toolroll 0.9.71 → 0.9.72

package/dist/invoke.js

@@ -24,6 +24,7 @@ import { classifyTerminal } from "./exhaustion.js";
 import { liftAuthPause } from "./provider-auth.js";
 import { attestProvider } from "./attest.js";
 import { run as runCommand, runOwnerTag, streamsInput } from "./exec.js";
+import { spawnSync } from "node:child_process";
 import { currentContainment } from "./containment.js";
 import { witnessedRunner } from "./process-custody.js";
 import { underStopWatch } from "./task-control.js";
@@ -1017,9 +1018,8 @@ export function fencedCommands(store, runId, writes, inner, available = () => ma
                     ...options,
                     fence: fenced.fence,
                     // Each sign-in file looked at again right before the launch: one no longer itself isn't granted.
-                    // With sign-ins, the keychain too (Claude Code keeps its macOS sign-in there), only while a person still set it.
-                    fenceGrants: signIns === null ? grants : { ...grants, signIns: { ...signIns.grants, read: signIns.grants.read.filter(path => signInIsItself(realpathSync(homedir()), path)) }, network: signIns.network,
-                        ...(signInsKeychain(store, checkout === null ? null : store.getWorktree(checkout)?.repo ?? null) ? { keychain: true } : {}) },
+                    // Never the keychain: the sign-ins kept there come in the environment, read outside (keychainSignIns).
+                    fenceGrants: signIns === null ? grants : { ...grants, signIns: { ...signIns.grants, read: signIns.grants.read.filter(path => signInIsItself(realpathSync(homedir()), path)) }, network: signIns.network },
                     confinement: "required",
                     env: { ...(options?.env ?? {}), TMPDIR: temp, TMP: temp, TEMP: temp, ...(fenced.cache === undefined || fenced.grants.writes === undefined ? {} : buildCacheEnv(fenced.cache)), ...(signIns?.env ?? {}) },
                     ...(signIns === null ? {} : { omitEnv: [...(options?.omitEnv ?? []), ...SIGN_INS_OMITTED_ENV] }),
@@ -1088,9 +1088,8 @@ export function fencedCheckoutCommands(store, repo, checkout, inner, available =
                     ...options,
                     fence: launch.fence,
                     // Each sign-in file looked at again right before the launch: one no longer itself isn't granted.
-                    // With sign-ins, the keychain too (Claude Code keeps its macOS sign-in there), only while a person still set it.
-                    fenceGrants: signIns === null ? grants : { ...grants, signIns: { ...signIns.grants, read: signIns.grants.read.filter(path => signInIsItself(realpathSync(homedir()), path)) }, network: signIns.network,
-                        ...(signInsKeychain(store, repo) ? { keychain: true } : {}) },
+                    // Never the keychain: the sign-ins kept there come in the environment, read outside (keychainSignIns).
+                    fenceGrants: signIns === null ? grants : { ...grants, signIns: { ...signIns.grants, read: signIns.grants.read.filter(path => signInIsItself(realpathSync(homedir()), path)) }, network: signIns.network },
                     confinement: launch.confinement,
                     env: { ...(options?.env ?? {}), TMPDIR: temp, TMP: temp, TEMP: temp, ...(allowed === null ? {} : buildCacheEnv(cache)), ...(signIns?.env ?? {}) },
                     ...(signIns === null ? {} : { omitEnv: [...(options?.omitEnv ?? []), ...SIGN_INS_OMITTED_ENV] }),
@@ -1178,19 +1177,50 @@ const SIGN_INS_OMITTED_ENV = ["CLAUDE_CONFIG_DIR"];
  * started unless all of it is.
  */
 /**
- * Whether a check with sign-ins also reaches the keychain (macOS securityd: any item every program may read, not only
- * the sign-ins). Only while the project's sign-ins level stands as a person set it: widening to sign-ins takes an
- * instance operator's password typed now (operate.ts project check-access, Settings → Project → Check access), and the
- * one who set it must still be an approver for the project and an instance operator now. Anything else: no keychain.
+ * macOS: the sign-ins a check with sign-ins needs that live in the keychain, not in files: Claude Code's
+ * ("Claude Code-credentials", its current access token as CLAUDE_CODE_OAUTH_TOKEN) and gh's ("gh:github.com", as
+ * GH_TOKEN). Read here, by Toolroll, outside the sandbox, and handed to the check in its environment, so the check never
+ * reaches securityd (sandbox-runtime.ts SEATBELT_NO_KEYCHAIN) and nothing else in the keychain. The check can't renew
+ * Claude's token: one that has expired fails its sign-in. A value that isn't a plain token is left out.
  */
-export function signInsKeychain(store, repo) {
-    if (repo === null || store.projectCheckAccess(repo) !== "sign-ins")
-        return false;
-    const change = store.projectCheckAccessChange(repo);
-    const account = change === null ? null : store.accountOf(change.by);
-    return account !== null && account.revokedAt === null && account.role === "approver" && store.accountCanAccess(change.by, repo) && store.isInstanceOperator(change.by);
+export const KEYCHAIN_SIGN_INS = [
+    { service: "Claude Code-credentials", env: "CLAUDE_CODE_OAUTH_TOKEN", token: secret => {
+            try {
+                const token = JSON.parse(secret).claudeAiOauth?.accessToken;
+                return typeof token === "string" ? token : null;
+            }
+            catch {
+                return null;
+            }
+        } },
+    // go-keyring (gh's) may keep it base64-encoded behind a prefix.
+    { service: "gh:github.com", env: "GH_TOKEN", token: secret => secret.startsWith("go-keyring-base64:") ? Buffer.from(secret.slice("go-keyring-base64:".length), "base64").toString("utf8") : secret },
+];
+const PLAIN_TOKEN = /^[A-Za-z0-9._~+/=-]{8,4096}$/;
+/** One keychain item's secret by its service, read with the system's `security` (null: none, or it can't be read). A
+ * keychain file may be named (tests: a throwaway one); never the item's value in an argument. */
+export function readKeychainSecret(service, keychain) {
+    const read = spawnSync("/usr/bin/security", ["find-generic-password", "-s", service, "-w", ...keychain === undefined ? [] : [keychain]], { encoding: "utf8", timeout: 10_000, env: { PATH: "/usr/bin:/bin", HOME: homedir() }, stdio: ["ignore", "pipe", "ignore"] });
+    return read.status === 0 && typeof read.stdout === "string" ? read.stdout.replace(/\n$/, "") : null;
+}
+/** The keychain's sign-ins as a check's environment (macOS only; elsewhere, for anything missing, and where Toolroll
+ * keeps nothing in the keychain (TOOLROLL_SECRET_STORE=files: the test suite), nothing). */
+export function keychainSignIns(platform = process.platform, read) {
+    if (platform !== "darwin")
+        return {};
+    if (read === undefined && process.env["TOOLROLL_SECRET_STORE"] === "files")
+        return {};
+    read ??= service => readKeychainSecret(service);
+    const env = {};
+    for (const one of KEYCHAIN_SIGN_INS) {
+        const secret = read(one.service);
+        const token = secret === null ? null : one.token(secret);
+        if (token !== null && PLAIN_TOKEN.test(token))
+            env[one.env] = token;
+    }
+    return env;
 }
-export async function signInsLaunch(store, own, temp, checkout, policy, gitPaths, platform = process.platform) {
+export async function signInsLaunch(store, own, temp, checkout, policy, gitPaths, platform = process.platform, keychain = () => keychainSignIns(platform)) {
     if (!signInsAvailable(platform))
         return { problem: "Sign-ins can't be shared with checks here, so nothing ran." };
     const home = homedir();
@@ -1198,7 +1228,7 @@ export async function signInsLaunch(store, own, temp, checkout, policy, gitPaths
     let egress = null;
     const close = async () => { await egress?.close(); };
     try {
-        const env = { CODEX_HOME: join(home, ".codex"), GH_CONFIG_DIR: join(home, ".config", "gh"), XDG_CONFIG_HOME: join(home, ".config") };
+        const env = { CODEX_HOME: join(home, ".codex"), GH_CONFIG_DIR: join(home, ".config", "gh"), XDG_CONFIG_HOME: join(home, ".config"), ...keychain() };
         if (policy.mode === "open")
             return { grants, network: { mode: "open" }, env, close };
         // Exactly the project's network: the services the sign-ins are for are reached only if the operator allowed their

package/dist/lead-status.js

@@ -122,13 +122,16 @@ export function taskWaitSnapshot(store, taskId, now, watchedRun) {
     const scope = store.handle.prepare(`SELECT digest, approved_digest, profile_state,
     (approved_at IS NOT NULL AND approved_by IS NOT NULL AND approved_digest = digest) AS approved
     FROM task_scope WHERE task_id = ?`).get(taskId);
-    if (task["plan"] === "drafted" && Number(scope?.["approved"]) !== 1)
+    // Approved only as dispatch reads it (approval policy): a seal whose authority doesn't stand — an old seal a lead token
+    // made, an ended mode — waits for a person, never for a worker.
+    const approvedNow = Number(scope?.["approved"]) === 1 && store.modeApprovalLive(taskRef, now);
+    if (task["plan"] === "drafted" && !approvedNow)
         return answer("Needs a person", "Approve plan", true, 1, "needs-person");
     if (Number(task["strikes"] ?? 0) >= 3)
         return answer("Needs a person", "Review repeated failures", true, 1, "needs-person");
     if (scope === undefined)
         return answer("Needs a person", "Add scope", true, 1, "needs-person");
-    if (Number(scope["approved"]) !== 1 || scope["profile_state"] !== "resolved")
+    if (!approvedNow || scope["profile_state"] !== "resolved")
         return answer("Needs a person", "Approve task", true, 1, "needs-person");
     if (state === "running" && attempt === undefined) {
         const liveClaim = store.handle.prepare(`SELECT 1 AS hit FROM claim INDEXED BY claim_by_task

package/dist/live-terminal.d.ts

@@ -202,9 +202,11 @@ export declare class TerminalHost {
      * End the program and everything that is its own: SIGHUP to every member (an interactive shell gives each job its own
      * process group, so the leader's group is not enough), then SIGKILL, re-reading the process table each time so a
      * child started during the close is caught too. Membership is the leader's descendants, every process with this
-     * terminal as its controlling terminal (started before the program ended), and every one noted while it ran, by pid
-     * and start time. A process that detached itself from the terminal AND its parents before it was noted is not seen —
-     * the same as any terminal. Resolves when the sweep is done; never waits without bound.
+     * terminal as its controlling terminal while the program runs, and every one noted while it ran, by pid and start
+     * time (membersOf). Each signal goes only to a process still that pid and start time; a process on the terminal after
+     * the program ended that was never noted, or a pid now someone else's, is never signalled and leaves the close
+     * uncertain. A process that detached itself from the terminal AND its parents before it was noted is not seen — the
+     * same as any terminal. Resolves when the sweep is done; never waits without bound.
      */
     close(id: string, by?: "owner" | "console"): Promise<void>;
     private sweep;
@@ -231,15 +233,17 @@ export type ProcessTable = Map<number, {
 export declare function readProcessTable(): ProcessTable | null;
 /**
  * A terminal's processes in this table, by pid and start time: what was noted while it ran (still the same process),
- * the leader, everything whose controlling terminal is its terminal and that started before it ended (a later process
- * on a reused device is someone else's), and every descendant of those. Never this console itself.
+ * the leader while it runs, everything whose controlling terminal is its terminal while it runs, and every descendant
+ * of those. Never this console itself. Once the program has ended its terminal's name is no one's proof: the device
+ * may already be someone else's, so a process on it that wasn't noted is not a member; it goes in `ambiguous` (when
+ * given), and the close that meets one says it is uncertain rather than signal it.
  */
 export declare function membersOf(table: ProcessTable, session: {
     leader: number;
     tty: string | null;
     known: ReadonlyMap<number, string>;
     exitedAt: number | null;
-}): Map<number, string>;
+}, ambiguous?: Set<number>): Map<number, string>;
 /**
  * Each listed process's working directory (Linux: /proc; macOS: lsof), and which ones couldn't be read (a setgid
  * helper such as ssh-agent is unreadable even to its own user). Null when the lookup itself failed: a timeout, a signal

package/dist/live-terminal.js

@@ -388,9 +388,11 @@ export class TerminalHost {
      * End the program and everything that is its own: SIGHUP to every member (an interactive shell gives each job its own
      * process group, so the leader's group is not enough), then SIGKILL, re-reading the process table each time so a
      * child started during the close is caught too. Membership is the leader's descendants, every process with this
-     * terminal as its controlling terminal (started before the program ended), and every one noted while it ran, by pid
-     * and start time. A process that detached itself from the terminal AND its parents before it was noted is not seen —
-     * the same as any terminal. Resolves when the sweep is done; never waits without bound.
+     * terminal as its controlling terminal while the program runs, and every one noted while it ran, by pid and start
+     * time (membersOf). Each signal goes only to a process still that pid and start time; a process on the terminal after
+     * the program ended that was never noted, or a pid now someone else's, is never signalled and leaves the close
+     * uncertain. A process that detached itself from the terminal AND its parents before it was noted is not seen — the
+     * same as any terminal. Resolves when the sweep is done; never waits without bound.
      */
     close(id, by = "owner") {
         const session = this.sessions.get(id);
@@ -408,19 +410,30 @@ export class TerminalHost {
         const pause = sleep;
         const leaderGone = () => session.pty === null;
         let readable = true;
+        // Processes on its terminal after it ended that were never noted: maybe someone else's, never signalled.
+        const ambiguous = new Set();
         const members = () => {
             const table = this.processes();
             if (table === null) {
                 readable = false;
                 return new Map();
             }
-            const found = membersOf(table, session);
+            const found = membersOf(table, session, ambiguous);
             for (const [pid, started] of found)
                 session.known.set(pid, started);
             return found;
         };
+        // Each signal goes only to the process it was meant for: the table is read again right before, and a pid whose
+        // start time is no longer the one recorded (gone, or a pid used again) is skipped, and the close is uncertain. The
+        // leader's group only while it runs: its pid is our unreaped child until the pty reports its exit, and, where the
+        // table reads, still the leader that started. A table that can't be read signals the leader alone (the close is
+        // uncertain then anyway).
         const signal = (found, name) => {
-            if (!leaderGone()) {
+            const table = this.processes();
+            if (table === null)
+                readable = false;
+            const leaderStarted = session.known.get(session.leader);
+            if (!leaderGone() && (table === null || (leaderStarted !== undefined && table.get(session.leader)?.started === leaderStarted))) {
                 try {
                     process.kill(-session.leader, name);
                 }
@@ -430,7 +443,16 @@ export class TerminalHost {
                 }
                 catch { /* gone */ }
             }
-            for (const pid of found.keys()) {
+            if (table === null)
+                return;
+            for (const [pid, started] of found) {
+                const now = table.get(pid);
+                if (now === undefined)
+                    continue;
+                if (now.started !== started) {
+                    ambiguous.add(pid);
+                    continue;
+                }
                 try {
                     process.kill(pid, name);
                 }
@@ -457,13 +479,26 @@ export class TerminalHost {
                 }
             }
             for (let round = 0; round < 20; round += 1) {
-                const found = members();
+                let found = members();
                 if (!readable)
                     return;
                 if (found.size === 0 && leaderGone()) {
                     cleanup = "clean";
                     return;
                 }
+                // Stopped first, then read again until nothing new appears: a stopped process can't fork, so a child one started
+                // just before it stopped is still its descendant here and is killed with it. Killed while running, a parent can
+                // fork between the read and the kill, and its child goes to launchd unnoted.
+                for (let settle = 0; settle < 5; settle += 1) {
+                    signal(found, "SIGSTOP");
+                    const again = members();
+                    if (!readable)
+                        return;
+                    const grew = [...again.keys()].some(pid => !found.has(pid));
+                    found = again;
+                    if (!grew)
+                        break;
+                }
                 signal(found, "SIGKILL");
                 await pause(100);
             }
@@ -486,7 +521,7 @@ export class TerminalHost {
                     }
                 }
             }
-            session.cleanup = readable && leaderGone() ? cleanup : "uncertain";
+            session.cleanup = readable && leaderGone() && ambiguous.size === 0 ? cleanup : "uncertain";
             if (session.endedAt === null)
                 session.endedAt = this.clock().toISOString();
             this.ledger.release(session.id, session.cleanup);
@@ -575,19 +610,21 @@ export function readProcessTable() {
 }
 /**
  * A terminal's processes in this table, by pid and start time: what was noted while it ran (still the same process),
- * the leader, everything whose controlling terminal is its terminal and that started before it ended (a later process
- * on a reused device is someone else's), and every descendant of those. Never this console itself.
+ * the leader while it runs, everything whose controlling terminal is its terminal while it runs, and every descendant
+ * of those. Never this console itself. Once the program has ended its terminal's name is no one's proof: the device
+ * may already be someone else's, so a process on it that wasn't noted is not a member; it goes in `ambiguous` (when
+ * given), and the close that meets one says it is uncertain rather than signal it.
  */
-export function membersOf(table, session) {
+export function membersOf(table, session, ambiguous) {
     const found = new Map();
-    const startedMs = (started) => Date.parse(started);
+    const live = session.exitedAt === null;
+    const onTerminal = (tty) => session.tty !== null && tty === session.tty;
     for (const [pid, row] of table) {
         if (pid === process.pid || pid <= 1)
             continue;
         const noted = session.known.get(pid);
-        const ownTty = session.tty !== null && row.tty === session.tty && (session.exitedAt === null || startedMs(row.started) <= session.exitedAt + 1_000);
         // The leader by pid only while it runs: after it exits its pid may be someone else's (it is noted by start time).
-        if (noted === row.started || (pid === session.leader && session.exitedAt === null) || ownTty)
+        if (noted === row.started || (pid === session.leader && live) || (live && onTerminal(row.tty)))
             found.set(pid, row.started);
     }
     for (let grew = true; grew;) {
@@ -598,6 +635,10 @@ export function membersOf(table, session) {
                 grew = true;
             }
     }
+    if (ambiguous !== undefined && !live)
+        for (const [pid, row] of table)
+            if (!found.has(pid) && pid !== process.pid && pid > 1 && onTerminal(row.tty))
+                ambiguous.add(pid);
     return found;
 }
 /**

package/dist/nightly-check.d.ts

@@ -0,0 +1,104 @@
+import { fileIdentity, groupIdentity, journeyIdentity, unitIdentity, versionIdentity, type CheckReport } from "./contracts/release-check.js";
+import type { StandingOrder } from "./contracts/flow.js";
+import { type Store } from "./store.js";
+import type { Runner } from "./worktree.js";
+import type { StandingFiring } from "./flow-schedule.js";
+/** How long a nightly may be missing before its flow says so. */
+export declare const NIGHTLY_MISSED_MS: number;
+export declare const NIGHTLY_STEM = "nightly";
+export type MainCheck = NonNullable<StandingOrder["check"]>;
+/** What every nightly firing files: fixed here, never read from the trigger's settings. */
+export declare const NIGHTLY_GOAL = "Run the full release check on main's head.";
+export declare const NIGHTLY_NOT = "Changing anything: this is a check only.";
+export declare const NIGHTLY_ACCEPTANCE: readonly {
+    id: string;
+    statement: string;
+    how: null;
+    evidence: "check"[];
+}[];
+/** The ledger act that records a person's approval of a nightly check, keyed by its trigger. */
+export declare const NIGHTLY_APPROVED = "nightly check approved";
+/** The digest a person's approval of the nightly signs: the trigger, the project, the schedule, the check-only terms
+ * and the fixed words each firing files. */
+export declare function nightlyDigestOf(trigger: number, repo: string, schedule: string, check: MainCheck): string;
+/**
+ * The approval of a nightly check as the plane recorded it when a person proved themselves (createNightlyCheckFlow):
+ * the newest ledger row for this trigger. The trigger's own settings never stand in for it — anyone who can edit them
+ * could write one.
+ */
+export declare function nightlyApprovalOf(store: Store, trigger: number): {
+    digest: string;
+    by: string;
+    proof: string;
+    at: string;
+} | null;
+/** How often the watch loop reads each recorded remote's main again, and how old a read may be when a nightly fires
+ * or debt is cleared against it (review round 2: one window, two refreshes wide, for both decisions). */
+export declare const TRUSTED_MAIN_REFRESH_MS: number;
+export declare const TRUSTED_MAIN_FIRE_MS: number;
+export declare const TRUSTED_MAIN_CLEAR_MS: number;
+/**
+ * Main's head as Toolroll's own process last read it from the project's RECORDED remote (remote-main.ts: the recorded
+ * URL, a private plane-owned Git directory, objects that arrive only by fetch) — never a ref in the project's Git
+ * directory, which a build shares and can move (review round 1). Null when there is no read young enough, when the
+ * last read failed, or when the read was of another remote than the one recorded now (review round 2).
+ */
+export declare function trustedMainOf(store: Store, repo: string, now: Date, maxAgeMs: number): string | null;
+/** The watch loop's read of each project's recorded remote main that the nightly check or main's debt needs, at most
+ * every 30 minutes. Each read is a fresh fetch into a private directory. A failed read forgets the last one. A good
+ * one hands its verified objects to the project's Git store (hardened git, content-addressed: git checks every object
+ * against its hash, and filing verifies the commit again), so the nightly can check a merge the checkout never pulled. */
+export declare function refreshTrustedMains(store: Store, root: string, now: Date, runner?: Runner): Promise<number>;
+/**
+ * Set up the nightly full check for a project, approved by a person proved now (their password or a re-check; never a
+ * lead or remote token). Its schedule starts paused unless `start`; turning it on is the flow's own switch.
+ */
+export declare function createNightlyCheckFlow(store: Store, input: {
+    repo: string;
+    schedule: string;
+    as: string;
+    token: string;
+    start: boolean;
+}, now: Date): {
+    ok: true;
+    flow: number;
+    trigger: number;
+} | {
+    ok: false;
+    message: string;
+};
+/** A nightly firing (fileStandingOrder routes here): the approval checked again, main's head read, one check-only task
+ * filed and sealed by its standing order. */
+export declare function fileNightlyCheck(store: Store, input: {
+    flowId: number;
+    repo: string;
+    trigger: number;
+    schedule: string;
+    order: StandingOrder;
+    title: string;
+    slot: string;
+}, now: Date): StandingFiring;
+/** Whether a task is a nightly check of main (check only: it never deploys, merges or completes). */
+export declare const isNightlyTask: (store: Store, taskId: string) => boolean;
+/** Every item a failed check failed: each failed identity, each failed group or version, and the whole part for a
+ * part that couldn't say which items (it stopped, never reported, or crashed). No report: every part. */
+export declare function failedItems(report: CheckReport | null): string[];
+/** The words of one failure notice: "2 unit files, app/pages". */
+export declare function failureSummary(items: readonly string[]): string;
+/**
+ * Whether a full run's report shows `item` itself ran and PASSED there (security review): a failed identity has to be
+ * reported passed by name — missing, skipped, or a passing part around it never clears it. A part-level item clears
+ * when that whole part ran and passed.
+ */
+export declare function coversItem(report: CheckReport, item: string): boolean;
+/**
+ * The plane's sweep (watch's follow-up checks): settle each finished nightly (failure rows and one attention notice),
+ * then let each finished full release check clear the main failures it covers. Returns how many it settled.
+ */
+export declare function settleReleaseChecks(store: Store, root: string, now: Date): number;
+/** The nightly's flow health: "the nightly check hasn't run since …" after 26 hours without a firing. Null when it ran
+ * recently, or the project has no nightly check. */
+export declare function nightlyHealthWords(store: Store, repo: string, configuredAt: string, now: Date): string | null;
+export { fileIdentity, groupIdentity, journeyIdentity, unitIdentity, versionIdentity };
+/** The items the nightly check of main found failing that are still open: a full check reports each by name. */
+export declare function openMainFailureItems(store: Store, repo: string): string[];