tickmarkr 2.6.7 → 2.6.9

package/dist/run/daemon.d.ts

@@ -140,6 +140,10 @@ export declare const watchCommand: (runId: string) => string;
  * skip stays satisfied; a gate that ran and passed stays satisfied.
  */
 export declare const gateSatisfied: (g: GateResult) => boolean;
+/** OBS-1010 / v2.6.8 T1: the review seats a journal's demotions carry into a resumed run as a SOFT
+ * preference (ranked last, never excluded) — every review-pool-demotion except the launch-caused ones, which
+ * never demote a seat (live or replayed). plan.ts previews a resume with this same fold. */
+export declare function replayedReviewerDemotions(events: readonly JournalEvent[]): Set<string>;
 /**
  * T4 (OBS-265): the journal with the review objections a round did NOT hinge on removed. Judge and
  * review are now launched together, so a round can journal a failed review that the serial walk would

package/dist/run/daemon.js

@@ -33,7 +33,7 @@ import { executionSignal, remainingExecutionMs, withExecutionBudget, withoutExec
 import { repairSelectionDecision, repairSelectionEnabled } from "./repair-selection.js";
 import { failureDisposition, reserveInfrastructureRetry } from "./recovery.js";
 import { runEnvironment } from "./environment.js";
-import { changeRepresented, cleanupRunWorktrees, deriveForkCap, FORK_CAP_ENV, gitHead, linkNodeModules, npmDependencyInstallCommand, npmDependencyManifestChanged, PRESERVE_COMMIT_SUBJECT, PRESERVE_PRODUCER_TRAILER, preserveWorktree, producerFields, removeWorktree, resolvedCapacity, runWithForkBudget, runWithVerificationBudget, sameCapacity, sameVerification, sh, shGit, SUITE_PARENT_ENV, verificationProtocol, WORKTREE_LAYOUT_CONTRACT, WORKTREES_DIR, worktreePath } from "./git.js";
+import { addDetachedWorktree, changeRepresented, cleanupRunWorktrees, deriveForkCap, FORK_CAP_ENV, gitHead, linkNodeModules, npmDependencyInstallCommand, npmDependencyManifestChanged, PRESERVE_COMMIT_SUBJECT, PRESERVE_PRODUCER_TRAILER, preserveWorktree, producerFields, removeWorktree, resolvedCapacity, runWithForkBudget, runWithVerificationBudget, sameCapacity, sameVerification, sh, shGit, SUITE_PARENT_ENV, verificationProtocol, WORKTREE_LAYOUT_CONTRACT, WORKTREES_DIR, worktreePath } from "./git.js";
 import { MASK } from "./redact.js";
 import { runInteractiveSeed } from "./interactive-seed.js";
 import { classifyRepairDisposition, resolveScopeHints } from "./repair-disposition.js";
@@ -376,9 +376,26 @@ function classifyInfraResult(g) {
 // diagnostics (never-started files, a worker RPC timeout) that make such a red infrastructure-SHAPED.
 // Shape alone never parks anything: it only buys one isolated re-observation before a charge. A
 // fresh-fingerprint section masks digits to `#`, so both spellings of a number are read.
-/** C (E1): the one no-verdict that is the host's slowness, not the seat's — the same predicate run-gates
- * applies to its run-scoped tally, read here for the live task strike and the resume reconstruction. */
-const proofTimeoutNote = (data) => data.cause === "seat-launch-failed" && data.launchCause === "checkout-proof-timeout";
+/** v2.6.8 T1: a seat that never LAUNCHED (any launchCause — checkout-proof-timeout, none, or other
+ * detail) is not a seat that failed to answer — the same predicate run-gates applies to its run-scoped
+ * tally, read here for the live task strike and the resume reconstruction. It never strikes. */
+const launchFailureNote = (data) => data.cause === "seat-launch-failed";
+/** v2.6.8 T1: a journaled review-pool-demotion a launch failure caused. The pre-2.6.8 engine struck seats
+ * that never launched, so an older journal can carry a demotion whose trigger was a launch failure, or whose
+ * two-strike pair counted one beside a single real no-verdict that was not silent on its own. */
+const launchCausedDemotion = (data) => {
+    if (launchFailureNote(data))
+        return true;
+    const silent = data.seatAuthoredBytes === 0 || data.cause === "silent" || data.cause === "launch-never-started";
+    return Array.isArray(data.causes) && !silent && data.causes.filter((cause) => cause !== "seat-launch-failed").length < 2;
+};
+/** OBS-1010 / v2.6.8 T1: the review seats a journal's demotions carry into a resumed run as a SOFT
+ * preference (ranked last, never excluded) — every review-pool-demotion except the launch-caused ones, which
+ * never demote a seat (live or replayed). plan.ts previews a resume with this same fold. */
+export function replayedReviewerDemotions(events) {
+    return new Set(events.filter((event) => event.event === "review-pool-demotion" && typeof event.data.reviewer === "string"
+        && !launchCausedDemotion(event.data)).map((event) => event.data.reviewer));
+}
 /** C: the gate-fresh-forced reason that bounds the out-of-scope re-execution, one per journaled subject. */
 const OUTSIDE_SCOPE_RED = "no-commit-out-of-scope-red";
 const NAMED_FAILURE_FILE_RE = /^\s*(\S+\.(?:test|spec)\.[cm]?[jt]sx?)\s+>/gm;
@@ -2232,25 +2249,25 @@ export async function runDaemon(repoRoot, opts = {}) {
                 process.on("SIGINT", onTermination);
                 process.on("SIGTERM", onTermination);
                 journal = opts.resume ? Journal.open(repoRoot, runId, opts.narrate) : Journal.create(repoRoot, runId, opts.narrate);
-                const demotedReviewers = new Set(journal.read()
-                    .filter((event) => event.event === "review-pool-demotion" && typeof event.data.reviewer === "string")
-                    .map((event) => event.data.reviewer));
-                // OBS-1010: a demotion the JOURNAL carries into this session left the rotation for the run — a
-                // resumed daemon excludes that seat from every review pick (reviewer role only; the worker channel
-                // is untouched — channel-demotion is the worker fold, replayExcludedChannels). In-session demotions
-                // keep their soft ordering above so a still-live seat can be re-tried at the end of the rotation.
-                const replayedReviewerExclusions = opts.resume ? [...demotedReviewers] : [];
+                // OBS-1010 / v2.6.8 T1: a demotion the JOURNAL carries into this session is replayed as what it was
+                // live — a SOFT preference (reviewer role only; the worker channel is untouched — channel-demotion is
+                // the worker fold, replayExcludedChannels). The seat ranks last, even over prefer, and may still be
+                // re-tried at the end of the rotation; a resume never hardens one strike into an exclusion. Retirement
+                // is the only hard rule: two real no-verdict strikes (the tally below) put a seat out for the run,
+                // in-session and after resume alike, whatever prefer or history say. A launch-caused demotion an older
+                // engine journaled is not replayed at all — neither soft nor hard.
+                const demotedReviewers = replayedReviewerDemotions(journal.read());
                 // OBS-1025 add.2 / OBS-1052 (Leg-2): the run-scoped no-verdict tally run-gates retires a seat from at two
                 // strikes. execTask's badReviewers already excludes a seat after ONE strike within a task, so this map
                 // is what bounds a seat that flakes once per task (or once per session) across the run. Seeded from the
                 // journal's review-no-verdict rows — the same notes noteReviewEvent appends — so a resumed daemon keeps
                 // the count; run-gates appends to it in place, exactly as it does demotedReviewers.
-                // C (E1): a checkout-proof timeout never struck the live tally (run-gates), so a resume never seeds one.
+                // v2.6.8 T1: a launch failure never struck the live tally (run-gates), so a resume never seeds one.
                 const reviewNoVerdicts = new Map();
                 for (const event of journal.read()) {
                     if (event.event !== "review-no-verdict" || event.data.noVerdict !== true || typeof event.data.reviewer !== "string")
                         continue;
-                    if (proofTimeoutNote(event.data))
+                    if (launchFailureNote(event.data))
                         continue;
                     reviewNoVerdicts.set(event.data.reviewer, [...(reviewNoVerdicts.get(event.data.reviewer) ?? []), String(event.data.cause)]);
                 }
@@ -2777,7 +2794,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                             const pristine = mkdtempSync(join(parent, `baseline-recapture-${process.pid}-`));
                             const staged = `${baselinePath}.${process.pid}.tmp`;
                             try {
-                                const added = await shGit(`git worktree add --detach ${shq(pristine)} ${shq(baseRef)}`, repoRoot);
+                                // the detached worktree capability (see addDetachedWorktree); a commondir moved while it ran is refused
+                                const added = await addDetachedWorktree(repoRoot, pristine, baseRef);
                                 if (added.code !== 0)
                                     throw new Error(`baseline recapture: journaled base ${baseRef} cannot be checked out: ${added.stderr.trim()}`);
                                 if (!linkNodeModules(repoRoot, pristine, { force: true }))
@@ -3413,15 +3431,19 @@ export async function runDaemon(repoRoot, opts = {}) {
                         await park(t, `${bootstrapExhausted} failed at bootstrap and no eligible channel remains after resume${poolExhaustion(t, cfg)}`, "infra", assignment, rs?.attempts ?? 0, startMs, 0, 0, undefined, 0, "fresh", { cause: "bootstrap", channel: bootstrapExhausted });
                         return;
                     }
-                    // Keep one live list: recovery retries must see exclusions added by onGate during the round.
-                    const badReviewers = [...replayedReviewerExclusions];
-                    // C (E1): a checkout-proof timeout is the host being slow, not the seat failing — it is excluded for
-                    // the CURRENT round only (so an always-timeout pool still ends the round), never struck task-wide.
+                    // Keep one live list: recovery retries must see exclusions added by onGate during the round. It starts
+                    // empty on resume too: a replayed demotion is soft (demotedReviewers), retirement is the run tally.
+                    const badReviewers = [];
+                    // v2.6.8 T1: a seat that failed to launch (any launchCause) is excluded for the CURRENT round only —
+                    // after its one bounded same-seat launch retry (run-gates), so an always-refusing pool still ends the
+                    // round — and is never struck task-wide or run-wide: a later round may seat it again.
                     let roundTimeouts = [];
-                    const noteReviewEvent = (e) => {
+                    const noteReviewEvent = (note) => {
+                        // The same-seat launch retry is bounded per candidate: its row carries the commit it was spent on.
+                        const e = note.name === "review-infra-retry" && gateSubject ? { ...note, payload: { ...note.payload, commit: gateSubject.commit } } : note;
                         journal.append(e.name, t.id, e.payload);
                         if (e.name === "review-no-verdict" && typeof e.payload.reviewer === "string") {
-                            const strikes = proofTimeoutNote(e.payload) ? roundTimeouts : badReviewers;
+                            const strikes = launchFailureNote(e.payload) ? roundTimeouts : badReviewers;
                             if (!strikes.includes(e.payload.reviewer))
                                 strikes.push(e.payload.reviewer);
                         }
@@ -3434,7 +3456,8 @@ export async function runDaemon(repoRoot, opts = {}) {
                         }
                     };
                     // Keep the measured siblings, including a red judge, while replacing only a missing review.
-                    // Every dispatched seat is excluded for this task, so the loop is bounded by the eligible pool.
+                    // Every seat that returned no verdict is excluded for this task — a launch failure for this round only,
+                    // after its one bounded relaunch — and a retired seat for the run, so the loop is bounded by the eligible pool.
                     const runReviewRecovery = async (task, ctx, allowSelection = true) => {
                         ctx.authorizeInfraRetry = cfg.executionPolicy?.boundedInfrastructure
                             ? (subject, cause) => reserveInfrastructureRetry(journal.read(), task.id, subject, journal.append.bind(journal), cause) : undefined;
@@ -3460,28 +3483,83 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 && row.event === "phase-start" && row.data.phase === "gates").length,
                         };
                         roundTimeouts = [];
+                        // v2.6.8 T1: the same-seat launch retries this candidate already spent, replayed from the journal so
+                        // a recovery round, a recheck or a resume never re-grants one (and never turns one into a strike).
+                        const launchRetried = () => journal.read().filter((row) => row.taskId === task.id && row.event === "review-infra-retry"
+                            && row.data.sameSeat === true && row.data.commit === gateSubject?.commit && typeof row.data.reviewer === "string")
+                            .map((row) => row.data.reviewer);
                         // C: every gate-round boundary — a returned or a THROWN round — publishes the one row held behind
                         // a still-pending sibling and forgets the pending set, before any park or task-failed row lands.
+                        // v2.6.8 T1: a review result whose recovery pool is retired-only is classified BEFORE it is published
+                        // (retiredOnly), and the round returns that same parked result, so the journal row and the result the
+                        // park reads state one outcome — an infrastructure no-verdict, never a failed review.
                         const gateRound = async (subject) => {
+                            const parked = new Map();
                             try {
-                                return await runGates(subject, { ...ctx, excludeReviewers: [...badReviewers, ...roundTimeouts] });
+                                const done = await runGates(subject, { ...ctx, excludeReviewers: [...badReviewers, ...roundTimeouts], launchRetried: launchRetried(),
+                                    onGate: async (e) => {
+                                        const park = e.phase === "end" && e.gate === "review" ? retiredOnly(e.result) : undefined;
+                                        if (park === undefined || e.phase !== "end")
+                                            return ctx.onGate?.(e);
+                                        parked.set(e.result, park);
+                                        return ctx.onGate?.({ ...e, result: park });
+                                    } });
+                                return { ...done, results: done.results.map((g) => parked.get(g) ?? g) };
                             }
                             finally {
                                 settleParallelRound();
                             }
                         };
-                        const round = await gateRound(task);
-                        let review = round.results.find((g) => g.gate === "review");
                         // The recovery pick carries every preserved author, exactly as reviewGate's own pick does.
                         const authors = ctx.carriedAuthors?.length ? [...ctx.carriedAuthors] : [channelKey(ctx.author)];
-                        while (review?.meta?.noVerdict === true) {
-                            // Recovery must honor the gate's floor, including the seats that just failed to
-                            // return a verdict; a below-floor alternative cannot replace the infra result. This round's
-                            // proof timeouts count too — runGates folds every excluded seat into its own floor.
-                            const { floor } = gateReviewerFloor(task, ctx.cfg, ctx.author, ctx.channels, [...(ctx.priorReviewers ?? []), ...badReviewers, ...roundTimeouts]);
-                            const next = pickReviewer(ctx.author, ctx.channels, [...badReviewers, ...roundTimeouts], cfg.review.prefer ?? [], floor, reviewHistory, undefined, demotedReviewers, carriedAuthorVendors(ctx.channels, authors), authors);
-                            if (!next)
+                        // Recovery must honor the gate's floor, including the seats that just failed to
+                        // return a verdict; a below-floor alternative cannot replace the infra result. This round's
+                        // launch failures count too — runGates folds every excluded seat into its own floor.
+                        const pick = (exclude) => pickReviewer(ctx.author, ctx.channels, exclude, cfg.review.prefer ?? [], gateReviewerFloor(task, ctx.cfg, ctx.author, ctx.channels, [...(ctx.priorReviewers ?? []), ...badReviewers, ...roundTimeouts]).floor, reviewHistory, undefined, demotedReviewers, carriedAuthorVendors(ctx.channels, authors), authors);
+                        // v2.6.8 T1: soft preference is not retirement. demotedReviewers — live or replayed on resume — only
+                        // ranks a seat last, so a once-demoted seat stays seatable; a seat two REAL no-verdict strikes retired
+                        // is out for the run, so every recovery pick excludes it outright — prefer and history can never
+                        // resurrect it, and runGates would refuse it anyway. A launch failure is neither: it buys one bounded
+                        // same-seat relaunch per candidate (launchRetried) and then leaves the seat out of THIS round only.
+                        const retiredSeats = () => [...reviewNoVerdicts].filter(([, causes]) => causes.length >= 2).map(([seat]) => seat);
+                        // The retired-only recovery park: when retirement is what empties the pool (the pick without the
+                        // retired exclusion would seat a retired seat), record the seat the pool cannot seat and why, buy
+                        // no dispatch, and park infrastructure naming it out for the run — never a soft-ranked pick that
+                        // dispatches it again, never a gate-fail. The tally is seeded from the journal, so every resume
+                        // or recheck replays this same row and park, whether its round dispatched a seat or found none.
+                        // It is decided where the review result is published (gateRound): a round that found no eligible
+                        // reviewer, or a no-verdict no recovery pick can replace — and once more after the round,
+                        // should another task retire a seat in between. The parked result is the same no-verdict shape every
+                        // review.ts no-verdict has: in memory `pass: false` (GateResult.pass is a boolean, and an unreviewed
+                        // candidate fails closed — it never merges), `noVerdict` + `infra`; the gate-result row written for a
+                        // noVerdict review below drops `pass` and adds `skipped`, so outcome readers, round budgets and
+                        // failure counters read one infrastructure outcome, and the infra park — not the gate-fail one — is
+                        // what the task gets.
+                        const retiredOnly = (r) => {
+                            if (r.meta?.cannotSeat !== undefined || (r.meta?.noEligibleReviewer !== true && (r.meta?.noVerdict !== true
+                                || pick([...badReviewers, ...roundTimeouts, ...retiredSeats()]))))
+                                return undefined;
+                            const retired = retiredSeats();
+                            const blocked = pick([...badReviewers, ...roundTimeouts].filter((seat) => !retired.includes(seat)));
+                            if (!blocked || !retired.includes(channelKey(blocked)))
+                                return undefined;
+                            const seat = channelKey(blocked);
+                            const causes = reviewNoVerdicts.get(seat) ?? [];
+                            journal.append("review-infra-retry", t.id, { reviewer: seat, cause: "retired", cannotSeat: true, causes });
+                            const { noEligibleReviewer: _none, ...meta } = r.meta ?? {};
+                            return { ...r, pass: false, meta: { cause: "retired", ...meta, noVerdict: true, cannotSeat: seat, infra: true, classification: "infra" },
+                                details: `${r.details}\nreview recovery cannot seat ${seat}: two real no-verdicts (${causes.join(", ")}) retired it — it is out for the run, and no other eligible seat remains` };
+                        };
+                        const round = await gateRound(task);
+                        let review = round.results.find((g) => g.gate === "review");
+                        while (review?.meta?.noVerdict === true && review.meta.cannotSeat === undefined) {
+                            const next = pick([...badReviewers, ...roundTimeouts, ...retiredSeats()]);
+                            if (!next) {
+                                const parked = retiredOnly(review);
+                                if (parked)
+                                    round.results = round.results.map((g) => g === review ? parked : g);
                                 break;
+                            }
                             journal.append("review-infra-retry", t.id, { reviewer: channelKey(next), cause: review.meta.cause });
                             const retried = await gateRound({ ...task, gates: ["review"] });
                             const replacement = retried.results.find((g) => g.gate === "review");
@@ -3510,7 +3588,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                                 gate: "review", flaked: rr.flaked, retried: rr.retried,
                                 ...(g.meta?.unparseable === true ? { secondUnparseable: true } : {}),
                             });
-                            // C (E1): a seat re-routed after a checkout-proof timeout is excluded for this round only.
+                            // v2.6.8 T1: a seat re-routed after a launch failure is excluded for this round only.
                             if (!roundTimeouts.includes(rr.flaked))
                                 badReviewers.push(rr.flaked);
                         }

package/dist/run/git-trust.d.ts

@@ -1,7 +1,8 @@
 /** A covered git invocation refused before spawn; `path` names the offending metadata. */
 export declare class GitTrustRefusal extends Error {
     readonly path: string;
-    constructor(path: string, detail: string);
+    readonly detail: string;
+    constructor(path: string, detail: string, options?: ErrorOptions);
 }
 /**
  * The canonical, independently expected common git directory for the checkout enclosing `cwd` — never what
@@ -15,13 +16,87 @@ export declare function trustedCommonDir(cwd: string): string;
  * extensions.worktreeConfig and the linked gitdir holds a config.worktree.
  */
 export declare function assertGitTrust(cwd: string): void;
+/** The child of tickmarkr's own git in a linked checkout: its pinned environment, the post-exit recheck and its release. */
+export interface OwnGitPin {
+    /** The whole child environment: the caller's, with the pin set and every unpinned inherited ref backend removed. */
+    env: NodeJS.ProcessEnv;
+    /** Throws GitTrustRefusal naming commondir when it changed in ANY way since the check that derived `env`. */
+    recheck: () => void;
+    /** Removes this attempt's private ref view; called once its child has exited, or when it never spawned. */
+    release: () => void;
+    /** git names ref paths through the view; its output names the trusted common directory instead. */
+    unview: (text: string) => string;
+    /** The trusted common directory this attempt derived from the layout: the authority a raced worktree add rolls back through. */
+    store: string;
+}
+/**
+ * v2.6.8 T2: what an own-git CALLER declares at its call site — never read from the command text, its tokens, login or
+ * cwd, and never a way out of any pin: every own-git child keeps the path pin, the ref-store pin and the recheck.
+ * `createsWorktree: "branch"` is declared by the three branch-creating adds (git writes a branch add's new HEAD as the
+ * symbolic branch ref, which the pin leaves intact). The two DETACHED adds declare the capability by calling
+ * `addDetachedWorktree` (src/run/git.ts), because under the pin git stubs a detached add's new HEAD as
+ * `ref: refs/heads/.invalid`.
+ */
+export interface OwnGitCapability {
+    createsWorktree?: "branch";
+    rollback?: WorktreeRollback;
+}
+/**
+ * What a worktree-creating call site declares it creates, so a result refused AFTER its child ran (a commondir raced
+ * mid-child) is rolled back: the checkout `dir` and its registration, and — when the add creates or moves one — the
+ * branch (`prior` restores a moved branch; without it the new branch is deleted). The rollback runs through the
+ * attempt's own trusted common directory (TrustedStoreCapability), never the caller's checkout, so it completes while
+ * the caller's commondir stays hostile.
+ */
+export interface WorktreeRollback {
+    dir: string;
+    branch?: {
+        name: string;
+        prior?: string;
+    };
+}
+/**
+ * Internal to addDetachedWorktree's add step: its ref store is pinned to the trusted common directory itself, not to a
+ * view. git stubs the new checkout's HEAD under ANY ref payload and, through a view, would resolve that stub into a
+ * shared `refs/heads/.invalid`; naming the common directory keeps it in the new gitdir, where the next step replaces
+ * it. That step writes no ref of the CALLER's checkout, so a commondir removed under it has no HEAD to redirect.
+ */
+export interface DetachedAddCapability {
+    createsWorktree: "detached";
+    rollback: WorktreeRollback;
+}
+/**
+ * v2.6.8 T2: cleanup authority. The child reads and writes ONLY `store` — a trusted common directory derived once from
+ * the trusted layout (gitfile and `<common>/worktrees/<name>`, never a mutable commondir) — as an ordinary repository:
+ * GIT_DIR names it and every inherited redirect (common dir, work tree, ref backend, index, objects) is removed. It never
+ * consults the caller's checkout, so removal completes even while that checkout's commondir stays hostile.
+ */
+export interface TrustedStoreCapability {
+    store: string;
+}
+/**
+ * v2.6.8 T2 (P3): the same uncached check, returning the child of tickmarkr's OWN git in a linked checkout — `env`
+ * (the caller's) with GIT_DIR, GIT_COMMON_DIR and GIT_WORK_TREE set to the canonical gitdir, trusted common directory
+ * and worktree root derived above, AND the ref store: GIT_REFERENCE_BACKEND names this attempt's private view of the
+ * trusted store (refStoreView), since git's ref store otherwise resolves shared refs through the gitdir's commondir
+ * FILE even under GIT_COMMON_DIR. So a commondir rewritten after this check (by a live worker or a surviving
+ * descendant) is followed for neither config, hooks, info/, objects nor refs: HEAD, branches, status and diffs read
+ * the real repository and every ref write lands in the trusted store, whatever an inherited GIT_CONFIG_* or ref backend
+ * says; a commondir REMOVED after it cannot move the main checkout's branch. Before such a child spawns, the git it
+ * would run must prove it honours that pin (refStorePinHonoured); one that cannot (git < 2.54) runs without it, below.
+ * Nothing here reads the command, and no caller leaves any pin. `recheck` (after the child exits) fails closed on ANY change to commondir since the check: the result
+ * of that child is never returned. An ordinary checkout or a non-repository gets no pin.
+ * NAMED RESIDUAL: git still reads $GIT_DIR/config.worktree when the trusted common config already enables
+ * extensions.worktreeConfig, so a config.worktree planted AFTER this check is not closed.
+ */
+export declare function ownGitPin(cwd: string, env: NodeJS.ProcessEnv, capability?: OwnGitCapability | DetachedAddCapability | TrustedStoreCapability): OwnGitPin | undefined;
 /** The inert hooks directory every protected git child receives (no hook can exist beneath it). */
 export declare const INERT_HOOKS_PATH = "/dev/null";
 /**
  * A copy of `env` whose git children run with core.fsmonitor=false and an inert core.hooksPath, despite repo
  * config and inherited GIT_CONFIG_COUNT/GIT_CONFIG_PARAMETERS: git applies GIT_CONFIG_PARAMETERS after
  * GIT_CONFIG_COUNT and the last value wins, so the forced pair is appended last. Every other value survives.
- * Named keys only — this does not neutralize arbitrary executable drivers. The pair is inherited by every
- * descendant of the protected child (a suite that needs real hooks must clear it for its own git).
+ * Named keys only — this does not neutralize arbitrary executable drivers. v2.6.8 T2: only tickmarkr's OWN git
+ * children (shGit/shGitOk) receive it; payload shells (gate commands, suites) keep the operator's git config.
  */
 export declare function protectedGitEnv(env: NodeJS.ProcessEnv): NodeJS.ProcessEnv;

package/dist/run/git-trust.js

@@ -1,5 +1,6 @@
 import { execFileSync } from "node:child_process";
-import { lstatSync, readFileSync, realpathSync, statSync } from "node:fs";
+import { lstatSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, statSync, symlinkSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
 import { basename, dirname, join } from "node:path";
 // v2.6.7 T4 (GHSA-2): a seat-run linked worktree's gitdir is seat-writable (the Codex worker grant), so its
 // `commondir` and `config.worktree` can redirect every later unsandboxed host git in that checkout to a
@@ -10,10 +11,12 @@ import { basename, dirname, join } from "node:path";
 /** A covered git invocation refused before spawn; `path` names the offending metadata. */
 export class GitTrustRefusal extends Error {
     path;
-    constructor(path, detail) {
-        super(`git trust refusal: ${path}: ${detail}`);
+    detail;
+    constructor(path, detail, options) {
+        super(`git trust refusal: ${path}: ${detail}`, options);
         this.name = "GitTrustRefusal";
         this.path = path;
+        this.detail = detail;
     }
 }
 /** The nearest `.git` entry at or above cwd, or undefined outside any checkout. */
@@ -113,37 +116,55 @@ export function trustedCommonDir(cwd) {
         throw new GitTrustRefusal(cwd, "no checkout encloses this directory");
     return authorityOf(dotGit).common;
 }
-/** Read failures and unparseable values never become clean authority. */
-function worktreeConfigEnabled(common) {
+/** One key of the trusted common config. Read failures and unparseable values never become clean authority. */
+function trustedConfig(common, key, type) {
     const config = join(common, "config");
     if (!present(config))
         throw new GitTrustRefusal(config, "the trusted common config is missing");
     try {
-        return execFileSync("git", ["config", "--file", config, "--type=bool", "--get", "extensions.worktreeConfig"], {
+        return execFileSync("git", ["config", "--file", config, ...(type ? [`--type=${type}`] : []), "--get", key], {
             cwd: "/", encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 15_000,
-        }).trim() === "true";
+        }).trim();
     }
     catch (error) {
         const e = error;
         if (e.status === 1 && !e.stderr?.trim())
-            return false; // the key is absent
-        throw new GitTrustRefusal(config, `cannot read extensions.worktreeConfig (${(e.stderr ?? String(error)).trim().split("\n")[0]})`);
+            return undefined; // the key is absent
+        throw new GitTrustRefusal(config, `cannot read ${key} (${(e.stderr ?? String(error)).trim().split("\n")[0]})`);
     }
 }
-/**
- * The uncached pre-spawn check for a covered git invocation at `cwd`. Outside any checkout it is a no-op
- * (unrelated shell commands stay compatible). Inside one it refuses, naming the file, when the commondir git
- * would follow resolves anywhere but the expected common directory, or when the trusted common config enables
- * extensions.worktreeConfig and the linked gitdir holds a config.worktree.
- */
-export function assertGitTrust(cwd) {
+const worktreeConfigEnabled = (common) => trustedConfig(common, "extensions.worktreeConfig", "bool") === "true";
+/** commondir's identity: ctime moves on every write, rename, unlink/recreate or restore, and no caller can set it. */
+const stampOf = (path) => {
+    try {
+        const s = lstatSync(path, { bigint: true });
+        return `${s.dev}:${s.ino}:${s.ctimeNs}`;
+    }
+    catch {
+        return undefined;
+    }
+};
+const isSymlink = (path) => { try {
+    return lstatSync(path).isSymbolicLink();
+}
+catch {
+    return false;
+} };
+/** The checked authority for `cwd` (see assertGitTrust), with the canonical worktree root the gitfile sits in. */
+function checkedAuthority(cwd) {
     const dotGit = dotGitOf(cwd);
     if (!dotGit)
-        return;
+        return undefined;
     const { gitdir, common, linked } = authorityOf(dotGit);
     const commondir = join(gitdir, "commondir");
+    // stamped BEFORE its bytes are read, so any change after this read moves the stamp
+    const stamp = linked ? stampOf(commondir) : undefined;
     if (linked && !present(commondir))
         throw new GitTrustRefusal(commondir, `is missing, so git would treat the seat-writable gitdir as its own repository; expected ${common}`);
+    // git writes commondir as a regular file; through a symlink the bytes git reads could be rewritten and restored
+    // without moving the link's own stamp, so that layout is refused rather than trusted
+    if (linked && isSymlink(commondir))
+        throw new GitTrustRefusal(commondir, "is a symbolic link, so its target could change without moving its stamp");
     if (present(commondir)) {
         // read as git reads it (resolveAsGit), never trimmed or lexically normalized: either would let a seat-written
         // path that names the real common directory to us lead git somewhere else
@@ -161,6 +182,141 @@ export function assertGitTrust(cwd) {
     if (linked && present(worktreeConfig) && worktreeConfigEnabled(common)) {
         throw new GitTrustRefusal(worktreeConfig, `extensions.worktreeConfig is enabled in ${join(common, "config")}, so git would read this seat-writable file`);
     }
+    return { gitdir, common, linked, worktree: dirname(dotGit), stamp };
+}
+/**
+ * The uncached pre-spawn check for a covered git invocation at `cwd`. Outside any checkout it is a no-op
+ * (unrelated shell commands stay compatible). Inside one it refuses, naming the file, when the commondir git
+ * would follow resolves anywhere but the expected common directory, or when the trusted common config enables
+ * extensions.worktreeConfig and the linked gitdir holds a config.worktree.
+ */
+export function assertGitTrust(cwd) {
+    checkedAuthority(cwd);
+}
+function storePin(store, env) {
+    if (!present(join(store, "HEAD")) || present(join(store, "commondir")))
+        throw new GitTrustRefusal(store, "is not an ordinary git directory");
+    const child = { ...env, GIT_DIR: store };
+    for (const k of ["GIT_COMMON_DIR", "GIT_WORK_TREE", "GIT_REFERENCE_BACKEND", "GIT_REF_STORAGE_FORMAT", "GIT_INDEX_FILE", "GIT_OBJECT_DIRECTORY", "GIT_ALTERNATE_OBJECT_DIRECTORIES"])
+        delete child[k];
+    return { env: child, store, recheck: () => { }, release: () => { }, unview: (text) => text };
+}
+/**
+ * v2.6.8 T2: the ref store an own-git child in a linked checkout is pinned to — a private directory of this attempt
+ * whose `refs`, `packed-refs`, `logs`, `worktrees` and `HEAD` are links into the TRUSTED common directory, beside a
+ * `HEAD.lock` nothing removes. git decides "linked" from the gitdir's commondir FILE alone: while it is present the
+ * child reads this checkout's own HEAD from <view>/worktrees/<id> (its trusted gitdir) and shared refs from the trusted
+ * store; when a seat REMOVES it before the child starts, git treats the view as the repository, so no HEAD-relative
+ * write (commit, merge, cherry-pick, reset, checkout, update-ref HEAD) can take the view's HEAD lock and nothing lands
+ * on the main checkout's branch — the recheck then refuses the result. That lock also refuses a write of the MAIN
+ * worktree's HEAD from a linked checkout's own git. Only the files format can be viewed this way: any other
+ * `extensions.refStorage` is refused by name, never run unpinned.
+ */
+function refStoreView(common) {
+    const view = realpathSync(mkdtempSync(join(tmpdir(), "tickmarkr-refs-")));
+    const release = () => rmSync(view, { recursive: true, force: true }); // unlinks the links, never their targets
+    try {
+        for (const name of ["refs", "packed-refs", "logs", "worktrees", "HEAD"])
+            symlinkSync(join(common, name), join(view, name));
+        writeFileSync(join(view, "HEAD.lock"), "");
+    }
+    catch (error) {
+        release();
+        throw error;
+    }
+    return { uri: `files://${view}`, release, unview: (text) => text.split(view).join(common) };
+}
+function assertFilesRefStore(common) {
+    const format = trustedConfig(common, "extensions.refStorage") ?? "files";
+    if (format !== "files") {
+        throw new GitTrustRefusal(join(common, "config"), `extensions.refStorage is ${format}; tickmarkr's own git can pin only the files ref store, so it is refused instead of running unpinned`);
+    }
+}
+/** A detached auto gc or maintenance would outlive its child and read refs through a view already released. */
+const NO_BACKGROUND_GIT = "'gc.auto=0' 'maintenance.auto=false'";
+const PROBE_REF = "refs/tickmarkr/ref-pin-probe", PROBE_TARGET = "refs/tickmarkr/ref-pin-honoured";
+/**
+ * Whether, before the child spawns, the git its PATH resolves honours GIT_REFERENCE_BACKEND (git >= 2.54): a fresh
+ * probe repository whose own refs lack PROBE_REF, pinned to a fresh store that holds it as a symbolic ref. A git that
+ * ignores the pin reads the probe repository's own refs. Nothing is cached: each attempt probes again.
+ */
+function refStorePinHonoured(env) {
+    const dir = mkdtempSync(join(tmpdir(), "tickmarkr-ref-pin-"));
+    try {
+        const repo = join(dir, "repo"), store = join(dir, "store");
+        for (const d of [join(repo, "objects"), join(repo, "refs"), join(store, "refs", "tickmarkr")])
+            mkdirSync(d, { recursive: true });
+        for (const head of [join(repo, "HEAD"), join(store, "HEAD")])
+            writeFileSync(head, "ref: refs/heads/main\n");
+        writeFileSync(join(store, PROBE_REF), `ref: ${PROBE_TARGET}\n`);
+        const probe = { ...env, GIT_DIR: repo, GIT_REFERENCE_BACKEND: `files://${store}` };
+        for (const k of ["GIT_COMMON_DIR", "GIT_WORK_TREE", "GIT_INDEX_FILE", "GIT_OBJECT_DIRECTORY", "GIT_ALTERNATE_OBJECT_DIRECTORIES"])
+            delete probe[k];
+        let read = "";
+        try {
+            read = execFileSync("git", ["symbolic-ref", PROBE_REF], { cwd: dir, env: probe, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 15_000 }).trim();
+        }
+        catch { /* refused below */ }
+        return read === PROBE_TARGET;
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+}
+let warnedRefStorePin = false;
+/** Said once per process: the fallback below is a weaker guard, and the operator should know why and what lifts it. */
+function warnRefStorePinUnavailable() {
+    if (warnedRefStorePin)
+        return;
+    warnedRefStorePin = true;
+    console.error("tickmarkr: the git on this PATH does not honour GIT_REFERENCE_BACKEND (needs git 2.54 or newer), so tickmarkr's own git in linked checkouts runs without its ref-store pin — path pins and the post-exit commondir recheck only, the 2.6.7 guard; upgrade git for the full pin");
+}
+/**
+ * v2.6.8 T2 (P3): the same uncached check, returning the child of tickmarkr's OWN git in a linked checkout — `env`
+ * (the caller's) with GIT_DIR, GIT_COMMON_DIR and GIT_WORK_TREE set to the canonical gitdir, trusted common directory
+ * and worktree root derived above, AND the ref store: GIT_REFERENCE_BACKEND names this attempt's private view of the
+ * trusted store (refStoreView), since git's ref store otherwise resolves shared refs through the gitdir's commondir
+ * FILE even under GIT_COMMON_DIR. So a commondir rewritten after this check (by a live worker or a surviving
+ * descendant) is followed for neither config, hooks, info/, objects nor refs: HEAD, branches, status and diffs read
+ * the real repository and every ref write lands in the trusted store, whatever an inherited GIT_CONFIG_* or ref backend
+ * says; a commondir REMOVED after it cannot move the main checkout's branch. Before such a child spawns, the git it
+ * would run must prove it honours that pin (refStorePinHonoured); one that cannot (git < 2.54) runs without it, below.
+ * Nothing here reads the command, and no caller leaves any pin. `recheck` (after the child exits) fails closed on ANY change to commondir since the check: the result
+ * of that child is never returned. An ordinary checkout or a non-repository gets no pin.
+ * NAMED RESIDUAL: git still reads $GIT_DIR/config.worktree when the trusted common config already enables
+ * extensions.worktreeConfig, so a config.worktree planted AFTER this check is not closed.
+ */
+export function ownGitPin(cwd, env, capability = {}) {
+    if ("store" in capability)
+        return storePin(capability.store, env);
+    const { createsWorktree } = capability;
+    const authority = checkedAuthority(cwd);
+    if (!authority?.linked)
+        return undefined;
+    const { gitdir, common, worktree, stamp } = authority;
+    const child = { ...env, GIT_DIR: gitdir, GIT_COMMON_DIR: common, GIT_WORK_TREE: worktree,
+        GIT_CONFIG_PARAMETERS: `${env.GIT_CONFIG_PARAMETERS?.trim() ?? ""} ${NO_BACKGROUND_GIT}`.trim() };
+    // GIT_REF_STORAGE_FORMAT only chooses a NEW repository's format; an inherited one is never a store this child follows
+    delete child.GIT_REF_STORAGE_FORMAT;
+    assertFilesRefStore(common);
+    const commondir = join(gitdir, "commondir");
+    const recheck = () => {
+        if (stampOf(commondir) !== stamp) {
+            throw new GitTrustRefusal(commondir, "changed while tickmarkr's own git ran in this checkout, so that result is refused");
+        }
+    };
+    // D-1484: a git older than 2.54 cannot take the ref-store pin. Refusing it would refuse tickmarkr's own git in every
+    // linked checkout on most installed gits, and a hostile git binary ignores every pin anyway; so it runs with the
+    // path pins and the post-exit recheck (the 2.6.7 guard). NAMED RESIDUAL there: refs still resolve through the
+    // commondir file, so a rewrite between check and exit can reach the hostile store before the recheck refuses.
+    if (!refStorePinHonoured(child)) {
+        delete child.GIT_REFERENCE_BACKEND;
+        warnRefStorePinUnavailable();
+        return { env: child, store: common, release: () => { }, unview: (text) => text, recheck };
+    }
+    const view = createsWorktree === "detached" ? { uri: `files://${common}`, release: () => { }, unview: (text) => text } : refStoreView(common);
+    child.GIT_REFERENCE_BACKEND = view.uri;
+    return { env: child, store: common, release: view.release, unview: view.unview, recheck };
 }
 /** The inert hooks directory every protected git child receives (no hook can exist beneath it). */
 export const INERT_HOOKS_PATH = "/dev/null";
@@ -169,8 +325,8 @@ const FORCED_GIT_CONFIG = `'core.fsmonitor=false' 'core.hooksPath=${INERT_HOOKS_
  * A copy of `env` whose git children run with core.fsmonitor=false and an inert core.hooksPath, despite repo
  * config and inherited GIT_CONFIG_COUNT/GIT_CONFIG_PARAMETERS: git applies GIT_CONFIG_PARAMETERS after
  * GIT_CONFIG_COUNT and the last value wins, so the forced pair is appended last. Every other value survives.
- * Named keys only — this does not neutralize arbitrary executable drivers. The pair is inherited by every
- * descendant of the protected child (a suite that needs real hooks must clear it for its own git).
+ * Named keys only — this does not neutralize arbitrary executable drivers. v2.6.8 T2: only tickmarkr's OWN git
+ * children (shGit/shGitOk) receive it; payload shells (gate commands, suites) keep the operator's git config.
  */
 export function protectedGitEnv(env) {
     const prior = env.GIT_CONFIG_PARAMETERS?.trim();