toolroll 0.9.73 → 0.9.75

package/dist/subscription-chat.js

@@ -21,6 +21,7 @@ import { claudeStreamReader } from "./lead-progress.js";
 import { ALL_CREDENTIAL_ENV } from "./provider.js";
 import { claudeLimitsOf, noteLimits } from "./provider-limits.js";
 import { claudeBillingFrom } from "./spend.js";
+import { primaryResultEvent, topLevelEvent } from "./stream-scope.js";
 const RESPONSE_CAP_BYTES = 65_536;
 function outputSchema(tools) {
     return {
@@ -179,7 +180,8 @@ function lastResultLine(stdout) {
             continue;
         try {
             const event = JSON.parse(line);
-            if (typeof event === "object" && event !== null && event["type"] === "result")
+            // The main query's result, never a subagent's or a background task's (stream-scope.ts).
+            if (typeof event === "object" && event !== null && primaryResultEvent(event))
                 return line;
         }
         catch { /* not an event line */ }
@@ -254,11 +256,11 @@ export async function performSubscriptionLeadRequest(request, runner = run) {
                     seen.planWindows = true;
                     noteLimits(reading);
                 }
-                else if (event["type"] === "system" && event["subtype"] === "init") {
+                else if (event["type"] === "system" && event["subtype"] === "init" && topLevelEvent(event)) {
                     seen.keySource = typeof event["apiKeySource"] === "string" ? event["apiKeySource"] : null;
                     seen.model = typeof event["model"] === "string" ? event["model"] : null;
                 }
-                else if (event["type"] === "result")
+                else if (primaryResultEvent(event))
                     answered = true;
             }
             const billing = answered ? claudeBillingFrom(seen) : null;

package/dist/task-status.d.ts

@@ -43,6 +43,8 @@ export type TaskStatus = {
         key: NeedKey;
         action: NeedAction;
     } | null;
+    /** The approved check as the Checks row shows it (`approvedCheckStateOf`): the road reads this, never the row's words. */
+    check?: ApprovedCheckState | null;
 };
 /** `reviewing`: the one automatic review (build-review.ts) is reading a finished build; it reads Building, not a headline of its own. */
 export type TaskStage = "queued" | "planning" | "needs-you" | "waiting" | "building" | "checking" | "reviewing" | "finished" | "complete" | "failed" | "stopped";
@@ -61,6 +63,8 @@ export type ChecksFact = {
         run: number;
         head: string;
     } | null;
+    /** Why it can't be read, when that is the project's check command approved again since it ran. */
+    cause?: "command-changed" | null;
 };
 /** What checks Off leaves for a release: `pending` until a passing full release check contains the commit, then
  * `covered`. `running`: a check is waiting for its batch or running on this commit. */
@@ -70,6 +74,25 @@ export declare function releaseStateOf(checks: Pick<ChecksFact, "status" | "leve
 /** How the project check stands for requirements that rest on it, read now: `covered` once a check passed on this
  * commit (its own, a follow-up, or a release check containing it), `pending` while checks Off wait for a release. */
 export declare function checkBackingOf(checks: Pick<ChecksFact, "status" | "level" | "release" | "running" | "batch"> | null | undefined): ReleaseState | undefined;
+/**
+ * Did the approved check pass for this result? The ONE answer the status headline and sentence, the Project checks
+ * row, the road's Checks step and the result page all read, so none of them can say "passed" while another says the
+ * check couldn't be read. Two records speak to it: the machine verdict sealed when the build finished, and the saved
+ * check receipt read now (with any follow-up check on the same commit). Fail closed: the check passed only when the
+ * receipt read now says so. A verdict that recorded a pass whose receipt is missing, says nothing ran, or can't be
+ * read is unreadable; a verdict that recorded a failure stays failed unless a later check on the same commit passed.
+ * `checks` undefined or null: nothing was read. Returns the check as every surface shows it (null: nothing to show).
+ */
+export declare function approvedCheckOf(verdict: string | null | undefined, reasons: readonly string[], checks: ChecksFact | null | undefined): ChecksFact | null;
+/** How the approved check reads, in one word every surface shares (from `approvedCheckOf`'s answer): `running` while a
+ * check is underway on the commit, else what it recorded. `unreadable`: it couldn't be read or the records disagree. */
+export type ApprovedCheckState = "passed" | "failed" | "running" | "not-run" | "off" | "unreadable";
+export declare function approvedCheckStateOf(checks: Pick<ChecksFact, "status" | "level" | "release" | "running" | "batch"> | null | undefined): ApprovedCheckState | null;
+/** A saved check that can't be read, in the words every surface uses. */
+export declare const CHECK_UNREADABLE = "The check result couldn't be read.";
+export declare const CHECK_UNREADABLE_ASK = "The check result couldn't be read. Run checks on it, or open the result to see why.";
+/** A saved check whose files are intact but whose command was approved again since it ran. */
+export declare const CHECK_COMMAND_CHANGED = "The check command changed since this check; run checks again.";
 /** What stands between a finished result and Complete (`completionBlockersOf`): each with the exact next step. */
 export type CompletionBlocker = {
     key: "check-failed" | "check-missing" | "criteria" | "high";
@@ -224,7 +247,7 @@ export declare function requirementsOf(matrix: readonly RequirementRow[] | null
  * the rest); an unresolved HIGH review finding. A release check that covers the commit counts as passed. */
 export declare function completionBlockersOf(f: {
     report: boolean;
-    checks: Pick<ChecksFact, "status" | "exitCode" | "level" | "release" | "running" | "batch"> | null;
+    checks: Pick<ChecksFact, "status" | "exitCode" | "level" | "release" | "running" | "batch" | "cause"> | null;
     checkRequired: boolean;
     matrix: readonly RequirementRow[] | null | undefined;
     verdict: string | null | undefined;
@@ -235,6 +258,10 @@ export declare function completionBlockersOf(f: {
 export declare function unverifiedWhenRefuted(requirements: NonNullable<TaskStatusFacts["requirements"]> | null, verdict: string | null | undefined): NonNullable<TaskStatusFacts["requirements"]> | null;
 /** Saved evidence health from the receipt's artifact list and its caveats. */
 export declare function evidenceOf(receipt: AssignmentSnapshot["receipt"], problems?: readonly string[]): NonNullable<TaskStatusFacts["evidence"]> | null;
+/** A saved check reading as the shared fact (head, level, a follow-up running, a batch, release coverage). */
+export declare function checksFactOf(checks: NonNullable<AssignmentSnapshot["receipt"]>["checks"], head: string | null): ChecksFact;
+/** A receipt's approved check, as every surface reads it (`approvedCheckOf` over its verdict and its saved check). */
+export declare function receiptChecksOf(receipt: NonNullable<AssignmentSnapshot["receipt"]>): ChecksFact | null;
 /** The status facts of one assignment, as every surface reads them. */
 export declare function assignmentStatusFacts(assignment: AssignmentSnapshot, options?: {
     work?: {

package/dist/task-status.js

@@ -12,6 +12,7 @@
  * technical reason stays one tap away in `why`. */
 import { DEFAULT_LEAD_NAME } from "./lead-identity.js";
 import { html } from "./html.js";
+import { FAILED_CHECK } from "./result-acts.js";
 import { CODE_NEED, NEEDS, needSentence, waitSentence } from "./needs-you.js";
 /** A cancelled task with a successor reads "Replaced by <id>" everywhere, never "Cancelled". */
 export const replacedWords = (successor) => `Replaced by ${successor}`;
@@ -38,6 +39,67 @@ export function releaseStateOf(checks) {
 export function checkBackingOf(checks) {
     return checks?.status === "passed" ? "covered" : checksUnderway(checks) ? "running" : releaseStateOf(checks);
 }
+/**
+ * Did the approved check pass for this result? The ONE answer the status headline and sentence, the Project checks
+ * row, the road's Checks step and the result page all read, so none of them can say "passed" while another says the
+ * check couldn't be read. Two records speak to it: the machine verdict sealed when the build finished, and the saved
+ * check receipt read now (with any follow-up check on the same commit). Fail closed: the check passed only when the
+ * receipt read now says so. A verdict that recorded a pass whose receipt is missing, says nothing ran, or can't be
+ * read is unreadable; a verdict that recorded a failure stays failed unless a later check on the same commit passed.
+ * `checks` undefined or null: nothing was read. Returns the check as every surface shows it (null: nothing to show).
+ */
+export function approvedCheckOf(verdict, reasons, checks) {
+    let failedExit = null;
+    for (const reason of reasons) {
+        const found = FAILED_CHECK.exec(reason);
+        if (found !== null) {
+            failedExit = Number(found[1]);
+            break;
+        }
+    }
+    const recordedFail = verdict === "refuted" && failedExit !== null;
+    const recordedPass = verdict === "verified";
+    const read = checks ?? null;
+    if (read === null) {
+        if (recordedFail)
+            return { status: "failed", exitCode: failedExit, head: null };
+        return recordedPass ? { status: "unavailable", exitCode: null, head: null } : null;
+    }
+    if (read.status === "passed" || read.status === "failed" || read.status === "running")
+        return read;
+    // Checks Off covered by a passing release check read as passed (the row says on which commit); nothing to correct.
+    if (read.level === "off" && read.release != null && !recordedFail)
+        return read;
+    if (recordedFail)
+        return { ...read, status: "failed", exitCode: failedExit };
+    // The verdict says the check passed, the receipt read now can't show it: the two disagree, so it doesn't count.
+    if (recordedPass)
+        return { ...read, status: "unavailable", exitCode: null };
+    return read;
+}
+export function approvedCheckStateOf(checks) {
+    if (checks == null)
+        return null;
+    // A failure stands while a new check runs: only its result can change the answer. A check that couldn't be read (a
+    // result waiting for its batch check has none yet) reads running while one is underway, and never passed.
+    if (checks.status === "failed")
+        return "failed";
+    if (checksUnderway(checks) || checks.status === "running")
+        return "running";
+    if (checks.status === "unavailable")
+        return "unreadable";
+    if (checks.status === "passed")
+        return "passed";
+    if (checks.level === "off")
+        return checks.release != null ? "passed" : "off";
+    return "not-run";
+}
+/** A saved check that can't be read, in the words every surface uses. */
+export const CHECK_UNREADABLE = "The check result couldn't be read.";
+export const CHECK_UNREADABLE_ASK = `${CHECK_UNREADABLE} Run checks on it, or open the result to see why.`;
+/** A saved check whose files are intact but whose command was approved again since it ran. */
+export const CHECK_COMMAND_CHANGED = "The check command changed since this check; run checks again.";
+const unreadableAsk = (checks) => checks?.cause === "command-changed" ? CHECK_COMMAND_CHANGED : CHECK_UNREADABLE_ASK;
 /** "T2", "T2 and T3", "T2, T3 and 2 more": short enough for one line. The full list is on the result. */
 export function peerWords(peers, shown = 2) {
     if (peers.length <= shown)
@@ -65,10 +127,11 @@ function resultAsk(facts) {
     if (blocker !== undefined)
         return blocker.message;
     const req = facts.requirements;
-    if (req == null || facts.accepted === true || req.unverified === true)
-        return null;
-    if ((req.yours > 0 || (req.unshown ?? 0) > 0) && req.ask != null)
+    if (req != null && facts.accepted !== true && req.unverified !== true && (req.yours > 0 || (req.unshown ?? 0) > 0) && req.ask != null)
         return req.ask;
+    // A check that can't be read is never a pass: a person runs it again or looks at why, unless they already accepted.
+    if (facts.accepted !== true && approvedCheckStateOf(facts.checks) === "unreadable")
+        return unreadableAsk(facts.checks);
     return null;
 }
 export function headlineOf(facts) {
@@ -122,6 +185,8 @@ function sentenceOf(headline, facts) {
             }
             if (facts.checks?.batch?.state === "waiting")
                 return "Its full check runs with other results within 10 minutes. Review the change, then mark it complete.";
+            if (facts.checks?.status === "unavailable")
+                return `${facts.checks.cause === "command-changed" ? CHECK_COMMAND_CHANGED : CHECK_UNREADABLE} Review the change, then mark it complete.`;
             // Never claim a check that isn't known to have passed.
             if (facts.checks == null)
                 return "Review the change, then mark it complete.";
@@ -155,7 +220,11 @@ function detailsOf(headline, facts) {
         const batch = checks.batch ?? null;
         const together = batch === null ? null : checkedTogetherWords(batch);
         const batchWhy = batch === null ? null : BATCH_WHY[batch.state] ?? null;
-        if (batch?.state === "waiting")
+        // A failure or an unreadable check keeps its words while a new check runs, so the row never reads better than the answer.
+        const again = checksUnderway(checks) && checks.status === "failed" ? " · running again" : "";
+        if (again !== "")
+            row("checks", CHECKS_LABEL, `${quick ? "Quick checks failed" : "Failed"}${checks.exitCode === null ? "" : ` (exit ${checks.exitCode})`}${again}`, problem(headline), headline === "Failed" ? { href: checksHref } : { action: { label: "See what failed", href: checksHref } });
+        else if (batch?.state === "waiting")
             row("checks", CHECKS_LABEL, "Waiting to check with other results", "running", { href: checksHref });
         else if (checks.running != null)
             row("checks", CHECKS_LABEL, `${checks.running === "quick" ? "Quick" : "Full"} checks running`, "running", { href: checksHref });
@@ -178,6 +247,8 @@ function detailsOf(headline, facts) {
         else if (checks.status === "not-run")
             row("checks", CHECKS_LABEL, "Didn't run", "none", runChecks === null ? {} : { action: runChecks });
         // A saved check that can't be read is run again where that is possible.
+        else if (checks.cause === "command-changed")
+            row("checks", CHECKS_LABEL, "Check command changed since", "note", { action: runChecks ?? { label: OPEN_RESULT, href: facts.links?.result ?? null }, why: CHECK_COMMAND_CHANGED });
         else
             row("checks", CHECKS_LABEL, "Couldn't be read", "note", { action: runChecks ?? { label: OPEN_RESULT, href: facts.links?.result ?? null } });
     }
@@ -255,7 +326,7 @@ export function statusOf(facts) {
     const primaryAction = need === null || ownWords ? facts.action ?? null : { label: need.action.label, href: facts.action?.href ?? null };
     const sentence = lead === "on-it" ? leadSentence(headline, facts) : lead === "lapsed" ? `${leadLapsed(facts.leadName)} ${sentenceOf(headline, facts)}` : sentenceOf(headline, facts);
     return { headline, tone: HEADLINE_TONE[headline], sentence, details: detailsOf(headline, facts),
-        primaryAction, why: [...new Set(facts.why ?? [])].filter(one => one.trim() !== ""), need };
+        primaryAction, why: [...new Set(facts.why ?? [])].filter(one => one.trim() !== ""), need, check: facts.report ? null : approvedCheckStateOf(facts.checks) };
 }
 /** The name most surfaces already import. */
 export const taskStatusOf = statusOf;
@@ -267,7 +338,7 @@ const CODE_STAGE = {
     "waiting-dependency": ["queued"], "scouting-ready": ["queued"], "planning-ready": ["queued"], "provider-quota": ["queued"],
     // A request the planner cannot be given (too long to hand back, say) waits on a person to shorten it.
     "planner-source": ["needs-you", "fix-request"],
-    running: ["building"], reviewing: ["reviewing"], "review-pending": ["building"],
+    running: ["building"], reviewing: ["reviewing"], "review-pending": ["building"], "checks-running": ["checking"],
     "signed-out": ["needs-you", "sign-in"],
     "needs-approval": ["needs-you", "approval"],
     "waiting-decision": ["needs-you", "answer"], "decision-queue": ["needs-you", "answer"],
@@ -432,7 +503,8 @@ export function completionBlockersOf(f) {
     }
     else if (!f.report && f.checkRequired && f.checks?.status !== "passed" && release === undefined) {
         blockers.push({ key: "check-missing", message: checksUnderway(f.checks) ? "Its project check hasn't finished yet. Mark it complete once it passes."
-                : "No passing project check is recorded for this result. Run checks on it, then mark it complete." });
+                : f.checks?.status === "unavailable" ? f.checks.cause === "command-changed" ? `${CHECK_COMMAND_CHANGED.replace(/; run checks again\.$/, ".")} Run checks again, then mark it complete.` : `${CHECK_UNREADABLE} Run checks on it, then mark it complete.`
+                    : "No passing project check is recorded for this result. Run checks on it, then mark it complete." });
     }
     if (!f.accepted && f.checks?.status !== "failed") {
         const refuted = f.verdict === "refuted";
@@ -457,11 +529,24 @@ export function unverifiedWhenRefuted(requirements, verdict) {
 export function evidenceOf(receipt, problems = receipt?.caveats ?? []) {
     if (receipt === null)
         return null;
+    // The check's own reading is the Project checks row's to say (a changed command is not a missing file).
+    problems = problems.filter(one => one !== receipt.checks.detail);
     const shortened = receipt.artifacts.filter(one => !one.complete).length + problems.filter(one => /shortened|cut short/.test(one)).length;
     const damaged = problems.filter(one => /unavailable or changed|no longer verif|cannot be read|could not be read|failed capture|altered|damaged/i.test(one)).length;
     const missing = problems.filter(one => /missing|ambiguous|no longer exists/i.test(one) && !/unavailable or changed/.test(one)).length;
     return { shortened, missing, damaged };
 }
+/** A saved check reading as the shared fact (head, level, a follow-up running, a batch, release coverage). */
+export function checksFactOf(checks, head) {
+    return { status: checks.status, exitCode: checks.exitCode, head,
+        ...(checks.level == null ? {} : { level: checks.level }), ...(checks.running == null ? {} : { running: checks.running }),
+        ...(checks.batch == null ? {} : { batch: checks.batch }), ...(checks.release == null ? {} : { release: checks.release }),
+        ...(checks.cause == null ? {} : { cause: checks.cause }) };
+}
+/** A receipt's approved check, as every surface reads it (`approvedCheckOf` over its verdict and its saved check). */
+export function receiptChecksOf(receipt) {
+    return approvedCheckOf(receipt.proof?.verdict ?? null, receipt.proof?.reasons ?? [], checksFactOf(receipt.checks, receipt.head));
+}
 /** The status facts of one assignment, as every surface reads them. */
 export function assignmentStatusFacts(assignment, options = {}) {
     const { stage, need, wait } = assignmentStageOf(assignment, options.work ?? null, options.planning ?? false);
@@ -471,10 +556,7 @@ export function assignmentStatusFacts(assignment, options = {}) {
     // A saved result's rows show whenever it is the reason a person is needed, too.
     const withResult = finished || stage === "failed" || ((stage === "needs-you" || stage === "waiting") && receipt !== null);
     const report = receipt?.completionKind === "research-report";
-    const checks = receipt === null || !withResult ? null
-        : { status: receipt.checks.status, exitCode: receipt.checks.exitCode, head: receipt.head,
-            ...(receipt.checks.level == null ? {} : { level: receipt.checks.level }), ...(receipt.checks.running == null ? {} : { running: receipt.checks.running }),
-            ...(receipt.checks.batch == null ? {} : { batch: receipt.checks.batch }), ...(receipt.checks.release == null ? {} : { release: receipt.checks.release }) };
+    const checks = receipt === null || !withResult ? null : receiptChecksOf(receipt);
     const publication = assignment.publication;
     const pullRequest = options.pullRequest !== undefined ? options.pullRequest
         : publication === null ? (withResult && !report ? { state: "none", number: null, url: null, ci: null, error: null } : null)

package/dist/teardown-git.d.ts

@@ -33,4 +33,30 @@ export declare function checkoutIncludes(checkout: string): boolean;
  * program (anything but INERT_LFS). A file that
  * isn't a plain one, or doesn't parse, counts as naming one. */
 export declare function lfsExtensionIn(checkout: string): boolean;
-export declare function checkoutGit(inner?: Runner): Runner;
+/** `mode` "read" is for reading a checkout an agent may still be writing (the code page): every command also takes
+ * readFlags() and runs against the checkout's readView, so neither its config nor its info/attributes can change
+ * between the inspection and the run. */
+export declare function checkoutGit(inner?: Runner, mode?: "build" | "read"): Runner;
+/**
+ * Flags for reading a checkout an agent writes while a page waits (docs/plans/get-side-effects.md). Command-line
+ * settings win over anything the checkout's config says, even one changed after it was inspected: no fsmonitor, hooks,
+ * pager or credential helper; no network (lazy fetch off, every protocol refused); and attributes read from the empty
+ * tree, so no filter or textconv a .gitattributes names can run. A diff also takes --no-ext-diff --no-textconv.
+ */
+export declare const PAGE_READ_FLAGS: readonly string[];
+/** The read flags, for every read of an agent-written checkout, whatever the HTTP method (security review of
+ * 01bf3114): the worktree's attributes come from the empty tree. Git still reads the repository's info/attributes and
+ * its config as it starts, so the flags alone don't stop a filter planted in both after the inspection: every read
+ * also runs against the checkout's readView (checkoutGitSync, checkoutGit "read"), whose config and info are the plane's. The cost is cosmetic: a checkout's line-ending or encoding rules are not applied, so
+ * a file they would normalize can read as changed (fail closed: shipping then asks for a clean commit). */
+export declare function readFlags(): readonly string[];
+/**
+ * checkoutGit, synchronously, for reads a page shows from a checkout an agent writes (docs/plans/get-side-effects.md):
+ * the same refusals (an include, an .lfsconfig extension, a config key that can run a command), no system or global
+ * config, the operator's own values carried, PAGE_READ_FLAGS and the checkout's readView (which hold even if its config
+ * or info/attributes change after they were read), submodules skipped, bounded. A refusal throws.
+ */
+export declare function checkoutGitSync(cwd: string, args: readonly string[], options?: {
+    timeoutMs?: number;
+    maxBuffer?: number;
+}): string;

package/dist/teardown-git.js

@@ -11,7 +11,8 @@
  * nothing is removed.
  */
 import { spawnSync } from "node:child_process";
-import { existsSync, lstatSync, readdirSync, readFileSync } from "node:fs";
+import { existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, realpathSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import { run } from "./exec.js";
 import { ENV, ENV_ALLOWLIST } from "./remote-main.js";
@@ -166,47 +167,112 @@ export function teardownGit(runner = run) {
  * that can't be read so counts as including.
  */
 export function checkoutIncludes(checkout) {
-    const regular = (path) => {
-        try {
-            const held = lstatSync(path);
-            if (!held.isFile() || held.size > 1024 * 1024)
-                return null;
-            return readFileSync(path, "utf8");
-        }
-        catch {
+    const dirs = gitDirsOf(checkout);
+    if (dirs === null)
+        return true;
+    for (const path of [join(dirs.common, "config"), join(dirs.gitdir, "config.worktree")]) {
+        if (!existsSync(path) && path.endsWith("config.worktree"))
+            continue;
+        if (configIncludes(path))
+            return true;
+    }
+    return false;
+}
+/** One config file, read only as the regular file it is (bounded), or null. */
+function regularFile(path) {
+    try {
+        const held = lstatSync(path);
+        if (!held.isFile() || held.size > 1024 * 1024)
             return null;
-        }
-    };
+        return readFileSync(path, "utf8");
+    }
+    catch {
+        return null;
+    }
+}
+/** A checkout's git directory and common directory, as git finds them from its `.git` (a folder, or a one-line
+ * `gitdir: ` file); null when the pointer isn't one git would read the same way. */
+function gitDirsOf(checkout) {
     let gitdir = join(checkout, ".git");
     try {
         if (!lstatSync(gitdir).isDirectory()) {
             // As git reads a .git file: "gitdir: " then the path, one line; anything else (more lines, stray space) refused.
-            const text = (regular(gitdir) ?? "").replace(/\r?\n$/, "");
+            const text = (regularFile(gitdir) ?? "").replace(/\r?\n$/, "");
             if (!text.startsWith("gitdir: ") || /[\r\n]/.test(text))
-                return true;
+                return null;
             const pointer = text.slice("gitdir: ".length);
             if (pointer === "" || pointer !== pointer.trim())
-                return true;
+                return null;
             gitdir = resolve(checkout, pointer);
         }
     }
     catch {
+        return null;
+    }
+    const named = regularFile(join(gitdir, "commondir"))?.trim();
+    return { gitdir, common: named === undefined || named === "" ? gitdir : resolve(gitdir, named) };
+}
+/** Whether one config file includes another (or can't be read as a plain file): by a plain reading, and as git itself
+ * parses it, includes not followed (only this one regular file, from a neutral folder, with no other config read). */
+function configIncludes(path) {
+    const text = regularFile(path);
+    if (text === null || /^\s*\[\s*include(if)?\b/im.test(text))
         return true;
+    const parsed = spawnSync("git", ["config", "--file", path, "--no-includes", "--name-only", "--list", "-z"], { cwd: "/", encoding: "utf8", timeout: 5_000, env: { PATH: process.env["PATH"] ?? "", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", HOME: "/nonexistent" } });
+    return parsed.status !== 0 || parsed.stdout.split("\0").some(name => /^(include\.path|includeif\..*\.path)$/i.test(name));
+}
+function readView(checkout) {
+    const dirs = gitDirsOf(checkout);
+    if (dirs === null)
+        throw new Error("the checkout's .git couldn't be read as git reads it");
+    const view = realpathSync(mkdtempSync(join(tmpdir(), "toolroll-git-read-")));
+    const dispose = () => rmSync(view, { recursive: true, force: true });
+    try {
+        let config = regularFile(join(dirs.common, "config"));
+        if (config === null)
+            throw new Error("the checkout's git config couldn't be read as a plain file");
+        const configPath = join(view, "config");
+        writeFileSync(configPath, config, { mode: 0o600 });
+        const plain = { cwd: "/", encoding: "utf8", timeout: 5_000, env: { PATH: process.env["PATH"] ?? "", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", HOME: "/nonexistent" } };
+        if (/worktreeconfig/i.test(config)) {
+            const flag = spawnSync("git", ["config", "--file", configPath, "--no-includes", "--type=bool", "--get", "extensions.worktreeConfig"], plain);
+            if (flag.status !== 0 && flag.status !== 1)
+                throw new Error("the checkout's git config couldn't be read");
+            if (flag.stdout.trim() === "true") {
+                // Git would also read the worktree's config.worktree, which the agent can still change: folded in as it is now.
+                const worktree = join(dirs.gitdir, "config.worktree");
+                const own = existsSync(worktree) ? regularFile(worktree) : "";
+                if (own === null)
+                    throw new Error("the checkout's config.worktree couldn't be read as a plain file");
+                config = `${config}\n${own}`;
+                writeFileSync(configPath, config, { mode: 0o600 });
+            }
+            const unset = spawnSync("git", ["config", "--file", configPath, "--unset-all", "extensions.worktreeConfig"], plain);
+            if (unset.status !== 0 && unset.status !== 5)
+                throw new Error("the checkout's git config couldn't be read");
+        }
+        if (configIncludes(configPath))
+            throw new Error("the checkout's git config includes another file");
+        mkdirSync(join(view, "info"));
+        const exclude = join(dirs.common, "info", "exclude");
+        if (existsSync(exclude)) {
+            const text = regularFile(exclude);
+            if (text !== null)
+                writeFileSync(join(view, "info", "exclude"), text, { mode: 0o600 });
+        }
+        for (const name of readdirSync(dirs.common)) {
+            if (name === "config" || name === "info" || name === "hooks")
+                continue;
+            symlinkSync(join(dirs.common, name), join(view, name));
+        }
     }
-    const common = (() => { const named = regular(join(gitdir, "commondir"))?.trim(); return named === undefined || named === "" ? gitdir : resolve(gitdir, named); })();
-    for (const path of [join(common, "config"), join(gitdir, "config.worktree")]) {
-        if (!existsSync(path) && path.endsWith("config.worktree"))
-            continue;
-        const text = regular(path);
-        if (text === null || /^\s*\[\s*include(if)?\b/im.test(text))
-            return true;
-        // And as git itself parses it, includes not followed (only this one regular file, from a neutral folder, with no
-        // other config read): an include git sees by any spelling is refused.
-        const parsed = spawnSync("git", ["config", "--file", path, "--no-includes", "--name-only", "--list", "-z"], { cwd: "/", encoding: "utf8", timeout: 5_000, env: { PATH: process.env["PATH"] ?? "", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", HOME: "/nonexistent" } });
-        if (parsed.status !== 0 || parsed.stdout.split("\0").some(name => /^(include\.path|includeif\..*\.path)$/i.test(name)))
-            return true;
+    catch (error) {
+        dispose();
+        throw error;
     }
-    return false;
+    // Where git names the view (rev-parse --git-common-dir), the caller is told the repository's own common directory.
+    const restore = (output) => output.split("\n").map(line => line === view || line.startsWith(`${view}/`) ? dirs.common + line.slice(view.length) : line).join("\n");
+    return { env: { GIT_DIR: dirs.gitdir, GIT_COMMON_DIR: view, GIT_WORK_TREE: resolve(checkout) }, restore, dispose };
 }
 /** Whether the checkout's .lfsconfig (read as git parses it, that file only) sets any git-lfs key that could name a
  * program (anything but INERT_LFS). A file that
@@ -223,7 +289,10 @@ export function lfsExtensionIn(checkout) {
     const parsed = spawnSync("git", ["config", "--file", path, "--no-includes", "--name-only", "--list", "-z"], { cwd: "/", encoding: "utf8", timeout: 5_000, env: { PATH: process.env["PATH"] ?? "", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", HOME: "/nonexistent" } });
     return parsed.status !== 0 || parsed.stdout.split("\0").filter(Boolean).some(name => lfsCommand(name.toLowerCase()) || /^include(if)?\./i.test(name));
 }
-export function checkoutGit(inner = run) {
+/** `mode` "read" is for reading a checkout an agent may still be writing (the code page): every command also takes
+ * readFlags() and runs against the checkout's readView, so neither its config nor its info/attributes can change
+ * between the inspection and the run. */
+export function checkoutGit(inner = run, mode = "build") {
     return async (file, args, options) => {
         if (file !== "git")
             return inner(file, args, options);
@@ -233,21 +302,98 @@ export function checkoutGit(inner = run) {
         // git-lfs also reads .lfsconfig from the checkout: one that names an extension (a command it would run) is refused.
         if (lfsExtensionIn(cwd))
             return refused("the checkout's .lfsconfig sets a git-lfs key that can run a command");
-        // The checkout's own config may name no command.
-        const own = await inner("git", ["--no-optional-locks", "config", "--list", "--show-scope", "-z"], options);
-        if (own.code !== 0)
-            return refused("its config couldn't be read");
+        let view = null;
+        if (mode === "read") {
+            try {
+                view = readView(cwd);
+            }
+            catch (error) {
+                return refused(error instanceof Error ? error.message : "the checkout couldn't be read");
+            }
+        }
+        try {
+            const viewed = { ...options, env: { ...(options?.env ?? {}), ...(view?.env ?? {}) } };
+            // The checkout's own config may name no command.
+            const own = await inner("git", ["--no-optional-locks", "config", "--list", "--show-scope", "-z"], view === null ? options : viewed);
+            if (own.code !== 0)
+                return refused("its config couldn't be read");
+            const key = commandSetting(own.stdout);
+            if (key !== null)
+                return refused(`the checkout's git config sets ${key}, which can run a command`);
+            // The operator's own config contributes values only (carriedSettings); git then reads no global or system config.
+            // A read carries no filter: it reads attributes from the empty tree anyway.
+            const carried = view === null ? carriedSettings(own.stdout) : withoutFilters(carriedSettings(own.stdout));
+            const env = { ...viewed.env, GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null" };
+            // Never into a submodule or nested repository, whose own config this never read: status and diff skip them.
+            const safeArgs = [...args];
+            const command = safeArgs.findIndex(arg => arg === "status" || arg === "diff");
+            if (command >= 0 && !safeArgs.includes("--ignore-submodules=all"))
+                safeArgs.splice(command + 1, 0, "--ignore-submodules=all");
+            const flags = view === null ? [] : readFlags();
+            const ran = await inner("git", [...TEARDOWN_FLAGS, ...flags, "-c", "diff.ignoreSubmodules=all", "-c", "commit.gpgsign=false", "-c", "tag.gpgsign=false", ...carried, ...safeArgs], { ...options, env });
+            return view !== null && args.includes("rev-parse") ? { ...ran, stdout: view.restore(ran.stdout) } : ran;
+        }
+        finally {
+            view?.dispose();
+        }
+    };
+}
+const withoutFilters = (carried) => carried.filter((one, at, all) => !(one.startsWith("filter.") || (one === "-c" && all[at + 1]?.startsWith("filter."))));
+/**
+ * Flags for reading a checkout an agent writes while a page waits (docs/plans/get-side-effects.md). Command-line
+ * settings win over anything the checkout's config says, even one changed after it was inspected: no fsmonitor, hooks,
+ * pager or credential helper; no network (lazy fetch off, every protocol refused); and attributes read from the empty
+ * tree, so no filter or textconv a .gitattributes names can run. A diff also takes --no-ext-diff --no-textconv.
+ */
+export const PAGE_READ_FLAGS = [
+    "--no-lazy-fetch", "--attr-source=4b825dc642cb6eb9a060e54bf8d69288fbee4904",
+    "-c", "protocol.allow=never", "-c", "core.pager=cat", "-c", "core.alternateRefsCommand=", "-c", "core.attributesFile=/dev/null",
+];
+/** The read flags, for every read of an agent-written checkout, whatever the HTTP method (security review of
+ * 01bf3114): the worktree's attributes come from the empty tree. Git still reads the repository's info/attributes and
+ * its config as it starts, so the flags alone don't stop a filter planted in both after the inspection: every read
+ * also runs against the checkout's readView (checkoutGitSync, checkoutGit "read"), whose config and info are the plane's. The cost is cosmetic: a checkout's line-ending or encoding rules are not applied, so
+ * a file they would normalize can read as changed (fail closed: shipping then asks for a clean commit). */
+export function readFlags() {
+    return PAGE_READ_FLAGS;
+}
+/**
+ * checkoutGit, synchronously, for reads a page shows from a checkout an agent writes (docs/plans/get-side-effects.md):
+ * the same refusals (an include, an .lfsconfig extension, a config key that can run a command), no system or global
+ * config, the operator's own values carried, PAGE_READ_FLAGS and the checkout's readView (which hold even if its config
+ * or info/attributes change after they were read), submodules skipped, bounded. A refusal throws.
+ */
+export function checkoutGitSync(cwd, args, options = {}) {
+    if (checkoutIncludes(cwd))
+        throw new Error("the checkout's git config includes another file, or couldn't be read as a plain file");
+    if (lfsExtensionIn(cwd))
+        throw new Error("the checkout's .lfsconfig sets a git-lfs key that can run a command");
+    // Its config and info/attributes as read once, in a folder of the plane's own: neither can change before git runs.
+    const view = readView(cwd);
+    try {
+        const env = { PATH: process.env["PATH"] ?? "", HOME: process.env["HOME"] ?? "", LANG: "C", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", GIT_TERMINAL_PROMPT: "0", ...view.env };
+        const bounded = { cwd, env, encoding: "utf8", timeout: options.timeoutMs ?? 60_000, maxBuffer: options.maxBuffer ?? 1_048_576, stdio: ["ignore", "pipe", "pipe"] };
+        const own = spawnSync("git", ["--no-optional-locks", "config", "--list", "--show-scope", "-z"], bounded);
+        if (own.status !== 0)
+            throw new Error("its config couldn't be read");
         const key = commandSetting(own.stdout);
         if (key !== null)
-            return refused(`the checkout's git config sets ${key}, which can run a command`);
-        // The operator's own config contributes values only (carriedSettings); git then reads no global or system config.
-        const carried = carriedSettings(own.stdout);
-        const env = { ...(options?.env ?? {}), GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null" };
-        // Never into a submodule or nested repository, whose own config this never read: status and diff skip them.
+            throw new Error(`the checkout's git config sets ${key}, which can run a command`);
         const safeArgs = [...args];
         const command = safeArgs.findIndex(arg => arg === "status" || arg === "diff");
         if (command >= 0 && !safeArgs.includes("--ignore-submodules=all"))
             safeArgs.splice(command + 1, 0, "--ignore-submodules=all");
-        return inner("git", [...TEARDOWN_FLAGS, "-c", "diff.ignoreSubmodules=all", "-c", "commit.gpgsign=false", "-c", "tag.gpgsign=false", ...carried, ...safeArgs], { ...options, env });
-    };
+        // An external diff program is named by config, which may change after it was read: never used here.
+        if (command >= 0 && safeArgs[command] === "diff")
+            safeArgs.splice(command + 1, 0, "--no-ext-diff", "--no-textconv");
+        // The operator's own values, but no filter: PAGE_READ_FLAGS reads attributes from the empty tree anyway.
+        const carried = withoutFilters(carriedSettings(own.stdout));
+        const ran = spawnSync("git", [...TEARDOWN_FLAGS, ...readFlags(), "-c", "diff.ignoreSubmodules=all", ...carried, ...safeArgs], bounded);
+        if (ran.status !== 0)
+            throw new Error(`git ${args[0] ?? ""} failed`);
+        return args.includes("rev-parse") ? view.restore(ran.stdout) : ran.stdout;
+    }
+    finally {
+        view.dispose();
+    }
 }

package/dist/telegram-progress.js

@@ -7,7 +7,7 @@
 import { assignmentOf } from "./assignment.js";
 import { chatResultHref, chatControlHref } from "./chat-controls.js";
 import { phoneText, projectLabel } from "./telegram-status.js";
-import { assignmentStatusFacts, headlineEmoji, pullRequestFactOf, requirementsOf, statusDetailLines, unverifiedWhenRefuted, taskStatusOf } from "./task-status.js";
+import { approvedCheckOf, assignmentStatusFacts, checksFactOf, headlineEmoji, pullRequestFactOf, requirementsOf, statusDetailLines, unverifiedWhenRefuted, taskStatusOf } from "./task-status.js";
 import { leadClaimOf } from "./lead-voice.js";
 import { leadNameOf } from "./lead-identity.js";
 import { chatTitle } from "./chat-voice.js";
@@ -46,10 +46,10 @@ export function telegramProgressCard(store, run, taskId, project, now = new Date
         const proof = store.proofVerdictFor(run.id);
         const machine = proof?.machineVerdict ?? proof?.verdict ?? null;
         const exit = failedCheckExit(proof?.reasons ?? []);
-        const checks = recorded !== null ? { status: recorded.status, exitCode: recorded.exitCode, head: run.headRevision }
+        // The one answer (task-status.ts approvedCheckOf) when a saved check was read; a verdict alone claims no pass.
+        const checks = recorded !== null ? approvedCheckOf(machine, proof?.reasons ?? [], checksFactOf(recorded, run.headRevision))
             : exit !== null ? { status: "failed", exitCode: exit, head: run.headRevision }
-                : machine === "verified" ? { status: "passed", exitCode: null, head: run.headRevision }
-                    : machine === "attested" ? { status: "not-run", exitCode: null, head: null } : null;
+                : machine === "attested" ? { status: "not-run", exitCode: null, head: null } : null;
         facts = { stage: "finished", report: run.role === "scout", checks, requirements: unverifiedWhenRefuted(requirementsOf(proof?.matrix), proof?.verdict),
             ...(pullRequest === undefined ? {} : { pullRequest }) };
     }