toolroll 0.9.41 → 0.9.43

package/dist/toolroll-update.js

@@ -37,6 +37,7 @@ import { installLaunchdService, launchdPlist, stopLaunchdService, writeFileDurab
 import { NAME } from "./names.js";
 import { isNewer, REGISTRY } from "./releases.js";
 import { markNeverIndex } from "./never-index.js";
+import { readRuntimeUpdateJournal, RUNTIME_PHASES, RUNTIME_UPDATE_STEPS, stagedStartedAt, updaterStartingOf } from "./contracts/update-journal.js";
 /** Loaded on first use (as backup.ts and store.ts do), so modules that only import this one (the console,
  * and tests that load it in a browser-like environment) never need `node:sqlite` itself. */
 function sqlite() {
@@ -48,7 +49,7 @@ export const PROVENANCE_ISSUER = "https://token.actions.githubusercontent.com";
 /** How long a watch's `toolroll up` may take to exit once launchd stops it (controller-supervisor's shutdown). */
 const UP_EXIT_MS = 45_000;
 /** The steps a person sees, in order. */
-export const UPDATE_STEPS = ["verifying", "draining", "backing-up", "rehearsing", "switching", "restarting", "health"];
+export const UPDATE_STEPS = RUNTIME_UPDATE_STEPS;
 export const STEP_WORDS = {
     verifying: "Verify the package", draining: "Let running work finish", "backing-up": "Stop and back up",
     rehearsing: "Rehearse the migration", switching: "Switch to the new version", restarting: "Restart", health: "Health check",
@@ -58,7 +59,7 @@ export const KEEP_RUNTIMES = 2;
 /** The one-off launchd job the console starts the updater as. */
 export const UPDATE_JOB_LABEL = "com.toolroll.update";
 const TERMINAL = ["complete", "restored", "refused", "cancelled"];
-export const runtimeUpdateTerminal = (phase) => TERMINAL.includes(phase);
+export const runtimeUpdateTerminal = (phase) => TERMINAL.some(known => known === phase);
 const journalFile = (stateDir) => join(stateDir, "toolroll-update.json");
 /** The last completed update, kept apart from the journal: what `--rollback` returns from. */
 const lastUpdateFile = (stateDir) => join(stateDir, "toolroll-update.last.json");
@@ -73,8 +74,10 @@ function markStarting(j, state, now) {
 }
 function updaterStarting(j, now) {
     try {
-        const mark = JSON.parse(readFileSync(startingFile(j), "utf8"));
-        const age = now.getTime() - Date.parse(mark.at ?? "");
+        const mark = updaterStartingOf(JSON.parse(readFileSync(startingFile(j), "utf8")));
+        if (mark === null)
+            return false;
+        const age = now.getTime() - mark.at;
         return mark.id === j.id && age >= 0 && age < UPDATER_START_MS;
     }
     catch {
@@ -93,14 +96,17 @@ export function readRuntimeUpdate(stateDir, file = journalFile(stateDir)) {
     const stat = lstatSync(file);
     if (!stat.isFile() || stat.isSymbolicLink())
         throw Error("The saved update record is not a regular file. Nothing was changed.");
-    const j = JSON.parse(readFileSync(file, "utf8"));
+    const read = readRuntimeUpdateJournal(JSON.parse(readFileSync(file, "utf8")));
+    if (!read.ok)
+        throw Error(`The saved update record is invalid. Preserve it and its backups; nothing was changed. (${read.issues.map(issue => issue.line).join("; ")})`);
+    const j = read.value;
     const real = (path) => { try {
         return realpathSync(path);
     }
     catch {
         return resolve(path);
     } };
-    if (j.version !== 1 || !/^[a-f0-9-]{36}$/.test(j.id) || typeof j.stateDir !== "string" || real(j.stateDir) !== real(stateDir) || !isAbsolute(j.stageDir ?? "") || real(dirname(j.stageDir)) !== real(join(stateDir, "staged-upgrades")))
+    if (!/^[a-f0-9-]{36}$/.test(j.id) || typeof j.stateDir !== "string" || real(j.stateDir) !== real(stateDir) || !isAbsolute(j.stageDir ?? "") || real(dirname(j.stageDir)) !== real(join(stateDir, "staged-upgrades")))
         throw Error("The saved update record is invalid. Preserve it and its backups; nothing was changed.");
     return j;
 }
@@ -121,13 +127,16 @@ function keepCompletedUpdate(stateDir) {
         return;
     durableJson(lastUpdateFile(stateDir), saved);
 }
+/** A null phase saves progress without changing the saved phase, including one a newer release wrote. */
 function save(j, phase, detail, now) {
-    if (j.phase !== phase)
-        j.steps.push({ phase, at: now.toISOString() });
-    j.phase = phase;
+    if (phase !== null) {
+        if (j.phase !== phase)
+            j.steps.push({ phase, at: now.toISOString() });
+        j.phase = phase;
+    }
     j.detail = detail;
     j.updatedAt = now.toISOString();
-    if (runtimeUpdateTerminal(phase))
+    if (runtimeUpdateTerminal(j.phase))
         j.finishedAt = now.toISOString();
     durableJson(join(j.stageDir, "update.json"), j);
     durableJson(journalFile(j.stateDir), j);
@@ -518,7 +527,7 @@ async function stopServices(j, system, main, watches) {
     }
     if (watching.length > 0)
         j.watches = watching;
-    save(j, j.phase, j.detail, system.now());
+    save(j, null, j.detail, system.now());
     for (const unit of [main, ...loadedWatches(j, watches)])
         if (unit)
             await system.stopService(unit);
@@ -781,7 +790,7 @@ export function requestRuntimeUpdateCancel(stateDir, now = new Date(), seams = {
     if (!j || runtimeUpdateTerminal(j.phase))
         return "No update is in progress.";
     const tooLate = (at) => `The update to ${at.to.version} is past the point it can be cancelled (${at.phase}); it will finish or restore on its own.`;
-    if (!CANCELLABLE.includes(j.phase))
+    if (!CANCELLABLE.some(phase => phase === j.phase))
         return tooLate(j);
     // No updater is running to see the request: cancel here, so the admission pause does not outlive it.
     const lock = sqliteLock(join(j.stageDir, "worker.sqlite"));
@@ -797,7 +806,7 @@ export function requestRuntimeUpdateCancel(stateDir, now = new Date(), seams = {
             return "No update is in progress.";
         if (held.id !== j.id)
             return "A different update was saved while cancelling. Nothing was cancelled.";
-        if (!CANCELLABLE.includes(held.phase))
+        if (!CANCELLABLE.some(phase => phase === held.phase))
             return tooLate(held);
         durableJson(cancelFile(held), { id: held.id, action: "cancel" });
         try {
@@ -840,7 +849,7 @@ async function driveRuntimeUpdate(j, system) {
     }
     // The lock now says an updater is here; the starting mark has done its job.
     rmSync(startingFile(j), { force: true });
-    const at = (phase) => UPDATE_STEPS.indexOf(phase);
+    const at = (phase) => UPDATE_STEPS.findIndex(step => step === phase);
     const step = (phase, detail) => { save(j, phase, detail, system.now()); system.checkpoint?.(phase); };
     const noun = j.kind === "update" ? "update" : "rollback";
     const verb = j.kind === "update" ? `${j.from.version} → ${j.to.version}` : `${j.from.version} → ${j.to.version} (back)`;
@@ -1137,12 +1146,13 @@ async function drain(j, system) {
  * the rollback-* records are not this updater's to remove. */
 export function pruneRuntimes(stateDir, keep) {
     const root = join(stateDir, "staged-upgrades");
+    // A partial or older stage file still says when it started; one that is not JSON (or is null) falls back to the mtime.
     const started = (dir) => { try {
-        return String(JSON.parse(readFileSync(join(dir, "update.json"), "utf8")).startedAt ?? "");
+        const at = stagedStartedAt(JSON.parse(readFileSync(join(dir, "update.json"), "utf8")));
+        if (at !== null)
+            return at;
     }
-    catch {
-        return statSync(dir).mtime.toISOString();
-    } };
+    catch { /* below */ } return statSync(dir).mtime.toISOString(); };
     const releases = readdirSync(root, { withFileTypes: true }).filter(entry => entry.isDirectory() && entry.name.startsWith("release-"))
         .map(entry => join(root, entry.name)).sort((a, b) => started(b).localeCompare(started(a)));
     const kept = new Set(releases.filter(dir => keep.some(dist => dist !== "" && dist.startsWith(dir + sep))));

package/dist/verification-evidence.js

@@ -8,6 +8,8 @@ import { adjudicate } from "./proof.js";
 import { parseReviewContext, reviewContextCustodyProblem } from "./review-context.js";
 import { readVerifiedArtifact, storeEvidence, scanForSecrets, redactSecretLines } from "./evidence.js";
 import { readVerificationReceipt } from "./contracts/verification-receipt.js";
+import { LEGACY_GATE_SOURCE, readVerificationView } from "./contracts/verification-view.js";
+import { readCandidateEndpoints, savedInventoryPaths } from "./contracts/diff-stat.js";
 import { liveQuickCommand, quickVerifyKey, runCheckLevel } from "./check-levels.js";
 export const VERIFICATION_RECEIPT_CAPTURE = "machine verification receipt v1";
 export const REVIEW_GATE_NAME = "REVIEW-VERIFICATION.json";
@@ -97,7 +99,10 @@ export function verificationEvidence(store, root, runId) {
                 const original = verificationEvidence(store, root, reused.run);
                 if (!original.ok || !original.bytes || original.digest !== reused.digest)
                     return fail("The original passing gate no longer verifies.");
-                const previous = JSON.parse(original.bytes);
+                const previousRead = readVerificationView(original.bytes);
+                if (!previousRead.ok)
+                    return fail("The original passing gate no longer verifies.");
+                const previous = previousRead.value;
                 const originalLog = store.getArtifact(previous.log.artifactId);
                 if (previous.head !== source.headRevision || !("exitCode" in previous.result) || previous.result.exitCode !== 0 || JSON.stringify(previous.command) !== JSON.stringify(command) ||
                     JSON.stringify(previous.result) !== JSON.stringify(receipt.result) || originalLog?.sha256 !== log.sha256 ||
@@ -123,13 +128,17 @@ export function verificationEvidence(store, root, runId) {
         const readStat = readVerifiedArtifact(root, stat[0]);
         if (!readStat.ok)
             return fail("Legacy candidate inventory no longer verifies.");
-        let endpoints;
+        let inventory;
         try {
-            endpoints = JSON.parse(readStat.content.toString("utf8"));
+            inventory = JSON.parse(readStat.content.toString("utf8"));
         }
         catch {
             return fail("Legacy candidate inventory is unreadable.");
         }
+        const endpointsRead = readCandidateEndpoints(inventory);
+        if (!endpointsRead.ok)
+            return fail("Legacy verification candidate endpoints do not match.");
+        const endpoints = endpointsRead.value;
         if (!source.headRevision || endpoints.head !== source.headRevision || endpoints.base !== source.baseRevision || endpoints.filesTruncated !== false)
             return fail("Legacy verification candidate endpoints do not match.");
         const text = read.content.toString("utf8");
@@ -139,7 +148,8 @@ export function verificationEvidence(store, root, runId) {
             return fail("The original log lacks an unambiguous machine gate receipt; historical output was not reconstructed.");
         if (verified && exitCode !== 0)
             return fail("The passing machine verdict disagrees with the original failed check.");
-        receipt = { version: 1, source: "legacy machine log header", run: runId, head: source.headRevision, base: source.baseRevision, scopeDigest: source.scopeDigest, command, result: { configured: true, ran: true, exitCode }, log: binding(log), candidate: binding(stat[0]) };
+        const view = { version: 1, source: LEGACY_GATE_SOURCE, run: runId, head: source.headRevision, base: source.baseRevision, scopeDigest: source.scopeDigest, command, result: { configured: true, ran: true, exitCode }, log: binding(log), candidate: binding(stat[0]) };
+        receipt = view;
     }
     // The view preserves shortened/redacted status and does not claim the omitted
     // output exists. Its fingerprint is re-proved before every turn and ingestion.
@@ -173,8 +183,10 @@ export function failedVerificationEvidence(store, root, runId) {
         return { kind: "unavailable", problem: verified.problem };
     if (verified.bytes === null)
         return { kind: "none" };
-    const receipt = JSON.parse(verified.bytes);
-    const result = receipt.result;
+    const view = readVerificationView(verified.bytes);
+    if (!view.ok)
+        return { kind: "unavailable", problem: "The verification receipt cannot be read." };
+    const receipt = view.value, result = receipt.result;
     if (!result.configured || (result.ran ? result.exitCode === 0 :
         result.failure !== "timed-out" && result.failure !== "retry-timed-out"))
         return { kind: "none" };
@@ -223,15 +235,15 @@ export function assessmentFromSavedEvidence(store, root, runId) {
     if (!gate.ok || gate.bytes === null)
         return null;
     try {
-        const inventory = JSON.parse(stat), receipt = JSON.parse(gate.bytes);
+        const view = readVerificationView(gate.bytes);
         const base = source.branch ? store.firstBuilderBase(source.taskRef, source.branch) ?? source.baseRevision : source.baseRevision;
-        if (inventory.schema !== 1 || inventory.head !== source.headRevision || inventory.base !== base || inventory.filesTruncated !== false ||
-            !Array.isArray(inventory.files) || inventory.fileCount !== inventory.files.length || !inventory.files.every((one) => typeof one?.path === "string") ||
-            new Set(inventory.files.map((one) => one.path)).size !== inventory.files.length)
+        const paths = savedInventoryPaths(stat, source.headRevision, base);
+        if (!view.ok || paths === null)
             return null;
+        const receipt = view.value;
         return adjudicate({ directAssessment: true, proofArtifactPresent: false, proofParse: null,
             handoffPresent: true, terminalDiffPresent: true, terminalDiffCaptureStatus: "ok",
-            diffStat: { captured: true, truncated: false, paths: new Set(inventory.files.map((one) => one.path)) },
+            diffStat: { captured: true, truncated: false, paths },
             verifyCommand: receipt.result, verificationCommand: receipt.command.command, screenshots: [],
             approvedCriteria: scope.acceptance, reviewContext: parsedContext.inventory.coverage });
     }
@@ -255,7 +267,10 @@ export function reuseObservationVerification(store, root, runId, now) {
     const original = verificationEvidence(store, root, brief.sourceRun);
     if (!original.ok || !original.bytes || original.digest !== brief.gateDigest)
         throw Error("The original passing gate is unavailable or changed.");
-    const receipt = JSON.parse(original.bytes), log = store.getArtifact(receipt.log.artifactId);
+    const view = readVerificationView(original.bytes);
+    if (!view.ok)
+        throw Error("The original passing gate is unavailable or changed.");
+    const receipt = view.value, log = store.getArtifact(receipt.log.artifactId);
     if (!log || receipt.head !== brief.head || !("ran" in receipt.result) || receipt.result.ran !== true || receipt.result.exitCode !== 0)
         throw Error("The source gate did not pass this candidate.");
     const read = readVerifiedArtifact(root, log);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolroll",
-  "version": "0.9.41",
+  "version": "0.9.43",
   "description": "A control plane for unattended coding agents — queue tasks, walk away, come back to pull requests. Agents build in leased worktrees, never touch your default branch, and interrupt you only for decisions that need a human.",
   "directories": {
     "doc": "docs"