toolroll 0.9.76 → 0.9.78

package/dist/teardown-git.js

@@ -11,12 +11,12 @@
  * nothing is removed.
  */
 import { spawnSync } from "node:child_process";
-import { closeSync, constants as fsConstants, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readdirSync, readFileSync, realpathSync, renameSync, rmSync, symlinkSync, writeFileSync, writeSync } from "node:fs";
+import { accessSync, closeSync, constants as fsConstants, existsSync, fstatSync, lstatSync, mkdirSync, mkdtempSync, openSync, readdirSync, readFileSync, realpathSync, renameSync, rmSync, symlinkSync, writeFileSync, writeSync } from "node:fs";
 import { randomBytes } from "node:crypto";
 import { homedir } from "node:os";
 import { ensureGitViewsRoot, withCheckoutLock } from "./git-views.js";
 import { gitIncident } from "./git-incident.js";
-import { basename, dirname, join, resolve } from "node:path";
+import { basename, delimiter, dirname, isAbsolute, join, resolve } from "node:path";
 import { run } from "./exec.js";
 import { ENV, ENV_ALLOWLIST } from "./remote-main.js";
 import { WORKTREE_TIMEOUT_MS } from "./worktree.js";
@@ -304,29 +304,37 @@ export function teardownGit(runner = run, binding = {}) {
  * git at any file, a pipe that never ends among them. Each file is read only as the regular file it is, bounded; one
  * that can't be read so counts as including.
  */
-export function checkoutIncludes(checkout) {
+export function checkoutIncludes(checkout, gitFile = "git") {
     const dirs = gitDirsOf(checkout);
     if (dirs === null)
         return true;
     for (const path of [join(dirs.common, "config"), join(dirs.gitdir, "config.worktree")]) {
         if (!existsSync(path) && path.endsWith("config.worktree"))
             continue;
-        if (configIncludes(path))
+        if (includeIn(path, gitFile) !== null)
             return true;
     }
     return false;
 }
 /** One config file, read only as the regular file it is (bounded), or null. */
 function regularFile(path) {
+    // Opened without following a link and without blocking, then judged by what was opened: a FIFO swapped in after a
+    // look never hangs the read (eval-harness review 1, finding 7).
+    let fd = null;
     try {
-        const held = lstatSync(path);
+        fd = openSync(path, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW | fsConstants.O_NONBLOCK);
+        const held = fstatSync(fd);
         if (!held.isFile() || held.size > 1024 * 1024)
             return null;
-        return readFileSync(path, "utf8");
+        return readFileSync(fd, "utf8");
     }
     catch {
         return null;
     }
+    finally {
+        if (fd !== null)
+            closeSync(fd);
+    }
 }
 /** A checkout's git directory and common directory, as git finds them from its `.git` (a folder, or a one-line
  * `gitdir: ` file); null when the pointer isn't one git would read the same way. */
@@ -350,18 +358,13 @@ function gitDirsOf(checkout) {
     const named = regularFile(join(gitdir, "commondir"))?.trim();
     return { gitdir, common: named === undefined || named === "" ? gitdir : resolve(gitdir, named) };
 }
-/** Whether one config file includes another (or can't be read as a plain file): by a plain reading, and as git itself
- * parses it, includes not followed (only this one regular file, from a neutral folder, with no other config read). */
-function configIncludes(path) {
-    return includeIn(path) !== null;
-}
 /** The include key one config file sets (lowercased, as git names it), "include" when only a plain reading finds one,
  * or "an unreadable file" when it can't be read as a plain file or parsed; null when it includes nothing. */
-function includeIn(path) {
+function includeIn(path, gitFile = "git") {
     const text = regularFile(path);
     if (text === null)
         return "an unreadable file";
-    const parsed = spawnSync("git", ["config", "--file", path, "--no-includes", "--name-only", "--list", "-z"], { cwd: "/", encoding: "utf8", timeout: 5_000, env: { PATH: process.env["PATH"] ?? "", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", HOME: "/nonexistent" } });
+    const parsed = spawnSync(gitFile, ["config", "--file", path, "--no-includes", "--name-only", "--list", "-z"], { cwd: "/", encoding: "utf8", timeout: 5_000, killSignal: "SIGKILL", env: { PATH: process.env["PATH"] ?? "", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", HOME: "/nonexistent" } });
     if (parsed.status !== 0)
         return "an unreadable file";
     const named = parsed.stdout.split("\0").find(name => /^(include\.path|includeif\..*\.path)$/i.test(name));
@@ -471,7 +474,7 @@ function boundDirs(checkout, binding = {}) {
 const ADMIN_LINKED = ["index", "logs", "refs", "reftable"];
 /** What git keeps in a common directory (its path.c common_list, and reftable), linked whether or not it exists yet. */
 const COMMON_NAMES = ["branches", "gc.pid", "logs", "lost-found", "modules", "objects", "packed-refs", "reftable", "refs", "remotes", "rr-cache", "shallow", "svn", "worktrees"];
-function gitView(checkout, kind, binding = {}) {
+function gitView(checkout, kind, binding = {}, gitFile = "git") {
     const dirs = boundDirs(checkout, binding);
     const root = ensureGitViewsRoot(realpathSync(homedir()));
     const view = realpathSync(mkdtempSync(join(root, `${kind}-`)));
@@ -485,9 +488,9 @@ function gitView(checkout, kind, binding = {}) {
             throw new Error("the checkout's git config couldn't be read as a plain file");
         const configPath = join(view, "config");
         writeFileSync(configPath, config, { mode: 0o600 });
-        const plain = { cwd: "/", encoding: "utf8", timeout: 5_000, env: { PATH: process.env["PATH"] ?? "", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", HOME: "/nonexistent" } };
+        const plain = { cwd: "/", encoding: "utf8", timeout: 5_000, killSignal: "SIGKILL", env: { PATH: process.env["PATH"] ?? "", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", HOME: "/nonexistent" } };
         if (/worktreeconfig/i.test(config)) {
-            const flag = spawnSync("git", ["config", "--file", configPath, "--no-includes", "--type=bool", "--get", "extensions.worktreeConfig"], plain);
+            const flag = spawnSync(gitFile, ["config", "--file", configPath, "--no-includes", "--type=bool", "--get", "extensions.worktreeConfig"], plain);
             if (flag.status !== 0 && flag.status !== 1)
                 throw new Error("the checkout's git config couldn't be read");
             if (flag.stdout.trim() === "true") {
@@ -499,11 +502,11 @@ function gitView(checkout, kind, binding = {}) {
                 config = `${config}\n${own}`;
                 writeFileSync(configPath, config, { mode: 0o600 });
             }
-            const unset = spawnSync("git", ["config", "--file", configPath, "--unset-all", "extensions.worktreeConfig"], plain);
+            const unset = spawnSync(gitFile, ["config", "--file", configPath, "--unset-all", "extensions.worktreeConfig"], plain);
             if (unset.status !== 0 && unset.status !== 5)
                 throw new Error("the checkout's git config couldn't be read");
         }
-        const include = includeIn(configPath);
+        const include = includeIn(configPath, gitFile);
         if (include !== null)
             throw new Error(`the checkout's git config includes another file (${include})`);
         mkdirSync(join(view, "info"));
@@ -1026,7 +1029,7 @@ export const WRITE_VIEW_FLAGS = ["-c", "worktree.useRelativePaths=false", "-c",
 /** Whether the checkout's .lfsconfig (read as git parses it, that file only) sets any git-lfs key that could name a
  * program (anything but INERT_LFS). A file that
  * isn't a plain one, or doesn't parse, counts as naming one. */
-export function lfsExtensionIn(checkout) {
+export function lfsExtensionIn(checkout, gitFile = "git") {
     const path = join(checkout, ".lfsconfig");
     try {
         if (!lstatSync(path).isFile())
@@ -1035,7 +1038,7 @@ export function lfsExtensionIn(checkout) {
     catch {
         return false;
     }
-    const parsed = spawnSync("git", ["config", "--file", path, "--no-includes", "--name-only", "--list", "-z"], { cwd: "/", encoding: "utf8", timeout: 5_000, env: { PATH: process.env["PATH"] ?? "", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", HOME: "/nonexistent" } });
+    const parsed = spawnSync(gitFile, ["config", "--file", path, "--no-includes", "--name-only", "--list", "-z"], { cwd: "/", encoding: "utf8", timeout: 5_000, killSignal: "SIGKILL", env: { PATH: process.env["PATH"] ?? "", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", HOME: "/nonexistent" } });
     return parsed.status !== 0 || parsed.stdout.split("\0").filter(Boolean).some(name => lfsCommand(name) || ["include", "includeif"].includes(keyParts(name).section));
 }
 /** Every command runs against a view of the checkout's repository (gitView) whose config and info are copies the
@@ -1070,12 +1073,15 @@ export function checkoutGit(inner = run, mode = "build", binding = {}) {
                 const key = commandSetting(own.stdout, { lfsChecked: true });
                 if (key !== null)
                     return refused(`the checkout's git config sets ${key}, which can run a command`);
+                // A git without --no-lazy-fetch: a repository that could fetch lazily is refused, from the view's frozen config.
+                if (!lazyFetchSupported() && lazyFetchSetting(own.stdout) !== null)
+                    return refused(PARTIAL_CLONE_REFUSAL);
                 // The operator's own config contributes values only (carriedSettings); git then reads no global or system config.
                 // A read carries no filter: it reads attributes from the empty tree anyway.
                 const carried = mode === "read" ? withoutFilters(carriedSettings(own.stdout)) : carriedSettings(own.stdout);
                 const env = { ...viewed.env, GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null" };
                 // Never into a submodule or nested repository, whose own config this never read: status and diff skip them.
-                const safeArgs = [...args];
+                const safeArgs = withoutUnsupportedFlags(args);
                 const command = safeArgs.findIndex(arg => arg === "status" || arg === "diff");
                 if (command >= 0 && !safeArgs.includes("--ignore-submodules=all"))
                     safeArgs.splice(command + 1, 0, "--ignore-submodules=all");
@@ -1117,8 +1123,8 @@ export const PAGE_READ_FLAGS = [
  * its config as it starts, so the flags alone don't stop a filter planted in both after the inspection: every read
  * also runs against a view of the checkout's repository (gitView; checkoutGitSync, checkoutGit "read"), whose config and info are the plane's. The cost is cosmetic: a checkout's line-ending or encoding rules are not applied, so
  * a file they would normalize can read as changed (fail closed: shipping then asks for a clean commit). */
-export function readFlags() {
-    return PAGE_READ_FLAGS;
+export function readFlags(gitFile = "git") {
+    return lazyFetchSupported(gitFile) ? PAGE_READ_FLAGS : PAGE_READ_FLAGS.filter(flag => flag !== "--no-lazy-fetch");
 }
 /**
  * checkoutGit, synchronously, for reads a page shows from a checkout an agent writes (docs/plans/get-side-effects.md):
@@ -1127,22 +1133,32 @@ export function readFlags() {
  * or info/attributes change after they were read), submodules skipped, bounded. A refusal throws.
  */
 export function checkoutGitSync(cwd, args, options = {}) {
-    if (checkoutIncludes(cwd))
+    const ran = viewedGitSync(cwd, args, options);
+    if (ran.status !== 0)
+        throw new Error(`git ${args[0] ?? ""} failed`);
+    return ran.stdout;
+}
+export function viewedGitSync(cwd, args, options = {}) {
+    const gitFile = options.git ?? "git";
+    if (checkoutIncludes(cwd, gitFile))
         throw new Error("the checkout's git config includes another file, or couldn't be read as a plain file");
-    if (lfsExtensionIn(cwd))
+    if (lfsExtensionIn(cwd, gitFile))
         throw new Error("the checkout's .lfsconfig sets a git-lfs key that can run a command");
     // Its config and info/attributes as read once, in a folder of the plane's own: neither can change before git runs.
-    const view = gitView(cwd, "read", options.binding);
+    const view = gitView(cwd, "read", options.binding, gitFile);
     try {
         const env = { PATH: process.env["PATH"] ?? "", HOME: process.env["HOME"] ?? "", LANG: "C", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", GIT_TERMINAL_PROMPT: "0", ...view.env };
-        const bounded = { cwd, env, encoding: "utf8", timeout: options.timeoutMs ?? 60_000, maxBuffer: options.maxBuffer ?? 1_048_576, stdio: ["ignore", "pipe", "pipe"] };
-        const own = spawnSync("git", ["--no-optional-locks", "config", "--list", "--show-scope", "-z"], bounded);
+        const bounded = { cwd, env, encoding: "utf8", timeout: options.timeoutMs ?? 60_000, killSignal: "SIGKILL", maxBuffer: options.maxBuffer ?? 1_048_576, stdio: ["ignore", "pipe", "pipe"] };
+        const own = spawnSync(gitFile, ["--no-optional-locks", "config", "--list", "--show-scope", "-z"], bounded);
         if (own.status !== 0)
             throw new Error("its config couldn't be read");
         const key = commandSetting(own.stdout, { lfsChecked: true });
         if (key !== null)
             throw new Error(`the checkout's git config sets ${key}, which can run a command`);
-        const safeArgs = [...args];
+        // A git without --no-lazy-fetch: a repository that could fetch lazily is refused, from the view's frozen config.
+        if (!lazyFetchSupported(gitFile) && lazyFetchSetting(own.stdout) !== null)
+            throw new Error(PARTIAL_CLONE_REFUSAL);
+        const safeArgs = withoutUnsupportedFlags(args, gitFile);
         const command = safeArgs.findIndex(arg => arg === "status" || arg === "diff");
         if (command >= 0 && !safeArgs.includes("--ignore-submodules=all"))
             safeArgs.splice(command + 1, 0, "--ignore-submodules=all");
@@ -1151,13 +1167,20 @@ export function checkoutGitSync(cwd, args, options = {}) {
             safeArgs.splice(command + 1, 0, "--no-ext-diff", "--no-textconv");
         // The operator's own values, but no filter: PAGE_READ_FLAGS reads attributes from the empty tree anyway.
         const carried = withoutFilters(carriedSettings(own.stdout));
-        const ran = spawnSync("git", [...TEARDOWN_FLAGS, ...readFlags(), "-c", "diff.ignoreSubmodules=all", ...carried, ...safeArgs], bounded);
-        if (ran.status !== 0)
-            throw new Error(`git ${args[0] ?? ""} failed`);
+        const argv = [...TEARDOWN_FLAGS, ...readFlags(gitFile), "-c", "diff.ignoreSubmodules=all", ...carried, ...safeArgs];
+        if (options.buffer === true) {
+            // stdin is the caller's own bytes when given (cat-file --batch), else closed.
+            const ran = spawnSync(gitFile, argv, { ...bounded, encoding: "buffer", ...(options.input === undefined ? {} : { input: options.input, stdio: ["pipe", "pipe", "pipe"] }) });
+            const why = view.settle();
+            if (why !== null)
+                throw new Error(why);
+            return { status: ran.error === undefined ? ran.status : null, stdout: ran.stdout };
+        }
+        const ran = spawnSync(gitFile, argv, bounded);
         const why = view.settle();
         if (why !== null)
             throw new Error(why);
-        return view.restore(ran.stdout, args);
+        return { status: ran.error === undefined ? ran.status : null, stdout: view.restore(ran.stdout ?? "", args) };
     }
     finally {
         view.dispose();
@@ -1183,3 +1206,92 @@ export function hardenedGit(inner = run, mode = "build", binding = {}) {
         return hardened("git", rest, { ...options, ...(cwd === undefined ? {} : { cwd }) });
     };
 }
+/**
+ * Git older than 2.45 has no `--no-lazy-fetch` (and no GIT_NO_LAZY_FETCH): there, every hardened read leaves the flag
+ * out and instead refuses a repository whose config makes lazy fetching possible (lazyFetchSetting), while
+ * `protocol.allow=never` stays on every read and write, so a lazy fetch that slipped past would still find no
+ * transport. Asked once per process, as the plane's other plain git probes run: no system or global config.
+ */
+const lazyFetchByGit = new Map();
+let lazyFetchOverride;
+/** The git executable `file` names, as the real path it runs (a bare name looked up on PATH), or `file` itself. */
+function gitExecutablePath(file) {
+    const candidates = file.includes("/") ? [file] : (process.env["PATH"] ?? "").split(delimiter).filter(dir => isAbsolute(dir)).map(dir => join(dir, file));
+    for (const candidate of candidates) {
+        try {
+            accessSync(candidate, fsConstants.X_OK);
+            return realpathSync(candidate);
+        }
+        catch { /* next */ }
+    }
+    return file;
+}
+/** Asked once per git executable (eval-harness review 2, follow-up): a fixed git given to viewedGitSync is probed
+ * itself, never answered for by the one PATH names. */
+export function lazyFetchSupported(gitFile = "git") {
+    if (lazyFetchOverride !== undefined)
+        return lazyFetchOverride;
+    const executable = gitExecutablePath(gitFile);
+    let known = lazyFetchByGit.get(executable);
+    if (known === undefined) {
+        const probe = spawnSync(executable, ["--no-lazy-fetch", "version"], { cwd: "/", encoding: "utf8", timeout: 5_000, killSignal: "SIGKILL", stdio: ["ignore", "pipe", "pipe"],
+            env: { PATH: process.env["PATH"] ?? "", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", HOME: "/nonexistent" } });
+        known = probe.status === 0;
+        lazyFetchByGit.set(executable, known);
+    }
+    return known;
+}
+/** For tests: forget the probes' answers, or set one for every executable (null forgets). */
+export function setLazyFetchSupportedForTest(value) { lazyFetchOverride = value ?? undefined; lazyFetchByGit.clear(); }
+/** The words for a partial clone refused on a git without `--no-lazy-fetch`. */
+export const PARTIAL_CLONE_REFUSAL = "this project is a partial clone; protected reads need git 2.45 or newer";
+/** `--no-lazy-fetch` where the installed git has it, else nothing (and lazyFetchSetting refuses partial clones). */
+export function noLazyFetch() { return lazyFetchSupported() ? ["--no-lazy-fetch"] : []; }
+/** A caller's own arguments with `--no-lazy-fetch` taken out when the installed git doesn't know it. */
+function withoutUnsupportedFlags(args, gitFile = "git") {
+    return lazyFetchSupported(gitFile) ? [...args] : args.filter(arg => arg !== "--no-lazy-fetch");
+}
+/**
+ * The repository setting (local or worktree scope of a `git config --list --show-scope -z` listing) that makes lazy
+ * fetching possible, or null: `extensions.partialClone` set at all, any `remote.<name>.promisor` not plainly false, or
+ * any `remote.<name>.partialCloneFilter` set (git makes that remote a promisor). Fails closed: a listing that can't be
+ * read names a setting. `remote.<name>.vcs` (a foreign-VCS helper) is named too, though the classifier already refuses
+ * it (commandSetting: not in the remote allowlist), as it does every `protocol.*` key and every include.
+ */
+export function lazyFetchSetting(listing) {
+    try {
+        const fields = listing.split("\0");
+        for (let at = 0; at + 1 < fields.length; at += 2) {
+            const scope = fields[at];
+            if (scope !== "local" && scope !== "worktree")
+                continue;
+            const entry = fields[at + 1];
+            const newline = entry.indexOf("\n");
+            const key = newline < 0 ? entry : entry.slice(0, newline);
+            const value = newline < 0 ? null : entry.slice(newline + 1);
+            const { section, subsection, variable } = keyParts(key);
+            if (section === "extensions" && variable === "partialclone")
+                return key.toLowerCase();
+            if (section === "remote" && subsection !== null && (variable === "partialclonefilter" || variable === "vcs"))
+                return key.toLowerCase();
+            if (section === "remote" && subsection !== null && variable === "promisor" && !/^(false|no|off|0)$/i.test((value ?? "true").trim()))
+                return key.toLowerCase();
+        }
+        return null;
+    }
+    catch {
+        return "a setting that couldn't be read";
+    }
+}
+/**
+ * For the reads that run git directly on a repository rather than through a view: with `--no-lazy-fetch` they run as
+ * they always have (the flag stops any fetch). Without it, they must not check a repository's config and then run git
+ * on it (the config could change in between, or an include could set what the check never saw): `inner`, wrapped so
+ * every git command runs through a frozen read view (checkoutGit "read"), whose own config listing (includes refused,
+ * command and protocol settings refused, a partial clone refused) is the config git then runs with.
+ */
+export function lazyFetchSafeGit(inner = run) {
+    // On every git version (eval-harness review 1, finding 7): with --no-lazy-fetch the direct read still took the
+    // repository's config and its includes as git found them, and an include naming a FIFO could hang the plane.
+    return checkoutGit(inner, "read");
+}

package/dist/test-infra.js

@@ -20,7 +20,7 @@ const VITEST_CONFIG = /(^|\/)vitest\.config\.[cm]?[jt]s$/;
 const EXTENSIONS = ["ts", "tsx", "mts", "cts", "js", "mjs", "cjs", "jsx"];
 /** The product's entry points: the CLI binary, the processes it starts by file name, and the browser bundles. */
 export const PRODUCT_ENTRIES = Object.freeze([
-    "src/bin.ts", "src/cli.ts", "src/controller-service.ts", "src/desktop-host.ts", "src/sandbox-launch.ts", "src/tool-launcher.ts",
+    "src/bin.ts", "src/cli.ts", "src/controller-service.ts", "src/up-role-child.ts", "src/desktop-host.ts", "src/sandbox-launch.ts", "src/tool-launcher.ts",
     "src/browser/app.tsx", "src/browser/terminal-app.tsx",
 ]);
 const join = (dir, spec) => {

package/dist/toolroll-update.js

@@ -37,7 +37,7 @@ import { removeTerminalUpdateGate } from "./terminal-catalog.js";
 import { assertCodingUpdateStopped, backupCodingCatalog, codingCatalogExists, releaseStaleCodingOwner, removeCodingUpdateGate } from "./coding-update.js";
 import { installLaunchdService, launchdPlist, stopLaunchdService, writeFileDurably } from "./daemon.js";
 import { NAME } from "./names.js";
-import { orphanKey, updateSafeSchema, V117_RENAMED_COLUMNS, V117_RENAMED_TABLES, V118_MERGED_TABLES, V119_ADDED_COLUMNS, V120_ADDED_COLUMNS, V121_ADDED_COLUMNS, V122_ADDED_COLUMNS, V123_ADDED_COLUMNS, V125_ADDED_COLUMNS, V126_ADDED_COLUMNS, V128_ADDED_COLUMNS, V129_ADDED_COLUMNS, V134_ADDED_COLUMNS, V135_ADDED_COLUMNS } from "./store.js";
+import { orphanKey, updateSafeSchema, V117_RENAMED_COLUMNS, V117_RENAMED_TABLES, V118_MERGED_TABLES, V119_ADDED_COLUMNS, V120_ADDED_COLUMNS, V121_ADDED_COLUMNS, V122_ADDED_COLUMNS, V123_ADDED_COLUMNS, V125_ADDED_COLUMNS, V126_ADDED_COLUMNS, V128_ADDED_COLUMNS, V129_ADDED_COLUMNS, V134_ADDED_COLUMNS, V135_ADDED_COLUMNS, V138_ADDED_COLUMNS } from "./store.js";
 import { isNewer, REGISTRY } from "./releases.js";
 import { markNeverIndex } from "./never-index.js";
 import { readRuntimeUpdateJournal, RUNTIME_PHASES, RUNTIME_UPDATE_STEPS, stagedStartedAt, updaterStartingOf } from "./contracts/update-journal.js";
@@ -409,7 +409,7 @@ const HISTORY_RULES = {
     // v126: a receipt's state, acceptance time and held item, a trigger's credential generation and turned-away count,
     // and who made a card read none, 0, or none. A table with an earlier rule (flow_trigger's v115 move) keeps it too.
     // v128: a lead message's pending flag reads waiting exactly for a team queue's unadmitted operator message.
-    ...Object.fromEntries(Object.entries(addedColumns(V119_ADDED_COLUMNS, V120_ADDED_COLUMNS, V121_ADDED_COLUMNS, V122_ADDED_COLUMNS, V123_ADDED_COLUMNS, V125_ADDED_COLUMNS, V126_ADDED_COLUMNS, V128_ADDED_COLUMNS, V129_ADDED_COLUMNS, V134_ADDED_COLUMNS, V135_ADDED_COLUMNS))
+    ...Object.fromEntries(Object.entries(addedColumns(V119_ADDED_COLUMNS, V120_ADDED_COLUMNS, V121_ADDED_COLUMNS, V122_ADDED_COLUMNS, V123_ADDED_COLUMNS, V125_ADDED_COLUMNS, V126_ADDED_COLUMNS, V128_ADDED_COLUMNS, V129_ADDED_COLUMNS, V134_ADDED_COLUMNS, V135_ADDED_COLUMNS, V138_ADDED_COLUMNS))
         .map(([table, rule]) => [table, { ...EARLIER_RULES[table], ...rule }])),
 };
 /** The tables a migration may remove whole (v115's removed features). */

package/dist/up-processes.d.ts

@@ -0,0 +1,137 @@
+export type UpRoleName = "console" | "worker";
+export type UpConsoleConfig = {
+    host: string;
+    port: number;
+    allowedHosts: string[] | null;
+    publicUrl: string | null;
+    localRunner: string;
+    poolRoot: string;
+    repos: string[];
+    projectRoots: string[];
+    registryPath: string;
+    editor: boolean;
+};
+export type UpWorkerConfig = {
+    runner: string;
+    token: string;
+    repos: string[];
+    pinnedRepos: string[];
+    projectRoots: string[];
+    registryPath: string;
+    pool: string;
+    forMs: number | null;
+    publicUrl: string | null;
+    stopGraceMs: number;
+    verbose: boolean;
+    terminal: boolean;
+    /** How long a start waits for a predecessor's watch lease to expire (a crashed worker's, after a restart). */
+    leaseWaitMs: number;
+};
+export type UpRoleStart = {
+    type: "start";
+    role: "console";
+    databaseFile: string;
+    containment: string | null;
+    build: string;
+    config: UpConsoleConfig;
+} | {
+    type: "start";
+    role: "worker";
+    databaseFile: string;
+    containment: string | null;
+    build: string;
+    config: UpWorkerConfig;
+};
+export type ParentToRole = {
+    type: "repos";
+    repos: string[];
+} | {
+    type: "stopping";
+} | {
+    type: "hard-stop";
+} | {
+    type: "sign-in-link";
+    id: number;
+    account: string;
+};
+export type RoleToParent = {
+    type: "ready";
+    role: UpRoleName;
+    build: string;
+    pid: number;
+    url: string | null;
+    port: number | null;
+} | {
+    type: "log";
+    line: string;
+} | {
+    type: "repos";
+    repos: string[];
+} | {
+    type: "failed";
+    reason: "port-busy" | "start";
+    detail: string;
+} | {
+    type: "fatal";
+    detail: string;
+} | {
+    type: "sign-in-link";
+    id: number;
+    link: string | null;
+} | {
+    type: "closed";
+    problem: string | null;
+};
+/** One role's side of the channel: the same shape over IPC (a child process) and in memory (one process). */
+export type RolePort = {
+    send: (message: RoleToParent) => void;
+    onMessage: (handler: (message: ParentToRole) => void) => void;
+    /** First call: drain. Every later call: stop now (the second signal's hard stop). */
+    onStop: (handler: (hard: boolean) => void) => void;
+};
+/** The parent's word to a role, checked before anything acts on it. */
+export declare function parentMessage(value: unknown): ParentToRole | null;
+/** A role's word to the parent, checked before the parent relays or acts on it. */
+export declare function roleMessage(value: unknown, role: UpRoleName): RoleToParent | null;
+/** The start message a role child waits for. The console's config carries no runner token; anything else refuses. */
+export declare function startMessage(value: unknown): UpRoleStart | null;
+/** Two ends of an in-memory channel: one process composing both roles (tests and the desktop host), same messages. */
+export declare function memoryChannel(role: UpRoleName): {
+    port: RolePort;
+    parent: {
+        send: (message: ParentToRole) => void;
+        onMessage: (handler: (message: RoleToParent) => void) => void;
+        stop: (hard: boolean) => void;
+    };
+};
+/** A build identity: the version and the exact code of the module that composes `up`. Both roles must report the
+ * parent's own, or the parent stops rather than run a console and a worker from different builds. */
+export declare function buildIdentity(version: string, moduleFile: string): string;
+/** How many replacements in a row may end before becoming ready, with no refusal said, before `up` stops. */
+export declare const ROLE_NOT_READY_REPLACEMENTS = 3;
+/**
+ * One supervised role's generations (Codex review round 1, finding 5): readiness is per generation, not for the role's
+ * whole life. When a generation ends, the verdict is:
+ * - `fail-start`: the role never became ready at all; the start fails as one, as before the split;
+ * - `restart`: this generation was ready and crashed afterwards (the supervisor starts it again);
+ * - `end`: a replacement refused to start (another build, another database, a start refused) — permanent, so the whole
+ *   `up` stops rather than loop — or ROLE_NOT_READY_REPLACEMENTS replacements in a row ended before readiness.
+ */
+export declare class RoleGenerations {
+    private everReady;
+    private generationReady;
+    private refusal;
+    private notReadyStreak;
+    /** A new generation was spawned: nothing about it is known yet. */
+    spawned(): void;
+    /** This generation became ready; true when it is the role's first readiness ever. */
+    ready(): boolean;
+    /** This generation refused its start for good (it said why, or its build is another). */
+    refused(detail: string): void;
+    /** What this generation said when it refused, if it did. */
+    refusedWith(): string | null;
+    /** Whether any generation ever became ready. */
+    wasReady(): boolean;
+    /** This generation ended (not stopped by `up`): what happens next. */
+    ended(): "fail-start" | "restart" | "end";
+}