@defrex/autobuild 0.11.0 → 0.13.0

package/packages/core/src/cli/pr-summary-publication.ts

@@ -0,0 +1,220 @@
+import { summaryBoundary, pendingSummaryRequests } from '../kernel/pr-summary'
+export { summaryBoundary, pendingSummaryRequests } from '../kernel/pr-summary'
+import type { AbEvent } from '../events/catalog'
+import { KERNEL } from '../events/envelope'
+import { isRemoteWorkspace } from '../events/workspace-remote'
+import { reduceBuild } from '../kernel/reducer'
+import { currentPrAttachments } from '../kernel/pr-attachments'
+import { openExecution } from '../processes/execution-settlement'
+import type { Forge } from '../ports/types'
+import { githubRateLimitUntil } from '../ports/forge/github-transport'
+import { summaryMarker } from '../ports/forge/summary-marker'
+import type { BuildStore, Clock } from '../store/types'
+import { html, shellQuote, renderPrSummary } from './pr-summary'
+
+export const SUMMARY_LIMIT = 65_536
+
+interface SummaryDeps {
+  store: BuildStore
+  forge: Forge
+  slug: string
+  workspacePath: string
+  storeRef: string
+  clock: Clock
+}
+
+/** No credentials are accepted by the renderer. The full oversized projection
+ * is deliberately not designated, avoiding recursive growth. */
+export async function boundedSummary(
+  deps: SummaryDeps,
+  events: readonly AbEvent[],
+): Promise<string> {
+  const env = {
+    build: deps.slug,
+    store: deps.storeRef,
+    phase: 'finalize' as const,
+    round: 1,
+    session: '',
+  }
+  const full = renderPrSummary(env, events)
+  if (full.length <= SUMMARY_LIMIT) return full
+  const meta = await deps.store.putArtifact(deps.slug, {
+    kind: 'pr-summary',
+    content: full,
+    metadata: {},
+  })
+  const command = `ab artifact download ${shellQuote(deps.slug)} ${shellQuote(`pr-summary@${meta.revision}`)} --store ${shellQuote(deps.storeRef)} --output pr-summary.md`
+  const compact = [
+    summaryMarker(deps.slug),
+    `## Autobuild: ${html(deps.slug)}`,
+    '',
+    `The full summary exceeds the comment limit. It includes ${currentPrAttachments(events).length} PR attachments.`,
+    `Store: <code>${html(deps.storeRef)}</code>`,
+    '',
+    'Download the complete summary, including all pinned artifact commands and hosted links:',
+    `<pre><code>${html(command)}</code></pre>`,
+  ].join('\n')
+  if (compact.length > SUMMARY_LIMIT) throw new Error('Summary locator exceeds comment limit')
+  return compact
+}
+
+/** Caller owns the exclusive build lease and has fenced guest execution.
+ * Claim-before-effect plus CAS also fences overlapping refresh triggers. */
+export async function publishSummary(
+  deps: SummaryDeps,
+  boundary: { occurrence: number; boundary: number },
+): Promise<'attempted' | 'skipped' | 'deferred'> {
+  try {
+    const events = await deps.store.getEvents(deps.slug)
+    const pr = reduceBuild(events).pr
+    if (pr === undefined) return 'skipped'
+    if (
+      events.some(
+        (event) =>
+          event.type === 'pr-summary.attempted' && event.payload.occurrence === boundary.occurrence,
+      )
+    )
+      return 'attempted'
+    if (
+      events.some(
+        (event) =>
+          event.type === 'pr-summary.result' &&
+          event.payload.eligibleAfter !== undefined &&
+          Date.parse(event.payload.eligibleAfter) > deps.clock().getTime(),
+      )
+    )
+      return 'deferred'
+    const claim = await deps.store.appendIfCurrent(deps.slug, events.at(-1)?.seq ?? 0, {
+      actor: KERNEL,
+      type: 'pr-summary.attempted',
+      payload: { ...boundary, pr: pr.number },
+    })
+    if (claim === null) return 'skipped'
+    let outcome: 'success' | 'failure' | 'rate-limited' = 'success'
+    let eligibleAfter: string | undefined
+    try {
+      const body = await boundedSummary(deps, await deps.store.getEvents(deps.slug))
+      await deps.forge.commentOnPr(deps.workspacePath, pr.number, body)
+    } catch (error) {
+      eligibleAfter = githubRateLimitUntil(error, deps.clock().getTime())
+      outcome = eligibleAfter === undefined ? 'failure' : 'rate-limited'
+    }
+    await deps.store.append(deps.slug, {
+      actor: KERNEL,
+      type: 'pr-summary.result',
+      payload: {
+        attempt: claim.seq,
+        outcome,
+        ...(eligibleAfter === undefined ? {} : { eligibleAfter }),
+      },
+    })
+    return 'attempted'
+  } catch {
+    return 'skipped'
+  }
+}
+
+/** Local boundary or durable guest handoff. Optional refresh failures never
+ * prevent pipeline progress, including a failed request deposit. */
+export async function refreshSummaryBoundary(deps: SummaryDeps): Promise<boolean> {
+  try {
+    const events = await deps.store.getEvents(deps.slug)
+    const boundary = summaryBoundary(events)
+    if (boundary === undefined) return false
+    const workspace = events.findLast((event) => event.type === 'workspace.provisioned')
+    if (workspace?.type === 'workspace.provisioned' && isRemoteWorkspace(workspace.payload)) {
+      const request = events.find(
+        (event) =>
+          event.type === 'pr-summary.requested' && event.payload.occurrence === boundary.occurrence,
+      )
+      if (request !== undefined) {
+        // A lost result/disposition append must not repeatedly park a guest.
+        if (
+          events.some(
+            (event) =>
+              event.type === 'pr-summary.attempted' &&
+              event.payload.occurrence === boundary.occurrence,
+          )
+        )
+          return false
+        if (
+          events.some(
+            (event) =>
+              event.type === 'pr-summary.result' &&
+              event.payload.eligibleAfter !== undefined &&
+              Date.parse(event.payload.eligibleAfter) > deps.clock().getTime(),
+          )
+        )
+          return false
+        return pendingSummaryRequests(events).some((event) => event.seq === request.seq)
+      }
+      if (
+        reduceBuild(events).pr === undefined &&
+        !events.some(
+          (event) =>
+            event.type === 'publication.requested' && event.payload.operation === 'finalize',
+        )
+      )
+        return false
+      const written = await deps.store.appendIfCurrent(deps.slug, events.at(-1)?.seq ?? 0, {
+        actor: KERNEL,
+        type: 'pr-summary.requested',
+        payload: boundary,
+      })
+      return written !== null
+    }
+    await publishSummary(deps, boundary)
+  } catch {
+    /* Optional publication cannot fail phase execution. */
+  }
+  return false
+}
+
+/** Host-only, after execution settlement. Reuse a launch reservation only
+ * before execution.start; otherwise acquire and release our own lease. */
+export async function settleSummaryRequests(
+  deps: SummaryDeps & { holder: string; reservation?: string },
+): Promise<void> {
+  let acquired = false
+  let heartbeat: ReturnType<typeof setInterval> | undefined
+  try {
+    let events = await deps.store.getEvents(deps.slug)
+    if (openExecution(events) !== null) return
+    // Repair a crash after terminal/session completion but before guest handoff.
+    const workspace = events.findLast((event) => event.type === 'workspace.provisioned')
+    if (workspace?.type !== 'workspace.provisioned' || !isRemoteWorkspace(workspace.payload)) return
+    const holder = deps.reservation ?? deps.holder
+    acquired = await deps.store.claimLease(deps.slug, holder, 60_000)
+    if (!acquired) return
+    heartbeat = setInterval(() => {
+      void deps.store.heartbeat(deps.slug, holder).catch(() => {})
+    }, 15_000)
+    events = await deps.store.getEvents(deps.slug)
+    if (openExecution(events) !== null) return
+    await refreshSummaryBoundary(deps)
+    events = await deps.store.getEvents(deps.slug)
+    const requests = pendingSummaryRequests(events)
+    const latest = requests.at(-1)
+    for (const request of requests) {
+      if (request.type !== 'pr-summary.requested') continue
+      const disposition =
+        request === latest ? await publishSummary(deps, request.payload) : 'skipped'
+      await deps.store.append(deps.slug, {
+        actor: KERNEL,
+        type: 'pr-summary.settled',
+        payload: { request: request.seq, disposition },
+      })
+    }
+  } catch {
+    /* Best effort, separate from branch publication and phase outcome. */
+  } finally {
+    if (heartbeat !== undefined) clearInterval(heartbeat)
+    if (acquired && deps.reservation === undefined) {
+      try {
+        await deps.store.releaseLease(deps.slug, deps.holder)
+      } catch {
+        /* lease expires */
+      }
+    }
+  }
+}

package/packages/core/src/cli/pr-summary.ts

@@ -1,3 +1,4 @@
+import { summaryMarker } from '../ports/forge/summary-marker'
 import type { AbEvent } from '../events/catalog'
 import {
   currentPrAttachments,
@@ -106,6 +107,7 @@ export function renderPrSummary(env: CliEnv, events: readonly AbEvent[]): string
   }
 
   return [
+    summaryMarker(env.build),
     `## Autobuild: ${html(env.build)}`,
     '',
     '### Verdict history',

package/packages/core/src/cli/project-credentials.ts

@@ -0,0 +1,132 @@
+import { createHash, randomUUID } from 'node:crypto'
+import {
+  constants,
+  fstatSync,
+  chmodSync,
+  lstatSync,
+  mkdirSync,
+  openSync,
+  closeSync,
+  readFileSync,
+  writeFileSync,
+  renameSync,
+  unlinkSync,
+} from 'node:fs'
+import { homedir } from 'node:os'
+import { isAbsolute, join } from 'node:path'
+import { normalizeServiceURL } from '../connection'
+import { normalizeGitRemoteUrl } from '../kernel/origin'
+
+export interface ProjectCredential {
+  service: string
+  repo: string
+  id: string
+  token: string
+}
+export class ProjectCredentials {
+  readonly directory: string
+  constructor(env: Record<string, string | undefined> = process.env) {
+    const root = env.XDG_CONFIG_HOME
+    if (root && !isAbsolute(root))
+      throw new Error('XDG_CONFIG_HOME must be absolute for project credentials')
+    this.directory = join(
+      root ||
+        (env.HOME && isAbsolute(env.HOME) ? join(env.HOME, '.config') : join(homedir(), '.config')),
+      'autobuild',
+      'credentials',
+    )
+  }
+  private path(service: string, repo: string): string {
+    return join(
+      this.directory,
+      `${createHash('sha256')
+        .update(JSON.stringify([normalizeServiceURL(service), normalizeGitRemoteUrl(repo)]))
+        .digest('hex')}.json`,
+    )
+  }
+  private guard(path: string): boolean {
+    try {
+      const info = lstatSync(path)
+      if (!info.isFile() || info.isSymbolicLink()) throw new Error('unsafe credential file')
+      return true
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code === 'ENOENT') return false
+      throw error
+    }
+  }
+  load(service: string, repo: string): ProjectCredential | undefined {
+    try {
+      const path = this.path(service, repo)
+      if (!this.guard(path)) return undefined
+      const directory = lstatSync(this.directory)
+      if (directory.isSymbolicLink() || (directory.mode & 0o777) !== 0o700) throw new Error()
+      const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW)
+      let entry: ProjectCredential
+      try {
+        if ((fstatSync(fd).mode & 0o777) !== 0o600) throw new Error()
+        entry = JSON.parse(readFileSync(fd, 'utf8'))
+      } finally {
+        closeSync(fd)
+      }
+      if (
+        entry.service !== normalizeServiceURL(service) ||
+        entry.repo !== normalizeGitRemoteUrl(repo) ||
+        typeof entry.id !== 'string' ||
+        typeof entry.token !== 'string' ||
+        !/^[a-f0-9]{32}$/.test(entry.id) ||
+        !new RegExp(`^abp_1_${entry.id}_[a-f0-9]{64}$`).test(entry.token)
+      )
+        throw new Error()
+      return entry
+    } catch {
+      throw new Error(
+        'Cannot read project credential; repair user credential storage and run ab connect',
+      )
+    }
+  }
+  save(entry: ProjectCredential): void {
+    const path = this.path(entry.service, entry.repo)
+    let temporary: string | undefined
+    try {
+      mkdirSync(this.directory, { recursive: true, mode: 0o700 })
+      if (lstatSync(this.directory).isSymbolicLink()) throw new Error()
+      chmodSync(this.directory, 0o700)
+      this.guard(path)
+      temporary = `${path}.${randomUUID()}`
+      const fd = openSync(temporary, 'wx', 0o600)
+      try {
+        writeFileSync(fd, `${JSON.stringify(entry)}\n`)
+      } finally {
+        closeSync(fd)
+      }
+      renameSync(temporary, path)
+    } catch {
+      throw new Error('Cannot save project credential; check user credential directory permissions')
+    } finally {
+      if (temporary) {
+        try {
+          unlinkSync(temporary)
+        } catch {
+          /* renamed or absent */
+        }
+      }
+    }
+  }
+  remove(service: string, repo: string): void {
+    const path = this.path(service, repo)
+    if (this.guard(path)) unlinkSync(path)
+  }
+}
+export function projectToken(
+  service: string,
+  repo: string,
+  env: Record<string, string | undefined>,
+): string | undefined {
+  if (env.AB_TOKEN !== undefined && env.AB_TOKEN !== '') return env.AB_TOKEN
+  try {
+    normalizeServiceURL(service)
+  } catch {
+    return undefined
+  }
+  return new ProjectCredentials(env).load(service, repo)?.token
+}

package/packages/core/src/cli/repo-state.ts

@@ -20,6 +20,7 @@
  * normalized against that checkout so the dispatcher and agents cannot
  * interpret a relative path from different working directories.
  */
+import { configuredStore } from './configured-store'
 import { basename, dirname, isAbsolute, join, resolve } from 'node:path'
 import type { Exec } from '../ports/workspace/git-worktree'
 import type { BuildRecord } from '../store/types'
@@ -92,6 +93,8 @@ export async function resolveMainRepo(targetRepo: string, exec: Exec): Promise<s
 }
 
 export interface RepoStatePaths {
+  /** Validated repository setting used for this selection, when present. */
+  configStore?: string
   /** Repository identity in BuildStore records/journals: the checkout's
    * normalized origin URL, falling back to the resolved checkout path only
    * when the checkout has no origin remote. Opaque to the store schema. */
@@ -116,7 +119,7 @@ function nonBlank(value: string | undefined): string | undefined {
 
 /**
  * Select state with one precedence rule for every sessionless command:
- * non-blank explicit `--store` > non-blank `AB_STORE` > repository-local default.
+ * non-blank explicit `--store` > non-blank `AB_STORE` > `[store] url` > local default.
  *
  * A local selection relocates the whole local tree, including worktrees. A
  * remote store has no filesystem root, so its worktrees remain local beneath
@@ -130,14 +133,20 @@ export function resolveRepoStatePaths(opts: {
   checkout?: string
   storeRef?: string
   envStore?: string
+  configStore?: string
 }): RepoStatePaths {
   const checkout = resolve(opts.checkout ?? opts.repo)
   const defaultLocalRoot = join(checkout, LOCAL_STATE_DIR)
-  const selected = nonBlank(opts.storeRef) ?? nonBlank(opts.envStore) ?? defaultLocalRoot
+  const selected =
+    nonBlank(opts.storeRef) ??
+    nonBlank(opts.envStore) ??
+    nonBlank(opts.configStore) ??
+    defaultLocalRoot
   const remote = isRemoteStoreRef(selected)
   const storeRef = remote ? selected : resolve(checkout, selected)
   const localStateRoot = remote ? defaultLocalRoot : storeRef
   return {
+    ...(opts.configStore !== undefined ? { configStore: opts.configStore } : {}),
     repo: opts.repo,
     checkout,
     defaultLocalRoot,
@@ -223,10 +232,14 @@ export async function resolveRepoState(opts: {
   exec: Exec
   storeRef?: string
   envStore?: string
+  configStore?: string
 }): Promise<RepoStatePaths> {
   const checkout = await resolveMainRepo(opts.targetRepo, opts.exec)
   const origin = await resolveRepoOrigin(checkout, opts.exec)
   return resolveRepoStatePaths({
+    configStore:
+      opts.configStore ??
+      (nonBlank(opts.storeRef) || nonBlank(opts.envStore) ? undefined : configuredStore(checkout)),
     repo: origin ?? checkout,
     checkout,
     ...(opts.storeRef !== undefined ? { storeRef: opts.storeRef } : {}),

package/packages/core/src/cli/self-update.ts

@@ -1,3 +1,5 @@
+import { join } from 'node:path'
+import { checkUpgradeCompatibility, type CompatibilityFetch } from './upgrade-compatibility'
 import { readFile, writeFile } from 'node:fs/promises'
 import semver from 'semver'
 import type { ExecResult } from '../ports/workspace/git-worktree'
@@ -71,6 +73,7 @@ export function registryVersion(response: { status: number; body: string }): str
 
 export interface SelfUpdateOptions {
   targetRepo: string
+  compatibilityFetch?: CompatibilityFetch
   version?: string
   distRoot?: string
   env?: Record<string, string | undefined>
@@ -361,6 +364,7 @@ export async function selfUpdate(options: SelfUpdateOptions): Promise<SelfUpdate
   const inspection = await inspectInstallation({
     distRoot,
     globalBin: globalBinResult.stdout.trim(),
+    cwd: options.targetRepo,
   })
   if (inspection.kind !== 'bun-forge' && inspection.kind !== 'npm-registry') {
     return explicit ? fail(options, inspection.reason) : warn(options, inspection.reason)
@@ -393,6 +397,14 @@ export async function selfUpdate(options: SelfUpdateOptions): Promise<SelfUpdate
     return { kind: 'continue' }
   }
 
+  await checkUpgradeCompatibility({
+    targetRepo: options.targetRepo,
+    version: resolved,
+    env: options.env,
+    stderr: options.stderr,
+    fetch: options.compatibilityFetch,
+  })
+
   const dependency = updateDependency(install, resolved)
   let updateCommand: string[]
   if (install.scope === 'global') {
@@ -459,7 +471,9 @@ export async function selfUpdate(options: SelfUpdateOptions): Promise<SelfUpdate
 
   let updated: DistributionIdentity
   try {
-    updated = await readDistributionIdentity(distRoot)
+    updated = await readDistributionIdentity(
+      join(install.ownerRoot, 'node_modules', ...install.packageName.split('/')),
+    )
     // Injected command fixtures do not rewrite disk; a real successful Bun
     // operation must. Keep the check injectable by accepting the old identity
     // only when the command seam itself was supplied.

package/packages/core/src/cli/store-opening.ts

@@ -6,6 +6,8 @@
  * joins those seams to the production remote adapter and owns finite-command
  * store lifecycle.
  */
+import { projectToken } from './project-credentials'
+import { isRemoteStoreRef } from './repo-state'
 import type { Exec } from '../ports/workspace/git-worktree'
 import { RemoteBuildStore } from '../store/remote/client'
 import { scopeLocalStoreToPhaseSession } from '../store/phase-session'
@@ -16,7 +18,7 @@ import {
   type CliEnv,
   type HarvestCliEnv,
 } from './env'
-import { isRemoteStoreRef, resolveRepoState, type RepoStatePaths } from './repo-state'
+import { resolveRepoState, type RepoStatePaths } from './repo-state'
 import { resolveStore } from './store-ref'
 
 /** Shared injection seam used by every command that opens a BuildStore. */
@@ -39,15 +41,14 @@ export const openProductionStore: StoreOpener = (ref, token) => {
 }
 
 /** Apply validated ambient authority to a selected Store handle. Remote
- * handles retain token-backed server authorization; filesystem handles receive
- * the equivalent in-process scope. Keeping this primitive shared prevents
+ * handles retain server-side project authorization; every handle receives
+ * the same in-process build/session scope. Keeping this primitive shared prevents
  * phase commands and ambient-aware query commands from drifting. */
 function scopeSelectedStoreToPhaseSession(
   store: BuildStore,
-  ref: string,
+  _ref: string,
   env: AmbientReadSession,
 ): BuildStore {
-  if (isRemoteStoreRef(ref)) return store
   return scopeLocalStoreToPhaseSession(
     store,
     'build' in env
@@ -65,15 +66,15 @@ export interface OpenedStoreContext extends RepoStatePaths {
   store: BuildStore
   token?: string
   /** The validated ambient phase/Harvest identity this invocation carries, if
-   * any — the same value that scoped `store` on the local path. Exposed so a
-   * command core can extend own-resource authority to remote handles too,
-   * where no session wrapper exists. */
+   * any — the same value that scoped `store`. Exposed for commands whose
+   * repository selection also depends on ambient own-build authority. */
   ambient?: AmbientReadSession
 }
 
 export interface OpenStoreForRepoStateOpts {
   env: Record<string, string | undefined>
   openStore?: StoreOpener
+  useProjectCredential?: boolean
 }
 
 /** Open from an already canonicalized state selection. Dispatch uses this form
@@ -82,7 +83,13 @@ export function openStoreForRepoState(
   state: RepoStatePaths,
   opts: OpenStoreForRepoStateOpts,
 ): OpenedStoreContext {
-  const token = optionalToken(opts.env.AB_TOKEN)
+  const token =
+    opts.useProjectCredential !== false && isRemoteStoreRef(state.storeRef)
+      ? projectToken(state.storeRef, state.repo, opts.env)
+      : optionalToken(opts.env.AB_TOKEN)
+  if (!token && isRemoteStoreRef(state.storeRef) && state.configStore === state.storeRef) {
+    throw new Error('No project credential for this service; run ab connect')
+  }
   const store = (opts.openStore ?? openProductionStore)(state.storeRef, token)
   return {
     ...state,
@@ -115,10 +122,8 @@ export async function openSessionlessStore(
 /** Finite command ownership boundary. Opening failures occur before the
  * try/finally, so only a successfully returned handle is ever closed.
  *
- * Remote store handles do not session-scope (bearer authorization is the
- * server's concern), so a command core that needs own-build authority must
- * consume `ambient` from the context directly rather than rely on the handle
- * enforcing a scope. */
+ * Ambient query openers apply in-process build/session scope to both local
+ * and remote handles; the server additionally enforces project authority. */
 export async function withSessionlessStore<T>(
   opts: SessionlessStoreOpts,
   use: (context: OpenedStoreContext) => Promise<T> | T,
@@ -145,7 +150,10 @@ export async function openAmbientReadStore(
     ...(opts.storeRef !== undefined ? { storeRef: opts.storeRef } : {}),
     ...(opts.env.AB_STORE !== undefined ? { envStore: opts.env.AB_STORE } : {}),
   })
-  const context = openStoreForRepoState(state, opts)
+  const context = openStoreForRepoState(state, {
+    ...opts,
+    useProjectCredential: ambient === undefined,
+  })
   if (ambient === undefined) return context
   return {
     ...context,

package/packages/core/src/cli/terminals.ts

@@ -50,7 +50,6 @@ import type { ArtifactMeta, BuildStore } from '../store/types'
 import { textContent } from '../store/types'
 import { expandIssues } from '../zod-issues'
 import { preparePrAttachments } from './pr-attachments'
-import { renderPrSummary } from './pr-summary'
 import type { CliEnv } from './env'
 
 /** Structural subset of CliDeps (src/cli/main.ts) — what terminals need. */
@@ -441,15 +440,6 @@ export async function completeFinalizePr(
     }
   }
 
-  try {
-    await deps.forge.commentOnPr(
-      deps.workspacePath,
-      pr.number,
-      renderPrSummary(env, await store.getEvents(env.build)),
-    )
-  } catch {
-    // The durable audit trail remains authoritative.
-  }
   return event
 }
 

package/packages/core/src/cli/ticket-assets.ts

@@ -42,6 +42,7 @@ export function ticketAssetNote(
   event: TicketAssetNoteEvent,
   meta: TicketAssetMeta,
   cli = 'ab',
+  hosted = false,
 ): string {
   const fileCount = meta.entries.filter((entry) => entry.type === 'file').length
   const label = `\`${meta.kind}/${meta.name}\``
@@ -52,7 +53,9 @@ export function ticketAssetNote(
       return [
         `Ticket asset attached: ${label} (revision ${meta.revision}, ${contents}).`,
         '',
-        'The contents live in the Autobuild store, not in this ticket.',
+        hosted
+          ? 'The contents live in the ticket service storage.'
+          : 'The contents live in the Autobuild store, not in this ticket.',
         `Download the latest revision: \`${get}\``,
         `Download this exact revision: \`${get} --rev ${meta.revision}\``,
       ].join('\n')
@@ -60,7 +63,9 @@ export function ticketAssetNote(
       return [
         `Ticket asset replaced: ${label} is now revision ${meta.revision} (${contents}).`,
         '',
-        'The contents live in the Autobuild store, not in this ticket. Earlier revisions stay retrievable.',
+        hosted
+          ? 'The contents live in the ticket service storage. Earlier revisions stay retrievable.'
+          : 'The contents live in the Autobuild store, not in this ticket. Earlier revisions stay retrievable.',
         `Download the latest revision: \`${get}\``,
         `Download this exact revision: \`${get} --rev ${meta.revision}\``,
       ].join('\n')