toolroll 0.9.7 → 0.9.9

package/dist/builder.js

@@ -59,11 +59,23 @@ import { TELEGRAM_TOKEN_ENVS } from "./names.js";
 import { OPENROUTER_ENV_KEY, auditOf, ALL_CREDENTIAL_ENV } from "./provider.js";
 import { openLiveLog } from "./live.js";
 import { CheckProgressTracker } from "./check-progress.js";
-import { captureParkEvidence, captureTerminalDiff, captureBaseTree, evidenceRoot, handoffName, storeHandoffArtifact, looksLikeProtocolFile, mailboxName, progressFileName, proofFileName, rubricFileName, proposalFileName, quarantineMailboxes, readMailbox, readVerifiedArtifact, scanForSecrets, redactSecretLines, storeEvidence, validateScreenshotBytes, imageDimensions, SCREENSHOT_BYTE_CAP, boundStreamHeadTail } from "./evidence.js";
+import { captureParkEvidence, captureTerminalDiff, captureBaseTree, evidenceRoot, handoffName, isImagePath, WORKTREE_EVIDENCE_DIR, storeHandoffArtifact, looksLikeProtocolFile, mailboxName, progressFileName, proofFileName, rubricFileName, proposalFileName, quarantineMailboxes, readMailbox, readVerifiedArtifact, scanForSecrets, redactSecretLines, storeEvidence, validateScreenshotBytes, imageDimensions, SCREENSHOT_BYTE_CAP, boundStreamHeadTail } from "./evidence.js";
 import { PROOF_LIMITS, parseProof, serializeProof, adjudicate, artifactManifestOnly, sameDiffStatFacts } from "./proof.js";
 import { captureReviewContext } from "./review-context.js";
 import { authoritySnapshotDigest, classifyRevisionAuthority, isMilestoneRegression, milestonesOf, parseExecutionPlanDocument, parsePlanRevisionProposal, parseProgressSnapshot, renderExecutionPlanDocument, PROGRESS_LIMITS, REVISION_LIMITS, } from "./plan.js";
 import { maybeSettleRepairChain } from "./dispose.js";
+import { detachShared, linkInto, linkedKey, promoteInstall, readyCopy, sharedDepsRoot, sharingFor } from "./shared-deps.js";
+/** Where this store keeps shared dependencies; null for an in-memory store, which shares nothing. */
+function sharedDepsRootOf(store) {
+    const file = store.databaseFile();
+    return file === null ? null : sharedDepsRoot(file);
+}
+/** The one line an agent needs when its node_modules is a shared copy: it is read-only, and how to get its own. */
+function sharedDepsBrief(store, worktree) {
+    const root = sharedDepsRootOf(store);
+    return root === null || linkedKey(worktree, root) === null ? "" :
+        "node_modules here links a shared, read-only install. If you change package.json or the lockfile, replace it with your own install first: `rm -rf node_modules && npm install`.\n";
+}
 /**
  * The native shell for an operator-approved repository command. There are
  * exactly two consumers: dependency setup before an agent starts, and the
@@ -668,6 +680,20 @@ export async function build(store, request) {
                     message: "runner custody lapsed before the setup spawn — the lease, the runner, or its repo binding no longer stands",
                 };
             }
+            // Shared dependencies: a checkout whose lockfile already has an installed
+            // copy links it instead of installing its own; a setup that is about to
+            // run never reaches through an old link into a shared copy.
+            const depsRoot = sharedDepsRootOf(store);
+            const sharing = depsRoot === null ? null : sharingFor({ repo: leased.repo, worktree, setup: setupWanted });
+            if (depsRoot !== null)
+                detachShared(worktree, depsRoot);
+            if (depsRoot !== null && sharing !== null) {
+                const ready = readyCopy(depsRoot, sharing.key);
+                if (ready !== null && linkInto(worktree, ready) !== null) {
+                    store.stampWorktreeSetup(worktree, setupWanted.digest);
+                    return null;
+                }
+            }
             const runSetup = request.setup ?? run;
             const shell = approvedCommandShell(setupWanted.command);
             // Setup runs under the stop watch (v52), owned by this run: an
@@ -700,6 +726,9 @@ export async function build(store, request) {
                     message: `the approved setup for ${leased.repo} ${made.timedOut ? `ran past ${Math.round(setupWanted.timeoutMs / 60_000)}m` : `exited ${made.code}`} — ${redactSecretText(firstLine(made.stderr)) || "no stderr"}; no agent spawns in a checkout whose setup failed`,
                 };
             }
+            if (depsRoot !== null && sharing !== null) {
+                promoteInstall({ root: depsRoot, repo: leased.repo, worktree, ...sharing, setupDigest: setupWanted.digest, now: (request.clock ?? (() => now))() });
+            }
             store.stampWorktreeSetup(worktree, setupWanted.digest);
         }
         return null;
@@ -1128,7 +1157,7 @@ export async function build(store, request) {
     // replacement for.
     milestones.length === 0 || planRevisionHash === null
         ? null
-        : { revision: planRevisionNumber, hash: planRevisionHash, milestones, progress, proposal }, scope === null ? [] : flowGoalCuts(store, scope.taskId, scope.goal)) + `\nCanonical signed rubric: ${rubric}. Its statement fields are exact; evidence requirements are separate fields. Do not edit this input. The lead or user reads these criteria directly; no restatement is needed.\n`;
+        : { revision: planRevisionNumber, hash: planRevisionHash, milestones, progress, proposal }, scope === null ? [] : flowGoalCuts(store, scope.taskId, scope.goal)) + `\nCanonical signed rubric: ${rubric}. Its statement fields are exact; evidence requirements are separate fields. Do not edit this input. The lead or user reads these criteria directly; no restatement is needed.\n` + sharedDepsBrief(store, worktree);
     // THE HELD BRANCH (Phase 2, v2 S0d + v6 W8): ownership transfers to the
     // coordinator at the spawn point. Everything build() armed that its
     // finally would have cleared is torn down or handed over HERE — the pulse
@@ -1786,7 +1815,7 @@ export async function settleProviderOutcome(captured, result) {
     // result is that commit, sealed below against the task's original base.
     const made = finishesKeptWork
         ? await keptWorkResult(captured, baseRevision, handoff.conclusion)
-        : await commit(git, worktree, branch, taskId, scope, handoff.conclusion, request.attended === undefined ? scope?.candidate ?? null : null);
+        : await commit(git, worktree, branch, taskId, scope, handoff.conclusion, request.attended === undefined ? scope?.candidate ?? null : null, words => store.addRunNote(request.runId, "Toolroll", words, clock()));
     if (made.ok && made.parked === undefined && made.committed) {
         const newHead = await git(GIT, ["--no-optional-locks", "rev-parse", "HEAD"], { cwd: worktree });
         if (newHead.code === 0) {
@@ -2221,8 +2250,48 @@ async function settleProof(captured, statArtifactId, sealedHead) {
             checkLog.push(attemptLog(label, configured.command, result));
             return result;
         };
-        const first = await runVerification("Project check · attempt 1");
-        if (first.notFound || first.timedOut) {
+        const ownInstallIfChanged = async () => {
+            const depsRoot = sharedDepsRootOf(store);
+            if (depsRoot === null || repo === null)
+                return null;
+            const linked = linkedKey(worktree, depsRoot);
+            const live = linked === null ? null : store.liveWorktreeSetup(repo);
+            if (linked === null || live === null)
+                return null;
+            if (sharingFor({ repo, worktree, setup: live })?.key === linked && readyCopy(depsRoot, linked) !== null)
+                return null;
+            if (!store.proveRunnerCustodyForSpawn(runId, now()))
+                return "custody-lost";
+            detachShared(worktree, depsRoot);
+            const label = "Own install · approved project setup (package.json or lockfile changed)";
+            const setupShell = approvedCommandShell(live.command);
+            const installed = await underStopWatch(store, runId, () => runWithIsolatedDatabase(witnessedRunner(store, runId, now, request.setup ?? run), setupShell.file, setupShell.args, {
+                cwd: worktree,
+                timeoutMs: live.timeoutMs,
+                processGroup: true,
+                owner: runOwnerTag(store, runId),
+                beforeSpawn: () => !stopRequestedFor(store, runId, request.shouldStop),
+                onSpawn: pid => {
+                    request.onProviderSpawn?.(pid);
+                    if (stopRequestedFor(store, runId, request.shouldStop))
+                        throw new Error("the attempt was stopped before spawn custody completed");
+                },
+                envAllowlist: SETUP_ENV_ALLOWLIST,
+                omitEnv: SETUP_ENV_DENYLIST,
+            }));
+            checkOutcomes.push(attemptOutcome(label, installed));
+            noteCheckSuite(label, installed);
+            checkLog.push(attemptLog(label, live.command, installed));
+            if (installed.notFound || installed.timedOut || installed.code !== 0)
+                return "own-install-failed";
+            return await sealedTreeState(request.git ?? run) === "clean" ? null : "setup-changed-files";
+        };
+        const ownInstall = await ownInstallIfChanged();
+        const first = ownInstall === null ? await runVerification("Project check · attempt 1") : null;
+        if (first === null) {
+            verifyCommand = { configured: true, ran: false, attemptFailed: true, failure: ownInstall ?? "own-install-failed" };
+        }
+        else if (first.notFound || first.timedOut) {
             verifyCommand = { configured: true, ran: false, attemptFailed: true, failure: first.timedOut ? "timed-out" : "spawn-failed" };
         }
         else if (!verificationExecutableMissing(first)) {
@@ -2419,7 +2488,7 @@ async function settleProof(captured, statArtifactId, sealedHead) {
                 now,
             });
             if (captureResult !== null) {
-                reviewContext = captureResult.inventory.coverage.map(one => ({ id: one.id, state: one.state, inherited: one.inherited, items: one.items, gaps: one.gaps, priorSupport: one.priorSupport }));
+                reviewContext = captureResult.inventory.coverage.map(one => ({ id: one.id, state: one.state, inherited: one.inherited, items: one.items, gaps: one.gaps, priorSupport: one.priorSupport, ...(one.assets === undefined ? {} : { assets: one.assets }) }));
             }
         }
         catch {
@@ -3230,9 +3299,12 @@ flowCuts = []) {
         "  changed-file inventory or final check results. This applies to no-change",
         "  results too. Put useful caveats in the short handoff; do not invent evidence.",
         "  Run focused checks for your edits. The machine runs the approved full check.",
+        "  Save screenshots and journey output only under evidence/ (the run's",
+        "  evidence folder). They are never committed: images added there are left",
+        "  out of the commit, so do not save them anywhere else in the repository.",
         "  If screenshots are required, capture the actual candidate and list them in",
         `  ${proof}: { "version": 1, "screenshots": [`,
-        '    { "path": "<repository-relative PNG or JPEG>", "caption": "<what it shows>" } ] }.',
+        '    { "path": "<evidence/… PNG or JPEG>", "caption": "<what it shows>" } ] }.',
         `  List at most ${PROOF_LIMITS.screenshots} screenshots, with paths/captions under ${PROOF_LIMITS.evidenceRef} UTF-8 bytes,`,
         "  on one line each; no absolute paths or dot segments. Images must be real,",
         "  at least 320 by 200 pixels. A list is optional; missing required images",
@@ -3355,7 +3427,7 @@ function fence(text) {
  * code and concluded the task needed no change has done its job, and turning
  * that into a failure would teach the loop to prefer writing something.
  */
-async function commit(git, worktree, branch, taskId, scope, summary, preparedCandidate = null) {
+async function commit(git, worktree, branch, taskId, scope, summary, preparedCandidate = null, notice) {
     const status = await git(GIT, ["--no-optional-locks", "status", "--porcelain"], { cwd: worktree });
     if (status.code !== 0) {
         return { ok: false, reason: "commit-failure", message: firstLine(status.stderr) };
@@ -3375,6 +3447,20 @@ async function commit(git, worktree, branch, taskId, scope, summary, preparedCan
     const add = await git(GIT, ["add", "-A", "--", ".", `:!${LEASE_MARKER}`, ":!STANDING-ORDERS-*", ":!NIGHTORDERS-*"], { cwd: worktree });
     if (add.code !== 0)
         return { ok: false, reason: "commit-failure", message: firstLine(add.stderr) };
+    // Screenshots belong to the run's evidence, not the branch. Images added
+    // under evidence/ are unstaged and left on disk, where the proof can still
+    // name them; an exact prepared candidate is compared whole instead.
+    if (preparedCandidate === null) {
+        const stripped = await stripEvidenceImages(git, worktree);
+        if (!stripped.ok)
+            return { ok: false, reason: "commit-failure", message: stripped.message };
+        if (stripped.notice !== null) {
+            notice?.(stripped.notice);
+            summary = `${summary}\n\n${stripped.notice}`;
+            if (!stripped.staged)
+                return { ok: true, committed: false, branch, summary };
+        }
+    }
     // Setup can create untracked files as well as edit tracked manifests.
     // Re-prove the whole staged tree after the normal path exclusions, before
     // committing, so neither can widen an exact prepared candidate.
@@ -3409,6 +3495,26 @@ async function commit(git, worktree, branch, taskId, scope, summary, preparedCan
     }
     return { ok: true, committed: true, branch, summary };
 }
+/** The plain words for images left out of a commit. */
+export function evidenceImagesNotice(paths) {
+    return `Left ${paths.length} image${paths.length === 1 ? "" : "s"} under ${WORKTREE_EVIDENCE_DIR} out of the commit: screenshots belong in the run's evidence, not the repository.`;
+}
+/** Unstage images newly added under evidence/; the files stay on disk. */
+async function stripEvidenceImages(git, worktree) {
+    const added = await git(GIT, ["--no-optional-locks", "diff", "--cached", "--name-only", "-z", "--no-renames", "--diff-filter=A", "--", WORKTREE_EVIDENCE_DIR], { cwd: worktree });
+    if (added.code !== 0)
+        return { ok: false, message: firstLine(added.stderr) };
+    const images = added.stdout.split("\0").filter(path => path !== "" && isImagePath(path));
+    if (images.length === 0)
+        return { ok: true, notice: null, staged: true };
+    for (let at = 0; at < images.length; at += 200) {
+        const removed = await git(GIT, ["rm", "--cached", "--quiet", "--", ...images.slice(at, at + 200).map(path => `:(literal)${path}`)], { cwd: worktree });
+        if (removed.code !== 0)
+            return { ok: false, message: firstLine(removed.stderr) };
+    }
+    const rest = await git(GIT, ["--no-optional-locks", "diff", "--cached", "--quiet"], { cwd: worktree });
+    return { ok: true, notice: evidenceImagesNotice(images), staged: rest.code !== 0 };
+}
 /**
  * `claude --output-format json` returns an envelope: the result is the
  * summary, and the session id is what lets a malformed park be repaired by

package/dist/chat-controls.d.ts

@@ -11,7 +11,7 @@ export declare const CHAT_CONTROLS: {
         readonly target: "task";
     };
     readonly planning: {
-        readonly label: "Review plan";
+        readonly label: "Approve plan";
         readonly target: "task";
     };
     readonly recovery: {

package/dist/chat-controls.js

@@ -4,7 +4,7 @@
 export const CHAT_CONTROLS = {
     task: { label: "Open task", target: "task" },
     approval: { label: "Review & start", target: "task" },
-    planning: { label: "Review plan", target: "task" },
+    planning: { label: "Approve plan", target: "task" },
     recovery: { label: "Review recovery options", target: "task" },
     cancel: { label: "Cancel task", target: "task" },
     result: { label: "Open result", target: "task" },

package/dist/check-levels-ui.d.ts

@@ -14,6 +14,11 @@ export type CheckSettingsView = {
     quick: VerifyCommand | null;
     /** A starting point for the quick command, from the project's scripts. */
     suggestion: string | null;
+    /** The project's automatic review switch (review-switch.ts), beside its checks. */
+    review?: {
+        on: boolean;
+        source: "project" | "hands-off" | "default";
+    };
     said: string | null;
     problem: string | null;
 };

package/dist/check-levels-ui.js

@@ -19,7 +19,7 @@ export function checkSettingsHtml(view) {
         (fallsBack ? `<p class="meta">No quick command yet, so builds run the full check.</p>` : "") +
         (view.level !== "full" && view.full !== null ? `<p class="meta">The full check still runs when a pull request opens, and Merge waits for it.</p>` : "");
     if (!view.canChange) {
-        return head + `<section class="card check-settings">${current}</section>` +
+        return head + `<section class="card check-settings">${current}</section>` + reviewHtml(view, "") +
             `<section class="card check-settings"><h2>Quick check</h2>${view.quick === null ? `<p class="meta">None yet.</p>` : command(view.quick)}</section>` +
             `<section class="card check-settings"><h2>Full check</h2>${view.full === null ? `<p class="meta">None yet.</p>` : command(view.full)}</section>`;
     }
@@ -45,7 +45,21 @@ export function checkSettingsHtml(view) {
             `<p class="meta">Quick builds run the full check instead.</p>${password}<button type="submit" class="danger">Remove</button></form></details></section>`;
     const full = `<details class="settings-more"><summary>Full check</summary><section class="card check-settings">` +
         (view.full === null ? `<p class="meta">None yet. Approve one with <span class="mono">toolroll verify set --repo … --command "…"</span>.</p>` : command(view.full)) + `</section></details>`;
-    return head + levelForm + quick + full;
+    return head + levelForm + reviewHtml(view, password) + quick + full;
+}
+/** Automatic review: one state, one sentence, and its one change behind a disclosure (the password). */
+function reviewHtml(view, password) {
+    const review = view.review;
+    if (review === undefined)
+        return "";
+    const state = review.on ? (review.source === "hands-off" ? "On while hands-off lasts" : "On") : "Off";
+    const act = review.on ? "Turn off" : "Turn on";
+    const change = password === "" ? ""
+        : `<details class="settings-more"><summary>${act}</summary><form method="post" action="/settings/checks" class="check-settings">` +
+            `<input type="hidden" name="csrf" value="${escape(view.csrf)}"><input type="hidden" name="repo" value="${escape(view.repo)}"><input type="hidden" name="act" value="review">` +
+            `<input type="hidden" name="on" value="${review.on ? "0" : "1"}">${password}<button type="submit">${act}</button></form></details>`;
+    return `<section class="card check-settings" data-review-switch="${review.on ? "on" : "off"}"><h2>Automatic review</h2>` +
+        `<p><strong>${state}</strong> · One read-only review after each build passes its checks. Only high findings send it back, once.</p>${change}</section>`;
 }
 export const CHECK_SETTINGS_CSS = `
   .check-settings { display: grid; gap: .6rem; max-width: 40rem; }

package/dist/check-progress.js

@@ -153,9 +153,10 @@ export class CheckProgressTracker {
             }
             return;
         }
-        // scripts/e2e-parallel.mjs: "Running 7 groups at once: console, task, …", then every group's
-        // lines as "[group] [app] …", then "✅ group  3.1 min" per group and "N of M groups passed …".
-        const starting = /^Running ([0-9]+) groups at once: (.+)$/.exec(line);
+        // scripts/e2e-parallel.mjs: "Running 7 groups, at most 4 at once (12.0 GB available, about 400 MB each): console,
+        // task, …" (before: "Running 7 groups at once: …"), then every group's lines as "[group] [app] …", then
+        // "✅ group  3.1 min" per group and "N of M groups passed …".
+        const starting = /^Running ([0-9]+) groups(?:, at most [0-9]+)? at once(?: \([^)]*\))?: (.+)$/.exec(line);
         if (starting !== null) {
             const total = safeCount(starting[1]);
             const names = starting[2].split(",").map(one => one.trim()).filter(one => one !== "");

package/dist/checkout-cleanup.d.ts

@@ -1,5 +1,5 @@
 import { type CheckoutCleanup } from "./storage.js";
-import type { Store } from "./store.js";
+import type { Store, WorktreeRow } from "./store.js";
 import { type WorktreePool } from "./worktree.js";
 /** A release candidate's checkout holds the build a deploy installs: kept a week after its task was done. */
 export declare const CANDIDATE_KEEP_MS: number;
@@ -36,12 +36,33 @@ type Status = {
     taskId: string;
     finishedAt: string | null;
     dueAt?: string;
+    atOnce?: boolean;
 };
+/** The release a deploy installed last (staged-upgrades/<stage>/deployment.json at phase "deployed"): its commit and
+ * builder run. A deploy runs from the gate's checkout, so that checkout stays while it is what runs. */
+export type Deployed = {
+    head: string | null;
+    run: number | null;
+};
+export declare function deployedRelease(stateDir: string | null): Deployed | null;
+/**
+ * Which release a gate belongs to: a failed gate is re-filed as the same name plus a letter (`release-x`, then
+ * `release-xb`, `release-xc` …), so a gate whose name is another gate's in the same project plus one letter is that
+ * release's.
+ */
+export declare function releaseOf(id: string, gates: ReadonlySet<string>): string;
 /** Where every task stands for cleanup, by task_ref id and by each branch it or its runs used. */
-export declare function taskStatuses(store: Store, now: Date): {
+export declare function taskStatuses(store: Store, now: Date, deployed?: Deployed | null): {
     byRef: Map<number, Status>;
     byBranch: Map<string, Status>;
 };
+/** The let-go checkouts whose task is complete or cancelled, and when it finished. Not a release candidate's that
+ * stays: a deploy runs from it. */
+export declare function finishedCheckouts(store: Store, now: Date, repo?: string): {
+    row: WorktreeRow;
+    taskId: string | null;
+    finishedAt: string;
+}[];
 /**
  * What a clean-up would remove now, how much space it would free, and what stays and why. `manual` is a clean-up by
  * hand (it doesn't wait for the setting); otherwise it is the worker's pass under the setting. Reads only.
@@ -71,6 +92,23 @@ export declare function cleanCheckouts(store: Store, pool: WorktreePool, now: ()
     repo?: string;
     only?: ReadonlySet<string>;
 }): Promise<CleanResult>;
+export type SlimResult = {
+    slimmed: {
+        path: string;
+        taskId: string | null;
+        dropped: string[];
+        bytes: number;
+    }[];
+};
+/**
+ * A kept checkout (its result waiting for review, or with changes) drops its dependencies and build output once its
+ * run has ended; the next run's setup restores them (node_modules only goes where the project has a setup to restore
+ * it). Never one in use or a release candidate (a deploy installs from it). Each in the ledger.
+ */
+export declare function slimKeptCheckouts(store: Store, pool: WorktreePool, now: () => Date, options: {
+    actor: string;
+    repo?: string;
+}): Promise<SlimResult>;
 /** Throw away a checkout kept for its changes, on purpose; its branch stays. In the ledger. */
 export declare function discardCheckout(store: Store, pool: WorktreePool, path: string, now: Date, actor: string): Promise<{
     ok: true;

package/dist/checkout-cleanup.js

@@ -6,13 +6,18 @@
  * Only the working copy goes: its branch, and so every commit, stays, and a later lease of the branch makes a new one.
  *
  * Always kept: a checkout in use, one whose task isn't finished (on hold, failed, a revision under way), a result
- * still waiting for review, a release candidate for a week after it was done (a deploy installs from it), a checkout
- * with changes (files Toolroll wrote itself aside), and one with commits on no branch. A checkout no task names
- * (adopted after a crash) goes only in a clean-up by hand. Every removal is in the ledger.
+ * still waiting for review, a checkout with changes (files Toolroll wrote itself aside), and one with commits on no
+ * branch. A release candidate's checkout (a deploy installs from it) is kept only while it is the newest gate for its
+ * release (for a week after it was done) or the one deployed; a superseded or cancelled gate goes at once, whatever
+ * its task's state (staged releases keep the rollback copy). A checkout no task names (adopted after a crash) goes only
+ * in a clean-up by hand. Every removal is in the ledger.
+ *
+ * A kept checkout waiting for review or with changes drops its dependencies and build output once its run ends
+ * (`slimKeptCheckouts`); the next run's setup restores them.
  */
 import { createHash } from "node:crypto";
-import { existsSync } from "node:fs";
-import { basename } from "node:path";
+import { existsSync, readFileSync, readdirSync } from "node:fs";
+import { basename, dirname, join } from "node:path";
 import { taskBranches } from "./names.js";
 import { COMPLETION_ACTION } from "./result-completion.js";
 import { CLEANUP_CHOICES, bytesWords, diskBytes } from "./storage.js";
@@ -24,19 +29,80 @@ export const CANDIDATE_KEEP_MS = 7 * DAY_MS;
 export const AUTO_MAX = 20;
 /** Git inspections at once. */
 const INSPECT_AT_ONCE = 8;
+export function deployedRelease(stateDir) {
+    if (stateDir === null)
+        return null;
+    const root = join(stateDir, "staged-upgrades");
+    let newest = null;
+    let names = [];
+    try {
+        names = readdirSync(root);
+    }
+    catch {
+        return null;
+    }
+    for (const name of names) {
+        let journal;
+        try {
+            journal = JSON.parse(readFileSync(join(root, name, "deployment.json"), "utf8"));
+        }
+        catch {
+            continue;
+        }
+        if (journal["phase"] !== "deployed")
+            continue;
+        const at = typeof journal["deployedAt"] === "string" ? journal["deployedAt"] : typeof journal["updatedAt"] === "string" ? journal["updatedAt"] : "";
+        if (newest !== null && newest.at >= at)
+            continue;
+        newest = { at, head: typeof journal["candidate"] === "string" ? journal["candidate"] : null, run: Number.isSafeInteger(journal["builder"]) ? Number(journal["builder"]) : null };
+    }
+    return newest === null ? null : { head: newest.head, run: newest.run };
+}
+/** The folder beside the database (where staged releases live), or null for a database in memory. */
+function stateDirOf(store) {
+    const main = store.handle.prepare("PRAGMA database_list").all().find(row => row["name"] === "main");
+    return typeof main?.["file"] === "string" && main["file"] !== "" ? dirname(main["file"]) : null;
+}
+/**
+ * Which release a gate belongs to: a failed gate is re-filed as the same name plus a letter (`release-x`, then
+ * `release-xb`, `release-xc` …), so a gate whose name is another gate's in the same project plus one letter is that
+ * release's.
+ */
+export function releaseOf(id, gates) {
+    return /[b-z]$/.test(id) && gates.has(id.slice(0, -1)) ? id.slice(0, -1) : id;
+}
 const STRENGTH = { "in use": 5, "task not finished": 4, "waiting for review": 3, "release candidate": 2 };
 const strength = (one) => one === undefined ? -1 : one.keep === null ? 0 : STRENGTH[one.keep] ?? 1;
 const stronger = (a, b) => strength(b) > strength(a) || (strength(b) === 0 && strength(a) === 0 && (b.finishedAt ?? "") > (a.finishedAt ?? "")) ? b : a;
 /** Where every task stands for cleanup, by task_ref id and by each branch it or its runs used. */
-export function taskStatuses(store, now) {
+export function taskStatuses(store, now, deployed) {
     const db = store.handle;
     const refs = db.prepare(`SELECT r.id AS ref, r.external_id AS id, r.revision_of AS revision_of, t.state AS state, t.updated_at AS updated_at,
       EXISTS (SELECT 1 FROM hold h WHERE h.task_ref = r.id) AS held,
       EXISTS (SELECT 1 FROM run live WHERE live.task_ref = r.id AND live.finished_at IS NULL) AS live,
-      EXISTS (SELECT 1 FROM task_scope s WHERE s.task_id = r.external_id AND s.candidate IS NOT NULL) AS candidate
+      (SELECT MAX(s.candidate) FROM task_scope s WHERE s.task_id = r.external_id) AS candidate, r.repo AS repo
     FROM task_ref r LEFT JOIN task t ON t.id = r.external_id AND r.backend = 'built-in'`).all();
     const runs = db.prepare("SELECT id, task_ref, branch FROM run").all();
     const refOfRun = new Map(runs.map(row => [Number(row["id"]), Number(row["task_ref"])]));
+    // Release candidates: per project and release, the newest gate not cancelled; and the one deployed.
+    const gates = refs.filter(row => row["candidate"] !== null);
+    const gateIds = new Map();
+    for (const row of gates) {
+        const repo = String(row["repo"]);
+        gateIds.set(repo, (gateIds.get(repo) ?? new Set()).add(String(row["id"])));
+    }
+    const releaseKey = (row) => `${String(row["repo"])}\u0000${releaseOf(String(row["id"]), gateIds.get(String(row["repo"])))}`;
+    const newestGate = new Map();
+    for (const row of gates) {
+        if (row["state"] === "cancelled")
+            continue;
+        const key = releaseKey(row);
+        newestGate.set(key, Math.max(newestGate.get(key) ?? -1, Number(row["ref"])));
+    }
+    const live = deployed === undefined ? deployedRelease(stateDirOf(store)) : deployed;
+    const deployedRef = live === null ? undefined : live.run !== null ? refOfRun.get(live.run) : undefined;
+    const isDeployed = (row) => live !== null &&
+        (Number(row["ref"]) === deployedRef || (live.head !== null && String(row["candidate"]) === live.head));
     // The completion names its family's root; its run names the result it completes.
     const completed = new Map();
     const completedRef = new Map();
@@ -59,16 +125,22 @@ export function taskStatuses(store, now) {
         const id = String(row["id"]);
         const state = row["state"] === null ? null : String(row["state"]);
         const updated = row["updated_at"] === null ? null : String(row["updated_at"]);
+        const gate = row["candidate"] !== null;
         let status;
         if (Number(row["live"]) === 1)
             status = { keep: "in use", taskId: id, finishedAt: null };
+        else if (gate && isDeployed(row))
+            status = { keep: "release candidate", taskId: id, finishedAt: updated };
+        // A superseded or cancelled gate goes at once, whatever its task's state: a newer gate (or none) is the release.
+        else if (gate && (state === "cancelled" || newestGate.get(releaseKey(row)) !== ref))
+            status = { keep: null, taskId: id, finishedAt: updated, atOnce: true };
         else if (state === null || Number(row["held"]) === 1 || (state !== "done" && state !== "cancelled"))
             status = { keep: "task not finished", taskId: id, finishedAt: null };
         else if (state === "cancelled")
             status = { keep: null, taskId: id, finishedAt: updated };
         else {
             const completedAt = [completed.get(id), completedRef.get(ref)].filter((one) => one !== undefined).sort().at(-1) ?? null;
-            if (Number(row["candidate"]) === 1) {
+            if (gate) {
                 const since = completedAt ?? updated ?? now.toISOString();
                 const until = new Date(Date.parse(since) + CANDIDATE_KEEP_MS).toISOString();
                 status = until > now.toISOString() ? { keep: "release candidate", taskId: id, finishedAt: since, dueAt: until } : { keep: null, taskId: id, finishedAt: since };
@@ -119,6 +191,17 @@ function statusOf(row, statuses) {
     }
     return found;
 }
+/** The let-go checkouts whose task is complete or cancelled, and when it finished. Not a release candidate's that
+ * stays: a deploy runs from it. */
+export function finishedCheckouts(store, now, repo) {
+    const statuses = taskStatuses(store, now);
+    return store.listWorktrees().filter(row => row.releasedAt !== null && row.runner === null && (repo === undefined || row.repo === repo)).flatMap(row => {
+        const status = statusOf(row, statuses);
+        if (status === undefined || status.finishedAt === null || status.keep !== null)
+            return [];
+        return [{ row, taskId: status.taskId, finishedAt: status.finishedAt }];
+    });
+}
 /** Why a checkout stays before anyone looks at its files, or null: it may go (as far as its task and the setting say). */
 function keptFor(pool, row, statuses, now, cleanup) {
     const status = statusOf(row, statuses);
@@ -136,6 +219,8 @@ function keptFor(pool, row, statuses, now, cleanup) {
         return { why: null, taskId };
     if (cleanup === "never")
         return { why: "cleanup is off", taskId };
+    if (status.atOnce === true)
+        return { why: null, taskId };
     const days = CLEANUP_CHOICES.find(one => one.value === cleanup).days;
     const since = [status.finishedAt, row.releasedAt].filter((one) => one !== null).sort().at(-1);
     const dueAt = new Date(Date.parse(since) + days * DAY_MS).toISOString();
@@ -215,6 +300,41 @@ export async function cleanCheckouts(store, pool, now, options) {
     }
     return { removed, kept: pruned.kept, freed: removed.reduce((sum, one) => sum + one.bytes, 0) };
 }
+/** Checkouts this process already looked at since they were let go (path and release time): looked at once. */
+const looked = new Set();
+/**
+ * A kept checkout (its result waiting for review, or with changes) drops its dependencies and build output once its
+ * run has ended; the next run's setup restores them (node_modules only goes where the project has a setup to restore
+ * it). Never one in use or a release candidate (a deploy installs from it). Each in the ledger.
+ */
+export async function slimKeptCheckouts(store, pool, now, options) {
+    const rows = store.listWorktrees().filter(row => row.releasedAt !== null && row.runner === null && (options.repo === undefined || row.repo === options.repo)
+        && !looked.has(`${row.path}\u0000${row.releasedAt}`) && existsSync(row.path));
+    const slimmed = [];
+    if (rows.length === 0)
+        return { slimmed };
+    const keptAs = (row) => keptFor(pool, row, taskStatuses(store, now()), now(), "manual");
+    const statuses = taskStatuses(store, now());
+    for (const row of rows) {
+        const kept = keptFor(pool, row, statuses, now(), "manual");
+        if (kept.why === "in use")
+            continue;
+        looked.add(`${row.path}\u0000${row.releasedAt}`);
+        if (kept.why === "release candidate")
+            continue;
+        if (kept.why !== "waiting for review" && await pool.inspect(row.path) !== "has changes")
+            continue;
+        const wanted = (fresh) => { const why = keptAs(fresh).why; return why !== "in use" && why !== "release candidate"; };
+        const done = await pool.slim(row, wanted, store.liveWorktreeSetup(row.repo) !== null);
+        if (!done.ok || done.dropped.length === 0)
+            continue;
+        const bytes = done.bytes;
+        slimmed.push({ path: row.path, taskId: kept.taskId, dropped: done.dropped, bytes });
+        store.recordAction({ at: now().toISOString(), actor: options.actor, repo: row.repo, taskId: kept.taskId, runId: null, action: "checkout slimmed", outcome: "removed", source: "work",
+            detail: `${basename(row.path)}: dropped ${done.dropped.join(", ")}${bytes > 0 ? ` (about ${bytesWords(bytes)})` : ""}; the next run's setup restores them` });
+    }
+    return { slimmed };
+}
 /** Throw away a checkout kept for its changes, on purpose; its branch stays. In the ledger. */
 export async function discardCheckout(store, pool, path, now, actor) {
     const bytes = existsSync(path) ? diskBytes([path]).get(path) ?? 0 : 0;
@@ -233,7 +353,7 @@ export function whyWords(item) {
         case "in use": return "in use";
         case "task not finished": return "its task isn't finished";
         case "waiting for review": return "its result is waiting for review";
-        case "release candidate": return `release candidate, kept until ${item.dueAt?.slice(0, 10) ?? "a week after"}`;
+        case "release candidate": return item.dueAt === undefined ? "the deployed release candidate" : `newest release candidate, kept until ${item.dueAt.slice(0, 10)}`;
         case "has changes": return "has changes";
         case "has commits": return "has commits on no branch";
         case "unreadable": return "git couldn't read it";

package/dist/cli.js

@@ -213,6 +213,7 @@ export const OPERATE_COMMANDS = new Set([
     "restore",
     "export",
     "policy",
+    "review",
     "assignment",
     "knowledge",
     "memory",
@@ -243,6 +244,7 @@ export const OPERATE_COMMANDS = new Set([
     "bridge",
     "publish",
     "reconcile",
+    "run",
     "routine",
     "flows",
     "config", "chat", "proposals", "mode", "people", "keys",