped under `--no-require-reviews`, the human's
  * way out). It runs after the review rows and reuses their file set (listed once).
  *
+ * B47: `block open` without `--level` takes the level `autopilot level` chose for the block (the
+ * latest `autopilot.level` row of the run for it whose MAC verifies, `autopilotLevel`); with
+ * neither it is a usage error (`no --level given and no autopilot level recorded for <id>`). An
+ * explicit `--level` always wins; a repeated or valueless `--level` is a usage error as before.
+ *
  * `--acceptance` is a YAML/JSON list of `{clause, tests: [test ids…]}`. `block close` runs B8's
  * rows of the gate (worker pin, MACs, orphans); the gate rows owned by later blocks join it
  * through `closeBlock`'s `extraChecks`.
@@ -41,13 +46,14 @@
 import { readFile, realpath } from 'node:fs/promises';
 import path from 'node:path';
 import { parse as parseYAML } from 'yaml';
+import { approvalCheckText, expiryChecks } from '../autopilot/limits.mjs';
 import { appendRow, readAllRows } from '../ledger/write.mjs';
 import { attemptBlock, claimPath, closeBlock, openBlock, rebaseBlock, stopBlock } from '../state/block.mjs';
 import { intFlag, parseFlags } from '../state/cli-args.mjs';
 import { StateError } from '../state/paths.mjs';
 import { findOverlap } from '../state/registry.mjs';
 import { readRun, writeSigned } from '../state/run.mjs';
-import { loadKey } from '../state/signer.mjs';
+import { loadKey, verifyRow } from '../state/signer.mjs';
 import { blockFileSet, reviewGateCheck, waiveFinding } from '../review/gate-check.mjs';
 import { writeSafe } from '../util/redact.mjs';
 import { DEFAULT_CONFIG_FILENAME, loadProjectConfig } from '../config/load.mjs';
@@ -58,7 +64,7 @@ import { gitChildEnv } from '../worker/ticket.mjs';
 import { missingReviewTickets } from '../engines/sentinel.mjs';
 
 const USAGE =
-  'usage: code-forge block open <id> --run <r> --level L<n> --owned <paths…> --acceptance <file> [--brief <file>] [--attempt <n>] [--base <sha>] [--lines <n>] [--kind code|docs|contract]\n' +
+  'usage: code-forge block open <id> --run <r> [--level L<n>] --owned <paths…> --acceptance <file> [--brief <file>] [--attempt <n>] [--base <sha>] [--lines <n>] [--kind code|docs|contract]\n' +
   '       code-forge block attempt|rebase <id> --run <r> · block close <id> --run <r> [--transcript <file>] [--report <file>] [--no-require-reviews] · block claim <id> <path> --run <r> · block stop <id> --run <r> --reason <text>\n' +
   '       code-forge block waive <id> <finding-id> --run <r> --file <path> --reason <text>\n';
 
@@ -67,7 +73,8 @@ const FLAG_VALUES = ['run', 'level', 'acceptance', 'brief', 'attempt', 'base', '
 
 /**
  * @param {string[]} args
- * @param {{stdout?: {write: (s: string) => unknown}, stderr?: {write: (s: string) => unknown}, probe?: import('../state/run.mjs').StartTimeProbe}} [deps]
+ * @param {{stdout?: {write: (s: string) => unknown}, stderr?: {write: (s: string) => unknown}, probe?: import('../state/run.mjs').StartTimeProbe, now?: () => Date}} [deps] -
+ *   `now` (B48): the clock of the autopilot expiry checks.
  * @returns {Promise<number>}
  */
 export async function runBlock(args, deps = {}) {
@@ -84,7 +91,7 @@ export async function runBlock(args, deps = {}) {
     const [id, extra] = positionals;
     const runId = typeof flags.run === 'string' ? flags.run : undefined;
     if (!id || !runId) throw new StateError('usage', 'a block id and --run are required');
-    if (sub === 'open' && (typeof flags.acceptance !== 'string' || !Array.isArray(flags.owned) || typeof flags.level !== 'string')) {
+    if (sub === 'open' && (typeof flags.acceptance !== 'string' || !Array.isArray(flags.owned) || (flags.level !== undefined && typeof flags.level !== 'string'))) {
       throw new StateError('usage', 'block open needs --level, --owned and --acceptance');
     }
     if (sub === 'claim' && (!extra || positionals.length !== 2)) throw new StateError('usage', 'block claim needs exactly one path');
@@ -93,8 +100,18 @@ export async function runBlock(args, deps = {}) {
     if (sub === 'waive' && typeof flags.file !== 'string') throw new StateError('usage', 'block waive needs --file <path> (a finding id is scoped to one file)');
     const record = await readRun(runId);
     const writeRow = (/** @type {Record<string, any>} */ row) => appendRow(row, { slug: record.project });
+    // B48: every block command runs the lazy autopilot checks (grant expiry, expired approvals);
+    // a failed check is a warning, never a reason to stop the block command
+    try {
+      err(approvalCheckText(await expiryChecks(runId, (deps.now ?? (() => new Date()))(), { writeRow })));
+    } catch (thrown) {
+      err(`autopilot: WARN the expiry check failed (${thrown?.message ?? String(thrown)})\n`);
+    }
 
     if (sub === 'open') {
+      // B47: no --level ⇒ the level autopilot chose for the block (a signed autopilot.level row)
+      const level = typeof flags.level === 'string' ? flags.level : await autopilotLevel(runId, id, record);
+      if (level === null) throw new StateError('usage', `no --level given and no autopilot level recorded for ${id}`);
       const acceptance = parseYAML(await readFile(/** @type {string} */ (flags.acceptance), 'utf8'), { prettyErrors: false });
       let brief;
       if (typeof flags.brief === 'string') {
@@ -106,7 +123,7 @@ export async function runBlock(args, deps = {}) {
       const { block, pointer } = await openBlock({
         runId,
         id,
-        level: /** @type {string} */ (flags.level),
+        level,
         owned: /** @type {string[]} */ (flags.owned),
         acceptance,
         attempt: intFlag(flags.attempt, 'attempt'),
@@ -117,8 +134,9 @@ export async function runBlock(args, deps = {}) {
         cfg: await openConfig(record.workspace),
         writeRow,
       });
-      const raised = block.level !== flags.level ? ` (${block.kind} floor, asked ${flags.level})` : '';
-      out(`block ${id} open · ${block.level}${raised} · ${block.kind} · attempt ${block.attempt} · base ${block.base_sha.slice(0, 12)}\n`);
+      const raised = block.level !== level ? ` (${block.kind} floor, asked ${level})` : '';
+      const chosen = typeof flags.level === 'string' ? '' : ' (autopilot level)';
+      out(`block ${id} open · ${block.level}${raised}${chosen} · ${block.kind} · attempt ${block.attempt} · base ${block.base_sha.slice(0, 12)}\n`);
       out(`${pointer ?? 'brief: none given (--brief <file>)'}\n`);
       return 0;
     }
@@ -204,6 +222,20 @@ export async function runBlock(args, deps = {}) {
   return 2;
 }
 
+/**
+ * B47: the level `autopilot level` chose for the block — the latest `autopilot.level` row of this
+ * run for it whose MAC verifies — or null when there is none.
+ * @param {string} runId @param {string} id @param {Record<string, any>} record
+ * @returns {Promise<string | null>}
+ */
+async function autopilotLevel(runId, id, record) {
+  const rows = (await readAllRows(record.project)).filter((r) => r?.event === 'autopilot.level' && r.run === runId && r.block === id && typeof r.level === 'string');
+  if (rows.length === 0) return null;
+  const key = await loadKey(runId);
+  const valid = rows.filter((r) => verifyRow(r, key).ok);
+  return valid.length === 0 ? null : valid[valid.length - 1].level;
+}
+
 /**
  * The project config for `block open`'s coder floor (B34): the loaded `.code-forge.yml`, or
  * undefined when there is none or it does not load — the floor then takes its default (L1), the

package/src/cli/facts.mjs

@@ -11,13 +11,12 @@
 
 import { accessSync, constants, statSync } from 'node:fs';
 import path from 'node:path';
-import { loadProjectConfig } from '../config/load.mjs';
+import { loadProjectConfig, slugFor } from '../config/load.mjs';
 import { buildFacts, FactsError } from '../session/facts.mjs';
 import { runRootFor, SessionError } from '../session/spawn.mjs';
 import { intFlag, parseFlags } from '../state/cli-args.mjs';
 import { StateError } from '../state/paths.mjs';
 import { redact, writeSafe } from '../util/redact.mjs';
-import { slugFor } from './run.mjs';
 import { exitCodeFor } from './spawn.mjs';
 
 /**

package/src/cli/jev.mjs

@@ -31,7 +31,7 @@
 
 import { randomUUID } from 'node:crypto';
 import { readFile } from 'node:fs/promises';
-import { loadConfigFile, DEFAULT_CONFIG_FILENAME } from '../config/load.mjs';
+import { loadConfigFile, DEFAULT_CONFIG_FILENAME, slugFor } from '../config/load.mjs';
 import path from 'node:path';
 import { buildQuestionPayload, isKnownQuestion, isQuestionDisabled } from '../decide/questions.mjs';
 import { askJev as realAskJev } from '../decide/jev-client.mjs';
@@ -40,7 +40,6 @@ import { resolveDispatchQuestionsByRules } from '../decide/fallback-rules.mjs';
 import { createDefaultKeyStore, resolveKey } from '../keys/store.mjs';
 import { appendRow as realAppendRow } from '../ledger/write.mjs';
 import { writeSafe } from '../util/redact.mjs';
-import { slugFor } from './run.mjs';
 
 const USAGE = 'usage: code-forge jev ask <question-id> --state <file> [--cwd <dir>] [--slug <slug>] [--key-ref <ref>] [--block <id>] [--plan <file>] [--rules]\n';
 

package/src/cli/logs.mjs

@@ -33,7 +33,7 @@
  */
 
 import { spawn } from 'node:child_process';
-import { accessSync, constants as fsConstants, readFileSync, statSync } from 'node:fs';
+import { readFileSync } from 'node:fs';
 import { mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
@@ -43,7 +43,7 @@ import { NO_ERROR_LOG_ENV, capBytes, createScrubber, describeCounts, errorLogPat
 import { compareVersions, fixStatus, loadKnownFixes } from '../util/known-fixes.mjs';
 import { redact, writeSafe } from '../util/redact.mjs';
 import { currentRunRoot } from '../util/tmp.mjs';
-import { SECRET_LOOKING_PATTERNS } from '../config/secret-patterns.mjs';
+import { GH_TIMEOUT_MS, findReported, findSecret, ghWithBodyFile, pathLookup } from '../util/gh.mjs';
 import { intFlag, parseFlags } from '../state/cli-args.mjs';
 import { AI_REPORT_MAX_BYTES, applyItems, describeAiCounts, runAiScrub } from '../session/scrub.mjs';
 
@@ -83,7 +83,8 @@ export const DISCLOSURE = disclosure();
 
 export const CONFIRM_MESSAGE = 'This will be public on GitHub. Send it?';
 
-const GH_TIMEOUT_MS = 60_000;
+// the secret check and the gh helpers live in `util/gh.mjs` (shared with B47's waiver issues)
+export { REPORT_SECRET_RULES, entropy, findSecret } from '../util/gh.mjs';
 const NPM_TIMEOUT_MS = 10_000;
 /** `code-forge doctor --json` for `--with-doctor` gets at most this long. */
 export const DOCTOR_TIMEOUT_MS = 60_000;
@@ -117,64 +118,6 @@ export const PACKAGE_NAME = '@codedology/code-forge';
  *   the editor on the terminal (default: argv only, stdio inherited, never a shell).
  */
 
-/**
- * Secret shapes the final report is checked for, after scrubbing. A hit stops the report.
- * @type {ReadonlyArray<{name: string, re: RegExp}>}
- */
-export const REPORT_SECRET_RULES = Object.freeze([
-  { name: 'API key (sk-)', re: /(?<![A-Za-z0-9_-])sk-[A-Za-z0-9_-]{10,}/ },
-  { name: 'GitHub token', re: /(?<![A-Za-z0-9_])(?:gh[opsur]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,})/ },
-  { name: 'Slack token', re: /(?<![A-Za-z0-9_-])xox[abprs]-[A-Za-z0-9-]{10,}/ },
-  { name: 'AWS access key', re: /(?<![A-Za-z0-9])AKIA[0-9A-Z]{16}(?![0-9A-Z])/ },
-  { name: 'private key', re: /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----/ },
-  { name: 'JWT', re: /(?<![A-Za-z0-9_-])eyJ[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}/ },
-  // copied without g/y: `.test()` must carry no `lastIndex` state between checks
-  ...SECRET_LOOKING_PATTERNS.map((re) => ({ name: 'secret-shaped token', re: new RegExp(re.source, re.flags.replace(/[gy]/g, '')) })),
-]);
-
-/** @param {string} s @returns {number} Shannon entropy in bits per character */
-export function entropy(s) {
-  /** @type {Map<string, number>} */
-  const freq = new Map();
-  for (const ch of s) freq.set(ch, (freq.get(ch) ?? 0) + 1);
-  let bits = 0;
-  for (const n of freq.values()) {
-    const p = n / s.length;
-    bits -= p * Math.log2(p);
-  }
-  return bits;
-}
-
-/**
- * A 32+ character run of `[A-Za-z0-9+/_=-]` with at least two of upper/lower/digit and entropy of
- * at least 4 bits per character (a hex hash tops out at 4 and is not flagged; a random token is).
- * @param {string} line
- * @returns {boolean}
- */
-function hasHighEntropyRun(line) {
-  for (const m of line.matchAll(/[A-Za-z0-9+/_=-]{32,}/g)) {
-    const run = m[0];
-    const classes = [/[A-Z]/, /[a-z]/, /[0-9]/].filter((re) => re.test(run)).length;
-    if (classes >= 2 && entropy(run) >= 4) return true;
-  }
-  return false;
-}
-
-/**
- * The first secret-shaped text in `text` (rule name and 1-based line), or null. The matched text
- * itself is never returned.
- * @param {string} text
- * @returns {{rule: string, line: number}|null}
- */
-export function findSecret(text) {
-  const lines = text.split('\n');
-  for (let i = 0; i < lines.length; i += 1) {
-    for (const r of REPORT_SECRET_RULES) if (r.re.test(lines[i])) return { rule: r.name, line: i + 1 };
-    if (hasHighEntropyRun(lines[i])) return { rule: 'high-entropy string', line: i + 1 };
-  }
-  return null;
-}
-
 /**
  * `owner/repo` from package.json `bugs.url`, else `repository` (string or `{url}`).
  * @param {any} [pkg]
@@ -197,21 +140,6 @@ export function issueRepo(pkg) {
   return null;
 }
 
-/** @param {string} pathEnv @returns {(cmd: string) => boolean} */
-function pathLookup(pathEnv) {
-  return (cmd) =>
-    pathEnv.split(path.delimiter).some((dir) => {
-      if (!dir) return false;
-      try {
-        const f = path.join(dir, cmd);
-        accessSync(f, fsConstants.X_OK);
-        return statSync(f).isFile();
-      } catch {
-        return false;
-      }
-    });
-}
-
 /** @param {ErrorEntry} e */
 function command(e) {
   return e.sub ? `${e.verb} ${e.sub}` : e.verb;
@@ -895,72 +823,6 @@ async function editBody(body, env, deps, out) {
   }
 }
 
-/**
- * An earlier issue holding `fp` in its body (open or closed): `{hit}` (null when there is none),
- * or `{why}` when the search failed (`gh exit n`; never gh's output).
- * @param {typeof realExec} exec @param {NodeJS.ProcessEnv} env @param {string} repo @param {string} fp
- * @returns {Promise<{hit: {number: number, url: string, state: string}|null} | {why: string}>}
- */
-async function findReported(exec, env, repo, fp) {
-  const res = await ghRun(exec, ['gh', 'issue', 'list', '--repo', repo, '--state', 'all', '--search', `${fp} in:body`, '--json', 'number,url,state', '--limit', '5'], env);
-  if (res.result !== 'ok') return { why: res.code !== null ? `gh exit ${res.code}` : res.timedOut ? 'gh timed out' : 'gh did not finish' };
-  let list;
-  try {
-    list = JSON.parse(res.stdout);
-  } catch {
-    return { why: 'gh gave no list' };
-  }
-  if (!Array.isArray(list)) return { why: 'gh gave no list' };
-  const hit = list.find((i) => Number.isSafeInteger(i?.number) && typeof i?.url === 'string' && /^https:\/\//.test(i.url));
-  return { hit: hit ? { number: hit.number, url: hit.url, state: typeof hit.state === 'string' ? hit.state.toLowerCase() : 'unknown' } : null };
-}
-
-/**
- * Write `text` to a private temp file and run the first argv of `argvsFor(file)`; when it fails
- * over a label, run the next one (once).
- * @param {typeof realExec} exec @param {NodeJS.ProcessEnv} env @param {string} text
- * @param {(file: string) => string[][]} argvsFor
- * @param {(stdout: string) => void} [onOk]
- * @returns {Promise<string|null>} null when gh succeeded; else why (`exit n`, never its output).
- */
-async function ghWithBodyFile(exec, env, text, argvsFor, onOk) {
-  /** @type {string|null} */
-  let dir = null;
-  try {
-    let res;
-    try {
-      const root = currentRunRoot();
-      await mkdir(root, { recursive: true });
-      dir = await mkdtemp(path.join(root, 'report-'));
-      const bodyFile = path.join(dir, 'body.md');
-      await writeFile(bodyFile, text, { encoding: 'utf8', mode: 0o600 });
-      const [first, retry] = argvsFor(bodyFile);
-      res = await ghRun(exec, first, env);
-      // gh's stderr is matched to decide the retry, never printed
-      if (res.result !== 'ok' && retry && /label/i.test(res.stderr)) res = await ghRun(exec, retry, env);
-    } catch {
-      return 'could not write the report file';
-    }
-    if (res.result !== 'ok') return res.code !== null ? `exit ${res.code}` : res.timedOut ? 'timed out' : 'did not finish';
-    onOk?.(res.stdout);
-    return null;
-  } finally {
-    if (dir !== null) await rm(dir, { recursive: true, force: true }).catch(() => {});
-  }
-}
-
-/**
- * @param {typeof realExec} exec @param {string[]} argv @param {NodeJS.ProcessEnv} env
- * @returns {Promise<{result: string, code: number|null, timedOut: boolean, stdout: string, stderr: string}>}
- */
-async function ghRun(exec, argv, env) {
-  try {
-    return await exec(argv, { env, timeoutMs: GH_TIMEOUT_MS });
-  } catch {
-    return { result: 'failed', code: null, timedOut: false, stdout: '', stderr: '' };
-  }
-}
-
 /**
  * The prefilled issue-form link: the form's `details` field holds the whole body (GitHub fills an
  * issue form's fields from query parameters named by field id).

package/src/cli/plan.mjs

@@ -12,14 +12,13 @@
 
 import { readFileSync } from 'node:fs';
 import path from 'node:path';
-import { loadProjectConfig } from '../config/load.mjs';
+import { loadProjectConfig, slugFor } from '../config/load.mjs';
 import { ledgerPath } from '../ledger/paths.mjs';
 import { readAllRows } from '../ledger/write.mjs';
 import { checkPlan } from '../session/plan-check.mjs';
 import { parseFlags } from '../state/cli-args.mjs';
 import { StateError } from '../state/paths.mjs';
 import { writeSafe } from '../util/redact.mjs';
-import { slugFor } from './run.mjs';
 
 const USAGE = 'usage: code-forge plan check <plan-file> [--facts <sheet>] [--slug <slug>]\n';
 

package/src/cli/run.mjs

@@ -22,37 +22,18 @@
  * run record per ticket — no restart).
  */
 
-import { readdirSync } from 'node:fs';
 import path from 'node:path';
-import { DEFAULT_CONFIG_FILENAME, loadProjectConfig } from '../config/load.mjs';
-import { loadSeenInCache } from '../config/refresh.mjs';
-import { validateConfig } from '../config/validate.mjs';
+import { reloadFailureText, reloadWorkspace } from '../autopilot/limits.mjs';
+import { DEFAULT_CONFIG_FILENAME, loadProjectConfig, slugFor } from '../config/load.mjs';
 import { budgetUsdOf, runSpend } from '../ledger/spend.mjs';
 import { appendRow, readAllRows } from '../ledger/write.mjs';
 import { intFlag, parseFlags } from '../state/cli-args.mjs';
 import { StateError } from '../state/paths.mjs';
-import { endRun, processStartTime, readRun, reattachWorker, reloadRun, startRun, stopPinnedWorker } from '../state/run.mjs';
+import { endRun, processStartTime, readRun, reattachWorker, startRun, stopPinnedWorker } from '../state/run.mjs';
 import { writeSafe } from '../util/redact.mjs';
 import { sweepRoots, tmpBase } from '../util/tmp.mjs';
 import { launchWorker, repinWorker } from '../worker/loop.mjs';
-import { pendingTickets, queueDir } from '../worker/queue.mjs';
-import { repoRootOf, WorkerError } from '../worker/ticket.mjs';
-import { hasCliOnPath } from './validate.mjs';
-
-/**
- * `project.slug` from config, else the workspace directory name as a ledger slug. The configured
- * value is NOT trusted here: `startRun` refuses any slug outside `/^[a-z0-9][a-z0-9-]*$/`
- * (`bad-project`) before anything is written, so `../x` never reaches the ledger path. Run ids
- * are checked the same way by the state layer (`assertRunId`, `bad-run-id`).
- * @param {Record<string, any>} cfg @param {string} workspace
- * @returns {string}
- */
-export function slugFor(cfg, workspace) {
-  const configured = cfg?.project?.slug;
-  if (typeof configured === 'string' && configured.length > 0) return configured;
-  const derived = path.basename(workspace).toLowerCase().replace(/[^a-z0-9-]+/g, '-').replace(/^-+|-+$/g, '');
-  return derived || 'project';
-}
+import { repoRootOf } from '../worker/ticket.mjs';
 
 /**
  * B33: the run's spend so far (estimated USD from its ledger rows, open blocks included) and its
@@ -190,52 +171,29 @@ export async function runRun(args, deps = {}) {
 
 /**
  * `run reload --run <id>`: load + validate the workspace config, pin the queue's pending tickets
- * to the old snapshot and store the new one (`reloadRun`). Exit 0 on a reload or no change, 1 on a
- * config that does not load or validate, or on a refused key.
+ * to the old snapshot and store the new one (`reloadWorkspace` → `reloadRun`). Exit 0 on a reload
+ * or no change, 1 on a config that does not load or validate, or on a refused key. B48: while an
+ * autopilot grant is active, a change to a limit key is refused (`autopilot-limit`): only the
+ * owner changes one, with `code-forge autopilot approve` (the verb never passes its internal allow).
  * @param {string} runId
  * @param {{out: (s: string) => void, err: (s: string) => void}} io
  * @returns {Promise<number>}
  */
 async function reloadVerb(runId, { out, err }) {
-  const { project, workspace, status } = await readRun(runId);
-  if (status !== 'active') throw new StateError('run-ended', `run ${runId} has ended`);
-  const loaded = await loadProjectConfig(workspace);
-  if (!loaded.ok || !loaded.config) {
-    // never the parser's message: it can quote a line of the file
-    if (loaded.error === 'not-found') err(`run reload: no ${DEFAULT_CONFIG_FILENAME} in the workspace — nothing changed\n`);
+  const { project } = await readRun(runId);
+  const reloaded = await reloadWorkspace({ runId, writeRow: ledgerWriter(project) });
+  if (!reloaded.ok) {
+    if (reloaded.error === 'not-found') err(`run reload: no ${DEFAULT_CONFIG_FILENAME} in the workspace — nothing changed\n`);
+    else if (reloaded.error === 'parse-error') err(`run reload: the config could not be parsed (${DEFAULT_CONFIG_FILENAME}${reloaded.line ? `:${reloaded.line}` : ''}) — nothing changed\n`);
+    else if (reloaded.error !== 'invalid') err(`run reload: ${reloadFailureText(reloaded)} — nothing changed\n`);
     else {
-      const line = loaded.error === 'parse-error' ? /\(line (\d+), column \d+\)$/.exec(loaded.message ?? '')?.[1] : undefined;
-      err(`run reload: the config could not be parsed (${DEFAULT_CONFIG_FILENAME}${line ? `:${line}` : ''}) — nothing changed\n`);
+      // rule ids and key paths only: a validator message may quote a value
+      const errors = reloaded.errors ?? [];
+      const lines = errors.map((e) => `  [${e.rule}]${e.path ? ` ${e.path}` : ''}\n`);
+      err(`run reload: ${DEFAULT_CONFIG_FILENAME} is invalid (${errors.length} error${errors.length === 1 ? '' : 's'}) — nothing changed; run code-forge validate\n${lines.join('')}`);
     }
     return 1;
   }
-  const result = validateConfig(loaded.config, { seenInCache: await loadSeenInCache(), hasCliOnPath });
-  if (!result.valid) {
-    // rule ids and key paths only: a validator message may quote a value
-    const lines = result.errors.map((e) => `  [${e.rule}]${typeof e.path === 'string' && e.path.length > 0 ? ` ${e.path}` : ''}\n`);
-    err(`run reload: ${DEFAULT_CONFIG_FILENAME} is invalid (${result.errors.length} error${result.errors.length === 1 ? '' : 's'}) — nothing changed; run code-forge validate\n${lines.join('')}`);
-    return 1;
-  }
-  /** @type {string | null} */
-  let repoRoot = null;
-  try {
-    repoRoot = await repoRootOf(workspace);
-  } catch (thrown) {
-    if (!(thrown instanceof WorkerError && thrown.code === 'no-repo')) throw thrown;
-    // no repository: there is no review queue to pin
-  }
-  const queueRoot = repoRoot;
-  const readPending = () => {
-    if (queueRoot === null) return [];
-    try {
-      readdirSync(queueDir(queueRoot));
-    } catch (thrown) {
-      if (thrown?.code === 'ENOENT') return [];
-      throw new StateError('queue-unreadable', 'cannot read the review queue; nothing changed');
-    }
-    return pendingTickets(queueRoot);
-  };
-  const reloaded = await reloadRun({ runId, config: loaded.config, readPending, effectiveSlug: slugFor(loaded.config, workspace), writeRow: ledgerWriter(project) });
   if (reloaded.changed !== null && reloaded.changed.length === 0) {
     out(`run ${runId}: no config change\n`);
     return 0;

package/src/cli/s2.mjs

@@ -8,13 +8,12 @@
 
 import { readFile } from 'node:fs/promises';
 import path from 'node:path';
-import { loadProjectConfig } from '../config/load.mjs';
+import { loadProjectConfig, slugFor } from '../config/load.mjs';
 import { runS2 } from '../session/s2.mjs';
 import { runRootFor, SessionError } from '../session/spawn.mjs';
 import { intFlag, parseFlags } from '../state/cli-args.mjs';
 import { StateError } from '../state/paths.mjs';
 import { writeSafe } from '../util/redact.mjs';
-import { slugFor } from './run.mjs';
 import { exitCodeFor } from './spawn.mjs';
 
 /**

package/src/cli/spawn.mjs

@@ -10,12 +10,11 @@
 
 import { readFile } from 'node:fs/promises';
 import path from 'node:path';
-import { loadProjectConfig } from '../config/load.mjs';
+import { loadProjectConfig, slugFor } from '../config/load.mjs';
 import { ROLES, runRootFor, SessionError, spawnSession } from '../session/spawn.mjs';
 import { intFlag, parseFlags } from '../state/cli-args.mjs';
 import { StateError } from '../state/paths.mjs';
 import { writeSafe } from '../util/redact.mjs';
-import { slugFor } from './run.mjs';
 
 /**
  * @param {string} file @param {string} flag

package/src/config/closed-book.mjs

@@ -13,6 +13,11 @@
  *
  * Opt-in (default off): `review.allow_open_book_codex: true` lets Codex run those roles with its
  * read-only argv; every surface then shows {@link OPEN_BOOK_CODEX_WARNING} instead of refusing.
+ *
+ * B46: the autopilot `delegate` is closed-book too, and the opt-in does NOT open it
+ * ({@link NEVER_OPEN_BOOK_ROLES}): the delegate decides FOR the owner while the owner is away, so
+ * a delegate that could read files on this machine (a coder-written note, a planted "the owner
+ * says yes") would be deciding on material nobody vetted. Codex is refused for it, always.
  */
 
 /** The text every refusal prints: the builder, the spawner, `doctor`, `validate`, `resolve`. */
@@ -36,7 +41,13 @@ export function openBookCodexAllowed(cfg) {
 export const NO_CLOSED_BOOK_PROVIDER = 'openai';
 
 /** Roles that must run with no tools (facts is not one: it has read-only tools by design). */
-export const NO_TOOL_ROLES = Object.freeze(['reviewer', 'judge', 's2', 'author']);
+export const NO_TOOL_ROLES = Object.freeze(['reviewer', 'judge', 's2', 'author', 'delegate']);
+
+/**
+ * No-tools roles that `review.allow_open_book_codex` never opens (B46): the autopilot delegate
+ * decides for the owner, so it only ever runs with no tools at all.
+ */
+export const NEVER_OPEN_BOOK_ROLES = Object.freeze(['delegate']);
 
 /** Levels whose sessions are closed-book: L2 (reviewers), L3 (judge, S2, author). */
 export const CLOSED_BOOK_LEVELS = Object.freeze(['L2', 'L3']);
@@ -56,6 +67,11 @@ export function isNoToolRole(role) {
   return NO_TOOL_ROLES.includes(norm(role));
 }
 
+/** @param {unknown} role @returns {boolean} true when `role` (any case) is never opened by the opt-in. */
+export function isNeverOpenBookRole(role) {
+  return NEVER_OPEN_BOOK_ROLES.includes(norm(role));
+}
+
 /**
  * @param {unknown} provider @param {unknown} role - compared lowercased and trimmed.
  * @returns {boolean} true when `provider` cannot run `role` closed-book.
@@ -68,8 +84,9 @@ export function needsClosedBook(provider, role) {
  * @param {unknown} provider @param {unknown} role @param {boolean} openBookAllowed - the config's
  *   opt-in, read once by the caller with {@link openBookCodexAllowed}.
  * @returns {boolean} true when the session must be refused: `provider` cannot run `role`
- *   closed-book and the config has not opted in to open-book Codex.
+ *   closed-book and the config has not opted in to open-book Codex — or the role is one the
+ *   opt-in never opens (the delegate, B46).
  */
 export function closedBookRefused(provider, role, openBookAllowed) {
-  return needsClosedBook(provider, role) && openBookAllowed !== true;
+  return needsClosedBook(provider, role) && (openBookAllowed !== true || isNeverOpenBookRole(role));
 }

package/src/config/load.mjs

@@ -133,3 +133,18 @@ export async function loadConfigFile(filePath) {
 export async function loadProjectConfig(cwd = process.cwd()) {
   return loadConfigFile(path.join(cwd, DEFAULT_CONFIG_FILENAME));
 }
+
+/**
+ * `project.slug` from config, else the workspace directory name as a ledger slug. The configured
+ * value is NOT trusted here: `startRun` refuses any slug outside `/^[a-z0-9][a-z0-9-]*$/`
+ * (`bad-project`) before anything is written, so `../x` never reaches the ledger path. Run ids
+ * are checked the same way by the state layer (`assertRunId`, `bad-run-id`).
+ * @param {Record<string, any>} cfg @param {string} workspace
+ * @returns {string}
+ */
+export function slugFor(cfg, workspace) {
+  const configured = cfg?.project?.slug;
+  if (typeof configured === 'string' && configured.length > 0) return configured;
+  const derived = path.basename(workspace).toLowerCase().replace(/[^a-z0-9-]+/g, '-').replace(/^-+|-+$/g, '');
+  return derived || 'project';
+}