toolroll 0.9.75 → 0.9.77

package/dist/up-role-child.js

@@ -0,0 +1,77 @@
+/**
+ * Started only by `toolroll up` (up-processes.ts): one of its two roles, the console or the worker, in a process of
+ * its own. It takes its whole start from the parent over the IPC channel (never from arguments or the environment, so
+ * the runner token is in no process listing), and stops when the parent says so or goes away.
+ */
+import { parentMessage, startMessage } from "./up-processes.js";
+if (process.send === undefined || !process.connected) {
+    process.stderr.write("This process is started by `toolroll up`; run `toolroll up` instead.\n");
+    process.exit(2);
+}
+// node:sqlite still says it is experimental; the CLI hushes exactly that notice, and so does a role.
+const emitWarning = process.emitWarning.bind(process);
+process.emitWarning = ((warning, ...rest) => {
+    const type = typeof rest[0] === "string" ? rest[0] : rest[0]?.type;
+    if (type === "ExperimentalWarning" && (warning instanceof Error ? warning.message : String(warning)).includes("SQLite"))
+        return;
+    emitWarning(warning, ...rest);
+});
+const handlers = [];
+const stops = [];
+let stopRequested = false;
+const stop = (hard) => {
+    stopRequested = true;
+    for (const one of stops)
+        one(hard);
+};
+const port = {
+    send: (message) => { if (process.connected) {
+        try {
+            process.send?.(message);
+        }
+        catch { /* the parent is gone; its loss stops this role */ }
+    } },
+    onMessage: handler => { handlers.push(handler); },
+    onStop: handler => { stops.push(handler); if (stopRequested)
+        handler(false); },
+};
+// A terminal's Ctrl-C reaches the whole process group: the parent decides what a signal means (drain, then a hard
+// stop on the second), so a role never acts on SIGINT itself. SIGTERM (the supervisor's stop) drains, once.
+process.on("SIGINT", () => { });
+process.on("SIGTERM", () => stop(false));
+// The parent gone (its channel closed): drain, as a stop would. The worker's own grace timer bounds it.
+process.once("disconnect", () => stop(false));
+const start = await new Promise(resolve => {
+    const timer = setTimeout(() => resolve(null), 60_000);
+    process.once("message", value => { clearTimeout(timer); resolve(value); });
+});
+const checked = startMessage(start);
+// The role named on the command line (for a process listing) and the one started must be the same.
+if (checked === null || checked.role !== process.argv[2]) {
+    process.stderr.write("The start message from `toolroll up` was not understood.\n");
+    process.exit(2);
+}
+process.on("message", value => {
+    const message = parentMessage(value);
+    if (message === null)
+        return;
+    if (message.type === "hard-stop") {
+        stop(true);
+        return;
+    }
+    for (const one of handlers)
+        one(message);
+});
+const { runUpRole } = await import("./operate.js");
+let code = 1;
+try {
+    code = await runUpRole(checked, port);
+}
+catch (error) {
+    port.send({ type: "fatal", detail: error instanceof Error ? error.message : String(error) });
+}
+// Everything this role owned is closed; leave promptly even if a stray handle lingers.
+if (process.connected)
+    process.disconnect?.();
+setTimeout(() => process.exit(code), 200).unref();
+process.exitCode = code;

package/dist/verification-evidence.d.ts

@@ -13,6 +13,7 @@ export type ReleaseCheckFacts = {
         report: string | null;
         inventory: string | null;
         exitCode?: number | null;
+        retried?: string[] | null;
     };
     composed: ComposedLinks | null;
 };

package/dist/verification-evidence.js

@@ -29,7 +29,10 @@ export function effectiveCheckFacts(raw, facts) {
     if (facts === null || coveragePasses(facts.coverage))
         return { result: raw, facts };
     const exitCode = raw.configured && raw.ran ? raw.exitCode : null;
-    return { result: { configured: true, ran: false, attemptFailed: true, failure: "coverage-incomplete" }, facts: { ...facts, check: { ...facts.check, exitCode } } };
+    // A check that stopped before it could report keeps its own failure (it timed out, Toolroll stopped it): that is why.
+    if (facts.coverage === "no-result" && raw.configured && !raw.ran)
+        return { result: raw, facts };
+    return { result: { configured: true, ran: false, attemptFailed: true, failure: facts.coverage === "no-result" ? "no-result" : "coverage-incomplete" }, facts: { ...facts, check: { ...facts.check, exitCode } } };
 }
 export function sealVerificationReceipt(store, root, runId, head, command, result, now, reusedFrom, release) {
     const source = store.getRun(runId);
@@ -142,6 +145,15 @@ export function verificationEvidence(store, root, runId) {
             const sha = (capture) => { const found = artifacts.filter(a => a.kind === "structured-output" && a.capture === capture); return found.length === 1 ? found[0].sha256 : null; };
             if (sha(CHECK_REPORT_CAPTURE) !== checked.check.report || sha(CHECK_INVENTORY_CAPTURE) !== checked.check.inventory)
                 return fail("The release check's sealed report or inventory changed.");
+            // Their bytes too, not only their records (eval-harness review 1, finding 3): a report or inventory the receipt
+            // names that is missing, cut short or changed on disk no longer verifies.
+            for (const capture of [CHECK_REPORT_CAPTURE, CHECK_INVENTORY_CAPTURE]) {
+                const one = artifacts.find(a => a.kind === "structured-output" && a.capture === capture);
+                if (one === undefined)
+                    continue;
+                if (one.truncated || one.redacted || one.captureStatus !== "ok" || !readVerifiedArtifact(root, one).ok)
+                    return fail("The release check's sealed report or inventory no longer verifies.");
+            }
             if ((checked.coverage === "composed") !== (checked.composed !== undefined))
                 return fail("The release check's coverage and its links disagree.");
             // A check that didn't cover what it owed can never read as a pass.

package/dist/worktree.d.ts

@@ -152,6 +152,10 @@ export declare class WorktreePool {
     private readonly store;
     private readonly options;
     private readonly runner;
+    /** The pool's own git in a project's repository and its checkouts (making, moving and reading them): hardened against
+     * a frozen view of the repository's config and info (teardown-git.ts checkoutGit), which agents can write. An injected
+     * runner (tests' stubbed git) is used as given. */
+    private readonly hardened;
     /** Carried to the independent storage sweep process. */
     get root(): string;
     constructor(store: Store, options: PoolOptions);

package/dist/worktree.js

@@ -32,7 +32,7 @@ import { HANDOFF_PREFIX, MAILBOX_SUFFIX, looksLikeProtocolFile, readMailbox } fr
 import { parseHandoff } from "./decision.js";
 import { diskBytes } from "./storage.js";
 import { markNeverIndex } from "./never-index.js";
-import { teardownGit } from "./teardown-git.js";
+import { checkoutGit, teardownGit } from "./teardown-git.js";
 /**
  * The note a lease leaves in the checkout, naming the process holding it.
  *
@@ -268,12 +268,18 @@ export class WorktreePool {
     store;
     options;
     runner;
+    /** The pool's own git in a project's repository and its checkouts (making, moving and reading them): hardened against
+     * a frozen view of the repository's config and info (teardown-git.ts checkoutGit), which agents can write. An injected
+     * runner (tests' stubbed git) is used as given. */
+    hardened;
     /** Carried to the independent storage sweep process. */
     get root() { return this.options.root; }
     constructor(store, options) {
         this.store = store;
         this.options = options;
         this.runner = options.runner ?? run;
+        // Bound to the project's repository from the pool's own request or record (teardown-git.ts GitBinding).
+        this.hardened = repo => this.runner === run ? checkoutGit(run, "build", { repo }) : this.runner;
     }
     /**
      * Take a working copy for this branch.
@@ -475,7 +481,7 @@ export class WorktreePool {
         // checkout between the inspection and the move.
         let base;
         if (request.freshBase !== undefined && request.taskRef !== undefined) {
-            const fresh = await this.freshen(path, request.branch, request.taskRef, request.freshBase, request.now);
+            const fresh = await this.freshen(request.repo, path, request.branch, request.taskRef, request.freshBase, request.now);
             if (!fresh.ok)
                 return { ok: false, reason: "git", message: fresh.message };
             base = fresh.standing;
@@ -524,9 +530,9 @@ export class WorktreePool {
      * untracked. The move is `git reset --keep`, which refuses rather than overwrite anything; HEAD and the tree are read
      * again right before and after it, and any surprise fails the lease with the checkout left for a person.
      */
-    async freshen(path, branch, taskRef, fresh, now) {
+    async freshen(repo, path, branch, taskRef, fresh, now) {
         const read = async (args) => {
-            const out = await this.runner(GIT, [...READ_ONLY, ...args], { cwd: path, timeoutMs: WORKTREE_TIMEOUT_MS });
+            const out = await this.hardened(repo)(GIT, [...READ_ONLY, ...args], { cwd: path, timeoutMs: WORKTREE_TIMEOUT_MS });
             return out.code === 0 ? out.stdout.trim() : null;
         };
         const main = await read(["rev-parse", "--verify", "--quiet", `${fresh.main}^{commit}`]);
@@ -544,14 +550,14 @@ export class WorktreePool {
             return stay("not on its branch");
         if (fresh.recordedBase !== null && fresh.recordedBase !== head)
             return stay("has commits");
-        const contained = await this.runner(GIT, [...READ_ONLY, "merge-base", "--is-ancestor", head, main], { cwd: path, timeoutMs: WORKTREE_TIMEOUT_MS });
+        const contained = await this.hardened(repo)(GIT, [...READ_ONLY, "merge-base", "--is-ancestor", head, main], { cwd: path, timeoutMs: WORKTREE_TIMEOUT_MS });
         if (contained.code !== 0)
             return stay("has commits");
         if (await this.isDirty(path) !== false)
             return stay("has changes");
         // Recorded before git moves it: a move that then fails leaves the next attempt's own base as the branch's origin.
         this.store.recordBranchBaseMove(taskRef, branch, head, main, now);
-        const moved = await this.runner(GIT, ["reset", "--keep", main], { cwd: path, timeoutMs: WORKTREE_TIMEOUT_MS });
+        const moved = await this.hardened(repo)(GIT, ["reset", "--keep", main], { cwd: path, timeoutMs: WORKTREE_TIMEOUT_MS });
         const after = await read(["rev-parse", "--verify", "--quiet", "HEAD^{commit}"]);
         const branchNow = await read(["rev-parse", "--verify", "--quiet", `refs/heads/${branch}^{commit}`]);
         if (moved.code !== 0 || after !== main || branchNow !== main || await this.isDirty(path) !== false) {
@@ -1052,7 +1058,7 @@ export class WorktreePool {
     /** All disposal and inspection paths share the hardened teardown boundary. */
     teardown = (cwd, args) => teardownGit(this.runner)(cwd, args);
     git(cwd, args, prefix = []) {
-        return this.runner(GIT, [...prefix, ...args], { cwd, timeoutMs: WORKTREE_TIMEOUT_MS });
+        return this.hardened(cwd)(GIT, [...prefix, ...args], { cwd, timeoutMs: WORKTREE_TIMEOUT_MS });
     }
 }
 function firstLine(text) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolroll",
-  "version": "0.9.75",
+  "version": "0.9.77",
   "description": "A control plane for unattended coding agents — queue tasks, walk away, come back to pull requests. Agents build in leased worktrees, never touch your default branch, and interrupt you only for decisions that need a human.",
   "directories": {
     "doc": "docs"
@@ -11,6 +11,7 @@
     "test:slow": "vitest run .slow.test",
     "test:all": "vitest run",
     "test:attacks": "vitest run --config test/attacks/vitest.config.ts",
+    "test:git": "vitest run test/attacks/checkout-git- test/attacks/fence-git-views test/attacks/repository-context-git test/attacks/discover-dirty src/teardown-git.test.ts src/worktree.slow.test.ts",
     "check:quick": "node scripts/quick-check.mjs",
     "dev": "tsx src/cli.ts",
     "typecheck": "tsc --noEmit && tsc -p tsconfig.browser.json",