toolroll 0.9.61 → 0.9.62

package/dist/operate.js

@@ -19,9 +19,11 @@ import { matchesOutsideCheckpoint } from "./ledger-chain.js";
 import { CLEANUP_CHOICES, bytesWords, cleanupWords, diskBytes, parseCleanup, storageReport } from "./storage.js";
 import { removeStaleTestTemp, tempRoots, testTempFolders } from "./test-temp.js";
 import { storageSweepSupervisor } from "./storage-sweep-process.js";
-import { dailyStorageSweep, lastSweep, nextSweepAt, saveSweep, storageSweepOff as storageSweepOffNow, sweepDetails, sweepWords as storageSweepWords } from "./storage-sweep.js";
+import { idleStorageSweep, sweepSchedule, sweepScheduleWords } from "./storage-sweep-schedule.js";
+import { lastSweep, saveSweep, sweepDetails, sweepWords as storageSweepWords } from "./storage-sweep.js";
 import { removeShared, sharedDepsRoot, sharedUse, unusedShared } from "./shared-deps.js";
 import { cleanLandedBacklog, gitOf, landedBacklog, reconcileLanded, BACKLOG_DAYS } from "./landed-cleanup.js";
+import { RemoteMains } from "./remote-main.js";
 import { checkoutPlan, cleanCheckouts, discardCheckout, finishedCheckouts, slimKeptCheckouts, whyWords } from "./checkout-cleanup.js";
 import { closeOutCheckouts, closeOutRuns, stoppedWords } from "./run-closeout.js";
 import { MIN_DAYS, RETENTION_KINDS, countWords, dailyRetention, isRetentionKind, lastSweepAt, parsePeriod, periodLabel, periodWords, retentionPlan, sweepWords } from "./retention.js";
@@ -182,6 +184,7 @@ import { createInterface } from "node:readline";
 import { propose, approve, addApprover, authenticateAccount, authenticateApprover as passwordApprover, describeScope, approvalOf, hashToken as hashApproverToken, fileAndSealUnderMode, modeFilingCoverage, acceptanceLinesToInput, parseAcceptanceCriteria, splitAcceptanceRubric, rubricIsPlaceholder, isCommitSha } from "./scope.js";
 import { CHAT_APPROVE_ALL, presetTerms, modeTermsJson, modeDigestOf, modeTermsFromJson, modeWords, MODE_MAX_DAYS } from "./modes.js";
 import { WorktreePool } from "./worktree.js";
+import { baseStandingWords, freshBaseFor, taskBaseOf } from "./task-base.js";
 import { requestTaskStop, resumeTaskStop, taskControlOf } from "./task-control.js";
 import { worktreeAdoptionNotice } from "./worktree-notices.js";
 import { workIndexPage, workIndexTask, WorkIndexCursorError } from "./work-index.js";
@@ -1052,6 +1055,19 @@ function telegramConversation(context, options = {}) {
         phoneOrigin: () => phoneOrigin(process.env, dirname(context.databaseFile), { serverOrigin: options.serverOrigin ?? null }),
     };
 }
+/** The attempt's history says where it started when that is news: moved to current main, or kept on an older one. */
+function noteBaseStanding(store, runId, standing, main, now) {
+    if (standing == null)
+        return;
+    const commits = (count) => `${count} commit${count === 1 ? "" : "s"}`;
+    if (standing.moved !== null) {
+        store.addRunNote(runId, "Toolroll", `Started from current ${main} (${standing.main.slice(0, 8)}). The branch had no commits or changes of its own and was ${commits(standing.moved.behind)} behind at ${standing.moved.from.slice(0, 8)}.`, now);
+    }
+    else if (standing.kept !== null && standing.behind > 0) {
+        const why = standing.kept === "has commits" ? "it has commits of its own" : standing.kept === "has changes" ? "it has uncommitted changes" : "its checkout is not on the task branch";
+        store.addRunNote(runId, "Toolroll", `Based on an older ${main}: ${standing.head.slice(0, 8)} is ${commits(standing.behind)} behind. It was not moved because ${why}.`, now);
+    }
+}
 /** A revision's verified start: its source build's sealed head, while the revision brief still binds that head and scope. */
 function revisionSourceHead(store, evidenceRoot, taskRef, revisionOf) {
     const source = store.revisionSourceOf(taskRef);
@@ -2728,6 +2744,8 @@ async function tickCommand(flags, context) {
                 // A plan branch from an earlier plan (its checkout removed by storage retention) is reused, as its kept checkout was.
                 reuseBranch: true,
                 reclaim: { evidenceRoot: context.evidenceRoot },
+                // Each plan starts from current main unless it revises earlier work, which keeps that work's head.
+                ...freshBaseFor(store, id, planBranch, base),
             });
             if (!planLeased.ok) {
                 release(store, lease, clock());
@@ -2751,6 +2769,7 @@ async function tickCommand(flags, context) {
                 now: clock(),
                 ...(planStamp === null ? {} : { route: planStamp }),
             });
+            noteBaseStanding(store, planRunId, planLeased.base, base, clock());
             // The source is RECORDED on the attempt before the brief is even
             // composed: the exact bytes the planner reads, sealed as evidence,
             // and the filed scope's digest stamped as what this run was proved
@@ -3054,6 +3073,7 @@ async function tickCommand(flags, context) {
                 continue;
             }
         }
+        // An existing branch with no commits of its own starts from current main (a new one already does).
         const leased = await worktrees.lease({
             repo,
             branch,
@@ -3062,6 +3082,7 @@ async function tickCommand(flags, context) {
             now: clock(),
             ...(exists.code === 0 ? {} : { base: buildBase }),
             reclaim: { evidenceRoot: context.evidenceRoot },
+            ...(exists.code === 0 ? freshBaseFor(store, id, branch, base) : {}),
         });
         if (!leased.ok) {
             // The task is fine; this machine's pool is not. Hand the claim back so
@@ -3122,6 +3143,7 @@ async function tickCommand(flags, context) {
             dispatched.push({ id, outcome: "skipped", reason: "admission-refused", detail: error instanceof Error ? error.message : String(error) });
             continue;
         }
+        noteBaseStanding(store, runId, leased.base, base, clock());
         if (leased.resumedFromRun !== undefined) {
             store.addRunNote(runId, "Toolroll", `Recovered the ${leased.recoveryKind === "completed" ? "completed source draft" : "work-in-progress draft"} from interrupted attempt #${leased.resumedFromRun}. This fresh attempt is reviewing and verifying it; the safety patch is retained.`, clock());
         }
@@ -3448,10 +3470,15 @@ async function reconcileCommand(flags, context) {
     // Landed work (landed-cleanup.ts): finish teardowns a crash cut short, then mark newly landed results complete (a
     // ledger entry says why) and remove their clean checkouts and local build and plan branches.
     let landed = { completed: [], steps: [] };
+    // Completion trusts only the recorded remote's main, fetched by this process into a private folder it removes after.
+    const remotes = new RemoteMains(store, context.gitRunner, context.evidenceRoot);
     try {
-        landed = await reconcileLanded(store, worktrees, gitOf(context.gitRunner), repo, context.evidenceRoot, clock);
+        landed = await reconcileLanded(store, worktrees, gitOf(context.gitRunner), remotes, repo, context.evidenceRoot, clock);
     }
     catch { /* the next pass tries again */ }
+    finally {
+        remotes.close();
+    }
     const landedGone = landed.steps.filter(one => one.outcome === "removed");
     // Checkout cleanup (Settings → Storage): finished work's clean checkouts go as the setting says (by default when
     // the task is complete or cancelled); their branches stay. Each removal is in the ledger.
@@ -3469,15 +3496,19 @@ async function reconcileCommand(flags, context) {
         retention = null; /* the next pass tries again */
     }
     const retained = retention === null ? [] : retention.counts.filter(one => one.count > 0);
-    // The daily storage sweep (storage-sweep.ts): stale test temp folders, orphans Toolroll left running, finished
+    // The storage sweep (storage-sweep.ts): stale test temp folders, orphans Toolroll left running, finished
     // checkouts, extra staged runtimes and dependency installs unused for a week; saved for Settings → Storage.
+    // Only the long-lived service (its watch passes `sweepOwner`) starts one, once due and while nothing is running or
+    // waiting (storage-sweep-schedule.ts). A one-shot reconcile would exit and lose the claimed sweep, so it leaves it.
     // Launch only: report a result here only if it already completed. Later results save independently.
     let storageSwept = null;
-    try {
-        storageSwept = dailyStorageSweep(store, { databaseFile: context.databaseFile, pool: worktrees, tempRoots: context.tempRoots ?? tempRoots(), ...(context.sweepOwner === undefined ? {} : { owner: context.sweepOwner }) }, clock);
-    }
-    catch {
-        storageSwept = null; /* the next pass tries again */
+    if (context.sweepOwner !== undefined) {
+        try {
+            storageSwept = idleStorageSweep(store, { databaseFile: context.databaseFile, pool: worktrees, tempRoots: context.tempRoots ?? tempRoots(), owner: context.sweepOwner }, clock);
+        }
+        catch {
+            storageSwept = null; /* the next pass tries again */
+        }
     }
     const swept = storageSwept === null ? [] : storageSwept.parts.filter(one => one.count > 0);
     const nothing = retained.length === 0 &&
@@ -6023,7 +6054,8 @@ async function runWatchLoop(args) {
     if (!Number.isSafeInteger(reconcileEveryMs) || reconcileEveryMs < 1 || reconcileEveryMs > 2_147_483_647) {
         throw new Error("--reconcile-every must be an integer from 1 to 2147483647 milliseconds");
     }
-    const incarnation = randomUUID();
+    // The owner carries lifetime without changing the lease schema. Bounded watches cannot host automatic sweeps.
+    const incarnation = `${runFor === null ? "toolroll-service:" : ""}${randomUUID()}`;
     const lease = acquireWatchLeaseAuthed(store, { runner, token, repo, owner: incarnation, ttlMs: WATCH_LEASE_MS }, new Date());
     if (!lease.ok) {
         return {
@@ -6158,7 +6190,9 @@ async function runWatchLoop(args) {
         },
         run: async () => {
             const maintenanceLines = [];
-            const maintenanceContext = { ...quietContext, sweepOwner, write: line => maintenanceLines.push(line) };
+            const maintenanceContext = { ...quietContext, ...(runFor === null ? { sweepOwner } : {}), write: line => maintenanceLines.push(line) };
+            if (runFor !== null)
+                delete maintenanceContext.sweepOwner;
             const code = await reconcileCommand(passFlags(), maintenanceContext);
             if (code !== EXIT.ok)
                 throw new Error(maintenanceLines.join(" "));
@@ -7212,6 +7246,9 @@ async function upCommand(flags, context) {
     }
     const loopFlagsFor = (repo) => {
         const copy = new Map();
+        // A bounded `up` must not advertise its child watches as an unbounded sweep service either.
+        if (forGiven !== undefined)
+            copy.set("for", forGiven);
         copy.set("runner", runnerName);
         copy.set("token", runnerToken);
         copy.set("repo", repo);
@@ -9054,6 +9091,7 @@ function showTask(positional, context) {
     const shared = listed === null ? null : { headline: listed.status.label, sentence: listed.status.detail };
     const primaryAction = listed === null ? work?.primaryAction ?? null : listed.primaryAction;
     const steeringLive = store.steeringLiveBuild(ref.id, now) !== null;
+    const base = taskBaseOf(store, id);
     const detail = {
         task,
         work: work === null || listed === null ? work : { ...work, status: { ...work.status, label: listed.status.label, detail: listed.status.detail, tone: listed.status.tone }, primaryAction },
@@ -9069,6 +9107,8 @@ function showTask(positional, context) {
         scope,
         approval: approvalOf(scope),
         route: taskRouteView(routed, readiness),
+        // Fresh base: the commit this task's work starts from, and how far current main has moved past it.
+        base,
         runs: runs.map(one => ({ ...one, route: store.runRoute(one.id) })),
         deliverable: ref.deliverable,
         report: readVerifiedReport(store, context.evidenceRoot, ref.id),
@@ -9125,6 +9165,7 @@ function showTask(positional, context) {
                 ]
                 : [`  report: ${detail.report.problem} (run ${detail.report.run})`]),
         ...pullRequestLines(detail.pullRequest),
+        ...(base === null ? [] : [`  base: ${baseStandingWords(base)}`]),
         ...(detail.blockedBy.length > 0 ? [`  waits for ${detail.blockedBy.join(", ")}`] : []),
         ...(detail.position === null
             ? []
@@ -11165,15 +11206,15 @@ async function storageCommand(positional, flags, context) {
     const sweepFacts = () => {
         const last = lastSweep(store);
         const automatic = last?.source === "automatic" ? last : lastSweep(store, "automatic");
-        return { last, lastAutomatic: automatic, next: nextSweepAt(store) };
+        return { last, lastAutomatic: automatic, schedule: sweepSchedule(store, context.clock()) };
     };
     const sweepLines = (facts) => {
         const when = (at) => new Date(at).toLocaleString("en-US", { month: "short", day: "numeric", hour: "numeric", minute: "2-digit" });
         const one = facts.last;
-        const head = one === null ? (facts.next === null && storageSweepOffNow() ? "Automatic sweep: off." : "Automatic sweep: not run yet; it runs once a day.")
+        const head = one === null ? "Not swept yet."
             : `Last swept ${when(one.at)}${one.source === "manual" ? ` by ${one.actor}` : " automatically"}: ${storageSweepWords(one.parts)}`;
         const auto = one !== null && one.source === "manual" && facts.lastAutomatic !== null ? [`Last automatic sweep ${when(facts.lastAutomatic.at)}: ${storageSweepWords(facts.lastAutomatic.parts)}`] : [];
-        return [head, ...auto, ...(one === null ? [] : sweepDetails(one.parts).slice(0, 8).map(line => `  ${line}`))];
+        return [head, ...auto, `Automatic sweep: ${sweepScheduleWords(facts.schedule, when)}`, ...(one === null ? [] : sweepDetails(one.parts).slice(0, 8).map(line => `  ${line}`))];
     };
     if (action === undefined) {
         const plan = await checkoutPlan(store, pool, context.clock(), { manual: true });
@@ -11289,6 +11330,16 @@ async function storageCommand(positional, flags, context) {
  * checkouts and local branches go; so do Toolroll's own branches no task uses whose work landed. A preview changes
  * nothing; --yes takes an instance operator, records every teardown first, then carries it out. */
 async function landedCommand(yes, operator, refused, pool, context) {
+    // Completion trusts only the recorded remote's main, fetched by this process into a private folder it removes after.
+    const remotes = new RemoteMains(context.store, context.gitRunner, context.evidenceRoot);
+    try {
+        return await landedCommandWith(remotes, yes, operator, refused, pool, context);
+    }
+    finally {
+        remotes.close();
+    }
+}
+async function landedCommandWith(remotes, yes, operator, refused, pool, context) {
     const command = "storage clean --landed";
     const git = gitOf(context.gitRunner);
     const plurals = (count, one, many = `${one}s`) => `${count} ${count === 1 ? one : many}`;
@@ -11300,7 +11351,7 @@ async function landedCommand(yes, operator, refused, pool, context) {
         branches: plan.results.reduce((sum, one) => sum + one.targets.filter(target => target.kind === "branch").length, 0) + plan.branches.length,
     });
     if (!yes) {
-        const plan = await landedBacklog(context.store, git, context.evidenceRoot, context.clock());
+        const plan = await landedBacklog(context.store, git, remotes, context.evidenceRoot, context.clock());
         const n = counts(plan);
         const anything = n.results + plan.branches.length + plan.pending > 0;
         return succeed(context.write, context.json, command, { preview: true, cutoff: plan.cutoff, results: plan.results, branches: plan.branches, kept: plan.kept, pending: plan.pending }, () => [
@@ -11315,8 +11366,8 @@ async function landedCommand(yes, operator, refused, pool, context) {
     const actor = await operator();
     if (actor === null)
         return refused("cleans up landed work");
-    const plan = await landedBacklog(context.store, git, context.evidenceRoot, context.clock());
-    const done = await cleanLandedBacklog(context.store, pool, git, context.evidenceRoot, context.clock, plan, actor);
+    const plan = await landedBacklog(context.store, git, remotes, context.evidenceRoot, context.clock());
+    const done = await cleanLandedBacklog(context.store, pool, git, remotes, context.evidenceRoot, context.clock, plan, actor);
     const gone = done.steps.filter(one => one.outcome === "removed" || one.outcome === "already gone");
     const stays = done.steps.filter(one => one.outcome === "waits" || one.outcome === "kept");
     return succeed(context.write, context.json, command, { completed: done.completed, steps: done.steps, refused: done.refused, kept: plan.kept }, () => [

package/dist/project-admission.d.ts

@@ -24,11 +24,16 @@ export type AdmissionFailure = {
     reason: "unavailable" | "not-git" | "locked" | "registry" | "abandoned" | "failed";
     message: string;
 };
+/** `remote`: the origin URL this add recorded as the project's trusted remote (null: none), and why one wasn't. */
 export type Admitted = {
     ok: true;
     repo: string;
     name: string;
     added: boolean;
+    remote: {
+        url: string | null;
+        why: string | null;
+    };
 };
 export type Released = {
     ok: true;
@@ -43,12 +48,7 @@ export declare function proveProjectRoot(path: string, exec?: ProjectExec): Prom
     ok: true;
     repo: string;
 } | AdmissionFailure>;
-/**
- * Admit one project. Idempotent: adding a saved project again changes
- * nothing and writes no ledger row. The registry is written first, under
- * its lock; the project row and its ledger row then commit together, so a
- * retry after a failure finishes the job and records it exactly once.
- */
+/** Registry first, then the project and its audit records in one transaction. Re-adds preserve trust. */
 export declare function admitProject(store: Store, input: {
     /** null: a console with no machine registry (a bare `serve`) keeps only the project list. */
     registryFile: string | null;
@@ -56,6 +56,10 @@ export declare function admitProject(store: Store, input: {
     actor: AdmissionActor;
     now: Date;
     exec?: ProjectExec;
+    /** Only the authorized CLI add opts in; console/open/onboarding never discover a remote. */
+    captureOrigin?: boolean;
+    /** Explicit value from the owner/instance-operator CLI boundary. */
+    remoteUrl?: string;
 }): Promise<Admitted | AdmissionFailure>;
 /**
  * Remove one project from the lists and the builder. Its tasks, results and

package/dist/project-admission.js

@@ -15,7 +15,12 @@ import { userInfo } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { run } from "./exec.js";
 import { canonicalProject, projectName, sameRepo } from "./project.js";
+import { remoteUrlProblem } from "./remote-main.js";
 import { addRepos, loadProjectRegistry, removeRepos, updateRepos } from "./repos.js";
+const ADMISSION_GIT = {
+    envAllowlist: ["PATH", "HOME", "TMPDIR", "LANG", "LC_ALL"],
+    env: { GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", GIT_NO_REPLACE_OBJECTS: "1" },
+};
 export const PROJECT_ADDED = "project added";
 export const PROJECT_REMOVED = "project removed";
 /** The checkout root a folder belongs to, canonical; never a shell. */
@@ -26,40 +31,57 @@ export async function proveProjectRoot(path, exec = run) {
     const canonical = canonicalProject(path);
     if (canonical === null)
         return { ok: false, reason: "unavailable", message: `${path} isn't a folder on this computer.` };
-    const top = await exec("git", ["rev-parse", "--show-toplevel"], { cwd: canonical, timeoutMs: 5_000 });
+    const top = await exec("git", ["rev-parse", "--show-toplevel"], { cwd: canonical, timeoutMs: 5_000, ...ADMISSION_GIT });
     const repo = top.code === 0 ? canonicalProject(top.stdout.trim()) : null;
     if (repo === null)
         return { ok: false, reason: "not-git", message: `${path} isn't a Git repository. Run git init there first, or choose a folder inside one.` };
     return { ok: true, repo };
 }
-/**
- * Admit one project. Idempotent: adding a saved project again changes
- * nothing and writes no ledger row. The registry is written first, under
- * its lock; the project row and its ledger row then commit together, so a
- * retry after a failure finishes the job and records it exactly once.
- */
+/** Read only on first CLI admission; never rediscover trust from an existing project's config. */
+async function originOf(repo, exec) {
+    const read = await exec("git", ["config", "--local", "--no-includes", "--get", "remote.origin.url"], { cwd: repo, timeoutMs: 5_000, ...ADMISSION_GIT });
+    const url = read.code === 0 ? read.stdout.trim() : "";
+    if (url === "")
+        return { url: null, why: "it has no origin remote" };
+    const problem = remoteUrlProblem(url);
+    return problem === null ? { url, why: null } : { url: null, why: problem };
+}
+/** Registry first, then the project and its audit records in one transaction. Re-adds preserve trust. */
 export async function admitProject(store, input) {
     const proved = await proveProjectRoot(input.path, input.exec);
     if (!proved.ok)
         return proved;
     const { repo } = proved;
+    if (input.remoteUrl !== undefined && (input.actor.origin === "console" || remoteUrlProblem(input.remoteUrl) !== null)) {
+        return { ok: false, reason: "failed", message: "Only an owner or instance operator can record a network remote with repos add --remote <url>. Use an HTTPS or SSH URL without credentials." };
+    }
+    const before = input.registryFile === null ? null : await loadProjectRegistry(input.registryFile);
+    const known = store.projectAdmissionKnown(repo) || (before !== null && !("error" in before) && before.repos.includes(repo));
+    const discovered = !known && input.captureOrigin === true && input.actor.origin !== "console"
+        ? await originOf(repo, input.exec ?? run) : null;
+    let remote = { url: store.projectRemote(repo), why: null };
     let registryHad = true;
     if (input.registryFile !== null) {
-        const before = await loadProjectRegistry(input.registryFile);
         const enrolled = await updateRepos(input.registryFile, repos => addRepos(repos, [repo]));
         if (!enrolled.ok)
             return { ok: false, reason: enrolled.reason, message: `${projectName(repo)} wasn't added: ${enrolled.message}` };
-        registryHad = !("error" in before) && before.repos.includes(repo);
+        registryHad = before !== null && !("error" in before) && before.repos.includes(repo);
     }
     const added = store.transact(() => {
         const rowHad = store.listProjects().some(one => one.path === repo);
-        store.upsertProject(repo, projectName(repo), input.now);
+        const previous = store.projectRemote(repo);
+        const first = !known && !store.projectAdmissionKnown(repo);
+        remote = input.remoteUrl !== undefined ? { url: input.remoteUrl, why: null }
+            : first && discovered !== null ? discovered : { url: previous, why: previous === null ? "no remote recorded; use repos add --remote <url>" : null };
+        store.upsertProject(repo, projectName(repo), input.now, { remoteUrl: remote.url });
+        if (input.remoteUrl !== undefined)
+            store.recordProjectRemote(input.actor.label, repo, previous, input.remoteUrl, input.now);
         if (rowHad && registryHad)
             return false;
         store.recordAction({ at: input.now.toISOString(), actor: input.actor.label, repo, taskId: null, runId: null, action: PROJECT_ADDED, outcome: "added", source: "access", detail: `from ${input.actor.origin}` });
         return true;
     });
-    return { ok: true, repo, name: projectName(repo), added };
+    return { ok: true, repo, name: projectName(repo), added, remote };
 }
 /**
  * Remove one project from the lists and the builder. Its tasks, results and

package/dist/project-delete-ui.d.ts

@@ -8,6 +8,7 @@ import { type Html } from "./html.js";
 import { type ProjectHoldings } from "./project-delete.js";
 export declare const PROJECT_DELETE_CSS: string;
 export type ProjectSettingsView = {
+    remoteUrl?: string | null;
     repo: string;
     name: string;
     holdings: ProjectHoldings;

package/dist/project-delete-ui.js

@@ -57,7 +57,10 @@ const note = (notice) => notice.problem ? html `<p class="problem" role="alert">
 /** The project's page: its path, what Toolroll holds for it, and (for an instance operator) Delete project. */
 export function projectSettingsHtml(view, notice) {
     const held = html `<p>Toolroll holds ${holdingsWords(view.holdings)} for <strong>${view.name}</strong>.</p>`;
-    const head = html `${note(notice)}<p class="path">${view.repo}</p>${held}${buildsHtml(view)}${accessHtml(view)}`;
+    const remote = html `<section class="build-access recorded-remote" aria-labelledby="recorded-remote-title"><h2 id="recorded-remote-title">Recorded remote</h2>${view.remoteUrl
+        ? html `<p class="path">${view.remoteUrl}</p>`
+        : html `<p>No remote recorded. Landed work waits for your review.</p>`}<details><summary>Change remote</summary><p>An owner or instance operator can run:</p><p class="path">toolroll repos add &lt;project&gt; --remote &lt;url&gt;</p></details></section>`;
+    const head = html `${note(notice)}<p class="path">${view.repo}</p>${held}${remote}${buildsHtml(view)}${accessHtml(view)}`;
     if (!view.canDelete)
         return html `<section class="project-settings">${head}<p class="meta">An instance operator can delete a project.</p></section>`;
     const body = view.running.length > 0

package/dist/remote-main.d.ts

@@ -0,0 +1,57 @@
+import { type ExecResult } from "./exec.js";
+import type { Store } from "./store.js";
+import type { Runner } from "./worktree.js";
+/** The only credential helper https may use: the system keychain on macOS; elsewhere none, so a private https remote
+ * fails closed instead of asking. */
+export declare const CREDENTIAL_HELPER: string;
+export type RemoteUrl = {
+    kind: "network";
+    url: string;
+};
+/**
+ * A URL Toolroll may fetch remote main from: https or ssh (either form). Local paths, file URLs and loopback hosts
+ * (this machine is where builds run) are always refused. Remote helpers (ext::, fd:: and the like), plain http and
+ * git:// (no authentication), relative paths, embedded passwords and anything odd are refused.
+ */
+export declare function parseRemoteUrl(url: string): RemoteUrl | {
+    why: string;
+};
+/** Why a recorded URL may not be used as the trusted remote; null when it may. */
+export declare function remoteUrlProblem(url: string): string | null;
+export type RemoteGit = (args: readonly string[]) => Promise<ExecResult>;
+export type RemoteMain = {
+    url: string;
+    /** The commit the recorded remote's main is at, as fetched just now. */
+    main: string;
+    /** Git in the private directory, hardened as above. */
+    git: RemoteGit;
+    /** Bring this exact commit (with its history) from the project by fetch, for a content comparison. */
+    bring: (repo: string, head: string) => Promise<boolean>;
+};
+export type RemoteMainRead = {
+    ok: true;
+    remote: RemoteMain;
+} | {
+    ok: false;
+    why: string;
+};
+/**
+ * One pass's reads of recorded remotes. Every `read` fetches again (the pre-teardown re-check is never older than
+ * the teardown); a project's private directory lasts until `close`, so a fetch after the first only brings what
+ * changed. Close removes every directory.
+ */
+export declare class RemoteMains {
+    private readonly store;
+    private readonly runner;
+    private readonly scratch;
+    private readonly helper;
+    private readonly dirs;
+    constructor(store: Store, runner: Runner | undefined, scratch: string, helper?: string);
+    private exec;
+    /** Nothing but fetched objects decides: a private directory that grew alternates, grafts or shallow state is
+     * not trusted. */
+    private clean;
+    private dirFor;
+    read(repo: string): Promise<RemoteMainRead>;
+    close(): void;
+}

package/dist/remote-main.js

@@ -0,0 +1,179 @@
+/**
+ * The project's main as its recorded remote has it, read by Toolroll's own process. Automatic completion of landed
+ * work (landed-cleanup.ts) trusts only this: a build shares the project's .git, so it can move the local main or
+ * repoint origin in .git/config, and neither may complete its own task.
+ *
+ * The remote URL is the one captured on first admission or explicitly supplied by the owner (project-admission.ts), never the repository's
+ * config. Each read fetches that URL's main into a fresh, private Git directory under Toolroll's evidence folder (which
+ * the agent fence denies to builds), with no system or global config, no includes or URL rewriting, no replace
+ * objects, no hooks, no ext or file transport and only an explicit credential helper. The shared repository's objects, refs,
+ * replace refs, grafts and shallow state are never read: commits enter only by fetch. A content comparison brings the
+ * result's exact recorded commit in by fetch too; git checks every object against its hash.
+ *
+ * Every doubt fails closed: no recorded remote, a URL that isn't allowed, a failed fetch or a remote without main all
+ * read as "not proven", and the task stays for a person.
+ */
+import { mkdirSync, mkdtempSync, rmSync, existsSync } from "node:fs";
+import { isAbsolute, join } from "node:path";
+import { run } from "./exec.js";
+/** The ref a fetched remote main is kept under, inside the private directory only. */
+const REMOTE_MAIN = "refs/toolroll/remote-main";
+const SHA = /^[0-9a-f]{40}$/;
+const FETCH_TIMEOUT_MS = 120_000;
+/** What the private directory's git may see of this process's environment: nothing that names a repository, an
+ * object store or config. The fixed settings below go on top. */
+const ENV_ALLOWLIST = ["PATH", "HOME", "TMPDIR", "LANG", "LC_ALL", "SSH_AUTH_SOCK", "HTTPS_PROXY", "https_proxy", "NO_PROXY", "no_proxy"];
+const ENV = {
+    GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", GIT_NO_REPLACE_OBJECTS: "1", GIT_TERMINAL_PROMPT: "0",
+    GIT_ASKPASS: "", SSH_ASKPASS: "", GIT_SSH_COMMAND: "ssh -o BatchMode=yes",
+};
+/** The only credential helper https may use: the system keychain on macOS; elsewhere none, so a private https remote
+ * fails closed instead of asking. */
+export const CREDENTIAL_HELPER = process.platform === "darwin" ? "osxkeychain" : "";
+/** Settings for every command in the private directory. The directory's own config is ours and empty. File transport
+ * is off for the recorded remote; only the result fetch from the registered project path turns it on. */
+function hardened(helper, file = "never") {
+    return ["-c", "core.hooksPath=/dev/null", "-c", "protocol.allow=never", "-c", "protocol.https.allow=always", "-c", "protocol.ssh.allow=always",
+        "-c", `protocol.file.allow=${file}`, "-c", "protocol.ext.allow=never", "-c", "credential.helper=", ...(helper === "" ? [] : ["-c", `credential.helper=${helper}`]),
+        "-c", "gc.auto=0", "-c", "maintenance.auto=false", "-c", "fetch.recurseSubmodules=false", "-c", "core.fsmonitor=false"];
+}
+/**
+ * A URL Toolroll may fetch remote main from: https or ssh (either form). Local paths, file URLs and loopback hosts
+ * (this machine is where builds run) are always refused. Remote helpers (ext::, fd:: and the like), plain http and
+ * git:// (no authentication), relative paths, embedded passwords and anything odd are refused.
+ */
+export function parseRemoteUrl(url) {
+    const refused = { why: "its remote URL isn't one Toolroll fetches from" };
+    if (url === "" || url.length > 2048 || /[\x00-\x20\x7f]/.test(url) || url.startsWith("-") || url.includes("\\"))
+        return refused;
+    if (/^[A-Za-z][A-Za-z0-9+.-]*::/.test(url) || /^file:/i.test(url) || /^[A-Za-z]:[\\/]/.test(url))
+        return refused;
+    const scheme = /^([A-Za-z][A-Za-z0-9+.-]*):\/\//.exec(url)?.[1]?.toLowerCase();
+    if (scheme !== undefined) {
+        if (scheme !== "https" && scheme !== "ssh")
+            return refused;
+        try {
+            const parsed = new URL(url);
+            if (parsed.password !== "" || (scheme === "https" && parsed.username !== "") || parsed.search !== "" || parsed.hash !== "" || parsed.hostname === "" || loopback(parsed.hostname))
+                return refused;
+        }
+        catch {
+            return refused;
+        }
+        return { kind: "network", url };
+    }
+    // scp-like ssh: [user@]host:path, with no slash before the first colon.
+    const colon = url.indexOf(":");
+    const host = /^(?:[A-Za-z0-9._-]+@)?([A-Za-z0-9.-]+)$/.exec(url.slice(0, colon))?.[1];
+    if (colon > 0 && colon < url.length - 1 && host !== undefined && !loopback(host))
+        return { kind: "network", url };
+    return refused;
+}
+/** localhost (and its subdomains), any IPv4 spelling of 127.0.0.0/8 or 0.0.0.0 (inet_aton accepts 127.1, 0x7f.1 and
+ * the like), and ::1, :: or an IPv4-mapped loopback. */
+function loopback(hostname) {
+    const host = hostname.toLowerCase().replace(/^\[(.*)\]$/, "$1").replace(/\.+$/, "");
+    if (host === "localhost" || host.endsWith(".localhost"))
+        return true;
+    const parts = host.split(".");
+    if (parts.length <= 4 && parts.every(part => /^(0x[0-9a-f]*|[0-9]+)$/.test(part))) {
+        const values = parts.map(part => part.startsWith("0x") ? parseInt(part.slice(2) || "0", 16) : /^0[0-7]+$/.test(part) ? parseInt(part, 8) : Number(part));
+        const first = values.length === 1 ? Math.floor(values[0] / 2 ** 24) : values[0];
+        return first === 127 || values.every(value => value === 0);
+    }
+    if (!host.includes(":"))
+        return false;
+    try {
+        const v6 = new URL(`http://[${host}]/`).hostname;
+        return v6 === "[::1]" || v6 === "[::]" || /^\[::ffff:(7f[0-9a-f]{2}:|0:)/.test(v6);
+    }
+    catch {
+        return true;
+    }
+}
+/** Why a recorded URL may not be used as the trusted remote; null when it may. */
+export function remoteUrlProblem(url) {
+    const parsed = parseRemoteUrl(url);
+    return "why" in parsed ? parsed.why : null;
+}
+/**
+ * One pass's reads of recorded remotes. Every `read` fetches again (the pre-teardown re-check is never older than
+ * the teardown); a project's private directory lasts until `close`, so a fetch after the first only brings what
+ * changed. Close removes every directory.
+ */
+export class RemoteMains {
+    store;
+    runner;
+    scratch;
+    helper;
+    dirs = new Map();
+    constructor(store, runner = run, scratch, helper = CREDENTIAL_HELPER) {
+        this.store = store;
+        this.runner = runner;
+        this.scratch = scratch;
+        this.helper = helper;
+    }
+    exec(dir, args, file = "never") {
+        return this.runner("git", ["--git-dir", dir, ...hardened(this.helper, file), ...args], { cwd: dir, envAllowlist: ENV_ALLOWLIST, env: ENV, timeoutMs: FETCH_TIMEOUT_MS, maxBuffer: 512 * 1024 * 1024 });
+    }
+    /** Nothing but fetched objects decides: a private directory that grew alternates, grafts or shallow state is
+     * not trusted. */
+    clean(dir) {
+        return !["shallow", join("info", "grafts"), join("objects", "info", "alternates"), join("objects", "info", "http-alternates")].some(name => existsSync(join(dir, name)));
+    }
+    async dirFor(repo) {
+        const known = this.dirs.get(repo);
+        if (known !== undefined && existsSync(known))
+            return known;
+        try {
+            mkdirSync(this.scratch, { recursive: true });
+            const dir = mkdtempSync(join(this.scratch, ".remote-main-"));
+            this.dirs.set(repo, dir);
+            const made = await this.runner("git", ["init", "--quiet", "--bare", "--template=", dir], { cwd: dir, envAllowlist: ENV_ALLOWLIST, env: ENV, timeoutMs: 30_000 });
+            return made.code === 0 ? dir : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    async read(repo) {
+        const url = this.store.projectRemote(repo);
+        if (url === null)
+            return { ok: false, why: "the project has no recorded remote" };
+        const problem = remoteUrlProblem(url);
+        if (problem !== null)
+            return { ok: false, why: problem };
+        const dir = await this.dirFor(repo);
+        if (dir === null)
+            return { ok: false, why: "Toolroll couldn't read the project's remote main" };
+        const fetched = await this.exec(dir, ["fetch", "--quiet", "--no-tags", "--no-write-fetch-head", "--", url, `+refs/heads/main:${REMOTE_MAIN}`]);
+        if (fetched.code !== 0 || !this.clean(dir))
+            return { ok: false, why: "Toolroll couldn't read the project's remote main" };
+        const resolved = await this.exec(dir, ["rev-parse", "--verify", "--quiet", `${REMOTE_MAIN}^{commit}`]);
+        const main = resolved.stdout.trim();
+        if (resolved.code !== 0 || !SHA.test(main))
+            return { ok: false, why: "Toolroll couldn't read the project's remote main" };
+        const git = args => this.exec(dir, args);
+        const bring = async (from, head) => {
+            if (!SHA.test(head))
+                return false;
+            if ((await git(["cat-file", "-e", `${head}^{commit}`])).code === 0)
+                return true;
+            // The one local fetch: from the project path Toolroll registered (never a URL), for this exact hash-checked commit.
+            if (!isAbsolute(from))
+                return false;
+            const got = await this.exec(dir, ["fetch", "--quiet", "--no-tags", "--no-write-fetch-head", "--", from, `+${head}:refs/toolroll/results/${head}`], "always");
+            return got.code === 0 && this.clean(dir) && (await git(["cat-file", "-e", `${head}^{commit}`])).code === 0;
+        };
+        return { ok: true, remote: { url, main, git, bring } };
+    }
+    close() {
+        for (const dir of this.dirs.values()) {
+            try {
+                rmSync(dir, { recursive: true, force: true });
+            }
+            catch { /* the next pass makes its own */ }
+        }
+        this.dirs.clear();
+    }
+}

package/dist/server/render-tasks.d.ts

@@ -3,6 +3,7 @@ import { type Html } from "../html.js";
 import { type RunActivity } from "../activity-line.js";
 import { type AgentChoice } from "../agentconfig.js";
 import { type AssignmentSnapshot } from "../assignment.js";
+import { type TaskBaseView } from "../task-base.js";
 import { type BrowserTaskView } from "../browser-workspace.js";
 import { type FormView } from "../contracts/console-api.js";
 import { type DispatchDiagnosis } from "../dispatch.js";
@@ -588,6 +589,8 @@ export declare function taskBodyParts(data: {
     /** The pull request opened through Complete (its state, link, CI and merge), or the offer to open one for a
      * result already marked complete; null when neither applies. */
     pullRequest?: TaskPullRequest | null;
+    /** Fresh base: the commit this task's work starts from, and how far current main has moved past it. */
+    base?: TaskBaseView | null;
     /** The task's whole family (the original and its revisions) and every attempt across it, for the thread. */
     family?: {
         root: {