toolroll 0.9.75 → 0.9.77

package/dist/planner.js

@@ -20,6 +20,7 @@ import { unlinkSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { run } from "./exec.js";
+import { checkoutGit } from "./teardown-git.js";
 import { auditOf, isProviderId } from "./provider.js";
 import { currentClaim, heartbeat } from "./claim.js";
 import { heartbeat as runnerHeartbeat } from "./runner.js";
@@ -491,7 +492,10 @@ function draftedOutcome(root, runId, plan, repairRunId = null) {
     return { ok: true, drafted: { plan, artifact, repairRunId } };
 }
 export async function plan(store, request) {
-    const { taskId, taskRef, runner, worktree, branch, now, agent, git = run, timeoutMs = DEFAULT_PLAN_TIMEOUT_MS, maxTurns = DEFAULT_PLAN_TURNS, } = request;
+    const { taskId, taskRef, runner, worktree, branch, now, agent, git: givenGit = run, timeoutMs = DEFAULT_PLAN_TIMEOUT_MS, maxTurns = DEFAULT_PLAN_TURNS, } = request;
+    // The plane's git on the plan's checkout (agent-written, and its repository shared with every build) runs hardened, against
+    // a frozen view of the repository's config and info (teardown-git.ts checkoutGit); an injected runner is used as given.
+    const git = givenGit === run ? checkoutGit(run, "build", { repo: store.getWorktree(worktree)?.repo ?? null }) : givenGit;
     // An ACP agent works with full access inside the fence: it builds and repairs, and is never handed a plan (routing refuses it first).
     if (request.provider !== undefined && isAcpProvider(request.provider)) {
         return { ok: false, kind: "failure", reason: "provider-unsupported", message: `${ACP_AGENTS[request.provider].name} builds and repairs only — configure the planner to claude, codex or gemini` };

package/dist/prepared-evidence.d.ts

@@ -1,6 +1,7 @@
 import { type ParsedProof } from './proof.js';
 export declare const PREPARED_EVIDENCE_FILE = "standing-orders.evidence.json";
-export declare const PREPARED_EVIDENCE_GIT: readonly ['--literal-pathspecs', '--no-lazy-fetch', '--no-replace-objects', '--no-optional-locks'];
+/** Read flags: --no-lazy-fetch where git has it; a partial clone is refused where it doesn't (teardown-git.ts). */
+export declare const preparedEvidenceGit: () => string[];
 export type PreparedEvidence = {
     proof: ParsedProof;
     files: {

package/dist/prepared-evidence.js

@@ -1,12 +1,13 @@
 /** Committed image inventory, never claimed checks, completion, or approval. */
-import { execFileSync } from 'node:child_process';
+import { noLazyFetch, viewedGitSync } from './teardown-git.js';
 import { createHash } from 'node:crypto';
 import { lstatSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { imageDimensions, looksLikeProtocolFile, readMailbox, SCREENSHOT_BYTE_CAP, validateScreenshotBytes } from './evidence.js';
 import { parseProof, PROOF_LIMITS, SCREENSHOT_EVIDENCE_MIN_BYTES, SCREENSHOT_EVIDENCE_MIN_HEIGHT, SCREENSHOT_EVIDENCE_MIN_WIDTH, serializeProof } from './proof.js';
 export const PREPARED_EVIDENCE_FILE = 'standing-orders.evidence.json';
-export const PREPARED_EVIDENCE_GIT = ['--literal-pathspecs', '--no-lazy-fetch', '--no-replace-objects', '--no-optional-locks'];
+/** Read flags: --no-lazy-fetch where git has it; a partial clone is refused where it doesn't (teardown-git.ts). */
+export const preparedEvidenceGit = () => ['--literal-pathspecs', ...noLazyFetch(), '-c', 'protocol.allow=never', '--no-replace-objects', '--no-optional-locks'];
 const nextAction = 'Ask Codex to prepare review screenshots and commit them with standing-orders.evidence.json, then review the new result.';
 const fail = (detail) => { throw Error(`Review screenshots are not ready. ${nextAction} ${detail}`); };
 const digest = (bytes) => createHash('sha256').update(bytes).digest('hex');
@@ -16,7 +17,11 @@ export function readPreparedEvidence(repo, candidate, required = false) {
         fail('The saved commit is invalid.');
     const git = (args, cap) => {
         try {
-            return execFileSync('git', [...PREPARED_EVIDENCE_GIT, '-C', repo, ...args], { stdio: ['ignore', 'pipe', 'pipe'], timeout: 10_000, maxBuffer: cap });
+            // Every git version through a frozen read view, bounded (eval-harness review 1, finding 7).
+            const ran = viewedGitSync(repo, [...preparedEvidenceGit(), ...args], { timeoutMs: 10_000, maxBuffer: cap, buffer: true });
+            if (ran.status !== 0)
+                throw new Error('git failed');
+            return ran.stdout;
         }
         catch {
             return fail('The committed screenshot inventory could not be read.');

package/dist/project-knowledge.js

@@ -1,5 +1,5 @@
 /** Project-owned context, independent of provider memory. Never grants authority. */
-import { execFileSync } from 'node:child_process';
+import { checkoutGitSync } from './teardown-git.js';
 import { acceptedIdentities, carryProject, learningIdentity, learningSha } from './project-learning.js';
 import { currentActor } from './actor.js';
 import { decisionLines, getDecision, listDecisions } from './project-memory.js';
@@ -35,7 +35,11 @@ CREATE TRIGGER IF NOT EXISTS knowledge_snapshot_no_update BEFORE UPDATE ON knowl
 CREATE TRIGGER IF NOT EXISTS knowledge_snapshot_no_delete BEFORE DELETE ON knowledge_snapshot BEGIN SELECT RAISE(ABORT,'Knowledge context is immutable'); END;
 `;
 const EMPTY = { instructions: '', references: [] };
-const git = (repo, args) => execFileSync('git', ['--no-optional-locks', '-C', repo, ...args], { encoding: 'utf8', maxBuffer: 200_000, stdio: ['ignore', 'pipe', 'pipe'] }).trimEnd();
+// No --no-lazy-fetch: through a frozen read view, which refuses a partial clone from the config git runs with.
+// Every git version through a frozen read view (eval-harness review 1, finding 7): the repository's config is copied
+// once and inspected (an include, a command or a partial clone refused), so an include pointing at a FIFO can't hang
+// the plane, and every call is bounded.
+const git = (repo, args) => checkoutGitSync(repo, args, { timeoutMs: 10_000, maxBuffer: 200_000 }).trimEnd();
 function clean(value, bytes) {
     if (Buffer.byteLength(value) > bytes || /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f\ufffd]/u.test(value))
         throw Error('This text is too long or is not readable text.');

package/dist/project-learning.js

@@ -1,7 +1,7 @@
 /** Optional, project-local advice. Core review and approval never depend on it. */
 import { inReadOnlyRequest } from "./read-only-request.js";
+import { checkoutGitSync } from './teardown-git.js';
 import { createHash } from 'node:crypto';
-import { execFileSync } from 'node:child_process';
 import { closeSync, constants as fsConstants, existsSync, fstatSync, lstatSync, openSync, readSync, realpathSync, statSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import { readVerifiedArtifact, scanForSecrets } from './evidence.js';
@@ -52,7 +52,9 @@ const git = (repo, args, seen) => {
     if (known !== undefined)
         return known;
     // Bounded, and no hook or fsmonitor program: it also runs from the console's background pass.
-    const out = execFileSync('git', ['--no-optional-locks', '-c', 'core.fsmonitor=false', '-c', 'core.hooksPath=/dev/null', '-C', repo, ...args], { encoding: 'utf8', maxBuffer: 2 * 1024 * 1024, timeout: 10_000, stdio: ['ignore', 'pipe', 'pipe'] }).trimEnd();
+    // No lazy fetch either: a partial clone's fetch runs whatever transport command the shared config names.
+    // Every git version through a frozen read view, bounded (eval-harness review 1, finding 7).
+    const out = checkoutGitSync(repo, args, { timeoutMs: 10_000, maxBuffer: 2 * 1024 * 1024 }).trimEnd();
     seen?.set(key, out);
     return out;
 };
@@ -542,6 +544,24 @@ export function learningContext(store, root, runId, phase, now = new Date(), val
             // advice may inform its proposal; only an approval can authorize a build.
             const unscopedPlan = phase === 'plan' && scope === null && !run.scopeDigest;
             const eligible = [];
+            // The checkout's status, read once for every lesson (one command on one checkout): a hardened read costs a
+            // private view and several git processes, and this runs inside the transaction. A failed read fails every lesson
+            // that reaches it, as each read alone would have.
+            let status = null;
+            const statusLines = (cwd) => {
+                status ??= (() => {
+                    // A build's checkout: status runs filters, so the hardened read (teardown-git.ts checkoutGitSync).
+                    try {
+                        return { lines: checkoutGitSync(cwd, ['status', '--porcelain', '--untracked-files=all'], { timeoutMs: 10_000, maxBuffer: 2 * 1024 * 1024 }).trimEnd().split('\n') };
+                    }
+                    catch (error) {
+                        return { error };
+                    }
+                })();
+                if ('error' in status)
+                    throw status.error;
+                return status.lines;
+            };
             if (policy && (paths.length > 0 || unscopedPlan)) {
                 for (const row of store.handle.prepare("SELECT * FROM project_lesson WHERE repo=? AND identity IN (SELECT value FROM json_each(?)) AND status='adopted' ORDER BY id DESC LIMIT 100").all(repo, carried)) {
                     try {
@@ -552,7 +572,7 @@ export function learningContext(store, root, runId, phase, now = new Date(), val
                         if (l.payload.environment !== environmentFingerprint(store, repo) || learningFingerprint(repo, head, l.payload.paths, seen) !== l.payload.fingerprint)
                             continue;
                         const cwd = run.worktree ?? repo;
-                        const dirty = git(cwd, ['status', '--porcelain', '--untracked-files=all'], seen).split('\n').some(line => { const p = line.slice(3); return configPath(p) || l.payload.paths.includes(p); });
+                        const dirty = statusLines(cwd).some(line => { const p = line.slice(3); return configPath(p) || l.payload.paths.includes(p); });
                         if (!dirty)
                             eligible.push(l);
                     }

package/dist/proof.js

@@ -622,6 +622,12 @@ function verificationFailureWords(failure) {
                 return "automatic recovery stopped because this worker no longer owned the build";
             case "coverage-incomplete":
                 return "the release check didn't cover everything it owed, or a required test went missing or was skipped";
+            case "no-result":
+                return "the release check gave no complete result (no valid report, or a part, file or journey with no outcome), so it can't count as a pass";
+            case "baseline-unverifiable":
+                return "the last release Toolroll recorded couldn't be verified, so what the release check owed is unknown and it wasn't run";
+            case "stopped-by-toolroll":
+                return "Toolroll's own shutdown stopped the approved verification command before it finished";
             case "timed-out":
                 return "the approved verification command timed out before checks finished";
             case "spawn-failed":

package/dist/pull-request-flow.js

@@ -25,6 +25,7 @@ import { authenticateApprover, personProof } from "./scope.js";
 import { BRANCH_PREFIX, headWithin } from "./names.js";
 import { NIGHTLY_CHECK_ONLY, RELEASE_MERGES_ONLY, nightlyTaskRef, releaseTaskRef } from "./store.js";
 import { belongsToRelease } from "./release-authority.js";
+import { autoReleaseSealed } from "./release-auto.js";
 import { fullCheckGate, requestFollowUpChecks } from "./result-follow-ups.js";
 export const MERGE_METHODS = ["squash", "merge", "rebase"];
 /** CI revisions one task may file across its revisions before a person is asked instead. */
@@ -402,6 +403,9 @@ export async function mergePullRequest(store, input) {
     // the merge at its lease's epoch and checks the exact pull request: never here, by hand or automatically.
     if (mergedTask !== null && belongsToRelease(store, mergedTask))
         return refuse("release", "This result belongs to a release; it merges only through `toolroll release`.");
+    // A release task the plane approved (or is checking) automatically (auto-approve-green.md) never merges here either.
+    if (mergedTask !== null && autoReleaseSealed(store, mergedTask))
+        return refuse("release", "This result was approved automatically for a release; it merges only through `toolroll release`.");
     const publication = store.publicationForRun(input.runId);
     const follow = publication === null ? null : followOf(store, publication.id);
     if (publication === null || follow === null || publication.prNumber === null)

package/dist/read-executor-worker.js

@@ -1,6 +1,7 @@
 import { parentPort, workerData } from 'node:worker_threads';
 import { openStoreReadOnly } from './store.js';
-import { workIndexPage } from './work-index.js';
+import { workCountsByProject, workIndexPage } from './work-index.js';
+import { projectSummaryOf } from './console-chrome.js';
 /** One read-only, query-only connection per worker (read-executor.ts). Jobs arrive one at a time. */
 let store = null;
 function connection() {
@@ -15,9 +16,12 @@ function connection() {
 parentPort.on('message', ({ id, job }) => {
     let reply;
     try {
-        if (job.kind !== 'work-index-page')
-            throw new Error('Unknown read.');
-        reply = { id, ok: true, value: workIndexPage(connection(), new Date(job.now), job.access, job.options) };
+        const now = new Date(job.now);
+        const value = job.kind === 'work-index-page' ? workIndexPage(connection(), now, job.access, job.options)
+            : job.kind === 'work-counts' ? workCountsByProject(connection(), now, job.access)
+                : job.kind === 'project-summary' ? projectSummaryOf(connection(), now, job.access, job.actor, job.projects, job.evidenceRoot ?? undefined)
+                    : (() => { throw new Error('Unknown read.'); })();
+        reply = { id, ok: true, value };
     }
     catch (error) {
         reply = { id, ok: false, error: { name: error instanceof Error ? error.name : 'Error', message: error instanceof Error ? error.message : String(error) } };

package/dist/read-executor.d.ts

@@ -1,5 +1,7 @@
 import type { Store } from './store.js';
-import { type WorkIndexOptions, type WorkIndexPage } from './work-index.js';
+import { type WorkIndexOptions, type WorkIndexPage, type WorkProjectCounts } from './work-index.js';
+import type { BrowserProjectState } from './browser-workspace.js';
+import type { SidebarProject } from './console-chrome.js';
 import type { WorkSummaryAccess } from './work-summary.js';
 /**
  * Heavy, read-only database work for the server, run on worker threads (docs/server-performance.md).
@@ -14,6 +16,17 @@ export type ReadJob = {
     now: string;
     access: WorkSummaryAccess;
     options: WorkIndexOptions;
+} | {
+    kind: 'work-counts';
+    now: string;
+    access: WorkSummaryAccess;
+} | {
+    kind: 'project-summary';
+    now: string;
+    access: WorkSummaryAccess;
+    actor: string;
+    projects: SidebarProject[];
+    evidenceRoot: string | null;
 };
 export type ReadReply = {
     id: number;
@@ -38,6 +51,10 @@ export declare class ReadExecutor {
     get size(): number;
     /** workIndexPage(store, now, access, options) on a worker's read-only connection: same rows, same errors. */
     workIndexPage(now: Date, access: WorkSummaryAccess, options: WorkIndexOptions): Promise<WorkIndexPage>;
+    /** workCountsByProject(store, now, access) on a worker: the console's Tasks count and live beat. */
+    workCounts(now: Date, access: WorkSummaryAccess): Promise<WorkProjectCounts[]>;
+    /** projectSummaryOf (console-chrome.ts) on a worker: the sidebar's project states for one already-admitted reader. */
+    projectSummary(now: Date, access: WorkSummaryAccess, actor: string, projects: readonly SidebarProject[], evidenceRoot: string | undefined): Promise<BrowserProjectState[]>;
     /** Fails every queued and running read once, then stops the workers. */
     close(): Promise<void>;
 }

package/dist/read-executor.js

@@ -29,6 +29,14 @@ export class ReadExecutor {
             throw error;
         }
     }
+    /** workCountsByProject(store, now, access) on a worker: the console's Tasks count and live beat. */
+    async workCounts(now, access) {
+        return await this.#run({ kind: 'work-counts', now: now.toISOString(), access });
+    }
+    /** projectSummaryOf (console-chrome.ts) on a worker: the sidebar's project states for one already-admitted reader. */
+    async projectSummary(now, access, actor, projects, evidenceRoot) {
+        return await this.#run({ kind: 'project-summary', now: now.toISOString(), access, actor, projects: projects.map(one => ({ path: one.path, name: one.name })), evidenceRoot: evidenceRoot ?? null });
+    }
     #run(job) {
         if (this.#closed)
             return Promise.reject(new ReadExecutorError('The server is closing.'));

package/dist/release-adapters.d.ts

@@ -4,8 +4,9 @@
  * Homebrew tap through `gh`. Each call is bounded; none asks for or stores a credential — `gh`, npm and Toolroll use
  * the sign-ins this machine already has.
  */
-import type { GateState, Installed, ReleaseAdapters } from "./release.js";
+import type { CheckRun, GateState, Installed, MainProtection, ReleaseAdapters } from "./release.js";
 import { Store } from "./store.js";
+import { type CiObservation } from "./release-auto.js";
 import { type BuildRunner } from "./release-carry.js";
 import { type ReleaseRepo, type ReleaseTools } from "./release-git.js";
 export { RELEASE_PATH, RELEASE_REMOTE, releaseConfigProblem, releaseGitArgs, releaseGitEnv, releaseRemote, releaseTools, type ReleaseRepo, type ReleaseTools } from "./release-git.js";
@@ -81,4 +82,72 @@ export declare function bumpFormula(text: string, url: string, sha256: string):
  * The release's authority record through a store (release-once.md): what `toolroll release` reads and writes for its
  * lease, its carries and its operations. `open` hands a store for each call and `done` lets it go.
  */
-export declare function storeReleaseAdapter(open: () => Store, done: (store: Store) => void, now: () => Date, runner?: BuildRunner): NonNullable<ReleaseAdapters["release"]>;
+export declare function storeReleaseAdapter(open: () => Store, done: (store: Store) => void, now: () => Date, runner?: BuildRunner, 
+/** Releases that approve themselves (auto-approve-green.md): the plane's own look at CI on a commit, and where the
+ * check receipts are kept. Absent: no automatic approval, every release asks a person. */
+auto?: AutoObservers): NonNullable<ReleaseAdapters["release"]>;
+/** What the plane itself reads for an automatic release approval. */
+export type AutoObservers = {
+    /** The plane's executor policy, never a report field or project setting. Unknown refuses. Production currently
+     * cannot establish this; synthetic observers may supply protected execution to exercise the remaining gates. */
+    reportsProtected?: boolean;
+    observe: (sha: string) => Promise<CiObservation>;
+    /** GitHub's merge base of `sha` with the branch `base` of the recorded repository. */
+    mergeBase: (base: string, sha: string) => Promise<string>;
+    /** Whether main's protection holds for the account that merges (readMainProtection); null when unreadable. */
+    upToDateRequired: () => Promise<boolean | null>;
+    evidenceRoot: string;
+};
+/**
+ * Every check run GitHub holds for one commit — every attempt, not only the latest (`filter=all`; GitHub's default
+ * lists only the latest of each), every page — with its id, app, check suite and the commit it is filed under, oldest
+ * first. A row that doesn't parse stops the read: a partial answer is never taken for the whole.
+ */
+export declare function readCheckRuns(run: Exec, gh: string, repo: string, sha: string): Promise<CheckRun[]>;
+/** One job's step outcomes as GitHub's Actions API reports them. */
+export type JobRecord = {
+    id: number;
+    status: string;
+    conclusion: string | null;
+    steps: {
+        number: number;
+        name: string;
+        status: string;
+        conclusion: string | null;
+    }[];
+};
+/**
+ * Whether a finished, unsuccessful job ended before any of the workflow's own steps ran: every step after GitHub's own
+ * first one ("Set up job", always number 1) never ran (no conclusion, or skipped) — leaving out only GitHub's own
+ * closing "Complete job" when it is the last step. Step numbers and outcomes are the runner's records; nothing the
+ * candidate prints is read. A job with no steps never reached one. Anything else (a step that ran, even the checkout)
+ * is not confirmed infrastructure.
+ */
+export declare function failedBeforeTests(job: JobRecord): boolean;
+/** GitHub's job record for one check run (its job), read strictly: null when it can't be read whole. */
+export declare function readJobBeforeTests(run: Exec, gh: string, repo: string, id: number): Promise<boolean | null>;
+/** GitHub lists check runs from at most the latest 1000 check suites of a commit: the history is whole only below that. */
+export declare const CHECK_SUITE_CEILING = 1000;
+export declare function readSuitesComplete(run: Exec, gh: string, repo: string, sha: string): Promise<boolean>;
+/** GitHub's merge base of `sha` with branch `base` (the compare API), read by the plane. */
+export declare function readMergeBase(run: Exec, gh: string, repo: string, base: string, sha: string): Promise<string>;
+/**
+ * Main's head as GitHub has it now (eval-harness review 1, finding 4): read by the plane's own gh from GitHub's API,
+ * never from a ref in a checkout a build can write.
+ */
+export declare function readMainHead(run: Exec, gh: string, repo: string, branch?: string): Promise<string>;
+/** Whether `sha` already holds `ancestor` (GitHub's compare: `sha` is not behind it), as GitHub answers now. */
+export declare function readContains(run: Exec, gh: string, repo: string, sha: string, ancestor: string): Promise<boolean>;
+/**
+ * Main's protection, judged for the principal that merges (eval-harness review 2, finding 1; review 1, finding 4): the
+ * plane's own gh, which merges as the same account. A layer holds only when it requires branches to be up to date, names
+ * a non-empty set of required checks covering PROTECTION_MINIMUM_CHECKS, bound to GitHub Actions (app 15368), and
+ * can't be bypassed by that account:
+ * classic protection with "Do not allow bypassing the above settings" (`enforce_admins`); an active ruleset whose
+ * bypass list reads whole, names no role, team or organization admin, and says this account never bypasses it. Read
+ * only — Toolroll never changes a repository's settings. A layer that can't be read never holds; null only when nothing
+ * could be read at all.
+ */
+export declare function readMainProtection(run: Exec, gh: string, repo: string, branch?: string): Promise<MainProtection | null>;
+/** Whether main's protection holds, as a yes/no (release-auto.ts sealAutoGreen): null when it can't be read. */
+export declare function readUpToDateRequired(run: Exec, gh: string, repo: string, branch?: string): Promise<boolean | null>;