toolroll 0.9.74 → 0.9.76

package/dist/workspace-ui.js

@@ -19,7 +19,7 @@
 import { ACCEPT_NEEDS_REASON, FAILED_CHECK, cantAcceptYetOf, evidenceProblemOf } from "./result-acts.js";
 export { ACCEPT_NEEDS_REASON, cantAcceptYetOf, evidenceProblemOf };
 import { manualReviewOnly, plainReasonWords } from "./proof.js";
-import { OPEN_RESULT, plainReasonOf, stageOfCode, taskStatusOf, workToneOf } from "./task-status.js";
+import { CHECK_COMMAND_CHANGED, CHECK_UNREADABLE, OPEN_RESULT, approvedCheckOf, approvedCheckStateOf, plainReasonOf, stageOfCode, taskStatusOf, workToneOf } from "./task-status.js";
 import { whenUtc } from "./when-html.js";
 import { html, postForm } from "./html.js";
 export const WORK_VIEWS = [
@@ -122,9 +122,15 @@ export function resultStatusOf(result, publication = null) {
     return (result?.role === "builder" ? reviewStatusOf(result.review ?? null) : null) ?? storedResultStatusOf(result, publication);
 }
 /** What the machine itself recorded about a result, in a clause. */
-function machineVerdictWords(result) {
-    if (result.verdict === "verified")
+function machineVerdictWords(result, check) {
+    if (check !== undefined && check?.status === "failed" && evidenceProblemOf(result.verdict, result.reasons) !== "checks-failed") {
+        return `the approved check failed against it${check.exitCode === null ? "" : ` (exit ${check.exitCode})`}`;
+    }
+    if (result.verdict === "verified" && passedNow(check))
         return "it verified the result before the acceptance";
+    // Unread here, or unreadable now: never restated as a pass.
+    if (result.verdict === "verified")
+        return check === undefined ? "open the result for its checks" : "its check result couldn't be read";
     if (result.verdict === "attested")
         return "the checks on record are the agent's own report";
     const problem = evidenceProblemOf(result.verdict, result.reasons);
@@ -136,6 +142,14 @@ function machineVerdictWords(result) {
         return "its evidence did not match the sealed record";
     return "its required evidence was missing";
 }
+/** The approved check passed (task-status.ts approvedCheckStateOf): its own pass, or checks Off covered by a passing
+ * release check. A re-run underway keeps the pass it had. */
+const passedNow = (check) => {
+    const state = approvedCheckStateOf(check);
+    return state === "passed" || (state === "running" && check?.status === "passed");
+};
+/** A result whose check this surface didn't read: no pass is claimed, the result page says. */
+const UNREAD_CHECK = "Open the result to see its checks.";
 function storedResultStatusOf(result, publication) {
     if (result === null || result.runId === null) {
         return {
@@ -151,6 +165,8 @@ function storedResultStatusOf(result, publication) {
     }
     const published = publicationStatusOf(publication);
     const withPublication = (detail) => (published === null ? detail : `${detail} ${published.detail}`);
+    // Did the approved check pass for this result (task-status.ts): the one answer the Checks row and the road read.
+    const check = result.checks === undefined ? undefined : approvedCheckOf(result.verdict, result.reasons, result.checks);
     const humanReview = manualReviewOnly({ verdict: result.verdict ?? "", reasons: result.reasons });
     if (result.accepted && humanReview) {
         return { token: "accepted-exception", label: "Accepted by a person", detail: withPublication("A person accepted this result. The recorded checks are unchanged."), tone: "done", action: { label: "Open the acceptance", kind: "open-review" } };
@@ -162,14 +178,18 @@ function storedResultStatusOf(result, publication) {
             // Acceptance records a person's decision; it neither proves nor
             // disproves anything about the checks. The machine's own verdict is
             // restated as recorded.
-            detail: withPublication(`An approver accepted this result by hand, and the recorded exception says why. The machine's verdict is unchanged: ${machineVerdictWords(result)}.`),
+            detail: withPublication(`An approver accepted this result by hand, and the recorded exception says why. The machine's verdict is unchanged: ${machineVerdictWords(result, check)}.`),
             tone: "done",
             action: { label: "Open the recorded exception", kind: "open-review" },
         };
     }
-    const problem = evidenceProblemOf(result.verdict, result.reasons);
+    const recordedProblem = evidenceProblemOf(result.verdict, result.reasons);
+    // A failed check that a later check on the same commit passed no longer fails the result; a check that failed
+    // since a passing verdict does.
+    const problem = recordedProblem === "checks-failed" && passedNow(check) ? "none"
+        : recordedProblem !== "mismatched" && check?.status === "failed" ? "checks-failed" : recordedProblem;
     if (problem === "checks-failed") {
-        const exit = failedCheckExit(result.reasons);
+        const exit = check?.status === "failed" ? check.exitCode : failedCheckExit(result.reasons);
         return {
             token: "checks-failed",
             label: "Changes saved, but checks failed",
@@ -218,7 +238,14 @@ function storedResultStatusOf(result, publication) {
             action: { label: "See what is missing", kind: "open-review" },
         };
     }
-    if (result.verdict === "attested") {
+    // Any verdict short of a pass the check confirms: never "passed" when the check can't be read now.
+    if (check !== undefined && !passedNow(check) && result.verdict === "verified") {
+        return check?.status === "running"
+            ? { token: "checks-running", label: "Checks running", detail: withPublication("The approved check is running on this result."), tone: "live", action: { label: OPEN_RESULT, kind: "open-result" } }
+            : { token: "check-unreadable", label: "Result saved — check result couldn't be read", detail: withPublication(`${check?.cause === "command-changed" ? CHECK_COMMAND_CHANGED : CHECK_UNREADABLE} This result isn't verified.`),
+                tone: "problem", action: { label: "Open the check", kind: "open-review" } };
+    }
+    if (result.verdict === "attested" && !passedNow(check)) {
         return {
             token: "agent-attested",
             label: "Result saved — checks reported by the agent",
@@ -231,7 +258,7 @@ function storedResultStatusOf(result, publication) {
         return {
             token: published.token,
             label: published.label,
-            detail: `The approved check passed against this result. ${published.detail}`,
+            detail: check === undefined ? `${UNREAD_CHECK} ${published.detail}` : `The approved check passed against this result. ${published.detail}`,
             tone: published.token === "pr-closed" ? "muted" : "done",
             action: published.token === "merge-observed" ? { label: OPEN_RESULT, kind: "open-result" } : { label: "Open the pull request", kind: "open-pr" },
         };
@@ -239,7 +266,8 @@ function storedResultStatusOf(result, publication) {
     return {
         token: "ready-to-review",
         label: "Ready",
-        detail: withPublication("The approved check passed against this result."),
+        // Only a check read here may be called passed; a surface that read none says where to see it.
+        detail: withPublication(check === undefined ? UNREAD_CHECK : "The approved check passed against this result."),
         tone: "ready",
         action: { label: OPEN_RESULT, kind: "open-result" },
     };
@@ -301,7 +329,7 @@ export function dispatchActionLabel(dispatch) {
 }
 /** Result tokens a done task can wear, as the shared stage they mean. A
  * result that is missing its record waits on a person; a failed check fails. */
-const RESULT_NEEDS_YOU = new Set(["no-build-record", "verification-needed", "evidence-mismatch", "record-incomplete", "evidence-damaged"]);
+const RESULT_NEEDS_YOU = new Set(["no-build-record", "verification-needed", "evidence-mismatch", "record-incomplete", "evidence-damaged", "check-unreadable"]);
 /** Result tokens that only follow a passing project check. */
 const VERIFIED_RESULT = new Set(["ready-to-review", "pr-opened", "merge-observed", "pr-closed"]);
 /** A finished result's display status in the shared headline's words: a

package/dist/worktree.d.ts

@@ -152,6 +152,10 @@ export declare class WorktreePool {
     private readonly store;
     private readonly options;
     private readonly runner;
+    /** The pool's own git in a project's repository and its checkouts (making, moving and reading them): hardened against
+     * a frozen view of the repository's config and info (teardown-git.ts checkoutGit), which agents can write. An injected
+     * runner (tests' stubbed git) is used as given. */
+    private readonly hardened;
     /** Carried to the independent storage sweep process. */
     get root(): string;
     constructor(store: Store, options: PoolOptions);

package/dist/worktree.js

@@ -32,7 +32,7 @@ import { HANDOFF_PREFIX, MAILBOX_SUFFIX, looksLikeProtocolFile, readMailbox } fr
 import { parseHandoff } from "./decision.js";
 import { diskBytes } from "./storage.js";
 import { markNeverIndex } from "./never-index.js";
-import { teardownGit } from "./teardown-git.js";
+import { checkoutGit, teardownGit } from "./teardown-git.js";
 /**
  * The note a lease leaves in the checkout, naming the process holding it.
  *
@@ -268,12 +268,18 @@ export class WorktreePool {
     store;
     options;
     runner;
+    /** The pool's own git in a project's repository and its checkouts (making, moving and reading them): hardened against
+     * a frozen view of the repository's config and info (teardown-git.ts checkoutGit), which agents can write. An injected
+     * runner (tests' stubbed git) is used as given. */
+    hardened;
     /** Carried to the independent storage sweep process. */
     get root() { return this.options.root; }
     constructor(store, options) {
         this.store = store;
         this.options = options;
         this.runner = options.runner ?? run;
+        // Bound to the project's repository from the pool's own request or record (teardown-git.ts GitBinding).
+        this.hardened = repo => this.runner === run ? checkoutGit(run, "build", { repo }) : this.runner;
     }
     /**
      * Take a working copy for this branch.
@@ -475,7 +481,7 @@ export class WorktreePool {
         // checkout between the inspection and the move.
         let base;
         if (request.freshBase !== undefined && request.taskRef !== undefined) {
-            const fresh = await this.freshen(path, request.branch, request.taskRef, request.freshBase, request.now);
+            const fresh = await this.freshen(request.repo, path, request.branch, request.taskRef, request.freshBase, request.now);
             if (!fresh.ok)
                 return { ok: false, reason: "git", message: fresh.message };
             base = fresh.standing;
@@ -524,9 +530,9 @@ export class WorktreePool {
      * untracked. The move is `git reset --keep`, which refuses rather than overwrite anything; HEAD and the tree are read
      * again right before and after it, and any surprise fails the lease with the checkout left for a person.
      */
-    async freshen(path, branch, taskRef, fresh, now) {
+    async freshen(repo, path, branch, taskRef, fresh, now) {
         const read = async (args) => {
-            const out = await this.runner(GIT, [...READ_ONLY, ...args], { cwd: path, timeoutMs: WORKTREE_TIMEOUT_MS });
+            const out = await this.hardened(repo)(GIT, [...READ_ONLY, ...args], { cwd: path, timeoutMs: WORKTREE_TIMEOUT_MS });
             return out.code === 0 ? out.stdout.trim() : null;
         };
         const main = await read(["rev-parse", "--verify", "--quiet", `${fresh.main}^{commit}`]);
@@ -544,14 +550,14 @@ export class WorktreePool {
             return stay("not on its branch");
         if (fresh.recordedBase !== null && fresh.recordedBase !== head)
             return stay("has commits");
-        const contained = await this.runner(GIT, [...READ_ONLY, "merge-base", "--is-ancestor", head, main], { cwd: path, timeoutMs: WORKTREE_TIMEOUT_MS });
+        const contained = await this.hardened(repo)(GIT, [...READ_ONLY, "merge-base", "--is-ancestor", head, main], { cwd: path, timeoutMs: WORKTREE_TIMEOUT_MS });
         if (contained.code !== 0)
             return stay("has commits");
         if (await this.isDirty(path) !== false)
             return stay("has changes");
         // Recorded before git moves it: a move that then fails leaves the next attempt's own base as the branch's origin.
         this.store.recordBranchBaseMove(taskRef, branch, head, main, now);
-        const moved = await this.runner(GIT, ["reset", "--keep", main], { cwd: path, timeoutMs: WORKTREE_TIMEOUT_MS });
+        const moved = await this.hardened(repo)(GIT, ["reset", "--keep", main], { cwd: path, timeoutMs: WORKTREE_TIMEOUT_MS });
         const after = await read(["rev-parse", "--verify", "--quiet", "HEAD^{commit}"]);
         const branchNow = await read(["rev-parse", "--verify", "--quiet", `refs/heads/${branch}^{commit}`]);
         if (moved.code !== 0 || after !== main || branchNow !== main || await this.isDirty(path) !== false) {
@@ -1052,7 +1058,7 @@ export class WorktreePool {
     /** All disposal and inspection paths share the hardened teardown boundary. */
     teardown = (cwd, args) => teardownGit(this.runner)(cwd, args);
     git(cwd, args, prefix = []) {
-        return this.runner(GIT, [...prefix, ...args], { cwd, timeoutMs: WORKTREE_TIMEOUT_MS });
+        return this.hardened(cwd)(GIT, [...prefix, ...args], { cwd, timeoutMs: WORKTREE_TIMEOUT_MS });
     }
 }
 function firstLine(text) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolroll",
-  "version": "0.9.74",
+  "version": "0.9.76",
   "description": "A control plane for unattended coding agents — queue tasks, walk away, come back to pull requests. Agents build in leased worktrees, never touch your default branch, and interrupt you only for decisions that need a human.",
   "directories": {
     "doc": "docs"