toolroll 0.9.74 → 0.9.75

package/dist/task-status.js

@@ -12,6 +12,7 @@
  * technical reason stays one tap away in `why`. */
 import { DEFAULT_LEAD_NAME } from "./lead-identity.js";
 import { html } from "./html.js";
+import { FAILED_CHECK } from "./result-acts.js";
 import { CODE_NEED, NEEDS, needSentence, waitSentence } from "./needs-you.js";
 /** A cancelled task with a successor reads "Replaced by <id>" everywhere, never "Cancelled". */
 export const replacedWords = (successor) => `Replaced by ${successor}`;
@@ -38,6 +39,67 @@ export function releaseStateOf(checks) {
 export function checkBackingOf(checks) {
     return checks?.status === "passed" ? "covered" : checksUnderway(checks) ? "running" : releaseStateOf(checks);
 }
+/**
+ * Did the approved check pass for this result? The ONE answer the status headline and sentence, the Project checks
+ * row, the road's Checks step and the result page all read, so none of them can say "passed" while another says the
+ * check couldn't be read. Two records speak to it: the machine verdict sealed when the build finished, and the saved
+ * check receipt read now (with any follow-up check on the same commit). Fail closed: the check passed only when the
+ * receipt read now says so. A verdict that recorded a pass whose receipt is missing, says nothing ran, or can't be
+ * read is unreadable; a verdict that recorded a failure stays failed unless a later check on the same commit passed.
+ * `checks` undefined or null: nothing was read. Returns the check as every surface shows it (null: nothing to show).
+ */
+export function approvedCheckOf(verdict, reasons, checks) {
+    let failedExit = null;
+    for (const reason of reasons) {
+        const found = FAILED_CHECK.exec(reason);
+        if (found !== null) {
+            failedExit = Number(found[1]);
+            break;
+        }
+    }
+    const recordedFail = verdict === "refuted" && failedExit !== null;
+    const recordedPass = verdict === "verified";
+    const read = checks ?? null;
+    if (read === null) {
+        if (recordedFail)
+            return { status: "failed", exitCode: failedExit, head: null };
+        return recordedPass ? { status: "unavailable", exitCode: null, head: null } : null;
+    }
+    if (read.status === "passed" || read.status === "failed" || read.status === "running")
+        return read;
+    // Checks Off covered by a passing release check read as passed (the row says on which commit); nothing to correct.
+    if (read.level === "off" && read.release != null && !recordedFail)
+        return read;
+    if (recordedFail)
+        return { ...read, status: "failed", exitCode: failedExit };
+    // The verdict says the check passed, the receipt read now can't show it: the two disagree, so it doesn't count.
+    if (recordedPass)
+        return { ...read, status: "unavailable", exitCode: null };
+    return read;
+}
+export function approvedCheckStateOf(checks) {
+    if (checks == null)
+        return null;
+    // A failure stands while a new check runs: only its result can change the answer. A check that couldn't be read (a
+    // result waiting for its batch check has none yet) reads running while one is underway, and never passed.
+    if (checks.status === "failed")
+        return "failed";
+    if (checksUnderway(checks) || checks.status === "running")
+        return "running";
+    if (checks.status === "unavailable")
+        return "unreadable";
+    if (checks.status === "passed")
+        return "passed";
+    if (checks.level === "off")
+        return checks.release != null ? "passed" : "off";
+    return "not-run";
+}
+/** A saved check that can't be read, in the words every surface uses. */
+export const CHECK_UNREADABLE = "The check result couldn't be read.";
+export const CHECK_UNREADABLE_ASK = `${CHECK_UNREADABLE} Run checks on it, or open the result to see why.`;
+/** A saved check whose files are intact but whose command was approved again since it ran. */
+export const CHECK_COMMAND_CHANGED = "The check command changed since this check; run checks again.";
+const unreadableAsk = (checks) => checks?.cause === "command-changed" ? CHECK_COMMAND_CHANGED : CHECK_UNREADABLE_ASK;
 /** "T2", "T2 and T3", "T2, T3 and 2 more": short enough for one line. The full list is on the result. */
 export function peerWords(peers, shown = 2) {
     if (peers.length <= shown)
@@ -65,10 +127,11 @@ function resultAsk(facts) {
     if (blocker !== undefined)
         return blocker.message;
     const req = facts.requirements;
-    if (req == null || facts.accepted === true || req.unverified === true)
-        return null;
-    if ((req.yours > 0 || (req.unshown ?? 0) > 0) && req.ask != null)
+    if (req != null && facts.accepted !== true && req.unverified !== true && (req.yours > 0 || (req.unshown ?? 0) > 0) && req.ask != null)
         return req.ask;
+    // A check that can't be read is never a pass: a person runs it again or looks at why, unless they already accepted.
+    if (facts.accepted !== true && approvedCheckStateOf(facts.checks) === "unreadable")
+        return unreadableAsk(facts.checks);
     return null;
 }
 export function headlineOf(facts) {
@@ -122,6 +185,8 @@ function sentenceOf(headline, facts) {
             }
             if (facts.checks?.batch?.state === "waiting")
                 return "Its full check runs with other results within 10 minutes. Review the change, then mark it complete.";
+            if (facts.checks?.status === "unavailable")
+                return `${facts.checks.cause === "command-changed" ? CHECK_COMMAND_CHANGED : CHECK_UNREADABLE} Review the change, then mark it complete.`;
             // Never claim a check that isn't known to have passed.
             if (facts.checks == null)
                 return "Review the change, then mark it complete.";
@@ -155,7 +220,11 @@ function detailsOf(headline, facts) {
         const batch = checks.batch ?? null;
         const together = batch === null ? null : checkedTogetherWords(batch);
         const batchWhy = batch === null ? null : BATCH_WHY[batch.state] ?? null;
-        if (batch?.state === "waiting")
+        // A failure or an unreadable check keeps its words while a new check runs, so the row never reads better than the answer.
+        const again = checksUnderway(checks) && checks.status === "failed" ? " · running again" : "";
+        if (again !== "")
+            row("checks", CHECKS_LABEL, `${quick ? "Quick checks failed" : "Failed"}${checks.exitCode === null ? "" : ` (exit ${checks.exitCode})`}${again}`, problem(headline), headline === "Failed" ? { href: checksHref } : { action: { label: "See what failed", href: checksHref } });
+        else if (batch?.state === "waiting")
             row("checks", CHECKS_LABEL, "Waiting to check with other results", "running", { href: checksHref });
         else if (checks.running != null)
             row("checks", CHECKS_LABEL, `${checks.running === "quick" ? "Quick" : "Full"} checks running`, "running", { href: checksHref });
@@ -178,6 +247,8 @@ function detailsOf(headline, facts) {
         else if (checks.status === "not-run")
             row("checks", CHECKS_LABEL, "Didn't run", "none", runChecks === null ? {} : { action: runChecks });
         // A saved check that can't be read is run again where that is possible.
+        else if (checks.cause === "command-changed")
+            row("checks", CHECKS_LABEL, "Check command changed since", "note", { action: runChecks ?? { label: OPEN_RESULT, href: facts.links?.result ?? null }, why: CHECK_COMMAND_CHANGED });
         else
             row("checks", CHECKS_LABEL, "Couldn't be read", "note", { action: runChecks ?? { label: OPEN_RESULT, href: facts.links?.result ?? null } });
     }
@@ -255,7 +326,7 @@ export function statusOf(facts) {
     const primaryAction = need === null || ownWords ? facts.action ?? null : { label: need.action.label, href: facts.action?.href ?? null };
     const sentence = lead === "on-it" ? leadSentence(headline, facts) : lead === "lapsed" ? `${leadLapsed(facts.leadName)} ${sentenceOf(headline, facts)}` : sentenceOf(headline, facts);
     return { headline, tone: HEADLINE_TONE[headline], sentence, details: detailsOf(headline, facts),
-        primaryAction, why: [...new Set(facts.why ?? [])].filter(one => one.trim() !== ""), need };
+        primaryAction, why: [...new Set(facts.why ?? [])].filter(one => one.trim() !== ""), need, check: facts.report ? null : approvedCheckStateOf(facts.checks) };
 }
 /** The name most surfaces already import. */
 export const taskStatusOf = statusOf;
@@ -267,7 +338,7 @@ const CODE_STAGE = {
     "waiting-dependency": ["queued"], "scouting-ready": ["queued"], "planning-ready": ["queued"], "provider-quota": ["queued"],
     // A request the planner cannot be given (too long to hand back, say) waits on a person to shorten it.
     "planner-source": ["needs-you", "fix-request"],
-    running: ["building"], reviewing: ["reviewing"], "review-pending": ["building"],
+    running: ["building"], reviewing: ["reviewing"], "review-pending": ["building"], "checks-running": ["checking"],
     "signed-out": ["needs-you", "sign-in"],
     "needs-approval": ["needs-you", "approval"],
     "waiting-decision": ["needs-you", "answer"], "decision-queue": ["needs-you", "answer"],
@@ -432,7 +503,8 @@ export function completionBlockersOf(f) {
     }
     else if (!f.report && f.checkRequired && f.checks?.status !== "passed" && release === undefined) {
         blockers.push({ key: "check-missing", message: checksUnderway(f.checks) ? "Its project check hasn't finished yet. Mark it complete once it passes."
-                : "No passing project check is recorded for this result. Run checks on it, then mark it complete." });
+                : f.checks?.status === "unavailable" ? f.checks.cause === "command-changed" ? `${CHECK_COMMAND_CHANGED.replace(/; run checks again\.$/, ".")} Run checks again, then mark it complete.` : `${CHECK_UNREADABLE} Run checks on it, then mark it complete.`
+                    : "No passing project check is recorded for this result. Run checks on it, then mark it complete." });
     }
     if (!f.accepted && f.checks?.status !== "failed") {
         const refuted = f.verdict === "refuted";
@@ -457,11 +529,24 @@ export function unverifiedWhenRefuted(requirements, verdict) {
 export function evidenceOf(receipt, problems = receipt?.caveats ?? []) {
     if (receipt === null)
         return null;
+    // The check's own reading is the Project checks row's to say (a changed command is not a missing file).
+    problems = problems.filter(one => one !== receipt.checks.detail);
     const shortened = receipt.artifacts.filter(one => !one.complete).length + problems.filter(one => /shortened|cut short/.test(one)).length;
     const damaged = problems.filter(one => /unavailable or changed|no longer verif|cannot be read|could not be read|failed capture|altered|damaged/i.test(one)).length;
     const missing = problems.filter(one => /missing|ambiguous|no longer exists/i.test(one) && !/unavailable or changed/.test(one)).length;
     return { shortened, missing, damaged };
 }
+/** A saved check reading as the shared fact (head, level, a follow-up running, a batch, release coverage). */
+export function checksFactOf(checks, head) {
+    return { status: checks.status, exitCode: checks.exitCode, head,
+        ...(checks.level == null ? {} : { level: checks.level }), ...(checks.running == null ? {} : { running: checks.running }),
+        ...(checks.batch == null ? {} : { batch: checks.batch }), ...(checks.release == null ? {} : { release: checks.release }),
+        ...(checks.cause == null ? {} : { cause: checks.cause }) };
+}
+/** A receipt's approved check, as every surface reads it (`approvedCheckOf` over its verdict and its saved check). */
+export function receiptChecksOf(receipt) {
+    return approvedCheckOf(receipt.proof?.verdict ?? null, receipt.proof?.reasons ?? [], checksFactOf(receipt.checks, receipt.head));
+}
 /** The status facts of one assignment, as every surface reads them. */
 export function assignmentStatusFacts(assignment, options = {}) {
     const { stage, need, wait } = assignmentStageOf(assignment, options.work ?? null, options.planning ?? false);
@@ -471,10 +556,7 @@ export function assignmentStatusFacts(assignment, options = {}) {
     // A saved result's rows show whenever it is the reason a person is needed, too.
     const withResult = finished || stage === "failed" || ((stage === "needs-you" || stage === "waiting") && receipt !== null);
     const report = receipt?.completionKind === "research-report";
-    const checks = receipt === null || !withResult ? null
-        : { status: receipt.checks.status, exitCode: receipt.checks.exitCode, head: receipt.head,
-            ...(receipt.checks.level == null ? {} : { level: receipt.checks.level }), ...(receipt.checks.running == null ? {} : { running: receipt.checks.running }),
-            ...(receipt.checks.batch == null ? {} : { batch: receipt.checks.batch }), ...(receipt.checks.release == null ? {} : { release: receipt.checks.release }) };
+    const checks = receipt === null || !withResult ? null : receiptChecksOf(receipt);
     const publication = assignment.publication;
     const pullRequest = options.pullRequest !== undefined ? options.pullRequest
         : publication === null ? (withResult && !report ? { state: "none", number: null, url: null, ci: null, error: null } : null)

package/dist/teardown-git.d.ts

@@ -33,4 +33,30 @@ export declare function checkoutIncludes(checkout: string): boolean;
  * program (anything but INERT_LFS). A file that
  * isn't a plain one, or doesn't parse, counts as naming one. */
 export declare function lfsExtensionIn(checkout: string): boolean;
-export declare function checkoutGit(inner?: Runner): Runner;
+/** `mode` "read" is for reading a checkout an agent may still be writing (the code page): every command also takes
+ * readFlags() and runs against the checkout's readView, so neither its config nor its info/attributes can change
+ * between the inspection and the run. */
+export declare function checkoutGit(inner?: Runner, mode?: "build" | "read"): Runner;
+/**
+ * Flags for reading a checkout an agent writes while a page waits (docs/plans/get-side-effects.md). Command-line
+ * settings win over anything the checkout's config says, even one changed after it was inspected: no fsmonitor, hooks,
+ * pager or credential helper; no network (lazy fetch off, every protocol refused); and attributes read from the empty
+ * tree, so no filter or textconv a .gitattributes names can run. A diff also takes --no-ext-diff --no-textconv.
+ */
+export declare const PAGE_READ_FLAGS: readonly string[];
+/** The read flags, for every read of an agent-written checkout, whatever the HTTP method (security review of
+ * 01bf3114): the worktree's attributes come from the empty tree. Git still reads the repository's info/attributes and
+ * its config as it starts, so the flags alone don't stop a filter planted in both after the inspection: every read
+ * also runs against the checkout's readView (checkoutGitSync, checkoutGit "read"), whose config and info are the plane's. The cost is cosmetic: a checkout's line-ending or encoding rules are not applied, so
+ * a file they would normalize can read as changed (fail closed: shipping then asks for a clean commit). */
+export declare function readFlags(): readonly string[];
+/**
+ * checkoutGit, synchronously, for reads a page shows from a checkout an agent writes (docs/plans/get-side-effects.md):
+ * the same refusals (an include, an .lfsconfig extension, a config key that can run a command), no system or global
+ * config, the operator's own values carried, PAGE_READ_FLAGS and the checkout's readView (which hold even if its config
+ * or info/attributes change after they were read), submodules skipped, bounded. A refusal throws.
+ */
+export declare function checkoutGitSync(cwd: string, args: readonly string[], options?: {
+    timeoutMs?: number;
+    maxBuffer?: number;
+}): string;

package/dist/teardown-git.js

@@ -11,7 +11,8 @@
  * nothing is removed.
  */
 import { spawnSync } from "node:child_process";
-import { existsSync, lstatSync, readdirSync, readFileSync } from "node:fs";
+import { existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, realpathSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import { run } from "./exec.js";
 import { ENV, ENV_ALLOWLIST } from "./remote-main.js";
@@ -166,47 +167,112 @@ export function teardownGit(runner = run) {
  * that can't be read so counts as including.
  */
 export function checkoutIncludes(checkout) {
-    const regular = (path) => {
-        try {
-            const held = lstatSync(path);
-            if (!held.isFile() || held.size > 1024 * 1024)
-                return null;
-            return readFileSync(path, "utf8");
-        }
-        catch {
+    const dirs = gitDirsOf(checkout);
+    if (dirs === null)
+        return true;
+    for (const path of [join(dirs.common, "config"), join(dirs.gitdir, "config.worktree")]) {
+        if (!existsSync(path) && path.endsWith("config.worktree"))
+            continue;
+        if (configIncludes(path))
+            return true;
+    }
+    return false;
+}
+/** One config file, read only as the regular file it is (bounded), or null. */
+function regularFile(path) {
+    try {
+        const held = lstatSync(path);
+        if (!held.isFile() || held.size > 1024 * 1024)
             return null;
-        }
-    };
+        return readFileSync(path, "utf8");
+    }
+    catch {
+        return null;
+    }
+}
+/** A checkout's git directory and common directory, as git finds them from its `.git` (a folder, or a one-line
+ * `gitdir: ` file); null when the pointer isn't one git would read the same way. */
+function gitDirsOf(checkout) {
     let gitdir = join(checkout, ".git");
     try {
         if (!lstatSync(gitdir).isDirectory()) {
             // As git reads a .git file: "gitdir: " then the path, one line; anything else (more lines, stray space) refused.
-            const text = (regular(gitdir) ?? "").replace(/\r?\n$/, "");
+            const text = (regularFile(gitdir) ?? "").replace(/\r?\n$/, "");
             if (!text.startsWith("gitdir: ") || /[\r\n]/.test(text))
-                return true;
+                return null;
             const pointer = text.slice("gitdir: ".length);
             if (pointer === "" || pointer !== pointer.trim())
-                return true;
+                return null;
             gitdir = resolve(checkout, pointer);
         }
     }
     catch {
+        return null;
+    }
+    const named = regularFile(join(gitdir, "commondir"))?.trim();
+    return { gitdir, common: named === undefined || named === "" ? gitdir : resolve(gitdir, named) };
+}
+/** Whether one config file includes another (or can't be read as a plain file): by a plain reading, and as git itself
+ * parses it, includes not followed (only this one regular file, from a neutral folder, with no other config read). */
+function configIncludes(path) {
+    const text = regularFile(path);
+    if (text === null || /^\s*\[\s*include(if)?\b/im.test(text))
         return true;
+    const parsed = spawnSync("git", ["config", "--file", path, "--no-includes", "--name-only", "--list", "-z"], { cwd: "/", encoding: "utf8", timeout: 5_000, env: { PATH: process.env["PATH"] ?? "", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", HOME: "/nonexistent" } });
+    return parsed.status !== 0 || parsed.stdout.split("\0").some(name => /^(include\.path|includeif\..*\.path)$/i.test(name));
+}
+function readView(checkout) {
+    const dirs = gitDirsOf(checkout);
+    if (dirs === null)
+        throw new Error("the checkout's .git couldn't be read as git reads it");
+    const view = realpathSync(mkdtempSync(join(tmpdir(), "toolroll-git-read-")));
+    const dispose = () => rmSync(view, { recursive: true, force: true });
+    try {
+        let config = regularFile(join(dirs.common, "config"));
+        if (config === null)
+            throw new Error("the checkout's git config couldn't be read as a plain file");
+        const configPath = join(view, "config");
+        writeFileSync(configPath, config, { mode: 0o600 });
+        const plain = { cwd: "/", encoding: "utf8", timeout: 5_000, env: { PATH: process.env["PATH"] ?? "", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", HOME: "/nonexistent" } };
+        if (/worktreeconfig/i.test(config)) {
+            const flag = spawnSync("git", ["config", "--file", configPath, "--no-includes", "--type=bool", "--get", "extensions.worktreeConfig"], plain);
+            if (flag.status !== 0 && flag.status !== 1)
+                throw new Error("the checkout's git config couldn't be read");
+            if (flag.stdout.trim() === "true") {
+                // Git would also read the worktree's config.worktree, which the agent can still change: folded in as it is now.
+                const worktree = join(dirs.gitdir, "config.worktree");
+                const own = existsSync(worktree) ? regularFile(worktree) : "";
+                if (own === null)
+                    throw new Error("the checkout's config.worktree couldn't be read as a plain file");
+                config = `${config}\n${own}`;
+                writeFileSync(configPath, config, { mode: 0o600 });
+            }
+            const unset = spawnSync("git", ["config", "--file", configPath, "--unset-all", "extensions.worktreeConfig"], plain);
+            if (unset.status !== 0 && unset.status !== 5)
+                throw new Error("the checkout's git config couldn't be read");
+        }
+        if (configIncludes(configPath))
+            throw new Error("the checkout's git config includes another file");
+        mkdirSync(join(view, "info"));
+        const exclude = join(dirs.common, "info", "exclude");
+        if (existsSync(exclude)) {
+            const text = regularFile(exclude);
+            if (text !== null)
+                writeFileSync(join(view, "info", "exclude"), text, { mode: 0o600 });
+        }
+        for (const name of readdirSync(dirs.common)) {
+            if (name === "config" || name === "info" || name === "hooks")
+                continue;
+            symlinkSync(join(dirs.common, name), join(view, name));
+        }
     }
-    const common = (() => { const named = regular(join(gitdir, "commondir"))?.trim(); return named === undefined || named === "" ? gitdir : resolve(gitdir, named); })();
-    for (const path of [join(common, "config"), join(gitdir, "config.worktree")]) {
-        if (!existsSync(path) && path.endsWith("config.worktree"))
-            continue;
-        const text = regular(path);
-        if (text === null || /^\s*\[\s*include(if)?\b/im.test(text))
-            return true;
-        // And as git itself parses it, includes not followed (only this one regular file, from a neutral folder, with no
-        // other config read): an include git sees by any spelling is refused.
-        const parsed = spawnSync("git", ["config", "--file", path, "--no-includes", "--name-only", "--list", "-z"], { cwd: "/", encoding: "utf8", timeout: 5_000, env: { PATH: process.env["PATH"] ?? "", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", HOME: "/nonexistent" } });
-        if (parsed.status !== 0 || parsed.stdout.split("\0").some(name => /^(include\.path|includeif\..*\.path)$/i.test(name)))
-            return true;
+    catch (error) {
+        dispose();
+        throw error;
     }
-    return false;
+    // Where git names the view (rev-parse --git-common-dir), the caller is told the repository's own common directory.
+    const restore = (output) => output.split("\n").map(line => line === view || line.startsWith(`${view}/`) ? dirs.common + line.slice(view.length) : line).join("\n");
+    return { env: { GIT_DIR: dirs.gitdir, GIT_COMMON_DIR: view, GIT_WORK_TREE: resolve(checkout) }, restore, dispose };
 }
 /** Whether the checkout's .lfsconfig (read as git parses it, that file only) sets any git-lfs key that could name a
  * program (anything but INERT_LFS). A file that
@@ -223,7 +289,10 @@ export function lfsExtensionIn(checkout) {
     const parsed = spawnSync("git", ["config", "--file", path, "--no-includes", "--name-only", "--list", "-z"], { cwd: "/", encoding: "utf8", timeout: 5_000, env: { PATH: process.env["PATH"] ?? "", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", HOME: "/nonexistent" } });
     return parsed.status !== 0 || parsed.stdout.split("\0").filter(Boolean).some(name => lfsCommand(name.toLowerCase()) || /^include(if)?\./i.test(name));
 }
-export function checkoutGit(inner = run) {
+/** `mode` "read" is for reading a checkout an agent may still be writing (the code page): every command also takes
+ * readFlags() and runs against the checkout's readView, so neither its config nor its info/attributes can change
+ * between the inspection and the run. */
+export function checkoutGit(inner = run, mode = "build") {
     return async (file, args, options) => {
         if (file !== "git")
             return inner(file, args, options);
@@ -233,21 +302,98 @@ export function checkoutGit(inner = run) {
         // git-lfs also reads .lfsconfig from the checkout: one that names an extension (a command it would run) is refused.
         if (lfsExtensionIn(cwd))
             return refused("the checkout's .lfsconfig sets a git-lfs key that can run a command");
-        // The checkout's own config may name no command.
-        const own = await inner("git", ["--no-optional-locks", "config", "--list", "--show-scope", "-z"], options);
-        if (own.code !== 0)
-            return refused("its config couldn't be read");
+        let view = null;
+        if (mode === "read") {
+            try {
+                view = readView(cwd);
+            }
+            catch (error) {
+                return refused(error instanceof Error ? error.message : "the checkout couldn't be read");
+            }
+        }
+        try {
+            const viewed = { ...options, env: { ...(options?.env ?? {}), ...(view?.env ?? {}) } };
+            // The checkout's own config may name no command.
+            const own = await inner("git", ["--no-optional-locks", "config", "--list", "--show-scope", "-z"], view === null ? options : viewed);
+            if (own.code !== 0)
+                return refused("its config couldn't be read");
+            const key = commandSetting(own.stdout);
+            if (key !== null)
+                return refused(`the checkout's git config sets ${key}, which can run a command`);
+            // The operator's own config contributes values only (carriedSettings); git then reads no global or system config.
+            // A read carries no filter: it reads attributes from the empty tree anyway.
+            const carried = view === null ? carriedSettings(own.stdout) : withoutFilters(carriedSettings(own.stdout));
+            const env = { ...viewed.env, GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null" };
+            // Never into a submodule or nested repository, whose own config this never read: status and diff skip them.
+            const safeArgs = [...args];
+            const command = safeArgs.findIndex(arg => arg === "status" || arg === "diff");
+            if (command >= 0 && !safeArgs.includes("--ignore-submodules=all"))
+                safeArgs.splice(command + 1, 0, "--ignore-submodules=all");
+            const flags = view === null ? [] : readFlags();
+            const ran = await inner("git", [...TEARDOWN_FLAGS, ...flags, "-c", "diff.ignoreSubmodules=all", "-c", "commit.gpgsign=false", "-c", "tag.gpgsign=false", ...carried, ...safeArgs], { ...options, env });
+            return view !== null && args.includes("rev-parse") ? { ...ran, stdout: view.restore(ran.stdout) } : ran;
+        }
+        finally {
+            view?.dispose();
+        }
+    };
+}
+const withoutFilters = (carried) => carried.filter((one, at, all) => !(one.startsWith("filter.") || (one === "-c" && all[at + 1]?.startsWith("filter."))));
+/**
+ * Flags for reading a checkout an agent writes while a page waits (docs/plans/get-side-effects.md). Command-line
+ * settings win over anything the checkout's config says, even one changed after it was inspected: no fsmonitor, hooks,
+ * pager or credential helper; no network (lazy fetch off, every protocol refused); and attributes read from the empty
+ * tree, so no filter or textconv a .gitattributes names can run. A diff also takes --no-ext-diff --no-textconv.
+ */
+export const PAGE_READ_FLAGS = [
+    "--no-lazy-fetch", "--attr-source=4b825dc642cb6eb9a060e54bf8d69288fbee4904",
+    "-c", "protocol.allow=never", "-c", "core.pager=cat", "-c", "core.alternateRefsCommand=", "-c", "core.attributesFile=/dev/null",
+];
+/** The read flags, for every read of an agent-written checkout, whatever the HTTP method (security review of
+ * 01bf3114): the worktree's attributes come from the empty tree. Git still reads the repository's info/attributes and
+ * its config as it starts, so the flags alone don't stop a filter planted in both after the inspection: every read
+ * also runs against the checkout's readView (checkoutGitSync, checkoutGit "read"), whose config and info are the plane's. The cost is cosmetic: a checkout's line-ending or encoding rules are not applied, so
+ * a file they would normalize can read as changed (fail closed: shipping then asks for a clean commit). */
+export function readFlags() {
+    return PAGE_READ_FLAGS;
+}
+/**
+ * checkoutGit, synchronously, for reads a page shows from a checkout an agent writes (docs/plans/get-side-effects.md):
+ * the same refusals (an include, an .lfsconfig extension, a config key that can run a command), no system or global
+ * config, the operator's own values carried, PAGE_READ_FLAGS and the checkout's readView (which hold even if its config
+ * or info/attributes change after they were read), submodules skipped, bounded. A refusal throws.
+ */
+export function checkoutGitSync(cwd, args, options = {}) {
+    if (checkoutIncludes(cwd))
+        throw new Error("the checkout's git config includes another file, or couldn't be read as a plain file");
+    if (lfsExtensionIn(cwd))
+        throw new Error("the checkout's .lfsconfig sets a git-lfs key that can run a command");
+    // Its config and info/attributes as read once, in a folder of the plane's own: neither can change before git runs.
+    const view = readView(cwd);
+    try {
+        const env = { PATH: process.env["PATH"] ?? "", HOME: process.env["HOME"] ?? "", LANG: "C", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", GIT_TERMINAL_PROMPT: "0", ...view.env };
+        const bounded = { cwd, env, encoding: "utf8", timeout: options.timeoutMs ?? 60_000, maxBuffer: options.maxBuffer ?? 1_048_576, stdio: ["ignore", "pipe", "pipe"] };
+        const own = spawnSync("git", ["--no-optional-locks", "config", "--list", "--show-scope", "-z"], bounded);
+        if (own.status !== 0)
+            throw new Error("its config couldn't be read");
         const key = commandSetting(own.stdout);
         if (key !== null)
-            return refused(`the checkout's git config sets ${key}, which can run a command`);
-        // The operator's own config contributes values only (carriedSettings); git then reads no global or system config.
-        const carried = carriedSettings(own.stdout);
-        const env = { ...(options?.env ?? {}), GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null" };
-        // Never into a submodule or nested repository, whose own config this never read: status and diff skip them.
+            throw new Error(`the checkout's git config sets ${key}, which can run a command`);
         const safeArgs = [...args];
         const command = safeArgs.findIndex(arg => arg === "status" || arg === "diff");
         if (command >= 0 && !safeArgs.includes("--ignore-submodules=all"))
             safeArgs.splice(command + 1, 0, "--ignore-submodules=all");
-        return inner("git", [...TEARDOWN_FLAGS, "-c", "diff.ignoreSubmodules=all", "-c", "commit.gpgsign=false", "-c", "tag.gpgsign=false", ...carried, ...safeArgs], { ...options, env });
-    };
+        // An external diff program is named by config, which may change after it was read: never used here.
+        if (command >= 0 && safeArgs[command] === "diff")
+            safeArgs.splice(command + 1, 0, "--no-ext-diff", "--no-textconv");
+        // The operator's own values, but no filter: PAGE_READ_FLAGS reads attributes from the empty tree anyway.
+        const carried = withoutFilters(carriedSettings(own.stdout));
+        const ran = spawnSync("git", [...TEARDOWN_FLAGS, ...readFlags(), "-c", "diff.ignoreSubmodules=all", ...carried, ...safeArgs], bounded);
+        if (ran.status !== 0)
+            throw new Error(`git ${args[0] ?? ""} failed`);
+        return args.includes("rev-parse") ? view.restore(ran.stdout) : ran.stdout;
+    }
+    finally {
+        view.dispose();
+    }
 }

package/dist/telegram-progress.js

@@ -7,7 +7,7 @@
 import { assignmentOf } from "./assignment.js";
 import { chatResultHref, chatControlHref } from "./chat-controls.js";
 import { phoneText, projectLabel } from "./telegram-status.js";
-import { assignmentStatusFacts, headlineEmoji, pullRequestFactOf, requirementsOf, statusDetailLines, unverifiedWhenRefuted, taskStatusOf } from "./task-status.js";
+import { approvedCheckOf, assignmentStatusFacts, checksFactOf, headlineEmoji, pullRequestFactOf, requirementsOf, statusDetailLines, unverifiedWhenRefuted, taskStatusOf } from "./task-status.js";
 import { leadClaimOf } from "./lead-voice.js";
 import { leadNameOf } from "./lead-identity.js";
 import { chatTitle } from "./chat-voice.js";
@@ -46,10 +46,10 @@ export function telegramProgressCard(store, run, taskId, project, now = new Date
         const proof = store.proofVerdictFor(run.id);
         const machine = proof?.machineVerdict ?? proof?.verdict ?? null;
         const exit = failedCheckExit(proof?.reasons ?? []);
-        const checks = recorded !== null ? { status: recorded.status, exitCode: recorded.exitCode, head: run.headRevision }
+        // The one answer (task-status.ts approvedCheckOf) when a saved check was read; a verdict alone claims no pass.
+        const checks = recorded !== null ? approvedCheckOf(machine, proof?.reasons ?? [], checksFactOf(recorded, run.headRevision))
             : exit !== null ? { status: "failed", exitCode: exit, head: run.headRevision }
-                : machine === "verified" ? { status: "passed", exitCode: null, head: run.headRevision }
-                    : machine === "attested" ? { status: "not-run", exitCode: null, head: null } : null;
+                : machine === "attested" ? { status: "not-run", exitCode: null, head: null } : null;
         facts = { stage: "finished", report: run.role === "scout", checks, requirements: unverifiedWhenRefuted(requirementsOf(proof?.matrix), proof?.verdict),
             ...(pullRequest === undefined ? {} : { pullRequest }) };
     }

package/dist/telegram-status.js

@@ -4,8 +4,8 @@ import { manualReviewOnly } from "./proof.js";
  * No provider calls, repository access, new workflow state, or inferred success. */
 import { diagnoseTaskDispatch, withDispatchDiagnoses } from "./dispatch.js";
 import { familyCompleted } from "./result-completion.js";
-import { assignmentStatusFacts, plainReasonOf, stageOfDispatch, taskStatusOf } from "./task-status.js";
-import { assignmentOf } from "./assignment.js";
+import { approvedCheckOf, approvedCheckStateOf, assignmentStatusFacts, checksFactOf, plainReasonOf, stageOfDispatch, taskStatusOf } from "./task-status.js";
+import { assignmentChecksForRun, assignmentOf } from "./assignment.js";
 import { CHAT_CONTROLS, chatControlHref, chatResultHref } from "./chat-controls.js";
 export function phoneCommand(text) {
     // Slash forms everywhere; the bare words too, because Slack and Discord
@@ -257,7 +257,12 @@ export function phoneTaskView(store, repos, id, now, root) {
             const proof = store.proofVerdictFor(result.id);
             link = taskLinkFor(id, d, { run: result.id, verdict: proof !== null });
             const accepted = store.proofAcceptance(result.id) !== null;
-            const proofWords = { verified: "Checks passed at completion", attested: "Checks reported by the agent, not run by Toolroll", short: "Required saved material is missing", refuted: "The saved result conflicts with the approved scope" };
+            // Did the approved check pass (task-status.ts approvedCheckOf): read with the saved files, else no claim at all.
+            const checkNow = root === undefined || proof?.verdict !== "verified" ? null
+                : approvedCheckStateOf(approvedCheckOf(proof.verdict, proof.reasons, checksFactOf(assignmentChecksForRun(store, root, result.id, now), result.headRevision)));
+            const verifiedWords = root === undefined ? "Open the result to see its checks" : checkNow === "passed" ? "Checks passed at completion"
+                : checkNow === "failed" ? "Checks failed" : checkNow === "running" ? "Checks running" : "The check result couldn't be read";
+            const proofWords = { verified: verifiedWords, attested: "Checks reported by the agent, not run by Toolroll", short: "Required saved material is missing", refuted: "The saved result conflicts with the approved scope" };
             lines.push(`Checks: ${proof === null ? "No completion record saved" : manualReviewOnly(proof) ? accepted ? "Accepted by a person; the recorded checks are unchanged" : "A person must inspect this result; no recorded check failed" : proofWords[proof.verdict]}.`);
             if (manualReviewOnly(proof) && !accepted)
                 lines.push('Reply “Send the result summary” for the checks, notes and screenshots.');

package/dist/tool-secret-store.js

@@ -27,6 +27,7 @@
  * database records which key Toolroll made: a folder, key, link or lock that
  * something else put there first is refused, never used.
  */
+import { inReadOnlyRequest } from "./read-only-request.js";
 import { spawnSync } from "node:child_process";
 import { createCipheriv, createDecipheriv, createHash, randomBytes } from "node:crypto";
 import { closeSync, constants, fstatSync, fsyncSync, linkSync, lstatSync, mkdirSync, openSync, readSync, readdirSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, writeSync } from "node:fs";
@@ -541,6 +542,10 @@ export function secretFolder(state) {
     const known = folders.get(root);
     if (known !== undefined && unchanged(known))
         return known;
+    // A page visit prepares nothing (docs/plans/get-side-effects.md): the console prepares its folder as it starts, and
+    // an action checks a changed one again. Until then the page says secrets can't be read right now.
+    if (inReadOnlyRequest())
+        throw new SecretStoreError(NOT_READY);
     // Changed since it was checked (or never seen): checked against the same record (the database's, for Toolroll's
     // own folder; this process's, for a test's), and refused if it doesn't match.
     const named = pending.get(root);
@@ -797,6 +802,9 @@ export function readHeldSecret(state, name, file) {
     const backend = secretBackend();
     if (backend === null)
         return readOwnFile(path);
+    // A page visit moves nothing and takes no lock (docs/plans/get-side-effects.md): the keychain, else the old file.
+    if (inReadOnlyRequest())
+        return readSealed(backend, folder, heldItem(folder, name)) ?? readOwnFile(path);
     return withSecretLock(folder, `held.${name}`, () => {
         moveHeldIn(backend, folder, name, path);
         return readSealed(backend, folder, heldItem(folder, name));

package/dist/toolroll-update-ui.d.ts

@@ -17,6 +17,8 @@ export type UpdatesView = {
         problem: string;
     } | {
         off: true;
+    } | {
+        pending: true;
     };
     method: InstallMethod;
     journal: RuntimeUpdateJournal | null;

package/dist/toolroll-update-ui.js

@@ -65,9 +65,10 @@ export function updatesHtml(view, notice) {
         : view.method.kind === "source" ? html `<h2>Toolroll ${view.current}</h2><p class="meta">This runs from a source checkout. Update it with git.</p>`
             : newer && view.method.kind === "desktop" ? html `<h2>Toolroll ${latest} is available</h2><p class="meta">You have ${view.current}. Update it from the Toolroll app.</p>`
                 : newer ? html `<h2>Toolroll ${latest} is available</h2><p class="meta">You have ${view.current}. Running work finishes first, and your current version is kept so you can go back.</p>`
-                    : "off" in view.latest ? html `<h2>Toolroll ${view.current}</h2><p class="meta">Update checks are off.</p><form method="get" action="/settings/updates" class="update-actions"><input type="hidden" name="check" value="now"><button type="submit">Check now</button></form>`
-                        : latest === null ? html `<h2>Toolroll ${view.current}</h2><p class="meta">Couldn’t check for a newer release: ${"problem" in view.latest ? view.latest.problem : ""}</p>`
-                            : html `<h2>Toolroll ${view.current} is up to date</h2>`;
+                    : "off" in view.latest ? html `<h2>Toolroll ${view.current}</h2><p class="meta">Update checks are off.</p>${postForm("/settings/updates/check", html `<button type="submit">Check now</button>`, { attrs: { class: "update-actions" } })}`
+                        : "pending" in view.latest ? html `<h2>Toolroll ${view.current}</h2><p class="meta">Not checked for a newer release yet.</p>${postForm("/settings/updates/check", html `<button type="submit">Check now</button>`, { attrs: { class: "update-actions" } })}`
+                            : latest === null ? html `<h2>Toolroll ${view.current}</h2><p class="meta">Couldn’t check for a newer release: ${"problem" in view.latest ? view.latest.problem : ""}</p>`
+                                : html `<h2>Toolroll ${view.current} is up to date</h2>`;
     const form = newer && !["npx", "source", "desktop"].includes(view.method.kind)
         ? postForm("/settings/updates", html `${reauth(html `<label class="step-up">Your Toolroll password<input type="password" name="password" autocomplete="current-password" required></label>`)}<div class="update-actions"><button type="submit" name="when" value="now" class="primary">Update now</button><button type="submit" name="when" value="when-idle">When idle</button><button type="submit" name="when" value="tonight">Tonight (03:00)</button></div>`, { hidden: { version: latest } })
         : "";