toolroll 0.9.67 → 0.9.69

package/dist/batch-checks.js

@@ -1,24 +1,4 @@
-/** Batch checks: like a merge queue, for projects that run the full check after every build.
- *
- * With batching on (a per-project setting, off by default), a Full build doesn't run its check
- * inline. It asks for a batch check on its exact commit, and waits up to the window (10 minutes)
- * for another result of the same project and the same approved command. The batch pass then
- * merges the waiting results onto the recorded project base in a temporary, detached checkout
- * and runs the approved check once:
- *
- * - it passes: every result gets its own sealed receipt, "checked together with" the others,
- *   naming the exact batch commit it tested;
- * - it fails: the batch is split in halves and each half checked, down to single results, so the
- *   one that breaks it is found and the others still pass on their own;
- * - the results conflict when merged: each is checked on its own.
- *
- * Nothing is merged into a real branch. The batch commit exists only in the temporary checkout,
- * which is always removed; each result still lands on its own.
- *
- * The queue is the follow-up check ledger (result-follow-ups.ts), with `batch` requests: the same
- * claim, receipts, abandoned-check reading, status projection and Merge gate. The policy is an
- * append-only ledger entry, like the check level. */
-import { fencedCheckoutCommands } from "./invoke.js";
+import { checkoutRunner, ranAtLine, widestRan } from "./invoke.js";
 import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -67,7 +47,8 @@ export async function runBatchChecks(store, root, deps = {}) {
             finish("The approved check changed while it waited. Run checks to check it now.");
             continue;
         }
-        const key = `${ref.repo}\u0000${one.digest}`;
+        // A cohort shares one check level: results whose own checks ran at different levels are checked apart (check-access.ts).
+        const key = `${ref.repo}\u0000${one.digest}\u0000${store.runCheckAccess(one.runId)}`;
         cohorts.set(key, [...(cohorts.get(key) ?? []), { request: one.request, runId: one.runId, task: ref.externalId, head: one.head, base: one.base ?? null, at: one.at }]);
     }
     for (const [key, members] of cohorts) {
@@ -121,6 +102,8 @@ async function checkCohort(store, root, repo, cohort, deps) {
     const attempts = new Map(members.map(one => [one.request, []]));
     const bound = (text) => { const hits = scanForSecrets(text); return boundStreamHeadTail(hits.length > 0 ? redactSecretLines(text, hits) : text, 12 * 1024); };
     const section = (label, shown, result) => `=== ${label} ===\n$ ${shown}\n(exit ${result.code}${result.notFound ? ", could not start" : ""}${result.timedOut ? ", timed out" : ""})\n\n--- stdout ---\n${bound(result.stdout)}\n\n--- stderr ---\n${bound(result.stderr)}`;
+    // How each command actually ran (check-access.ts), per result: only the commands it was part of count for its receipt.
+    const ranAtOf = new Map();
     const note = (set, text) => { for (const one of set)
         logs.get(one.request).push(text); };
     const attempt = (set, tested, outcome) => { for (const one of set)
@@ -158,11 +141,15 @@ async function checkCohort(store, root, repo, cohort, deps) {
                 return { conflict: false, tested, outcome: { ran: false, failure: "Stopped before the check started." }, setupFailed: false };
             // The approvals are re-read before every spawn: a revoked or changed command never runs.
             const liveSetup = store.liveWorktreeSetup(repo);
+            // Worked out again right before each command (check-access.ts): a narrowing meanwhile applies to the next one. Each
+            // member is credited with exactly the commands of this set.
+            const setRan = (level) => { for (const one of set)
+                ranAtOf.set(one.request, [...(ranAtOf.get(one.request) ?? []), level]); };
             if ((liveSetup?.digest ?? null) !== (setup?.digest ?? null))
                 return { conflict: false, tested, outcome: { ran: false, failure: "The project's approved setup changed before the check started." }, setupFailed: false };
             if (liveSetup !== null) {
                 const shell = approvedCommandShell(liveSetup.command);
-                const prepared = await runWithIsolatedDatabase(fencedCheckoutCommands(store, repo, checkout, runner), shell.file, shell.args, { cwd: checkout, timeoutMs: liveSetup.timeoutMs, processGroup: true, envAllowlist: SETUP_ENV_ALLOWLIST, omitEnv: SETUP_ENV_DENYLIST });
+                const prepared = await runWithIsolatedDatabase(checkoutRunner(store, repo, checkout, runner, set.map(one => one.runId), setRan), shell.file, shell.args, { cwd: checkout, timeoutMs: liveSetup.timeoutMs, processGroup: true, envAllowlist: SETUP_ENV_ALLOWLIST, omitEnv: SETUP_ENV_DENYLIST });
                 note(set, section(`${label} · approved project setup on ${tested.slice(0, 7)}`, liveSetup.command, prepared));
                 if (prepared.code !== 0 || prepared.timedOut || prepared.notFound)
                     return { conflict: false, tested, outcome: { ran: false, failure: "The project's setup failed, so the check didn't run." }, setupFailed: true };
@@ -171,7 +158,7 @@ async function checkCohort(store, root, repo, cohort, deps) {
             if (live === null || live.digest !== command.digest)
                 return { conflict: false, tested, outcome: { ran: false, failure: "The approved check changed before it started." }, setupFailed: false };
             const shell = approvedCommandShell(live.command);
-            const ran = await runWithIsolatedDatabase(fencedCheckoutCommands(store, repo, checkout, runner), shell.file, shell.args, { cwd: checkout, timeoutMs: live.timeoutMs, processGroup: true, envAllowlist: SETUP_ENV_ALLOWLIST, omitEnv: SETUP_ENV_DENYLIST });
+            const ran = await runWithIsolatedDatabase(checkoutRunner(store, repo, checkout, runner, set.map(one => one.runId), setRan), shell.file, shell.args, { cwd: checkout, timeoutMs: live.timeoutMs, processGroup: true, envAllowlist: SETUP_ENV_ALLOWLIST, omitEnv: SETUP_ENV_DENYLIST });
             note(set, section(`${label} · full check on ${tested.slice(0, 7)}`, live.command, ran));
             return { conflict: false, tested, setupFailed: false,
                 outcome: ran.timedOut ? { ran: false, failure: "The check ran out of time." } : ran.notFound ? { ran: false, failure: "The check couldn't start." } : { ran: true, exitCode: ran.code } };
@@ -183,11 +170,12 @@ async function checkCohort(store, root, repo, cohort, deps) {
     };
     const seal = (one, mode, together, tested, outcome) => {
         const at = now();
-        const text = logs.get(one.request).length === 0 ? "No command started." : logs.get(one.request).join("\n\n");
+        const ranLine = ranAtLine(widestRan(ranAtOf.get(one.request) ?? []));
+        const text = logs.get(one.request).length === 0 ? "No command started." : [...logs.get(one.request), ...(ranLine === null ? [] : [ranLine])].join("\n\n");
         const logId = storeEvidence(store, root, one.runId, "structured-output", `batch-check-${one.request}.log`, Buffer.from(text, "utf8"), FOLLOW_UP_LOG, at, { captureStatus: "ok" });
         const logArtifact = store.getArtifact(logId);
         const batch = { mode, tested: tested ?? one.head, base, members: together.map(m => ({ task: m.task, run: m.runId, head: m.head })), attempts: attempts.get(one.request) };
-        const receipt = JSON.stringify({ version: 1, request: one.request, run: one.runId, head: one.head, tested, level: "full",
+        const receipt = JSON.stringify({ version: 1, request: one.request, run: one.runId, head: one.head, tested, level: "full", checkAccess: widestRan(ranAtOf.get(one.request) ?? []),
             command: { repo: command.repo, command: command.command, digest: command.digest, approvedBy: command.approvedBy },
             result: outcome, batch, log: { artifactId: logArtifact.id, sha256: logArtifact.sha256, bytesStored: logArtifact.bytesStored, truncated: logArtifact.truncated } }, null, 1);
         storeEvidence(store, root, one.runId, "structured-output", `batch-check-${one.request}.json`, Buffer.from(receipt, "utf8"), FOLLOW_UP_RECEIPT, at, { captureStatus: "ok" });