toolroll 0.9.30 → 0.9.32

package/dist/result-follow-ups.js

@@ -47,28 +47,34 @@ export function followUpChecksOf(store, runId, now = new Date(), root) {
                 const body = JSON.parse(read.content.toString("utf8"));
                 if (typeof body.request !== "number")
                     continue;
+                const head = typeof body.head === "string" ? body.head : null;
                 receipts.set(body.request, { ran: body.result?.ran === true, exitCode: typeof body.result?.exitCode === "number" ? body.result.exitCode : null,
-                    log: typeof body.log?.artifactId === "number" ? body.log.artifactId : null });
+                    log: typeof body.log?.artifactId === "number" ? body.log.artifactId : null, head,
+                    tested: typeof body.tested === "string" ? body.tested : head, batch: batchFactsOf(body.batch, runId, head) });
             }
             catch { /* an unreadable receipt upgrades nothing */ }
         }
     }
     return rows.filter(row => row.action === CHECKS_REQUESTED && (row.outcome === "quick" || row.outcome === "full")).map(request => {
-        const [head = "", why = "person", digest = ""] = (request.detail ?? "").split(" · ");
+        const [head = "", why = "person", digest = "", recordedBase = ""] = (request.detail ?? "").split(" · ");
         const started = rows.find(row => row.action === CHECKS_STARTED && row.outcome === String(request.id)) ?? null;
         const finished = rows.find(row => row.action === CHECKS_FINISHED && row.outcome.startsWith(`${request.id}:`)) ?? null;
         const base = { request: request.id, runId, level: request.outcome, head, digest, actor: request.actor, at: request.at,
-            why: why === "pull-request" ? "pull-request" : "person", exitCode: null, logArtifactId: null, note: null };
+            why: why === "pull-request" ? "pull-request" : why === "batch" ? "batch" : "person", exitCode: null, logArtifactId: null, note: null,
+            ...(why === "batch" ? { base: /^[a-f0-9]{40}$/.test(recordedBase) ? recordedBase : null } : {}) };
         if (finished !== null) {
             const status = finished.outcome.slice(String(request.id).length + 1);
             const sealed = receipts.get(request.id) ?? null;
-            // With the evidence at hand, only a sealed receipt can say passed.
-            if (status === "passed" && root !== undefined && (sealed === null || !sealed.ran || sealed.exitCode !== 0)) {
+            // With the evidence at hand, only a sealed receipt can say passed: for this result's own commit, and,
+            // for a batch, a batch that names this result.
+            if (status === "passed" && root !== undefined && (sealed === null || !sealed.ran || sealed.exitCode !== 0 || (sealed.head !== null && sealed.head !== head)
+                || (base.why === "batch" && sealed.batch === null))) {
                 return { ...base, state: "not-run", note: "The saved check result could not be verified." };
             }
             const exit = /exit (\d+)/.exec(finished.detail ?? "");
             return { ...base, state: status === "passed" ? "passed" : status === "failed" ? "failed" : "not-run",
-                exitCode: exit === null ? sealed?.exitCode ?? null : Number(exit[1]), logArtifactId: sealed?.log ?? null, note: status === "not-run" ? finished.detail : null };
+                exitCode: exit === null ? sealed?.exitCode ?? null : Number(exit[1]), logArtifactId: sealed?.log ?? null, note: status === "not-run" ? finished.detail : null,
+                ...(sealed === null ? {} : { tested: sealed.ran ? sealed.tested : null, batch: sealed.batch }) };
         }
         if (started !== null) {
             const limit = Number(/limit (\d+)/.exec(started.detail ?? "")?.[1] ?? 3_600_000);
@@ -79,6 +85,26 @@ export function followUpChecksOf(store, runId, now = new Date(), root) {
         return { ...base, state: "waiting" };
     });
 }
+/** A receipt's batch facts, only when they are whole and name this result at its own commit. */
+function batchFactsOf(value, runId, head) {
+    if (value === null || typeof value !== "object")
+        return null;
+    const raw = value;
+    const modes = ["together", "split", "conflict", "alone"];
+    const mode = modes.find(one => one === raw.mode);
+    if (mode === undefined || typeof raw.tested !== "string" || !/^[a-f0-9]{40}$/.test(raw.tested) || !Array.isArray(raw.members))
+        return null;
+    const members = raw.members.flatMap(one => {
+        const m = one;
+        return typeof m?.task === "string" && typeof m.run === "number" && typeof m.head === "string" ? [{ task: m.task, run: m.run, head: m.head }] : [];
+    });
+    if (members.length !== raw.members.length || !members.some(one => one.run === runId && one.head === head))
+        return null;
+    // Checked on its own: the commit tested is the result's own.
+    if (mode !== "together" && (members.length !== 1 || raw.tested !== head))
+        return null;
+    return { mode, tested: raw.tested, base: typeof raw.base === "string" ? raw.base : null, members };
+}
 /** Whether a result can have checks run on it, and with which command. */
 function checkTarget(store, runId, level) {
     const run = store.getRun(runId);
@@ -110,8 +136,11 @@ export function requestFollowUpChecks(store, input, now) {
         return { ok: true, request, level: target.level, existing: false };
     });
 }
-/** Requests nobody has started yet, oldest first. */
+/** Requests nobody has started yet, oldest first. Batch requests wait for the batch pass (batch-checks.ts). */
 export function waitingCheckRequests(store, now) {
+    return waitingRequestsOfAnyKind(store, now).filter(one => one.why !== "batch");
+}
+export function waitingRequestsOfAnyKind(store, now) {
     const runs = store.handle.prepare(`SELECT DISTINCT r.run_id AS run FROM action_ledger r WHERE r.action = ? AND r.run_id IS NOT NULL
     AND NOT EXISTS (SELECT 1 FROM action_ledger s WHERE s.run_id = r.run_id AND s.action = ? AND s.outcome = CAST(r.id AS TEXT)) ORDER BY r.id`)
         .all(CHECKS_REQUESTED, CHECKS_STARTED).map(row => Number(row["run"]));
@@ -204,7 +233,7 @@ export async function runFollowUpCheck(store, root, request, deps = {}) {
     const text = log.length === 0 ? "No command started." : log.join("\n\n");
     const logId = storeEvidence(store, root, runId, "structured-output", `follow-up-check-${request}.log`, Buffer.from(text, "utf8"), FOLLOW_UP_LOG, at, { captureStatus: "ok" });
     const logArtifact = store.getArtifact(logId);
-    const receipt = JSON.stringify({ version: 1, request, run: runId, head: target.head, level: target.level,
+    const receipt = JSON.stringify({ version: 1, request, run: runId, head: target.head, tested: target.head, level: target.level,
         command: { repo: target.command.repo, command: target.command.command, digest: target.command.digest, approvedBy: target.command.approvedBy },
         result, log: { artifactId: logArtifact.id, sha256: logArtifact.sha256, bytesStored: logArtifact.bytesStored, truncated: logArtifact.truncated } }, null, 1);
     storeEvidence(store, root, runId, "structured-output", `follow-up-check-${request}.json`, Buffer.from(receipt, "utf8"), FOLLOW_UP_RECEIPT, at, { captureStatus: "ok" });
@@ -262,9 +291,14 @@ export function fullCheckGate(store, runId, now) {
     const level = runCheckLevel(store, runId);
     const repo = repoOfRun(store, runId);
     const run = store.getRun(runId);
-    if (level === null || level === "full" || repo === null || run === null || store.liveVerifyCommand(repo) === null)
+    if (level === null || repo === null || run === null)
+        return { state: "clear" };
+    const fulls = followUpChecksOf(store, runId, now).filter(one => one.level === "full" && one.head === run.headRevision);
+    // A Full build that waited for a batch check has had no check of its own: Merge waits for the batch, like Quick does.
+    const batched = level === "full" && fulls.some(one => one.why === "batch");
+    if ((level === "full" && !batched) || (!batched && store.liveVerifyCommand(repo) === null))
         return { state: "clear" };
-    const last = followUpChecksOf(store, runId, now).filter(one => one.level === "full" && one.head === run.headRevision).at(-1);
+    const last = fulls.at(-1);
     if (last === undefined)
         return { state: "not-requested", message: "The full check hasn't run on this commit yet. Merge once it passes, or merge anyway." };
     if (last.state === "passed")

package/dist/serve.js

@@ -3,6 +3,7 @@ import { aboutYouOf, checkAboutYou, saveAboutYou, ABOUT_YOU_LINE_MAX, ABOUT_YOU_
 import { withActor } from "./actor.js";
 import { repositoryContext, repositoryContextRead } from './repository-context.js';
 import { ADD_TESTS_ACTION, followUpChecksOf, requestFollowUpChecks, fileAddTestsTask, resultCheckLevel } from './result-follow-ups.js';
+import { projectBatchChecks, setProjectBatchChecks } from './batch-policy.js';
 import { CHECK_LEVEL_WORDS, isCheckLevel, liveQuickCommand, projectCheckLevel, quickVerifyKey, setProjectCheckLevel, suggestQuickCommand } from './check-levels.js';
 import { repositoryContextHtml } from './repository-context-ui.js';
 import { browserAssetsAvailable, browserWorkspaceDocument, serveBrowserAsset } from './browser-shell.js';
@@ -34,7 +35,7 @@ import { CONNECT_CALLBACK, connectionsOf, finishConnect, localConnectOf, oneClic
 import { KITS_CSS, kitPageHtml, kitsGalleryHtml } from "./kits-ui.js";
 import { STARTERS_CSS, startersHtml } from "./flow-starters-ui.js";
 import { GALLERY_CSS, galleryHtml, galleryUseHtml } from "./flow-gallery-ui.js";
-import { galleryDefaults, galleryDiagram, galleryTemplateOf, previewGallery, useGalleryTemplate } from "./flow-gallery.js";
+import { galleryDefaults, galleryDiagram, galleryTemplateOf, galleryToolsOf, previewGallery, useGalleryTemplate } from "./flow-gallery.js";
 import { starterForWork, starterOf, startersFor, switchOnStarter } from "./flow-starters.js";
 import { createTeammateFrom, labelOf, nameOf, saveSoul, setTeammateState, teammateSettings, sendTeammateSummaries } from "./teammate-admin.js";
 import { editMemory, forgetMemory, tellTeammate } from "./teammate-memory.js";
@@ -235,6 +236,7 @@ import { prometheusMetrics } from "./metrics.js";
 import { SPEND_CSS, spendCsv, spendHtml } from "./spend-ui.js";
 import { RETENTION_CSS, retentionHtml } from "./retention-ui.js";
 import { STORAGE_CSS, storageHtml } from "./storage-ui.js";
+import { lastSweep, saveSweep, storageSweepOff } from "./storage-sweep.js";
 import { bytesWords, parseCleanup } from "./storage.js";
 import { checkoutPlan, cleanCheckouts, discardCheckout, previewDigest } from "./checkout-cleanup.js";
 import { UPDATES_CSS, newerThan, updateStepsHtml, updatesHtml, updatesScript } from "./toolroll-update-ui.js";
@@ -1116,7 +1118,10 @@ export function createDecisionServer(options) {
             return done("/settings/tools", "problem", "That sign-in expired. Connect again.");
         const service = oneClickOf(visit.service);
         const kit = visit.kit === null ? null : kitOf(visit.kit);
-        const back = kit === null ? `/settings/tools?repo=${encodeURIComponent(visit.repo)}` : `/kits/${kit.id}?repo=${encodeURIComponent(visit.repo)}`;
+        // Started from a gallery template's page: back to it, for the same project.
+        const template = visit.template === null ? null : galleryTemplateOf(visit.template);
+        const back = template !== null ? `/flows/new/${template.id}?repo=${encodeURIComponent(visit.repo)}`
+            : kit === null ? `/settings/tools?repo=${encodeURIComponent(visit.repo)}` : `/kits/${kit.id}?repo=${encodeURIComponent(visit.repo)}`;
         const to = projectName(visit.repo);
         if (url.searchParams.has("error"))
             return done(back, "problem", url.searchParams.get("error") === "access_denied" ? `${service.label} wasn't connected to ${to}: access was declined.` : `${service.label} wasn't connected to ${to}.`);
@@ -1748,7 +1753,7 @@ export function createDecisionServer(options) {
     }
     // ---- reads ---------------------------------------------------------------
     /** A gallery template's page (Flows → New → Use this): its questions, the preview of these answers, and Create. */
-    function sendGalleryUse(response, who, template, projects, repo, given, name, notice) {
+    function sendGalleryUse(response, who, template, projects, repo, given, name, notice, said = null) {
         const answers = given ?? galleryDefaults(store, template, repo);
         let preview = null, problem = notice;
         try {
@@ -1757,8 +1762,9 @@ export function createDecisionServer(options) {
         catch (error) {
             problem = error instanceof Error ? error.message : "That can't be made here.";
         }
+        const diagram = preview?.built.definition ?? galleryDiagram(template);
         const html = galleryUseHtml({ template, projects: projects.map(path => ({ path, name: projectName(path) })), repo, answers, name, preview, problem,
-            csrf: who.via === "cookie" ? who.session.csrf : "", diagram: preview?.built.definition ?? galleryDiagram(template) });
+            csrf: who.via === "cookie" ? who.session.csrf : "", diagram, tools: preview?.tools ?? galleryToolsOf(template, diagram, connectionsOf(store, repo)), said });
         return sendScreen(response, problem !== null && preview === null && notice !== null ? 400 : 200, screen(template.name, `<p><a href="/flows/new">New flow</a></p><h1>${escape(template.name)}</h1>${html}`, { chrome: chromeFor(repo, "flows") }));
     }
     async function handleGet(url, who, request, response) {
@@ -3188,8 +3194,10 @@ export function createDecisionServer(options) {
         if (url.pathname === "/flows/new") {
             const projects = [...new Set([...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()])].filter(visible);
             const canUse = who.via === "cookie" && who.role === "approver" && projects.length > 0;
-            const repo = url.searchParams.get("repo");
-            return sendScreen(response, 200, screen("New flow", `<p><a href="/flows">Flows</a></p><h1>New flow</h1>${galleryHtml({ repo: repo !== null && projects.includes(repo) ? repo : null, canUse })}`, { chrome: chromeFor(project, "flows") }));
+            // The chosen project, else the one being looked at: its tools are what each card says is connected.
+            const asked = url.searchParams.get("repo");
+            const repo = asked !== null && projects.includes(asked) ? asked : project !== null && projects.includes(project) ? project : null;
+            return sendScreen(response, 200, screen("New flow", `<p><a href="/flows">Flows</a></p><h1>New flow</h1>${galleryHtml({ repo, canUse, connections: repo === null ? null : connectionsOf(store, repo) })}`, { chrome: chromeFor(repo ?? project, "flows") }));
         }
         const galleryRead = /^\/flows\/new\/([a-z-]{1,40})$/.exec(url.pathname);
         if (galleryRead !== null) {
@@ -3203,7 +3211,9 @@ export function createDecisionServer(options) {
                 return refuse(response, who, 409, "Add a project first.", "/projects");
             const asked = url.searchParams.get("repo");
             const repo = asked !== null && projects.includes(asked) ? asked : project !== null && projects.includes(project) ? project : projects[0];
-            return sendGalleryUse(response, who, template, projects, repo, null, template.name, null);
+            // Back from a Connect started on this page: how it went.
+            const problem = url.searchParams.get("problem"), said = url.searchParams.get("said");
+            return sendGalleryUse(response, who, template, projects, repo, null, template.name, problem === null ? null : problem.slice(0, 400), said === null ? null : said.slice(0, 400));
         }
         if (url.pathname === "/flows") {
             const projects = [...new Set([...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()])].filter(visible);
@@ -3969,7 +3979,7 @@ export function createDecisionServer(options) {
                 said: url.searchParams.get("said"), problem: url.searchParams.get("problem")
             }) +
                 // Every template, beside the starters: Use this opens its page for this project.
-                `<h2 class="gallery-heading">Templates</h2>${galleryHtml({ repo: chosen, canUse: who.via === "cookie" && who.role === "approver" && !store.isDemo() })}`;
+                `<h2 class="gallery-heading">Templates</h2>${galleryHtml({ repo: chosen, canUse: who.via === "cookie" && who.role === "approver" && !store.isDemo(), connections: connectionsOf(store, chosen) })}`;
             return sendScreen(response, 200, screen("Flows", `<p><a href="/settings">Settings</a></p><h1>Flows</h1>${content}`, { chrome: chromeFor(chosen || project, "settings") }));
         }
         // Settings → Integrations: which integrations work. The list is the last checks; a render never waits on one.
@@ -4020,7 +4030,8 @@ export function createDecisionServer(options) {
             if (who.via !== "cookie" || !store.isInstanceOperator(who.name) || databaseFile === null)
                 return refuse(response, who, 403, "An instance operator looks after storage.", "/settings");
             const plan = await checkoutPlan(store, storagePool(databaseFile), now, { manual: true });
-            return sendScreen(response, 200, screen("Storage", `<p><a href="/settings">Settings</a></p><h1>Storage</h1>${storageHtml({ plan, csrf: who.session.csrf }, { said: url.searchParams.get("said"), problem: url.searchParams.get("problem") })}`, { chrome: chromeFor(project, "settings") }));
+            const sweep = { last: lastSweep(store), off: storageSweepOff() };
+            return sendScreen(response, 200, screen("Storage", `<p><a href="/settings">Settings</a></p><h1>Storage</h1>${storageHtml({ plan, csrf: who.session.csrf, sweep }, { said: url.searchParams.get("said"), problem: url.searchParams.get("problem") })}`, { chrome: chromeFor(project, "settings") }));
         }
         // Settings → Projects → Pull requests: one project's setup. Off, the checks run on open, so the page says
         // exactly what turning on would do, or what to fix first.
@@ -4045,7 +4056,7 @@ export function createDecisionServer(options) {
             const quick = liveQuickCommand(store, repo);
             const html = checkSettingsHtml({ repo, name: projectName(repo), csrf: who.session.csrf, canChange: who.role === "approver" && !store.isDemo(),
                 level: projectCheckLevel(store, repo).level, full: store.liveVerifyCommand(repo), quick, suggestion: quick === null ? suggestQuickCommand(repo) : null,
-                review: (({ on, source }) => ({ on, source }))(store.reviewSwitch(repo, clock())),
+                review: (({ on, source }) => ({ on, source }))(store.reviewSwitch(repo, clock())), batch: { on: projectBatchChecks(store, repo).on },
                 said: url.searchParams.get("said"), problem: url.searchParams.get("problem") });
             return sendScreen(response, 200, screen("Checks", `<p><a href="/projects">Projects</a></p><h1>Checks</h1>${html}`, { chrome: chromeFor(project, "projects") }));
         }
@@ -7533,6 +7544,7 @@ export function createDecisionServer(options) {
                 if (body.get("preview") !== previewDigest(plan))
                     return back("problem", "What a clean-up would remove changed since you looked. Check the list again.");
                 const done = await cleanCheckouts(store, pool, clock, { manual: true, actor: who.name, only: new Set(plan.go.map(one => one.path)) });
+                saveSweep(store, { at: clock().toISOString(), source: "manual", actor: who.name, parts: [{ kind: "checkouts", count: done.removed.length, bytes: done.freed, failed: done.kept.filter(one => one.why === "git refused").length, items: done.removed.slice(0, 20).map(one => one.path) }] });
                 return back("said", done.removed.length === 0 ? "Nothing was removed: those checkouts are no longer ready to go." : `Removed ${done.removed.length} checkout${done.removed.length === 1 ? "" : "s"}, about ${bytesWords(done.freed)}. Their branches stay.`);
             }
             const done = await discardCheckout(store, pool, body.get("path") ?? "", now, who.name);
@@ -7594,6 +7606,12 @@ export function createDecisionServer(options) {
                 store.setReviewSwitch(repo, on, who.name, now);
                 return back("said", on ? "Automatic review is on." : "Automatic review is off.");
             }
+            // Batch checks: off by default; the ledger keeps before → after.
+            if (act === "batch") {
+                const on = body.get("on") === "1";
+                const changed = setProjectBatchChecks(store, repo, on, who.name, now);
+                return back("said", !changed.changed ? "Saved." : on ? "Batch checks are on." : "Batch checks are off.");
+            }
             if (act === "level") {
                 const level = body.get("level");
                 if (!isCheckLevel(level))
@@ -7737,10 +7755,14 @@ export function createDecisionServer(options) {
             const local = service === null && also === null ? localConnectOf(body.get("service") ?? "") : null;
             const chosen = service ?? local;
             const target = also === null ? repo : split > 0 ? also.slice(split + 1) : "";
-            const kit = kitOf(body.get("kit") ?? "")?.id ?? null;
+            // From a gallery template that uses this tool: it comes back to that template's page, for this project.
+            const gallery = also === null && chosen !== null ? galleryTemplateOf(body.get("template") ?? "") : null;
+            const template = gallery !== null && (gallery.tools ?? []).includes(chosen.id) ? gallery.id : null;
+            const kit = template === null ? kitOf(body.get("kit") ?? "")?.id ?? null : null;
             // A Connect that fails comes back to its own button, where the reason is said (no #fragment: one stops the alert's
             // autofocus); an "Also connect to" refusal goes back to the Connect card.
-            const back = (words, page = repo) => redirect(response, `/settings/tools?repo=${encodeURIComponent(page)}${kit === null ? "" : `&kit=${kit}`}${chosen === null || also !== null ? "" : `&connect=${chosen.id}`}&problem=${encodeURIComponent(words)}${also === null ? "" : "#connect"}`);
+            const back = (words, page = repo) => template !== null ? redirect(response, `/flows/new/${template}?repo=${encodeURIComponent(page)}&problem=${encodeURIComponent(words)}`)
+                : redirect(response, `/settings/tools?repo=${encodeURIComponent(page)}${kit === null ? "" : `&kit=${kit}`}${chosen === null || also !== null ? "" : `&connect=${chosen.id}`}&problem=${encodeURIComponent(words)}${also === null ? "" : "#connect"}`);
             // The page posts the project it showed; a post from a page showing another project is stale.
             const shown = body.get("shown") ?? "";
             if (shown !== repo)
@@ -7769,8 +7791,10 @@ export function createDecisionServer(options) {
                         return back(added.message);
                 }
                 const tested = await testToolOf(store, repo, local.id, clock(), { home: toolHome, omitEnv: ALL_CREDENTIAL_ENV });
+                const connected = `${local.label} is connected: ${tested?.tools.length ?? 0} action${tested?.tools.length === 1 ? "" : "s"}.`;
                 if (tested?.ok)
-                    return redirect(response, `/settings/tools?repo=${encodeURIComponent(repo)}${kit === null ? "" : `&kit=${kit}`}&said=${encodeURIComponent(`${local.label} is connected: ${tested.tools.length} action${tested.tools.length === 1 ? "" : "s"}.`)}#tool-${local.id}`);
+                    return redirect(response, template !== null ? `/flows/new/${template}?repo=${encodeURIComponent(repo)}&said=${encodeURIComponent(connected)}`
+                        : `/settings/tools?repo=${encodeURIComponent(repo)}${kit === null ? "" : `&kit=${kit}`}&said=${encodeURIComponent(connected)}#tool-${local.id}`);
                 if (had === undefined)
                     removeToolFrom(store, repo, local.id, who.name, clock(), toolHome);
                 return back(tested?.problem ?? `${local.label} didn't answer.`);
@@ -7780,7 +7804,7 @@ export function createDecisionServer(options) {
             const origin = consoleOrigin(request.headers.host);
             if (origin === null)
                 return back("Connect tools from this computer (localhost) or from your https address.");
-            const started = await startConnect({ service: service.id, repo: target, by: who.name, origin, kit: also === null ? kit : null }, options.connectFetch ?? fetch);
+            const started = await startConnect({ service: service.id, repo: target, by: who.name, origin, kit: also === null ? kit : null, template }, options.connectFetch ?? fetch);
             if (!started.ok)
                 return back(started.said);
             for (const [key, visit] of connectVisits)
@@ -9658,7 +9682,8 @@ export function createDecisionServer(options) {
                 const onProgress = beginLiveTurn(opened.thread.id);
                 void runMateTurn({ store, who: principal, session: mateSession, thread: opened.thread, config: enabled.config, key: enabled.key, message, onProgress, channel: "console", ...(requestId === null ? {} : { requestId }), ...(focusTask === null && chatProject !== null ? { context: `Current project: ${projectName(chatProject)} (${chatProject}). Keep this conversation about that project unless the operator explicitly asks to broaden it; use it as the repo for project tools.` } : {}), ...(focusTask === null ? {} : { context: `Current task: ${focusTask.id}. Read it with get_task before answering or proposing changes. Read its currentExecution next and bind new actions to that exact execution. Never replace the target of a prior proposal with a newer revision. Keep this turn about that task unless the operator explicitly asks to broaden it.${resultContext}${modeContext}` }), fetcher: chatFetcher, ...(options.subscriptionChatRunner === undefined ? {} : { subscriptionRunner: options.subscriptionChatRunner }), clock, evidenceRoot })
                     .then(outcome => {
-                    if (!outcome.ok)
+                    // A turn that saved its outcome in the thread (one stopped at its deadline) is said there, once.
+                    if (!outcome.ok && !("saved" in outcome && outcome.saved === true))
                         noteMate(who.session.csrf, "turn" in outcome ? outcome.turn : null, outcome.message);
                     endLiveTurn(opened.thread.id, outcome.ok);
                 })
@@ -18268,7 +18293,8 @@ function mateBrowserMessages(rows, csrf, back, target = { task: null, project: n
         html: message.role === 'operator' ? `<p>${escape(message.text)}</p>` : renderChatText(message.text, askedBy.get(message.id)) + asked(message.turn),
         activity: message.activity, createdAt: message.createdAt,
         ...(() => {
-            const parts = message.turn === null ? [] : rows.proposals.filter(one => one.turn === message.turn)
+            // Under the lead's message only, as the server-rendered thread does: the person's message shares the turn.
+            const parts = message.turn === null || message.role === 'operator' ? [] : rows.proposals.filter(one => one.turn === message.turn)
                 .map(one => mateProposalCardParts(one, csrf, rows.pending !== null, rows.decisions.get(typeof one.payload['decision'] === 'number' ? one.payload['decision'] : -1) ?? null, back));
             return { cardsHtml: parts.map(one => one.html).join(''), cards: parts.map(one => one.card) };
         })(),
@@ -23010,9 +23036,16 @@ function followUpsFor(store, evidenceRoot, run, now) {
 const FOLLOW_UP_WORDS = { waiting: "waiting for a worker", running: "running", passed: "passed", failed: "failed", "not-run": "didn't run" };
 /** Run checks and Add tests, under the result's Checks: what ran since, then the two acts. */
 function followUpsHtml(followUps, runId, o) {
-    const rows = followUps.checks.map(one => `<li data-follow-up-check="${one.state}">${escape(CHECK_LEVEL_WORDS[one.level])} checks ${escape(FOLLOW_UP_WORDS[one.state])}` +
-        `${one.exitCode === null || one.state === "passed" ? "" : ` (exit ${one.exitCode})`} on <span class="mono">${escape(one.head.slice(0, 7))}</span>` +
-        `<span class="meta"> · ${one.why === "pull-request" ? "for the pull request" : escape(one.actor)}${one.note === null ? "" : ` · ${escape(one.note)}`}</span>` +
+    // A batch check names every result it ran with and the exact commit it tested (batch-checks.ts).
+    const batchHow = (one) => {
+        const peers = one.batch?.members.filter(member => member.run !== runId).map(member => member.task) ?? [];
+        return one.batch?.mode === "together" && peers.length > 0 ? ` together with ${peers.map(escape).join(", ")}`
+            : one.batch?.mode === "split" ? " on its own after its batch failed" : one.batch?.mode === "conflict" ? " on its own (it conflicted with another result)" : "";
+    };
+    const rows = followUps.checks.map(one => `<li data-follow-up-check="${one.state}"${one.why === "batch" ? ` data-batch="${escape(one.batch?.mode ?? "waiting")}"` : ""}>${escape(CHECK_LEVEL_WORDS[one.level])} checks ` +
+        `${escape(one.why === "batch" && one.state === "waiting" ? "waiting to check with other results" : FOLLOW_UP_WORDS[one.state])}${batchHow(one)}` +
+        `${one.exitCode === null || one.state === "passed" ? "" : ` (exit ${one.exitCode})`} on <span class="mono">${escape((one.tested ?? one.head).slice(0, 7))}</span>` +
+        `<span class="meta"> · ${one.why === "pull-request" ? "for the pull request" : one.why === "batch" ? "batch check" : escape(one.actor)}${one.note === null ? "" : ` · ${escape(one.note)}`}</span>` +
         `${one.logArtifactId === null ? "" : ` <a href="/r/${runId}/evidence/${one.logArtifactId}">Log</a>`}</li>`).join("");
     const hidden = `<input type="hidden" name="csrf" value="${escape(o.csrf)}"><input type="hidden" name="return" value="${escape(o.returnTo)}">`;
     const canCheck = followUps.quick || followUps.full;

package/dist/shared-deps.d.ts

@@ -1,12 +1,14 @@
 export declare const DEPS_FOLDER = "deps";
 /** A copy linked or made this recently is never removed by a clean-up: a lease may be about to link it. */
 export declare const SHARED_GRACE_MS: number;
+/** The daily storage sweep removes a copy no checkout uses and none has linked for this long. */
+export declare const SHARED_UNUSED_MS: number;
 export type SharedCopy = {
     key: string;
     /** The copy's folder, holding node_modules and ready.json. */
     dir: string;
     repo: string;
-    /** sha256 of the lockfile and package.json it was installed from. */
+    /** sha256 of the lockfile and package.json, excluding the project's own version (raw bytes in old copies). */
     lock: string;
     node: string;
     createdAt: string;
@@ -19,7 +21,8 @@ export declare function sharedDepsRoot(databaseFile: string): string;
 /** A setup whose whole effect is node_modules: `npm ci` or `npm install`, with plain flags only. */
 export declare function installsOnly(command: string): boolean;
 /**
- * The checkout's dependency identity: its npm lockfile and package.json, hashed together. null when there is no
+ * The checkout's dependency identity: its npm lockfile and package.json, hashed together without the root
+ * package's own version, as in release-check.mjs versionOnly(). null when either JSON file is invalid, there is no
  * lockfile, or the lockfile links local folders (workspaces, `file:`), whose links would point into the shared
  * folder instead of the checkout.
  */
@@ -35,6 +38,7 @@ export declare function sharingFor(args: {
         command: string;
         digest: string;
     };
+    root?: string;
 }): {
     key: string;
     lock: string;
@@ -92,3 +96,15 @@ export declare function unusedShared(root: string, checkouts: readonly {
 };
 /** Remove one copy or debris folder (read-only on disk, so made writable first). */
 export declare function removeShared(path: string): boolean;
+/**
+ * The daily sweep: remove each copy no checkout uses and none has linked for `unusedMs` (a week), and old debris.
+ * Right before a copy goes, who uses it and when it was last linked are read again; a copy a checkout picked up in
+ * between stays.
+ */
+export declare function pruneUnusedShared(root: string, checkouts: () => readonly {
+    path: string;
+    repo: string;
+}[], now: Date, unusedMs?: number): {
+    removed: SharedUse[];
+    failed: string[];
+};

package/dist/shared-deps.js

@@ -14,12 +14,13 @@
  * The link is read-only to the build. A checkout whose package.json or lockfile no longer matches the copy it links
  * gets its own install (the link goes, the approved setup runs there) and the shared copy is never touched; a copy
  * whose installed tree changed anyway is retired, never linked again. `toolroll storage clean` removes a copy no
- * checkout links or matches.
+ * checkout links or matches; the plane's daily storage sweep removes one no checkout has used for a week.
  */
 import { createHash, randomBytes } from "node:crypto";
 import { spawnSync } from "node:child_process";
 import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync, symlinkSync, utimesSync, writeFileSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
+import { markNeverIndex } from "./never-index.js";
 export const DEPS_FOLDER = "deps";
 const READY = "ready.json";
 const RETIRED = "retired";
@@ -28,6 +29,8 @@ const LINK_NOTE = ".toolroll-shared";
 const NODE_MODULES = "node_modules";
 /** A copy linked or made this recently is never removed by a clean-up: a lease may be about to link it. */
 export const SHARED_GRACE_MS = 60 * 60_000;
+/** The daily storage sweep removes a copy no checkout uses and none has linked for this long. */
+export const SHARED_UNUSED_MS = 7 * 24 * 60 * 60_000;
 /** A half-made copy (a crash mid-promotion) is debris after this long. */
 const PARTIAL_STALE_MS = 24 * 60 * 60_000;
 export function sharedDepsRoot(databaseFile) {
@@ -38,15 +41,20 @@ export function installsOnly(command) {
     return /^\s*npm\s+(?:ci|install|i)(?:\s+--?[A-Za-z][\w-]*(?:=[\w.@/:+-]+)?)*\s*$/.test(command);
 }
 /**
- * The checkout's dependency identity: its npm lockfile and package.json, hashed together. null when there is no
+ * The checkout's dependency identity: its npm lockfile and package.json, hashed together without the root
+ * package's own version, as in release-check.mjs versionOnly(). null when either JSON file is invalid, there is no
  * lockfile, or the lockfile links local folders (workspaces, `file:`), whose links would point into the shared
  * folder instead of the checkout.
  */
 export function lockDigest(checkout) {
+    return dependencyInputs(checkout)?.digest ?? null;
+}
+const digestPair = (lock, manifest) => createHash("sha256").update(lock).update("\u0000").update(manifest).digest("hex");
+function dependencyInputs(checkout) {
     let lock = null;
     for (const name of ["npm-shrinkwrap.json", "package-lock.json"]) {
         try {
-            lock = readFileSync(join(checkout, name));
+            lock = readFileSync(join(checkout, name), "utf8");
             break;
         }
         catch {
@@ -55,16 +63,75 @@ export function lockDigest(checkout) {
     }
     if (lock === null)
         return null;
-    let manifest;
     try {
-        manifest = readFileSync(join(checkout, "package.json"));
+        const manifest = readFileSync(join(checkout, "package.json"), "utf8");
+        const normalized = (text, isLock) => {
+            const json = JSON.parse(text);
+            if (json === null || typeof json !== "object" || Array.isArray(json))
+                throw Error("not an object");
+            delete json.version;
+            if (isLock && json.packages?.[""] !== undefined)
+                delete json.packages[""].version;
+            return JSON.stringify(json);
+        };
+        if (/"link"\s*:\s*true/.test(lock))
+            return null;
+        return { lock, manifest, digest: digestPair(normalized(lock, true), normalized(manifest, false)) };
     }
     catch {
         return null;
     }
-    if (/"link"\s*:\s*true/.test(lock.toString("utf8")))
-        return null;
-    return createHash("sha256").update(lock).update("\u0000").update(manifest).digest("hex");
+}
+/** Replace only root version values, preserving every other byte for comparison with a pre-normalization hash.
+ * The caller already parsed the JSON. Token offsets let compact and indented files keep their original layout. */
+function withRootVersion(text, version, isLock) {
+    const tokens = [...text.matchAll(/"(?:[^"\\]|\\.)*"|[{}[\]:,]|[^\s{}[\]:,]+/g)];
+    let cursor = 0;
+    const edits = [];
+    const value = (path) => {
+        const start = tokens[cursor++];
+        if (start[0] === "{") {
+            while (tokens[cursor][0] !== "}") {
+                const key = JSON.parse(tokens[cursor++][0]);
+                cursor++; // colon
+                value([...path, key]);
+                if (tokens[cursor][0] === ",")
+                    cursor++;
+            }
+            cursor++;
+        }
+        else if (start[0] === "[") {
+            let index = 0;
+            while (tokens[cursor][0] !== "]") {
+                value([...path, String(index++)]);
+                if (tokens[cursor][0] === ",")
+                    cursor++;
+            }
+            cursor++;
+        }
+        if ((path.length === 1 && path[0] === "version") ||
+            (isLock && path.length === 3 && path[0] === "packages" && path[1] === "" && path[2] === "version")) {
+            const end = tokens[cursor - 1];
+            edits.push({ start: start.index, end: end.index + end[0].length });
+        }
+    };
+    value([]);
+    for (const edit of edits.sort((a, b) => b.start - a.start))
+        text = text.slice(0, edit.start) + JSON.stringify(version) + text.slice(edit.end);
+    return text;
+}
+/** Old copies did not save the manifests. npm's hidden lock records their root version; reconstruct only those
+ * version fields and require the exact old raw digest. Never infer equality from the installed packages alone. */
+function matchesInputs(dir, ready, inputs) {
+    if (ready.lock === inputs.digest || ready.lock === digestPair(inputs.lock, inputs.manifest))
+        return true;
+    try {
+        const version = JSON.parse(readFileSync(join(dir, NODE_MODULES, ".package-lock.json"), "utf8")).version;
+        return typeof version === "string" && ready.lock === digestPair(withRootVersion(inputs.lock, version, true), withRootVersion(inputs.manifest, version, false));
+    }
+    catch {
+        return false;
+    }
 }
 const nodeSeen = new Map();
 /** The node a setup on this PATH would install with: version, platform and architecture (native modules differ). */
@@ -85,13 +152,32 @@ export function depsKey(repo, setupDigest, lock, node) {
 export function sharingFor(args) {
     if (!installsOnly(args.setup.command))
         return null;
-    const lock = lockDigest(args.worktree);
-    if (lock === null)
+    const inputs = dependencyInputs(args.worktree);
+    if (inputs === null)
         return null;
+    const lock = inputs.digest;
     const node = nodeIdentity();
     if (node === null)
         return null;
-    return { key: depsKey(args.repo, args.setup.digest, lock, node), lock, node };
+    const key = depsKey(args.repo, args.setup.digest, lock, node);
+    if (args.root !== undefined) {
+        let names = [];
+        try {
+            names = readdirSync(args.root).filter(name => /^[0-9a-f]{24}$/.test(name));
+        }
+        catch { /* no copies yet */ }
+        // Keep a currently linked copy first. Reusing its old directory preserves every existing checkout's links.
+        for (const name of new Set([linkedKey(args.worktree, args.root), key, ...names])) {
+            if (name === null)
+                continue;
+            const dir = join(args.root, name);
+            const ready = readReady(dir);
+            if (ready?.repo === args.repo && ready.setup === args.setup.digest && ready.node === node &&
+                readyCopy(args.root, name) !== null && matchesInputs(dir, ready, inputs))
+                return { key: name, lock, node };
+        }
+    }
+    return { key, lock, node };
 }
 function readReady(dir) {
     try {
@@ -179,6 +265,7 @@ export function linkInto(worktree, shared) {
             symlinkSync(join(shared, entry.name), join(at, entry.name), entry.isDirectory() ? (process.platform === "win32" ? "junction" : "dir") : "file");
         }
         writeFileSync(join(at, LINK_NOTE), `${shared}\n`, "utf8");
+        markNeverIndex(at);
         touch(dirname(shared));
         return "link";
     }
@@ -234,6 +321,8 @@ export function promoteInstall(args) {
     const partial = join(args.root, `${args.key}.partial-${process.pid}-${randomBytes(4).toString("hex")}`);
     try {
         mkdirSync(partial, { recursive: true });
+        // Spotlight leaves shared installs alone (never-index.ts).
+        markNeverIndex(args.root);
         renameSync(own, join(partial, NODE_MODULES));
     }
     catch {
@@ -317,12 +406,14 @@ export function sharedUse(root, checkouts) {
         }
         if (!existsSync(checkout.path))
             continue;
-        const lock = lockDigest(checkout.path);
-        if (lock === null)
+        const inputs = dependencyInputs(checkout.path);
+        if (inputs === null)
             continue;
-        for (const copy of copies)
-            if (!copy.retired && copy.repo === checkout.repo && copy.lock === lock)
+        for (const copy of copies) {
+            const ready = readReady(copy.dir);
+            if (!copy.retired && copy.repo === checkout.repo && ready !== null && matchesInputs(copy.dir, ready, inputs))
                 users.get(copy.key).add(checkout.path);
+        }
     }
     return copies.map(one => ({ ...one, checkouts: [...users.get(one.key)].sort() }));
 }
@@ -363,3 +454,26 @@ export function removeShared(path) {
         return false;
     }
 }
+/**
+ * The daily sweep: remove each copy no checkout uses and none has linked for `unusedMs` (a week), and old debris.
+ * Right before a copy goes, who uses it and when it was last linked are read again; a copy a checkout picked up in
+ * between stays.
+ */
+export function pruneUnusedShared(root, checkouts, now, unusedMs = SHARED_UNUSED_MS) {
+    const stale = (one) => one.checkouts.length === 0 && now.getTime() - Date.parse(one.usedAt) > unusedMs;
+    const removed = [];
+    const failed = [];
+    for (const one of sharedUse(root, checkouts()).filter(stale)) {
+        const fresh = sharedUse(root, checkouts()).find(other => other.key === one.key);
+        if (fresh === undefined || !stale(fresh))
+            continue;
+        if (removeShared(fresh.dir))
+            removed.push(fresh);
+        else
+            failed.push(fresh.dir);
+    }
+    for (const debris of sharedDebris(root, now))
+        if (!removeShared(debris))
+            failed.push(debris);
+    return { removed, failed };
+}