toolroll 0.9.60 → 0.9.61

package/dist/invoke.js

@@ -16,19 +16,21 @@
  * (`adapterFor`), and only builder, planner, reviewer, and scout import
  * `invokeAgent`.
  */
-import { adapterFor, auditOf } from "./provider.js";
+import { adapterFor, auditOf, isolationUnsupported } from "./provider.js";
 import { readProviderKey, readAuthModeStrict, PROVIDER_KEY_ENV, OWN_KEY_ENV } from "./keys.js";
 import { classifyTerminal } from "./exhaustion.js";
 import { liftAuthPause } from "./provider-auth.js";
 import { attestProvider } from "./attest.js";
-import { run as runCommand, runOwnerTag } from "./exec.js";
+import { run as runCommand, runOwnerTag, streamsInput } from "./exec.js";
 import { currentContainment } from "./containment.js";
 import { witnessedRunner } from "./process-custody.js";
 import { underStopWatch } from "./task-control.js";
 import { childDatabaseEnv, isolatedChildDatabase, removeChildDatabase as removeAgentDatabase } from "./child-database.js";
 import { noToolsArgs, prepareRunTools } from "./project-tools.js";
-import { realpathSync } from "node:fs";
-import { agentFence, linuxFenceAvailable, macosFenceAvailable } from "./agent-fence.js";
+import { readFileSync, realpathSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { agentFence, linuxFenceAvailable, macosFenceAvailable, taskBoundary } from "./agent-fence.js";
 import { billingOf, claudeBillingFrom, seenBilling } from "./spend.js";
 /** The claude binary name — kept for the legacy quota rows and tests that
  * describe history; new code carries a resolved AgentSpec instead. */
@@ -36,6 +38,46 @@ export const PROVIDER_BINARY = "claude";
 /** "Within seconds": how soon a silent failed run must end for its stderr to
  * be read for the sign-in signal. */
 const AUTH_EARLY_EXIT_MS = 30_000;
+// Fixed names only: neither setting values nor arbitrary JSON keys belong in
+// diagnostics. The CLI's existing login stays where it is; no config is copied.
+const CLAUDE_AUTH_ENV = [
+    "ANTHROPIC_API_KEY", "ANTHROPIC_BASE_URL", "ANTHROPIC_AUTH_TOKEN",
+    "CLAUDE_CODE_USE_BEDROCK", "CLAUDE_CODE_SKIP_BEDROCK_AUTH", "ANTHROPIC_BEDROCK_BASE_URL",
+    "AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN", "AWS_PROFILE",
+    "AWS_REGION", "AWS_DEFAULT_REGION", "AWS_BEARER_TOKEN_BEDROCK", "ANTHROPIC_SMALL_FAST_MODEL_AWS_REGION",
+    "CLAUDE_CODE_USE_VERTEX", "CLAUDE_CODE_SKIP_VERTEX_AUTH", "ANTHROPIC_VERTEX_BASE_URL",
+    "ANTHROPIC_VERTEX_PROJECT_ID", "CLOUD_ML_REGION", "GOOGLE_APPLICATION_CREDENTIALS", "GOOGLE_CLOUD_PROJECT",
+];
+/** A value-only preflight: a settings-dependent login cannot survive empty setting sources. */
+function claudeSettingsAuthProblem(configDir) {
+    let text;
+    try {
+        text = readFileSync(join(configDir, "settings.json"), "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        return "Can't read your Claude settings.json to check sign-in. Restore access to that file and try again. Isolated builds do not load it.";
+    }
+    let settings;
+    try {
+        settings = JSON.parse(text);
+    }
+    catch {
+        return "Your Claude settings.json is not valid JSON. Fix that file and try again. Isolated builds do not load it, so Toolroll must check whether sign-in depends on it first.";
+    }
+    if (settings === null || typeof settings !== "object" || Array.isArray(settings)) {
+        return "Your Claude settings.json must contain an object. Fix that file and try again. Isolated builds do not load it.";
+    }
+    const value = settings;
+    const keys = ["apiKeyHelper", "forceLoginMethod"].filter(key => Object.hasOwn(value, key));
+    const env = value["env"];
+    if (env !== null && typeof env === "object" && !Array.isArray(env)) {
+        keys.push(...CLAUDE_AUTH_ENV.filter(key => Object.hasOwn(env, key)).map(key => `env.${key}`));
+    }
+    return keys.length === 0 ? null
+        : `Your Claude settings.json defines sign-in settings: ${keys.join(", ")}. Isolated builds do not load that file. Use a Claude login that works without these settings, or select another build provider in Settings. Toolroll has not changed your login or copied these values.`;
+}
 /**
  * A provider can run the repository's own CLI. In a self-hosting build that
  * must never mean "open the database that launched me": a migration from the
@@ -104,9 +146,15 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
         throw new Error(`run ${runId} already records session ${recordedSessionId} but this invocation neither resumes nor starts under it`);
     }
     const adapter = adapterFor(spec.provider);
-    const { startSessionId: _untrustedStartSessionId, ...invocationWithoutStart } = invocation;
+    const { startSessionId: _untrustedStartSessionId, streamInput: _untrustedStreamInput, ...invocationWithoutStart } = invocation;
+    // Live input (live-input.ts): only Claude's builds, only through a transport that keeps stdin open. The brief is
+    // the session's first stdin message and never rides the argv; every other road keeps its prompt where it was.
+    const liveInput = spec.provider === "claude" && invocation.phase === "build" && options.liveInput !== undefined && streamsInput(options.runner ?? adapter.defaultRunner)
+        ? options.liveInput
+        : null;
     const resolvedInvocation = {
         ...invocationWithoutStart,
+        ...(liveInput === null ? {} : { streamInput: true }),
         model: spec.model,
         resumeSession: requestedResumeSessionId,
         ...(startSessionId === undefined ? {} : { startSessionId }),
@@ -142,7 +190,7 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
     // re-supply survives resolveChildEnv's chat-key strip); in
     // "subscription" mode the key is STRIPPED from the child so the CLI's
     // own login is used — its key is retained, just not handed over.
-    const { runner, clock: _clock, versionProbe: _probe, keyHome, timeoutMs: _hardTimeout, idleTimeoutMs: _idleTimeout, stdin: _callerStdin, accumulateUsage: _accumulateUsage, ...runOptions } = options;
+    const { runner, clock: _clock, versionProbe: _probe, keyHome, timeoutMs: _hardTimeout, idleTimeoutMs: _idleTimeout, stdin: _callerStdin, accumulateUsage: _accumulateUsage, liveInput: _liveInput, ...runOptions } = options;
     // The live setting is read STRICTLY (atomic authority closure): a
     // present mode file that says neither word is a value-shaped refusal
     // before any stamp or process — never the subscription default a
@@ -158,6 +206,11 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
         };
     }
     const authMode = strict.mode;
+    if (spec.provider === "claude" && invocation.phase !== "review") {
+        const problem = claudeSettingsAuthProblem(options.env?.["CLAUDE_CONFIG_DIR"] ?? process.env["CLAUDE_CONFIG_DIR"] ?? join(keyHome ?? homedir(), ".claude"));
+        if (problem !== null)
+            return { kind: "refused", reason: "auth-mode", providerVersion: attested?.version ?? null, diagnostic: problem };
+    }
     const ownKeyEnv = OWN_KEY_ENV[spec.provider];
     const managedKey = authMode === "api-key"
         ? readProviderKey(spec.provider, keyHome) ?? (process.env[PROVIDER_KEY_ENV[spec.provider]] || null)
@@ -239,6 +292,8 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
         store.stampProviderStart(runId, clock(), attested.version);
     else
         store.stampProviderStart(runId, clock());
+    // The brief is the live session's first message, queued before the spawn writes it.
+    liveInput?.begin(invocation.brief);
     const spawn = witnessedRunner(store, runId, clock, runner ?? adapter.defaultRunner);
     let transportAnnouncedSessionId = null;
     let transportSessionConflict = false;
@@ -255,10 +310,16 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
     // The agent fence: Toolroll's own secrets, database and other runs'
     // evidence stay out of reach, whatever the permission mode. A review is
     // already confined to its sealed files.
-    const baseFence = invocation.phase === "review" ? [] : runFence(store, runId, options.keyHome);
+    // A build's fence also holds its task boundary: home configuration and
+    // the repositories beside its own, fresh and resumed alike.
+    const fenceOf = invocation.phase === "review" ? { fence: [], fileTools: [] } : runFence(store, runId, spec.provider, options.keyHome);
+    const baseFence = fenceOf.fence;
     const toolsDir = (spec.provider === "codex" || spec.provider === "openrouter") && baseFence.length > 0 ? tools?.privateDir : undefined;
     const fence = toolsDir === undefined ? baseFence : [...baseFence, realpathSync(toolsDir)];
-    const launchArgv = tools === null ? argv : adapter.argv({ ...resolvedInvocation, toolArgv: tools.argv, fence });
+    // Where the build runs: Claude reads the repository's CLAUDE.md from here.
+    const workspace = invocation.phase === "review" ? null : runOptions.cwd ?? run.worktree ?? null;
+    const buildInvocation = { ...resolvedInvocation, ...(tools === null ? {} : { toolArgv: tools.argv, fence, fileToolFence: fenceOf.fileTools }), ...(workspace === null ? {} : { workspace }) };
+    const launchArgv = tools === null ? argv : adapter.argv(buildInvocation);
     const fenced = fenceLaunch(spec.provider, fence);
     if (invocation.phase !== "review")
         store.recordRunFence(runId, { method: fenced.method, paths: fence.length }, clock());
@@ -302,11 +363,13 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
                     throw new Error("the attempt was stopped before spawn custody completed");
             },
             ...(stdin === undefined ? {} : { stdin }),
+            ...(liveInput === null ? {} : { liveInput }),
             ...(hardTimeoutMs === undefined ? {} : { timeoutMs: hardTimeoutMs }),
             ...(idleTimeoutMs === undefined ? {} : { idleTimeoutMs }),
             ...(defaultTimeoutMs === undefined ? {} : { timeoutMs: defaultTimeoutMs }),
             env: {
                 ...(runOptions.env ?? {}),
+                ...(adapter.env?.(buildInvocation) ?? {}),
                 ...(tools?.env ?? {}),
                 ...(managedKey === null ? {} : { [PROVIDER_KEY_ENV[spec.provider]]: managedKey }),
                 // This key is deliberately last: no caller may point an agent back at
@@ -360,6 +423,12 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
     }
     store.fixRunBilling(runId, authMode === "api-key" ? "api-key" : evidence ?? billingOf(spec.provider, store.handle), new Date());
     const envelope = adapter.parse(result.stdout);
+    // An installed CLI too old for a build's own setup refuses its flags
+    // before it starts: nothing ran, and the run says what to update.
+    const unsupported = result.code !== 0 && envelope.initObserved !== true && invocation.phase !== "review" ? isolationUnsupported(spec.provider, result.stderr) : null;
+    if (unsupported !== null) {
+        return { kind: "refused", reason: "provider-unattested", providerVersion: attested === null ? null : attested.version, diagnostic: unsupported };
+    }
     // The callback is the crash-safe early stamp; the parsed envelope is the
     // authoritative completed-stream account. Stamp it as a fallback for an
     // alternate transport. On fresh runs COALESCE makes callback/parser
@@ -384,11 +453,19 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
                         ? "the provider returned a session id different from the exact identity recorded for resume"
                         : "the provider session id was different from the identity durably recorded when the stream initialized"
                 : null;
+    // A run whose cost could not be read may still have spent up to its cap: it is charged the cap, never nothing, so
+    // the next run's remaining budget stays honest. With no cap it is unmeasured, as a Codex run is, and says so.
+    const unknownCost = envelope.costUnknown === true;
+    const cap = typeof invocation.maxBudgetUsd === "number" && Number.isFinite(invocation.maxBudgetUsd) && invocation.maxBudgetUsd > 0 ? invocation.maxBudgetUsd : null;
+    const costUsd = unknownCost ? cap : envelope.costUsd;
+    const usageJson = unknownCost
+        ? JSON.stringify({ cost_note: cap === null ? "cost unknown, no dollar cap applied: unmeasured" : "cost unknown, charged at the cap", ...usageOf(envelope.usageRaw) })
+        : envelope.usageRaw;
     store.recordUsage(runId, {
         ...(envelope.tokensIn === null ? {} : { tokensIn: envelope.tokensIn + (options.accumulateUsage ? run.tokensIn ?? 0 : 0) }),
         ...(envelope.tokensOut === null ? {} : { tokensOut: envelope.tokensOut + (options.accumulateUsage ? run.tokensOut ?? 0 : 0) }),
-        ...(envelope.costUsd === null ? {} : { costUsd: envelope.costUsd + (options.accumulateUsage ? run.costUsd ?? 0 : 0) }),
-        ...(envelope.usageRaw === null ? {} : { usageJson: envelope.usageRaw }),
+        ...(costUsd === null ? {} : { costUsd: costUsd + (options.accumulateUsage ? run.costUsd ?? 0 : 0) }),
+        ...(usageJson === null ? {} : { usageJson }),
     });
     // How the attempt ended, classified HERE where the structural terminal
     // still exists; a sign-in that no longer works pauses its provider.
@@ -501,7 +578,7 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
             usage: {
                 tokensIn: envelope.tokensIn,
                 tokensOut: envelope.tokensOut,
-                costUsd: envelope.costUsd,
+                costUsd,
             },
             // Gated on the run having NOTHING to show (Codex M5-M8 audit, C-8),
             // where "nothing to show" is STRUCTURAL when the transport can say so
@@ -520,17 +597,32 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
         },
     };
 }
-/** The paths this run's agent may not reach: the state folder around the live database (but not its own worktree) and ~/.toolroll (or its older name). */
-function runFence(store, runId, keyHome) {
+/** The reported usage, when its kept text is whole JSON, to sit beside a cost note. */
+function usageOf(raw) {
+    if (raw === null)
+        return {};
+    try {
+        return { usage: JSON.parse(raw) };
+    }
+    catch {
+        return {};
+    }
+}
+/** The paths this run's agent may not reach: the state folder around the live database (but not its own worktree),
+ * ~/.toolroll (or its older name), and its task boundary; plus what only Claude's file tools refuse. */
+function runFence(store, runId, provider, keyHome) {
     try {
         // A plane always has a database file; an in-memory store (a test) has nothing to fence.
         const databaseFile = store.databaseFile();
         if (databaseFile === null)
-            return [];
-        return agentFence({ databaseFile, worktree: store.getRun(runId)?.worktree ?? null, ...(keyHome === undefined ? {} : { home: keyHome }) });
+            return { fence: [], fileTools: [] };
+        const worktree = store.getRun(runId)?.worktree ?? null;
+        const home = keyHome === undefined ? {} : { home: keyHome };
+        const boundary = worktree === null ? null : taskBoundary({ worktree, provider, ...home });
+        return { fence: agentFence({ databaseFile, worktree, ...home, boundary }), fileTools: boundary?.fileTools ?? [] };
     }
     catch {
-        return [];
+        return { fence: [], fileTools: [] };
     }
 }
 /** How the fence reaches a provider: Codex through its own sandbox profile
@@ -551,10 +643,10 @@ function fenceLaunch(provider, fence) {
 /** One launch's tools, or — when they cannot be prepared — the same isolation with none, never the operator's global servers. */
 function runTools(store, runId, spec, keyHome, clock, readOnly, withheld) {
     try {
-        return prepareRunTools(store, runId, spec.provider, { ...(keyHome === undefined ? {} : { home: keyHome }), now: clock(), includeModel: spec.model === null, ...(readOnly === undefined ? {} : { readOnly }), ...(withheld === undefined ? {} : { withheld }) });
+        return prepareRunTools(store, runId, spec.provider, { ...(keyHome === undefined ? {} : { home: keyHome }), now: clock(), ...(readOnly === undefined ? {} : { readOnly }), ...(withheld === undefined ? {} : { withheld }) });
     }
     catch {
-        return noToolsArgs(spec.provider, spec.model === null);
+        return noToolsArgs(spec.provider);
     }
 }
 /** How Codex says it's signed in (`codex login status`): a ChatGPT sign-in is its plan; a key or Bedrock is a key;

package/dist/landed-cleanup.d.ts

@@ -0,0 +1,157 @@
+import { type ExecResult } from "./exec.js";
+import type { Store } from "./store.js";
+import { type Runner, type WorktreePool } from "./worktree.js";
+/** `storage clean --landed` takes only what has waited at least this long. */
+export declare const BACKLOG_DAYS = 7;
+/** The local branches the one-time pass looks at: Toolroll's build and plan branches, under either name. */
+export declare const BACKLOG_PREFIXES: readonly string[];
+/** The ledger action that closes a teardown. */
+export declare const LANDED_CLEANED_ACTION = "landed work cleaned up";
+/** Reconcile looks at most this many results and finishes at most this many items a pass; the pass by hand has no cap. */
+export declare const AUTO_LOOKS = 20;
+export declare const AUTO_ITEMS = 40;
+export type Git = (cwd: string, args: readonly string[]) => Promise<ExecResult>;
+export declare function gitOf(runner?: Runner): Git;
+export type LandedHow = "merged" | "in-main" | "content-in-main";
+export type LandedProof = {
+    landed: true;
+    how: LandedHow;
+    reason: string;
+} | {
+    landed: false;
+    why: string;
+};
+/** What Toolroll last saw of the result's pull request. */
+export type PullRequestFact = {
+    merged: boolean;
+    headSha: string | null;
+    number: number | null;
+};
+/**
+ * Whether this commit's work landed, read from what Toolroll recorded and the local repository only. Fails closed:
+ * every doubt is "not proven", with the reason in a few words.
+ */
+export declare function landedProof(git: Git, repo: string, head: string | null, pullRequest?: PullRequestFact | null): Promise<LandedProof>;
+export type LandedTarget = {
+    kind: "checkout" | "branch";
+    target: string;
+    expect: string;
+};
+export type LandedKeep = {
+    repo: string;
+    what: string;
+    why: string;
+};
+export type LandedCandidate = {
+    repo: string;
+    taskId: string;
+    rootId: string;
+    runId: number;
+    receipt: string;
+    head: string;
+    finishedAt: string;
+    /** False when it is already complete: only its teardown is left. */
+    completes: boolean;
+    how: LandedHow;
+    reason: string;
+    targets: LandedTarget[];
+    keeps: LandedKeep[];
+};
+/**
+ * Results in a project whose work landed, with what their teardown would remove and what stays. Reads only.
+ * `limit` caps how many results are read against git (reconcile's bound; results read before and unchanged since
+ * don't count); `before` takes only results finished before it (the one-time pass's seven days).
+ */
+export declare function landedResults(store: Store, git: Git, repo: string, root: string, now: Date, options?: {
+    limit?: number;
+    before?: string;
+    memo?: boolean;
+}): Promise<{
+    found: LandedCandidate[];
+    kept: LandedKeep[];
+}>;
+/**
+ * Mark a landed result complete (unless it already is) and record its teardown, in one transaction, bound to the
+ * exact result read: refused when the result changed since. The completion's ledger entry says why. Returns the
+ * teardown's id; a result already taken returns its existing teardown.
+ */
+export declare function recordLandedIntent(store: Store, candidate: LandedCandidate, now: Date, root: string, actor?: string): {
+    ok: true;
+    id: number;
+    completed: boolean;
+} | {
+    ok: false;
+    why: string;
+};
+/** A landed branch no task names: its teardown, on its own. */
+export type LandedBranch = {
+    repo: string;
+    branch: string;
+    oid: string;
+    how: LandedHow;
+    reason: string;
+    checkout: string | null;
+};
+export declare function recordBranchIntent(store: Store, branch: LandedBranch, now: Date, actor: string): number;
+export type LandedStep = {
+    kind: "checkout" | "branch";
+    repo: string;
+    target: string;
+    taskId: string | null;
+    outcome: "removed" | "already gone" | "waits" | "kept";
+    why: string | null;
+};
+/**
+ * Finish what teardowns intended: pending items, oldest first (checkouts before branches). Each is checked again
+ * right before it goes, and recorded right after. Doubt leaves it pending for the next pass; a branch that moved, or
+ * a result that has newer work, is kept for good. `only` limits it to these teardowns.
+ */
+export declare function finishLanded(store: Store, pool: WorktreePool, git: Git, now: () => Date, options?: {
+    repo?: string;
+    limit?: number;
+    only?: ReadonlySet<number>;
+}): Promise<LandedStep[]>;
+/**
+ * Reconcile's part: finish teardowns a crash cut short, then find newly landed results (a bounded few), mark them
+ * complete and tear them down.
+ */
+export declare function reconcileLanded(store: Store, pool: WorktreePool, git: Git, repo: string, root: string, now: () => Date): Promise<{
+    completed: string[];
+    steps: LandedStep[];
+}>;
+export type LandedSummary = {
+    completed: number;
+    checkouts: number;
+    branches: number;
+    /** What a teardown still waits on, and why. */
+    waiting: {
+        target: string;
+        why: string | null;
+    }[];
+};
+/** What landed-work teardowns did so far, and what they still wait on (Settings → Storage). Reads only. */
+export declare function landedSummary(store: Store): LandedSummary;
+export type LandedPlan = {
+    at: string;
+    cutoff: string;
+    results: LandedCandidate[];
+    branches: LandedBranch[];
+    kept: LandedKeep[];
+    /** Items an earlier teardown still has to finish. */
+    pending: number;
+};
+/**
+ * What `storage clean --landed` would do now, across every project: landed results finished at least a week ago,
+ * and Toolroll's own branches (toolroll/, toolroll-plan/, standing-orders/) no task uses whose last commit is at
+ * least a week old and landed in main. Reads only.
+ */
+export declare function landedBacklog(store: Store, git: Git, root: string, now: Date, options?: {
+    repos?: readonly string[];
+}): Promise<LandedPlan>;
+/** Act on a preview: record every teardown first, then carry them out. Refuses nothing it previewed silently: what
+ * changed since is reported as kept. */
+export declare function cleanLandedBacklog(store: Store, pool: WorktreePool, git: Git, root: string, now: () => Date, plan: LandedPlan, actor: string): Promise<{
+    completed: string[];
+    steps: LandedStep[];
+    refused: LandedKeep[];
+}>;