tickmarkr 2.6.6 → 2.6.8

package/dist/run/git.js

@@ -1,5 +1,6 @@
-import { executionSignal } from "./execution-budget.js";
-import { commandLeaseEnvironment, withCommandLease } from "./lease.js";
+import { observeVerificationReceipt, observeVerificationSpawn, verificationJobEnvironment } from "./verification-job.js";
+import { executionSignal, withoutExecutionBudget } from "./execution-budget.js";
+import { commandLeaseEnvironment, repositoryLeaseEnvironment, registerRepositoryChild, withCommandLease } from "./lease.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { execFile, execFileSync, spawn } from "node:child_process";
 import { existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, readlinkSync, realpathSync, rmSync, statSync, symlinkSync, writeFileSync } from "node:fs";
@@ -10,6 +11,7 @@ import { shq } from "../adapters/types.js";
 import { tickmarkrDir } from "../graph/graph.js";
 import { ROUTING_ENV_SEAMS } from "../route/router.js";
 import { titleEnvironment } from "./title-environment.js";
+import { assertGitTrust, GitTrustRefusal, ownGitPin, protectedGitEnv, trustedCommonDir } from "./git-trust.js";
 export { ROUTING_ENV_SEAMS };
 // OBS-110: gate/baseline/tip-verify children are vitest suites; without a fork cap, concurrent
 // full-suite gate runs fork a worker-per-core pool per worktree and saturate the operator box.
@@ -257,8 +259,13 @@ export const SPAWN_RETRY_BACKOFF_MS = 50;
 // RULING-P99-28: SHIP — every gate user can hit the inherited-pipe hang at this product seam.
 /** Give a normally-exited shell's descendants this long to close their inherited pipes themselves. */
 const SHELL_REAP_GRACE_MS = 2000;
-/** Shared command seam, including invocation-bound manifested runners. */
+/** Shared command seam, including invocation-bound manifested runners. A PAYLOAD entry: its children keep the
+ * operator's git config (hooks, fsmonitor) and get no checkout pin — ownership follows the entry, never `login`
+ * or the command text. tickmarkr's own git goes through shGit/shGitOk. */
 export function shell(cmd, cwd, timeoutMs, login = false, options = {}) {
+    return shellEntry(cmd, cwd, timeoutMs, login, options, undefined);
+}
+function shellEntry(cmd, cwd, timeoutMs, login, options, ownGit) {
     const inherited = executionSignal();
     const signal = inherited && options.signal ? AbortSignal.any([inherited, options.signal]) : inherited ?? options.signal;
     let attribution;
@@ -289,6 +296,7 @@ export function shell(cmd, cwd, timeoutMs, login = false, options = {}) {
                 activeShells.delete(activePid);
             activePid = undefined;
         }
+        observeVerificationReceipt({ ...receipt, confirmedStart });
         // Observational callbacks must not change process cleanup, retries or cancellation.
         try {
             options.onReceipt?.({ ...receipt, confirmedStart, ...(attribution ? { attribution: { ...attribution } } : {}) });
@@ -302,20 +310,24 @@ export function shell(cmd, cwd, timeoutMs, login = false, options = {}) {
     };
     begin(1);
     checkAbort();
-    return withCommandLease(cmd, () => executeShell(cmd, cwd, timeoutMs, login, { ...options, signal }, { begin, emit, checkAbort }))
+    return withCommandLease(cmd, () => executeShell(cmd, cwd, timeoutMs, login, { ...options, signal }, { begin, emit, checkAbort }, ownGit))
         .catch((error) => {
         if (signal?.aborted)
             emit({ outcome: "cancelled", exitCode: null, signal: null });
         throw error;
     });
 }
-function executeShell(cmd, cwd, timeoutMs, login, options, observation) {
+function executeShell(cmd, cwd, timeoutMs, login, options, observation, ownGit) {
     observation.checkAbort();
     // OBS-74: scrub tickmarkr's own routing env seams from every child — a daemon carrying
     // TICKMARKR_QUALITY leaked it into baseline/gate/tip-verify children, turning a dogfood
     // repo's route() tests red inside the gates. Scrub a copy at this one choke point so
     // children are hermetic by construction; the daemon's own process.env stays unchanged.
-    const env = commandLeaseEnvironment(options.env ?? process.env);
+    // v2.6.7 T4 (E1) / v2.6.8 T2: tickmarkr's OWN git children (shGit/shGitOk) run with core.fsmonitor=false and
+    // an inert hooksPath whatever the repository or inherited GIT_CONFIG_* say; payload children keep the
+    // operator's config. Every other parent, capability and explicit value survives.
+    const payloadEnv = verificationJobEnvironment(repositoryLeaseEnvironment(commandLeaseEnvironment(options.env ?? process.env)));
+    const env = ownGit ? protectedGitEnv(payloadEnv) : payloadEnv;
     for (const k of ROUTING_ENV_SEAMS)
         delete env[k];
     // A run freezes the operator override and cores at startup; admission can lower the round cap.
@@ -340,14 +352,34 @@ function executeShell(cmd, cwd, timeoutMs, login, options, observation) {
     // under. `Number` of an unparseable export is NaN, which every reader treats as malformed and
     // therefore fails closed — the honest direction when the cap in play cannot be stated.
     const capacity = { forkCap: Number(env[FORK_CAP_ENV]), cores: resolvedCapacity().cores };
+    // v2.6.8 T2: the pin's post-exit recheck for the attempt that actually ran its child, and its ref view's release.
+    let recheck, release, unview, store;
     const attempt = () => new Promise((resolve) => {
         const startedAt = Date.now();
         // detached: bash gets its own process group so a timeout can kill the whole tree —
         // SIGKILLing bash alone orphans grandchildren (codex/pi) that hold the stdio pipes
         // open, so "close" never fires and the promise wedges forever (v1.33.1 init hang).
         let p;
+        // v2.6.7 T4: the trust check runs before EVERY spawn attempt (retries included) and caches nothing — a
+        // seat can rewrite its gitdir's commondir/config.worktree between any two calls. A refusal names the file.
+        // v2.6.8 T2 (P3): an own-git attempt in a linked checkout also pins its child (config, objects and the ref store)
+        // to the authority that check derived, and its result is refused when commondir changed before the child exited;
+        // payloads get no pin. The command text never selects a pin.
+        let childEnv = env;
+        recheck = undefined;
+        unview = undefined;
+        store = undefined;
+        try {
+            const pin = ownGit ? ownGitPin(cwd, env, ownGit) : (assertGitTrust(cwd), undefined);
+            if (pin)
+                ({ env: childEnv, recheck, release, unview, store } = pin);
+        }
+        catch (error) {
+            observation.emit({ outcome: "spawn-failed", exitCode: null, signal: null, error: String(error) });
+            throw error;
+        }
         try {
-            p = (spawnChild ?? spawn)("bash", [login ? "-lc" : "-c", cmd], { cwd, env, stdio: ["ignore", "pipe", "pipe"], detached: true });
+            p = (spawnChild ?? spawn)("bash", [login ? "-lc" : "-c", cmd], { cwd, env: childEnv, stdio: ["ignore", "pipe", "pipe"], detached: true });
         }
         catch (error) {
             observation.emit({ outcome: "spawn-failed", exitCode: null, signal: null, error: String(error) });
@@ -428,6 +460,19 @@ function executeShell(cmd, cwd, timeoutMs, login, options, observation) {
             boundDrain();
         };
         options.signal?.addEventListener("abort", abort, { once: true });
+        try {
+            registerRepositoryChild(p.pid);
+        }
+        catch (error) {
+            try {
+                process.kill(-p.pid, "SIGKILL");
+            }
+            catch {
+                p.kill("SIGKILL");
+            }
+            spawnError = String(error);
+        }
+        observeVerificationSpawn(p.pid);
         options.onSpawn?.(p.pid);
         if (options.signal?.aborted)
             abort();
@@ -494,9 +539,29 @@ function executeShell(cmd, cwd, timeoutMs, login, options, observation) {
             if (n > 1)
                 observation.begin(n);
             observation.checkAbort();
-            const r = await attempt();
-            if (!("refused" in r))
-                return r;
+            let r;
+            try {
+                r = await attempt();
+            }
+            finally {
+                release?.();
+                release = undefined;
+            }
+            if (!("refused" in r)) {
+                try {
+                    recheck?.();
+                }
+                catch (error) {
+                    // v2.6.8 T2: a raced worktree add already registered what it created in the trusted store; it is removed through
+                    // the trusted common directory this attempt derived, even while the caller's commondir stays hostile and even
+                    // when the execution budget expired meanwhile; a failed rollback rides on the refusal, never swallowed
+                    const rollback = ownGit && "rollback" in ownGit ? ownGit.rollback : undefined;
+                    if (rollback && store)
+                        await dropWorktree(store, rollback, timeoutMs).catch((failure) => { throw rollbackFailed(error, failure); });
+                    throw error;
+                }
+                return unview ? { ...r, stdout: unview(r.stdout), stderr: unview(r.stderr) } : r;
+            }
             // Bounded, and the bound is what makes a persisting shortage a REPORTED failure rather than a
             // wedged daemon: past it the caller gets the refusal's own text under exit 127, as before.
             if (n >= SPAWN_ATTEMPT_LIMIT) {
@@ -510,8 +575,10 @@ export function sh(cmd, cwd, timeoutMs = DEFAULT_SHELL_TIMEOUT_MS, options = {})
     return shell(cmd, cwd, timeoutMs, true, options);
 }
 // Git plumbing never needs an operator profile; skip login-shell startup and its side effects.
-export function shGit(cmd, cwd, timeoutMs = DEFAULT_SHELL_TIMEOUT_MS) {
-    return shell(cmd, cwd, timeoutMs, false);
+// v2.6.8 T2: the explicit OWN-GIT entry — forced inert hooks/fsmonitor and, in a linked checkout, the trusted-path and
+// ref-store pin.
+export function shGit(cmd, cwd, timeoutMs = DEFAULT_SHELL_TIMEOUT_MS, own = {}) {
+    return shellEntry(cmd, cwd, timeoutMs, false, {}, own);
 }
 export async function shOk(cmd, cwd) {
     const r = await sh(cmd, cwd);
@@ -519,12 +586,88 @@ export async function shOk(cmd, cwd) {
         throw new Error(`command failed (${r.code}): ${cmd}\n${r.stderr || r.stdout}`);
     return r.stdout;
 }
-export async function shGitOk(cmd, cwd) {
-    const r = await shGit(cmd, cwd);
+export async function shGitOk(cmd, cwd, own = {}) {
+    const r = await shGit(cmd, cwd, DEFAULT_SHELL_TIMEOUT_MS, own);
     if (r.code !== 0)
         throw new Error(`command failed (${r.code}): ${cmd}\n${r.stderr || r.stdout}`);
     return r.stdout;
 }
+/**
+ * v2.6.8 T2: the DETACHED worktree capability, declared by calling it (the daemon's baseline recapture and standalone
+ * verify's base worktree). Under the ref-store pin git stubs a detached add's new HEAD as `ref: refs/heads/.invalid`
+ * and checks out nothing, and no own-git step ever runs unpinned instead: the commit-ish is resolved to an object id in
+ * `cwd`'s checkout (HEAD and branch names read the trusted store), the checkout is added `--no-checkout --detach` at
+ * that id (its ref store pinned to the trusted common directory, see DetachedAddCapability), and then — pinned to the
+ * NEW checkout's own authority — its HEAD is written as that id, git's `refs/heads/.invalid` stub ref is deleted and the
+ * checkout is populated.
+ * A step raced by a commondir change is refused by name before the next one runs, and what the add created is rolled
+ * back through the trusted common directory derived here once (dropWorktree), even while that commondir stays hostile.
+ */
+export async function addDetachedWorktree(cwd, dir, commitish, timeoutMs = DEFAULT_SHELL_TIMEOUT_MS) {
+    // the authority this operation keeps, rollback included: derived once from the trusted layout, never a commondir
+    const store = trustedCommonDir(cwd);
+    const resolved = await shGit(`git rev-parse --verify --end-of-options ${shq(`${commitish}^{commit}`)}`, cwd, timeoutMs);
+    if (resolved.code !== 0)
+        return resolved;
+    const oid = resolved.stdout.trim();
+    // under a ref payload git also resolves its new-HEAD stub into a shared refs/heads/.invalid; it is deleted again
+    const rollback = { dir, branch: { name: ".invalid" } };
+    const added = await shellEntry(`git worktree add --no-checkout --detach ${shq(dir)} ${shq(oid)}`, cwd, timeoutMs, false, {}, { createsWorktree: "detached", rollback });
+    if (added.code !== 0)
+        return added;
+    let repaired;
+    try {
+        repaired = await shGit(`git update-ref --no-deref HEAD ${shq(oid)} && git update-ref -d refs/heads/.invalid && git reset -q --hard --no-recurse-submodules`, dir, timeoutMs);
+    }
+    catch (error) {
+        await dropWorktree(store, rollback, timeoutMs).catch((failure) => { throw rollbackFailed(error, failure); });
+        throw error;
+    }
+    if (repaired.code !== 0)
+        await dropWorktree(store, rollback, timeoutMs);
+    return repaired;
+}
+/** A failed rollback is never swallowed: it rides on the error the operation already throws (a refusal stays one). */
+function rollbackFailed(error, failure) {
+    const why = `; its rollback failed, so what it created may remain: ${failure instanceof Error ? failure.message : String(failure)}`;
+    return error instanceof GitTrustRefusal ? new GitTrustRefusal(error.path, `${error.detail}${why}`, { cause: failure })
+        : new AggregateError([error, failure], `${error instanceof Error ? error.message : String(error)}${why}`);
+}
+/**
+ * Removes a checkout `dir` and its registration — and, when named, a branch the add created (deleted) or moved
+ * (restored to `prior`) — through `store`, a trusted common directory derived from the layout (TrustedStoreCapability):
+ * nothing here reads the caller's checkout, so it completes while that checkout's commondir is hostile. Cleanup only, so
+ * it runs outside any execution budget (an expired one would refuse every step and leave what the add created), each
+ * step bounded by `timeoutMs`; every step is tried, and any that failed is thrown, never swallowed.
+ */
+async function dropWorktree(store, { dir, branch }, timeoutMs = DEFAULT_SHELL_TIMEOUT_MS) {
+    const failed = await withoutExecutionBudget(async () => {
+        const run = async (cmd) => {
+            try {
+                const r = await shellEntry(cmd, store, timeoutMs, false, {}, { store });
+                return r.code === 0 ? undefined : `${cmd} (${r.code}): ${(r.stderr || r.stdout).trim()}`;
+            }
+            catch (error) {
+                return `${cmd}: ${String(error)}`;
+            }
+        };
+        await run(`git worktree remove --force ${shq(dir)}`); // best-effort; the steps below decide
+        const steps = [`rm -rf ${shq(dir)}`, "git worktree prune"];
+        if (branch) {
+            const ref = shq(`refs/heads/${branch.name}`);
+            steps.push(branch.prior ? `git update-ref ${ref} ${shq(branch.prior)}` : `git update-ref -d ${ref}`);
+        }
+        const out = [];
+        for (const cmd of steps) {
+            const f = await run(cmd);
+            if (f)
+                out.push(f);
+        }
+        return out;
+    });
+    if (failed.length)
+        throw new Error(`cleanup of ${dir} through ${store} failed: ${failed.join("; ")}`);
+}
 const NPM_DEPENDENCY_MANIFESTS = ["package.json", "package-lock.json", "npm-shrinkwrap.json"];
 // OBS-126: compare the whole attempt (committed, staged, unstaged, or newly added manifest) with
 // the task's integration-tip baseline. A committed package.json change is invisible to `git status`,
@@ -678,7 +821,10 @@ export async function createWorktree(repo, branch, baseRef) {
     const dir = join(tickmarkrDir(repo), WORKTREES_DIR, sanitize(branch));
     if (existsSync(dir))
         await removeWorktree(repo, dir);
-    await shGitOk(`git worktree add -B ${shq(branch)} ${shq(dir)} ${shq(baseRef)}`, repo);
+    // the worktree capability: a branch add, whose symbolic HEAD keeps the ref-store pin (see OwnGitCapability); a raced
+    // add is rolled back, its branch restored to the value read here or deleted when it is new
+    const prior = (await shGit(`git rev-parse --verify -q ${shq(`refs/heads/${branch}`)}`, repo)).stdout.trim() || undefined;
+    await shGitOk(`git worktree add -B ${shq(branch)} ${shq(dir)} ${shq(baseRef)}`, repo, { createsWorktree: "branch", rollback: { dir, branch: { name: branch, prior } } });
     linkNodeModules(repo, dir);
     return dir;
 }
@@ -693,21 +839,14 @@ export async function createWorktree(repo, branch, baseRef) {
 // match the provisioned SYMLINK, so a worker staging with `git add -A` commits the link and burns an
 // attempt on the scope gate. Write `node_modules` (no slash: matches the link too) into the exclude
 // file git actually consults for this worktree. Per-worktree `info/` is ignored in linked worktrees
-// (gitrepository-layout redirects it), so resolve through the `.git` gitfile + `commondir` indirection
-// to the common git dir. Local git metadata only — the target repository's .gitignore is never edited.
+// (gitrepository-layout redirects it), so write the common git dir's exclude. Local git metadata only — the target repository's .gitignore is never edited.
 // Idempotent (appends only when no entry exists) and best-effort, like the link itself.
+// v2.6.7 T4 (W1): the common dir is the independently derived one (trustedCommonDir), never what a
+// seat-writable commondir names — a redirected commondir never receives the write.
 function excludeNodeModules(dir) {
     try {
-        let gitDir = join(dir, ".git");
-        if (lstatSync(gitDir).isFile()) { // linked worktree: .git is a gitfile naming the real git dir
-            const m = /^gitdir:\s*(.+?)\s*$/m.exec(readFileSync(gitDir, "utf8"));
-            if (!m)
-                return;
-            gitDir = resolve(dir, m[1]);
-        }
-        const commondir = join(gitDir, "commondir");
-        if (existsSync(commondir))
-            gitDir = resolve(gitDir, readFileSync(commondir, "utf8").trim());
+        lstatSync(join(dir, ".git")); // only the checkout itself, never an enclosing repository
+        const gitDir = trustedCommonDir(dir);
         const exclude = join(gitDir, "info", "exclude");
         const current = existsSync(exclude) ? readFileSync(exclude, "utf8") : "";
         if (/^node_modules$/m.test(current))
@@ -886,10 +1025,10 @@ export async function changeRepresented(cwd, commit, dest = "HEAD") {
     const tree = await shGit(`git rev-parse ${shq(`${dest}^{tree}`)}`, cwd);
     return tree.code === 0 && merged.stdout.split("\n")[0].trim() === tree.stdout.trim();
 }
+// v2.6.8 T2: through the trusted common directory derived once from `repo`'s layout, never `repo`'s mutable commondir,
+// so a checkout is removed even while that commondir stays hostile (see dropWorktree)
 export async function removeWorktree(repo, dir) {
-    await shGit(`git worktree remove --force ${shq(dir)}`, repo); // best-effort; stale dirs are re-added with -B
-    await shGit(`rm -rf ${shq(dir)}`, repo);
-    await shGit("git worktree prune", repo);
+    await dropWorktree(trustedCommonDir(repo), { dir });
 }
 export const REFS_PREFLIGHT_PREFIX = "refs/tickmarkr/preflight";
 export const REFS_PROBE_REMEDY = "run from the main repository or a full clone; a sandbox that denies writes under that path cannot host a run";

package/dist/run/journal.js

@@ -11,6 +11,7 @@ import { channelRouteIdentity, modelProvider } from "../route/preference.js";
 import { buildProfile, classify } from "../route/profile.js";
 import { DecisionEventSchema, trackJournalRows, } from "./protocol.js";
 import { PRESERVE_COMMIT_SUBJECT, PRESERVE_PRODUCER_TRAILER } from "./git.js";
+import { assertGitTrust, protectedGitEnv } from "./git-trust.js";
 import { normalizeGateOutcome } from "./outcome.js";
 import { redactSecrets } from "./redact.js";
 export function phaseForGate(gate) {
@@ -2398,9 +2399,17 @@ export class Journal {
 // "unknown" — never zero — for a waiver without a well-formed obligation or a proof that no longer holds.
 export const OWED_CHECK_VERSION = 1;
 export const OWED_DISCHARGE_EVENT = "owed-check-discharged";
-const owedGit = (cwd, args, input) => execFileSync("git", args, {
-    cwd, encoding: "utf8", maxBuffer: 64 * 1024 * 1024, ...(input === undefined ? { stdio: ["ignore", "pipe", "pipe"] } : { input }),
-});
+// v2.6.7 T4: every owed-identity git call runs the uncached trust check and the forced child config, and its
+// diff-producing verbs never run an external diff or textconv driver; a refusal throws, so the fold is unknown.
+const NO_DRIVERS = new Set(["diff", "show", "log"]);
+const owedGit = (cwd, args, input) => {
+    assertGitTrust(cwd);
+    const argv = NO_DRIVERS.has(args[0]) ? [args[0], "--no-ext-diff", "--no-textconv", ...args.slice(1)] : args;
+    return execFileSync("git", argv, {
+        cwd, env: protectedGitEnv(process.env), encoding: "utf8", maxBuffer: 64 * 1024 * 1024,
+        ...(input === undefined ? { stdio: ["ignore", "pipe", "pipe"] } : { input }),
+    });
+};
 const sha256 = (text) => createHash("sha256").update(text).digest("hex");
 export const owedCriteria = (acceptance) => sha256(JSON.stringify(acceptance));
 /** The daemon's canonical gate subject for base..head (daemon.ts gateCommitSubject), byte for byte. */
@@ -2700,6 +2709,9 @@ export function foldOwedChecks(events, cwd, memo) {
     }
 }
 function foldOwedChecksOrThrow(events, cwd, memo) {
+    // v2.6.7 T4 (G2): checkout trust is re-derived at the fold boundary, before a memoised proof can answer —
+    // a memo hit runs no git, so hostile metadata would otherwise ride a clean fold's cached proof to known debt.
+    assertGitTrust(cwd);
     const accepted = new Map();
     const discharged = new Set();
     const unknown = [];

package/dist/run/lease.d.ts

@@ -27,6 +27,13 @@ export interface RepositoryLeaseHolder {
     cwd: string;
     at: number;
     token: string;
+    /** Exact owner birth and token-bound execution roots; retained across owner death. */
+    identity?: string;
+    protectOrphans?: true;
+    /** The owner settled; only its protected tree can still block reclamation. */
+    ownerReleased?: true;
+    roots?: number[];
+    rootBirths?: Record<string, string>;
 }
 export interface RepositoryLeaseOptions {
     pollMs?: number;
@@ -35,6 +42,13 @@ export interface RepositoryLeaseOptions {
     onWait?: (holder: RepositoryLeaseHolder) => void;
     /** The token a descendant inherited; defaults to REPOSITORY_LEASE_TOKEN_ENV. */
     inherited?: string;
+    /** Manifest jobs bridge capabilities through explicit child environments, never process.env. */
+    isolated?: boolean;
+    protectOrphans?: boolean;
+    onAdmission?: (holder: RepositoryLeaseHolder) => void;
+    onRelease?: () => void;
+    /** A new job inside an existing job cannot borrow that job's async capability. */
+    independent?: boolean;
 }
 /** OBS-880/1071: the file lease's token, exported to the holder's descendants for the span it is held
  * so a nested runner (a gate's suite under `tickmarkr verify`, a mutation child inside a leased suite)
@@ -68,4 +82,13 @@ export declare const readHolder: (path: string) => RepositoryLeaseHolder | undef
 export declare function tryReserve(path: string, mine: RepositoryLeaseHolder): boolean;
 /** Exposed for recovery regressions; the standalone verify uses the combined critical section. */
 export declare const reclaimDead: (path: string, identity: string, pollMs?: number) => Promise<boolean>;
+export declare function protectedProcesses(holder: RepositoryLeaseHolder, tokenEnv?: string, ownedOnly?: boolean): Promise<number[]>;
+export declare const repositoryLeaseEnvironment: (env: NodeJS.ProcessEnv) => NodeJS.ProcessEnv;
+/** Called synchronously at spawn, before any user callback, and only on an owned generation. */
+export declare function registerRepositoryChild(pid: number | undefined): void;
+export declare const withFreshCommandLease: <T>(command: string, run: () => Promise<T>) => Promise<T>;
+/** The standalone wrapper uses the same command-then-repository order when a scheduler exists.
+ * Without one (CLI/global setup), this remains exactly the outer file reservation API. */
 export declare function withRepositoryLease<T>(cwd: string, run: () => Promise<T>, opts?: RepositoryLeaseOptions): Promise<T>;
+export declare const hasRepositoryLeaseOwnership: () => boolean;
+export declare function reapRepositoryChildren(holder: RepositoryLeaseHolder, pollMs: number, tokenEnv?: string): Promise<void>;