toolroll 0.9.76 → 0.9.78

package/dist/up-processes.js

@@ -0,0 +1,165 @@
+/**
+ * `toolroll up` as two processes (docs/plans/isolated-checks.md, stage 1): the console (HTTP: serving, reading and the
+ * person's ceremonies) and the worker (the watch loops: builds, checks, batch checks, follow-ups, reconcilers, the
+ * storage sweep and checkout sizing). `up` itself keeps the identities it minted (the approver's login, the runner and
+ * its token), supervises both with controller-supervisor, and relays between them. Nothing here grants authority:
+ * each role is handed only what it needs, by message, never on a command line or in the environment.
+ *
+ * What each holds:
+ *   console  the database, the console's own session and sign-in secrets, the attach (instance) secret, push keys, the
+ *            port. Never the runner token: it can't claim, lease or build.
+ *   worker   the database and the runner name and token, for the watch leases and claims. It opens no port and mints
+ *            no console session or attach secret.
+ * Both are the same user on the same database folder, so files beside the database (the saved login, tool secrets)
+ * are reachable by either: the split keeps secrets out of each other's memory and messages, not out of the folder.
+ */
+import { createHash, randomUUID } from "node:crypto";
+import { readFileSync } from "node:fs";
+const MAX_TEXT = 16_384;
+const MAX_LIST = 4_096;
+const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const text = (value, max = MAX_TEXT) => typeof value === "string" && value.length <= max;
+const nonEmpty = (value, max = MAX_TEXT) => text(value, max) && value !== "" && !value.includes("\0");
+const texts = (value) => Array.isArray(value) && value.length <= MAX_LIST && value.every(one => nonEmpty(one));
+const whole = (value, min = 0, max = 2_147_483_647) => typeof value === "number" && Number.isSafeInteger(value) && value >= min && value <= max;
+const orNull = (value, check) => value === null || check(value);
+/** The parent's word to a role, checked before anything acts on it. */
+export function parentMessage(value) {
+    if (!isObject(value))
+        return null;
+    switch (value["type"]) {
+        case "repos": return texts(value["repos"]) ? { type: "repos", repos: [...value["repos"]] } : null;
+        case "stopping": return { type: "stopping" };
+        case "hard-stop": return { type: "hard-stop" };
+        case "sign-in-link": return whole(value["id"]) && nonEmpty(value["account"], 256) ? { type: "sign-in-link", id: value["id"], account: value["account"] } : null;
+        default: return null;
+    }
+}
+/** A role's word to the parent, checked before the parent relays or acts on it. */
+export function roleMessage(value, role) {
+    if (!isObject(value))
+        return null;
+    switch (value["type"]) {
+        case "ready":
+            if (value["role"] !== role || !nonEmpty(value["build"], 512) || !whole(value["pid"], 1))
+                return null;
+            if (!orNull(value["url"], (one) => nonEmpty(one, 2_048)) || !orNull(value["port"], (one) => whole(one, 1, 65_535)))
+                return null;
+            // Only the console serves: a worker that names an address is not a worker.
+            if (role === "worker" && (value["url"] !== null || value["port"] !== null))
+                return null;
+            if (role === "console" && (value["url"] === null || value["port"] === null))
+                return null;
+            return { type: "ready", role, build: value["build"], pid: value["pid"], url: value["url"], port: value["port"] };
+        case "log": return text(value["line"]) ? { type: "log", line: value["line"] } : null;
+        case "repos": return role === "worker" && texts(value["repos"]) ? { type: "repos", repos: [...value["repos"]] } : null;
+        case "failed": return (value["reason"] === "port-busy" || value["reason"] === "start") && text(value["detail"]) ? { type: "failed", reason: value["reason"], detail: value["detail"] } : null;
+        case "fatal": return text(value["detail"]) ? { type: "fatal", detail: value["detail"] } : null;
+        case "sign-in-link": return role === "console" && whole(value["id"]) && orNull(value["link"], (one) => nonEmpty(one, 2_048)) ? { type: "sign-in-link", id: value["id"], link: value["link"] } : null;
+        case "closed": return orNull(value["problem"], (one) => text(one)) ? { type: "closed", problem: value["problem"] } : null;
+        default: return null;
+    }
+}
+/** The start message a role child waits for. The console's config carries no runner token; anything else refuses. */
+export function startMessage(value) {
+    if (!isObject(value) || value["type"] !== "start" || !nonEmpty(value["databaseFile"], 4_096) || !orNull(value["containment"], (one) => nonEmpty(one, 64)) || !nonEmpty(value["build"], 512))
+        return null;
+    const config = value["config"];
+    if (!isObject(config))
+        return null;
+    const base = { type: "start", databaseFile: value["databaseFile"], containment: value["containment"], build: value["build"] };
+    if (value["role"] === "console") {
+        const keys = ["host", "port", "allowedHosts", "publicUrl", "localRunner", "poolRoot", "repos", "projectRoots", "registryPath", "editor"];
+        if (Object.keys(config).some(key => !keys.includes(key)))
+            return null;
+        if (!nonEmpty(config["host"], 253) || !whole(config["port"], 0, 65_535) || !orNull(config["allowedHosts"], texts) || !orNull(config["publicUrl"], (one) => nonEmpty(one, 2_048)) ||
+            !nonEmpty(config["localRunner"], 256) || !nonEmpty(config["poolRoot"], 4_096) || !texts(config["repos"]) || !texts(config["projectRoots"]) || !nonEmpty(config["registryPath"], 4_096) || typeof config["editor"] !== "boolean")
+            return null;
+        return { ...base, role: "console", config: config };
+    }
+    if (value["role"] === "worker") {
+        const keys = ["runner", "token", "repos", "pinnedRepos", "projectRoots", "registryPath", "pool", "forMs", "publicUrl", "stopGraceMs", "verbose", "terminal", "leaseWaitMs"];
+        if (Object.keys(config).some(key => !keys.includes(key)))
+            return null;
+        if (!nonEmpty(config["runner"], 256) || !nonEmpty(config["token"], 1_024) || !texts(config["repos"]) || !texts(config["pinnedRepos"]) || !texts(config["projectRoots"]) ||
+            !nonEmpty(config["registryPath"], 4_096) || !nonEmpty(config["pool"], 4_096) || !orNull(config["forMs"], (one) => whole(one, 1)) ||
+            !orNull(config["publicUrl"], (one) => nonEmpty(one, 2_048)) || !whole(config["stopGraceMs"], 0) || typeof config["verbose"] !== "boolean" || typeof config["terminal"] !== "boolean" || !whole(config["leaseWaitMs"], 0))
+            return null;
+        return { ...base, role: "worker", config: config };
+    }
+    return null;
+}
+/** Two ends of an in-memory channel: one process composing both roles (tests and the desktop host), same messages. */
+export function memoryChannel(role) {
+    const toParent = [];
+    const toRole = [];
+    const stops = [];
+    // Delivered on a later turn, as IPC would be, and through the same checks: a role can't lean on synchronous replies.
+    const later = (fn) => { queueMicrotask(fn); };
+    return {
+        port: {
+            send: message => { const checked = roleMessage(JSON.parse(JSON.stringify(message)), role); if (checked !== null)
+                later(() => { for (const one of toParent)
+                    one(checked); }); },
+            onMessage: handler => { toRole.push(handler); },
+            onStop: handler => { stops.push(handler); },
+        },
+        parent: {
+            send: message => { const checked = parentMessage(JSON.parse(JSON.stringify(message))); if (checked !== null)
+                later(() => { for (const one of toRole)
+                    one(checked); }); },
+            onMessage: handler => { toParent.push(handler); },
+            stop: hard => { for (const one of stops)
+                one(hard); },
+        },
+    };
+}
+/** A build identity: the version and the exact code of the module that composes `up`. Both roles must report the
+ * parent's own, or the parent stops rather than run a console and a worker from different builds. */
+export function buildIdentity(version, moduleFile) {
+    let digest = `unreadable-${randomUUID()}`;
+    try {
+        digest = createHash("sha256").update(readFileSync(moduleFile)).digest("hex").slice(0, 16);
+    }
+    catch { /* unique: never equal to any other identity */ }
+    return `${version}+${digest}`;
+}
+/** How many replacements in a row may end before becoming ready, with no refusal said, before `up` stops. */
+export const ROLE_NOT_READY_REPLACEMENTS = 3;
+/**
+ * One supervised role's generations (Codex review round 1, finding 5): readiness is per generation, not for the role's
+ * whole life. When a generation ends, the verdict is:
+ * - `fail-start`: the role never became ready at all; the start fails as one, as before the split;
+ * - `restart`: this generation was ready and crashed afterwards (the supervisor starts it again);
+ * - `end`: a replacement refused to start (another build, another database, a start refused) — permanent, so the whole
+ *   `up` stops rather than loop — or ROLE_NOT_READY_REPLACEMENTS replacements in a row ended before readiness.
+ */
+export class RoleGenerations {
+    everReady = false;
+    generationReady = false;
+    refusal = null;
+    notReadyStreak = 0;
+    /** A new generation was spawned: nothing about it is known yet. */
+    spawned() { this.generationReady = false; this.refusal = null; }
+    /** This generation became ready; true when it is the role's first readiness ever. */
+    ready() { const first = !this.everReady; this.everReady = true; this.generationReady = true; return first; }
+    /** This generation refused its start for good (it said why, or its build is another). */
+    refused(detail) { this.refusal = detail; }
+    /** What this generation said when it refused, if it did. */
+    refusedWith() { return this.refusal; }
+    /** Whether any generation ever became ready. */
+    wasReady() { return this.everReady; }
+    /** This generation ended (not stopped by `up`): what happens next. */
+    ended() {
+        if (!this.everReady)
+            return "fail-start";
+        if (this.refusal !== null)
+            return "end";
+        if (this.generationReady) {
+            this.notReadyStreak = 0;
+            return "restart";
+        }
+        this.notReadyStreak += 1;
+        return this.notReadyStreak >= ROLE_NOT_READY_REPLACEMENTS ? "end" : "restart";
+    }
+}

package/dist/up-role-child.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/up-role-child.js

@@ -0,0 +1,81 @@
+/**
+ * Started only by `toolroll up` (up-processes.ts): one of its two roles, the console or the worker, in a process of
+ * its own. It takes its whole start from the parent over the IPC channel (never from arguments or the environment, so
+ * the runner token is in no process listing), and stops when the parent says so or goes away.
+ */
+import { parentMessage, startMessage } from "./up-processes.js";
+if (process.send === undefined || !process.connected) {
+    process.stderr.write("This process is started by `toolroll up`; run `toolroll up` instead.\n");
+    process.exit(2);
+}
+// node:sqlite still says it is experimental; the CLI hushes exactly that notice, and so does a role.
+const emitWarning = process.emitWarning.bind(process);
+process.emitWarning = ((warning, ...rest) => {
+    const type = typeof rest[0] === "string" ? rest[0] : rest[0]?.type;
+    if (type === "ExperimentalWarning" && (warning instanceof Error ? warning.message : String(warning)).includes("SQLite"))
+        return;
+    emitWarning(warning, ...rest);
+});
+const handlers = [];
+const stops = [];
+let stopRequested = false;
+const stop = (hard) => {
+    stopRequested = true;
+    for (const one of stops)
+        one(hard);
+};
+const port = {
+    send: (message) => { if (process.connected) {
+        try {
+            process.send?.(message);
+        }
+        catch { /* the parent is gone; its loss stops this role */ }
+    } },
+    onMessage: handler => { handlers.push(handler); },
+    onStop: handler => { stops.push(handler); if (stopRequested)
+        handler(false); },
+};
+// A terminal's Ctrl-C reaches the whole process group: the parent decides what a signal means (drain, then a hard
+// stop on the second), so a role never acts on SIGINT itself. SIGTERM (the supervisor's stop) drains, once.
+process.on("SIGINT", () => { });
+process.on("SIGTERM", () => stop(false));
+// The parent gone (its channel closed): drain, as a stop would. The worker's own grace timer bounds it; past a minute
+// with nobody left to stop it, the role stops its work outright and ends, never running on as an orphan.
+process.once("disconnect", () => {
+    stop(false);
+    setTimeout(() => { stop(true); setTimeout(() => process.exit(1), 5_000).unref(); }, 60_000).unref();
+});
+const start = await new Promise(resolve => {
+    const timer = setTimeout(() => resolve(null), 60_000);
+    process.once("message", value => { clearTimeout(timer); resolve(value); });
+});
+const checked = startMessage(start);
+// The role named on the command line (for a process listing) and the one started must be the same.
+if (checked === null || checked.role !== process.argv[2]) {
+    process.stderr.write("The start message from `toolroll up` was not understood.\n");
+    process.exit(2);
+}
+process.on("message", value => {
+    const message = parentMessage(value);
+    if (message === null)
+        return;
+    if (message.type === "hard-stop") {
+        stop(true);
+        return;
+    }
+    for (const one of handlers)
+        one(message);
+});
+const { runUpRole } = await import("./operate.js");
+let code = 1;
+try {
+    code = await runUpRole(checked, port);
+}
+catch (error) {
+    port.send({ type: "fatal", detail: error instanceof Error ? error.message : String(error) });
+}
+// Everything this role owned is closed; leave promptly even if a stray handle lingers.
+if (process.connected)
+    process.disconnect?.();
+setTimeout(() => process.exit(code), 200).unref();
+process.exitCode = code;

package/dist/verification-evidence.d.ts

@@ -13,6 +13,7 @@ export type ReleaseCheckFacts = {
         report: string | null;
         inventory: string | null;
         exitCode?: number | null;
+        retried?: string[] | null;
     };
     composed: ComposedLinks | null;
 };

package/dist/verification-evidence.js

@@ -29,7 +29,10 @@ export function effectiveCheckFacts(raw, facts) {
     if (facts === null || coveragePasses(facts.coverage))
         return { result: raw, facts };
     const exitCode = raw.configured && raw.ran ? raw.exitCode : null;
-    return { result: { configured: true, ran: false, attemptFailed: true, failure: "coverage-incomplete" }, facts: { ...facts, check: { ...facts.check, exitCode } } };
+    // A check that stopped before it could report keeps its own failure (it timed out, Toolroll stopped it): that is why.
+    if (facts.coverage === "no-result" && raw.configured && !raw.ran)
+        return { result: raw, facts };
+    return { result: { configured: true, ran: false, attemptFailed: true, failure: facts.coverage === "no-result" ? "no-result" : "coverage-incomplete" }, facts: { ...facts, check: { ...facts.check, exitCode } } };
 }
 export function sealVerificationReceipt(store, root, runId, head, command, result, now, reusedFrom, release) {
     const source = store.getRun(runId);
@@ -142,6 +145,15 @@ export function verificationEvidence(store, root, runId) {
             const sha = (capture) => { const found = artifacts.filter(a => a.kind === "structured-output" && a.capture === capture); return found.length === 1 ? found[0].sha256 : null; };
             if (sha(CHECK_REPORT_CAPTURE) !== checked.check.report || sha(CHECK_INVENTORY_CAPTURE) !== checked.check.inventory)
                 return fail("The release check's sealed report or inventory changed.");
+            // Their bytes too, not only their records (eval-harness review 1, finding 3): a report or inventory the receipt
+            // names that is missing, cut short or changed on disk no longer verifies.
+            for (const capture of [CHECK_REPORT_CAPTURE, CHECK_INVENTORY_CAPTURE]) {
+                const one = artifacts.find(a => a.kind === "structured-output" && a.capture === capture);
+                if (one === undefined)
+                    continue;
+                if (one.truncated || one.redacted || one.captureStatus !== "ok" || !readVerifiedArtifact(root, one).ok)
+                    return fail("The release check's sealed report or inventory no longer verifies.");
+            }
             if ((checked.coverage === "composed") !== (checked.composed !== undefined))
                 return fail("The release check's coverage and its links disagree.");
             // A check that didn't cover what it owed can never read as a pass.

package/dist/workspace-revision.js

@@ -8,7 +8,9 @@ const OMIT = new Set(['schema_version', 'service_cursor', 'wake', 'notification_
     // Who is watching an agent right now: renewed by every open page's keep-alive, never news.
     'agent_view',
     // A run's How it ran, derived from its own records on first view (run-efficiency.ts): a cache, never news.
-    'run_efficiency']);
+    'run_efficiency',
+    // v137: lifecycle heartbeats, latency timelines and the continuous copy's record are bookkeeping, never news.
+    'service_lifecycle', 'latency_timeline', 'live_backup']);
 const QUIET = {
     runner: ['heartbeat_at'], claim: ['heartbeat_at', 'expires_at'], watch_lease: ['heartbeat_at', 'expires_at'],
     watch_episode: ['ticks'], provider_readiness: ['observed_at'],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolroll",
-  "version": "0.9.76",
+  "version": "0.9.78",
   "description": "A control plane for unattended coding agents — queue tasks, walk away, come back to pull requests. Agents build in leased worktrees, never touch your default branch, and interrupt you only for decisions that need a human.",
   "directories": {
     "doc": "docs"
@@ -11,6 +11,7 @@
     "test:slow": "vitest run .slow.test",
     "test:all": "vitest run",
     "test:attacks": "vitest run --config test/attacks/vitest.config.ts",
+    "test:git": "vitest run test/attacks/checkout-git- test/attacks/fence-git-views test/attacks/repository-context-git test/attacks/discover-dirty src/teardown-git.test.ts src/worktree.slow.test.ts",
     "check:quick": "node scripts/quick-check.mjs",
     "dev": "tsx src/cli.ts",
     "typecheck": "tsc --noEmit && tsc -p tsconfig.browser.json",