toolroll 0.9.62 → 0.9.65

package/dist/work-index.d.ts

@@ -47,6 +47,8 @@ export type WorkIndexOptions = {
     state?: TaskState;
     leadId?: string;
     root?: string;
+    /** Only these families (by root task id): the sidebar reads its rows' own words this way. */
+    roots?: readonly string[];
 };
 /** How the list is grouped: the Needs you rows by their ask, then building, then the rest. */
 export type WorkIndexGroup = Ask | 'building' | 'rest';
@@ -85,6 +87,33 @@ export declare function workIndexPage(store: Store, now: Date, access: WorkSumma
  * permission-bound and bypasses pagination, never action-time verification. */
 export declare function workIndexTask(store: Store, taskId: string, now: Date, access: WorkSummaryAccess, root?: string): WorkIndexItem | null;
 export declare function workCountsByProject(store: Store, now: Date, access: WorkSummaryAccess): WorkProjectCounts[];
+/** One row per task family the person may see (the Tasks list's own projection: current version, admission, unplaced
+ * work and the ceiling as the list applies them), with what the cockpit's states read (agent-state.ts): its code, whether
+ * it waits on a person, whether a lead took it on, and its live, unfinished and result runs. Every family, no page. */
+export type WorkStateRow = {
+    repo: string | null;
+    rootId: string;
+    code: string;
+    needs: boolean;
+    personNeed: boolean;
+    leadClaim: boolean;
+    liveRun: number | null;
+    unfinished: number | null;
+    resultRun: number | null;
+    /** The Tasks list ranks it as waiting its turn (custody confirmations from another computer included). */
+    waits: boolean;
+    /** What it needs now, as an identity: its code and the question, hold, result or stop it is about. A new one of
+     * these — or a changed plan or approval terms (its digests) — is a new thing to need a person, even on the same task. */
+    version: string;
+    /** When what it needs now began: the newest of its plan's proposal, its question, its hold, its result and its stop
+     * (each fixed once written, so an unrelated edit never moves it). Newer asks are named first. */
+    at: string;
+    /** The agent its ask is about: the live one, or the one whose question or decision it parked on. */
+    askRun: number | null;
+    /** Every task_ref of the family (its versions), for counting each of its live attempts. */
+    members: number[];
+};
+export declare function workStateRows(store: Store, now: Date, access: WorkSummaryAccess): WorkStateRow[];
 /** Families whose headline is Ready for review, newest first: the Tasks
  * list's own rows, so a completed family (root or any revision), a failed
  * check and a superseded version never count. */

package/dist/work-index.js

@@ -5,7 +5,7 @@ import { leadNameOf } from './lead-identity.js';
 import { createHash } from 'node:crypto';
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
-import { readProjectAccess } from './project-access.js';
+import { accountReachesSql, readProjectAccess } from './project-access.js';
 import { pauseOnTaskProviders, providerName, signInReason } from './provider-auth.js';
 import { scopeTermsProblem, stopFactOf } from './store.js';
 import { assignmentChecksForRun } from './assignment.js';
@@ -19,6 +19,7 @@ import { withFollowUps } from './result-follow-ups.js';
 import { LANDED_ACTOR, landedReasonOf } from './result-completion.js';
 import { ASKS, NEED_ASK, NEEDS, askChipOf, failedAttemptSentence, processNeedOf, resultHoldUpSentence } from './needs-you.js';
 import { LEAD_CLAIM_SQL, LEAD_IDLE_MS } from './lead-voice.js';
+import { grantStandsSql } from './flow-unattended.js';
 export const WORK_INDEX_PAGE_LIMIT = 40;
 export const WORK_INDEX_MAX_LIMIT = 100;
 const EMPTY = { all: 0, 'needs-you': 0, running: 0, completed: 0 };
@@ -134,9 +135,10 @@ const PROJECTION = `WITH RECURSIVE admitted AS MATERIALIZED (
       UNION ALL SELECT json_extract(leg.value,'$.provider') FROM json_each(CASE WHEN json_valid(sc.approved_route_json) THEN sc.approved_route_json ELSE '{}' END,'$.legs') leg
         WHERE json_extract(leg.value,'$.phase')='build'))) signed_out,
     (sc.approved_at IS NOT NULL AND sc.approved_by IS NOT NULL AND sc.approved_digest=sc.digest) approved,
-    (sc.approval_basis IS NOT 'mode' OR EXISTS(SELECT 1 FROM operating_mode om JOIN approver signer ON signer.name=om.signed_by
+    ((sc.approval_basis IS NOT 'mode' AND sc.approval_basis IS NOT 'grant') OR (sc.approval_basis='mode' AND EXISTS(SELECT 1 FROM operating_mode om JOIN approver signer ON signer.name=om.signed_by
       WHERE om.repo=c.repo AND om.digest=sc.mode_digest AND om.revoked_at IS NULL AND om.absolute_expiry>$now
-      AND signer.role='approver' AND signer.revoked_at IS NULL)) dispatch_approval,
+      AND signer.role='approver' AND signer.revoked_at IS NULL AND ${accountReachesSql("signer", "c.repo")}))
+      OR (sc.approval_basis='grant' AND ${grantStandsSql("sc.mode_digest", "$now", "c.repo")})) dispatch_approval,
     CASE WHEN sc.task_id IS NULL THEN 0 ELSE so_work_scope_valid(json_object(
       'touches',sc.touches,'acceptance_json',sc.acceptance_json,'budget_microusd',sc.budget_microusd,
       'goal',CASE WHEN typeof(sc.goal)='text' THEN '' ELSE sc.goal END,
@@ -386,7 +388,7 @@ function readWorkIndexPage(store, now, access, options, taskId = null) {
     const scope = cursorScope(access, options, view), cursor = readCursor(options.cursor, scope);
     const filter = view === 'needs-you' ? 'needs=1' : view === 'running' ? 'family_running=1' : view === 'completed' ? "code='complete'" : '1';
     const rows = prepared(store, `${projection}, selected_page AS MATERIALIZED (
-    SELECT * FROM ranked WHERE ${filter} AND ($taskId IS NULL OR root_ref IN (SELECT root_ref FROM members WHERE id=$taskId)) AND ($cursorRoot=0 OR
+    SELECT * FROM ranked WHERE ${filter} AND ($taskId IS NULL OR root_ref IN (SELECT root_ref FROM members WHERE id=$taskId)) AND ($roots IS NULL OR root_id IN (SELECT value FROM json_each($roots))) AND ($cursorRoot=0 OR
       ${ORDER}>$cursorRank OR (${ORDER}=$cursorRank AND (sort_at<$cursorAt OR (sort_at=$cursorAt AND root_ref<$cursorRoot))))
     ORDER BY ${ORDER},sort_at DESC,root_ref DESC LIMIT $limit
   ), page AS (SELECT p.*,COALESCE(p.result_id,(SELECT id FROM run WHERE task_ref=p.ref_id AND finished_at IS NOT NULL AND role IN ('builder','scout') ORDER BY id DESC LIMIT 1)) page_result_id FROM selected_page p), totals AS (SELECT ${TOTALS},${GROUP_TOTALS} FROM ranked), project_totals AS (
@@ -413,7 +415,7 @@ function readWorkIndexPage(store, now, access, options, taskId = null) {
     'agent_ask_run',(SELECT run FROM agent_question WHERE id=page.agent_ask),'agent_ask_text',(SELECT substr(question,1,300) FROM agent_question WHERE id=page.agent_ask),'replaced_by',(SELECT successor FROM task_replacement WHERE task_ref=page.ref_id),
     'completed_by_lead',(SELECT lead FROM task_act WHERE task_ref=page.root_ref AND act='completed' ORDER BY id DESC LIMIT 1),
     'question_task',(SELECT r.external_id FROM decision d JOIN run ON run.id=d.run JOIN task_ref r ON r.id=run.task_ref WHERE d.id=page.question_id)) FROM page`)
-        .all({ ...parameters(now, access, options, custody), $taskId: taskId, $cursorRoot: cursor?.root ?? 0, $cursorRank: cursor?.rank ?? 0, $cursorAt: cursor?.at ?? '', $limit: limit + 1, $recent: new Date(now.getTime() - 86_400_000).toISOString() });
+        .all({ ...parameters(now, access, options, custody), $taskId: taskId, $roots: options.roots === undefined ? null : JSON.stringify(options.roots), $cursorRoot: cursor?.root ?? 0, $cursorRank: cursor?.rank ?? 0, $cursorAt: cursor?.at ?? '', $limit: limit + 1, $recent: new Date(now.getTime() - 86_400_000).toISOString() });
     const selected = rows.slice(1).map(row => JSON.parse(String(row['row_json'])));
     const page = selected.slice(0, limit), last = page.at(-1);
     const nextCursor = selected.length > limit && last !== undefined ? Buffer.from(JSON.stringify({ version: 2, scope,
@@ -440,6 +442,20 @@ export function workCountsByProject(store, now, access) {
         .all({ ...parameters(now, access, {}, custodyReadings(store)), $recent: new Date(now.getTime() - 86_400_000).toISOString() })
         .map(row => ({ repo: s(row, 'repo'), totals: counts(row), queued: n(row, 'queued'), doneRecently: n(row, 'done_recently') }));
 }
+export function workStateRows(store, now, access) {
+    const projection = registerValidators(store);
+    return store.handle.prepare(`${projection} SELECT repo,root_id,code,needs,person_need,lead_claim,live_run,unfinished,result_id,rank,
+      code||':'||COALESCE(question_id,'')||':'||COALESCE(agent_ask,'')||':'||COALESCE(hold_id,'')||':'||COALESCE(result_id,'')||':'||COALESCE(stop_run,'')||':'||COALESCE(digest,'')||':'||COALESCE(scope_digest,'') version,
+      COALESCE(NULLIF(MAX(COALESCE(proposed_at,''),COALESCE(finished_at,''),
+        COALESCE((SELECT created_at FROM decision WHERE id=question_id),''),COALESCE((SELECT asked_at FROM agent_question WHERE id=agent_ask),''),
+        COALESCE((SELECT held_at FROM hold WHERE id=hold_id),''),COALESCE((SELECT requested_at FROM run_stop WHERE run=stop_run),'')),''),sort_at) ask_at,
+      COALESCE(live_run,(SELECT run FROM decision WHERE id=question_id),(SELECT run FROM agent_question WHERE id=agent_ask)) ask_run,
+      (SELECT json_group_array(m.ref_id) FROM members m WHERE m.root_ref=ranked.root_ref) members FROM ranked`)
+        .all(parameters(now, access, {}, custodyReadings(store)))
+        .map(row => ({ repo: s(row, 'repo'), rootId: String(row['root_id']), code: String(row['code']), needs: n(row, 'needs') === 1, personNeed: n(row, 'person_need') === 1,
+        leadClaim: n(row, 'lead_claim') === 1, liveRun: row['live_run'] == null ? null : n(row, 'live_run'), unfinished: row['unfinished'] == null ? null : n(row, 'unfinished'),
+        resultRun: row['result_id'] == null ? null : n(row, 'result_id'), waits: Number(row['rank']) === 2, version: String(row['version']), at: String(row['ask_at'] ?? ''), askRun: row['ask_run'] == null ? null : n(row, 'ask_run'), members: JSON.parse(String(row['members'] ?? '[]')).map(Number) }));
+}
 /** Families whose headline is Ready for review, newest first: the Tasks
  * list's own rows, so a completed family (root or any revision), a failed
  * check and a superseded version never count. */

package/dist/workspace-revision.js

@@ -6,7 +6,9 @@ const MAX_AGE_MS = 60_000;
 const OMIT = new Set(['schema_version', 'service_cursor', 'wake', 'notification_delivery', 'sqlite_sequence',
     'team_read', 'team_request', 'push_delivery', 'chat_message_ref',
     // Who is watching an agent right now: renewed by every open page's keep-alive, never news.
-    'agent_view']);
+    'agent_view',
+    // A run's How it ran, derived from its own records on first view (run-efficiency.ts): a cache, never news.
+    'run_efficiency']);
 const QUIET = {
     runner: ['heartbeat_at'], claim: ['heartbeat_at', 'expires_at'], watch_lease: ['heartbeat_at', 'expires_at'],
     watch_episode: ['ticks'], provider_readiness: ['observed_at'],

package/dist/worktree.d.ts

@@ -24,6 +24,7 @@
  */
 import { type ExecResult, type RunOptions } from "./exec.js";
 import type { Store, WorktreeRow } from "./store.js";
+import { type Git } from "./teardown-git.js";
 export type Runner = (file: string, args: readonly string[], options?: RunOptions) => Promise<ExecResult>;
 export type PoolOptions = {
     /** Where worktrees are created. Outside the repo, and outside any sync root. */
@@ -123,6 +124,8 @@ export declare const WORKTREE_TIMEOUT_MS = 60000;
  * the pool root through its own slashes.
  */
 export declare function worktreePath(root: string, repo: string, branch: string): string;
+/** The pool root a checkout at `path` of `repo` was made under (worktreePath's layout), or null for one it didn't make. */
+export declare function poolRootOf(path: string, repo: string): string | null;
 /** Record a potentially writing subprocess against the original checkout lease. */
 export declare function recordWorktreeProcess(store: Store, path: string, runner: string, pid: number, leaseEpoch?: string | null): void;
 /** Read-only occupancy witness shared with stop settlement. */
@@ -281,17 +284,18 @@ export declare class WorktreePool {
     /**
      * Whether a let-go checkout could go without losing anything: clean (build output that .gitignore hides is not
      * work, and neither are the files Toolroll itself wrote in there), and everything its HEAD reaches on a branch, tag
-     * or remote. Reads only.
+     * or remote. Reads only, through `git` when given (teardown's hardened git).
      */
-    inspect(path: string): Promise<"clean" | KeptWhy>;
+    inspect(path: string, git?: Git): Promise<"clean" | KeptWhy>;
     /**
      * Keep storage in check: remove the working copies nobody needs any more. Of `rows`, a checkout goes when it is
      * let go, nothing holds it, `wanted` says it may go (asked again right before it goes, so a task coming back or a
      * lease since keeps it) and `inspect` finds it clean, then clean still right before it goes (git refuses an edit
      * made after that). Only the working copy goes: its branch, and so every commit,
-     * stays, and a later lease of the same branch makes a new one. At most `max` go per pass.
+     * stays, and a later lease of the same branch makes a new one. At most `max` go per pass. Every git command goes
+     * through `git` when given: landed cleanup passes its hardened teardown git (teardown-git.ts).
      */
-    prune(rows: readonly WorktreeRow[], wanted: (row: WorktreeRow, fresh: boolean) => boolean | Promise<boolean>, max?: number): Promise<{
+    prune(rows: readonly WorktreeRow[], wanted: (row: WorktreeRow, fresh: boolean) => boolean | Promise<boolean>, max?: number, git?: Git): Promise<{
         removed: WorktreeRow[];
         kept: {
             path: string;
@@ -342,5 +346,7 @@ export declare class WorktreePool {
      * hides is not work, but a file somebody dropped in and never staged is.
      */
     private isDirty;
+    /** All disposal and inspection paths share the hardened teardown boundary. */
+    private readonly teardown;
     private git;
 }

package/dist/worktree.js

@@ -23,15 +23,16 @@
  * over `.git` internals corrupts both.
  */
 import { createHash, randomBytes } from "node:crypto";
-import { existsSync, readFileSync, writeFileSync, rmSync, realpathSync, mkdirSync, readdirSync, renameSync } from "node:fs";
+import { existsSync, lstatSync, readFileSync, writeFileSync, rmSync, realpathSync, mkdirSync, readdirSync, renameSync } from "node:fs";
 import { hostname } from "node:os";
-import { dirname, join } from "node:path";
+import { basename, dirname, join, relative, resolve, sep } from "node:path";
 import { run } from "./exec.js";
 import { currentBootId, provenDeadByBootChange } from "./boot-identity.js";
 import { HANDOFF_PREFIX, MAILBOX_SUFFIX, looksLikeProtocolFile, readMailbox } from "./evidence.js";
 import { parseHandoff } from "./decision.js";
 import { diskBytes } from "./storage.js";
 import { markNeverIndex } from "./never-index.js";
+import { teardownGit } from "./teardown-git.js";
 /**
  * The note a lease leaves in the checkout, naming the process holding it.
  *
@@ -129,6 +130,31 @@ export function worktreePath(root, repo, branch) {
         .slice(0, 8);
     return join(root, safeSegment(basenameOf(repo)), `${safeSegment(branch)}-${digest}`);
 }
+/** The pool root a checkout at `path` of `repo` was made under (worktreePath's layout), or null for one it didn't make. */
+export function poolRootOf(path, repo) {
+    const project = dirname(path);
+    return basename(project) === safeSegment(basenameOf(repo)) && /-[0-9a-f]{8}$/.test(basename(path)) ? dirname(project) : null;
+}
+/** Inspect names, not their destinations, before the plane writes into a pool. */
+function safePoolPath(root, target) {
+    const base = resolve(root);
+    const rel = relative(base, resolve(target));
+    if (rel.startsWith("..") || rel.startsWith(sep))
+        return false;
+    let path = base;
+    for (const component of ["", ...rel.split(sep)]) {
+        path = join(path, component);
+        try {
+            if (!lstatSync(path).isDirectory())
+                return false;
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                return false;
+        }
+    }
+    return true;
+}
 function normalisePath(path) {
     return path.replace(/\\/g, "/").replace(/\/+$/, "");
 }
@@ -210,20 +236,21 @@ export function worktreeProcessOccupancy(path) {
  * reset or clean a tree saves this first.
  */
 export async function saveWorkPatch(runner, path, file, header) {
-    const status = await runner(GIT, [...READ_ONLY, "status", "--porcelain", "--untracked-files=all"], { cwd: path, timeoutMs: WORKTREE_TIMEOUT_MS });
+    const git = teardownGit(runner);
+    const status = await git(path, [...READ_ONLY, "status", "--porcelain", "--untracked-files=all", "--ignore-submodules=all"]);
     if (status.code !== 0)
         return { ok: false, message: `${path} could not be inspected before its work was saved` };
     const untracked = status.stdout
         .split("\n")
         .filter(line => line.startsWith("?? ") && !line.trimEnd().endsWith(MARKER))
         .map(line => line.slice(3).trim());
-    const tracked = await runner(GIT, [...READ_ONLY, "diff", "--binary", "HEAD"], { cwd: path, timeoutMs: WORKTREE_TIMEOUT_MS });
+    const tracked = await git(path, [...READ_ONLY, "diff", "--binary", "--ignore-submodules=all", "HEAD"]);
     if (tracked.code !== 0)
         return { ok: false, message: `${path}: git diff failed while saving its work (${firstLine(tracked.stderr)})` };
     const parts = [tracked.stdout];
     for (const one of untracked) {
         // --no-index exits 1 when the sides differ; that is the expected answer.
-        const diff = await runner(GIT, [...READ_ONLY, "diff", "--binary", "--no-index", "--", "/dev/null", one], { cwd: path, timeoutMs: WORKTREE_TIMEOUT_MS });
+        const diff = await git(path, [...READ_ONLY, "diff", "--binary", "--no-index", "--ignore-submodules=all", "--", "/dev/null", one]);
         if (diff.code > 1)
             return { ok: false, message: `${path}: ${one} could not be captured (${firstLine(diff.stderr)})` };
         parts.push(diff.stdout);
@@ -304,6 +331,8 @@ export class WorktreePool {
     }
     async lease(request) {
         const target = worktreePath(this.options.root, request.repo, request.branch);
+        if (!safePoolPath(this.options.root, target))
+            return { ok: false, reason: "git", message: "The checkout pool contains a symlink or an unreadable folder." };
         if (busy.has(target))
             return { ok: false, reason: "in-use", message: `${target} is busy; try again in a moment` };
         const release = reserveCheckout(this.store, target);
@@ -331,6 +360,9 @@ export class WorktreePool {
             };
         }
         const path = worktreePath(this.options.root, request.repo, request.branch);
+        const unsafe = () => ({ ok: false, reason: "git", message: "The checkout pool contains a symlink or an unreadable folder." });
+        if (!safePoolPath(this.options.root, path))
+            return unsafe();
         const existing = this.store.getWorktree(path);
         // The machine outranks the database here. A row can say "released" while a
         // process that never got to write its own ending is still working in the
@@ -408,10 +440,14 @@ export class WorktreePool {
             const fromBase = request.base !== undefined && !branchExists;
             // Spotlight leaves the checkouts alone: the marker sits in the pool and the project's folder, never inside a
             // checkout, where a build's `git add -A` would commit it (never-index.ts).
+            if (!safePoolPath(this.options.root, path))
+                return unsafe();
             try {
                 mkdirSync(dirname(path), { recursive: true });
             }
-            catch { /* git reports it */ }
+            catch {
+                return unsafe();
+            }
             markNeverIndex(this.options.root);
             markNeverIndex(dirname(path));
             // A new branch is created first, on its own, so its reflog's first entry says Toolroll made it and when.
@@ -426,10 +462,12 @@ export class WorktreePool {
                     return { ok: false, reason: "git", message: firstLine(branch.stderr) };
                 made = oid;
             }
+            if (!safePoolPath(this.options.root, path))
+                return unsafe();
             const add = await this.git(request.repo, ["worktree", "add", path, request.branch]);
             if (add.code !== 0) {
                 if (made !== null)
-                    await this.git(request.repo, ["update-ref", "-d", `refs/heads/${request.branch}`, made]);
+                    await this.teardown(request.repo, ["update-ref", "-d", `refs/heads/${request.branch}`, made]);
                 return { ok: false, reason: "git", message: firstLine(add.stderr) };
             }
         }
@@ -592,10 +630,10 @@ export class WorktreePool {
     }
     /** Back to HEAD, untracked gone, our lease note kept; proven clean after. */
     async resetTree(path) {
-        const checkout = await this.runner(GIT, ["checkout", "--", "."], { cwd: path, timeoutMs: WORKTREE_TIMEOUT_MS });
+        const checkout = await this.teardown(path, ["checkout", "--", "."]);
         if (checkout.code !== 0)
             return { ok: false, message: `${path}: git checkout failed while resetting (${firstLine(checkout.stderr)})` };
-        const clean = await this.runner(GIT, ["clean", "-fd", "-e", MARKER], { cwd: path, timeoutMs: WORKTREE_TIMEOUT_MS });
+        const clean = await this.teardown(path, ["clean", "-fd", "-e", MARKER]);
         if (clean.code !== 0)
             return { ok: false, message: `${path}: git clean failed while resetting (${firstLine(clean.stderr)})` };
         const dirty = await this.isDirty(path);
@@ -683,17 +721,17 @@ export class WorktreePool {
         const occupied = this.inUse(path);
         if (occupied.held)
             return { ok: false, message: `${path} is being used by process ${occupied.by} — leaving it alone` };
-        const removed = await this.git(existing.repo, ["worktree", "remove", "--force", path]);
+        const removed = await this.teardown(existing.repo, ["worktree", "remove", "--force", path]);
         if (removed.code !== 0)
             return { ok: false, message: `git worktree remove: ${removed.stderr.trim() || `exit ${removed.code}`}` };
         // The branch is disposable too; a failure here is bookkeeping, not custody.
-        await this.git(existing.repo, ["branch", "-D", existing.branch]);
+        await this.teardown(existing.repo, ["branch", "-D", existing.branch]);
         this.store.forgetWorktree(path);
         void now;
         return { ok: true };
     }
     async orphans(repo) {
-        const listed = await this.git(repo, ["worktree", "list", "--porcelain"], READ_ONLY);
+        const listed = await this.teardown(repo, ["worktree", "list", "--porcelain"]);
         // A listing that failed is not a listing that came back empty. Treating
         // it as empty would report every stored row as missing — and anything
         // acting on that answer would erase real bookkeeping over a git hiccup.
@@ -790,14 +828,14 @@ export class WorktreePool {
     /**
      * Whether a let-go checkout could go without losing anything: clean (build output that .gitignore hides is not
      * work, and neither are the files Toolroll itself wrote in there), and everything its HEAD reaches on a branch, tag
-     * or remote. Reads only.
+     * or remote. Reads only, through `git` when given (teardown's hardened git).
      */
-    async inspect(path) {
-        const dirty = await this.isDirty(path, true);
+    async inspect(path, git = this.teardown) {
+        const dirty = await this.isDirty(path, true, git);
         if (dirty !== false)
             return dirty === null ? "unreadable" : "has changes";
         // Commits only this checkout's HEAD reaches (a detached HEAD moved on) exist nowhere else.
-        const own = await this.runner(GIT, [...READ_ONLY, "rev-list", "-1", "HEAD", "--not", "--branches", "--tags", "--remotes"], { cwd: path, timeoutMs: WORKTREE_TIMEOUT_MS });
+        const own = await git(path, [...READ_ONLY, "rev-list", "-1", "HEAD", "--not", "--branches", "--tags", "--remotes"]);
         if (own.code !== 0)
             return "unreadable";
         return own.stdout.trim() === "" ? "clean" : "has commits";
@@ -807,9 +845,10 @@ export class WorktreePool {
      * let go, nothing holds it, `wanted` says it may go (asked again right before it goes, so a task coming back or a
      * lease since keeps it) and `inspect` finds it clean, then clean still right before it goes (git refuses an edit
      * made after that). Only the working copy goes: its branch, and so every commit,
-     * stays, and a later lease of the same branch makes a new one. At most `max` go per pass.
+     * stays, and a later lease of the same branch makes a new one. At most `max` go per pass. Every git command goes
+     * through `git` when given: landed cleanup passes its hardened teardown git (teardown-git.ts).
      */
-    async prune(rows, wanted, max = Infinity) {
+    async prune(rows, wanted, max = Infinity, git = this.teardown) {
         const removed = [];
         const kept = [];
         const idle = (row, releasedAt) => row !== null && row.runner === null && row.releasedAt === releasedAt && !this.inUse(row.path).held;
@@ -823,7 +862,7 @@ export class WorktreePool {
                 continue;
             if (!existsSync(row.path) || !idle(row, row.releasedAt))
                 continue;
-            const found = await this.inspect(row.path);
+            const found = await this.inspect(row.path, git);
             if (found !== "clean") {
                 kept.push({ path: row.path, why: found });
                 continue;
@@ -843,7 +882,7 @@ export class WorktreePool {
                 const allowed = wanted(now, true);
                 if (!(typeof allowed === "boolean" ? allowed : await allowed))
                     continue;
-                const gone = await this.removeCleanCopy(row);
+                const gone = await this.removeCleanCopy(row, git);
                 if (gone !== "removed") {
                     kept.push({ path: row.path, why: gone });
                     continue;
@@ -867,7 +906,7 @@ export class WorktreePool {
         const idle = (now) => now !== null && now.runner === null && now.releasedAt !== null && now.releasedAt === row.releasedAt && !this.inUse(row.path).held;
         if (busy.has(row.path) || !existsSync(row.path) || !idle(this.store.getWorktree(row.path)))
             return { ok: false, message: `${row.path} is in use` };
-        const listed = await this.runner(GIT, [...READ_ONLY, "ls-files", "--others", "--ignored", "--exclude-standard", "--directory", "-z"], { cwd: row.path, timeoutMs: WORKTREE_TIMEOUT_MS });
+        const listed = await this.teardown(row.path, [...READ_ONLY, "ls-files", "--others", "--ignored", "--exclude-standard", "--directory", "-z"]);
         if (listed.code !== 0)
             return { ok: false, message: `git couldn't list ${row.path}` };
         const drop = listed.stdout.split("\0").filter(one => one.endsWith("/")).map(one => one.slice(0, -1))
@@ -949,7 +988,7 @@ export class WorktreePool {
         catch {
             return false;
         }
-        const gone = await this.git(row.repo, ["worktree", "remove", "--force", row.path]);
+        const gone = await this.teardown(row.repo, ["worktree", "remove", "--force", row.path]);
         if (gone.code !== 0) {
             rmSync(note, { force: true });
             return false;
@@ -963,11 +1002,11 @@ export class WorktreePool {
      * removed without --force, so git itself refuses an edit made since. Only Toolroll's own files go first, because
      * git's check would count them.
      */
-    async removeCleanCopy(row) {
-        const found = await this.inspect(row.path);
+    async removeCleanCopy(row, git) {
+        const found = await this.inspect(row.path, git);
         if (found !== "clean")
             return found;
-        const status = await this.runner(GIT, [...READ_ONLY, "status", "--porcelain", "--untracked-files=all"], { cwd: row.path, timeoutMs: WORKTREE_TIMEOUT_MS });
+        const status = await git(row.path, [...READ_ONLY, "status", "--porcelain", "--untracked-files=all", "--ignore-submodules=all"]);
         if (status.code !== 0)
             return "unreadable";
         for (const line of status.stdout.split("\n")) {
@@ -975,9 +1014,9 @@ export class WorktreePool {
             if (name === MARKER || (name !== "" && looksLikeProtocolFile(name)))
                 rmSync(join(row.path, name), { recursive: true, force: true });
         }
-        const gone = await this.git(row.repo, ["worktree", "remove", row.path]);
+        const gone = await git(row.repo, ["worktree", "remove", row.path]);
         if (gone.code !== 0)
-            return (await this.isDirty(row.path)) === false ? "git refused" : "has changes";
+            return (await this.isDirty(row.path, false, git)) === false ? "git refused" : "has changes";
         this.forgetRemoved(row);
         return "removed";
     }
@@ -995,8 +1034,8 @@ export class WorktreePool {
      * `--untracked-files=all` and no `--ignored`: build output that .gitignore
      * hides is not work, but a file somebody dropped in and never staged is.
      */
-    async isDirty(path, ignoreOwnFiles = false) {
-        const status = await this.runner(GIT, [...READ_ONLY, "status", "--porcelain", "--untracked-files=all"], { cwd: path, timeoutMs: WORKTREE_TIMEOUT_MS });
+    async isDirty(path, ignoreOwnFiles = false, git = this.teardown) {
+        const status = await git(path, [...READ_ONLY, "status", "--porcelain", "--untracked-files=all", "--ignore-submodules=all"]);
         if (status.code !== 0)
             return null;
         // Our own lease note is not the operator's work. Without this the marker
@@ -1010,6 +1049,8 @@ export class WorktreePool {
             .filter(line => line.trim() !== "")
             .some(line => !line.trimEnd().endsWith(MARKER) && !(ignoreOwnFiles && line.startsWith("?? ") && looksLikeProtocolFile(line.slice(3).trim())));
     }
+    /** All disposal and inspection paths share the hardened teardown boundary. */
+    teardown = (cwd, args) => teardownGit(this.runner)(cwd, args);
     git(cwd, args, prefix = []) {
         return this.runner(GIT, [...prefix, ...args], { cwd, timeoutMs: WORKTREE_TIMEOUT_MS });
     }

package/package.json

@@ -1,13 +1,17 @@
 {
   "name": "toolroll",
-  "version": "0.9.62",
+  "version": "0.9.65",
   "description": "A control plane for unattended coding agents — queue tasks, walk away, come back to pull requests. Agents build in leased worktrees, never touch your default branch, and interrupt you only for decisions that need a human.",
   "directories": {
     "doc": "docs"
   },
   "scripts": {
     "build": "tsc -p tsconfig.build.json && node scripts/browser-build.mjs && node scripts/postbuild.mjs",
-    "test": "vitest run",
+    "test": "vitest run --exclude '**/*.slow.test.ts'",
+    "test:slow": "vitest run .slow.test",
+    "test:all": "vitest run",
+    "test:attacks": "vitest run --config test/attacks/vitest.config.ts",
+    "check:quick": "node scripts/quick-check.mjs",
     "dev": "tsx src/cli.ts",
     "typecheck": "tsc --noEmit && tsc -p tsconfig.browser.json",
     "certify:provider": "npm run build && node scripts/provider-canary.mjs",
@@ -78,6 +82,9 @@
     "@types/node": "26.6.4",
     "@types/react": "19.3.0",
     "@types/react-dom": "19.3.0",
+    "@types/ws": "8.18.2",
+    "@xterm/addon-fit": "0.11.0",
+    "@xterm/xterm": "6.0.0",
     "@xyflow/react": "12.12.0",
     "class-variance-authority": "0.7.1",
     "clsx": "2.1.1",
@@ -122,7 +129,11 @@
     "mailparser": "3.9.36",
     "nodemailer": "10.0.15",
     "typescript-parser": "npm:typescript@6.0.3",
+    "ws": "8.22.0",
     "yaml": "2.9.1",
     "zod": "^4.6.5"
+  },
+  "optionalDependencies": {
+    "@lydell/node-pty": "1.2.0-beta.15"
   }
 }