toolroll 0.9.73 → 0.9.75

package/dist/project-learning.js

@@ -1,8 +1,9 @@
 /** Optional, project-local advice. Core review and approval never depend on it. */
+import { inReadOnlyRequest } from "./read-only-request.js";
 import { createHash } from 'node:crypto';
 import { execFileSync } from 'node:child_process';
-import { realpathSync, statSync } from 'node:fs';
-import { resolve } from 'node:path';
+import { closeSync, constants as fsConstants, existsSync, fstatSync, lstatSync, openSync, readSync, realpathSync, statSync } from 'node:fs';
+import { join, resolve } from 'node:path';
 import { readVerifiedArtifact, scanForSecrets } from './evidence.js';
 import { normalizeStructuredJson } from "./structured-output.js";
 import { parseReviewContext, reviewContextCustodyProblem } from "./review-context.js";
@@ -50,7 +51,8 @@ const git = (repo, args, seen) => {
     const known = seen?.get(key);
     if (known !== undefined)
         return known;
-    const out = execFileSync('git', ['--no-optional-locks', '-C', repo, ...args], { encoding: 'utf8', maxBuffer: 2 * 1024 * 1024, stdio: ['ignore', 'pipe', 'pipe'] }).trimEnd();
+    // Bounded, and no hook or fsmonitor program: it also runs from the console's background pass.
+    const out = execFileSync('git', ['--no-optional-locks', '-c', 'core.fsmonitor=false', '-c', 'core.hooksPath=/dev/null', '-C', repo, ...args], { encoding: 'utf8', maxBuffer: 2 * 1024 * 1024, timeout: 10_000, stdio: ['ignore', 'pipe', 'pipe'] }).trimEnd();
     seen?.set(key, out);
     return out;
 };
@@ -62,9 +64,42 @@ export const legacyIdentityOf = (repo, common, st) => learningSha(JSON.stringify
 function identityFacts(repo, seen) {
     if (canonicalProject(repo) !== repo)
         throw new Error('Project identity changed.');
-    const common = realpathSync(resolve(repo, git(repo, ['rev-parse', '--git-common-dir'], seen)));
+    // A page visit starts no git (docs/plans/get-side-effects.md): it reads the same answer from the folder itself.
+    const common = realpathSync(resolve(repo, inReadOnlyRequest() ? commonDirOnDisk(repo) : git(repo, ['rev-parse', '--git-common-dir'], seen)));
     return { common, st: statSync(common) };
 }
+/** The shared Git folder as git finds it for a checkout: `.git` itself, or the folder a `.git` file names, through its
+ * `commondir` when it is a linked worktree. Throws when the folder holds neither. */
+function commonDirOnDisk(repo) {
+    const dotGit = join(repo, '.git');
+    if (lstatSync(dotGit).isDirectory())
+        return dotGit;
+    const named = /^gitdir: (.+)$/m.exec(smallFile(dotGit))?.[1]?.trim();
+    if (!named)
+        throw new Error('Project identity is unavailable.');
+    const gitDir = resolve(repo, named);
+    if (!lstatSync(gitDir).isDirectory())
+        throw new Error('Project identity is unavailable.');
+    const commondir = join(gitDir, 'commondir');
+    if (!existsSync(commondir))
+        return gitDir;
+    return resolve(gitDir, smallFile(commondir).trim());
+}
+/** A small plain file's text, read through one descriptor that follows no link and never waits (a FIFO, a device or a
+ * file swapped in between is refused, never read), at most 4 KiB. */
+function smallFile(path) {
+    const fd = openSync(path, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW | fsConstants.O_NONBLOCK);
+    try {
+        const st = fstatSync(fd);
+        if (!st.isFile() || st.size > 4096)
+            throw new Error('Project identity is unavailable.');
+        const buffer = Buffer.alloc(4096);
+        return buffer.subarray(0, readSync(fd, buffer, 0, 4096, 0)).toString('utf8');
+    }
+    finally {
+        closeSync(fd);
+    }
+}
 export function learningIdentity(repo, seen) {
     const { common, st } = identityFacts(repo, seen);
     return identityOf(repo, common, st);
@@ -114,7 +149,8 @@ export function reconcileIdentity(store, repo, seen, now = new Date()) {
     if (!done)
         reconciled.set(store, done = new Set());
     const key = `${repo}\n${legacy}`;
-    if (legacy !== current && !done.has(key)) {
+    // Carrying saved rows to the current identity is a write: never a page visit's (the background pass does it).
+    if (legacy !== current && !done.has(key) && !inReadOnlyRequest()) {
         if (!store.handle.prepare('SELECT 1 FROM project_identity_carry WHERE repo=? AND from_identity=? AND to_identity=?').get(repo, legacy, current)
             && store.handle.prepare(STORED_IDENTITY).get(repo, legacy)) {
             // Damaged knowledge history keeps its own error; retry on the next read.
@@ -413,7 +449,9 @@ function supported(store, root, lesson, seen) {
 }
 export function learningView(store, root, repo, actor, before = 0) {
     admission(store, repo, actor);
-    recoverLearning(store, root, repo);
+    // Recovering learning from reviewed runs writes: the console's background pass and each run's start do it.
+    if (!inReadOnlyRequest())
+        recoverLearning(store, root, repo);
     const identity = learningIdentity(repo), accepted = acceptedIdentities(store, repo);
     const p = store.handle.prepare('SELECT * FROM learning_policy WHERE repo=?').get(repo);
     const revision = Number(p?.['revision'] ?? 0), enabled = accepted.has(String(p?.['identity'])) && p?.['enabled'] === 1;

package/dist/project-tools.js

@@ -19,6 +19,7 @@
  * the agent. A tool connected by signing in gives a run only an access token
  * of its own (oauth-run-token.ts).
  */
+import { inReadOnlyRequest } from "./read-only-request.js";
 import { toolRefusal } from "./policy.js";
 import { createHash } from "node:crypto";
 import { spawn } from "node:child_process";
@@ -319,6 +320,23 @@ function moveIn(backend, folder, repo, tool) {
 export function readToolSecrets(repo, tool, state) {
     const folder = secretFolder(state);
     const backend = secretBackend();
+    // A page visit moves nothing (docs/plans/get-side-effects.md): it reads the store, else the file not yet moved in.
+    if (inReadOnlyRequest()) {
+        const stored = readStored(backend, folder, repo, tool);
+        if (stored !== null)
+            return stored;
+        for (const file of [legacyFile(folder, repo, tool), backend === null ? null : toolFile(folder, repo, tool, ".json")]) {
+            if (file === null || !existsSync(file))
+                continue;
+            try {
+                const values = readSecretFile(file);
+                if (values !== null)
+                    return values;
+            }
+            catch { /* kept as it is, and never used */ }
+        }
+        return {};
+    }
     moveIn(backend, folder, repo, tool);
     return readStored(backend, folder, repo, tool) ?? {};
 }
@@ -1067,7 +1085,7 @@ export function secretsSetFor(repo, tool, state) {
     if (names === null) {
         const values = readToolSecrets(repo, tool.name, state);
         names = Object.keys(values).filter(name => values[name] !== "");
-        if (backend !== null)
+        if (backend !== null && !inReadOnlyRequest())
             writeNames(folder, repo, tool.name, names);
     }
     return tool.secrets.filter(one => names.includes(one.name)).map(one => one.name);

package/dist/provider-limits.d.ts

@@ -24,7 +24,9 @@ export type LimitReading = {
     billing?: Billing;
 };
 export declare const record: (value: unknown) => Record<string, unknown> | null;
-/** A Claude stream event's limits, or null when it isn't a `rate_limit_event` or says nothing usable. */
+/** A Claude stream event's limits, or null when it isn't the session's own `rate_limit_event` or says nothing usable.
+ * A subagent's (parent_tool_use_id set) is never read: the session reports its own windows each turn, and a
+ * subagent-tagged reading can't be told apart from one shaped by the subagent's own traffic (stream-scope.ts). */
 export declare function claudeLimitsOf(event: unknown): LimitReading | null;
 /** Codex's `account/rateLimits/read` answer as a reading, or null. */
 export declare function codexLimitsOf(result: unknown): LimitReading | null;

package/dist/provider-limits.js

@@ -1,3 +1,4 @@
+import { topLevelEvent } from "./stream-scope.js";
 const WINDOW_NAME = /^[a-z][a-z0-9_]{0,39}$/;
 const CLAUDE_MINUTES = { five_hour: 300, seven_day: 10_080, seven_day_opus: 10_080, seven_day_sonnet: 10_080 };
 const finite = (value) => typeof value === "number" && Number.isFinite(value) ? value : null;
@@ -8,10 +9,12 @@ const epoch = (value) => {
     return seconds === null || seconds < 1_000_000_000 || seconds > 10_000_000_000 ? null : new Date(seconds * 1000).toISOString();
 };
 export const record = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
-/** A Claude stream event's limits, or null when it isn't a `rate_limit_event` or says nothing usable. */
+/** A Claude stream event's limits, or null when it isn't the session's own `rate_limit_event` or says nothing usable.
+ * A subagent's (parent_tool_use_id set) is never read: the session reports its own windows each turn, and a
+ * subagent-tagged reading can't be told apart from one shaped by the subagent's own traffic (stream-scope.ts). */
 export function claudeLimitsOf(event) {
     const body = record(event);
-    if (body === null || body["type"] !== "rate_limit_event")
+    if (body === null || body["type"] !== "rate_limit_event" || !topLevelEvent(body))
         return null;
     const info = record(body["rate_limit_info"]);
     if (info === null)

package/dist/provider.js

@@ -29,6 +29,7 @@ import { REVIEW_OUTPUT_LIMITS } from "./structured-output.js";
 import { ACP_AGENTS, isAcpProvider, withAcp } from "./acp-agents.js";
 import { acpParse } from "./acp-client.js";
 import { agentSpecSchema, MODEL_ID, modelIdSchema, PROVIDER_ID_VALUES, providerIdSchema } from "./contracts/provider.js";
+import { primaryResultEvent, topLevelEvent } from "./stream-scope.js";
 export const PROVIDER_IDS = PROVIDER_ID_VALUES;
 export function isProviderId(value) {
     return providerIdSchema.safeParse(value).success;
@@ -292,17 +293,6 @@ function claudeFinalMessage(result) {
     }
     return typeof result.result === "string" ? result.result : null;
 }
-/**
- * The primary-result allowlist (arc 1 finding 10): only an absent origin or
- * an explicit human origin can be the main query's accounting envelope.
- * Every other kind — task-notification, channel, peer, coordinator, and
- * anything the SDK grows later — fails closed as a non-primary result.
- */
-function claudePrimaryOrigin(event) {
-    if (event.origin === undefined || event.origin === null)
-        return true;
-    return typeof event.origin === "object" && String(event.origin["kind"] ?? "") === "human";
-}
 function claudeEnvelopeOf(result, sessionFromInit, initObserved, initSessionConflict = false) {
     const input = result?.usage?.input_tokens;
     const output = result?.usage?.output_tokens;
@@ -378,6 +368,10 @@ function claudeParse(stdout) {
         }
         if (event === null || typeof event !== "object")
             continue;
+        // A subagent's object (parent_tool_use_id set) is never the session's envelope, init, result or overflow witness
+        // (stream-scope.ts). The transport's own witness carries no parent and still counts.
+        if (!topLevelEvent(event))
+            continue;
         const type = event["type"];
         if (type === undefined) {
             // Legacy buffered envelope: one JSON object, no event framing.
@@ -404,7 +398,7 @@ function claudeParse(stdout) {
                 // replacement for the primary result's usage/accounting envelope.
                 transportFailure = result;
             }
-            if (primary === null && claudePrimaryOrigin(result))
+            if (primary === null && primaryResultEvent(event))
                 primary = result;
         }
     }

package/dist/pull-request-ui.d.ts

@@ -16,7 +16,7 @@ export type PullRequestSettingsView = {
     } | {
         ok: false;
         message: string;
-    } | null;
+    } | "unchecked" | null;
     said: string | null;
     problem: string | null;
 };

package/dist/pull-request-ui.js

@@ -22,8 +22,12 @@ export function pullRequestSettingsHtml(view) {
     const check = view.check;
     if (check === null)
         return html `${head}<section class="card pr-settings"><p><strong>Off</strong></p><p class="meta">An approver can turn on pull requests.</p></section>`;
+    // The checks ask git and GitHub, so they run when asked, never on opening the page (docs/plans/get-side-effects.md).
+    const checkButton = (label) => postForm("/settings/pull-requests/check", html `<button type="submit"${label === "Check again" ? html ` class="secondary"` : ""}>${label}</button>`, { hidden: { repo: view.repo } });
+    if (check === "unchecked")
+        return html `${head}<section class="card pr-settings"><p><strong>Off</strong></p><p class="meta">Check this project's GitHub setup to see what turning on would do.</p>${checkButton("Check setup")}</section>`;
     if (!check.ok) {
-        return html `${head}<section class="card pr-settings"><p><strong>Can’t turn on yet</strong></p><p>${check.message}</p><p><a class="button-link" href="/settings/pull-requests?repo=${encodeURIComponent(view.repo)}">Check again</a></p></section>`;
+        return html `${head}<section class="card pr-settings"><p><strong>Can’t turn on yet</strong></p><p>${check.message}</p>${checkButton("Check again")}</section>`;
     }
     const plan = check.plan;
     return html `${head}${post("on", html `<p><strong>Ready to turn on</strong></p><ul class="pr-terms"><li>Pull requests open on <span class="mono">${plan.githubRepo}</span> into <span class="mono">${plan.base}</span>${plan.account === null ? "" : `, as ${plan.account}`}.</li><li>Complete offers “Complete and open a pull request”, from the exact completed commit. A flow's Pull request zone can open one too.</li><li>Merging squashes and deletes the branch. A person merges with their password; a flow merges only when its zone says so, after a person approved the card.</li></ul>${password}<button type="submit">Turn on pull requests</button>`, { github: plan.githubRepo, base: plan.base })}`;

package/dist/push.d.ts

@@ -31,6 +31,8 @@ export type VapidKeys = {
     fingerprint: string;
 };
 export declare function vapidFingerprint(publicKey: string): string;
+/** Load the saved pair only (null when none is saved yet): what a page reads (docs/plans/get-side-effects.md). */
+export declare function loadVapidKeys(dir: string): VapidKeys | null;
 /**
  * Mint-or-load, atomically across processes (finding 29): exclusive
  * creation; the loser of a race re-reads the winner's file; and a loaded

package/dist/push.js

@@ -35,6 +35,10 @@ const fromB64url = (text) => Buffer.from(text, "base64url");
 export function vapidFingerprint(publicKey) {
     return createHash("sha256").update(publicKey, "utf8").digest("hex").slice(0, 16);
 }
+/** Load the saved pair only (null when none is saved yet): what a page reads (docs/plans/get-side-effects.md). */
+export function loadVapidKeys(dir) {
+    return readVapidKeys(join(dir, VAPID_FILE));
+}
 /**
  * Mint-or-load, atomically across processes (finding 29): exclusive
  * creation; the loser of a race re-reads the winner's file; and a loaded
@@ -43,25 +47,7 @@ export function vapidFingerprint(publicKey) {
  */
 export function loadOrCreateVapidKeys(dir) {
     const path = join(dir, VAPID_FILE);
-    const read = () => {
-        let raw;
-        try {
-            raw = readFileSync(path, "utf8");
-        }
-        catch {
-            return null;
-        }
-        const parsed = JSON.parse(raw);
-        if (typeof parsed.publicKey !== "string" || typeof parsed.privateKey !== "string") {
-            throw new Error(`${VAPID_FILE} is not a key file`);
-        }
-        const check = createECDH("prime256v1");
-        check.setPrivateKey(fromB64url(parsed.privateKey));
-        if (b64url(check.getPublicKey()) !== parsed.publicKey) {
-            throw new Error(`${VAPID_FILE} holds a mismatched key pair — refusing to sign with it`);
-        }
-        return { publicKey: parsed.publicKey, privateKey: parsed.privateKey, fingerprint: vapidFingerprint(parsed.publicKey) };
-    };
+    const read = () => readVapidKeys(path);
     const existing = read();
     if (existing !== null)
         return existing;
@@ -87,6 +73,25 @@ export function loadOrCreateVapidKeys(dir) {
         return winner;
     }
 }
+function readVapidKeys(path) {
+    let raw;
+    try {
+        raw = readFileSync(path, "utf8");
+    }
+    catch {
+        return null;
+    }
+    const parsed = JSON.parse(raw);
+    if (typeof parsed.publicKey !== "string" || typeof parsed.privateKey !== "string") {
+        throw new Error(`${VAPID_FILE} is not a key file`);
+    }
+    const check = createECDH("prime256v1");
+    check.setPrivateKey(fromB64url(parsed.privateKey));
+    if (b64url(check.getPublicKey()) !== parsed.publicKey) {
+        throw new Error(`${VAPID_FILE} holds a mismatched key pair — refusing to sign with it`);
+    }
+    return { publicKey: parsed.publicKey, privateKey: parsed.privateKey, fingerprint: vapidFingerprint(parsed.publicKey) };
+}
 // ---- RFC 8291 encryption ----------------------------------------------------
 /**
  * The deterministic core, exported for the Appendix A vector test: given

package/dist/read-only-request.d.ts

@@ -0,0 +1,4 @@
+/** Run a GET or HEAD request's work. */
+export declare function asReadOnlyRequest<T>(work: () => T): T;
+/** Whether the current work answers a GET or HEAD request. */
+export declare function inReadOnlyRequest(): boolean;

package/dist/read-only-request.js

@@ -0,0 +1,15 @@
+/**
+ * A page visit only reads (docs/plans/get-side-effects.md). The server runs every GET and HEAD inside this scope, and
+ * the few store reads that used to tidy up as they went (closing an operating mode past its expiry) check it and
+ * leave the tidying to the background pass and the paths that act.
+ */
+import { AsyncLocalStorage } from "node:async_hooks";
+const scope = new AsyncLocalStorage();
+/** Run a GET or HEAD request's work. */
+export function asReadOnlyRequest(work) {
+    return scope.run(true, work);
+}
+/** Whether the current work answers a GET or HEAD request. */
+export function inReadOnlyRequest() {
+    return scope.getStore() === true;
+}

package/dist/release-adapters.js

@@ -115,6 +115,9 @@ export function gateStateOf(answer, accounts = []) {
     const failed = newest !== undefined && newest["finishedAt"] != null && newest["outcome"] !== "built" && newest["outcome"] !== "no-change" && Number(newest["id"]) !== resultRun
         ? `run ${String(newest["id"])} ended ${String(newest["outcome"] ?? "without an outcome")}` : null;
     const worktree = runs.find(run => run["id"] === resultRun)?.["worktree"];
+    // Queued again or still building past the result shown (a regate): that result is the one before the rerun.
+    const state = object(answer["task"])["state"];
+    const pending = resultRun !== null && (state === "queued" || state === "running" || (newest !== undefined && newest["finishedAt"] == null && Number(newest["id"]) > resultRun));
     return {
         exists: true,
         candidate: textOr(scope["candidate"]),
@@ -131,6 +134,7 @@ export function gateStateOf(answer, accounts = []) {
                 : checks["status"] === "passed" && checks["level"] !== "full" ? "not-full" : String(checks["status"] ?? "not-run"),
         },
         failed,
+        pending,
         completion: textOr(completion["digest"]) === null ? null : { actor: String(completion["actor"]), at: String(completion["at"]), digest: String(completion["digest"]) },
     };
 }

package/dist/release.d.ts

@@ -90,6 +90,9 @@ export type GateState = {
     } | null;
     /** A finished build that left no result to complete (it failed before the check), in words. */
     failed: string | null;
+    /** A newer attempt is queued or running (`task regate` after a failed check): the result shown is the one before it.
+     * Absent from a plane too old to say. */
+    pending?: boolean;
     completion: {
         actor: string;
         at: string;

package/dist/release.js

@@ -535,6 +535,9 @@ export async function runRelease(options, adapters) {
                             await watch("dispatch");
                             const gate = await adapters.toolroll.gate(j.task.id);
                             await approved(gate);
+                            // A rerun of the same approved commit is on its way: the failure before it is not this release's answer.
+                            if (gate.pending === true && gate.result?.check !== "passed")
+                                return null;
                             if (gate.failed !== null)
                                 throw new Stop("check-failed", `The release build of ${j.task.id} failed: ${gate.failed}. Fix it and release the new commit with --new.`);
                             if (gate.result === null || gate.result.check === "running" || gate.result.check === "pending")

package/dist/repository-context-ui.js

@@ -1,5 +1,6 @@
 import { html, postForm } from "./html.js";
+import { framedSection } from './knowledge-ui.js';
 export function repositoryContextHtml(repo, query, result, csrf) {
     const root = `/settings/knowledge?repo=${encodeURIComponent(repo)}`;
-    return html `<section class="knowledge repository-context"><h2>Relevant code</h2><form method="get" action="/settings/knowledge"><input type="hidden" name="repo" value="${repo}"><label>Find code<input name="q" value="${query}" maxlength="1000" placeholder="A feature, file or symbol"></label><button type="submit">Search</button></form>${result === null ? '' : html `<p class="meta">${result.index.engine === 'typescript-ast' ? 'Code relationships' : 'Source search'}${result.mode === 'impact' ? ' · possible change impact' : ''}</p>${result.excerpts.length ? result.excerpts.map(one => html `<details><summary>${one.file}:${one.line}${one.symbol ? ` · ${one.symbol}` : ''}</summary><p class="meta">${one.reason}</p><pre>${one.text}</pre><a href="${root}&mode=impact&q=${encodeURIComponent(one.file)}">What this may affect</a></details>`) : html `<p>No matching source was found in this bounded search.</p>`}${result.relationships.length ? html `<details><summary>Related files</summary><ul>${result.relationships.map(one => html `<li>${one.from} → ${one.to} · ${one.kind}</li>`)}</ul></details>` : ''}<details><summary>Context details</summary><p>${result.index.status}${result.checkout ? ` · checkout ${result.checkout.head.slice(0, 8)}` : ''}</p>${result.warnings.map(one => html `<p>${one}</p>`)}</details>`}${csrf ? html `<details><summary>Refresh code index</summary>${postForm("/settings/knowledge/refresh", html `<p>Builds a local map of TypeScript and JavaScript imports. Uses no model.</p><button type="submit">Refresh index</button>`, { hidden: { repo } })}</details>` : ''}</section>`;
+    return framedSection('Relevant code', html `<form class="field-row" method="get" action="/settings/knowledge"><input type="hidden" name="repo" value="${repo}"><label>Find code<input name="q" value="${query}" maxlength="1000" placeholder="A feature, file or symbol"></label><button type="submit">Search</button></form>${result === null ? '' : html `<p class="meta">${result.index.engine === 'typescript-ast' ? 'Code relationships' : 'Source search'}${result.mode === 'impact' ? ' · possible change impact' : ''}</p>${result.excerpts.length ? result.excerpts.map(one => html `<details><summary>${one.file}:${one.line}${one.symbol ? ` · ${one.symbol}` : ''}</summary><p class="meta">${one.reason}</p><pre>${one.text}</pre><a href="${root}&mode=impact&q=${encodeURIComponent(one.file)}">What this may affect</a></details>`) : html `<p>No matching source was found in this bounded search.</p>`}${result.relationships.length ? html `<details><summary>Related files</summary><ul>${result.relationships.map(one => html `<li>${one.from} → ${one.to} · ${one.kind}</li>`)}</ul></details>` : ''}<details><summary>Context details</summary><p>${result.index.status}${result.checkout ? ` · checkout ${result.checkout.head.slice(0, 8)}` : ''}</p>${result.warnings.map(one => html `<p>${one}</p>`)}</details>`}${csrf ? html `<details><summary>Refresh code index</summary>${postForm("/settings/knowledge/refresh", html `<p>Builds a local map of TypeScript and JavaScript imports. Uses no model.</p><button type="submit">Refresh index</button>`, { hidden: { repo } })}</details>` : ''}`, 'repository-context');
 }

package/dist/repository-context.js

@@ -1,6 +1,8 @@
 /** Optional repository context. Callers admit project access; this module grants no authority.
  * The index is disposable. Every read hashes the current bounded tracked source set;
  * a missing/changed/unreadable index falls back to ordinary text search, never a task gate. */
+import { inReadOnlyRequest } from './read-only-request.js';
+import { checkoutGitSync } from './teardown-git.js';
 import { createHash, randomUUID } from 'node:crypto';
 import { execFileSync } from 'node:child_process';
 import { existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
@@ -12,7 +14,10 @@ const CODE = /\.(?:[cm]?[jt]sx?)$/i;
 const TEXT = /\.(?:[cm]?[jt]sx?|md|txt|css|html|json)$/i;
 const MAX_NODES = 16_000, MAX_EDGES = 12_000;
 const sha = (value) => createHash('sha256').update(value).digest('hex');
-const git = (repo, args) => execFileSync('git', ['--no-optional-locks', '-C', repo, ...args], { encoding: 'utf8', maxBuffer: 2_000_000, timeout: 10_000, stdio: ['ignore', 'pipe', 'pipe'] }).trimEnd();
+// Read-only and bounded: no index refresh, no hooks, no fsmonitor program.
+// On a page read (Settings -> Knowledge's search), the hardened checkout git: no filter, hook, program or network.
+const git = (repo, args) => inReadOnlyRequest() ? checkoutGitSync(repo, args, { timeoutMs: 10_000, maxBuffer: 2_000_000 }).trimEnd()
+    : execFileSync('git', ['--no-optional-locks', '-c', 'core.fsmonitor=false', '-c', 'core.hooksPath=/dev/null', '-C', repo, ...args], { encoding: 'utf8', maxBuffer: 2_000_000, timeout: 10_000, stdio: ['ignore', 'pipe', 'pipe'] }).trimEnd();
 const inside = (root, path) => { const r = relative(root, path); return r !== '..' && !r.startsWith('..' + sep) && !isAbsolute(r); };
 function capture(request) {
     const repo = realpathSync(request.repo);

package/dist/result-follow-ups.js

@@ -46,6 +46,25 @@ export function followUpChecksOf(store, runId, now = new Date(), root) {
             catch { /* an unreadable receipt upgrades nothing */ }
         }
     }
+    // A pass stands only while its saved log still verifies and the command it ran is still the approved one, the same
+    // bar the build's own check receipt meets (verification-evidence.ts): otherwise it can't be read as a pass now.
+    const repo = root === undefined ? null : repoOfRun(store, runId);
+    const logVerifies = (artifactId) => {
+        if (root === undefined || artifactId === null)
+            return false;
+        const artifact = store.getArtifact(artifactId);
+        return artifact !== null && artifact.run === runId && artifact.kind === "structured-output" && artifact.capture === FOLLOW_UP_LOG && artifact.captureStatus !== "failed" && readVerifiedArtifact(root, artifact).ok;
+    };
+    const stillApproved = (level, digest) => {
+        if (repo === null)
+            return false;
+        try {
+            return checkCommandFor(store, repo, level).command?.digest === digest;
+        }
+        catch {
+            return false;
+        }
+    };
     return rows.filter(row => row.action === CHECKS_REQUESTED && (row.outcome === "quick" || row.outcome === "full")).map(request => {
         const [head = "", why = "person", digest = "", recordedBase = ""] = (request.detail ?? "").split(" · ");
         const started = rows.find(row => row.action === CHECKS_STARTED && row.outcome === String(request.id)) ?? null;
@@ -59,7 +78,7 @@ export function followUpChecksOf(store, runId, now = new Date(), root) {
             // With the evidence at hand, only a sealed receipt can say passed: for this result's own commit, and,
             // for a batch, a batch that names this result.
             if (status === "passed" && root !== undefined && (sealed === null || !sealed.ran || sealed.exitCode !== 0 || (sealed.head !== null && sealed.head !== head)
-                || (base.why === "batch" && sealed.batch === null))) {
+                || (base.why === "batch" && sealed.batch === null) || !logVerifies(sealed.log) || !stillApproved(base.level, digest))) {
                 return { ...base, state: "not-run", note: "The saved check result could not be verified." };
             }
             const exit = /exit (\d+)/.exec(finished.detail ?? "");

package/dist/result-review.js

@@ -28,7 +28,11 @@ export function evidenceResultStatusOf(result, publication, evidence) {
         stored = {
             token: "evidence-damaged",
             label: "Result saved, but some saved material is unavailable",
-            detail: `Some saved material is missing, damaged, or could not be read. The machine's verdict at completion is unchanged: ${result.verdict === "verified" ? "the approved check passed against it then" : recorded.label.toLowerCase()}.`,
+            // Never "passed" when the check itself can't be read now (task-status.ts approvedCheckOf).
+            detail: recorded.token === "check-unreadable" ? `Some saved material is missing, damaged, or could not be read. ${recorded.detail}`
+                : `Some saved material is missing, damaged, or could not be read. ${result.verdict === "verified" && result.checks !== undefined && ["ready-to-review", "pr-opened", "merge-observed", "pr-closed"].includes(recorded.token)
+                    ? "The machine's verdict at completion is unchanged: the approved check passed against it then."
+                    : result.verdict === "verified" ? "Open the result to see its checks." : `The machine's verdict at completion is unchanged: ${recorded.label.toLowerCase()}.`}`,
             tone: "problem",
             action: { label: "See what is missing", kind: "open-result" },
         };

package/dist/run-efficiency.d.ts

@@ -8,7 +8,7 @@
  * kept 24 hours) are read once, bounded, through the descriptor-safe live reader, for step counts and observed step
  * times. No command text is ever stored here: repeats are counted, never quoted.
  */
-import type { Run, Store } from "./store.js";
+import { type Run, type Store } from "./store.js";
 import type { LiveActivityKind, LiveRecord } from "./live-records.js";
 export declare const RUN_EFFICIENCY_VERSION = 3;
 /** Budgets for one derivation: never more than the live file's own cap, and a bounded record count. */
@@ -62,10 +62,10 @@ export declare function usageOf(run: Pick<Run, "provider" | "model" | "tokensIn"
  * others their times are partly made up (Codex reports a step when it completes, ACP agents may report late), so no
  * duration is claimed for them. */
 export declare function stepsOf(records: Iterable<LiveRecord>, truncated: string | null, measured?: boolean): RunEfficiency["steps"];
-/** Derive a finished run's How it ran from its records. */
+/** Derive a finished run's How it ran from its records, read under the run's own captured "Show commands" answer. */
 export declare function deriveRunEfficiency(run: Run & {
     usageJson?: string | null;
-}, evidenceRoot: string, now: Date): RunEfficiency;
+}, evidenceRoot: string, now: Date, commands?: boolean): RunEfficiency;
 /**
  * A finished run's How it ran: the saved one when it was derived by this version, else derived now and saved (once:
  * a row whose steps were complete or have expired is final). An unfinished run is derived but never saved.

package/dist/run-efficiency.js

@@ -1,3 +1,14 @@
+/**
+ * How a run went (docs/plans/run-efficiency.md): derived from the run's own records, display only. It never changes a
+ * completion, an approval, a charge or a check verdict, and it claims nothing its sources don't hold — an unreported
+ * number is unknown (null, shown as a dash), never zero.
+ *
+ * Sources, and what each can say: the run row (wall times, tokens, the provider's raw usage with its cache counts, the
+ * agent's turns where reported) is kept with the run; the live records (`<evidence>/live/<run>.jsonl`, display-only,
+ * kept 24 hours) are read once, bounded, through the descriptor-safe live reader, for step counts and observed step
+ * times. No command text is ever stored here: repeats are counted, never quoted.
+ */
+import { runLiveCommands } from "./store.js";
 import { closeSync, constants, fstatSync, lstatSync, openSync, readSync } from "node:fs";
 import { join } from "node:path";
 import { LIVE_RETAIN_MS, legacyLiveLogPath, liveLogPath, liveWindowRecords } from "./live.js";
@@ -95,7 +106,7 @@ const noSteps = (state, reason) => ({ state, reason, total: null, failed: null,
  * directory), measured once, and never more than the budget read whatever the file does meanwhile; then parsed line by
  * line. A file over the budget, in the older text format, with lines that don't read, or cut or capped while the agent
  * ran, says its steps are incomplete. Null when there is no step file at all. */
-function readRecords(evidenceRoot, runId) {
+function readRecords(evidenceRoot, runId, commands) {
     try {
         const dir = lstatSync(join(evidenceRoot, "live"));
         if (!dir.isDirectory() || dir.isSymbolicLink())
@@ -154,10 +165,10 @@ function readRecords(evidenceRoot, runId) {
         whole.length = EFFICIENCY_RECORDS;
     const keys = { inKey: false };
     // One record per line: a whole line that doesn't read is a record lost.
-    const read = liveWindowRecords({ text: whole.length === 0 ? "" : `${whole.join("\n")}\n`, format: "records" }, keys);
+    const read = liveWindowRecords({ text: whole.length === 0 ? "" : `${whole.join("\n")}\n`, format: "records" }, commands, keys);
     const lost = whole.length - read.length;
     // A finished run's last line without its newline is read like any other; one that doesn't read is a record lost.
-    const tail = unfinished.trim() === "" ? [] : liveWindowRecords({ text: `${unfinished}\n`, format: "records" }, keys);
+    const tail = unfinished.trim() === "" ? [] : liveWindowRecords({ text: `${unfinished}\n`, format: "records" }, commands, keys);
     const records = [...read, ...tail];
     const lostAll = lost + (unfinished.trim() !== "" && tail.length === 0 ? 1 : 0);
     if (records.length === 0 && text.trim() !== "")
@@ -170,10 +181,10 @@ function readRecords(evidenceRoot, runId) {
                         : null;
     return { records, truncated };
 }
-/** Derive a finished run's How it ran from its records. */
-export function deriveRunEfficiency(run, evidenceRoot, now) {
+/** Derive a finished run's How it ran from its records, read under the run's own captured "Show commands" answer. */
+export function deriveRunEfficiency(run, evidenceRoot, now, commands = false) {
     const finished = run.finishedAt;
-    const read = readRecords(evidenceRoot, run.id);
+    const read = readRecords(evidenceRoot, run.id, commands);
     const steps = read !== null && "unreadable" in read ? noSteps("truncated", read.unreadable)
         : read !== null ? stepsOf(read.records, read.truncated, run.provider === "claude")
             : finished !== null && now.getTime() - Date.parse(finished) > LIVE_RETAIN_MS ? noSteps("expired", "Step details are kept for a day after a run; this one's have expired.")
@@ -196,8 +207,9 @@ export function runEfficiencyOf(store, evidenceRoot, runId, now) {
         return null;
     const usageJson = store.handle.prepare("SELECT usage_json FROM run WHERE id = ?").get(runId)?.["usage_json"];
     const full = { ...run, usageJson: typeof usageJson === "string" ? usageJson : null };
+    const commands = runLiveCommands(store, runId);
     if (run.finishedAt === null)
-        return deriveRunEfficiency(full, evidenceRoot, now);
+        return deriveRunEfficiency(full, evidenceRoot, now, commands);
     let saved;
     try {
         saved = store.handle.prepare("SELECT parser_version, payload_json FROM run_efficiency WHERE run = ?").get(runId);
@@ -211,7 +223,7 @@ export function runEfficiencyOf(store, evidenceRoot, runId, now) {
         }
         catch { /* derived again below */ }
     }
-    const derived = deriveRunEfficiency(full, evidenceRoot, now);
+    const derived = deriveRunEfficiency(full, evidenceRoot, now, commands);
     const payload = JSON.stringify(derived);
     // A row too large for its column (it can't be: the counts are bounded) is shown, never saved.
     // Saving is a convenience: a store that can't take the row (read-only, busy) still shows what was derived.

package/dist/scout.d.ts

@@ -131,6 +131,9 @@ export declare function readReportImage(folder: string, file: string): {
 };
 /** The shorten turn's ask: the fields over their limits, and the same report again within them. */
 export declare function shortenReportBrief(over: readonly ReportProblem[], reportFile: string, structured: boolean): string;
+/** Whether a stream event shows the session writing its plan-mode plan
+ * file (~/.claude/plans/…) or handing a plan to ExitPlanMode. */
+export declare function touchesPlanFile(event: Record<string, unknown>): boolean;
 /** A cited link without its secrets: credential-shaped query values and path parts become REDACTED, a fragment
  * that carries one is dropped, and a link still showing one keeps only its origin. Unchanged when it has none. */
 export declare function scrubUrl(text: string): {

package/dist/scout.js

@@ -37,6 +37,7 @@ import { grantOf, researchToolsOf } from "./mcp-connect.js";
 import { startScoutProxy } from "./scout-net.js";
 import * as browserCheck from "./scout-browser.js";
 import { invokeAgent } from "./invoke.js";
+import { topLevelEvent } from "./stream-scope.js";
 const GIT = "git";
 const AGENT_ENV_DENYLIST = [...TELEGRAM_TOKEN_ENVS];
 const DEFAULT_SCOUT_TIMEOUT_MS = 20 * 60_000;
@@ -298,7 +299,7 @@ async function scoutWith(store, request, outputDir) {
     }
     // The live window (peek): the same transcript file the builder keeps,
     // so `toolroll peek` and the run page can watch this session too.
-    const liveLog = openLiveLog(root, request.runId, liveLogContext(store, taskRef, worktree));
+    const liveLog = openLiveLog(root, request.runId, liveLogContext(store, request.runId, taskRef, worktree, clock()));
     // Claude's report rides the terminal result event (run 2334's fix): plan
     // mode only lets the session write its own plan file. Codex has no
     // structured output and keeps the mailbox file.
@@ -706,8 +707,9 @@ export function shortenReportBrief(over, reportFile, structured) {
 }
 /** Whether a stream event shows the session writing its plan-mode plan
  * file (~/.claude/plans/…) or handing a plan to ExitPlanMode. */
-function touchesPlanFile(event) {
-    if (event["type"] !== "assistant")
+export function touchesPlanFile(event) {
+    // The session's own calls only: a subagent's (parent_tool_use_id set) is not the scout's plan (stream-scope.ts).
+    if (event["type"] !== "assistant" || !topLevelEvent(event))
         return false;
     const message = event["message"];
     if (typeof message !== "object" || message === null)