toolroll 0.9.75 → 0.9.76

package/CHANGELOG.md

@@ -1,5 +1,54 @@
 # Changelog
 
+## 0.9.76 — 2026-10-28
+
+- **Releases can approve themselves when they're green.** A new per-project
+  setting, **Release approval: Ask me / Approve automatically when checks
+  pass**, is off by default. Turning it on takes your typed password;
+  turning it off takes one click and withdraws every automatic approval not
+  yet merged. When it's on, a release task first reads "Checking
+  automatically" (`auto-check`), which lets its release check run and
+  nothing else. Once GitHub CI and the release check both pass on the exact
+  candidate, it approves itself (`auto-green`) and the release continues as
+  after your yes. You're told, not asked.
+- **What an automatic approval must prove.** Up to two failed attempts per
+  CI job, and two failed release-check builds on the same commit, are
+  tolerated as flakes. Past that it asks you. The change must touch only
+  allowed paths: product code and its tests, test files under `test/`,
+  docs, the changelog and a version-only `package.json` bump. Scripts, CI,
+  configuration, dependencies, policy files and test helpers (found from the
+  tests' own imports) need a person. CI is read again before the deploy, the
+  CLI switch, the merge and the tag. Anything not green stops the release,
+  withdraws the approval and tells you.
+- **A red CI after the merge holds publishing.** No tag, npm publish or
+  Homebrew update happens until a person runs
+  `toolroll release publish-ok <task>` with their password.
+- **Stricter CI verdicts on every release, yours too.** Only checks on the
+  exact head count. Required checks must come from GitHub Actions, so
+  another app's same-name success can't hide a failure. A newer run of the
+  same workflow supersedes its older runs on the commit.
+- **Toolroll's own git on agent checkouts runs against a frozen view.**
+  Every git command the plane runs on a checkout an agent wrote (staging,
+  committing, cleanup, pool refresh, scouts, planners, coding sessions, page
+  reads) runs against a private copy of the repository's settings taken
+  once. Changes the agent makes to them afterwards are never read.
+- **Git settings are denied by default.** Only audited config sections and
+  variables pass. Aliases, URL rewrites that reach remote helpers, empty
+  filter names and `hook.*` are refused. Writes allow no network transport.
+  Local git-lfs installs still work.
+- **Writes are bound to the project's recorded repository.** A checkout
+  whose `.git` points anywhere else is refused. Before git writes through a
+  view, every path it could write is walked for links and hard links. Plane
+  git writes on one checkout run one at a time. On git before 2.48, a
+  checkout added through the view is pointed at its repository, not at the
+  view.
+- **A git incident is recorded and you're notified.** A swap seen after git
+  ran is logged and raised as an attention notification. The notification
+  names the project by Toolroll's own record, never by a path the agent
+  chose.
+- **`discover --dirty` reads repositories through the same hardened git.**
+- Database: schema v136 (unchanged).
+
 ## 0.9.75 — 2026-10-27
 
 - **Opening a page only shows it.** Pages no longer run checks, tidy up or

package/dist/agent-fence.js

@@ -32,6 +32,7 @@ import { homedir, tmpdir } from "node:os";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { readMonitoring } from "./monitoring-settings.js";
 import { existingFolders } from "./names.js";
+import { ensureGitViewsRoot, gitViewsRoot } from "./git-views.js";
 import { DEPS_FOLDER, linkedKey, readyCopy, sharedCopies } from "./shared-deps.js";
 import { SEATBELT_PROBE, sandboxRuntimeProblem, srtSpawn } from "./sandbox-runtime.js";
 import { protectedStorageDenies, protectedStorageNames } from "./protected-storage.js";
@@ -175,6 +176,13 @@ export function agentFence(options) {
                 fence.add(join(state, entry));
         }
     }
+    // The plane's private views of repositories for its own git (git-views.ts): made first, so no build is the one to
+    // create them, and denied by name whether or not that worked (a sandbox that can't cover the path refuses to launch).
+    try {
+        ensureGitViewsRoot(home);
+    }
+    catch { /* fenced by name below either way */ }
+    fence.add(gitViewsRoot(home));
     for (const secrets of existingFolders(home, { dot: true }))
         fence.add(secrets);
     // v104: the folder the audit stream writes to holds the whole instance's history.

package/dist/approval-authority.js

@@ -4,7 +4,9 @@
  *
  * An allowlist, never a deny-list: a person's yes (`password`, `chat`) stands unless a machine made that seal; a mode
  * or a flow grant stands while its signature does; a standing order's firing (`schedule`, or an old firing stored as
- * `password`) stands while its approver can still approve in the project. Everything else — the lead (`lead`, which
+ * `password`) stands while its approver can still approve in the project; an automatic release seal (`auto-check`,
+ * `auto-green`: docs/plans/auto-approve-green.md) stands on its own evidence row while the project's setting is on and
+ * the person who turned it on can still approve there. Everything else — the lead (`lead`, which
  * phase 1 never lets stand), a null basis, a word this code doesn't write — stands on nothing.
  *
  * The seal's origin is read from the acts recorded AT the seal's own instant, exactly as scope.ts sealOriginOf reads
@@ -12,6 +14,7 @@
  */
 import { grantStandsSql } from "./flow-unattended.js";
 import { accountReachesSql } from "./project-access.js";
+import { autoSealSql } from "./release-authority.js";
 /** The proofs a person gives (src/person-proof.ts), as an SQL list. */
 const PERSON_PROOFS = "('password-now', 'sso-now', 'fresh-password', 'fresh-sso', 'session', 'cli-login', 'chat', 'passkey')";
 /** SQL over a `task_scope` alias and a repo expression: whether that row's approval authority stands at `now` (an SQL
@@ -25,7 +28,8 @@ export const authorityStandsSql = (scope, repo, now) => `COALESCE((((COALESCE(${
          WHERE om.repo = ${repo} AND om.revoked_at IS NULL AND om.absolute_expiry > ${now} AND om.digest = ${scope}.mode_digest
            AND signer.revoked_at IS NULL AND signer.role = 'approver' AND ${accountReachesSql("signer", repo)}))
     OR (${scope}.approval_basis = 'grant' AND ${grantStandsSql(`${scope}.mode_digest`, now, repo)})
-    OR (${scope}.approval_basis = 'schedule' AND ${approverStandsSql(scope, repo)}))
+    OR (${scope}.approval_basis = 'schedule' AND ${approverStandsSql(scope, repo)})
+    OR (${scope}.approval_basis IN ('auto-check', 'auto-green') AND ${autoSealSql(scope, repo)} AND ${approverStandsSql(scope, repo)}))
     AND ${releaseStandsSql(scope, now)}), 0)`;
 /** SQL: a `carried` seal stands only on its own carry row — this task, this approved digest, this candidate, and the
  * reference `<authority>:<carry>` the carry transaction wrote (release-once.md). */

package/dist/approval-rules-ui.d.ts

@@ -6,6 +6,8 @@
  */
 import { type Html } from "./html.js";
 import type { ApprovalRules } from "./approval-policy.js";
+/** The rules' style, and the same for the Releases section under its own class (so a page holds one `.approval-rules`
+ * form, not two). */
 export declare const APPROVAL_RULES_CSS: string;
 export type ApprovalRulesView = {
     repo: string;
@@ -20,6 +22,15 @@ export type ApprovalRulesView = {
 };
 /** The rules in plain words, for anyone who can see the project. */
 export declare function rulesSummary(rules: ApprovalRules): string;
+/** Settings → Approval rules → Releases (docs/plans/auto-approve-green.md): who approves this project's releases. */
+export type ReleaseApprovalView = {
+    repo: string;
+    auto: boolean;
+    setBy: string | null;
+    at: string | null;
+    canChange: boolean;
+};
+export declare function releaseApprovalHtml(view: ReleaseApprovalView): Html;
 export declare function approvalRulesHtml(view: ApprovalRulesView, notice: {
     said?: string | null;
     problem?: string | null;

package/dist/approval-rules-ui.js

@@ -5,11 +5,14 @@
  * ledger, before → after.
  */
 import { html, postForm, reauth } from "./html.js";
-export const APPROVAL_RULES_CSS = `.approval-rules{max-width:720px;min-width:0}.approval-rules fieldset{border:0;padding:0;margin:18px 0 0;min-width:0}` +
+const RULES_CSS = `.approval-rules{max-width:720px;min-width:0}.approval-rules fieldset{border:0;padding:0;margin:18px 0 0;min-width:0}` +
     `.approval-rules legend{font-weight:600;font-size:.875rem;margin-bottom:8px}.approval-rules .choice{display:grid;grid-template-columns:auto minmax(0,1fr);gap:10px;align-items:start;margin:0 0 10px;font-weight:400}` +
     `.approval-rules .choice input{margin:.2rem 0 0}.approval-rules .choice strong{display:block;font-size:.875rem;font-weight:500}.approval-rules .choice small{display:block;color:var(--muted-foreground);font-size:.8125rem;margin-top:2px}` +
     `.approval-rules textarea{min-height:88px;font-family:var(--font-mono);font-size:.8125rem}.approval-rules .paths{margin:4px 0 0 26px}` +
     `.approval-rules .current{margin:0 0 4px}.approval-rules .step-up{margin-top:16px}.approval-rules button[type=submit]{margin-top:14px}`;
+/** The rules' style, and the same for the Releases section under its own class (so a page holds one `.approval-rules`
+ * form, not two). */
+export const APPROVAL_RULES_CSS = RULES_CSS + RULES_CSS.replaceAll(".approval-rules", ".release-approval");
 /** The rules in plain words, for anyone who can see the project. */
 export function rulesSummary(rules) {
     const parts = [];
@@ -21,6 +24,15 @@ export function rulesSummary(rules) {
         parts.push(`Work touching ${rules.protectedPaths.join(", ")} is protected: two people approve it, never a subagent or an operating mode.`);
     return parts.length === 0 ? "No approval rules: anyone who can approve on this project can approve its work, including their own." : parts.join(" ");
 }
+export function releaseApprovalHtml(view) {
+    const since = view.setBy === null ? "" : html ` <span class="meta">Changed by ${view.setBy} on ${(view.at ?? "").slice(0, 10)}.</span>`;
+    const current = html `<p class="current">${view.auto ? "Releases approve themselves once the pull request's CI and the release check pass on the exact commit. Anything red still asks you." : "Every release waits for your approval."}${since}</p>`;
+    const heading = html `<h2>Release approval</h2>`;
+    if (!view.canChange)
+        return html `<section class="release-approval">${heading}${current}<p class="meta">An approver of this project sets this.</p></section>`;
+    const choice = (value, title, hint) => html `<label class="choice"><input type="radio" name="action" value="${value}"${(view.auto ? "auto" : "ask") === value ? html ` checked` : ""}><span><strong>${title}</strong><small>${hint}</small></span></label>`;
+    return html `<section class="release-approval">${heading}${current}${postForm("/settings/release-approval", html `<fieldset aria-label="Release approval">${choice("ask", "Ask me", "A release deploys only after you approve it.")}${choice("auto", "Approve automatically when checks pass", "You're told when a release approves itself. A failed check, red CI or a CI failure after the deploy still stops and asks you.")}</fieldset><div class="step-up"><label>Your Toolroll password (to approve automatically)<input type="password" name="password" autocomplete="current-password"></label></div><button type="submit">Save</button>`, { hidden: { repo: view.repo } })}</section>`;
+}
 export function approvalRulesHtml(view, notice) {
     const note = notice.problem ? html `<p class="problem" role="alert">${notice.problem}</p>` : notice.said ? html `<p role="status">${notice.said}</p>` : "";
     const changed = view.rules.updatedBy === null ? "" : html ` <span class="meta">Changed by ${view.rules.updatedBy} on ${(view.rules.updatedAt ?? "").slice(0, 10)}.</span>`;

package/dist/batch-checks.js

@@ -3,6 +3,7 @@ import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { run as execRun } from "./exec.js";
+import { hardenedGit } from "./teardown-git.js";
 import { approvedCommandShell, SETUP_ENV_ALLOWLIST, SETUP_ENV_DENYLIST } from "./builder.js";
 import { runWithIsolatedDatabase } from "./child-database.js";
 import { boundStreamHeadTail, redactSecretLines, scanForSecrets, storeEvidence } from "./evidence.js";
@@ -86,7 +87,8 @@ function finishOne(store, one, repo, task, status, detail, at) {
 async function checkCohort(store, root, repo, cohort, deps) {
     const now = deps.now ?? (() => new Date());
     const runner = deps.runner ?? execRun;
-    const git = deps.git ?? execRun;
+    // The project's repository and checkouts of builds' commits, both agent-writable: the hardened git (teardown-git.ts).
+    const git = deps.git ?? hardenedGit(execRun);
     const command = store.liveVerifyCommand(repo);
     if (command === null)
         return 0;

package/dist/builder.js

@@ -255,7 +255,7 @@ const BRANCH_QUERIES = [
 function buildCheckoutGit(given, worktree, mainCheckout = null) {
     if (given !== run)
         return given;
-    const hardened = checkoutGit(given);
+    const hardened = checkoutGit(given, "build", { repo: mainCheckout });
     const real = (path) => { try {
         return realpathSync(resolve(path));
     }

package/dist/coding-workspace.js

@@ -400,8 +400,10 @@ export class CodingWorkspace {
                 }, 50);
         }
     }
-    async git(repo, args) {
-        const result = await run('git', ['--no-optional-locks', '-c', 'core.hooksPath=/dev/null', ...args], { cwd: repo, timeoutMs: 60_000, maxBuffer: 1_048_576 });
+    async git(repo, args, project = repo) {
+        // The project's repository and the session's checkout are agent-written: the hardened git, against a frozen view of
+        // the repository's config and info (teardown-git.ts checkoutGit).
+        const result = await checkoutGit(run, 'build', { repo: project })('git', ['--no-optional-locks', ...args], { cwd: repo, timeoutMs: 60_000, maxBuffer: 1_048_576 });
         if (result.code !== 0)
             throw Error('Git could not complete this workspace operation. Check the repository and try again.');
         return result.stdout;
@@ -520,13 +522,13 @@ export class CodingWorkspace {
     }
     async verifyWorktree(session) {
         const [branch, common, original] = await Promise.all([
-            this.git(session.worktree, ['symbolic-ref', '--short', 'HEAD']),
-            this.git(session.worktree, ['rev-parse', '--path-format=absolute', '--git-common-dir']),
+            this.git(session.worktree, ['symbolic-ref', '--short', 'HEAD'], session.repo),
+            this.git(session.worktree, ['rev-parse', '--path-format=absolute', '--git-common-dir'], session.repo),
             this.git(session.repo, ['rev-parse', '--path-format=absolute', '--git-common-dir']),
         ]);
         if (branch.trim() !== session.branch || realpathSync(common.trim()) !== realpathSync(original.trim()))
             throw Error('This checkout no longer matches the saved project and branch. Restore that checkout before resuming.');
-        await this.git(session.worktree, ['merge-base', '--is-ancestor', session.base, 'HEAD']);
+        await this.git(session.worktree, ['merge-base', '--is-ancestor', session.base, 'HEAD'], session.repo);
     }
     priorProcessesGone() {
         const row = this.db.prepare('SELECT payload FROM coding_custody WHERE singleton=1').get();

package/dist/contracts/console-api.d.ts

@@ -72,6 +72,7 @@ export declare const CONSOLE_FORMS: {
     readonly code: FormContract<"acceptance" | "answers" | "base" | "candidate" | "decision" | "goal" | "model" | "password" | "prompt" | "repo" | "requestId" | "title" | "visual" | `question:${string}`>;
     readonly sweep: FormContract<"confirm" | "snapshot">;
     readonly passwordless: FormContract<"action" | "password">;
+    readonly releaseApproval: FormContract<"action" | "password" | "repo">;
     readonly term: FormContract<"password" | "program" | "repo">;
     readonly skillsRevise: FormContract<"feedback" | "nonce" | "repo" | "run">;
     readonly skillsChange: FormContract<"action" | "content" | "files" | "identity" | "method" | "nonce" | "repo" | "restore" | "revision" | "sample" | "sha" | "url">;

package/dist/contracts/console-api.js

@@ -81,6 +81,7 @@ export const CONSOLE_FORMS = {
     code: formContract("POST /code, /code/start, /code/<session>/<act>, /code/<anything else>", ["repo", "password", "title", "model", "prompt", "requestId", "base", "candidate", "goal", "acceptance", "visual", "decision", "answers"], { prefixes: ["question:"] }),
     sweep: formContract("POST /sweeps/<sweep>/cancel-rest", ["confirm", "snapshot"]),
     passwordless: formContract("POST /settings/passwordless", ["action", "password"]),
+    releaseApproval: formContract("POST /settings/release-approval", ["repo", "action", "password"]),
     term: formContract("POST /term/start, /term/<terminal>/close, /term/<terminal>/remove", ["repo", "program", "password"]),
     skillsRevise: formContract("POST /settings/skills/revise", ["run", "repo", "feedback", "nonce"]),
     skillsChange: formContract("POST /settings/skills/import, /settings/skills/change", ["repo", "identity", "revision", "method", "content", "files", "url", "action", "sha", "sample", "nonce", "restore"]),

package/dist/deploy-gate.d.ts

@@ -14,4 +14,7 @@ export declare function deploymentGate(store: Store, input: {
     runId: number;
     evidenceRoot: string;
     now: Date;
+    /** Inside `toolroll release` (its own reserved deploy): a release's own automatic approval also stands
+     * (docs/plans/auto-approve-green.md). Anywhere else only a person's approval deploys. */
+    releaseFlow?: boolean;
 }): DeploymentGate;

package/dist/deploy-gate.js

@@ -6,7 +6,7 @@
  * same checks for the deployment script, proven again there with the installed runtime's modules.)
  */
 import { assignmentOf } from "./assignment.js";
-import { liveReleaseOf, personApprovalOf } from "./scope.js";
+import { liveReleaseOf, personApprovalOf, releaseApprovalOf } from "./scope.js";
 import { verificationEvidence } from "./verification-evidence.js";
 /** Whether run `runId` is a deployable candidate now, read only from the plane's records and this runtime's code. */
 export function deploymentGate(store, input) {
@@ -33,7 +33,8 @@ export function deploymentGate(store, input) {
     const release = liveReleaseOf(store, ref.externalId, "deploy", input.now);
     if (release.applies && !release.ok)
         return refuse(`This release can't deploy: ${release.why}.`);
-    const anchorPerson = release.applies && release.ok ? personApprovalOf(store, release.authority.anchorTask) : null;
+    const anchorPerson = release.applies && release.ok
+        ? (input.releaseFlow === true ? releaseApprovalOf(store, release.authority.anchorTask, input.now) : personApprovalOf(store, release.authority.anchorTask)) : null;
     const person = anchorPerson ?? personApprovalOf(store, ref.externalId);
     if (!person.ok)
         return refuse(`A person has to approve this candidate's scope: ${person.why}.`);

package/dist/desktop-update.d.ts

@@ -97,7 +97,6 @@ export declare function sqliteLock(file: string, busyTimeoutMs?: number): Databa
 export declare function lockHeld(file: string): boolean;
 export declare const installationLock: (j: UpdateJournal) => DatabaseSync | null;
 export declare function desktopUpdateStatus(stateDir: string): {
-    version?: never;
     active: boolean;
     phase: string;
     detail: string;
@@ -111,6 +110,7 @@ export declare function desktopUpdateStatus(stateDir: string): {
     wasRunning?: never;
     backupPath?: never;
     updateId?: never;
+    version?: never;
     buildId?: never;
     workDir?: never;
 } | {

package/dist/discover.js

@@ -19,6 +19,7 @@
  */
 import { basename } from "node:path";
 import { run } from "./exec.js";
+import { checkoutGit } from "./teardown-git.js";
 import { parseWorktrees, parseBranches } from "./git.js";
 import { findRepos } from "./scan.js";
 /** Enough to keep git busy without turning a laptop fan on. */
@@ -43,7 +44,11 @@ const BRANCH_FORMAT = "--format=%(refname:short)%09%(upstream:track)%09%(committ
 const BRANCH_FORMAT_CHEAP = "--format=%(refname:short)%09%09%(committerdate:iso8601-strict)";
 export async function inspectRepo(path, options = {}) {
     const { runner = run, dirty = false } = options;
-    const git = (args, timeoutMs = REF_TIMEOUT_MS) => runner(GIT, [...READ_ONLY, ...args], { cwd: path, timeoutMs });
+    // Scanned and enrolled projects share their repository with every build, which can write its config, info and hooks
+    // (`--dirty`'s status would run a planted fsmonitor or filter): the hardened git, against a frozen view of the
+    // repository (teardown-git.ts checkoutGit). An injected runner (tests) is used as given.
+    const hardened = runner === run ? checkoutGit(run, "build") : runner;
+    const git = (args, timeoutMs = REF_TIMEOUT_MS) => hardened(GIT, [...READ_ONLY, ...args], { cwd: path, timeoutMs });
     const [worktrees, branchRead, head, remote, status] = await Promise.all([
         git(["worktree", "list", "--porcelain"]),
         readBranches(git),

package/dist/first-run.js

@@ -6,6 +6,7 @@
  * the composer: nothing is filed until the person sends it and confirms.
  */
 import { run } from "./exec.js";
+import { hardenedGit } from "./teardown-git.js";
 import { githubIssues } from "./issues.js";
 export const SIGN_IN_COMMAND = "claude auth login";
 export const SANDBOX_COMMAND = "npx toolroll demo";
@@ -95,7 +96,8 @@ export async function findFirstTasks(repo, runner = run) {
     let todos = [];
     if (issues.length < 3) {
         try {
-            const result = await runner("git", [...TODO_GREP_ARGS], { cwd: repo, timeoutMs: 5_000 });
+            // The project's repository is shared with builds that can write its config: the hardened read (teardown-git.ts).
+            const result = await (runner === run ? hardenedGit(run, "read") : runner)("git", [...TODO_GREP_ARGS], { cwd: repo, timeoutMs: 5_000 });
             if (result.code === 0 || result.stdout !== "")
                 todos = parseTodoLines(result.stdout);
         }

package/dist/git-incident.d.ts

@@ -0,0 +1,49 @@
+export type GitIncident = {
+    at: string;
+    checkout: string;
+    repository: string;
+    /** Folders of the repository found swapped, and where each now leads (null: its pointers changed instead). */
+    swapped: {
+        path: string;
+        leadsTo: string | null;
+    }[];
+};
+type Listener = (incident: GitIncident) => void;
+/** Hear about every git incident (returns the unsubscribe). With none registered, incidents go to stderr. */
+export declare function onGitIncident(listener: Listener): () => void;
+/** Record and tell one incident. */
+export declare function gitIncident(input: {
+    checkout: string;
+    repository: string;
+    swapped: GitIncident["swapped"];
+    record: string;
+}): GitIncident;
+/** What noticeGitIncidents needs of the store: its durable outbox, and its own project records. */
+export type IncidentOutbox = {
+    enqueueNotification(notification: {
+        dedupeKey: string;
+        kind: string;
+        subject: string;
+        body: string;
+        pushClass?: "attention";
+        source?: {
+            project: string;
+        } | {
+            installation: true;
+        };
+    }, now: Date): boolean;
+    listProjects(): {
+        path: string;
+        name: string;
+    }[];
+};
+/**
+ * Every git incident from now on raises an attention notification in `outbox` (the console and the background worker
+ * register their store as they start; once per store): "Git incident in <project>: a folder of its repository changed
+ * while Toolroll's git ran". Nothing the agent chose reaches the text (paths in an agent-written repository can carry
+ * newlines and words of its own): the project is named only by the plane's own record of it (matched by real path,
+ * else "a project"), and the person is pointed to the incident record file, where the paths are. Returns the
+ * unsubscribe.
+ */
+export declare function noticeGitIncidents(outbox: IncidentOutbox, now?: () => Date, record?: string): () => void;
+export {};

package/dist/git-incident.js

@@ -0,0 +1,69 @@
+/**
+ * A git incident: the plane's own git wrote through a view of a repository (teardown-git.ts gitView) while a folder of
+ * that repository the view links to was swapped for a link elsewhere, or its git pointers changed (the residual the
+ * view can't prevent: git takes paths, and a build that outlived its turn can still rename a folder of the shared
+ * `.git` mid-command). Seen after git ran, it is:
+ *
+ * - recorded, one JSON line in `~/.toolroll/git-incidents.jsonl` (beside the fenced views folder, git-views.ts);
+ * - told to every listener (the console's, when it registers one; otherwise the plane's stderr);
+ * - and the command is reported refused, so no caller takes its result as done.
+ *
+ * Nothing is rolled back automatically: where a swapped folder leads is the agent's choice, and the plane never runs
+ * git there on its say (a confused deputy); what git wrote is for a person, named in the record.
+ */
+import { appendFileSync, realpathSync } from "node:fs";
+import { basename, dirname } from "node:path";
+const listeners = new Set();
+/** Hear about every git incident (returns the unsubscribe). With none registered, incidents go to stderr. */
+export function onGitIncident(listener) {
+    listeners.add(listener);
+    return () => listeners.delete(listener);
+}
+/** Record and tell one incident. */
+export function gitIncident(input) {
+    const incident = { at: new Date().toISOString(), checkout: input.checkout, repository: input.repository, swapped: input.swapped };
+    try {
+        appendFileSync(input.record, `${JSON.stringify(incident)}\n`, { mode: 0o600 });
+    }
+    catch { /* still told */ }
+    if (listeners.size === 0)
+        process.stderr.write(`Toolroll git incident: ${JSON.stringify(incident)}\n`);
+    for (const listener of listeners) {
+        try {
+            listener(incident);
+        }
+        catch { /* every listener hears it */ }
+    }
+    return incident;
+}
+const noticed = new WeakSet();
+/**
+ * Every git incident from now on raises an attention notification in `outbox` (the console and the background worker
+ * register their store as they start; once per store): "Git incident in <project>: a folder of its repository changed
+ * while Toolroll's git ran". Nothing the agent chose reaches the text (paths in an agent-written repository can carry
+ * newlines and words of its own): the project is named only by the plane's own record of it (matched by real path,
+ * else "a project"), and the person is pointed to the incident record file, where the paths are. Returns the
+ * unsubscribe.
+ */
+export function noticeGitIncidents(outbox, now = () => new Date(), record = "~/.toolroll/git-incidents.jsonl") {
+    if (noticed.has(outbox))
+        return () => { };
+    noticed.add(outbox);
+    const stop = onGitIncident(incident => {
+        const main = basename(incident.repository) === ".git" ? dirname(incident.repository) : incident.repository;
+        const real = (path) => { try {
+            return realpathSync(path);
+        }
+        catch {
+            return null;
+        } };
+        const known = outbox.listProjects().find(project => real(project.path) !== null && real(project.path) === real(main)) ?? null;
+        outbox.enqueueNotification({
+            dedupeKey: `git-incident:${incident.at}:${known?.path ?? "unrecorded"}`, kind: "git-incident", pushClass: "attention",
+            source: known === null ? { installation: true } : { project: known.path },
+            subject: `Git incident in ${known === null ? "a project" : known.name}: a folder of its repository changed while Toolroll's git ran`,
+            body: `Toolroll stopped trusting that git command and changed nothing more. Nothing was rolled back: check the repository by hand. The checkout and the folders that changed are in ${record}.`,
+        }, now());
+    });
+    return () => { stop(); noticed.delete(outbox); };
+}

package/dist/git-views.d.ts

@@ -0,0 +1,20 @@
+/** The views folder under `home`. */
+export declare function gitViewsRoot(home: string): string;
+/**
+ * The views folder under `home`, made if it isn't there (owner-only), and proven to be this user's own real folder all
+ * the way from `home`: neither it nor `~/.toolroll` may be a link or anyone else's. Throws otherwise.
+ */
+export declare function ensureGitViewsRoot(home: string): string;
+/**
+ * One plane git command at a time on a checkout (Codex review of a0fa135d): each command's private GIT_DIR has its own
+ * HEAD, so two at once would each take their own HEAD lock and the later carry-back would undo the earlier. The lock
+ * is a file the plane makes exclusively in the fenced views folder, named by the checkout's real path, holding this
+ * process's id; one whose process is gone is taken over. Waits up to `timeoutMs`; returns the release.
+ */
+export declare function lockCheckout(home: string, checkout: string, timeoutMs?: number): Promise<() => void>;
+/**
+ * Run `work` holding the checkout's lock (lockCheckout). Re-entrant along one call chain: a hardened git nested in
+ * another on the same checkout (teardown's git run through the builder's hardened runner, a view within a view) runs
+ * under the lock its caller already holds instead of waiting on itself.
+ */
+export declare function withCheckoutLock<T>(home: string, checkout: string, work: () => Promise<T>): Promise<T>;

package/dist/git-views.js

@@ -0,0 +1,120 @@
+/**
+ * Where the plane makes its private views of a repository for git (teardown-git.ts gitView): a folder of its own under
+ * the home folder's `~/.toolroll`, which every fence denies to builds, read and write (agent-fence.ts agentFence names
+ * this folder by name, made first so no build can be the one to create it). A view in the system temp folder could be
+ * rewritten by a build that writes anywhere and outlived its turn (Codex review of e48e9d8d).
+ */
+import { AsyncLocalStorage } from "node:async_hooks";
+import { createHash } from "node:crypto";
+import { closeSync, constants as fsConstants, lstatSync, mkdirSync, openSync, readFileSync, rmSync, writeSync } from "node:fs";
+import { join } from "node:path";
+/** The views folder under `home`. */
+export function gitViewsRoot(home) {
+    return join(home, ".toolroll", "git-views");
+}
+/**
+ * The views folder under `home`, made if it isn't there (owner-only), and proven to be this user's own real folder all
+ * the way from `home`: neither it nor `~/.toolroll` may be a link or anyone else's. Throws otherwise.
+ */
+export function ensureGitViewsRoot(home) {
+    const uid = process.getuid?.();
+    const base = join(home, ".toolroll");
+    const root = gitViewsRoot(home);
+    for (const dir of [base, root]) {
+        try {
+            mkdirSync(dir, { mode: 0o700 });
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw error;
+        }
+        const held = lstatSync(dir);
+        if (!held.isDirectory() || held.isSymbolicLink() || (uid !== undefined && held.uid !== uid))
+            throw new Error(`${dir} isn't a folder of this user's own`);
+    }
+    return root;
+}
+/**
+ * One plane git command at a time on a checkout (Codex review of a0fa135d): each command's private GIT_DIR has its own
+ * HEAD, so two at once would each take their own HEAD lock and the later carry-back would undo the earlier. The lock
+ * is a file the plane makes exclusively in the fenced views folder, named by the checkout's real path, holding this
+ * process's id; one whose process is gone is taken over. Waits up to `timeoutMs`; returns the release.
+ */
+export async function lockCheckout(home, checkout, timeoutMs = 10 * 60_000) {
+    const folder = join(ensureGitViewsRoot(home), "locks");
+    try {
+        mkdirSync(folder, { mode: 0o700 });
+    }
+    catch (error) {
+        if (error.code !== "EEXIST")
+            throw error;
+    }
+    const held = lstatSync(folder);
+    if (!held.isDirectory() || held.isSymbolicLink())
+        throw new Error(`${folder} isn't a folder of this user's own`);
+    const path = join(folder, `${createHash("sha256").update(checkout).digest("hex")}.lock`);
+    const deadline = Date.now() + timeoutMs;
+    for (;;) {
+        try {
+            const fd = openSync(path, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL | fsConstants.O_NOFOLLOW, 0o600);
+            try {
+                writeSync(fd, `${process.pid}\n`);
+            }
+            finally {
+                closeSync(fd);
+            }
+            let released = false;
+            return () => { if (!released) {
+                released = true;
+                rmSync(path, { force: true });
+            } };
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw error;
+        }
+        // Held: by a live process, wait; by one that is gone, take it over.
+        let owner = NaN;
+        try {
+            owner = Number(readFileSync(path, "utf8").trim());
+        }
+        catch {
+            owner = NaN;
+        }
+        if (Number.isSafeInteger(owner) && owner > 0 && owner !== process.pid && !alive(owner)) {
+            rmSync(path, { force: true });
+            continue;
+        }
+        if (Date.now() > deadline)
+            throw new Error("another of Toolroll's git commands on this checkout is still running");
+        await new Promise(done => setTimeout(done, 25));
+    }
+}
+function alive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code === "EPERM";
+    }
+}
+/** The checkouts the current async call chain already holds (lockCheckout through withCheckoutLock). */
+const heldHere = new AsyncLocalStorage();
+/**
+ * Run `work` holding the checkout's lock (lockCheckout). Re-entrant along one call chain: a hardened git nested in
+ * another on the same checkout (teardown's git run through the builder's hardened runner, a view within a view) runs
+ * under the lock its caller already holds instead of waiting on itself.
+ */
+export async function withCheckoutLock(home, checkout, work) {
+    const held = heldHere.getStore() ?? new Set();
+    if (held.has(checkout))
+        return work();
+    const release = await lockCheckout(home, checkout);
+    try {
+        return await heldHere.run(new Set([...held, checkout]), work);
+    }
+    finally {
+        release();
+    }
+}

package/dist/grant.js

@@ -178,7 +178,9 @@ async function observedByGit(repo, paths, runner) {
     for (const path of local) {
         const asked = [path, `${normalise(path)}/`];
         const ignored = await Promise.all(asked.map(async (candidate) => {
-            const result = await runner("git", ["--no-optional-locks", "check-ignore", "-q", candidate], {
+            // check-ignore reads the index, so a planted fsmonitor would run: off (and hooks, lazy fetch) on the command line,
+            // which wins over any config the repository's builds can write.
+            const result = await runner("git", ["--no-optional-locks", "--no-lazy-fetch", "-c", "core.fsmonitor=false", "-c", "core.hooksPath=/dev/null", "check-ignore", "-q", candidate], {
                 cwd: repo,
             });
             return result.code === 0;