toolroll 0.9.31 → 0.9.32

package/dist/builder.js

@@ -1,5 +1,7 @@
 import { OBSERVATION_MAILBOX, observationBrief, parseObservationCases, collectObservations } from "./observations.js";
 import { checkCommandFor, effectiveCheckLevel, recordRunCheckLevel } from "./check-levels.js";
+import { queueBatchCheck } from "./batch-checks.js";
+import { batchesFullCheck } from "./batch-policy.js";
 import { skillsContext } from "./project-skills.js";
 import { failedVerificationEvidence, sealVerificationReceipt, verificationEvidence, reuseObservationVerification } from "./verification-evidence.js";
 import { learningContext } from "./project-learning.js";
@@ -684,7 +686,7 @@ export async function build(store, request) {
             // copy links it instead of installing its own; a setup that is about to
             // run never reaches through an old link into a shared copy.
             const depsRoot = sharedDepsRootOf(store);
-            const sharing = depsRoot === null ? null : sharingFor({ repo: leased.repo, worktree, setup: setupWanted });
+            const sharing = depsRoot === null ? null : sharingFor({ repo: leased.repo, worktree, setup: setupWanted, root: depsRoot });
             if (depsRoot !== null)
                 detachShared(worktree, depsRoot);
             if (depsRoot !== null && sharing !== null) {
@@ -2175,6 +2177,11 @@ async function settleProof(captured, statArtifactId, sealedHead) {
     const configured = chosenCheck?.command ?? null;
     if (repo !== null && chosenCheck !== null)
         recordRunCheckLevel(store, { id: runId, taskId: request.taskId, repo }, chosenCheck.level, checkChoice.from, now());
+    // Batch checks (batch-checks.ts): with the project's batching on, a Full check waits to run once with
+    // other results on a temporary batch commit. The build seals no check of its own; the batch's sealed
+    // receipt is this result's check, and Merge waits for it.
+    const batched = repo !== null && chosenCheck !== null && batchesFullCheck(store, repo, chosenCheck.level, configured);
+    const gateCommand = batched ? null : configured;
     let verifyCommand;
     const checkLog = [];
     const checkOutcomes = [];
@@ -2210,6 +2217,10 @@ async function settleProof(captured, statArtifactId, sealedHead) {
     else if (configured === null) {
         verifyCommand = { configured: false };
     }
+    else if (batched && repo !== null) {
+        verifyCommand = { configured: false };
+        queueBatchCheck(store, { runId, taskId: request.taskId, repo, head: sealedHead, base: captured.baseRevision, command: configured }, now());
+    }
     else if (!store.proveRunnerCustodyForSpawn(runId, now())) {
         verifyCommand = { configured: true, ran: false, attemptFailed: true, failure: "custody-lost" };
         recordCheckNote("Verification did not start: this worker no longer owned the build.");
@@ -2258,7 +2269,7 @@ async function settleProof(captured, statArtifactId, sealedHead) {
             const live = linked === null ? null : store.liveWorktreeSetup(repo);
             if (linked === null || live === null)
                 return null;
-            if (sharingFor({ repo, worktree, setup: live })?.key === linked && readyCopy(depsRoot, linked) !== null)
+            if (sharingFor({ repo, worktree, setup: live, root: depsRoot })?.key === linked && readyCopy(depsRoot, linked) !== null)
                 return null;
             if (!store.proveRunnerCustodyForSpawn(runId, now()))
                 return "custody-lost";
@@ -2497,7 +2508,7 @@ async function settleProof(captured, statArtifactId, sealedHead) {
     }
     const { verdict, reasons, matrix, machineVerdict } = adjudicate({
         directAssessment: true,
-        ...(configured === null ? {} : { verificationCommand: configured.command }),
+        ...(gateCommand === null ? {} : { verificationCommand: gateCommand.command }),
         proofArtifactPresent,
         proofParse,
         handoffPresent: handoffArtifact !== null,

package/dist/chat-actions.js

@@ -5,7 +5,7 @@ import { TEXT_LIMITS } from "./text-limits.js";
 import { publicChatText } from "./chat-display.js";
 import { gateWords } from "./approval-policy.js";
 import { createHash, randomBytes } from "node:crypto";
-import { verifiedAuthor } from "./store.js";
+import { mateTurnKeepsProposals, verifiedAuthor } from "./store.js";
 import { isVerifiedApprover, reproveApprover, } from "./principal.js";
 import { changeSkills, importSkill, skillsView, skillsVersion, testSkill, validateSkill, } from "./project-skills.js";
 import { changeKnowledge, knowledgeVersion, knowledgeView, } from "./project-knowledge.js";
@@ -1025,7 +1025,7 @@ function savedActionContext(store, who, id, state) {
         session.ceilingDigest !== who.ceilingDigest ||
         proposal.ceilingDigest !== who.ceilingDigest ||
         (!shared && turn?.session !== session.id) ||
-        turn?.state !== "answered")
+        !mateTurnKeepsProposals(turn))
         throw Error("This conversation ended or its project access changed. Ask for a fresh proposal.");
     requireActor(store, who, payload.repo, payload.operation);
     return payload;

package/dist/check-levels-ui.d.ts

@@ -19,6 +19,10 @@ export type CheckSettingsView = {
         on: boolean;
         source: "project" | "hands-off" | "default";
     };
+    /** Batch checks (batch-checks.ts): off by default. */
+    batch?: {
+        on: boolean;
+    };
     said: string | null;
     problem: string | null;
 };

package/dist/check-levels-ui.js

@@ -3,6 +3,7 @@
  * one. Every change takes the password and lands in the ledger; approving a
  * command restates exactly what will run, unattended, before the yes. */
 import { CHECK_LEVELS, CHECK_LEVEL_HINTS, CHECK_LEVEL_WORDS } from "./check-levels.js";
+import { BATCH_HINT } from "./batch-policy.js";
 const escape = (text) => text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 export function checkSettingsHtml(view) {
     const hidden = (act) => `<input type="hidden" name="csrf" value="${escape(view.csrf)}"><input type="hidden" name="repo" value="${escape(view.repo)}"><input type="hidden" name="act" value="${act}">`;
@@ -19,7 +20,7 @@ export function checkSettingsHtml(view) {
         (fallsBack ? `<p class="meta">No quick command yet, so builds run the full check.</p>` : "") +
         (view.level !== "full" && view.full !== null ? `<p class="meta">The full check still runs when a pull request opens, and Merge waits for it.</p>` : "");
     if (!view.canChange) {
-        return head + `<section class="card check-settings">${current}</section>` + reviewHtml(view, "") +
+        return head + `<section class="card check-settings">${current}</section>` + batchHtml(view, "") + reviewHtml(view, "") +
             `<section class="card check-settings"><h2>Quick check</h2>${view.quick === null ? `<p class="meta">None yet.</p>` : command(view.quick)}</section>` +
             `<section class="card check-settings"><h2>Full check</h2>${view.full === null ? `<p class="meta">None yet.</p>` : command(view.full)}</section>`;
     }
@@ -45,7 +46,25 @@ export function checkSettingsHtml(view) {
             `<p class="meta">Quick builds run the full check instead.</p>${password}<button type="submit" class="danger">Remove</button></form></details></section>`;
     const full = `<details class="settings-more"><summary>Full check</summary><section class="card check-settings">` +
         (view.full === null ? `<p class="meta">None yet. Approve one with <span class="mono">toolroll verify set --repo … --command "…"</span>.</p>` : command(view.full)) + `</section></details>`;
-    return head + levelForm + reviewHtml(view, password) + quick + full;
+    return head + levelForm + batchHtml(view, password) + reviewHtml(view, password) + quick + full;
+}
+/** Batch checks: one state and one sentence; turning it on restates exactly what happens, behind a disclosure with the password. */
+function batchHtml(view, password) {
+    const batch = view.batch;
+    if (batch === undefined)
+        return "";
+    const act = batch.on ? "Turn off" : "Turn on";
+    const terms = batch.on ? `<p class="meta">Each result runs its own full check again. Results already waiting are checked now.</p>`
+        : `<ul class="check-terms"><li>When results finish within 10 minutes of each other, they're merged in a temporary checkout and the full check runs once.</li>` +
+            `<li>If it fails, the batch is split until the result that breaks it is found. Results that conflict are checked on their own.</li>` +
+            `<li>Nothing is merged into a real branch. Each result still lands on its own.</li></ul>`;
+    const change = password === "" ? ""
+        : `<details class="settings-more"><summary>${act}</summary><form method="post" action="/settings/checks" class="check-settings">` +
+            `<input type="hidden" name="csrf" value="${escape(view.csrf)}"><input type="hidden" name="repo" value="${escape(view.repo)}"><input type="hidden" name="act" value="batch">` +
+            `<input type="hidden" name="on" value="${batch.on ? "0" : "1"}">${terms}${password}<button type="submit">${act}</button></form></details>`;
+    return `<section class="card check-settings" data-batch-checks="${batch.on ? "on" : "off"}"><h2>Batch checks</h2>` +
+        `<p><strong>${batch.on ? "On" : "Off"}</strong> · ${escape(BATCH_HINT)}</p>` +
+        (batch.on && view.level !== "full" ? `<p class="meta">Only Full checks are batched.</p>` : "") + `${change}</section>`;
 }
 /** Automatic review: one state, one sentence, and its one change behind a disclosure (the password). */
 function reviewHtml(view, password) {

package/dist/checkout-cleanup.d.ts

@@ -1,7 +1,7 @@
 import { type CheckoutCleanup } from "./storage.js";
 import type { Store, WorktreeRow } from "./store.js";
 import { type WorktreePool } from "./worktree.js";
-/** A release candidate's checkout holds the build a deploy installs: kept a week after its task was done. */
+/** A release candidate's checkout holds the build a deploy installs: the newest complete one waits at most a week for it. */
 export declare const CANDIDATE_KEEP_MS: number;
 /** The worker's pass removes at most this many; a clean-up by hand has no cap. */
 export declare const AUTO_MAX = 20;
@@ -43,6 +43,7 @@ type Status = {
 export type Deployed = {
     head: string | null;
     run: number | null;
+    at?: string | null;
 };
 export declare function deployedRelease(stateDir: string | null): Deployed | null;
 /**

package/dist/checkout-cleanup.js

@@ -7,9 +7,10 @@
  *
  * Always kept: a checkout in use, one whose task isn't finished (on hold, failed, a revision under way), a result
  * still waiting for review, a checkout with changes (files Toolroll wrote itself aside), and one with commits on no
- * branch. A release candidate's checkout (a deploy installs from it) is kept only while it is the newest gate for its
- * release (for a week after it was done) or the one deployed; a superseded or cancelled gate goes at once, whatever
- * its task's state (staged releases keep the rollback copy). A checkout no task names (adopted after a crash) goes only
+ * branch. A release check's checkout (a deploy installs from it) goes once its task is complete, with its dependency
+ * install and journey output, except the one deployed now and the project's newest complete one still waiting for its
+ * deploy (no deploy since it was complete; at most a week). A superseded or cancelled gate goes at once, whatever its
+ * task's state (staged releases keep the rollback copy). A checkout no task names (adopted after a crash) goes only
  * in a clean-up by hand. Every removal is in the ledger.
  *
  * A kept checkout waiting for review or with changes drops its dependencies and build output once its run ends
@@ -23,7 +24,7 @@ import { COMPLETION_ACTION } from "./result-completion.js";
 import { CLEANUP_CHOICES, bytesWords, diskBytes } from "./storage.js";
 import { worktreePath } from "./worktree.js";
 const DAY_MS = 86_400_000;
-/** A release candidate's checkout holds the build a deploy installs: kept a week after its task was done. */
+/** A release candidate's checkout holds the build a deploy installs: the newest complete one waits at most a week for it. */
 export const CANDIDATE_KEEP_MS = 7 * DAY_MS;
 /** The worker's pass removes at most this many; a clean-up by hand has no cap. */
 export const AUTO_MAX = 20;
@@ -56,7 +57,7 @@ export function deployedRelease(stateDir) {
             continue;
         newest = { at, head: typeof journal["candidate"] === "string" ? journal["candidate"] : null, run: Number.isSafeInteger(journal["builder"]) ? Number(journal["builder"]) : null };
     }
-    return newest === null ? null : { head: newest.head, run: newest.run };
+    return newest === null ? null : { head: newest.head, run: newest.run, at: newest.at === "" ? null : newest.at };
 }
 /** The folder beside the database (where staged releases live), or null for a database in memory. */
 function stateDirOf(store) {
@@ -117,6 +118,19 @@ export function taskStatuses(store, now, deployed) {
         if (ref !== undefined && (completedRef.get(ref) ?? "") < at)
             completedRef.set(ref, at);
     }
+    const completedAtOf = (row) => [completed.get(String(row["id"])), completedRef.get(Number(row["ref"]))].filter((one) => one !== undefined).sort().at(-1) ?? null;
+    // Per project, the newest complete gate (by when it was complete): the one a deploy may still be about to install.
+    // Once the project deployed after it was complete, it waits for nothing.
+    const deployedRepo = deployedRef === undefined ? (live?.head == null ? undefined : gates.find(row => String(row["candidate"]) === live.head)?.["repo"]) : refs.find(row => Number(row["ref"]) === deployedRef)?.["repo"];
+    const newestDone = new Map();
+    for (const row of gates) {
+        if (row["state"] !== "done")
+            continue;
+        const at = completedAtOf(row) ?? (row["updated_at"] === null ? "" : String(row["updated_at"]));
+        const seen = newestDone.get(String(row["repo"]));
+        if (seen === undefined || at > seen.at || (at === seen.at && Number(row["ref"]) > seen.ref))
+            newestDone.set(String(row["repo"]), { ref: Number(row["ref"]), at });
+    }
     const byRef = new Map();
     const byId = new Map();
     const parentOf = new Map();
@@ -139,11 +153,13 @@ export function taskStatuses(store, now, deployed) {
         else if (state === "cancelled")
             status = { keep: null, taskId: id, finishedAt: updated };
         else {
-            const completedAt = [completed.get(id), completedRef.get(ref)].filter((one) => one !== undefined).sort().at(-1) ?? null;
+            const completedAt = completedAtOf(row);
             if (gate) {
                 const since = completedAt ?? updated ?? now.toISOString();
                 const until = new Date(Date.parse(since) + CANDIDATE_KEEP_MS).toISOString();
-                status = until > now.toISOString() ? { keep: "release candidate", taskId: id, finishedAt: since, dueAt: until } : { keep: null, taskId: id, finishedAt: since };
+                const deployedSince = live?.at != null && deployedRepo !== undefined && String(row["repo"]) === String(deployedRepo) && live.at >= since;
+                const waiting = newestDone.get(String(row["repo"]))?.ref === ref && !deployedSince && until > now.toISOString();
+                status = waiting ? { keep: "release candidate", taskId: id, finishedAt: since, dueAt: until } : { keep: null, taskId: id, finishedAt: since, atOnce: true };
             }
             else
                 status = completedAt === null ? { keep: "waiting for review", taskId: id, finishedAt: null } : { keep: null, taskId: id, finishedAt: completedAt };
@@ -353,7 +369,7 @@ export function whyWords(item) {
         case "in use": return "in use";
         case "task not finished": return "its task isn't finished";
         case "waiting for review": return "its result is waiting for review";
-        case "release candidate": return item.dueAt === undefined ? "the deployed release candidate" : `newest release candidate, kept until ${item.dueAt.slice(0, 10)}`;
+        case "release candidate": return item.dueAt === undefined ? "the deployed release candidate" : `newest release candidate, kept for its deploy until ${item.dueAt.slice(0, 10)}`;
         case "has changes": return "has changes";
         case "has commits": return "has commits on no branch";
         case "unreadable": return "git couldn't read it";

package/dist/desktop-update.d.ts

@@ -125,13 +125,13 @@ export declare function prepareDesktopUpdate(stateDir: string, installed: string
 export declare function sqliteLock(file: string, busyTimeoutMs?: number): DatabaseSync | null;
 export declare const installationLock: (j: UpdateJournal) => DatabaseSync | null;
 export declare function desktopUpdateStatus(stateDir: string): {
-    error?: never;
     active: boolean;
     phase: string;
     detail: string;
     running: boolean;
     canResume: boolean;
     canCancel: boolean;
+    error?: never;
     automaticRecovery?: never;
     recoveryAttempts?: never;
     recoveryRepairs?: never;

package/dist/exec.d.ts

@@ -56,6 +56,8 @@ export type RunOptions = ProcessTreeObserver & {
      * timeoutMs there is deliberately no absolute wall-clock ceiling.
      */
     idleTimeoutMs?: number;
+    /** Ends a process-group run early, exactly as its timeout does: the whole group is killed and the result reads timed out. */
+    signal?: AbortSignal;
     maxBuffer?: number;
     /**
      * Extra environment, merged over the process's own. A capability probe is a

package/dist/exec.js

@@ -526,6 +526,7 @@ export function run(file, args, options = {}) {
         return retryTransientSpawn(() => runBufferedGroup(file, args, {
             timeoutMs,
             maxBuffer,
+            ...(options.signal === undefined ? {} : { signal: options.signal }),
             ...(options.stdin === undefined ? {} : { stdin: options.stdin }),
             ...(cwd === undefined ? {} : { cwd }),
             ...(childEnv === undefined ? {} : { childEnv }),
@@ -610,6 +611,15 @@ function runBufferedGroup(file, args, bag) {
             timedOut = true;
             killGroup(child);
         }, bag.timeoutMs);
+        // The caller's deadline, when it owns one: the same group kill as the timer.
+        const aborted = () => {
+            timedOut = true;
+            killGroup(child);
+        };
+        if (bag.signal?.aborted === true)
+            aborted();
+        else
+            bag.signal?.addEventListener("abort", aborted, { once: true });
         child.stdout?.setEncoding("utf8");
         child.stdout?.on("data", (chunk) => {
             stdout += chunk;
@@ -638,6 +648,7 @@ function runBufferedGroup(file, args, bag) {
                 return;
             settled = true;
             clearTimeout(timer);
+            bag.signal?.removeEventListener("abort", aborted);
             liveProviders.delete(child);
             // The OS object is settled BEFORE the answer: a root that exited is
             // not an empty container until the OS says so.

package/dist/lead-capabilities.d.ts

@@ -1,10 +1,3 @@
-/**
- * What the lead can rely on right now, in one read (get_capabilities): the agents a project's route would run, the
- * workers that would run them, the project's tools and skills, the integrations, and the project's checks. Every entry
- * says what it lets the lead do and, when it can't, the one next step and the settings control (show_control) that
- * takes the owner there. Everything here reads what is already recorded — runner readiness reports, sign-in pauses,
- * plan-limit readings, tool tests, skill tests, integration checks — and never probes anything that spends.
- */
 import type { Store } from "./store.js";
 import type { ChatControl } from "./chat-controls.js";
 import type { ProviderId } from "./provider.js";

package/dist/lead-capabilities.js

@@ -1,3 +1,11 @@
+/**
+ * What the lead can rely on right now, in one read (get_capabilities): the agents a project's route would run, the
+ * workers that would run them, the project's tools and skills, the integrations, and the project's checks. Every entry
+ * says what it lets the lead do and, when it can't, the one next step and the settings control (show_control) that
+ * takes the owner there. Everything here reads what is already recorded — runner readiness reports, sign-in pauses,
+ * plan-limit readings, tool tests, skill tests, integration checks — and never probes anything that spends.
+ */
+import { projectBatchChecks } from "./batch-policy.js";
 import { resolveRouteCandidates } from "./agentconfig.js";
 import { authPauseOf, messageCommand, providerName } from "./provider-auth.js";
 import { readAuthMode, SUBSCRIPTION_CAPABLE } from "./keys.js";
@@ -136,7 +144,9 @@ function checksOf(store, repo) {
         return { ...base, state: "Off", ok: false, next: "Builds are not checked. Turn checks on for the project if results need them.", link: "projects" };
     if (!releaseCheck)
         return { ...base, state: `${CHECK_LEVEL_WORDS[level]} · no release check`, ok: false, next: "No release check is set up, so no result can show a passing check. Set one for the project.", link: "projects" };
-    return { ...base, state: level === "quick" && !quickCheck ? "Quick · runs the release check" : `${CHECK_LEVEL_WORDS[level]} · release check set`, ok: true, next: null, link: null };
+    // Batch checks are changed in Settings → Projects → Checks (or `project checks --batch on|off`), never from chat.
+    const batched = level === "full" && projectBatchChecks(store, repo).on ? " · batched with results that finish together" : "";
+    return { ...base, state: level === "quick" && !quickCheck ? "Quick · runs the release check" : `${CHECK_LEVEL_WORDS[level]} · release check set${batched}`, ok: true, next: null, link: null };
 }
 function workersOf(store, repos, now) {
     const live = store.handle.prepare(`SELECT ref.external_id AS task, ref.repo AS repo FROM claim JOIN task_ref AS ref ON ref.id = claim.task_ref

package/dist/mate-doors.js

@@ -15,7 +15,7 @@ import { executeSharedAction, sharedActionPayload, sharedActionAllowsChallenge,
  * silent re-read.
  */
 import { isCheckLevel, setTaskCheckLevel } from "./check-levels.js";
-import { verifiedAuthor } from "./store.js";
+import { mateTurnKeepsProposals, verifiedAuthor } from "./store.js";
 import { isVerifiedApprover, reproveApprover } from "./principal.js";
 import { TeamLeads } from './team-leads.js';
 import { fileTaskProposal } from "./proposal.js";
@@ -97,7 +97,7 @@ export function confirmMateProposal(store, who, proposalId, now, options) {
             return { ok: false, kind: proposal.kind, reason: "ceiling-changed", said: "the admitted projects changed since this was proposed — it cannot be confirmed" };
         }
         const turn = store.getMateTurn(proposal.turn);
-        if (turn === null || turn.state !== "answered") {
+        if (!mateTurnKeepsProposals(turn) || proposal.state === "drafting") {
             return { ok: false, kind: proposal.kind, reason: "turn-not-answered", said: "this proposal's turn did not finish — it cannot be confirmed" };
         }
         if (proposal.kind === "cancel") {

package/dist/mate.d.ts

@@ -93,6 +93,7 @@ export type MateTurnOutcome = {
     failed: MateFailure;
     message: string;
     unknownSpend: boolean;
+    saved?: boolean;
 };
 /** What happened, what it means, and one next step: plain words a person can act on, never internal terms. */
 export declare const MATE_REFUSAL_COPY: Record<MateRefusal, string>;
@@ -102,7 +103,7 @@ export declare const MATE_CHANNEL_COPY: Record<MateChannelProblem, string>;
 export declare const MATE_FAILURE_COPY: {
     readonly stopped: "This reply was stopped before it finished, from another window or by a newer message. Nothing it proposed was kept. Send your message again if you still need an answer.";
     readonly ended: "Your sign-in or this conversation ended while the lead was answering. Nothing it proposed was kept. Sign in again or start a new chat, then send your message again.";
-    readonly tooLong: "The reply took too long and was stopped. Nothing it proposed was kept. Send your message again, or ask for less at once.";
+    readonly tooLong: string;
     readonly secretRead: "Something the lead read looked like a password or key, so it stopped before sending it anywhere. Nothing was kept. Remove the password or key from that task or note, then ask again.";
     readonly secretReply: "The lead's reply contained something that looked like a password or key, so it was thrown away. Nothing was kept. Ask again, without asking for a password or key.";
     readonly paused: "An earlier reply stopped before its cost was known, so chat is paused. This message wasn't answered. Confirm that earlier reply on the Chat page, then send again.";
@@ -111,7 +112,7 @@ export declare const MATE_FAILURE_COPY: {
     readonly unreadable: "The chat provider sent back an answer that couldn't be read, so it was thrown away. Nothing was kept. Send your message again.";
     readonly signIn: "The chat provider couldn't answer; its sign-in may have expired. Nothing was kept. Sign in to it again on this computer, then send your message again.";
     readonly refused: "The chat provider turned the request down. Nothing was kept or charged. Try again in a minute; if it keeps happening, check the provider in Settings → Lead.";
-    readonly tooLongUnknownCost: "The reply took too long and was stopped, and its cost isn't known yet, so chat is paused. Nothing it proposed was kept. Confirm the cost on the Chat page to turn chat back on.";
+    readonly tooLongUnknownCost: string;
     readonly lostUnknownCost: "The chat provider stopped responding partway through, and the cost isn't known, so chat is paused. Nothing it proposed was kept. Confirm the cost on the Chat page to turn chat back on.";
     readonly unreadableUnknownCost: "The chat provider sent back an answer that couldn't be read, and its cost isn't known, so chat is paused. Nothing it proposed was kept. Confirm the cost on the Chat page to turn chat back on.";
     readonly empty: "The lead sent back an empty answer. Nothing was kept. Send your message again.";
@@ -119,6 +120,9 @@ export declare const MATE_FAILURE_COPY: {
 };
 /** A failed turn's saved reason as plain words, for a surface that reads the turn back later (a restart, a delivery retry). */
 export declare function mateFailureText(reason: string | null): string;
+/** How long a provider that ignored its abort at the turn's deadline is waited for before the turn ends without it.
+ * Its process group was already killed at the deadline; this only bounds the wait for the transport to say so. */
+export declare const MATE_ABORT_GRACE_MS = 5000;
 /** The last messages of the thread as provider-neutral history, newest kept first until the byte cap. */
 export declare function historyFor(store: Store, thread: number, queuedMessageId?: number): MateHistoryMessage[];
 /** "read 3 · proposed 1 · 2 steps" — counts only, never results (ruling 11). */

package/dist/mate.js

@@ -1,6 +1,7 @@
 import { Buffer } from "node:buffer";
 import { mateToolLabel } from "./mate-progress.js";
 import { createHash } from "node:crypto";
+import { mateTimeoutNotice } from "./store.js";
 import { RESULT_IMAGES_PER_TURN_CAP } from "./chat-evidence.js";
 import { isVerifiedApprover, reproveApprover } from "./principal.js";
 import { MATE_MAX_CALLS_PER_STEP, MATE_MAX_STEPS, MATE_TOOL_RESULT_CAP_BYTES, TURN_WALL_CLOCK_MS, composeMateRequest, credentialKeyOf, isDirectChatProvider, mateWorstCaseForPrice, performMateRequest, priceForConfig, settleForPrice, subscriptionCredentialKey, } from "./converse.js";
@@ -56,7 +57,7 @@ export const MATE_CHANNEL_COPY = {
 export const MATE_FAILURE_COPY = {
     stopped: "This reply was stopped before it finished, from another window or by a newer message. Nothing it proposed was kept. Send your message again if you still need an answer.",
     ended: "Your sign-in or this conversation ended while the lead was answering. Nothing it proposed was kept. Sign in again or start a new chat, then send your message again.",
-    tooLong: "The reply took too long and was stopped. Nothing it proposed was kept. Send your message again, or ask for less at once.",
+    tooLong: mateTimeoutNotice(false),
     secretRead: "Something the lead read looked like a password or key, so it stopped before sending it anywhere. Nothing was kept. Remove the password or key from that task or note, then ask again.",
     secretReply: "The lead's reply contained something that looked like a password or key, so it was thrown away. Nothing was kept. Ask again, without asking for a password or key.",
     paused: "An earlier reply stopped before its cost was known, so chat is paused. This message wasn't answered. Confirm that earlier reply on the Chat page, then send again.",
@@ -65,7 +66,7 @@ export const MATE_FAILURE_COPY = {
     unreadable: "The chat provider sent back an answer that couldn't be read, so it was thrown away. Nothing was kept. Send your message again.",
     signIn: "The chat provider couldn't answer; its sign-in may have expired. Nothing was kept. Sign in to it again on this computer, then send your message again.",
     refused: "The chat provider turned the request down. Nothing was kept or charged. Try again in a minute; if it keeps happening, check the provider in Settings → Lead.",
-    tooLongUnknownCost: "The reply took too long and was stopped, and its cost isn't known yet, so chat is paused. Nothing it proposed was kept. Confirm the cost on the Chat page to turn chat back on.",
+    tooLongUnknownCost: mateTimeoutNotice(false, true),
     lostUnknownCost: "The chat provider stopped responding partway through, and the cost isn't known, so chat is paused. Nothing it proposed was kept. Confirm the cost on the Chat page to turn chat back on.",
     unreadableUnknownCost: "The chat provider sent back an answer that couldn't be read, and its cost isn't known, so chat is paused. Nothing it proposed was kept. Confirm the cost on the Chat page to turn chat back on.",
     empty: "The lead sent back an empty answer. Nothing was kept. Send your message again.",
@@ -74,7 +75,8 @@ export const MATE_FAILURE_COPY = {
 /** A failed turn's saved reason as plain words, for a surface that reads the turn back later (a restart, a delivery retry). */
 export function mateFailureText(reason) {
     switch (reason) {
-        case "timeout": return MATE_FAILURE_COPY.tooLong;
+        case "timeout":
+        case "crashed": return MATE_FAILURE_COPY.tooLong;
         case "malformed-reply": return MATE_FAILURE_COPY.unreadable;
         case "secret-refused": return MATE_FAILURE_COPY.secretReply;
         case "latched": return MATE_FAILURE_COPY.paused;
@@ -84,6 +86,16 @@ export function mateFailureText(reason) {
         default: return "The lead's reply didn't finish. Nothing it proposed was kept. Send your message again.";
     }
 }
+/** How long a provider that ignored its abort at the turn's deadline is waited for before the turn ends without it.
+ * Its process group was already killed at the deadline; this only bounds the wait for the transport to say so. */
+export const MATE_ABORT_GRACE_MS = 5_000;
+const LATE = Symbol("late");
+/** The work's own result, or LATE once `ms` passes: the turn's clock, not the work, decides when the person hears back. */
+function settleBy(work, ms) {
+    let timer;
+    const late = new Promise(resolve => { timer = setTimeout(() => resolve(LATE), Math.max(0, ms)); });
+    return Promise.race([work, late]).finally(() => clearTimeout(timer));
+}
 const READ_TOOLS = new Set(["get_brief", "get_project_context", "get_actions", "get_action_status", "get_skills", "get_acceptance_evidence", "recap", "list_repos", "list_tasks", "get_task", "get_result", "get_result_images", "get_controls", "get_agents", "get_project_knowledge", "get_task_conversation", "get_diff", "get_check_log", "get_project_tools", "get_flows", "get_flow_insights", "list_decisions", "get_decision", "queue"]);
 /** The last messages of the thread as provider-neutral history, newest kept first until the byte cap. */
 export function historyFor(store, thread, queuedMessageId) {
@@ -291,6 +303,20 @@ export async function runMateTurn(input) {
         store.dropMateAsk(turnId);
         return { ok: false, turn: turnId, failed, message, unknownSpend };
     };
+    /** The turn stopped at its deadline: the notice is saved in the thread with whatever its completed tool calls proposed, in
+     * the same write that ends the turn, so a refresh, another device or a restart shows the same outcome. */
+    const timedOut = (unknownSpend) => {
+        now = clock();
+        const message = mateTimeoutNotice(proposals > 0, unknownSpend);
+        const saved = store.finalizeMateTurn(turnId, started.generation, { state: "failed", settledMicrousd: settled, unknownSpend, tokensIn, tokensOut, failureReason: "timeout", keepProposals: true, message: { text: message, activity: activitySummary(reads, proposals, steps) } }, now);
+        store.dropMateAsk(turnId);
+        if (!saved)
+            return { ok: false, turn: turnId, failed: "superseded", message: MATE_FAILURE_COPY.stopped, unknownSpend: false };
+        return { ok: false, turn: turnId, failed: "timeout", message, unknownSpend, saved: true };
+    };
+    const deadlineLeft = () => TURN_WALL_CLOCK_MS - (clock().getTime() - turnStartedAt);
+    /** The channel's standing, bounded by the turn's deadline: a lookup that never answers cannot hold the turn open. */
+    const revalidated = async () => input.revalidate === undefined ? { ok: true } : settleBy(input.revalidate(), deadlineLeft() + MATE_ABORT_GRACE_MS);
     /** The turn's own row, re-read: still running under our generation, or someone ended it under us. */
     const stillOurs = () => {
         const row = store.getMateTurn(turnId);
@@ -301,6 +327,8 @@ export async function runMateTurn(input) {
     const guard = (channel) => {
         if (!stillOurs())
             return { ok: false, turn: turnId, failed: "superseded", message: MATE_FAILURE_COPY.stopped, unknownSpend: false };
+        if (channel === LATE)
+            return timedOut(false);
         if (!channel.ok)
             return fail("revoked", MATE_CHANNEL_COPY[channel.reason] ?? MATE_CHANNEL_COPY["access-changed"], false);
         const standing = reproveApprover(store, who);
@@ -328,13 +356,13 @@ export async function runMateTurn(input) {
         return claim;
     };
     while (steps < maxSteps) {
-        const blocked = guard(input.revalidate === undefined ? { ok: true } : await input.revalidate());
+        const blocked = guard(await revalidated());
         if (blocked !== null)
             return blocked;
         now = clock();
         const remainingMs = TURN_WALL_CLOCK_MS - (now.getTime() - turnStartedAt);
         if (remainingMs <= 0)
-            return fail("timeout", MATE_FAILURE_COPY.tooLong, false);
+            return timedOut(false);
         const request = direct ? composeDirect(input.key) : composeSubscription();
         // Tool results join the outbound body: scanned again before every dispatch.
         const outbound = typeof request === "string" ? request : request.body;
@@ -354,39 +382,34 @@ export async function runMateTurn(input) {
         progress({ kind: "step", turn: turnId, step: steps });
         const requestBytes = Buffer.byteLength(outbound, "utf8");
         let result;
+        // The turn owns its deadline (lead-stall, release check 2438): at the deadline the request is aborted, which ends a
+        // harness's whole process group, and a provider that still has not settled MATE_ABORT_GRACE_MS later is left behind.
+        // Whatever it says after that is never read; the turn has already ended with its notice.
+        const controller = new AbortController();
+        const abortAt = setTimeout(() => controller.abort(), remainingMs);
+        const settle = (work) => settleBy(work, remainingMs + MATE_ABORT_GRACE_MS)
+            .then(value => value === LATE || controller.signal.aborted ? { ok: false, problem: "timeout" } : value)
+            .finally(() => clearTimeout(abortAt));
         if (direct) {
-            const controller = new AbortController();
-            const timer = setTimeout(() => controller.abort(), remainingMs);
-            try {
-                result = await performMateRequest(request, directProvider, controller.signal, fetcher);
-            }
-            catch {
-                result = { ok: false, problem: "network" };
-            }
-            finally {
-                clearTimeout(timer);
-            }
+            result = await settle(performMateRequest(request, directProvider, controller.signal, fetcher)
+                .catch(() => ({ ok: false, problem: "network" })));
         }
         else {
             const runner = input.subscriptionRunner ?? performSubscriptionMateRequest;
-            try {
-                result = await runner({
-                    provider: subscriptionProvider,
-                    model: config.model,
-                    system: MATE_CONTRACT,
-                    dataDocument: document,
-                    history,
-                    tools: MATE_TOOL_SCHEMAS,
-                    timeoutMs: remainingMs,
-                    // The reply as it is written; text that looks like a secret is
-                    // never shown (the finished reply is scanned again before saving).
-                    ...(input.onProgress === undefined ? {} : { onText: (text) => { if (scanForSecrets(text).length === 0)
-                            progress({ kind: "text", turn: turnId, step: steps, text }); } }),
-                });
-            }
-            catch {
-                result = { ok: false, problem: "provider-error" };
-            }
+            result = await settle((async () => runner({
+                provider: subscriptionProvider,
+                model: config.model,
+                system: MATE_CONTRACT,
+                dataDocument: document,
+                history,
+                tools: MATE_TOOL_SCHEMAS,
+                timeoutMs: remainingMs,
+                signal: controller.signal,
+                // The reply as it is written; text that looks like a secret is
+                // never shown (the finished reply is scanned again before saving).
+                ...(input.onProgress === undefined ? {} : { onText: (text) => { if (!controller.signal.aborted && scanForSecrets(text).length === 0)
+                        progress({ kind: "text", turn: turnId, step: steps, text }); } }),
+            }))().catch(() => ({ ok: false, problem: "provider-error" })));
         }
         now = clock();
         const finishStep = (outcome) => store.finalizeChatTurn(step.id, stepStarted.generation, outcome, now);
@@ -400,7 +423,9 @@ export async function runMateTurn(input) {
                         : result.problem === "malformed-reply"
                             ? MATE_FAILURE_COPY.unreadable
                             : MATE_FAILURE_COPY.signIn;
-                return fail(result.problem === "timeout" ? "timeout" : result.problem === "malformed-reply" ? "malformed-reply" : "provider-error", message, false);
+                if (result.problem === "timeout")
+                    return timedOut(false);
+                return fail(result.problem === "malformed-reply" ? "malformed-reply" : "provider-error", message, false);
             }
             if (result.problem.startsWith("status-")) {
                 // The provider ANSWERED with an error: nothing billed for this step.
@@ -409,7 +434,7 @@ export async function runMateTurn(input) {
             }
             if (result.problem === "timeout") {
                 finishStep({ state: "failed", failureReason: "timeout", settledMicrousd: null, unknownSpend: true });
-                return fail("timeout", MATE_FAILURE_COPY.tooLongUnknownCost, true);
+                return timedOut(true);
             }
             if (result.problem === "network") {
                 finishStep({ state: "failed", failureReason: "provider-error", settledMicrousd: null, unknownSpend: true });
@@ -437,7 +462,7 @@ export async function runMateTurn(input) {
         // After the wait (finding 5): the row may have been failed under us by
         // a revocation or the sweep — then nothing the model said runs; and the
         // approver must still stand before any tool runs as them.
-        const changed = guard(input.revalidate === undefined ? { ok: true } : await input.revalidate());
+        const changed = guard(await revalidated());
         if (changed !== null)
             return changed;
         if (answer.calls.length === 0) {
@@ -470,7 +495,7 @@ export async function runMateTurn(input) {
         history.push({ role: "assistant", text: answer.text, calls: answer.calls });
         for (const [index, call] of answer.calls.entries()) {
             if (index > 0) {
-                const changed = guard(input.revalidate === undefined ? { ok: true } : await input.revalidate());
+                const changed = guard(await revalidated());
                 if (changed !== null)
                     return changed;
             }

package/dist/never-index.d.ts

@@ -0,0 +1,3 @@
+export declare const NEVER_INDEX = ".metadata_never_index";
+/** Put the marker in `dir` (an existing folder). False when it couldn't be written. */
+export declare function markNeverIndex(dir: string): boolean;

package/dist/never-index.js

@@ -0,0 +1,21 @@
+/**
+ * Spotlight leaves Toolroll's churn alone: a `.metadata_never_index` file in a folder tells macOS not to index it or
+ * what is inside. Toolroll puts one in the folders it fills and empties all day — the checkouts folder and each
+ * project's folder in it (never inside a checkout, where a build's `git add -A` would commit it), shared dependency
+ * installs, staged runtimes and test temp roots. Measured Oct 4: fseventsd at 15 GB with 107k test temp folders.
+ *
+ * A marker that can't be written is only noted: it never decides whether anything is removed.
+ */
+import { writeFileSync } from "node:fs";
+import { join } from "node:path";
+export const NEVER_INDEX = ".metadata_never_index";
+/** Put the marker in `dir` (an existing folder). False when it couldn't be written. */
+export function markNeverIndex(dir) {
+    try {
+        writeFileSync(join(dir, NEVER_INDEX), "", { flag: "a" });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}