toolroll 0.9.75 → 0.9.77

package/dist/repository-context.js

@@ -1,10 +1,8 @@
 /** Optional repository context. Callers admit project access; this module grants no authority.
  * The index is disposable. Every read hashes the current bounded tracked source set;
  * a missing/changed/unreadable index falls back to ordinary text search, never a task gate. */
-import { inReadOnlyRequest } from './read-only-request.js';
 import { checkoutGitSync } from './teardown-git.js';
 import { createHash, randomUUID } from 'node:crypto';
-import { execFileSync } from 'node:child_process';
 import { existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
 import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { scanForSecrets } from './evidence.js';
@@ -14,10 +12,10 @@ const CODE = /\.(?:[cm]?[jt]sx?)$/i;
 const TEXT = /\.(?:[cm]?[jt]sx?|md|txt|css|html|json)$/i;
 const MAX_NODES = 16_000, MAX_EDGES = 12_000;
 const sha = (value) => createHash('sha256').update(value).digest('hex');
-// Read-only and bounded: no index refresh, no hooks, no fsmonitor program.
-// On a page read (Settings -> Knowledge's search), the hardened checkout git: no filter, hook, program or network.
-const git = (repo, args) => inReadOnlyRequest() ? checkoutGitSync(repo, args, { timeoutMs: 10_000, maxBuffer: 2_000_000 }).trimEnd()
-    : execFileSync('git', ['--no-optional-locks', '-c', 'core.fsmonitor=false', '-c', 'core.hooksPath=/dev/null', '-C', repo, ...args], { encoding: 'utf8', maxBuffer: 2_000_000, timeout: 10_000, stdio: ['ignore', 'pipe', 'pipe'] }).trimEnd();
+// Read-only and bounded, and always the hardened checkout git (a crew worktree is agent-written, and a page read or a
+// lead's refresh reads it alike): no filter, hook, program or network, its config and info frozen in a view of the
+// plane's own before they're inspected (teardown-git.ts checkoutGitSync).
+const git = (repo, args) => checkoutGitSync(repo, args, { timeoutMs: 10_000, maxBuffer: 2_000_000 }).trimEnd();
 const inside = (root, path) => { const r = relative(root, path); return r !== '..' && !r.startsWith('..' + sep) && !isAbsolute(r); };
 function capture(request) {
     const repo = realpathSync(request.repo);

package/dist/result-follow-ups.js

@@ -4,6 +4,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { belongsToRelease } from "./release-authority.js";
 import { run as execRun } from "./exec.js";
+import { hardenedGit } from "./teardown-git.js";
 import { approvedCommandShell, SETUP_ENV_ALLOWLIST, SETUP_ENV_DENYLIST } from "./builder.js";
 import { runWithIsolatedDatabase } from "./child-database.js";
 import { boundStreamHeadTail, readVerifiedArtifact, redactSecretLines, scanForSecrets, storeEvidence } from "./evidence.js";
@@ -161,7 +162,8 @@ export function waitingRequestsOfAnyKind(store, now) {
 export async function runFollowUpCheck(store, root, request, deps = {}) {
     const now = deps.now ?? (() => new Date());
     const runner = deps.runner ?? execRun;
-    const git = deps.git ?? execRun;
+    // The project's repository and a checkout of a build's commit, both agent-writable: the hardened git (teardown-git.ts).
+    const git = deps.git ?? hardenedGit(execRun);
     const asked = store.handle.prepare("SELECT run_id FROM action_ledger WHERE id = ? AND action = ?").get(request, CHECKS_REQUESTED);
     if (asked === undefined)
         return null;

package/dist/review-context.js

@@ -45,6 +45,7 @@ import { createHash } from "node:crypto";
 import { hasForbiddenControls } from "./decision.js";
 import { EVIDENCE_CAPS, isBinaryAssetPath, isImagePath, readVerifiedArtifact, redactSecretLines, scanForSecrets, storeEvidence } from "./evidence.js";
 import { parseProof } from "./proof.js";
+import { noLazyFetch } from "./teardown-git.js";
 /** Explicit bounds. Content bytes are UTF-8 of the stored (possibly
  * redacted) text; the aggregate is the sum over every stored item. */
 export const LEGACY_REVIEW_CONTEXT_LIMITS = {
@@ -468,11 +469,12 @@ export function citesSuppliedProvenance(note, supplied) {
             return true;
     return false;
 }
-const GIT_READ = ["--literal-pathspecs", "--no-lazy-fetch", "--no-replace-objects", "--no-optional-locks"];
+/** Read flags: --no-lazy-fetch where git has it (the hardened runner refuses a partial clone where it doesn't). */
+const gitRead = () => ["--literal-pathspecs", ...noLazyFetch(), "-c", "protocol.allow=never", "--no-replace-objects", "--no-optional-locks"];
 async function treeEntries(git, cwd, revision, paths) {
     if (paths.length === 0)
         return new Map();
-    const listed = await git("git", [...GIT_READ, "ls-tree", "-z", "-l", revision, "--", ...paths], { cwd, maxBuffer: 4 * 1024 * 1024 });
+    const listed = await git("git", [...gitRead(), "ls-tree", "-z", "-l", revision, "--", ...paths], { cwd, maxBuffer: 4 * 1024 * 1024 });
     if (listed.code !== 0)
         return null;
     const entries = new Map();
@@ -570,7 +572,7 @@ async function ancestorPatch(store, git, args, inventory, path) {
         if (!base || !head || !SHA1.test(base) || !SHA1.test(head))
             return fail(`run #${runId} has no exact patch endpoints`);
         for (const from of new Set([base, previousHead ?? base])) {
-            const ancestor = await git("git", [...GIT_READ, "merge-base", "--is-ancestor", from, head], { cwd: args.worktree });
+            const ancestor = await git("git", [...gitRead(), "merge-base", "--is-ancestor", from, head], { cwd: args.worktree });
             if (ancestor.code !== 0)
                 return fail(`run #${runId}'s patch ancestry could not be verified`);
         }
@@ -780,7 +782,7 @@ export async function deriveReviewContext(store, git, args, lineage) {
     const sourceCriteria = new Map((sourceScopeVerified ? sourceScope.acceptance : []).map(one => [one.id, one]));
     // 3. Ancestry: is the source head an ancestor of this head?
     if (sourceHead !== null) {
-        const check = await git("git", [...GIT_READ, "merge-base", "--is-ancestor", sourceHead, args.head], { cwd: args.worktree });
+        const check = await git("git", [...gitRead(), "merge-base", "--is-ancestor", sourceHead, args.head], { cwd: args.worktree });
         if (check.code === 0)
             inventory.ancestry = { verified: true, detail: `${sourceHead} is an ancestor of ${args.head}` };
         else if (check.code === 1) {
@@ -832,7 +834,7 @@ export async function deriveReviewContext(store, git, args, lineage) {
     if (generalPaths.length === 0 && sourceScopeVerified) {
         const paths = sourceScope.touches.filter(path => safeContextPath(path.replace(/\/$/, "")) && !/[?*\[\]]/.test(path));
         if (paths.length > 0) {
-            const listed = await git("git", [...GIT_READ, "ls-tree", "-r", "-z", "--name-only", args.head, "--", ...paths], { cwd: args.worktree, maxBuffer: 4 * 1024 * 1024 });
+            const listed = await git("git", [...gitRead(), "ls-tree", "-r", "-z", "--name-only", args.head, "--", ...paths], { cwd: args.worktree, maxBuffer: 4 * 1024 * 1024 });
             if (listed.code === 0)
                 generalPaths.push(...[...new Set(listed.stdout.split("\0").filter(safeContextPath))].sort());
             else
@@ -949,7 +951,7 @@ export async function deriveReviewContext(store, git, args, lineage) {
                     gap("aggregate-limit", `${entry.size} bytes would cross the ${REVIEW_CONTEXT_LIMITS.aggregateBytes}-byte aggregate limit`);
                     continue;
                 }
-                const read = await git("git", [...GIT_READ, "cat-file", "blob", entry.object], { cwd: args.worktree, maxBuffer: REVIEW_CONTEXT_LIMITS.itemBytes + 4096 });
+                const read = await git("git", [...gitRead(), "cat-file", "blob", entry.object], { cwd: args.worktree, maxBuffer: REVIEW_CONTEXT_LIMITS.itemBytes + 4096 });
                 if (read.code !== 0) {
                     gap("capture-failed", `blob ${entry.object} could not be read (git exit ${read.code})`);
                     continue;

package/dist/runner.js

@@ -19,6 +19,7 @@
  * again. Reaping on the second tells you a *machine* is gone, and everything
  * it was holding — claims and worktrees alike — needs recovering together.
  */
+import { mintSecret } from "./secret-mint.js";
 import { isAcpProvider } from "./acp-agents.js";
 import { verifyLaunch } from "./acp-attest.js";
 import { inspectAcpAgent, inspectionWords } from "./acp-inspect.js";
@@ -352,7 +353,7 @@ export function recoverDead(store, now, livenessMs = DEFAULT_LIVENESS_MS) {
 }
 /** 32 bytes of randomness, urlsafe, so it survives being pasted anywhere. */
 function mintToken() {
-    return randomBytes(32).toString("base64url");
+    return mintSecret(32);
 }
 export function hashToken(token) {
     return createHash("sha256").update(token, "utf8").digest("hex");

package/dist/sandbox-runtime.d.ts

@@ -63,6 +63,14 @@ export declare const SEATBELT_NO_OTHER_TERMINAL: string;
  * any program read them (anthropics/sandbox-runtime#755). Build agents keep it (Claude Code signs in from the keychain).
  */
 export declare const SEATBELT_NO_KEYCHAIN: string;
+/**
+ * First after the profile's default deny: a mach service lookup the profile doesn't allow is still denied, unreported.
+ * On macOS 26.5 a reported mach-lookup denial now and then never answers: bootstrap_look_up blocks in launchd for good
+ * (seen as npm stuck in Node's DNS setup, dns_configuration_copy → com.apple.SystemConfiguration.DNSConfiguration, about
+ * 1 launch in 70 under load; never with the report off). Every allow after it still wins, so what is reachable is the
+ * same; only the report goes.
+ */
+export declare const SEATBELT_QUIET_MACH_DENY = "(deny mach-lookup (with no-report))";
 /**
  * Chromium, a project check's launch only: Playwright's default browser (its Chromium headless shell) registers its
  * port rendezvous service as org.chromium.Chromium.MachPortRendezvousServer.<its pid> at start, and its helpers look

package/dist/sandbox-runtime.js

@@ -122,8 +122,16 @@ export const SEATBELT_NO_OTHER_TERMINAL = [
  */
 export const SEATBELT_NO_KEYCHAIN = [
     "; Toolroll: no keychain",
-    "(deny mach-lookup (global-name \"com.apple.SecurityServer\") (global-name \"com.apple.securityd.xpc\"))",
+    "(deny mach-lookup (with no-report) (global-name \"com.apple.SecurityServer\") (global-name \"com.apple.securityd.xpc\"))",
 ].join("\n");
+/**
+ * First after the profile's default deny: a mach service lookup the profile doesn't allow is still denied, unreported.
+ * On macOS 26.5 a reported mach-lookup denial now and then never answers: bootstrap_look_up blocks in launchd for good
+ * (seen as npm stuck in Node's DNS setup, dns_configuration_copy → com.apple.SystemConfiguration.DNSConfiguration, about
+ * 1 launch in 70 under load; never with the report off). Every allow after it still wins, so what is reachable is the
+ * same; only the report goes.
+ */
+export const SEATBELT_QUIET_MACH_DENY = "(deny mach-lookup (with no-report))";
 /**
  * Chromium, a project check's launch only: Playwright's default browser (its Chromium headless shell) registers its
  * port rendezvous service as org.chromium.Chromium.MachPortRendezvousServer.<its pid> at start, and its helpers look
@@ -226,11 +234,15 @@ export function withSeatbeltRules(command, rules, expected) {
     const profile = words[exec + 2];
     if (!profile.startsWith("(version 1)\n(deny default"))
         throw shape();
+    // Where the default deny's line ends (the profile's end when it is the last line).
+    const lineEnd = profile.indexOf("\n", "(version 1)\n".length);
+    const opening = lineEnd < 0 ? profile.length : lineEnd;
     if (!/^\/[A-Za-z0-9_./-]+$/.test(words[exec + 3]))
         throw shape();
     if (expected !== undefined && words[exec + 5] !== expected)
         throw shape();
-    return srtQuote([...words.slice(0, exec + 2), `${profile}\n${rules}\n`, ...words.slice(exec + 3)]);
+    const quiet = `${profile.slice(0, opening)}\n${SEATBELT_QUIET_MACH_DENY}${profile.slice(opening)}`;
+    return srtQuote([...words.slice(0, exec + 2), `${quiet}\n${rules}\n`, ...words.slice(exec + 3)]);
 }
 /** The runtime's macOS invocation for `file args` run from `cwd`: a command line for /bin/sh. */
 export function srtMacosCommand(file, args, terms, cwd = process.cwd(), temp) {

package/dist/scope.d.ts

@@ -418,7 +418,10 @@ export type ScopeAuthor = "mate" | "coordinator" | "scout" | "lead";
 /** The authorities a seal can stand on (approval-policy plan §1.5). Anything else stands on nothing. */
 /** `carried`: a later commit of a release carried under a person's release approval (release-once.md); only the carry
  * transaction ever writes it. */
-export type ApprovalBasis = "password" | "mode" | "chat" | "grant" | "schedule" | "lead" | "carried";
+/** `auto-check` / `auto-green`: a release task the plane approved itself under the project's "Approve automatically when
+ * checks pass" (docs/plans/auto-approve-green.md) — `auto-check` lets its check run, `auto-green` is the release
+ * approval once CI and that check passed. Only release-auto.ts writes them; neither is ever a person's. */
+export type ApprovalBasis = "password" | "mode" | "chat" | "grant" | "schedule" | "lead" | "carried" | "auto-check" | "auto-green";
 export declare const APPROVAL_BASES: readonly ApprovalBasis[];
 export type Approval = {
     approved: true;
@@ -865,7 +868,7 @@ export declare function releaseTermsSentence(terms: ReleaseTerms): string;
 export declare function releaseAsksAgainWords(terms: ReleaseTerms): string[];
 export { personProof } from "./person-proof.js";
 import { type ReleaseTerms } from "./contracts/release-terms.js";
-import { type ReleaseAuthority, type ReleaseCarry } from "./release-authority.js";
+import { type AutoEvidence, type ReleaseAuthority, type ReleaseCarry } from "./release-authority.js";
 /** Whether the command running now is a machine's: the lead (its token) or a remote API run. Trusted context only. */
 export declare const machineActing: () => boolean;
 /** A proof row's detail, either form: the legacy text (`<at> · generation <n> · digest <d>`) or the versioned record
@@ -952,3 +955,29 @@ export declare function mainDebtProblem(store: Store, repo: string, taskId: stri
  * chat it is approved only through the release card.
  */
 export declare function deployGateScope(scope: Pick<Scope, "candidate" | "releaseTerms">): boolean;
+/**
+ * The plane's own automatic approval of a release task (docs/plans/auto-approve-green.md), read the way the dispatch
+ * belts read it (release-authority.ts autoSealSql): sealed `kind` on the current digest, its evidence row naming exactly
+ * this task, kind, digest and candidate, a release task (candidate and terms signed in), the project's setting on now,
+ * and the person who turned it on still an approver there. Never a person's approval.
+ */
+export declare function autoReleaseApprovalOf(store: Store, taskId: string, kind: "auto-check" | "auto-green"): {
+    ok: true;
+    by: string;
+    at: string;
+    evidence: AutoEvidence;
+} | {
+    ok: false;
+    why: string;
+};
+/** A release's approval: a person's (personApprovalOf, unchanged), or the plane's own `auto-green`. Only release
+ * readers ask this (liveReleaseOf, and the deploy gates inside `toolroll release`); everything else asks for a person. */
+export declare function releaseApprovalOf(store: Store, taskId: string, _now?: Date): {
+    ok: true;
+    by: string;
+    at: string;
+    method: string;
+} | {
+    ok: false;
+    why: string;
+};

package/dist/scope.js

@@ -1,5 +1,6 @@
 // The rubric's vocabulary loads before anything that reaches the plan contract (see contracts/acceptance-terms.ts).
 export { ACCEPTANCE_LIMITS, EVIDENCE_KINDS } from "./contracts/acceptance-terms.js";
+import { mintSecret } from "./secret-mint.js";
 import { passwordlessOn } from "./passwordless.js";
 import { currentPasswordSource, passwordGuardOf, provenPasswordAccount } from "./sign-in-guard.js";
 import { validateScopeText } from "./task-text.js";
@@ -47,10 +48,11 @@ import { z } from "zod";
 import {} from "./contracts/acceptance-terms.js";
 import { parseContract } from "./contracts/contract.js";
 import { readAcceptance, readScopeTerms, storedRubricSchema } from "./contracts/scope.js";
+import { releaseCiHoldOf, releaseCiHoldWords } from "./release-ci-hold.js";
 import { NO_READINESS, exactModelId, legOf, projectRoute, routeDigestOf, routeFromJson, routeJsonProblem, routeWords, } from "./phase-routing.js";
 /** Same shape as a runner's credential, for the same reasons. */
 function mintToken() {
-    return randomBytes(32).toString("base64url");
+    return mintSecret(32);
 }
 export function hashToken(token) {
     return createHash("sha256").update(token, "utf8").digest("hex");
@@ -571,7 +573,7 @@ export function canonicalAcceptance(criteria) {
         .sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0))
         .map(c => ({ id: c.id, statement: c.statement.trim(), evidence: [...c.evidence].sort() }));
 }
-export const APPROVAL_BASES = ["password", "mode", "chat", "grant", "schedule", "lead", "carried"];
+export const APPROVAL_BASES = ["password", "mode", "chat", "grant", "schedule", "lead", "carried", "auto-check", "auto-green"];
 /**
  * The exact bytes an operator agreed to.
  *
@@ -1098,6 +1100,10 @@ export function approve(store, taskId, by, now, sawDigest, token, mutation = {})
         const releaseProblem = scope.releaseTerms == null ? null : releaseSealProblem(store, scope.releaseTerms);
         if (releaseProblem !== null)
             return { ok: false, reason: "policy", message: releaseProblem };
+        // Filed while CI still ran: nobody approves it before the plane read exact-head CI passing (round 1, finding 4).
+        const ciHold = releaseCiHoldOf(store, taskId);
+        if (ciHold !== null)
+            return { ok: false, reason: "policy", message: releaseCiHoldWords(ciHold) };
         const gate = store.approvalGate(taskId, by, "person");
         if (gate.verdict === "refuse")
             return { ok: false, reason: gate.reason };
@@ -1359,7 +1365,7 @@ function describeApproval(approval) {
 export { personProof } from "./person-proof.js";
 import { personProof } from "./person-proof.js";
 import { releaseTermsDigest } from "./contracts/release-terms.js";
-import { CHECK_ACCESS_WIDTH, carriesUnsandboxed, newestReleaseGeneration, releaseAuthorityOfTask, releaseSealProblem } from "./release-authority.js";
+import { CHECK_ACCESS_WIDTH, autoEvidenceOf, carriesUnsandboxed, newestReleaseGeneration, releaseAuthorityOfTask, releaseAutoApproves, releaseSealProblem } from "./release-authority.js";
 /** Whether the command running now is a machine's: the lead (its token) or a remote API run. Trusted context only. */
 export const machineActing = () => currentActor()?.lead === true || activeRemote() !== null;
 /** A proof row's detail, either form: the legacy text (`<at> · generation <n> · digest <d>`) or the versioned record
@@ -1400,6 +1406,8 @@ export function personApprovalOf(store, taskId) {
     const basis = scope.approvalBasis ?? null;
     if (basis === "lead")
         return { ok: false, why: "approved by the lead, not by a person" };
+    if (basis === "auto-check" || basis === "auto-green")
+        return { ok: false, why: "approved automatically, not by a person" };
     if (basis !== "password" && basis !== "chat")
         return { ok: false, why: `approved by ${basis === null ? "an unknown road" : basis === "grant" ? "a flow" : basis}, not by a person` };
     const origin = sealOriginOf(store, taskId, scope.approvedBy, scope.approvedDigest, scope.approvedAt);
@@ -1474,7 +1482,8 @@ export function liveReleaseOf(store, taskId, action, now = new Date()) {
     if (a.tipTask !== taskId)
         return refuse("this is not the release's current commit");
     const anchor = store.getScope(a.anchorTask);
-    const person = personApprovalOf(store, a.anchorTask);
+    // A person's yes, or the plane's own automatic one while the project still approves releases automatically.
+    const person = releaseApprovalOf(store, a.anchorTask, now);
     if (!person.ok)
         return refuse(`the release approval no longer stands: ${person.why}`);
     if (anchor === null || anchor.approvedDigest !== a.anchorDigest || anchor.digest !== a.anchorDigest)
@@ -1539,3 +1548,41 @@ export function mainDebtProblem(store, repo, taskId) {
 export function deployGateScope(scope) {
     return (scope.candidate ?? null) !== null || (scope.releaseTerms ?? null) !== null;
 }
+/**
+ * The plane's own automatic approval of a release task (docs/plans/auto-approve-green.md), read the way the dispatch
+ * belts read it (release-authority.ts autoSealSql): sealed `kind` on the current digest, its evidence row naming exactly
+ * this task, kind, digest and candidate, a release task (candidate and terms signed in), the project's setting on now,
+ * and the person who turned it on still an approver there. Never a person's approval.
+ */
+export function autoReleaseApprovalOf(store, taskId, kind) {
+    const scope = store.getScope(taskId);
+    const ref = store.lookupRef(taskId);
+    if (scope === null || scope.approvedAt === null || scope.approvedBy === null || scope.approvedDigest === null)
+        return { ok: false, why: "not approved yet" };
+    if (scope.approvedDigest !== scope.digest)
+        return { ok: false, why: "the approval is for different scope text" };
+    if (scope.approvalBasis !== kind)
+        return { ok: false, why: kind === "auto-green" ? "not approved automatically" : "not checking automatically" };
+    if ((scope.candidate ?? null) === null || (scope.releaseTerms ?? null) === null || ref === null || ref.repo === null)
+        return { ok: false, why: "only a release task is approved automatically" };
+    const evidence = autoEvidenceOf(store, taskId, scope.modeDigest, kind);
+    if (evidence === null || evidence.digest !== scope.approvedDigest || evidence.candidate !== scope.candidate || evidence.by !== scope.approvedBy)
+        return { ok: false, why: "no record shows what approved it automatically" };
+    if (!releaseAutoApproves(store, ref.repo))
+        return { ok: false, why: "approving releases automatically was turned off" };
+    const account = store.accountOf(scope.approvedBy);
+    if (account === null || account.revokedAt !== null || account.role !== "approver" || !store.accountCanAccess(scope.approvedBy, ref.repo))
+        return { ok: false, why: `${scope.approvedBy}, who turned on automatic release approval, can no longer approve in this project` };
+    return { ok: true, by: scope.approvedBy, at: scope.approvedAt, evidence };
+}
+/** A release's approval: a person's (personApprovalOf, unchanged), or the plane's own `auto-green`. Only release
+ * readers ask this (liveReleaseOf, and the deploy gates inside `toolroll release`); everything else asks for a person. */
+export function releaseApprovalOf(store, taskId, _now = new Date()) {
+    const person = personApprovalOf(store, taskId);
+    if (person.ok)
+        return person;
+    if (store.getScope(taskId)?.approvalBasis !== "auto-green")
+        return person;
+    const auto = autoReleaseApprovalOf(store, taskId, "auto-green");
+    return auto.ok ? { ok: true, by: auto.by, at: auto.at, method: "auto-green" } : auto;
+}

package/dist/scout.js

@@ -18,6 +18,7 @@ import { mkdtempSync, realpathSync, rmSync, unlinkSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import { dirname, join, relative, isAbsolute } from "node:path";
 import { run } from "./exec.js";
+import { checkoutGit } from "./teardown-git.js";
 import { auditOf } from "./provider.js";
 import { currentClaim, heartbeat } from "./claim.js";
 import { heartbeat as runnerHeartbeat } from "./runner.js";
@@ -225,7 +226,10 @@ export async function scout(store, request) {
     }
 }
 async function scoutWith(store, request, outputDir) {
-    const { taskId, taskRef, runner, worktree, branch, now, agent, git = run, timeoutMs = DEFAULT_SCOUT_TIMEOUT_MS, maxTurns = DEFAULT_SCOUT_TURNS, } = request;
+    const { taskId, taskRef, runner, worktree, branch, now, agent, git: givenGit = run, timeoutMs = DEFAULT_SCOUT_TIMEOUT_MS, maxTurns = DEFAULT_SCOUT_TURNS, } = request;
+    // The plane's git on the scout's checkout (agent-written, and its repository shared with every build) runs hardened, against
+    // a frozen view of the repository's config and info (teardown-git.ts checkoutGit); an injected runner is used as given.
+    const git = givenGit === run ? checkoutGit(run, "build", { repo: store.getWorktree(worktree)?.repo ?? null }) : givenGit;
     const claim = currentClaim(store, taskRef, now);
     if (claim === null || claim.runner !== runner || claim.leaseId !== request.leaseId) {
         return { ok: false, kind: "failure", reason: "not-yours", message: `${taskId} is not held under ${request.leaseId}` };

package/dist/secret-mint.d.ts

@@ -0,0 +1 @@
+export declare function mintSecret(bytes: number, draw?: (size: number) => Buffer): string;

package/dist/secret-mint.js

@@ -0,0 +1,14 @@
+/**
+ * Secrets a person types or pastes on a command line (passwords, invite and approver tokens, runner credentials):
+ * random base64url, never starting with "-". A value starting with "--" reads as a flag to many parsers (`--token
+ * --abc…` was refused as a missing value: about 1 in 4096 minted passwords), so it is drawn again. The CLI accepts one
+ * anyway (an older secret), but a new one never needs that.
+ */
+import { randomBytes } from "node:crypto";
+export function mintSecret(bytes, draw = randomBytes) {
+    for (;;) {
+        const secret = draw(bytes).toString("base64url");
+        if (!secret.startsWith("-"))
+            return secret;
+    }
+}

package/dist/serve.js

@@ -14,19 +14,15 @@ import { signInsUnavailableWords } from "./check-access.js";
 import { LIVE_VIEW_CONSENT, liveCommandsShown, liveViewConsentDigest } from "./live-detail.js";
 import { html, htmlString, jsonScript, textHtml } from "./html.js";
 import { browserAssetsAvailable, browserWorkspaceDocument } from './browser-shell.js';
-import { NO_COUNTS, projectStates, STATE_WORDS } from './agent-state.js';
+import { accessKey, countsKey, indexKey, projectSummaryOf, RevisionCache, summaryKey } from './console-chrome.js';
 import { usageChipOf } from './limits-ui.js';
-/** Tasks the rail lists under a project; the rest are a count that links to the project's tasks. */
-const RAIL_TASKS = 6;
 /** Any header a proxy adds: a request carrying one is never "from this computer" (password freshness, one-time links). */
 const PROXY_HEADER = /^(forwarded|via|x-forwarded-.+|x-real-ip|x-client-ip|x-original-.+|x-cluster-client-ip|true-client-ip|cf-connecting-ip|fastly-client-ip|x-proxyuser-ip)$/i;
-/** Asks a project names for the chime (its count is complete beyond them). */
-const ASKS_PER_PROJECT = 100;
 /** How often the background checks look at what is due (docs/plans/get-side-effects.md), and how often this
  * computer's agent sign-ins are asked again. */
 const BACKGROUND_CHECKS_MS = 30_000;
 const LOCAL_AGENTS_EVERY_MS = 2 * 60_000;
-import { boundProjectSummary, browserCrewFromIndex, browserCrewOf, browserNavigationOf, browserProjectsOf, needsYouLabelOf } from './browser-workspace.js';
+import { browserCrewFromIndex, browserCrewOf, browserNavigationOf, browserProjectsOf, needsYouLabelOf } from './browser-workspace.js';
 import { sharedActionPayload } from './chat-actions.js';
 import { prepareCodingContext } from './coding-context.js';
 import { CodingWorkspace } from './coding-workspace.js';
@@ -255,6 +251,9 @@ export function createDecisionServer(options) {
         };
     };
     const workspaceRevision = prepareWorkspaceRevision(store);
+    // The sidebar, the Tasks count and the crew: read at most once per workspace revision per reader's exact access
+    // (console-chrome.ts), and filled from a read worker before a page renders when one is attached.
+    const chromeReads = new RevisionCache(workspaceRevision, clock);
     const workspaceIncarnation = randomBytes(16).toString('hex');
     const workspaceValidators = new WorkspaceValidatorCache();
     const providerHome = options.connectionHome ?? homedir();
@@ -881,6 +880,8 @@ export function createDecisionServer(options) {
                 get fresh() { return freshFacts.getStore() != null && ssoNowAvailable(who.name); } } : undefined,
             refusal: (answer, status, body) => sendScreen(answer, status, screen(status === 404 ? "Not found" : "Request refused", body, { chrome: chromeFor(who.via === "cookie" ? who.session.project : null, "work") })),
             workspaceRead,
+            freshWork: ["request", "task", "result"].some(name => url.searchParams.has(name)),
+            ...(workspaceRead && typeof request.headers['if-none-match'] === 'string' ? { workspaceIfNoneMatch: request.headers['if-none-match'] } : {}),
             workspaceRequest: url.searchParams.get('request'),
         };
         if (method === "GET" || method === "POST")
@@ -935,6 +936,16 @@ export function createDecisionServer(options) {
                             facts.workspaceValidator = { key, revision, expiresAt,
                                 etag: '"' + createHash('sha256').update(`${key}:${revision}:${expiresAt}`).digest('hex') + '"' };
                         }
+                        await prefetchChrome(route, url, who);
+                        // The worker wait lets a sign-out, credential/access change or console ceiling change land. Prove the
+                        // cookie and route again before rendering protected content or answering with a content validator.
+                        if (who.via === 'cookie') {
+                            const current = identify(request, false);
+                            if (current?.via !== 'cookie' || current.session !== who.session)
+                                return redirect(response, loginHref(url.pathname + url.search));
+                            if (!projectRequestAllowed(route, route.project, url, who, request, response, null))
+                                return;
+                        }
                         return handleGet(route, url, who, request, response);
                     }
                     return handlePost(route, url, who, request, response, body);
@@ -1480,7 +1491,10 @@ export function createDecisionServer(options) {
                 const project = s.chrome.active === 'chat' ? null : s.chrome.project;
                 crew = extras.team?.tasks ? browserCrewFromIndex(extras.team.tasks, extras.team.selected?.id) : requestFacts.workCrew?.project === project ? browserCrewFromIndex(requestFacts.workCrew.page)
                     // The reader's own lead's claims read "<name> is on it" here too.
-                    : browserCrewOf(store, clock(), { principal: 'operator', repos: managedRepos(), includeUnplaced: false, viewer: requestFacts.actor ?? null }, { evidenceRoot, project });
+                    : (() => {
+                        const access = { principal: 'operator', repos: managedRepos(), includeUnplaced: false, viewer: requestFacts.actor ?? null };
+                        return chromeRead(`crew\u0000${accessKey(access)}\u0000${project ?? ''}`, () => browserCrewOf(store, clock(), access, { evidenceRoot, project }));
+                    })();
             }
             catch {
                 notices.push('Crew updates are unavailable. Open Tasks to inspect saved work.');
@@ -1586,7 +1600,17 @@ export function createDecisionServer(options) {
                     workspaceValidators.set(validator.key, validator);
                     response.setHeader('ETag', validator.etag);
                 }
-                return respond(response, status, 'application/json; charset=utf-8', JSON.stringify(workspace));
+                const body = JSON.stringify(workspace);
+                // Every other page's re-read after a live `change` (chat keeps its own validator, and its receipt, task and
+                // result reads none): when what it renders now is exactly what the page holds, it hears 304 and keeps its view
+                // (no transfer, no re-render).
+                if (status === 200 && validator === undefined && path.pathname !== '/chat') {
+                    const etag = '"w' + createHash('sha256').update(body).digest('base64url') + '"';
+                    response.setHeader('ETag', etag);
+                    if (requestFacts.workspaceIfNoneMatch === etag)
+                        return respond(response, 304, 'application/json; charset=utf-8', '');
+                }
+                return respond(response, status, 'application/json; charset=utf-8', body);
             }
             const nonce = randomBytes(16).toString('base64');
             // React owns the conversation and its refresh/draft lifecycle. Native
@@ -1623,8 +1647,9 @@ export function createDecisionServer(options) {
         return page(response, status, document, nonce, s.functional?.fetches === true || chromeLayer || sensitiveChrome !== "");
     }
     /** The needs-you count every surface wears, read from this request's own
-     * Work counts (one query per request, never a cached earlier one), so a
-     * live page's badge and its Needs you tab always agree. */
+     * Work counts (one read per request, kept only while the workspace revision
+     * it was read at stands), so a live page's badge and its Needs you tab
+     * always agree. */
     function needsYouBadge(project) {
         return needsYouCount(project);
     }
@@ -1653,44 +1678,8 @@ export function createDecisionServer(options) {
     function projectSummary() {
         const projects = sidebarProjects();
         const actor = requestContext.getStore()?.actor ?? '';
-        const states = new Map(projectStates(store, workAccess(), actor, clock(), evidenceRoot, projects.map(one => one.path)).map(one => [one.repo, one]));
-        // A row that needs a person or failed says what the Tasks list says it needs (its own next step); a row at work says
-        // what its agent did last; a finished one says Done.
-        const asking = [...states.values()].flatMap(one => one.families.slice(0, RAIL_TASKS)).filter(one => one.state === 'needs-you' || one.state === 'failed').map(one => one.rootId);
-        const needWords = new Map();
-        if (asking.length > 0) {
-            try {
-                // Every row the rail may list, in pages the index allows.
-                for (let at = 0; at < asking.length; at += WORK_INDEX_MAX_LIMIT)
-                    for (const item of workIndexPage(store, clock(), workAccess(), { roots: asking.slice(at, at + WORK_INDEX_MAX_LIMIT), limit: WORK_INDEX_MAX_LIMIT, root: evidenceRoot }).items)
-                        needWords.set(item.rootId, item.status.detail !== '' ? item.status.detail : item.status.label);
-            }
-            catch { /* the rows keep their state's words */ }
-        }
-        // The chime's subjects: an opaque key per obligation and version, scoped to this reader (no words, no ids in it).
-        const keyOf = (...parts) => createHash('sha256').update([actor, ...parts].join('\u0000')).digest('base64url').slice(0, 22);
-        // Newest first, so a new ask always has a key however many older ones wait (those were heard when they were new).
-        const asksOf = (state) => [
-            ...(state?.families ?? []).flatMap(one => one.ask === undefined ? [] : [{ at: one.ask.at, ask: { key: keyOf('task', one.rootId, one.ask.version), task: one.rootId, run: one.ask.run, at: one.ask.at } }]),
-            ...(state?.flowAsks ?? []).map(one => ({ at: one.at, ask: { key: keyOf('flow', one.card, one.stage, one.entry), task: null, run: null, at: one.at } })),
-        ].sort((a, b) => b.at.localeCompare(a.at)).slice(0, ASKS_PER_PROJECT).map(one => one.ask);
-        const railOf = (state) => {
-            const families = state?.families ?? [];
-            const tasks = families.slice(0, RAIL_TASKS).flatMap((one) => {
-                const task = store.getTask(one.rootId);
-                const line = one.state === 'needs-you' || one.state === 'failed' ? needWords.get(one.rootId) ?? null : one.line;
-                return task === null ? [] : [{ id: one.rootId, title: task.title, href: `/t/${encodeURIComponent(one.rootId)}`, state: one.state, line: line ?? STATE_WORDS[one.state] }];
-            });
-            return { tasks, more: Math.max(0, families.length - RAIL_TASKS), asks: asksOf(state) };
-        };
-        const rows = projects.map(one => {
-            const state = states.get(one.path);
-            return { path: one.path, name: one.name, href: `/work?project=${encodeURIComponent(one.path)}`, state: state?.state ?? 'idle', counts: state?.counts ?? { ...NO_COUNTS }, ...railOf(state) };
-        });
-        const unplaced = states.get(null);
-        if (unplaced !== undefined && unplaced.state !== 'idle')
-            rows.push({ path: null, name: 'No project', href: '/work', state: unplaced.state, counts: unplaced.counts, ...railOf(unplaced) });
-        return boundProjectSummary(rows);
+        const access = workAccess();
+        return chromeRead(summaryKey(actor, access, projects), () => projectSummaryOf(store, clock(), access, actor, projects, evidenceRoot));
     }
     /** What one account may see now, as the summary room keys it: a narrowed ceiling or grant is a different key, so a
      * snapshot read for the wider scope never reaches it. Null: no such account. */
@@ -1777,13 +1766,15 @@ export function createDecisionServer(options) {
             ...(scope === undefined ? {} : { scope }),
         };
     }
-    // All project counts are read together. No task artifacts or processes are
-    // inspected to paint a badge or a project switcher.
+    // All project counts are read together, at most once per workspace revision
+    // for this reader's access. No task artifacts or processes are inspected to
+    // paint a badge or a project switcher.
     function projectCounts(now) {
         const facts = requestContext.getStore();
         if (facts?.workCounts !== undefined)
             return facts.workCounts;
-        const counts = workCountsByProject(store, now, workAccess());
+        const access = workAccess();
+        const counts = chromeRead(countsKey(access), () => workCountsByProject(store, now, access));
         if (facts !== undefined)
             facts.workCounts = counts;
         return counts;
@@ -1793,6 +1784,64 @@ export function createDecisionServer(options) {
             .reduce((sum, one) => sum + one.totals['needs-you'], 0);
         return { count, saturated: false };
     }
+    /** One work index page for an already-admitted reader, through the chrome cache: a whole view the chat landing reads
+     * on every refresh. */
+    function sharedIndexPage(access, options) {
+        // Receipt reconciliation, task and result reads always read work afresh (disk state included).
+        if (requestContext.getStore()?.freshWork === true)
+            return workIndexPage(store, clock(), access, options);
+        return chromeRead(indexKey(access, options), () => workIndexPage(store, clock(), access, options));
+    }
+    /** A chrome read for this request: what it already read (its prefetch included) stands for the whole request, else
+     * the revision cache's value, else `compute()` now. */
+    function chromeRead(key, compute) {
+        const facts = requestContext.getStore();
+        const held = facts?.chromeReads?.get(key);
+        if (held !== undefined)
+            return held;
+        const value = chromeReads.read(key, compute);
+        if (facts !== undefined)
+            (facts.chromeReads ??= new Map()).set(key, value);
+        return value;
+    }
+    /** The chat landing's three whole views (chat.ts chatHomeOf), as it asks for them. */
+    const chatHomeViews = () => ["all", "needs-you", "completed"]
+        .map(view => ({ view, limit: WORK_INDEX_MAX_LIMIT, ...(evidenceRoot === undefined ? {} : { root: evidenceRoot }) }));
+    /** Pages that wear the chrome (the sidebar's states and the Tasks count). */
+    const CHROME_PAGES = new Set(["home", "work", "board", "agents", "agents.live", "task.page", "run.page", "chat.page", "review", "tasks", "inbox",
+        "next", "done", "projects.page", "flows.page", "flow.page", "settings.page", "decision.page", "menu"]);
+    /** Before a chromed page renders: its chrome reads (and the chat landing's views) run on a read worker, so the
+     * request thread finds them cached instead of computing them. The reader is the one this request admitted; the keys
+     * carry its exact access (console-chrome.ts). Without a worker, or when one fails, the page computes them as before. */
+    async function prefetchChrome(route, url, who) {
+        if (reads === null || who.via !== "cookie" || !CHROME_PAGES.has(route.id))
+            return;
+        try {
+            const actor = requestContext.getStore()?.actor ?? "";
+            const access = workAccess(), projects = sidebarProjects(), now = clock();
+            // Populate only the revision cache. Each answer must still pass its revision/expiry check when rendering:
+            // another job can remain pending while an earlier answer's approval or Needs-you state changes.
+            const fill = async (key, read) => { await chromeReads.fill(key, read); };
+            const jobs = [
+                fill(countsKey(access), () => reads.workCounts(now, access)),
+                fill(summaryKey(actor, access, projects), () => reads.projectSummary(now, access, actor, projects, evidenceRoot)),
+            ];
+            if (route.id === "chat.page") {
+                if (!["project", "room", "team"].some(name => url.searchParams.has(name)) && requestContext.getStore()?.freshWork !== true)
+                    for (const options of chatHomeViews())
+                        jobs.push(fill(indexKey(access, options), () => reads.workIndexPage(now, access, options)));
+                // The conversation's briefing (chat.ts: the fleet snapshot's states), read as chat reads it.
+                const repos = managedRepos();
+                if (repos.length > 0 && requestContext.getStore()?.freshWork !== true) {
+                    const fleet = { principal: "operator", repos, includeUnplaced: false, viewer: who.name };
+                    const options = { limit: 100, ...(evidenceRoot === undefined ? {} : { root: evidenceRoot }) };
+                    jobs.push(fill(indexKey(fleet, options), () => reads.workIndexPage(now, fleet, options)));
+                }
+            }
+            await Promise.all(jobs);
+        }
+        catch { /* the page computes what is missing */ }
+    }
     /** A live page's own beat without a docked chat: 10 s while any admitted task is building, else 30 s. */
     function liveRefreshSeconds() {
         return projectCounts(clock()).some(one => one.totals.running > 0) ? 10 : 30;
@@ -2073,6 +2122,7 @@ export function createDecisionServer(options) {
         get projectFamilyPeek() { return projectFamilyPeek; },
         get needsYouBadge() { return needsYouBadge; },
         get liveRefreshSeconds() { return liveRefreshSeconds; },
+        get sharedIndexPage() { return sharedIndexPage; },
         get chatKeyFor() { return chatKeyFor; },
         get chatCatalog() { return chatCatalog; },
         get chatCatalogKnown() { return chatCatalogKnown; },