toolroll 0.9.76 → 0.9.77

package/dist/store.js

@@ -1,3 +1,4 @@
+import { mintSecret } from "./secret-mint.js";
 import { WRITES_DEFAULT } from "./writes-mode.js";
 import { checkAccessOf, widerThan } from "./check-access.js";
 import { PROJECT_SANDBOX_DEFAULT, sandboxOf } from "./project-sandbox.js";
@@ -72,6 +73,7 @@ import { hasDisguisedText, hasForbiddenControls, validateNote } from "./decision
 import { parseReviewContext, reviewContextCustodyProblem } from "./review-context.js";
 import { foldReview, manualReviewOnly } from "./proof.js";
 import { liveReleaseOf } from "./scope.js";
+import { releaseCiHoldOf, releaseCiRunningOf } from "./release-ci-hold.js";
 import { APPROVAL_BASES, approvalOf, machineActing, personProof, proofDetailOf, quarantinedAuthor, sealOriginOf, digestOf, canonicalProfileJson, chainFromJson, profileDigestOf, profileFromJson, scopeAuthorityOf, routeParityProblem, parseAcceptanceCriteria, exactAcceptance, exactStringList, exactSafeIntegerOrNull } from "./scope.js";
 import { resolveScopeProfile, resolveRouteCandidates, exactPinOf, routeOfTask, agentChoicesFor } from "./agentconfig.js";
 import { canonicalOverridesJson, canonicalRouteJson, isRiskLevel, isTaskSize, headroomFrom, makesNoPlan, legOf, overridesFromJson, phaseOfRole, recommendRoute, routeDigestOf, routeFromJson, routeProblems, routeStampProblem, ROUTE_ERA, PROVIDER_ID_LIST, } from "./phase-routing.js";
@@ -6932,6 +6934,10 @@ export class Store {
             // road it came by.
             if (basis === undefined && machineActing())
                 return false;
+            // A RELEASE WAITING FOR CI (Codex review round 1, finding 4): filed while its pull request's checks still ran,
+            // only the automatic road (which proves CI itself) seals it until the plane read exact-head CI passing.
+            if (basis?.kind !== "auto-check" && basis?.kind !== "auto-green" && releaseCiHoldOf(this, taskId) !== null)
+                return false;
             // `carried` is written by the carry transaction alone (carryReleaseApproval), never through a seal.
             if (basis?.kind === "carried")
                 return false;
@@ -8018,7 +8024,7 @@ export class Store {
     /** A single-use door into the instance (U2): 128-bit token, sha256
      * stored, role pinned at mint, 72 hours. Only the caller's own
      * authentication gates this — an approver mints; a viewer cannot. */
-    mintInvite(role, mintedBy, now, token = () => randomBytes(16).toString("base64url"), projects = null) {
+    mintInvite(role, mintedBy, now, token = () => mintSecret(16), projects = null) {
         const access = normalizeProjectAccess(projects);
         return this.transact(() => {
             if (!this.isInstanceOperator(mintedBy))
@@ -20507,6 +20513,9 @@ export function reserveRelease(store, input) {
         const a = releaseAuthority(store, input.authority);
         if (a === null)
             return { ok: false, why: `No release ${input.authority}.` };
+        // Early approval authorizes the check, never an irreversible operation before the plane confirms exact-head CI.
+        if (releaseCiRunningOf(store, input.taskId) !== null)
+            return { ok: false, why: "This release still waits for GitHub CI. Resume it with `toolroll release`." };
         const at = input.now.toISOString();
         // Expiry stops every live state; an operation already reserved settles only through reconciliation.
         if (a.expiresAt <= at)
@@ -20548,6 +20557,8 @@ export function runReleaseOperation(store, id, epoch, now, issuer = currentRelea
         const a = op === null ? null : releaseAuthority(store, op.authority);
         if (op === null || a === null || op.state !== "reserved" || op.epoch !== epoch || a.leaseEpoch !== epoch)
             return false;
+        if (releaseCiRunningOf(store, op.taskId) !== null)
+            return false;
         // Past the expiry nothing new starts; the reserved operation is settled by reconciliation instead.
         if (a.expiresAt <= now.toISOString())
             return false;
@@ -20858,3 +20869,16 @@ export function agentsLiveRuns(store, endedSince) {
         repo: row["live_task_repo"] === null || row["live_task_repo"] === undefined ? null : String(row["live_task_repo"]),
     }));
 }
+/**
+ * This runner's watches a predecessor left needing recovery (Codex review round 1, finding 2): a watch lease still
+ * live, or one whose holder left a claim open (or a run open under a claim a reaper already released). A replacement
+ * worker takes each over — recovering the holder's incarnation in the same transaction — before it admits new work,
+ * whichever projects its start names (a project being removed when the predecessor died is in none of them).
+ */
+export function predecessorWatches(store, runner, now) {
+    return store.handle.prepare(`SELECT w.repo AS repo, w.owner AS owner FROM watch_lease w
+      WHERE w.runner = ? AND (w.expires_at > ? OR EXISTS (
+        SELECT 1 FROM claim c WHERE c.runner = w.runner AND c.incarnation = w.owner
+          AND (c.released_at IS NULL OR EXISTS (SELECT 1 FROM run r WHERE r.lease_id = c.lease_id AND r.outcome IS NULL))))
+      ORDER BY w.repo`).all(runner, now.toISOString()).map(row => ({ repo: String(row["repo"]), owner: String(row["owner"]) }));
+}

package/dist/task-base.d.ts

@@ -33,3 +33,7 @@ export declare function freshBaseFor(store: Store, taskId: string, branch: strin
     };
 } | Record<string, never>;
 export declare function taskBaseOf(store: Store, taskId: string, git?: GitRead): TaskBaseView | null;
+/** `git`'s answers kept for `ttlMs` (at most `entries` of them), for a page that shows the base line on every refresh:
+ * each read still goes through the same frozen view when it runs; only its answer is reused for a moment. Display only —
+ * never for a decision. */
+export declare function recentGitReads(git?: GitRead, ttlMs?: number, entries?: number, now?: () => number): GitRead;

package/dist/task-base.js

@@ -4,10 +4,13 @@
  * branch's pinned origin, or the newest plan's base — and the behind count is
  * read from Git now. Reads only.
  */
-import { execFileSync } from "node:child_process";
+import { viewedGitSync } from "./teardown-git.js";
 export const readGit = (cwd, args) => {
     try {
-        return execFileSync("git", ["--no-optional-locks", "--no-lazy-fetch", "-c", "core.fsmonitor=false", "-c", "core.hooksPath=/dev/null", ...args], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 5_000, maxBuffer: 65_536 }).trim();
+        // Every git version through a frozen read view, bounded (eval-harness review 1, finding 7): a partial clone, an
+        // include or a command-naming key is refused from the config git then runs with.
+        const ran = viewedGitSync(cwd, args, { timeoutMs: 5_000, maxBuffer: 65_536 });
+        return ran.status === 0 ? ran.stdout.trim() : null;
     }
     catch {
         return null;
@@ -49,3 +52,20 @@ export function taskBaseOf(store, taskId, git = readGit) {
     const view = { base, branch, main: behind === null ? null : main, behind };
     return { ...view, words: `Base ${baseStandingWords(view)}` };
 }
+/** `git`'s answers kept for `ttlMs` (at most `entries` of them), for a page that shows the base line on every refresh:
+ * each read still goes through the same frozen view when it runs; only its answer is reused for a moment. Display only —
+ * never for a decision. */
+export function recentGitReads(git = readGit, ttlMs = 15_000, entries = 64, now = Date.now) {
+    const kept = new Map();
+    return (cwd, args) => {
+        const key = JSON.stringify([cwd, args]), at = now(), hit = kept.get(key);
+        if (hit !== undefined && at - hit.at < ttlMs && at >= hit.at)
+            return hit.value;
+        const value = git(cwd, args);
+        kept.delete(key);
+        if (kept.size >= entries)
+            kept.delete(kept.keys().next().value);
+        kept.set(key, { at, value });
+        return value;
+    };
+}

package/dist/teardown-git.d.ts

@@ -38,7 +38,7 @@ export declare function teardownGit(runner?: Runner, binding?: GitBinding): Git;
  * git at any file, a pipe that never ends among them. Each file is read only as the regular file it is, bounded; one
  * that can't be read so counts as including.
  */
-export declare function checkoutIncludes(checkout: string): boolean;
+export declare function checkoutIncludes(checkout: string, gitFile?: string): boolean;
 export type GitBinding = {
     repo?: string | null;
 };
@@ -50,7 +50,7 @@ export declare const WRITE_VIEW_FLAGS: readonly string[];
 /** Whether the checkout's .lfsconfig (read as git parses it, that file only) sets any git-lfs key that could name a
  * program (anything but INERT_LFS). A file that
  * isn't a plain one, or doesn't parse, counts as naming one. */
-export declare function lfsExtensionIn(checkout: string): boolean;
+export declare function lfsExtensionIn(checkout: string, gitFile?: string): boolean;
 /** Every command runs against a view of the checkout's repository (gitView) whose config and info are copies the
  * plane made, inspected there, so neither can change between the inspection and the run. `mode` "read" is for reading
  * a checkout an agent may still be writing (the code page): every command also takes readFlags(), and the view holds
@@ -69,7 +69,7 @@ export declare const PAGE_READ_FLAGS: readonly string[];
  * its config as it starts, so the flags alone don't stop a filter planted in both after the inspection: every read
  * also runs against a view of the checkout's repository (gitView; checkoutGitSync, checkoutGit "read"), whose config and info are the plane's. The cost is cosmetic: a checkout's line-ending or encoding rules are not applied, so
  * a file they would normalize can read as changed (fail closed: shipping then asks for a clean commit). */
-export declare function readFlags(): readonly string[];
+export declare function readFlags(gitFile?: string): readonly string[];
 /**
  * checkoutGit, synchronously, for reads a page shows from a checkout an agent writes (docs/plans/get-side-effects.md):
  * the same refusals (an include, an .lfsconfig extension, a config key that can run a command), no system or global
@@ -81,6 +81,30 @@ export declare function checkoutGitSync(cwd: string, args: readonly string[], op
     maxBuffer?: number;
     binding?: GitBinding;
 }): string;
+/**
+ * checkoutGitSync's run, answering git's exit status instead of throwing on a non-zero one (a refusal, or a repository
+ * that changed while git ran, still throws): for reads whose "no" is an exit code (`merge-base --is-ancestor`), and,
+ * with `buffer`, for blobs read as bytes (their output is never rewritten).
+ */
+export declare function viewedGitSync(cwd: string, args: readonly string[], options: {
+    timeoutMs?: number;
+    maxBuffer?: number;
+    binding?: GitBinding;
+}): {
+    status: number | null;
+    stdout: string;
+};
+export declare function viewedGitSync(cwd: string, args: readonly string[], options: {
+    timeoutMs?: number;
+    maxBuffer?: number;
+    binding?: GitBinding;
+    buffer: true;
+    input?: Buffer;
+    git?: string;
+}): {
+    status: number | null;
+    stdout: Buffer;
+};
 /**
  * checkoutGit ("build": the repository written through its view) for callers that name the repository with a leading
  * `git -C <dir>` instead of a cwd: worktree add and remove in a project's repository, a merge in a checkout of it.
@@ -88,3 +112,28 @@ export declare function checkoutGitSync(cwd: string, args: readonly string[], op
  * what they name. Anything but git goes to `inner` as given.
  */
 export declare function hardenedGit(inner?: Runner, mode?: "build" | "read", binding?: GitBinding): Runner;
+/** Asked once per git executable (eval-harness review 2, follow-up): a fixed git given to viewedGitSync is probed
+ * itself, never answered for by the one PATH names. */
+export declare function lazyFetchSupported(gitFile?: string): boolean;
+/** For tests: forget the probes' answers, or set one for every executable (null forgets). */
+export declare function setLazyFetchSupportedForTest(value: boolean | null): void;
+/** The words for a partial clone refused on a git without `--no-lazy-fetch`. */
+export declare const PARTIAL_CLONE_REFUSAL = "this project is a partial clone; protected reads need git 2.45 or newer";
+/** `--no-lazy-fetch` where the installed git has it, else nothing (and lazyFetchSetting refuses partial clones). */
+export declare function noLazyFetch(): readonly string[];
+/**
+ * The repository setting (local or worktree scope of a `git config --list --show-scope -z` listing) that makes lazy
+ * fetching possible, or null: `extensions.partialClone` set at all, any `remote.<name>.promisor` not plainly false, or
+ * any `remote.<name>.partialCloneFilter` set (git makes that remote a promisor). Fails closed: a listing that can't be
+ * read names a setting. `remote.<name>.vcs` (a foreign-VCS helper) is named too, though the classifier already refuses
+ * it (commandSetting: not in the remote allowlist), as it does every `protocol.*` key and every include.
+ */
+export declare function lazyFetchSetting(listing: string): string | null;
+/**
+ * For the reads that run git directly on a repository rather than through a view: with `--no-lazy-fetch` they run as
+ * they always have (the flag stops any fetch). Without it, they must not check a repository's config and then run git
+ * on it (the config could change in between, or an include could set what the check never saw): `inner`, wrapped so
+ * every git command runs through a frozen read view (checkoutGit "read"), whose own config listing (includes refused,
+ * command and protocol settings refused, a partial clone refused) is the config git then runs with.
+ */
+export declare function lazyFetchSafeGit(inner?: Runner): Runner;

package/dist/teardown-git.js

@@ -11,12 +11,12 @@
  * nothing is removed.
  */
 import { spawnSync } from "node:child_process";
-import { closeSync, constants as fsConstants, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readdirSync, readFileSync, realpathSync, renameSync, rmSync, symlinkSync, writeFileSync, writeSync } from "node:fs";
+import { accessSync, closeSync, constants as fsConstants, existsSync, fstatSync, lstatSync, mkdirSync, mkdtempSync, openSync, readdirSync, readFileSync, realpathSync, renameSync, rmSync, symlinkSync, writeFileSync, writeSync } from "node:fs";
 import { randomBytes } from "node:crypto";
 import { homedir } from "node:os";
 import { ensureGitViewsRoot, withCheckoutLock } from "./git-views.js";
 import { gitIncident } from "./git-incident.js";
-import { basename, dirname, join, resolve } from "node:path";
+import { basename, delimiter, dirname, isAbsolute, join, resolve } from "node:path";
 import { run } from "./exec.js";
 import { ENV, ENV_ALLOWLIST } from "./remote-main.js";
 import { WORKTREE_TIMEOUT_MS } from "./worktree.js";
@@ -304,29 +304,37 @@ export function teardownGit(runner = run, binding = {}) {
  * git at any file, a pipe that never ends among them. Each file is read only as the regular file it is, bounded; one
  * that can't be read so counts as including.
  */
-export function checkoutIncludes(checkout) {
+export function checkoutIncludes(checkout, gitFile = "git") {
     const dirs = gitDirsOf(checkout);
     if (dirs === null)
         return true;
     for (const path of [join(dirs.common, "config"), join(dirs.gitdir, "config.worktree")]) {
         if (!existsSync(path) && path.endsWith("config.worktree"))
             continue;
-        if (configIncludes(path))
+        if (includeIn(path, gitFile) !== null)
             return true;
     }
     return false;
 }
 /** One config file, read only as the regular file it is (bounded), or null. */
 function regularFile(path) {
+    // Opened without following a link and without blocking, then judged by what was opened: a FIFO swapped in after a
+    // look never hangs the read (eval-harness review 1, finding 7).
+    let fd = null;
     try {
-        const held = lstatSync(path);
+        fd = openSync(path, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW | fsConstants.O_NONBLOCK);
+        const held = fstatSync(fd);
         if (!held.isFile() || held.size > 1024 * 1024)
             return null;
-        return readFileSync(path, "utf8");
+        return readFileSync(fd, "utf8");
     }
     catch {
         return null;
     }
+    finally {
+        if (fd !== null)
+            closeSync(fd);
+    }
 }
 /** A checkout's git directory and common directory, as git finds them from its `.git` (a folder, or a one-line
  * `gitdir: ` file); null when the pointer isn't one git would read the same way. */
@@ -350,18 +358,13 @@ function gitDirsOf(checkout) {
     const named = regularFile(join(gitdir, "commondir"))?.trim();
     return { gitdir, common: named === undefined || named === "" ? gitdir : resolve(gitdir, named) };
 }
-/** Whether one config file includes another (or can't be read as a plain file): by a plain reading, and as git itself
- * parses it, includes not followed (only this one regular file, from a neutral folder, with no other config read). */
-function configIncludes(path) {
-    return includeIn(path) !== null;
-}
 /** The include key one config file sets (lowercased, as git names it), "include" when only a plain reading finds one,
  * or "an unreadable file" when it can't be read as a plain file or parsed; null when it includes nothing. */
-function includeIn(path) {
+function includeIn(path, gitFile = "git") {
     const text = regularFile(path);
     if (text === null)
         return "an unreadable file";
-    const parsed = spawnSync("git", ["config", "--file", path, "--no-includes", "--name-only", "--list", "-z"], { cwd: "/", encoding: "utf8", timeout: 5_000, env: { PATH: process.env["PATH"] ?? "", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", HOME: "/nonexistent" } });
+    const parsed = spawnSync(gitFile, ["config", "--file", path, "--no-includes", "--name-only", "--list", "-z"], { cwd: "/", encoding: "utf8", timeout: 5_000, env: { PATH: process.env["PATH"] ?? "", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", HOME: "/nonexistent" } });
     if (parsed.status !== 0)
         return "an unreadable file";
     const named = parsed.stdout.split("\0").find(name => /^(include\.path|includeif\..*\.path)$/i.test(name));
@@ -471,7 +474,7 @@ function boundDirs(checkout, binding = {}) {
 const ADMIN_LINKED = ["index", "logs", "refs", "reftable"];
 /** What git keeps in a common directory (its path.c common_list, and reftable), linked whether or not it exists yet. */
 const COMMON_NAMES = ["branches", "gc.pid", "logs", "lost-found", "modules", "objects", "packed-refs", "reftable", "refs", "remotes", "rr-cache", "shallow", "svn", "worktrees"];
-function gitView(checkout, kind, binding = {}) {
+function gitView(checkout, kind, binding = {}, gitFile = "git") {
     const dirs = boundDirs(checkout, binding);
     const root = ensureGitViewsRoot(realpathSync(homedir()));
     const view = realpathSync(mkdtempSync(join(root, `${kind}-`)));
@@ -487,7 +490,7 @@ function gitView(checkout, kind, binding = {}) {
         writeFileSync(configPath, config, { mode: 0o600 });
         const plain = { cwd: "/", encoding: "utf8", timeout: 5_000, env: { PATH: process.env["PATH"] ?? "", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", HOME: "/nonexistent" } };
         if (/worktreeconfig/i.test(config)) {
-            const flag = spawnSync("git", ["config", "--file", configPath, "--no-includes", "--type=bool", "--get", "extensions.worktreeConfig"], plain);
+            const flag = spawnSync(gitFile, ["config", "--file", configPath, "--no-includes", "--type=bool", "--get", "extensions.worktreeConfig"], plain);
             if (flag.status !== 0 && flag.status !== 1)
                 throw new Error("the checkout's git config couldn't be read");
             if (flag.stdout.trim() === "true") {
@@ -499,11 +502,11 @@ function gitView(checkout, kind, binding = {}) {
                 config = `${config}\n${own}`;
                 writeFileSync(configPath, config, { mode: 0o600 });
             }
-            const unset = spawnSync("git", ["config", "--file", configPath, "--unset-all", "extensions.worktreeConfig"], plain);
+            const unset = spawnSync(gitFile, ["config", "--file", configPath, "--unset-all", "extensions.worktreeConfig"], plain);
             if (unset.status !== 0 && unset.status !== 5)
                 throw new Error("the checkout's git config couldn't be read");
         }
-        const include = includeIn(configPath);
+        const include = includeIn(configPath, gitFile);
         if (include !== null)
             throw new Error(`the checkout's git config includes another file (${include})`);
         mkdirSync(join(view, "info"));
@@ -1026,7 +1029,7 @@ export const WRITE_VIEW_FLAGS = ["-c", "worktree.useRelativePaths=false", "-c",
 /** Whether the checkout's .lfsconfig (read as git parses it, that file only) sets any git-lfs key that could name a
  * program (anything but INERT_LFS). A file that
  * isn't a plain one, or doesn't parse, counts as naming one. */
-export function lfsExtensionIn(checkout) {
+export function lfsExtensionIn(checkout, gitFile = "git") {
     const path = join(checkout, ".lfsconfig");
     try {
         if (!lstatSync(path).isFile())
@@ -1035,7 +1038,7 @@ export function lfsExtensionIn(checkout) {
     catch {
         return false;
     }
-    const parsed = spawnSync("git", ["config", "--file", path, "--no-includes", "--name-only", "--list", "-z"], { cwd: "/", encoding: "utf8", timeout: 5_000, env: { PATH: process.env["PATH"] ?? "", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", HOME: "/nonexistent" } });
+    const parsed = spawnSync(gitFile, ["config", "--file", path, "--no-includes", "--name-only", "--list", "-z"], { cwd: "/", encoding: "utf8", timeout: 5_000, env: { PATH: process.env["PATH"] ?? "", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", HOME: "/nonexistent" } });
     return parsed.status !== 0 || parsed.stdout.split("\0").filter(Boolean).some(name => lfsCommand(name) || ["include", "includeif"].includes(keyParts(name).section));
 }
 /** Every command runs against a view of the checkout's repository (gitView) whose config and info are copies the
@@ -1070,12 +1073,15 @@ export function checkoutGit(inner = run, mode = "build", binding = {}) {
                 const key = commandSetting(own.stdout, { lfsChecked: true });
                 if (key !== null)
                     return refused(`the checkout's git config sets ${key}, which can run a command`);
+                // A git without --no-lazy-fetch: a repository that could fetch lazily is refused, from the view's frozen config.
+                if (!lazyFetchSupported() && lazyFetchSetting(own.stdout) !== null)
+                    return refused(PARTIAL_CLONE_REFUSAL);
                 // The operator's own config contributes values only (carriedSettings); git then reads no global or system config.
                 // A read carries no filter: it reads attributes from the empty tree anyway.
                 const carried = mode === "read" ? withoutFilters(carriedSettings(own.stdout)) : carriedSettings(own.stdout);
                 const env = { ...viewed.env, GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null" };
                 // Never into a submodule or nested repository, whose own config this never read: status and diff skip them.
-                const safeArgs = [...args];
+                const safeArgs = withoutUnsupportedFlags(args);
                 const command = safeArgs.findIndex(arg => arg === "status" || arg === "diff");
                 if (command >= 0 && !safeArgs.includes("--ignore-submodules=all"))
                     safeArgs.splice(command + 1, 0, "--ignore-submodules=all");
@@ -1117,8 +1123,8 @@ export const PAGE_READ_FLAGS = [
  * its config as it starts, so the flags alone don't stop a filter planted in both after the inspection: every read
  * also runs against a view of the checkout's repository (gitView; checkoutGitSync, checkoutGit "read"), whose config and info are the plane's. The cost is cosmetic: a checkout's line-ending or encoding rules are not applied, so
  * a file they would normalize can read as changed (fail closed: shipping then asks for a clean commit). */
-export function readFlags() {
-    return PAGE_READ_FLAGS;
+export function readFlags(gitFile = "git") {
+    return lazyFetchSupported(gitFile) ? PAGE_READ_FLAGS : PAGE_READ_FLAGS.filter(flag => flag !== "--no-lazy-fetch");
 }
 /**
  * checkoutGit, synchronously, for reads a page shows from a checkout an agent writes (docs/plans/get-side-effects.md):
@@ -1127,22 +1133,32 @@ export function readFlags() {
  * or info/attributes change after they were read), submodules skipped, bounded. A refusal throws.
  */
 export function checkoutGitSync(cwd, args, options = {}) {
-    if (checkoutIncludes(cwd))
+    const ran = viewedGitSync(cwd, args, options);
+    if (ran.status !== 0)
+        throw new Error(`git ${args[0] ?? ""} failed`);
+    return ran.stdout;
+}
+export function viewedGitSync(cwd, args, options = {}) {
+    const gitFile = options.git ?? "git";
+    if (checkoutIncludes(cwd, gitFile))
         throw new Error("the checkout's git config includes another file, or couldn't be read as a plain file");
-    if (lfsExtensionIn(cwd))
+    if (lfsExtensionIn(cwd, gitFile))
         throw new Error("the checkout's .lfsconfig sets a git-lfs key that can run a command");
     // Its config and info/attributes as read once, in a folder of the plane's own: neither can change before git runs.
-    const view = gitView(cwd, "read", options.binding);
+    const view = gitView(cwd, "read", options.binding, gitFile);
     try {
         const env = { PATH: process.env["PATH"] ?? "", HOME: process.env["HOME"] ?? "", LANG: "C", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", GIT_TERMINAL_PROMPT: "0", ...view.env };
         const bounded = { cwd, env, encoding: "utf8", timeout: options.timeoutMs ?? 60_000, maxBuffer: options.maxBuffer ?? 1_048_576, stdio: ["ignore", "pipe", "pipe"] };
-        const own = spawnSync("git", ["--no-optional-locks", "config", "--list", "--show-scope", "-z"], bounded);
+        const own = spawnSync(gitFile, ["--no-optional-locks", "config", "--list", "--show-scope", "-z"], bounded);
         if (own.status !== 0)
             throw new Error("its config couldn't be read");
         const key = commandSetting(own.stdout, { lfsChecked: true });
         if (key !== null)
             throw new Error(`the checkout's git config sets ${key}, which can run a command`);
-        const safeArgs = [...args];
+        // A git without --no-lazy-fetch: a repository that could fetch lazily is refused, from the view's frozen config.
+        if (!lazyFetchSupported(gitFile) && lazyFetchSetting(own.stdout) !== null)
+            throw new Error(PARTIAL_CLONE_REFUSAL);
+        const safeArgs = withoutUnsupportedFlags(args, gitFile);
         const command = safeArgs.findIndex(arg => arg === "status" || arg === "diff");
         if (command >= 0 && !safeArgs.includes("--ignore-submodules=all"))
             safeArgs.splice(command + 1, 0, "--ignore-submodules=all");
@@ -1151,13 +1167,20 @@ export function checkoutGitSync(cwd, args, options = {}) {
             safeArgs.splice(command + 1, 0, "--no-ext-diff", "--no-textconv");
         // The operator's own values, but no filter: PAGE_READ_FLAGS reads attributes from the empty tree anyway.
         const carried = withoutFilters(carriedSettings(own.stdout));
-        const ran = spawnSync("git", [...TEARDOWN_FLAGS, ...readFlags(), "-c", "diff.ignoreSubmodules=all", ...carried, ...safeArgs], bounded);
-        if (ran.status !== 0)
-            throw new Error(`git ${args[0] ?? ""} failed`);
+        const argv = [...TEARDOWN_FLAGS, ...readFlags(gitFile), "-c", "diff.ignoreSubmodules=all", ...carried, ...safeArgs];
+        if (options.buffer === true) {
+            // stdin is the caller's own bytes when given (cat-file --batch), else closed.
+            const ran = spawnSync(gitFile, argv, { ...bounded, encoding: "buffer", ...(options.input === undefined ? {} : { input: options.input, stdio: ["pipe", "pipe", "pipe"] }) });
+            const why = view.settle();
+            if (why !== null)
+                throw new Error(why);
+            return { status: ran.error === undefined ? ran.status : null, stdout: ran.stdout };
+        }
+        const ran = spawnSync(gitFile, argv, bounded);
         const why = view.settle();
         if (why !== null)
             throw new Error(why);
-        return view.restore(ran.stdout, args);
+        return { status: ran.error === undefined ? ran.status : null, stdout: view.restore(ran.stdout ?? "", args) };
     }
     finally {
         view.dispose();
@@ -1183,3 +1206,92 @@ export function hardenedGit(inner = run, mode = "build", binding = {}) {
         return hardened("git", rest, { ...options, ...(cwd === undefined ? {} : { cwd }) });
     };
 }
+/**
+ * Git older than 2.45 has no `--no-lazy-fetch` (and no GIT_NO_LAZY_FETCH): there, every hardened read leaves the flag
+ * out and instead refuses a repository whose config makes lazy fetching possible (lazyFetchSetting), while
+ * `protocol.allow=never` stays on every read and write, so a lazy fetch that slipped past would still find no
+ * transport. Asked once per process, as the plane's other plain git probes run: no system or global config.
+ */
+const lazyFetchByGit = new Map();
+let lazyFetchOverride;
+/** The git executable `file` names, as the real path it runs (a bare name looked up on PATH), or `file` itself. */
+function gitExecutablePath(file) {
+    const candidates = file.includes("/") ? [file] : (process.env["PATH"] ?? "").split(delimiter).filter(dir => isAbsolute(dir)).map(dir => join(dir, file));
+    for (const candidate of candidates) {
+        try {
+            accessSync(candidate, fsConstants.X_OK);
+            return realpathSync(candidate);
+        }
+        catch { /* next */ }
+    }
+    return file;
+}
+/** Asked once per git executable (eval-harness review 2, follow-up): a fixed git given to viewedGitSync is probed
+ * itself, never answered for by the one PATH names. */
+export function lazyFetchSupported(gitFile = "git") {
+    if (lazyFetchOverride !== undefined)
+        return lazyFetchOverride;
+    const executable = gitExecutablePath(gitFile);
+    let known = lazyFetchByGit.get(executable);
+    if (known === undefined) {
+        const probe = spawnSync(executable, ["--no-lazy-fetch", "version"], { cwd: "/", encoding: "utf8", timeout: 5_000, stdio: ["ignore", "pipe", "pipe"],
+            env: { PATH: process.env["PATH"] ?? "", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", HOME: "/nonexistent" } });
+        known = probe.status === 0;
+        lazyFetchByGit.set(executable, known);
+    }
+    return known;
+}
+/** For tests: forget the probes' answers, or set one for every executable (null forgets). */
+export function setLazyFetchSupportedForTest(value) { lazyFetchOverride = value ?? undefined; lazyFetchByGit.clear(); }
+/** The words for a partial clone refused on a git without `--no-lazy-fetch`. */
+export const PARTIAL_CLONE_REFUSAL = "this project is a partial clone; protected reads need git 2.45 or newer";
+/** `--no-lazy-fetch` where the installed git has it, else nothing (and lazyFetchSetting refuses partial clones). */
+export function noLazyFetch() { return lazyFetchSupported() ? ["--no-lazy-fetch"] : []; }
+/** A caller's own arguments with `--no-lazy-fetch` taken out when the installed git doesn't know it. */
+function withoutUnsupportedFlags(args, gitFile = "git") {
+    return lazyFetchSupported(gitFile) ? [...args] : args.filter(arg => arg !== "--no-lazy-fetch");
+}
+/**
+ * The repository setting (local or worktree scope of a `git config --list --show-scope -z` listing) that makes lazy
+ * fetching possible, or null: `extensions.partialClone` set at all, any `remote.<name>.promisor` not plainly false, or
+ * any `remote.<name>.partialCloneFilter` set (git makes that remote a promisor). Fails closed: a listing that can't be
+ * read names a setting. `remote.<name>.vcs` (a foreign-VCS helper) is named too, though the classifier already refuses
+ * it (commandSetting: not in the remote allowlist), as it does every `protocol.*` key and every include.
+ */
+export function lazyFetchSetting(listing) {
+    try {
+        const fields = listing.split("\0");
+        for (let at = 0; at + 1 < fields.length; at += 2) {
+            const scope = fields[at];
+            if (scope !== "local" && scope !== "worktree")
+                continue;
+            const entry = fields[at + 1];
+            const newline = entry.indexOf("\n");
+            const key = newline < 0 ? entry : entry.slice(0, newline);
+            const value = newline < 0 ? null : entry.slice(newline + 1);
+            const { section, subsection, variable } = keyParts(key);
+            if (section === "extensions" && variable === "partialclone")
+                return key.toLowerCase();
+            if (section === "remote" && subsection !== null && (variable === "partialclonefilter" || variable === "vcs"))
+                return key.toLowerCase();
+            if (section === "remote" && subsection !== null && variable === "promisor" && !/^(false|no|off|0)$/i.test((value ?? "true").trim()))
+                return key.toLowerCase();
+        }
+        return null;
+    }
+    catch {
+        return "a setting that couldn't be read";
+    }
+}
+/**
+ * For the reads that run git directly on a repository rather than through a view: with `--no-lazy-fetch` they run as
+ * they always have (the flag stops any fetch). Without it, they must not check a repository's config and then run git
+ * on it (the config could change in between, or an include could set what the check never saw): `inner`, wrapped so
+ * every git command runs through a frozen read view (checkoutGit "read"), whose own config listing (includes refused,
+ * command and protocol settings refused, a partial clone refused) is the config git then runs with.
+ */
+export function lazyFetchSafeGit(inner = run) {
+    // On every git version (eval-harness review 1, finding 7): with --no-lazy-fetch the direct read still took the
+    // repository's config and its includes as git found them, and an include naming a FIFO could hang the plane.
+    return checkoutGit(inner, "read");
+}

package/dist/test-infra.js

@@ -20,7 +20,7 @@ const VITEST_CONFIG = /(^|\/)vitest\.config\.[cm]?[jt]s$/;
 const EXTENSIONS = ["ts", "tsx", "mts", "cts", "js", "mjs", "cjs", "jsx"];
 /** The product's entry points: the CLI binary, the processes it starts by file name, and the browser bundles. */
 export const PRODUCT_ENTRIES = Object.freeze([
-    "src/bin.ts", "src/cli.ts", "src/controller-service.ts", "src/desktop-host.ts", "src/sandbox-launch.ts", "src/tool-launcher.ts",
+    "src/bin.ts", "src/cli.ts", "src/controller-service.ts", "src/up-role-child.ts", "src/desktop-host.ts", "src/sandbox-launch.ts", "src/tool-launcher.ts",
     "src/browser/app.tsx", "src/browser/terminal-app.tsx",
 ]);
 const join = (dir, spec) => {