talon-agent 5.23.1 → 5.24.1

package/README.md

@@ -88,7 +88,9 @@ xattr -d com.apple.quarantine ./talon-darwin-arm64
 ```
 
 Verify a direct download against the release `SHA256SUMS`:
-`sha256sum -c SHA256SUMS --ignore-missing`.
+`sha256sum -c SHA256SUMS --ignore-missing`, and its build provenance with
+`gh attestation verify talon-linux-x64 --repo thefalconry/talon` (see
+[SECURITY.md](SECURITY.md#verifying-a-release)).
 
 **Server only, no Telegram?** Run the daemon with just the client bridge,
 reached by the companion app and talon-node: see
@@ -272,6 +274,7 @@ daemon (plugins) or apply on the next session (skills):
 talon plugin install @scope/my-talon-plugin        # npm → module plugin
 talon plugin install some-mcp-server --mcp         # npm → standalone MCP server (npx)
 talon plugin install owner/repo                    # git → module plugin
+talon plugin install owner/repo#<sha>              # …at that commit (or --commit <sha>)
 talon plugin list                                  # built-ins + configured entries
 talon plugin disable github                        # also toggles built-ins
 talon plugin remove my-talon-plugin
@@ -285,7 +288,10 @@ talon skill remove pdf
 ```
 
 Module plugins install under `~/.talon/plugins/`; standalone MCP servers are
-registered as `npx` entries in `config.json`. Disabling keeps the entry (or a
+registered as `npx` entries in `config.json`. A git source can be pinned to a
+commit with `#<sha>` or `--commit <sha>` (7-64 hex digits): Talon checks that
+commit out and verifies HEAD before installing. Either way the install
+folder's `.talon-install.json` records the repo and the exact commit. Disabling keeps the entry (or a
 `.disabled` marker in the skill folder) so enabling restores it unchanged.
 
 ## Built-in Plugins

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "talon-agent",
-  "version": "5.23.1",
+  "version": "5.24.1",
   "description": "Multi-frontend AI agent with full tool access, streaming, cron jobs, and plugin system",
   "author": "The Falconry",
   "license": "Apache-2.0",

package/src/app.ts

@@ -74,6 +74,7 @@ import {
   writePidRecord,
   removePidRecordIfOwnedBy,
 } from "./core/daemon/pidfile.js";
+import { stampDaemonOwner } from "./core/daemon/pidfile.js";
 import {
   recordBootMetrics,
   startResourceSampler,
@@ -95,6 +96,24 @@ if (process.argv.includes(BOOT_SMOKE_FLAG)) {
   process.exit(0);
 }
 
+// One daemon per install. This runs before anything with a side effect
+// (restore, database, pidfile, trigger resume), because a second daemon
+// does damage in each of them — see checkSingleInstance in core/daemon/discovery.ts.
+{
+  const { checkSingleInstance, describeRefusal } =
+    await import("./core/daemon/discovery.js");
+  const verdict = await checkSingleInstance();
+  if (!verdict.ok) {
+    const message = describeRefusal(verdict.instance);
+    logError("bot", message);
+    console.error(`talon: ${message}`);
+    process.exit(1);
+  }
+}
+// Every child spawned from here on names this daemon as its owner, so an
+// orphan sweep can tell a dead daemon's leftovers from a live one's runs.
+stampDaemonOwner();
+
 /**
  * A `/backup restore <id>` from chat writes ~/.talon/restore-pending.json
  * and restarts. It is applied HERE, before anything else: every store
@@ -160,6 +179,17 @@ writePidRecord({ pid: process.pid, startedAt: bootedAt });
 // ── Create gateway + frontend ─────────────────────────────────────────────────
 
 const gateway = new Gateway("daemon");
+// Fail rather than fall back when the gateway port belongs to another
+// daemon: a fallback port is how a second daemon went unnoticed.
+gateway.setPortInUseCheck(async (port) => {
+  const { probeHealth } = await import("./core/daemon/discovery.js");
+  const health = await probeHealth(port);
+  return health?.app === "talon" &&
+    health.mode === "daemon" &&
+    health.pid !== process.pid
+    ? `gateway port ${port} is held by another Talon daemon (pid ${String(health.pid)})`
+    : undefined;
+});
 gateway.onStarted((port) =>
   writePidRecord({ pid: process.pid, port, startedAt: bootedAt }),
 );

package/src/backend/agy/process/orphans.ts

@@ -12,6 +12,7 @@
 
 import { readdir, readFile } from "node:fs/promises";
 import { log } from "../../../util/log.js";
+import { childBelongsToLiveDaemon } from "../../../core/daemon/pidfile.js";
 import { AGY_KILL_GRACE_MS } from "../constants.js";
 import { childChatIds, getChild } from "./child.js";
 
@@ -96,7 +97,10 @@ async function findOrphanPids(contextLabel: string): Promise<number[]> {
       // SIGKILL, so a chat id that happens to appear inside an
       // unrelated path must not select a victim.
       if (!argv.some((arg) => arg === "agy" || arg.endsWith("/agy"))) continue;
-      if (argv.includes(contextLabel)) matched.push(pid);
+      if (!argv.includes(contextLabel)) continue;
+      // Another running daemon's live run, not an orphan of ours.
+      if (childBelongsToLiveDaemon(pid)) continue;
+      matched.push(pid);
     } catch {
       // Exited between readdir and readFile, or not ours. Skip.
       continue;

package/src/backend/claude-sdk/one-shot.ts

@@ -22,6 +22,10 @@ import { buildMcpServers, buildPluginMcpServers } from "./options.js";
 import { isBackgroundToolContext } from "../../core/agents/context.js";
 import { warnIfBelowCacheMinimum } from "../runtime/cache/cache-telemetry.js";
 import { emitAssistantText } from "../runtime/one-shot-hooks.js";
+import {
+  isOtherLiveDaemon,
+  ownerFromEnviron,
+} from "../../core/daemon/pidfile.js";
 
 const DEFAULT_SUBPROCESS_KILL_GRACE_MS = 5 * 1000;
 
@@ -290,8 +294,10 @@ async function formatAndAppendMessage(
  * triggers: the warden respawned them, the next sweep killed them again, and
  * the only visible symptom was a trigger stuck in "errored" with no output.
  *
- * Two independent guards, because this function issues SIGKILL:
+ * Three independent guards, because this function issues SIGKILL:
  *  - refuse anything tagged `TALON_TRIGGER_ID` (a trigger, or its child);
+ *  - refuse anything spawned by another daemon that is still running
+ *    (see core/daemon/pidfile.ts). Its "orphans" are that daemon's live runs;
  *  - require the argv to actually be the `claude` SDK binary, which is the
  *    only thing this sweep was ever meant to reap.
  */
@@ -304,6 +310,7 @@ export function isEvictableOrphan(
   if (envEntries.some((entry) => entry.startsWith("TALON_TRIGGER_ID="))) {
     return false;
   }
+  if (isOtherLiveDaemon(ownerFromEnviron(envEntries))) return false;
   return argv.some((arg) => arg === "claude" || arg.endsWith("/claude"));
 }
 

package/src/backend/codex/factory.ts

@@ -19,7 +19,10 @@ import {
   type ModelCatalog,
   type UsageTelemetry,
 } from "../../core/agent-runtime/capabilities.js";
-import { getPlanUsage as getCodexPlanUsage } from "./plan-usage.js";
+import {
+  getAuthFailure as getCodexAuthFailure,
+  getPlanUsage as getCodexPlanUsage,
+} from "./plan-usage.js";
 
 import { initCodexAgent, getCodexAuthInfo } from "./init.js";
 import { handleMessage as codexHandleMessage } from "./handler/index.js";
@@ -88,6 +91,7 @@ const codexFactory: BackendFactory = {
     // report its rate-limit windows.
     const usage: UsageTelemetry = {
       getPlanUsage: () => getCodexPlanUsage(),
+      getAuthFailure: () => getCodexAuthFailure(),
     };
 
     const backend = composeBackend({

package/src/backend/codex/plan-usage.ts

@@ -172,6 +172,18 @@ async function load(): Promise<PlanUsage | undefined> {
   }
 }
 
+/**
+ * Why the Codex login is known to be rejected, or `undefined`. Set by a 401
+ * from the usage endpoint and cleared once `codex login` rewrites
+ * auth.json (seen on the next {@link getPlanUsage} refresh). The router
+ * reads it to stop sending work to a backend whose runs can only fail.
+ */
+export function getAuthFailure(): string | undefined {
+  return rejectedAuthMtimeMs === undefined
+    ? undefined
+    : "Codex login expired (usage endpoint returned 401) — run `codex login`";
+}
+
 /**
  * Plan windows for `/usage`, cached for a minute. A failed refresh keeps
  * serving the last known values — `fetchedAt` lets the caller age them.

package/src/backend/runtime/turn/turn-phases.ts

@@ -26,7 +26,10 @@ import {
 } from "../../../storage/sessions.js";
 import { log } from "../../../util/log.js";
 import { extractSessionName } from "../../../core/weaver/session-name.js";
-import { recordBackendRunUsage } from "../../../core/engine/backend-router/index.js";
+import {
+  recordBackendRunSuccess,
+  recordBackendRunUsage,
+} from "../../../core/engine/backend-router/index.js";
 import { traceMessage } from "../../../util/trace.js";
 import {
   FLOW_VIOLATION_MAX_RETRIES,
@@ -120,6 +123,9 @@ export function accountTurn(inputs: AccountTurnInputs): void {
   // a provider with no account API still has a headroom signal. Backends
   // that DO report a plan simply outrank their own ledger.
   recordBackendRunUsage(inputs.backend, usage);
+  // A chat turn that completed is proof the backend works: close its
+  // breaker so background work may route there again.
+  if (!inputs.failed) recordBackendRunSuccess(inputs.backend);
   recordUsage(chatId, {
     ...usage,
     durationMs,

package/src/bootstrap.ts

@@ -155,6 +155,7 @@ export async function bootstrap(
       ...(config.operatorIds ?? []),
       ...(config.discord?.adminUserIds ?? []).map((id) => `discord:${id}`),
     ],
+    guardChildren: true,
   });
 
   initWorkspace(config.workspace);

package/src/cli/install-sources.ts

@@ -10,11 +10,17 @@
  *   4. anything else                         → { kind: "other" } — the caller
  *      decides (plugins treat it as an npm spec, skills reject it)
  *
- * Cloning always uses `--depth=1` (installs never need history), ends the
- * options with `--` so a URL can never be read as a git flag, and reports
- * the commit it got so the install can be pinned/audited later. It spawns
- * `git`/`npm` via cross-spawn, which resolves the `.cmd`/`.exe` shims on
- * Windows — never assume a POSIX shell here.
+ * A git source may name a commit: `<source>#<sha>` (7-64 hex digits), or
+ * `--commit <sha>` on the command line (`withCommit`).
+ *
+ * Without a commit, cloning uses `--depth=1` (installs never need history).
+ * With one, it clones with `--filter=blob:none` (history, but only the
+ * blobs of the commit it checks out), checks the commit out and verifies
+ * HEAD is that commit. Either way the options end with `--` so a URL can
+ * never be read as a git flag, a URL starting with "-" is refused before
+ * git runs, and the commit it got is reported so the install can record
+ * it. It spawns `git`/`npm` via cross-spawn, which resolves the
+ * `.cmd`/`.exe` shims on Windows — never assume a POSIX shell here.
  */
 
 import crossSpawn from "cross-spawn";
@@ -22,40 +28,84 @@ import { existsSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 
+export type GitSource = {
+  kind: "git";
+  url: string;
+  subpath?: string;
+  /** Requested commit (lowercase hex, 7-64 digits); unset = default branch. */
+  commit?: string;
+};
+
 export type ResolvedSource =
-  | { kind: "local"; dir: string }
-  | { kind: "git"; url: string; subpath?: string }
-  | { kind: "other"; raw: string };
+  { kind: "local"; dir: string } | GitSource | { kind: "other"; raw: string };
 
 const GIT_URL_RE = /^(https?|git|ssh):\/\//;
 /** `owner/repo` or `owner/repo/sub/path` — never an npm scope (`@…`). */
 const GITHUB_SHORTHAND_RE =
   /^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)((?:\/[^\s/]+)*)$/;
+/** An abbreviated or full commit id (SHA-1 or SHA-256). */
+const COMMIT_RE = /^[0-9a-f]{7,64}$/;
+/** `<source>#<commit>` — only a hex fragment is a pin. */
+const COMMIT_FRAGMENT_RE = /^(.+)#([0-9a-fA-F]{7,64})$/;
+
+function gitSource(spec: string): GitSource | undefined {
+  if (
+    GIT_URL_RE.test(spec) ||
+    spec.startsWith("git@") ||
+    spec.endsWith(".git")
+  ) {
+    return { kind: "git", url: spec };
+  }
+  if (spec.startsWith("@")) return undefined;
+  const match = GITHUB_SHORTHAND_RE.exec(spec);
+  if (!match) return undefined;
+  const [, owner, repo, rest] = match;
+  return {
+    kind: "git",
+    url: `https://github.com/${owner}/${repo}.git`,
+    ...(rest ? { subpath: rest.slice(1) } : {}),
+  };
+}
 
 export function resolveSource(raw: string): ResolvedSource {
   const trimmed = raw.trim();
   if (existsSync(resolve(trimmed))) {
     return { kind: "local", dir: resolve(trimmed) };
   }
-  if (
-    GIT_URL_RE.test(trimmed) ||
-    trimmed.startsWith("git@") ||
-    trimmed.endsWith(".git")
-  ) {
-    return { kind: "git", url: trimmed };
+  const pinned = COMMIT_FRAGMENT_RE.exec(trimmed);
+  if (pinned) {
+    const git = gitSource(pinned[1]!);
+    if (git) return { ...git, commit: pinned[2]!.toLowerCase() };
+  }
+  return gitSource(trimmed) ?? { kind: "other", raw: trimmed };
+}
+
+/**
+ * Apply a `--commit <sha>` flag to a resolved source: only git sources
+ * take one, and it must agree with a `#<sha>` already in the source.
+ */
+export function withCommit(
+  source: ResolvedSource,
+  commit: string | undefined,
+): { ok: true; source: ResolvedSource } | { ok: false; error: string } {
+  if (commit === undefined) return { ok: true, source };
+  const sha = commit.trim().toLowerCase();
+  if (!COMMIT_RE.test(sha)) {
+    return {
+      ok: false,
+      error: `"${commit}" is not a commit id (7-64 hex digits)`,
+    };
+  }
+  if (source.kind !== "git") {
+    return { ok: false, error: "--commit only applies to git sources" };
   }
-  if (!trimmed.startsWith("@")) {
-    const match = GITHUB_SHORTHAND_RE.exec(trimmed);
-    if (match) {
-      const [, owner, repo, rest] = match;
-      return {
-        kind: "git",
-        url: `https://github.com/${owner}/${repo}.git`,
-        ...(rest ? { subpath: rest.slice(1) } : {}),
-      };
-    }
+  if (source.commit !== undefined && source.commit !== sha) {
+    return {
+      ok: false,
+      error: `--commit ${sha} conflicts with #${source.commit} in the source`,
+    };
   }
-  return { kind: "other", raw: trimmed };
+  return { ok: true, source: { ...source, commit: sha } };
 }
 
 export type CommandOutcome = { ok: true } | { ok: false; error: string };
@@ -105,16 +155,56 @@ function headCommit(dir: string): string | undefined {
   return sha && /^[0-9a-f]{40,64}$/.test(sha) ? sha : undefined;
 }
 
+/** Whether the clone already has `commit` (no network). */
+function hasCommit(dir: string, commit: string): boolean {
+  return (
+    crossSpawn.sync(
+      "git",
+      ["-C", dir, "cat-file", "-e", `${commit}^{commit}`],
+      {
+        stdio: "ignore",
+      },
+    ).status === 0
+  );
+}
+
+/**
+ * `--` stops git's option parsing; refusing a leading dash too means a
+ * hostile "URL" never even reaches git.
+ */
+function dashRefusal(url: string): CloneOutcome | undefined {
+  return url.startsWith("-")
+    ? { ok: false, error: `Refusing a git URL that starts with "-"` }
+    : undefined;
+}
+
+/**
+ * Check out bytes exactly as committed. Windows git defaults to
+ * core.autocrlf=true, which rewrites LF to CRLF on checkout — a pinned
+ * install would then differ from the commit it names, and CRLF frontmatter
+ * fails to parse as a skill. `clone -c` writes this into the new repo's
+ * config, so the later `checkout` honours it too.
+ */
+const EXACT_BYTES = ["-c", "core.autocrlf=false"];
+
+function tempCloneDir(): { dir: string; cleanup: () => void } {
+  const dir = mkdtempSync(join(tmpdir(), "talon-install-"));
+  return { dir, cleanup: () => rmSync(dir, { recursive: true, force: true }) };
+}
+
 /** Shallow-clone into a fresh temp directory. Caller must run `cleanup`. */
 export function cloneShallow(url: string): CloneOutcome {
-  // `--` below already stops option parsing; refusing a leading dash too
-  // means a hostile "URL" never even reaches git.
-  if (url.startsWith("-")) {
-    return { ok: false, error: `Refusing a git URL that starts with "-"` };
-  }
-  const dir = mkdtempSync(join(tmpdir(), "talon-install-"));
-  const cleanup = () => rmSync(dir, { recursive: true, force: true });
-  const outcome = runTool("git", ["clone", "--depth=1", "--", url, dir]);
+  const refused = dashRefusal(url);
+  if (refused) return refused;
+  const { dir, cleanup } = tempCloneDir();
+  const outcome = runTool("git", [
+    "clone",
+    ...EXACT_BYTES,
+    "--depth=1",
+    "--",
+    url,
+    dir,
+  ]);
   if (!outcome.ok) {
     cleanup();
     return { ok: false, error: `Clone failed: ${outcome.error}` };
@@ -122,13 +212,75 @@ export function cloneShallow(url: string): CloneOutcome {
   return { ok: true, dir, commit: headCommit(dir), cleanup };
 }
 
+/**
+ * Clone and check out exactly `commit`, verifying HEAD is that commit.
+ * Caller must run `cleanup`. The clone keeps history (a commit can be
+ * anywhere in it) but fetches file contents only for the checked-out tree.
+ */
+export function cloneAtCommit(url: string, commit: string): CloneOutcome {
+  const refused = dashRefusal(url);
+  if (refused) return refused;
+  const { dir, cleanup } = tempCloneDir();
+  const fail = (error: string): CloneOutcome => {
+    cleanup();
+    return { ok: false, error };
+  };
+  const cloned = runTool("git", [
+    "clone",
+    ...EXACT_BYTES,
+    "--filter=blob:none",
+    "--no-checkout",
+    "--",
+    url,
+    dir,
+  ]);
+  if (!cloned.ok) return fail(`Clone failed: ${cloned.error}`);
+  if (!hasCommit(dir, commit) && commit.length >= 40) {
+    // A commit no branch reaches (a PR head, say): ask for it by id.
+    runTool("git", ["-C", dir, "fetch", "-q", "origin", commit]);
+  }
+  const checkout = runTool("git", [
+    "-C",
+    dir,
+    "checkout",
+    "-q",
+    "--detach",
+    commit,
+    "--",
+  ]);
+  if (!checkout.ok) {
+    return fail(`Commit ${commit} not found in ${url}: ${checkout.error}`);
+  }
+  const head = headCommit(dir);
+  if (!head?.startsWith(commit)) {
+    return fail(`Checked out ${head ?? "nothing"}, not commit ${commit}`);
+  }
+  return { ok: true, dir, commit: head, cleanup };
+}
+
+/** Clone a git source: at its requested commit, else the default branch. */
+export function cloneSource(source: GitSource): CloneOutcome {
+  return source.commit
+    ? cloneAtCommit(source.url, source.commit)
+    : cloneShallow(source.url);
+}
+
 /** The file a git-installed plugin keeps its provenance in. */
 const INSTALL_RECORD = ".talon-install.json";
 
-/** Write where an install came from and exactly which commit it is. */
+/**
+ * Write where an install came from and exactly which commit it is.
+ * `pinned` marks a commit the user asked for, rather than whatever the
+ * default branch pointed at.
+ */
 export function writeInstallRecord(
   dir: string,
-  record: { source: string; subpath?: string; commit?: string },
+  record: {
+    source: string;
+    subpath?: string;
+    commit?: string;
+    pinned?: boolean;
+  },
 ): void {
   writeFileSync(
     join(dir, INSTALL_RECORD),

package/src/cli/plugin.ts

@@ -12,7 +12,9 @@
  * Install sources (see cli/install-sources.ts for the shared grammar):
  * local path and git checkouts become module entries under ~/.talon/plugins;
  * an npm spec installs there too, or registers an `npx` MCP entry with
- * `--mcp`. Windows-safe throughout — tools are spawned via cross-spawn.
+ * `--mcp`. A cloned source installs at a given commit with `#<sha>` or
+ * `--commit <sha>`. Windows-safe throughout — tools are spawned via
+ * cross-spawn.
  */
 
 import pc from "picocolors";
@@ -24,11 +26,12 @@ import { findRunningInstance } from "../core/daemon/discovery.js";
 import { fetchGateway } from "./daemon-api.js";
 import { loadConfig, saveConfig, type Config } from "./config.js";
 import {
-  cloneShallow,
+  cloneSource,
   writeInstallRecord,
   resolveSource,
+  withCommit,
   runTool,
-  type ResolvedSource,
+  type GitSource,
 } from "./install-sources.js";
 import {
   BUILTIN_PLUGINS,
@@ -50,7 +53,8 @@ const USAGE = [
   "  Commands:",
   `    ${pc.cyan("list")}                       Show built-ins and configured plugins`,
   `    ${pc.cyan("install <source>")}           Add a plugin (local path, git URL,`,
-  "                               owner/repo, or npm spec)",
+  "                               owner/repo, or npm spec); a git source",
+  "                               may end in #<commit>",
   `    ${pc.cyan("enable <name>")}              Enable a plugin`,
   `    ${pc.cyan("disable <name>")}             Disable a plugin (kept in config)`,
   `    ${pc.cyan("remove <name>")}              Remove a plugin entry (and its install)`,
@@ -60,6 +64,7 @@ const USAGE = [
   "                               MCP server (npx) instead of a module",
   `    ${pc.cyan("--name <name>")}              Override the derived plugin name`,
   `    ${pc.cyan("--force")}                    Replace an existing install/entry`,
+  `    ${pc.cyan("--commit <sha>")}             Install a git source at this commit`,
   "",
 ].join("\n");
 
@@ -184,7 +189,12 @@ function cmdList(): void {
 
 // ── install ─────────────────────────────────────────────────────────────────
 
-type InstallFlags = { mcp: boolean; force: boolean; name?: string };
+type InstallFlags = {
+  mcp: boolean;
+  force: boolean;
+  name?: string;
+  commit?: string;
+};
 
 function parseInstallArgs(
   args: string[],
@@ -196,10 +206,12 @@ function parseInstallArgs(
     if (arg === "--mcp") flags.mcp = true;
     else if (arg === "--force") flags.force = true;
     else if (arg === "--name") flags.name = args[++i];
+    else if (arg === "--commit") flags.commit = args[++i];
     else if (!arg.startsWith("-") && source === undefined) source = arg;
     else return null;
   }
   if (!source || (flags.name !== undefined && !flags.name)) return null;
+  if (flags.commit !== undefined && !flags.commit) return null;
   return { source, flags };
 }
 
@@ -229,10 +241,7 @@ function installFromLocalDir(dir: string): EntryOutcome {
  * once the staged copy is known-good, so a failed install never destroys
  * a working one.
  */
-function installFromGit(
-  source: Extract<ResolvedSource, { kind: "git" }>,
-  flags: InstallFlags,
-): EntryOutcome {
+function installFromGit(source: GitSource, flags: InstallFlags): EntryOutcome {
   const derived = source.subpath
     ? basename(source.subpath)
     : basename(source.url, ".git");
@@ -245,7 +254,7 @@ function installFromGit(
     };
   }
 
-  const clone = cloneShallow(source.url);
+  const clone = cloneSource(source);
   if (!clone.ok) return { ok: false, error: clone.error };
   try {
     const stage = source.subpath
@@ -265,6 +274,7 @@ function installFromGit(
       source: source.url,
       ...(source.subpath ? { subpath: source.subpath } : {}),
       ...(clone.commit ? { commit: clone.commit } : {}),
+      ...(source.commit ? { pinned: true } : {}),
     });
     if (clone.commit) {
       console.log(`  ${pc.dim(`Commit ${clone.commit}`)}`);
@@ -338,7 +348,13 @@ async function cmdInstall(args: string[]): Promise<void> {
   }
   const { source, flags } = parsed;
 
-  const resolved = resolveSource(source);
+  const pinned = withCommit(resolveSource(source), flags.commit);
+  if (!pinned.ok) {
+    fail(pinned.error);
+    process.exitCode = 1;
+    return;
+  }
+  const resolved = pinned.source;
   let outcome: EntryOutcome;
   switch (resolved.kind) {
     case "local":