@staix/agent-hub 0.28.0 → 0.29.0

package/src/hub/daemon.ts

@@ -45,6 +45,7 @@ import { createStalenessProbe } from "./memory-staleness.ts";
 import { matchingPlanFails, planGuardNodes, taskMemoryQueryNodes } from "./memory-plan-guard.ts";
 import { planningWipLimits } from "./planning.ts";
 import { ToolWriteRegistry, toolWriteOperation, toolWriteUnknownReply } from "./tool-request.ts";
+import { ControlWriteTelemetry, controlWriteMetadata, controlWriteSpan } from "./control-write-trace.ts";
 import { projectedDiff } from "./projected-diff.ts";
 import { listenWithoutPortCollision } from "./listen.ts";
 import { needs, type NeedsInput } from "../ui/needs.ts";
@@ -174,6 +175,7 @@ import { autonomyPreset, autonomyEnvironment, planAutonomy, autonomyRemovalKeys,
 import { readAutonomyDefaults } from "./autonomy-defaults.ts";
 import { AUTONOMY_UNDO, autonomyOwnershipDigest, autonomyUndoKeys, writeAutonomyPreset, LEARN_CHECKLIST, NEVER_EDITABLE, projectSettings, checkSettingValue, ignoredLine, pendingUndo, pendingUndoIdentity, readOverlay, restoredValue, routingCandidate, storedLocally, sharedValue, settingDef as instanceSettingDef, settingRefusal, settingRows, settingText, undoSetting, valueAt, writeConfigSetting, writeRoutingSetting, type SettingAuthority, type SettingSource, type SettingDef, type SettingRow, type SettingValue, type UndoIdentity } from "./settings.ts";
 import { githubOriginRepository, githubRemoteRepository } from "./task-repository.ts";
+import { TaskWorktrees, originVerdict } from "./task-worktree.ts";
 import { Bus } from "./bus.ts";
 import { attribute, deliveryTask, type TaskAttribution } from "./attribution.ts";
 import { DeliveryJournal } from "./delivery-journal.ts";
@@ -1208,7 +1210,7 @@ export async function startDaemon(opts: DaemonOptions) {
         let parsed: any;
         try {
           parsed = JSON.parse(String(data));
-          onMessage(sock, parsed);
+          onControlMessage(sock, parsed);
         } catch (e) {
           if (isDatabaseBusy(e) && sock.data.authed && Number.isSafeInteger(parsed?.rid)) {
             const busy = new RecoveryDatabaseBusy();
@@ -1718,10 +1720,11 @@ export async function startDaemon(opts: DaemonOptions) {
     for (const t of board.list("in_progress")) if (!tasks.isPii(t)) renewLeases(t);
   }
   let syncRun: Promise<void> | undefined;
+  let controlWriteTelemetry: ControlWriteTelemetry | undefined;
   /** Machine sync, when a person set a remote; one log line per failure, never a blocked turn. Stopping aborts and awaits it. */
   function syncNow(): Promise<void> {
     if (!memoryStore || syncRun || stopping) return syncRun ?? Promise.resolve();
-    syncRun = (async () => {
+    const run = async () => {
       try {
         checkMemory();
         const r = await (opts.memorySync ?? syncMemory)(memoryStore!, { signal: syncStop.signal });
@@ -1729,7 +1732,8 @@ export async function startDaemon(opts: DaemonOptions) {
         else if (r.warning) log(`hub memory sync: ${r.warning}`);
       } catch { /* A stale binding disables native memory, never the bus. */ }
       finally { syncRun = undefined; }
-    })();
+    };
+    syncRun = controlWriteTelemetry ? controlWriteTelemetry.observe("memory", () => !stopping, run) : run();
     return syncRun;
   }
 
@@ -2047,6 +2051,13 @@ export async function startDaemon(opts: DaemonOptions) {
     }).finally(() => { refreshingRunner = undefined; });
     return refreshingRunner;
   };
+  // #1115: the hub makes, commits and clears the task worktree of a hub-sandboxed peer. The sandbox profile is unchanged; the record file lives in the hub's state dir, which no sandbox root contains.
+  const taskWorktree = new TaskWorktrees({
+    root: opts.cwd, stateFile: join(opts.stateDir, "task-worktrees.json"),
+    applies: peer => definitionOf(peer)?.trust.hubSandboxed === true,
+    deny: () => config.local.deny, protectInstructions: () => config.protect_instruction_files,
+    pushAllowed: urls => originVerdict(shellProjectRepository, urls, url => githubRemoteRepository(url)),
+  });
   const peerCapabilities = () => {
     // Keep the last confirmed capability during a bounded, single-flight refresh; replace it only on a result.
     if (Date.now() - runnerStateAt >= 60_000) void refreshRunner();
@@ -2054,9 +2065,10 @@ export async function startDaemon(opts: DaemonOptions) {
     if (!definitionOf(peer)?.trust.hubSandboxed) return [peer, { tests: true, spec: true, network: true, worktree: true }];
     // #1081: Pi and the local worker run their shell under one sandbox network setting (`local.bash_network`): false is no network at all, an egress proxy or "direct" is some.
     const network = sandboxNetwork !== false;
-    // A hub sandbox never lets its shell run `git worktree add` (#270: it writes under the git common dir), so such a peer cannot create the task worktree. The hub-made writable worktree is #1115.
-    return [peer, { tests: runnerState.available && may(peer, "check_run"), spec: specState.available && may(peer, "spec_read"), network, worktree: false,
-      worktreeReason: "git worktree add runs outside the sandbox; this peer cannot create the task worktree (#270; a hub-made worktree is #1115)",
+    // A hub sandbox never lets its shell run `git worktree add` (#270: it writes under the git common dir), so the hub makes the task worktree for such a peer (#1115): the capability is whether it can here.
+    const hubWorktree = taskWorktree.available();
+    return [peer, { tests: runnerState.available && may(peer, "check_run"), spec: specState.available && may(peer, "spec_read"), network, worktree: hubWorktree.ok,
+      ...(hubWorktree.ok ? {} : { worktreeReason: `the hub cannot make a task worktree for it: ${hubWorktree.reason}; ${hubWorktree.next} (#1115)` }),
       ...(network ? {} : { networkReason: "local.bash_network is off, so its shell has no network (ahub settings local.bash_network)" }),
       testsReason: !may(peer, "check_run") ? `capabilities.${peer}` : `runner unavailable: ${runnerState.reason ?? "unknown"}`,
       specReason: !may(peer, "spec_read") ? `capabilities.${peer}` : specState.reason ?? "gh unauthenticated" }];
@@ -2129,7 +2141,7 @@ export async function startDaemon(opts: DaemonOptions) {
       if (why || configSourceTexts(opts.cwd)["config.local.json"] === null) throw new Error(`research.runners source trust unavailable${why ? `: ${why}` : ""}`);
       return parseResearchRunners(config.research.runners);
     },
-    capabilities: peerCapabilities, repository: memoryRepo,
+    capabilities: peerCapabilities, taskWorktree, repository: memoryRepo,
     contextAdmission: () => ({
       policy: { max_used: config.context.max_assignment_used ?? 0, stale_min: config.context.stale_min },
       peers: (config.context.max_assignment_used ?? 0) > 0 ? Object.fromEntries(bus.knownPeers().filter(peer => definitionOf(peer)?.budget?.context).map(peer => [peer,
@@ -2241,13 +2253,16 @@ export async function startDaemon(opts: DaemonOptions) {
         read: task => publicCorpus([task.title, ...task.refs.paths ?? [], ...task.plan?.paths ?? [], ...task.plan?.symbols ?? []].join(" "), () => corpusBriefAllowed(task)).map(item => ({ id: item.id, kind: "note", line: `${item.id}: ${item.text.replace(/\s+/g, " ")}` })),
       }),
     ...(memoryStore ? { planFails: (task: import("./board.ts").Task) => {
-      checkMemory();
-      const context = { cwd: opts.cwd, project: memoryProject, repo: memoryRepo, deny: config.local.deny };
-      const nodes = planGuardNodes(task, context);
-      const related = screenMemory(memoryStore.related(memoryProject, nodes, Number.MAX_SAFE_INTEGER));
-      const all = screenMemory(memoryStore.list({ project: memoryProject, kind: "fail", limit: Number.MAX_SAFE_INTEGER }));
-      const rows = [...new Map([...related, ...all].map(row => [row.id, row])).values()];
-      return matchingPlanFails(task, rows, context).slice(0, config.memory.brief_items).map(v => ({ id: `mem:${v.id}`, line: memoryLine(v), kind: v.kind, about: v.about }));
+      const read = () => {
+        checkMemory();
+        const context = { cwd: opts.cwd, project: memoryProject, repo: memoryRepo, deny: config.local.deny };
+        const nodes = planGuardNodes(task, context);
+        const related = screenMemory(memoryStore.related(memoryProject, nodes, Number.MAX_SAFE_INTEGER));
+        const all = screenMemory(memoryStore.list({ project: memoryProject, kind: "fail", limit: Number.MAX_SAFE_INTEGER }));
+        const rows = [...new Map([...related, ...all].map(row => [row.id, row])).values()];
+        return matchingPlanFails(task, rows, context).slice(0, config.memory.brief_items).map(v => ({ id: `mem:${v.id}`, line: memoryLine(v), kind: v.kind, about: v.about }));
+      };
+      return controlWriteTelemetry ? controlWriteTelemetry.observe("memory", controlWritePrivacyGuard(true, true, undefined, task.id), read) : read();
     } } : {}),
     ...(memoryStore ? { store: { store: memoryStore, project: memoryProject, repo: memoryRepo, deny: config.local.deny, onNote: (id: string) => void suggestEdges(id) } } : {}),
     notify,
@@ -2270,14 +2285,29 @@ export async function startDaemon(opts: DaemonOptions) {
         log(`note for ${peer} not kept: ${(e as Error).message}`);
       }
     },
-    triage: { classify: (title, detail) => inference?.triage(title, detail) ?? Promise.resolve(undefined), onCampus: () => onCampus() },
+    triage: {
+      classify: (title, detail) => {
+        const classify = () => inference?.triage(title, detail) ?? Promise.resolve(undefined);
+        return controlWriteTelemetry ? controlWriteTelemetry.observe("external", controlWritePrivacyGuard(true, true), classify,
+          () => boundedSafe(`${title}\n${detail}`)) : classify();
+      },
+      onCampus: () => controlWriteTelemetry ? controlWriteTelemetry.observe("external", controlWritePrivacyGuard(true, true), () => onCampus()) : onCampus(),
+    },
     // #334: the hub model's split, validated against the same `hub_backlog_split` parts schema a planner's call is, and the source registry for `--source`.
-    intake: { split: (system, user, opts) => inference?.split(system, user, opts) ?? Promise.resolve(undefined), sourceKnown: id => sourceRegistry.get(id) !== undefined,
+    intake: { split: (system, user, opts) => {
+      const split = () => inference?.split(system, user, opts) ?? Promise.resolve(undefined);
+      return controlWriteTelemetry ? controlWriteTelemetry.observe("external", controlWritePrivacyGuard(true, true), split,
+        () => boundedSafe(`${system}\n${user}`)) : split();
+    }, sourceKnown: id => sourceRegistry.get(id) !== undefined,
       partsSchema: () => profileTaskTools(resolvedProfile, lifecycleConfig.stages, lifecycleConfig.mode !== "off").find(tool => tool.name === "hub_backlog_split")?.inputSchema.properties.parts },
     studySource: id => sourceRegistry.get(id),
     experimentCheck: run => checkRunner.result(run),
     // The PII screen (issue #198): the model on this machine when MLX/Ollama is enabled, else the gateway on campus only.
-    piiScreen: opts.piiScreen ?? ((text) => screenPii(text, { ...(config.mlx.enabled === false ? {} : { device: () => ensureMlx(config.mlx) }), onCampus, omni, fixedModel: () => activeRouting().local.fixed_model })),
+    piiScreen: (text) => {
+      const screen = () => (opts.piiScreen ?? ((value: string) => screenPii(value, { ...(config.mlx.enabled === false ? {} : { device: () => ensureMlx(config.mlx) }), onCampus, omni, fixedModel: () => activeRouting().local.fixed_model })))(text);
+      return controlWriteTelemetry ? controlWriteTelemetry.observe("external", controlWritePrivacyGuard(true, true), screen,
+        () => boundedSafe(text)) : screen();
+    },
     recordScreen: (record) => event({ type: "pii_screen", ...record }),
     quota: (): ReturnType<Budget["headroom"]> => projectBudgetHeadroom(budget.headroom(), accountMembers), // budget is built below; this runs at assignment time
     review: config.review,
@@ -2573,6 +2603,20 @@ export async function startDaemon(opts: DaemonOptions) {
   };
   const activityRings: Record<string, ActivityRing> = Object.fromEntries(SUPPORTED_PEERS.filter(peer => definitionOf(peer)?.capabilities?.watch).map(peer => [peer, new ActivityRing()]));
   const contextPii = (peer: PeerId) => !!turns.get(peer)?.private || board.peerTaskSignals(peer).some(task => !isClosedTaskState(task.state) && tasks.isPii(task));
+  // Hoisted for the Tasks ports above; only the returned guard reads fully initialized daemon state.
+  function controlWritePrivacyGuard(admittedAtReceive: boolean, inputPublicAtReceive: boolean, peer?: PeerId, taskId?: number) {
+    return () => {
+      try {
+        if (!admittedAtReceive || !inputPublicAtReceive) return false;
+        if (peer && (turns.get(peer)?.private || contextPii(peer))) return false;
+        if (taskId !== undefined) {
+          const task = board.get(taskId);
+          if (!task || tasks.isPii(task) || !tasks.publicMetadataText(String(task.id))) return false;
+        }
+        return true;
+      } catch { return false; }
+    };
+  }
   // #878: what each peer is doing. Daemon memory only: never persisted (status.json leaves it out), logged, captured or relayed.
   const doings = new Map<PeerId, DoingTracker>();
   const observeDoing = (peer: PeerId, kind: DoingKind, text?: unknown, learnedPrivate = false) => {
@@ -2815,22 +2859,25 @@ export async function startDaemon(opts: DaemonOptions) {
   };
   const snap = (what: string, capture = config.snapshots.enabled, peer?: string): { tree?: string; head?: string | null; commit?: string | null; reflog?: HeadMoveCursor; ms: number; budget?: SnapshotBudget; repo?: Repo } => {
     if (!capture) return { ms: 0 };
-    const t0 = performance.now(), budget = reserveSnapshotBudget();
-    let tree: string | undefined, head: string | null | undefined, commit: string | null | undefined, repo: Repo | undefined, reflog: HeadMoveCursor | undefined;
-    try {
-      repo = peer ? repoFor(peer, budget) : factsRepo;
-      const before = repo && headState(repo, budget);
-      tree = repo && (opts.snapshot ?? snapshot)(repo, budget);
-      const after = repo && headState(repo, budget);
-      head = after?.tree; commit = after?.head;
-      if (!before || !after || before.tree !== after.tree) tree = undefined;
-      if (tree && repo && head !== undefined && after) reflog = headMoveCursor(repo, head, budget, after.head);
-      if (repo && !tree) log(`snapshot failed at ${what}`);
-    } catch (error) {
-      tree = undefined; head = undefined; commit = undefined; reflog = undefined;
-      snapshotFailure(what, error);
-    }
-    return { tree, head, commit, reflog, budget, repo, ms: Math.round(performance.now() - t0) };
+    const captureSnapshot = () => {
+      const t0 = performance.now(), budget = reserveSnapshotBudget();
+      let tree: string | undefined, head: string | null | undefined, commit: string | null | undefined, repo: Repo | undefined, reflog: HeadMoveCursor | undefined;
+      try {
+        repo = peer ? repoFor(peer, budget) : factsRepo;
+        const before = repo && headState(repo, budget);
+        tree = repo && (opts.snapshot ?? snapshot)(repo, budget);
+        const after = repo && headState(repo, budget);
+        head = after?.tree; commit = after?.head;
+        if (!before || !after || before.tree !== after.tree) tree = undefined;
+        if (tree && repo && head !== undefined && after) reflog = headMoveCursor(repo, head, budget, after.head);
+        if (repo && !tree) log(`snapshot failed at ${what}`);
+      } catch (error) {
+        tree = undefined; head = undefined; commit = undefined; reflog = undefined;
+        snapshotFailure(what, error);
+      }
+      return { tree, head, commit, reflog, budget, repo, ms: Math.round(performance.now() - t0) };
+    };
+    return controlWriteTelemetry ? controlWriteTelemetry.observe("snapshot", controlWritePrivacyGuard(true, true, peer as PeerId | undefined), captureSnapshot) : captureSnapshot();
   };
   function privateSnapshotWindow(): boolean {
     return [...turns.values()].some(turn => turn.private) || board.list().some(task => !isClosedTaskState(task.state) && tasks.isPii(task));
@@ -3302,6 +3349,10 @@ export async function startDaemon(opts: DaemonOptions) {
   // commit waits for those in flight, or its integrity digest misses their later writes. Completion checks outlive
   // their op, so recoveryReady() also waits for `tasks.checksPending()`: a check the commit's stop kills would write.
   let taskOpsInFlight = 0;
+  controlWriteTelemetry = new ControlWriteTelemetry({ emit: line => {
+    try { if (tasks.publicMetadataText(line) && boundedSafe(line)) log(line); } catch { /* diagnostics never fail a write */ }
+  } });
+  startupCleanup.push(() => controlWriteTelemetry?.stop());
   const toolWriteRegistry = new ToolWriteRegistry(instanceId, opts.toolWriteReplayMaxEntries === undefined ? {} : { maxEntries: opts.toolWriteReplayMaxEntries });
   const toolWriteScope = (c: Client, operation: string): string => {
     const actor = c.peer ?? USER, peer = c.peer ? bus.peers.get(c.peer) : undefined;
@@ -3925,7 +3976,7 @@ export async function startDaemon(opts: DaemonOptions) {
         const silent = tasks.silentFor(t.id);
         const overlap = a.plan == null && a.refs == null && !silent ? "" : tasks.overlaps(t);
         if (silent && factsOn()) factsFor(by).sawPlans(by, tasks.overlapTasks(t)); // the plans in this answer need no fact later
-        return [line(t), specs, overlap, tasks.planGuardText(t), tasks.submoduleNotice(t)].filter(Boolean).join("\n"); // #798 D1
+        return [line(t), specs, overlap, tasks.planGuardText(t), tasks.submoduleNotice(t), tasks.worktreeNote(t, by)].filter(Boolean).join("\n"); // #798 D1
       }
       case "hub_task_cancel": {
         if (!a || typeof a !== "object" || Array.isArray(a) || Object.keys(a).some(key => !["id", "reason", "superseded_by", "revision"].includes(key))
@@ -3938,7 +3989,9 @@ export async function startDaemon(opts: DaemonOptions) {
       case "hub_task_decline":
         return line(await tasks.decline(by, a.id, a.reason, a.capacity === true));
       case "hub_task_done": {
-        const t = await tasks.done(by, a.id, a.summary, a.refs, a.deliverables, a.spec_ack);
+        // #1115: a hub-sandboxed peer's worktree is staged, committed and pushed by the hub first, so the done carries the real head and branch.
+        const handed = await tasks.worktreeHandoff(by, a.id, a.refs);
+        const t = await tasks.done(by, a.id, a.summary, handed ?? a.refs, a.deliverables, a.spec_ack);
         const completion = t.history.findLast(h => h.by === by && (h.event === "done" || h.event === "done (checking)"));
         if (!piiTurn && !tasks.isPii(t) && completion && !completion.withheld && typeof a.summary === "string" && completion.note?.startsWith(a.summary)) {
           citeMemory(by, a.summary, `summary:${t.id}:${t.history.indexOf(completion)}`, [newEnvelope(by, "", { refs: { task: String(t.id) } })]);
@@ -4769,6 +4822,7 @@ export async function startDaemon(opts: DaemonOptions) {
     isolatedChecks: { pending: checkPending.size, orphans: orphanChecks, unknownReceipts: checkRunner.unknownReceipts ?? [], maintenanceUnavailable: checkRunner.maintenanceUnavailable === true },
     taskCapabilities: peerCapabilities(),
     tasks: board.counts(),
+    ...(includeAttentionItems && controlWriteTelemetry ? { controlWriteTiming: controlWriteTelemetry.status() } : {}),
     taskStalls, pendingTaskOffers,
     ...(bus.storageError ? { deliveryError: bus.storageError } : {}),
     ...(recoveryOperationId ? { recovery: { operationId: recoveryOperationId, phase: recoveryPhase, ready: recoveryReady() } } : {}),
@@ -4799,20 +4853,28 @@ export async function startDaemon(opts: DaemonOptions) {
   // (the status reply is unchanged); readers without it judge the pid alone, as 0.12.20 did.
   const pidSignature = processSignature(process.pid);
   const writeStatus = () => {
-    try {
-      const file = join(opts.stateDir, "status.json"); // clients parse this on every connect: replace it atomically
-      writeFileSync(`${file}.${instanceId}.tmp`, `${JSON.stringify({ ...status(), ...(pidSignature ? { pidSignature } : {}) }, null, 2)}\n`);
-      renameSync(`${file}.${instanceId}.tmp`, file);
-    } catch { /* the state dir is gone; the watchdog is stopping the hub (issue #56) */ }
+    const write = () => {
+      try {
+        const file = join(opts.stateDir, "status.json"); // clients parse this on every connect: replace it atomically
+        writeFileSync(`${file}.${instanceId}.tmp`, `${JSON.stringify({ ...status(), ...(pidSignature ? { pidSignature } : {}) }, null, 2)}\n`);
+        renameSync(`${file}.${instanceId}.tmp`, file);
+      } catch { /* the state dir is gone; the watchdog is stopping the hub (issue #56) */ }
+    };
+    if (controlWriteTelemetry) controlWriteTelemetry.observe("status-hook", () => true, write);
+    else write();
   };
   const taskChanged = board.onChange;
   board.onChange = (task, entry) => {
-    try { taskChanged?.(task, entry); }
-    finally {
-      try { handoffNotifyOrigin(task, entry); } catch { /* never throw after a board write */ }
-      try { settleSupersededDeliveries(); }
-      finally { writeStatus(); } // committed task transitions refresh token-free attention even without bus activity
-    }
+    const changed = () => {
+      try { taskChanged?.(task, entry); }
+      finally {
+        try { handoffNotifyOrigin(task, entry); } catch { /* never throw after a board write */ }
+        try { settleSupersededDeliveries(); }
+        finally { writeStatus(); } // committed task transitions refresh token-free attention even without bus activity
+      }
+    };
+    if (controlWriteTelemetry) controlWriteTelemetry.observe("queue-hook", controlWritePrivacyGuard(true, true, undefined, task.id), changed);
+    else changed();
   };
 
   // A queue change is not a bus event: without this, status.json reports the queue as it was before the last
@@ -4847,6 +4909,7 @@ export async function startDaemon(opts: DaemonOptions) {
   let reportingQueues = false;
   let queuePressureStatusQueued = false;
   bus.onQueues = () => {
+    const changed = () => {
     if (stopping || settlingSuperseded || reportingQueues) return;
     remoteQueueChanged();
     reportingQueues = true;
@@ -4872,6 +4935,9 @@ export async function startDaemon(opts: DaemonOptions) {
         });
       }
     }
+    };
+    if (controlWriteTelemetry) controlWriteTelemetry.observe("queue-hook", () => true, changed);
+    else changed();
   };
   // Opening the journal/restoring the snapshot preceded callbacks; classify those holds too.
   settleSupersededDeliveries();
@@ -8134,10 +8200,62 @@ export async function startDaemon(opts: DaemonOptions) {
     if (!result.ok) throw new Error(String(result.error));
   }
 
-  function onMessage(sock: Sock, msg: any): void {
+  function onControlMessage(sock: Sock, msg: any): void {
+    const client = sock.data;
+    const admittedAtReceive = client.authed && !!client.role, peer = client.peer;
+    if (!admittedAtReceive) return onMessage(sock, msg);
+    const metadata = controlWriteMetadata(msg);
+    if (!metadata || !controlWriteTelemetry) return onMessage(sock, msg);
+    const inputPublicAtReceive = (() => {
+      const rawArgs = msg?.args;
+      if (rawArgs === undefined) return true;
+      if (!rawArgs || typeof rawArgs !== "object" || Array.isArray(rawArgs)) return false;
+      try {
+        const idDescriptor = Object.getOwnPropertyDescriptor(rawArgs, "id");
+        if (idDescriptor && (!Object.hasOwn(idDescriptor, "value") || idDescriptor.value !== undefined) && metadata.task === undefined) return false;
+        const stack: { value: unknown; depth: number }[] = [{ value: rawArgs, depth: 0 }];
+        const text: string[] = [];
+        let bytes = 0, nodes = 0;
+        while (stack.length) {
+          const current = stack.pop()!;
+          if (++nodes > 2048 || current.depth > 16) return undefined;
+          if (typeof current.value === "string") {
+            bytes += Buffer.byteLength(current.value);
+            if (bytes > 32 * 1024) return undefined;
+            text.push(current.value);
+          } else if (Array.isArray(current.value)) {
+            if (current.value.length > 256) return undefined;
+            for (const value of current.value) stack.push({ value, depth: current.depth + 1 });
+          } else if (current.value && typeof current.value === "object") {
+            const values = Object.values(current.value);
+            if (values.length > 256) return undefined;
+            for (const value of values) stack.push({ value, depth: current.depth + 1 });
+          }
+        }
+        const joined = text.join("\n");
+        return tasks.publicMetadataText(joined) && boundedSafe(joined);
+      } catch { return undefined; }
+    })();
+    const privacyCurrent = controlWritePrivacyGuard(admittedAtReceive, inputPublicAtReceive === true, peer, metadata.task);
+    let finishControlWrite = () => {};
+    let finished = false;
+    const finish = () => { if (!finished) { finished = true; finishControlWrite(); } };
+    try {
+      void controlWriteTelemetry.run(metadata, privacyCurrent, () => {
+        const completed = new Promise<void>(resolve => { finishControlWrite = resolve; });
+        try {
+          controlWriteSpan("daemon-dispatch", () => onMessage(sock, msg, finish));
+        } catch (error) { finish(); throw error; }
+        return completed;
+      });
+    } catch (error) { finish(); throw error; }
+  }
+
+  function onMessage(sock: Sock, msg: any, finishControlWrite: () => void = () => {}): void {
     const c = sock.data;
     let refusalRecorded=false;
     const reply = (body: Record<string, unknown>) => {
+      const sendReply = () => {
       const writeRequestId = typeof msg.requestId === "string" && msg.requestId.length <= 256 && !/[\p{Cc}\p{Cf}]/u.test(msg.requestId)
         && toolWriteOperation(msg) !== undefined && body.requestId === msg.requestId ? msg.requestId : undefined;
       let writeRefusal: string | undefined;
@@ -8157,6 +8275,10 @@ export async function startDaemon(opts: DaemonOptions) {
         body = { ...body, ...toolWriteUnknownReply(msg, writeRequestId, writeRefusal ?? "caller authority changed before the result could be returned"), ...authority };
       }
       if (sock.readyState === WebSocket.OPEN) sock.send(JSON.stringify({ rid: msg.rid, ...body }));
+      };
+      try {
+        controlWriteSpan("daemon-reply", sendReply);
+      } finally { finishControlWrite(); }
     };
     const runTaskRequest = (run: () => Promise<string>, extraCurrent: () => void = () => {}, formatError: (error: unknown) => Record<string, unknown> = error => ({ t: "task", ok: false, error: error instanceof Error ? error.message : "task write refused" })): void => {
       const operation = toolWriteOperation(msg);
@@ -9548,6 +9670,7 @@ export async function startDaemon(opts: DaemonOptions) {
   }
   async function stopOnce(): Promise<void> {
     stopping = true;
+    controlWriteTelemetry?.stop();
     roomCommands.stop();
     tasks.stopQueuePressureRechecks();
     const studiesStopped = tasks.stopStudies();
@@ -9647,6 +9770,7 @@ export async function startDaemon(opts: DaemonOptions) {
   bus.onQueues(); // initial restored holds are reported only after the listener is bound; writes status.json too
   log(`${RUN_START}${process.pid} control=127.0.0.1:${server.port} cwd=${opts.cwd}`);
   ready = true;
+  controlWriteTelemetry?.start();
   handoffCatchUp();
   tasks.scheduleQueuePressureRecheck();
   for (const name of opts.configWatch === false ? [] : CONFIG_SOURCE_FILES) {

package/src/hub/hub-tools.ts

@@ -122,7 +122,7 @@ export const TASK_TOOLS: HubTool[] = [
   tool("hub_task_accept", "Take a task that was assigned to you, with your plan for it. Set refs.repo for work in another repository; acceptance may correct only that repository metadata.", { id, plan: acceptPlan, refs: { ...refs, properties: { repo: refs.properties.repo } } }, ["id"]),
   tool("hub_task_cancel", "Cancel proposed/backlog work you proposed as its configured planner, including work an owner accepted and then declined while it has no execution, branch, commit or PR evidence; work with any such evidence is person-only. Keeps history and does not stop a native turn or delete files.", { id, reason: str, superseded_by: str, revision: { type: "integer", minimum: 0 } }, ["id", "reason"]),
   tool("hub_task_decline", "Pass on a task assigned to you; the hub offers it to the next peer. A plain decline is a lasting refusal: you are never offered this task again. Pass capacity: true when you only have no room right now: you are skipped for this move only, and a later reroute or planner pull may offer it to you again.", { id, reason: str, capacity: { type: "boolean" } }, ["id"]),
-  tool("hub_task_done", "Mark your task finished. It goes to its reviewer with your summary and refs; no duplicate hub_send chat is needed. If a covering spec is unchanged, update it or provide spec_ack with a public reason for each unchanged spec. When the project configures a check for its class, the hub runs it first and the result comes as a task message: a failed check keeps the task with you.", { id, summary: { type: "string", description: "what changed, why, and the check you ran with its result" }, refs, deliverables: deliverablesSchema, spec_ack: specAck }, ["id", "summary"]),
+  tool("hub_task_done", "Mark your task finished. It goes to its reviewer with your summary and refs; no duplicate hub_send chat is needed. When re-filing work after review, set refs.commit to the new full SHA; summary text does not change the review head. If a covering spec is unchanged, update it or provide spec_ack with a public reason for each unchanged spec. When the project configures a check for its class, the hub runs it first and the result comes as a task message: a failed check keeps the task with you.", { id, summary: { type: "string", description: "what changed, why, and the check you ran with its result" }, refs, deliverables: deliverablesSchema, spec_ack: specAck }, ["id", "summary"]),
   tool("hub_sdlc_record", "Record artifact ids or claimed local checks on your task. This grants no authority or external-check evidence. Only its owner/reviewer or the person may record; only its reviewer/person may name a reviewed head or phase checklist. Phase evidence refs are content hashes, not external verification.", { id, receipt: { type: "object", properties: { deliverables: deliverablesSchema, stage: { type: "string", enum: ["spec", "plan", "implement", "review", "verify", "merge", "release"] }, repo: str, issue: id, pr: id, localHead: str, localResult: { type: "string", enum: ["passed", "failed", "unknown"] }, reviewedHead: str, phase: { type: "object", properties: { id: str, head: str, tasks: { type: "array", maxItems: 64, items: { type: "object", properties: { id, after: { type: "array", maxItems: 16, items: id } }, required: ["id", "after"], additionalProperties: false } }, criteria: { type: "array", maxItems: 32, items: { type: "object", properties: { id: str, required: { type: "boolean" }, result: { type: "string", enum: ["verified", "failed", "unverified"] }, refs: { type: "array", maxItems: 8, items: str } }, required: ["id", "required", "result", "refs"], additionalProperties: false } } }, required: ["id", "tasks", "criteria"], additionalProperties: false } }, additionalProperties: false } }, ["id", "receipt"]),
   tool("hub_task_list", "The task board, newest updated first, 50 compact rows (id, state, owner, reviewer, title) per call. The reply is {tasks, total, next?}: pass next as cursor for the following page. Use ids for full rows of specific tasks, or detail: true for full rows of a page. PII tasks show as [pii].", { state: { type: "string", enum: ["proposed", "in_progress", "in_review", "approved", "changes_requested", "cancelled"] }, ready: { type: "boolean", description: "only proposed tasks with nothing left to wait for" }, limit: { type: "integer", minimum: 1, maximum: 200, description: "rows per page, default 50" }, cursor: { type: "string", description: "the next value from the previous reply, unchanged" }, ids: { type: "array", minItems: 1, maxItems: 200, items: { type: "integer", minimum: 1 }, description: "full rows for exactly these task numbers; no paging" }, detail: { type: "boolean", description: "full rows instead of compact rows" } }),
   tool("hub_specs", "Read the project's design-spec checks or find specs covering repository-relative paths. Read-only; at most 20 result items are returned. Does not reveal private task data.", { action: { type: "string", enum: ["check", "covers"] }, paths: { type: "array", maxItems: 32, items: { type: "string", minLength: 1, maxLength: 2000 } } }, ["action"]),

package/src/hub/routing.ts

@@ -7,7 +7,7 @@ import { join, resolve } from "node:path";
 import { CLASSES, type Task, type TaskClass } from "./board.ts";
 import { isGitHubRepository, specRefs } from "./spec-read.ts";
 
-export interface PeerCapabilities { tests: boolean; spec: boolean; testsReason?: string; specReason?: string; /** #1081: the peer's shell can reach the network (through the egress proxy or directly). Absent means unknown, never refused. */ network?: boolean; networkReason?: string; /** #1081: the peer can create the task worktree (`git worktree add` runs outside a hub sandbox, #270). Absent means unknown, never refused. */ worktree?: boolean; worktreeReason?: string; }
+export interface PeerCapabilities { tests: boolean; spec: boolean; testsReason?: string; specReason?: string; /** #1081: the peer's shell can reach the network (through the egress proxy or directly). Absent means unknown, never refused. */ network?: boolean; networkReason?: string; /** #1081: the peer can have the task worktree made for it: it makes its own, or (a hub sandbox, #270) the hub makes it (#1115) where it can. Absent means unknown, never refused. */ worktree?: boolean; worktreeReason?: string; }
 import type { PeerId, PeerState } from "./envelope.ts";
 
 import { parseHubRoutes, type HubRoute } from "../models/route/config.ts";
@@ -343,6 +343,12 @@ export function ownerRoleOfClass(cls: TaskClass): "planner" | "implementer" | "r
   return cls === "review" ? "reviewer" : cls === "plan" ? "planner" : "implementer";
 }
 
+/**
+ * #1129: the classes whose owner changes the repository, so a hub-sandboxed owner needs the hub's task worktree and commit (#1115) whether or not the task declares
+ * `needs_worktree`. `test`, `summarize`, `triage`, `review` and `plan` read and report: they get none. One definition, so routing and `Tasks` cannot disagree.
+ */
+export const writesRepository = (cls: TaskClass): boolean => cls === "implement" || cls === "bulk_edit";
+
 /** Why a planner was chosen: the person named it, rotation reached it, the task's recorded planner is kept, or there is none (PII, no holder). */
 export type PlannerReason = "rotation" | "named" | "kept" | "none";
 
@@ -493,7 +499,8 @@ export function assign(
       // #1081: work that declares it needs the network is never offered to a peer whose shell has none. Unknown (no `network` entry) is not a refusal.
       if (task.signals.includes("needs_network") && caps?.network === false) return deny("network", `no network: ${caps.networkReason ?? "its shell cannot reach the network"}`);
       // #1081: work that declares it needs a task worktree is never offered to a peer that cannot create one, so no branch ref is left behind by a refused accept.
-      if (task.signals.includes("needs_worktree") && caps?.worktree === false) return deny("worktree", `no worktree: ${caps.worktreeReason ?? "it cannot create the task worktree"}`);
+      // #1129: write-class work needs one whether or not it declares it, because a hub-sandboxed owner cannot commit and the hub commits in its worktree. Unknown capability is not a refusal.
+      if ((task.signals.includes("needs_worktree") || writesRepository(task.class)) && caps?.worktree === false) return deny("worktree", `no worktree: ${caps.worktreeReason ?? "it cannot create the task worktree"}`);
     }
     if (opts.offRoster?.includes(peer)) return deny("roster", "off roster");
     const named = role === "owner" ? opts.namedOwner ?? reserved : opts.namedReviewer;

package/src/hub/runtime-capture-prune.ts

@@ -246,7 +246,10 @@ function knownLayout(root: string, directories: readonly string[], files: readon
   }
 }
 function captureLayout(root: string): void {
-  knownLayout(root, ["src", "plugins", "templates", ".claude-plugin"], ["package.json", "README.md", "LICENSE", "CHANGELOG.md"], ["node_modules"]);
+  knownLayout(root, ["src", "plugins", "templates", ".claude-plugin"], ["package.json", "README.md", "LICENSE", "CHANGELOG.md"], ["node_modules", "scripts"]);
+  // #1120: captures made before the release checker was carried have no scripts directory; when present it holds exactly the checker.
+  // The name is repeated here on purpose: a pruner copied into a capture runs beside that capture's own verifier and imports nothing but verifyPackage from it. test/runtime-capture-checker.test.ts pins this name to RELEASE_CHECKER.
+  if (optionalInfo(join(root, "scripts"))) knownLayout(join(root, "scripts"), [], ["check-docs.mjs"]);
   const modules = join(root, "node_modules");
   if (optionalInfo(modules)) {
     knownLayout(modules, ["@staix"], []); const scope = join(modules, "@staix"); knownLayout(scope, ["agent-mem"], []);

package/src/hub/sdlc-release-authorization.ts

@@ -2,7 +2,7 @@ import { releaseTrackedClean } from "./release-worktree.ts";
 import { createHash, randomUUID } from "node:crypto";
 import { USER, type PeerId } from "./envelope.ts";
 import { hubGitEnv, hubGitSync } from "./git.ts";
-import { readDocEvidence, type DocEvidence, type ReleaseGit, type ReleaseReadiness } from "./sdlc-release.ts";
+import { readDocEvidenceDetailed, type DocEvidence, type ReleaseGit, type ReleaseReadiness } from "./sdlc-release.ts";
 import type { SdlcGh } from "./sdlc.ts";
 import type { ReleaseGuardRequest, ReleasePushUpdate } from "../cli/sdlc-release-guard.ts";
 
@@ -17,6 +17,8 @@ export interface ReleaseAuthorization { schemaVersion: 1; id: string; by: PeerId
 export interface ReleaseAuthorizationPorts {
   git?: ReleaseGit;
   docs?: (root: string) => Promise<DocEvidence | undefined>;
+  /** Test seam: the checker program the default reader spawns (#1120). Never set from configuration. */
+  checker?: string;
   gh?: SdlcGh;
   now?: () => number;
   current?: () => boolean;
@@ -46,6 +48,13 @@ export class ReleaseAuthorizations {
   private latest?: Entry;
   constructor(private readonly root: string, private readonly ports: ReleaseAuthorizationPorts) {}
   private current(): void { if (this.ports.current?.() === false) throw new ReleaseAuthorizationError("release authorization unavailable during lifecycle transition"); }
+  /** #1120: a checker that is missing or failed is its own refusal; only evidence that is read and not fresh is "stale documentation". An injected reader keeps its undefined meaning (no evidence). */
+  private async docs(commit: string, version: string): Promise<ReleaseDocsVerdict | undefined> {
+    if (this.ports.docs) return docsVerdict(await this.ports.docs(this.root), commit, version);
+    const read = await readDocEvidenceDetailed(this.root, undefined, this.ports.checker);
+    if ("unavailable" in read) throw new ReleaseAuthorizationError(`release authorization needs the documentation checker: ${read.unavailable}`);
+    return docsVerdict(read.evidence, commit, version);
+  }
   private actor(by: PeerId): void {
     if (by !== USER && (typeof by !== "string" || !by.trim() || this.ports.conductor?.() !== by)) throw new ReleaseAuthorizationError("only the person or the configured conductor may authorize a release");
   }
@@ -95,8 +104,8 @@ export class ReleaseAuthorizations {
     this.current();
     const git = this.git(), commit = this.commit(git, "HEAD"), origin = this.origin(git);
     if (commit !== expectedCommit || this.version(git, commit) !== version) throw new ReleaseAuthorizationError("candidate commit or version differs from the person's request");
-    const docs = docsVerdict(await (this.ports.docs ?? readDocEvidence)(this.root), commit, version);
-    if (!docs) throw new ReleaseAuthorizationError("release authorization requires fresh committed documentation evidence");
+    const docs = await this.docs(commit, version);
+    if (!docs) throw new ReleaseAuthorizationError("release authorization requires fresh committed documentation evidence: run `node scripts/check-docs.mjs --committed` in the candidate checkout, restamp the stale documents in a committed change, then authorize again");
     this.current(); this.actor(by);
     if (this.commit(git, "HEAD") !== commit || this.version(git, commit) !== version || this.origin(git).hash !== origin.hash) throw new ReleaseAuthorizationError("release candidate changed during authorization");
     this.current(); this.actor(by);
@@ -127,7 +136,7 @@ export class ReleaseAuthorizations {
         if (!releaseTrackedClean(this.root, git)) throw new ReleaseAuthorizationError("npm publish requires a clean tracked worktree");
         const commit = this.commit(git, "HEAD"), version = this.version(git, commit);
         const receipt = this.matched(git, version, commit);
-        const docs = docsVerdict(await (this.ports.docs ?? readDocEvidence)(this.root), commit, version);
+        const docs = await this.docs(commit, version);
         this.current();
         if (!docs || docs.digest !== receipt.docs.digest || this.commit(git, "HEAD") !== commit || !releaseTrackedClean(this.root, git)) throw new ReleaseAuthorizationError("publish checkout or documentation evidence changed");
         return { ok: true, receipts: [this.matched(git, version, commit)] };

package/src/hub/sdlc-release.ts

@@ -1,6 +1,7 @@
 import type { Task } from "./board.ts";
 import type { Release } from "./planning.ts";
 import { spawn } from "node:child_process";
+import { existsSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { childEnv, stopOwnedProcess } from "./child-process.ts";
 import { hubGitSync } from "./git.ts";
@@ -23,7 +24,7 @@ const sdlcGh: SdlcGh = async (...args) => {
 export interface DocEvidence { schemaVersion: 1; head?: string; version?: string; documents: { path?: string; state: "fresh" | "stale" | "nonancestor" | "unknown"; verifiedAgainst?: string; commits?: number; dirty?: boolean }[]; errors: number; fresh: boolean; }
 export interface ReleaseReadiness { /** #481 AC12: interval, approval-to-release lead time and hotfix rate over shipped releases, filled by Tasks.releaseReadiness. */ releaseMetrics?: ReturnType<typeof releaseMetrics>; repo: string; head?: string; version?: string; tag?: string; tagCommit?: string; commits: string[]; mergedPrs: { pr: number; commit: string }[]; documents?: DocEvidence; liveIssues: { id: number; state: "open" | "closed" | "unknown" }[]; blockers: string[]; sourceReady: boolean; native: "unverified"; ready: false; }
 export type ReleaseGit = (args: string[]) => { code: number; stdout: string };
-export interface ReleaseReaders { gh?: SdlcGh; git?: ReleaseGit; docs?: (root: string, timeoutMs: number) => Promise<DocEvidence | undefined>; }
+export interface ReleaseReaders { gh?: SdlcGh; git?: ReleaseGit; docs?: (root: string, timeoutMs: number) => Promise<DocEvidence | undefined>; /** Test seam (#1120): the checker program the default docs reader spawns. */ checker?: string; }
 const SHA = /^[0-9a-f]{40}$/;
 const VERSION = /^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
 const REPO = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
@@ -34,21 +35,31 @@ function tagMatches(target: unknown, commit: string): boolean {
   return typeof oid === "string" && SHA.test(oid) && oid === commit;
 }
 /** Package-owned checker only; no caller-supplied program or document text is executed. */
-export function readDocEvidence(root: string, timeoutMs = 10_000): Promise<DocEvidence | undefined> {
+/** #1120: why no evidence could be read, apart from evidence that says the documents are stale. */
+export type DocEvidenceRead = { evidence: DocEvidence } | { unavailable: string };
+const CHECKER_PATH = fileURLToPath(new URL("../../scripts/check-docs.mjs", import.meta.url));
+const CHECKER_MISSING = "the documentation checker scripts/check-docs.mjs is missing from the running hub, which predates the fix that carries it into captured runtimes; record consent from a hub started from a checkout or a release that carries the checker (docs/sdlc.md, release preparation)";
+const CHECKER_FAILED = "the documentation checker in the running hub did not finish with readable evidence (it timed out, crashed or printed unreadable output); run `node scripts/check-docs.mjs --json --committed` in the candidate checkout to see why, then retry";
+export async function readDocEvidence(root: string, timeoutMs = 10_000): Promise<DocEvidence | undefined> {
+  const read = await readDocEvidenceDetailed(root, timeoutMs);
+  return "evidence" in read ? read.evidence : undefined;
+}
+export function readDocEvidenceDetailed(root: string, timeoutMs = 10_000, checker = CHECKER_PATH): Promise<DocEvidenceRead> {
+  if (!existsSync(checker)) return Promise.resolve({ unavailable: CHECKER_MISSING });
   return new Promise(resolve => {
-    const child = spawn(process.execPath, [fileURLToPath(new URL("../../scripts/check-docs.mjs", import.meta.url)), root, "--json", "--committed"], { cwd: root, env: childEnv(), detached: true, stdio: ["ignore", "pipe", "ignore"] });
+    const child = spawn(process.execPath, [checker, root, "--json", "--committed"], { cwd: root, env: childEnv(), detached: true, stdio: ["ignore", "pipe", "ignore"] });
     let output = "", invalid = false;
     const stop = () => { invalid = true; void stopOwnedProcess(child, { group: true }).catch(() => {}); };
     const timer = setTimeout(stop, Math.max(1, Math.min(10_000, timeoutMs)));
     child.stdout?.setEncoding("utf8"); child.stdout?.on("data", chunk => { output += chunk; if (Buffer.byteLength(output) > 256 * 1024) { output = ""; stop(); } });
-    child.once("error", () => { invalid = true; clearTimeout(timer); resolve(undefined); });
+    child.once("error", () => { invalid = true; clearTimeout(timer); resolve({ unavailable: CHECKER_FAILED }); });
     child.once("close", (code, signal) => {
-      clearTimeout(timer); if (invalid || signal || (code !== 0 && code !== 1)) return resolve(undefined);
+      clearTimeout(timer); if (invalid || signal || (code !== 0 && code !== 1)) return resolve({ unavailable: CHECKER_FAILED });
       try {
         const data = JSON.parse(output);
-        if (data.schemaVersion !== 1 || !Array.isArray(data.documents) || data.documents.length > 128 || !Number.isSafeInteger(data.errors) || data.errors < 0 || typeof data.fresh !== "boolean" || (data.head !== undefined && !SHA.test(data.head)) || (data.version !== undefined && !VERSION.test(data.version)) || data.documents.some((d: {state?:string}) => !["fresh","stale","nonancestor","unknown"].includes(d.state ?? ""))) return resolve(undefined);
-        resolve(data);
-      } catch { resolve(undefined); }
+        if (data.schemaVersion !== 1 || !Array.isArray(data.documents) || data.documents.length > 128 || !Number.isSafeInteger(data.errors) || data.errors < 0 || typeof data.fresh !== "boolean" || (data.head !== undefined && !SHA.test(data.head)) || (data.version !== undefined && !VERSION.test(data.version)) || data.documents.some((d: {state?:string}) => !["fresh","stale","nonancestor","unknown"].includes(d.state ?? ""))) return resolve({ unavailable: CHECKER_FAILED });
+        resolve({ evidence: data });
+      } catch { resolve({ unavailable: CHECKER_FAILED }); }
     });
   });
 }
@@ -101,8 +112,10 @@ export async function readReleaseReadiness(root: string, repo: string, liveIssue
       } catch { report.blockers.push("merged PR coverage unknown or truncated"); break; }
     }
   }
-  const left = deadline - performance.now(); report.documents = left > 0 ? await (readers.docs ?? readDocEvidence)(root,Math.min(10_000,left)) : undefined;
-  if (!report.documents || report.documents.head !== head || !report.documents.fresh || report.documents.errors || report.documents.documents.some(d => d.state !== "fresh")) report.blockers.push("documentation freshness or ancestry is unknown or stale");
+  const left = deadline - performance.now(); report.documents = left > 0 ? await (readers.docs ?? ((dir, ms) => readDocEvidenceDetailed(dir, ms, readers.checker).then(read => "evidence" in read ? read.evidence : undefined)))(root,Math.min(10_000,left)) : undefined;
+  const checkerMissing = !readers.docs && !existsSync(readers.checker ?? CHECKER_PATH); // #1120: a hub without the checker says so instead of calling the documents stale
+  if (checkerMissing) report.blockers.push("documentation checker unavailable in the running hub: " + CHECKER_MISSING);
+  else if (!report.documents || report.documents.head !== head || !report.documents.fresh || report.documents.errors || report.documents.documents.some(d => d.state !== "fresh")) report.blockers.push("documentation freshness or ancestry is unknown or stale");
   if (!liveIssues.length) report.blockers.push("native verification ledger unspecified");
   for (const id of liveIssues) {
     const reply = await gh(["issue","view",String(id),"--repo",repo,"--json","number,state"]); let state: "open"|"closed"|"unknown" = "unknown";