toolroll 0.9.103 → 0.9.105

package/dist/live.js

@@ -1,18 +1,3 @@
-/**
- * The live window (arc 1): what the running agent is saying, on disk, for
- * the run page to poll — and NOTHING else.
- *
- * This file is display state, not evidence. No artifact row points at it,
- * no digest binds it, and the page that renders it says so: the machine
- * running the agent could alter it. It exists so a person can watch work
- * happen without a terminal, and every byte in it went through the same
- * sanitize discipline as the peek: controls stripped, credential-shaped
- * lines replaced whole, tool activity described in OUR fixed vocabulary —
- * event metadata is never echoed.
- *
- * Fail-soft everywhere: a live view that cannot be written must never
- * break, slow, or reclassify a build.
- */
 import { randomBytes } from "node:crypto";
 import { closeSync, constants, fstatSync, linkSync, lstatSync, mkdirSync, openSync, readSync, readdirSync, renameSync, statSync, unlinkSync, writeSync } from "node:fs";
 import { join } from "node:path";
@@ -23,34 +8,23 @@ import { topLevelEvent } from "./stream-scope.js";
 export const LIVE_LINE_CAP = 2 * 1024;
 export const LIVE_FILE_CAP = 4 * 1024 * 1024;
 export const LIVE_REDACTED_LINE = "[a credential-shaped line was redacted]";
-/** Finalized runs keep their live file this long for the final drain. */
 export const LIVE_RETAIN_MS = 24 * 60 * 60 * 1000;
-/** The bounded sweep: at most this many FINALIZED runs' files survive a pass (a run's records and its subagents' file
- * count as one). */
 export const LIVE_FILE_BOUND = 500;
-/** A run's subagent file (docs/plans/agents-view.md §2.3) is never larger than this; its writer stops there. */
 export const LIVE_SUB_FILE_CAP = 16 * 1024 * 1024;
-/** All finished and orphan live files together stay under this; the oldest runs go first past it. */
 export const LIVE_TOTAL_BYTES = 1024 * 1024 * 1024;
 export function liveDir(root) {
     return join(root, "live");
 }
-/** The exact filename, from the numeric id and nothing else — no user
- * input is ever parsed into this path. Records (`.jsonl`) are what every
- * run writes now; the name is the format. */
 export function liveLogPath(root, runId) {
     return join(liveDir(root), `${Math.trunc(runId)}.jsonl`);
 }
-/** A run's subagents' records (docs/plans/agents-view.md §2.3): the run's file, swept with it. */
 export function liveSubLogPath(root, runId) {
     return join(liveDir(root), `${Math.trunc(runId)}.sub.jsonl`);
 }
-/** The plain-text file runs wrote before the live conversation; read until it ages out. */
 export function legacyLiveLogPath(root, runId) {
     return join(liveDir(root), `${Math.trunc(runId)}.log`);
 }
 export { LIVE_ACTIVITY_KINDS } from "./live-records.js";
-/** The activity line's kinds for known Claude tools (task-activity.ts). */
 const TOOL_KINDS = new Map([
     ["Edit", "edit"],
     ["Write", "edit"],
@@ -67,14 +41,8 @@ const TOOL_KINDS = new Map([
     ["Task", "delegate"],
 ]);
 const toolKind = (name) => TOOL_KINDS.get(typeof name === "string" ? name : "") ?? "tool";
-/**
- * What one stream event says the agent just did, as one fixed kind: the
- * last-activity line's only input. Never text, names or arguments; an
- * event that says nothing (results, deltas, subagent chatter) is null.
- */
 export function liveActivityKind(event) {
     try {
-        // A subagent's events, of every type, are not this run's activity (stream-scope.ts).
         if (!topLevelEvent(event))
             return null;
         const type = String(event["type"] ?? "");
@@ -109,40 +77,26 @@ export function liveActivityKind(event) {
         return null;
     }
 }
-/** Strip ANSI escapes and every control character; tabs become spaces. */
 function stripControls(text) {
     return text
         .replace(/\x1b\[[0-9;?]*[ -\/]*[@-~]/g, "")
         .replace(/\t/g, " ")
         .replace(/[\x00-\x1f\x7f-\x9f]/g, "");
 }
-/** Cut a string to at most `cap` UTF-8 bytes without splitting a character. */
 function capBytes(text, cap) {
     if (Buffer.byteLength(text, "utf8") <= cap)
         return text;
     const bytes = Buffer.from(text, "utf8").subarray(0, cap);
     const decoded = bytes.toString("utf8");
-    // A cut mid-character decodes with a trailing replacement char — drop it.
     return decoded.endsWith("�") ? decoded.slice(0, -1) : decoded;
 }
-/** Bidirectional overrides and isolates (U+202A–U+202E, U+2066–U+2069): they can make shown text read differently from what was written. */
 const BIDI_CONTROLS = /[\u202a-\u202e\u2066-\u2069]/g;
-/** Sanitize one display line: strip controls and bidi overrides, redact whole on any secret hit, cap. */
 export function sanitizeTranscriptLine(line) {
     const stripped = stripControls(line).replace(BIDI_CONTROLS, "");
     if (scanForSecrets(stripped).length > 0)
         return LIVE_REDACTED_LINE;
     return capBytes(stripped, LIVE_LINE_CAP);
 }
-/**
- * Open the run's live file for appending records. The directory is 0700,
- * the file 0600 and CREATED HERE (O_EXCL: a name that already exists —
- * whatever put it there — is refused, not appended to), opened O_NOFOLLOW
- * with the descriptor retained for the run's whole duration. `options` is
- * the run's trusted context: its checkout, and whether its project shows
- * commands (read once, here). Returns null on any failure: no live view is
- * ever worth a build.
- */
 export function openLiveLog(root, runId, options = {}) {
     let fd;
     try {
@@ -153,8 +107,6 @@ export function openLiveLog(root, runId, options = {}) {
         return null;
     }
     const recorderOptions = { base: options.base ?? null, commands: options.commands === true, ...(options.clock === undefined ? {} : { clock: options.clock }) };
-    // The run's subagents go to their own file (live-children.ts), under the same captured answer; this file is unchanged
-    // (the recorder only tells the subagents' side which step it wrote for each delegation).
     const children = createChildRecorder(recorderOptions);
     const recorder = createLiveRecorder({ ...recorderOptions, onStep: children.parentStep });
     const childLog = childLogWriter(root, runId);
@@ -165,7 +117,6 @@ export function openLiveLog(root, runId, options = {}) {
         if (closed || capped)
             return;
         const payload = Buffer.from(`${serializeLiveRecord(record)}\n`, "utf8");
-        // The cap record is RESERVED inside the cap: whatever remains must still fit it.
         const capLine = `${serializeLiveRecord({ k: "cap", at: record.at })}\n`;
         if (written + payload.length + Buffer.byteLength(capLine, "utf8") > LIVE_FILE_CAP) {
             capped = true;
@@ -173,7 +124,6 @@ export function openLiveLog(root, runId, options = {}) {
                 writeSync(fd, capLine);
             }
             catch {
-                // Nothing to do: the file simply ends early.
             }
             return;
         }
@@ -182,12 +132,11 @@ export function openLiveLog(root, runId, options = {}) {
             written += payload.length;
         }
         catch {
-            closed = true; // a broken descriptor never breaks the run
+            closed = true;
             try {
                 closeSync(fd);
             }
             catch {
-                // already gone
             }
         }
     };
@@ -204,7 +153,6 @@ export function openLiveLog(root, runId, options = {}) {
                 }
             }
             catch {
-                // Recording is observational; a malformed event records nothing.
             }
         },
         close() {
@@ -215,29 +163,25 @@ export function openLiveLog(root, runId, options = {}) {
                     append(record);
             }
             catch {
-                // the steps simply stay open in the file
             }
             try {
                 const before = childLog.due() ? children.checkpoint() : null;
                 childLog.append(children.end(), before);
             }
-            catch { /* the subagents' steps stay open in theirs */ }
+            catch { }
             childLog.close();
             closed = true;
             try {
                 closeSync(fd);
             }
             catch {
-                // already gone
             }
         },
     };
 }
 const READ_WINDOW = 64 * 1024;
 const READ_LOOKAHEAD = 2 * 1024;
-/** How far past an over-long line one read looks for its end; past it, the line is skipped up to there. */
 const SKIP_SCAN = 64 * 1024 * 1024;
-/** The live directory itself: a real directory, never a link to one. */
 function liveDirIsReal(root) {
     try {
         const stat = lstatSync(liveDir(root));
@@ -255,22 +199,9 @@ function openForRead(path) {
         return error.code === "ENOENT" ? { missing: true } : { unreadable: true };
     }
 }
-/** The line that stands in for one too long to read, in the file's own format. */
 function cutLine(format) {
     return format === "records" ? `${serializeLiveRecord({ k: "cut", at: "" })}\n` : "[a line was too long to show]\n";
 }
-/**
- * Read the live file from a byte offset, returning only COMPLETE lines
- * (through the last LF in the window). The records file is read when it
- * exists, else the legacy text file. The descriptor is the authority:
- * opened O_NOFOLLOW | O_NONBLOCK inside a real live directory, proved a
- * regular file, measured and read through itself. A file smaller than the
- * offset was replaced — the caller resets, visibly, and `gen` names the file
- * so an offset is never reused against another one. A line longer than the
- * whole window is skipped through its end, so a reader never stalls.
- * `allowTail` (the final drain) returns the unterminated tail after
- * finalization. Legacy text is cleaned again on the way out.
- */
 export function readLiveWindow(root, runId, from, allowTail = false) {
     if (!Number.isSafeInteger(from) || from < 0)
         return { ok: false, reason: "unreadable" };
@@ -291,7 +222,6 @@ export function readLiveWindow(root, runId, from, allowTail = false) {
         const stat = fstatSync(fd, { bigint: true });
         if (!stat.isFile())
             return { ok: false, reason: "unreadable" };
-        // Linux hands a removed file's inode straight to the next one made, so the birth time (ns) tells them apart too.
         const gen = `${format}:${stat.dev}:${stat.ino}:${stat.birthtimeNs}`;
         const size = Number(stat.size);
         if (size < from)
@@ -310,7 +240,6 @@ export function readLiveWindow(root, runId, from, allowTail = false) {
         const eofReached = from + offset >= size;
         const out = (text, next, eof) => ({
             ok: true,
-            // Raw: every reader cleans and redacts through liveWindowLines / liveWindowRecords, carrying the key state.
             text,
             nextOffset: next,
             eof,
@@ -320,7 +249,6 @@ export function readLiveWindow(root, runId, from, allowTail = false) {
         if (lastLf === -1) {
             if (allowTail && eofReached && offset > 0)
                 return out(chunk.toString("utf8"), from + offset, true);
-            // A whole window without an end of line: skip through its end (bounded), never stall on it.
             if (offset === READ_WINDOW + READ_LOOKAHEAD) {
                 const scan = Buffer.alloc(64 * 1024);
                 const limit = Math.min(size, from + SKIP_SCAN);
@@ -334,8 +262,6 @@ export function readLiveWindow(root, runId, from, allowTail = false) {
                         return { ok: true, text: cutLine(format), nextOffset: at + lf + 1, eof: at + lf + 1 >= size, format, gen };
                     at += read;
                 }
-                // No end within reach. A finished run's drain, or a line longer than any read looks, is cut where the
-                // look stopped, so reading always moves on; a live run's line may still be being written, so it waits.
                 if (allowTail || at >= from + SKIP_SCAN)
                     return { ok: true, text: cutLine(format), nextOffset: at, eof: at >= size, format, gen };
                 return { ok: true, text: "", nextOffset: from, eof: false, format, gen };
@@ -354,25 +280,16 @@ export function readLiveWindow(root, runId, from, allowTail = false) {
         closeSync(fd);
     }
 }
-/** A window's complete lines as the plain words the run page and `toolroll peek` show, whatever its format. `commands` is
- * the run's own captured answer (store.ts runLiveCommands), never the file's say. */
 export function liveWindowLines(read, commands, keys = { inKey: false }) {
     if (read.format === "records")
         return projectLiveText(withholdCommands(parseLiveRecords(read.text, keys), commands));
     return cleanLegacy(read.text, keys).split("\n").filter(one => one !== "");
 }
-/** A window as records, whatever its format: an older plain file's lines become the agent's words. Command text and
- * output show only when the run's own captured answer (`commands`) is on. */
 export function liveWindowRecords(read, commands, keys = { inKey: false }) {
     if (read.format === "records")
         return withholdCommands(parseLiveRecords(read.text, keys), commands);
     return cleanLegacy(read.text, keys).split("\n").filter(one => one !== "").map(line => ({ k: "say", at: "", t: [line] }));
 }
-/**
- * Enforce a run's captured "Show commands" answer on read: the file is build-writable, so an `open` record, a command
- * step's text or a step's output may say anything. With the answer off, every `open` reads the base tier, command steps
- * lose their text and steps lose their output. (The older plain-text format predates command detail and is unchanged.)
- */
 export function withholdCommands(records, commands) {
     if (commands)
         return records;
@@ -390,7 +307,6 @@ export function withholdCommands(records, commands) {
         return record;
     });
 }
-/** Legacy text lines, cleaned again on read: the file may have been altered after it was written. */
 function cleanLegacy(text, keys) {
     const lines = text.split("\n");
     const ended = lines.length > 0 && lines[lines.length - 1] === "";
@@ -399,11 +315,6 @@ function cleanLegacy(text, keys) {
     const shown = redactLiveLines(lines, keys);
     return ended ? `${shown.join("\n")}\n` : shown.join("\n");
 }
-/**
- * Enumerate the live directory for the reconcile sweep: names only. Pure listing — the CALLER settles which runs are
- * finalized before it measures anything; this module only refuses to guess. Non-run names are reported with runId
- * null (orphans from nothing this plane wrote; aged on mtime like everything else).
- */
 export function listLiveFiles(root) {
     let names;
     try {
@@ -412,18 +323,13 @@ export function listLiveFiles(root) {
     catch {
         return [];
     }
-    // A sweep's private claim (QUARANTINE_PREFIX) is never listed: it is the sweep's own, and one it couldn't restore
-    // stays for a person to look at rather than be aged out under a name nobody chose.
     return names.filter(name => !name.startsWith(QUARANTINE_PREFIX)).map(name => {
         const match = /^(\d{1,15})\.(jsonl|log|sub\.jsonl)$/.exec(name);
-        // The writer stops at its cap and adds one last record; anything far past it is no file this plane wrote.
         const cap = match === null ? null : (match[2] === "sub.jsonl" ? LIVE_SUB_FILE_CAP : LIVE_FILE_CAP) + 64 * 1024;
         return { runId: match === null ? null : Number(match[1]), fileName: name, cap };
     });
 }
-/** Remove one live file, silently: a sweep never throws over display state. True when it is gone now. */
 export function removeLiveFile(root, fileName, unlink = unlinkSync) {
-    // The name comes from listLiveFiles' own readdir, never from user input.
     if (fileName.includes("/") || fileName.includes("\\") || fileName.includes(".."))
         return false;
     try {
@@ -434,22 +340,7 @@ export function removeLiveFile(root, fileName, unlink = unlinkSync) {
         return error.code === "ENOENT";
     }
 }
-/** The prefix of a sweep's private claim on a file it is about to remove (never a name a writer uses). */
 const QUARANTINE_PREFIX = ".sweep-claim-";
-/**
- * The reconcile sweep (arc 1 §2): ACTIVE runs are exempt ABSOLUTELY — the
- * transport's no-truncation assumption depends on it — and a run's files
- * (its records, its subagents' file, an older text file) go together, as one.
- * A run is settled finished (or absent) BEFORE its files are measured.
- * Finalized runs age from finished_at; orphans (no run row, or a name this
- * plane never writes) age from mtime. Among the finalized-or-orphan: a file
- * far past its own cap goes at once, then the day's retention, then the
- * 500-run bound, then the total byte limit, oldest first, until each limit is
- * really met or nothing eligible is left. Each removal re-proves, under the
- * store's write lock (the one run admission takes), that the run is still
- * not active and the file is the very one measured; otherwise it is kept. A
- * file that can't be removed stays counted and never stops the rest.
- */
 export function sweepLiveLogs(store, root, now, io = {}) {
     const removed = [];
     const settled = (runId) => {
@@ -465,7 +356,6 @@ export function sweepLiveLogs(store, root, now, io = {}) {
     };
     const at = (name) => join(liveDir(root), name);
     const lstat = io.lstat ?? ((path) => lstatSync(path));
-    /** A file as it is now: measured, confirmed gone (ENOENT only), or unknown (any other failure: never taken as gone). */
     const measure = (fileName, runId, path = at(fileName)) => {
         try {
             const stat = lstat(path);
@@ -476,7 +366,6 @@ export function sweepLiveLogs(store, root, now, io = {}) {
         }
     };
     const same = (a, b) => a.dev === b.dev && a.ino === b.ino && a.size === b.size && a.mtimeMs === b.mtimeMs;
-    /** The run is still not active, proved under the store's write lock (the one run admission takes) — and only that. */
     const stillSweepable = (runId) => {
         const check = () => { const state = settled(runId); return state !== "active" && state !== "unknown"; };
         try {
@@ -486,20 +375,13 @@ export function sweepLiveLogs(store, root, now, io = {}) {
             return false;
         }
     };
-    /** Put a claimed file back under its name without overwriting whatever may be there now. */
     const restore = (claim, fileName) => {
         try {
             linkSync(at(claim), at(fileName));
             unlinkSync(at(claim));
         }
-        catch { /* the name is taken: the claim stays, unlisted */ }
+        catch { }
     };
-    /**
-     * Remove one measured file: its run still not active, then the name atomically claimed under a private name in the
-     * live directory, then the claim proved to be the very file measured (dev, inode, size, mtime) and the run still not
-     * active — and only then is the private claim deleted. A mismatch is put back without overwriting anything. The
-     * store's lock covers the run-state checks only; the filesystem work runs outside it.
-     */
     const remove = (file) => {
         if (file.failed === true)
             return false;
@@ -530,22 +412,17 @@ export function sweepLiveLogs(store, root, now, io = {}) {
         restore(claim, file.fileName);
         return done(false);
     };
-    // One group per finished run (keyed by id) or per orphan file, aged from the run's end or the file's mtime.
     const groups = new Map();
-    // Settle every listed run first, then list again and measure: a file a run wrote (or grew) before it finished is
-    // seen at its final size, and one its run created after the first listing is counted with it.
     const states = new Map();
     for (const entry of listLiveFiles(root))
         if (entry.runId !== null && !states.has(entry.runId))
             states.set(entry.runId, settled(entry.runId));
     for (const entry of listLiveFiles(root)) {
-        // A run first seen in this listing waits for the next pass: it was never settled before its files were listed.
         if (entry.runId !== null && !states.has(entry.runId))
             continue;
         const state = entry.runId === null ? null : states.get(entry.runId);
         if (state === "active" || state === "unknown")
-            continue; // live, or unknown this pass: kept, never guessed
-        // Measured only now, after the run is settled finished: its writer is done.
+            continue;
         const file = measure(entry.fileName, entry.runId);
         if (file === "gone" || file === "unknown")
             continue;
@@ -559,17 +436,14 @@ export function sweepLiveLogs(store, root, now, io = {}) {
         group.ageAnchorMs = Math.min(group.ageAnchorMs, anchor);
         groups.set(key, group);
     }
-    /** Remove a group's files; what can't be removed stays in it (and in every count after). True when it's empty. */
     const removeGroup = (group) => {
         group.files = group.files.filter(file => !remove(file));
         return group.files.length === 0;
     };
     const cutoff = now.getTime() - LIVE_RETAIN_MS;
     let kept = [...groups.values()].sort((a, b) => a.ageAnchorMs - b.ageAnchorMs).filter(group => group.ageAnchorMs > cutoff || !removeGroup(group));
-    // Oldest-first beyond the bound, continuing past any that can't go — still never touching an active run.
     let excess = kept.length - LIVE_FILE_BOUND;
     kept = kept.filter(group => excess <= 0 || !removeGroup(group) || (excess -= 1, false));
-    // Then the total, oldest first, counting only what is really still there.
     const bytesOf = (group) => group.files.reduce((sum, file) => sum + file.bytes, 0);
     let total = kept.reduce((sum, group) => sum + bytesOf(group), 0);
     for (const group of kept) {

package/dist/local-owner-acts.js

@@ -0,0 +1,168 @@
+import { refArchived, requeueEligibility } from "./store.js";
+import { LOCAL_OWNER_LAPSED, localActNow } from "./local-owner.js";
+import { approverStanding, localWorkEligible, personApprovalOf } from "./scope.js";
+import { plannerContractOf, plannerSourceDigest } from "./planner-source.js";
+import { scopeApprovedForDispatch } from "./dispatch.js";
+export const LOCAL_PLAN_ACTION = "task plan (local owner)";
+export const LOCAL_TASK_CHANGED = "This task changed. Look at it again.";
+export function planSourceOf(store, taskId) {
+    const contract = plannerContractOf(store, taskId);
+    return contract.ok ? plannerSourceDigest(contract.contract) : null;
+}
+export function requestPlanAsLocalOwner(store, taskId, source, now) {
+    try {
+        return store.transact(() => {
+            const local = localActNow(store, "request-plan");
+            if (local === null)
+                return { ok: false, reason: "local-owner", message: LOCAL_OWNER_LAPSED };
+            const ref = store.lookupRef(taskId);
+            if (ref === null || store.getTask(taskId) === null)
+                return { ok: false, reason: "not-found", message: "That task is unavailable in your projects." };
+            if (!approverStanding(store, local.account, ref.repo).ok)
+                return { ok: false, reason: "not-found", message: "That task is unavailable in your projects." };
+            if (refArchived(store, ref.id))
+                return { ok: false, reason: "archived", message: "This task is put away. Restore it first." };
+            const eligible = localWorkEligible(store, local.account, taskId, { act: "plan" });
+            if (!eligible.ok)
+                return { ok: false, reason: "refused", message: eligible.message };
+            if (ref.planProvider !== null || ref.planModel !== null) {
+                return { ok: false, reason: "refused", message: "This task names its own planning agent, so planning it needs your password." };
+            }
+            if (planSourceOf(store, taskId) !== source)
+                return { ok: false, reason: "stale", message: LOCAL_TASK_CHANGED };
+            const armed = store.handle.prepare("SELECT signed_by, basis FROM plan_authorization WHERE task_id = ?").get(taskId);
+            if (armed !== undefined) {
+                store.handle.prepare("DELETE FROM plan_authorization WHERE task_id = ?").run(taskId);
+                store.recordAction({ at: now.toISOString(), actor: `operator:${local.account}`, repo: ref.repo, taskId, runId: null, source: "request",
+                    action: "unchanged plan pre-authorization withdrawn", outcome: "withdrawn",
+                    detail: JSON.stringify({ v: 1, signedBy: String(armed["signed_by"]), basis: String(armed["basis"]), why: "the local owner asked for the plan" }) });
+            }
+            if (ref.plan === "requested" || ref.plan === "drafted")
+                return { ok: true, replayed: true };
+            const asked = store.requestPlan(ref.id, now);
+            if (!asked.ok)
+                throw new Undone({ ok: false, reason: "refused", message: `This task can't be planned now: ${asked.reason}.` });
+            store.recordAction({ at: now.toISOString(), actor: `operator:${local.account}`, repo: ref.repo, taskId, runId: null, action: LOCAL_PLAN_ACTION,
+                outcome: "requested", source: "request", detail: JSON.stringify({ v: 1, source, via: local.transport }) });
+            return { ok: true, replayed: false };
+        });
+    }
+    catch (error) {
+        if (error instanceof Undone)
+            return error.result;
+        if (error instanceof Error && error.message === LOCAL_OWNER_LAPSED)
+            return { ok: false, reason: "local-owner", message: LOCAL_OWNER_LAPSED };
+        throw error;
+    }
+}
+export const LOCAL_RETRY_ACTION = "task requeue (local owner)";
+export const LOCAL_RETRY_LIMIT = 3;
+export const LOCAL_RETRY_SPENT = `You've retried this ${LOCAL_RETRY_LIMIT} times. Send it back with a note, or sign in with your password to retry again.`;
+export const LOCAL_RETRY_STOPPING = "The last build is still stopping. Try again in a moment.";
+const sameSeal = (a, b) => {
+    const one = a;
+    return one !== null && typeof one === "object" && one.by === b.by && one.at === b.at && one.digest === b.digest;
+};
+export function retryPinsOf(store, taskId) {
+    const ref = store.lookupRef(taskId);
+    const scope = store.getScope(taskId);
+    const state = store.getTask(taskId)?.state;
+    if (ref === null || scope === null || scope.approvedAt === null || scope.approvedDigest !== scope.digest || (state !== "failed" && state !== "done"))
+        return null;
+    const last = store.lastBuilderRun(ref.id);
+    return last === null ? null : { run: last.id, digest: scope.digest };
+}
+function localRetriesOf(store, taskId, account, seal) {
+    const rows = store.handle.prepare("SELECT run_id, detail FROM action_ledger WHERE action = ? AND task_id = ? AND actor = ? ORDER BY id")
+        .all(LOCAL_RETRY_ACTION, taskId, `operator:${account}`);
+    const runs = [];
+    for (const row of rows) {
+        let detail;
+        try {
+            detail = JSON.parse(String(row["detail"] ?? ""));
+        }
+        catch {
+            continue;
+        }
+        const bound = detail;
+        if (bound.v === 1 && sameSeal(bound.seal, seal))
+            runs.push(Number(row["run_id"]));
+    }
+    return runs;
+}
+export function retryAsLocalOwner(store, taskId, pins, now) {
+    try {
+        return store.transact(() => {
+            const local = localActNow(store, "retry-build");
+            if (local === null)
+                return { ok: false, reason: "local-owner", message: LOCAL_OWNER_LAPSED };
+            const ref = store.lookupRef(taskId);
+            if (ref === null || store.getTask(taskId) === null || !approverStanding(store, local.account, ref.repo).ok) {
+                return { ok: false, reason: "not-found", message: "That task is unavailable in your projects." };
+            }
+            const person = personApprovalOf(store, taskId);
+            if (!person.ok || person.by !== local.account) {
+                return { ok: false, reason: "refused", message: "Only a build of your own approval can be retried without a password. Sign in with your password to retry it." };
+            }
+            const scope = store.getScope(taskId);
+            const seal = { by: scope.approvedBy, at: scope.approvedAt, digest: scope.approvedDigest };
+            if (scope.digest !== pins.digest)
+                return { ok: false, reason: "stale", message: LOCAL_TASK_CHANGED };
+            if (!scopeApprovedForDispatch(store, ref.id, now)) {
+                return { ok: false, reason: "refused", message: "This approval no longer stands. Approve the plan again, or sign in with your password." };
+            }
+            const eligible = localWorkEligible(store, local.account, taskId, { act: "retry" });
+            if (!eligible.ok)
+                return { ok: false, reason: "refused", message: eligible.message };
+            const latest = store.lastBuilderRun(ref.id);
+            const retried = localRetriesOf(store, taskId, local.account, seal);
+            const state = store.getTask(taskId).state;
+            if (retried.includes(pins.run) && latest?.id === pins.run && (state === "queued" || state === "running"))
+                return { ok: true, replayed: true, retries: retried.length };
+            if (store.handle.prepare("SELECT 1 AS hit FROM run WHERE task_ref = ? AND finished_at IS NULL LIMIT 1").get(ref.id) !== undefined) {
+                return { ok: false, reason: "stopping", message: LOCAL_RETRY_STOPPING };
+            }
+            if (latest === null || latest.id !== pins.run || store.handle.prepare("SELECT 1 AS hit FROM run WHERE task_ref = ? AND id > ? LIMIT 1").get(ref.id, pins.run) !== undefined) {
+                return { ok: false, reason: "stale", message: LOCAL_TASK_CHANGED };
+            }
+            for (const run of store.runsFor(ref.id)) {
+                if (store.stopQuiescenceFact(run.id) !== null)
+                    return { ok: false, reason: "stopping", message: LOCAL_RETRY_STOPPING };
+            }
+            if (store.finalResultReason(pins.run) !== null) {
+                return { ok: false, reason: "final", message: "This result was accepted or published, so it isn't built again. Send it back with a note instead." };
+            }
+            const eligibility = requeueEligibility(store, taskId, now);
+            if (!eligibility.ok) {
+                return eligibility.reason === "archived" ? { ok: false, reason: "archived", message: "This task is put away. Restore it first." }
+                    : eligibility.reason === "claimed" ? { ok: false, reason: "stopping", message: LOCAL_RETRY_STOPPING }
+                        : { ok: false, reason: "refused", message: "This task has nothing to retry." };
+            }
+            if (eligibility.state !== "failed" && !(eligibility.state === "done" && eligibility.rejectedRun === pins.run)) {
+                return { ok: false, reason: "refused", message: "This task has nothing to retry." };
+            }
+            if (retried.length >= LOCAL_RETRY_LIMIT)
+                return { ok: false, reason: "limit", message: LOCAL_RETRY_SPENT };
+            const requeued = store.requeueTask(taskId, local.account, now);
+            if (!requeued.ok)
+                throw new Undone({ ok: false, reason: "refused", message: "This task has nothing to retry." });
+            store.recordAction({ at: now.toISOString(), actor: `operator:${local.account}`, repo: ref.repo, taskId, runId: pins.run, action: LOCAL_RETRY_ACTION,
+                outcome: "requeued", source: "request", detail: JSON.stringify({ v: 1, seal, via: local.transport }) });
+            return { ok: true, replayed: false, retries: retried.length + 1 };
+        });
+    }
+    catch (error) {
+        if (error instanceof Undone)
+            return error.result;
+        if (error instanceof Error && error.message === LOCAL_OWNER_LAPSED)
+            return { ok: false, reason: "local-owner", message: LOCAL_OWNER_LAPSED };
+        throw error;
+    }
+}
+class Undone extends Error {
+    result;
+    constructor(result) {
+        super(result.message);
+        this.result = result;
+    }
+}