toolroll 0.9.81 → 0.9.83

package/dist/release-cli.js

@@ -21,6 +21,7 @@ import { carryRefusalWords, proveCarry, setAskEveryReleaseCommit, setUnsandboxed
 import { authenticateApprover, machineActing, personProof, proveCredential } from "./scope.js";
 import { allowAutoPublish, setReleaseApproval } from "./release-auto.js";
 import { createNightlyCheckFlow } from "./nightly-check.js";
+import { aliasNightlyLane, optInGithubNightly, retireNightlyLane } from "./nightly-github.js";
 import { parseSchedule } from "./flow-schedule.js";
 export const RELEASE_HELP = `toolroll release <branch> — release Toolroll itself, from a pushed branch with an open pull request
 
@@ -58,6 +59,12 @@ toolroll release nightly --repo <path> --as <you> --token <password> [--schedule
   — the full release check of main's head every night, approved once with your password; it never deploys,
   merges or completes, and a failure tells you and holds composed releases until a full check passes
 
+toolroll release nightly --github --repo <path> --as <you> --token <password> — read GitHub's Nightly runs on main
+  for this project (its recorded GitHub remote): a lane that fails its tests holds every deploy of the project, a
+  release's merge and its tag until a later nightly passes it, or the release's own CI re-ran it after the failure and
+  passed. --lane-alias <lane-id> <new name> says a renamed job is the same lane; --lane-retire <lane-id> retires a
+  lane no required check names any more (both with your password)
+
 toolroll release ask-every-commit on|off --repo <path> [--as <you> --token <password>] — this project's releases ask
   for every later commit (on), or carry test-only commits again (off: your password, never the lead's token)
 
@@ -91,8 +98,8 @@ A runner's lease is returned with \`toolroll worker release <lease>\`.`;
 /** A runner lease id (claim.ts mints randomUUID()). */
 export const LEASE_SHAPED = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 export const LEASE_DEPRECATION = "`toolroll release <lease>` is now `toolroll worker release <lease>`; the old form goes in the next minor version.";
-const VALUE_FLAGS = new Set(["--repo", "--limit", "--tap", "--release-gate", "--to", "--request", "--as", "--token", "--schedule", "--stage"]);
-const BARE_FLAGS = new Set(["--new", "--json", "--help", "--yes", "--no-carry", "--start", "--recover-deploy"]);
+const VALUE_FLAGS = new Set(["--repo", "--limit", "--tap", "--release-gate", "--to", "--request", "--as", "--token", "--schedule", "--stage", "--lane-retire"]);
+const BARE_FLAGS = new Set(["--new", "--json", "--help", "--yes", "--no-carry", "--start", "--recover-deploy", "--github"]);
 export async function runReleaseCommand(args, write, deps = {}) {
     // The flag, not a secret's value that happens to read "--json".
     // A secret is never exactly one of these names (the loop below refuses that as a missing value).
@@ -104,12 +111,21 @@ export async function runReleaseCommand(args, write, deps = {}) {
     };
     const positional = [];
     const limits = {};
-    let stage;
+    let stage, laneRetire, laneAlias;
     let repo, tap, gate, to, request, as, token, scheduleFlag;
     for (let i = 0; i < args.length; i += 1) {
         const raw = args[i];
         if (BARE_FLAGS.has(raw))
             continue;
+        // `--lane-alias <lane-id> <new name>`: two values, neither a flag of this command.
+        if (raw === "--lane-alias") {
+            const [id, name] = [args[i + 1], args[i + 2]];
+            if (id === undefined || name === undefined || id.startsWith("--") || name.startsWith("--"))
+                return refuse("usage", "--lane-alias takes <lane-id> <new name>.", 2);
+            laneAlias = [id, name];
+            i += 2;
+            continue;
+        }
         // `--flag=value` for every value flag; a secret (--token) is also the next argument even when it starts with "--".
         const equals = raw.startsWith("--") ? raw.indexOf("=") : -1;
         const arg = equals === -1 ? raw : raw.slice(0, equals);
@@ -139,6 +155,8 @@ export async function runReleaseCommand(args, write, deps = {}) {
                 gate = value;
             else if (arg === "--stage")
                 stage = value;
+            else if (arg === "--lane-retire")
+                laneRetire = value;
             else {
                 const match = /^([a-z]+)=([0-9]+)$/.exec(value);
                 if (match === null || !(match[1] in RELEASE_LIMITS) || Number(match[2]) < 1)
@@ -169,6 +187,13 @@ export async function runReleaseCommand(args, write, deps = {}) {
         return refuse("usage", "--stage goes with --recover-deploy.", 2);
     if (bare.has("--yes"))
         return refuse("usage", "--yes goes with --release-gate <id> or --recover-deploy; a release needs no confirmation beyond the owner's approval.", 2);
+    if (bare.has("--github") || laneAlias !== undefined || laneRetire !== undefined) {
+        if (positional[0] !== "nightly" || positional.length !== 1)
+            return refuse("usage", "--github, --lane-alias and --lane-retire go with `toolroll release nightly`.", 2);
+        if ([bare.has("--github"), laneAlias !== undefined, laneRetire !== undefined].filter(Boolean).length !== 1 || scheduleFlag !== undefined || bare.has("--start"))
+            return refuse("usage", "Use one of --github, --lane-alias or --lane-retire, without --schedule or --start.", 2);
+        return runGithubNightlyCommand({ repo: repo === undefined ? undefined : resolve(deps.cwd ?? process.cwd(), repo), as, token, alias: laneAlias, retire: laneRetire }, write, json, deps);
+    }
     if (positional[0] === "nightly" && positional.length === 1)
         return runNightlyCommand({ repo: repo === undefined ? undefined : resolve(deps.cwd ?? process.cwd(), repo), as, token, schedule: scheduleFlag, start: bare.has("--start") }, write, json, deps);
     if (["carry", "revoke", "ask-every-commit", "unsandboxed-carry", "auto-approve", "publish-ok"].includes(positional[0] ?? "") && positional.length === 2) {
@@ -463,3 +488,34 @@ async function runNightlyCommand(flags, write, json, deps) {
         store.close();
     }
 }
+/** `toolroll release nightly --github | --lane-alias | --lane-retire`: GitHub's nightly as release debt
+ * (nightly-github.ts), each a person's step proved with their password now. */
+async function runGithubNightlyCommand(flags, write, json, deps) {
+    const answer = (ok, fields, words, code) => { write(json ? checkedEnvelopeJson({ ok, command: "release nightly", ...fields }) : words); return code; };
+    if (flags.repo === undefined)
+        return answer(false, { reason: "usage", message: "Name the project with --repo <path>." }, "Name the project with --repo <path>.", 2);
+    if (flags.as === undefined || flags.token === undefined)
+        return answer(false, { reason: "usage", message: "This needs your password: add --as <you> --token <password>." }, "This needs your password: add --as <you> --token <password>.", 2);
+    if (machineActing() || process.env["TOOLROLL_LEAD_TOKEN"] !== undefined || process.env["TOOLROLL_REMOTE_TOKEN"] !== undefined)
+        return answer(false, { reason: "person-only", message: "Only a person changes how GitHub's nightly holds releases." }, "Only a person changes how GitHub's nightly holds releases.", 1);
+    const store = openStore(deps.database ?? databasePath(process.env, homedir()));
+    const now = (deps.now ?? (() => new Date()))();
+    try {
+        if (flags.alias !== undefined) {
+            const [laneId, name] = flags.alias;
+            const done = aliasNightlyLane(store, { repo: flags.repo, laneId, name, as: flags.as, token: flags.token }, now);
+            return done.ok ? answer(true, { lane: laneId, name }, `Jobs named "${name}" now count for lane ${laneId}.`, 0) : answer(false, { reason: "refused", message: done.message }, done.message, 1);
+        }
+        if (flags.retire !== undefined) {
+            const done = retireNightlyLane(store, { repo: flags.repo, laneId: flags.retire, as: flags.as, token: flags.token }, now);
+            return done.ok ? answer(true, { lane: flags.retire, closed: done.closed }, `Retired lane ${flags.retire}${done.closed > 0 ? `; ${done.closed} open failure${done.closed === 1 ? "" : "s"} closed` : ""}.`, 0)
+                : answer(false, { reason: "refused", message: done.message }, done.message, 1);
+        }
+        const made = optInGithubNightly(store, { repo: flags.repo, as: flags.as, token: flags.token }, now);
+        return made.ok ? answer(true, { github: made.slug, lanes: made.lanes }, `GitHub's nightly for ${made.slug} now holds this project's deploys, release merges and tags while a lane fails (${made.lanes} lanes).`, 0)
+            : answer(false, { reason: "refused", message: made.message }, made.message, 1);
+    }
+    finally {
+        store.close();
+    }
+}

package/dist/release-view.d.ts

@@ -30,5 +30,8 @@ export type ReleaseView = {
         outcome: string | null;
     } | null;
     openMainFailures: number;
+    /** GitHub's nightly (nightly-github.ts): each open lane failure, held or exempted for this release's tip, and a
+     * warning when it couldn't be read or hasn't run lately. */
+    githubNightly: string[];
 };
 export declare function releaseViewOf(store: Store, taskId: string, now: Date, obligations?: (authority: number) => string[]): ReleaseView | null;

package/dist/release-view.js

@@ -4,6 +4,7 @@
  * main; for a carried task, whose release approval it was carried from. Read-only, from the store.
  */
 import { liveReleaseOf } from "./scope.js";
+import { nightlyReleaseLines } from "./nightly-github.js";
 import { releaseAuthorityOfTask, releaseCarries } from "./store.js";
 export function releaseViewOf(store, taskId, now, obligations = () => []) {
     const found = releaseAuthorityOfTask(store, taskId);
@@ -23,5 +24,6 @@ export function releaseViewOf(store, taskId, now, obligations = () => []) {
         obligations: obligations(a.id),
         nightly: nightly === undefined ? null : { at: String(nightly["at"]), sha: String(nightly["sha"]), outcome: nightly["outcome"] == null ? null : String(nightly["outcome"]) },
         openMainFailures: open,
+        githubNightly: nightlyReleaseLines(store, { repo: a.repo, taskId: a.tipTask, candidate: a.tipSha, now }),
     };
 }

package/dist/release.d.ts

@@ -307,6 +307,22 @@ export type ReleaseAuthorityAdapter = {
     /** Releases that approve themselves when green (docs/plans/auto-approve-green.md): the plane's own seals, each proven
      * again inside the plane. Absent: a plane that can't, and every release asks a person as before. */
     auto?: AutoReleaseAdapter;
+    /** GitHub's nightly lane debt (nightly-github.ts, docs/plans/evals-nightly.md part A) right before a deploy, the merge
+     * and the tag: one bounded read of GitHub (20 s), this candidate's exemptions read again, then the plane's stored
+     * debt. A warning never holds; a hold stops the release. Absent: a plane that can't read it. */
+    nightly?(input: {
+        taskId: string;
+        candidate: string;
+        pr: number;
+        phase: "deploy" | "merge" | "tag";
+    }): Promise<{
+        ok: true;
+        warning: string | null;
+    } | {
+        ok: false;
+        why: string;
+        warning: string | null;
+    }>;
 };
 /** The plane's automatic release approval, as the coordinator asks it. Every answer is the plane's own: the coordinator
  * hands it ids, never evidence (the plane reads GitHub CI itself for `approve`). */

package/dist/release.js

@@ -570,6 +570,16 @@ export async function runRelease(options, adapters) {
             if (held !== null)
                 throw new Stop("approval", `${held}. It was merged; nothing more is tagged, published or sent to Homebrew until a person lets it go on: \`toolroll release publish-ok ${j.task.id} --as <you> --token <password>\`, then rerun.`);
         };
+        /** GitHub's nightly lane debt before a deploy, the merge or the tag (evals-nightly.md, part A2). */
+        const nightlyHolds = async (phase) => {
+            if (rel?.nightly === undefined)
+                return;
+            const answer = await rel.nightly({ taskId: j.task.id, candidate: j.candidate.sha, pr: j.pr, phase });
+            if (answer.warning !== null)
+                say(`  ${answer.warning}`);
+            if (!answer.ok)
+                throw new Stop("nightly-debt", `${answer.why} Nothing was ${phase === "deploy" ? "deployed" : phase === "merge" ? "merged" : "tagged or published"}; rerun the release once it passes.`);
+        };
         /** identity(), on a plane that keeps release authority; a legacy plane keeps the old rules. */
         const watch = async (action) => { if (rel !== undefined)
             await identity(action, true); };
@@ -1000,6 +1010,7 @@ export async function runRelease(options, adapters) {
                                 await watch("deploy");
                                 // Every deploy reservation, whatever the journal saved: CI must still be green on the exact commit.
                                 await autoCiHolds("the deploy");
+                                await nightlyHolds("deploy");
                                 const reserved = await rel.reserve({ authority: j.authority.id, kind: "deploy", taskId: j.task.id, candidate: j.candidate.sha, epoch });
                                 if (!reserved.ok)
                                     throw new Stop("release", `The deploy couldn't be reserved: ${reserved.why}`);
@@ -1017,6 +1028,7 @@ export async function runRelease(options, adapters) {
                             await pinned();
                             // Every deploy issued, whatever the journal saved (a retry after a rollback included): CI still green.
                             await autoCiHolds("the deploy");
+                            await nightlyHolds("deploy");
                             let operation, secret = "";
                             if (rel !== undefined && j.authority && epoch !== null) {
                                 const reserved = await rel.reserve({ authority: j.authority.id, kind: "deploy", taskId: j.task.id, candidate: j.candidate.sha, epoch });
@@ -1110,6 +1122,9 @@ export async function runRelease(options, adapters) {
                             const verdict = prChecksVerdict(await adapters.github.checks(j.github, j.candidate.sha), j.candidate.sha, REQUIRED_PR_CHECKS, { ...autoCap(), workflow: REQUIRED_PR_CHECKS_WORKFLOW });
                             if (verdict.state !== "passed")
                                 await ciFailedAfterDeploy(`Pull request checks are no longer all passing on ${j.candidate.sha.slice(0, 7)}`);
+                            // GitHub's nightly lane debt (a bounded read), before main's last read so it doesn't widen that window; the
+                            // reservation below checks the stored debt again in its own transaction.
+                            await nightlyHolds("merge");
                             // Main once more, from GitHub, the last thing before the merge is reserved: moved since the comparison, it
                             // stops here (finding 4). GitHub's own up-to-date rule refuses the rest of the window.
                             const now = await adapters.github.mainHead(j.github);
@@ -1166,6 +1181,7 @@ export async function runRelease(options, adapters) {
                             throw new Stop("conflict", `${j.tag} already points at ${at.slice(0, 7)}, not the merge ${merge.sha.slice(0, 7)}.`);
                         if (at === null) {
                             await autoCiHolds("the tag");
+                            await nightlyHolds("tag");
                             intend("tag");
                             await adapters.github.createTag(j.github, j.tag, merge.sha);
                         }

package/dist/reported-usage.d.ts

@@ -0,0 +1,69 @@
+import type { Billing } from "./spend.js";
+/** Several reported models are kept as their sorted ids joined by this (it has spaces, so no one id can equal it):
+ * a run whose calls ran different models never reads as any one of them. */
+export declare const MODELS_JOIN = " + ";
+export declare function reportedModelOf(value: unknown): string | null;
+/** The one model a Claude result's `modelUsage` names; null when it names none, several, or anything malformed. */
+export declare function soleReportedModel(modelUsage: unknown): string | null;
+/** Two reports of the same piece of work (a resumed turn, a second init): unknown if either is, the model when they
+ * agree, otherwise every model named, sorted (never one chosen). */
+export declare function combineReportedModels(a: string | null, b: string | null): string | null;
+export declare function providerTurnsOf(value: unknown): number | null;
+export declare function reportedCostUsdOf(value: unknown): number | null;
+/** One provider call's own report. `tokensIn` is everything the model read (cached included) when the provider
+ * reported every part of it (run-efficiency.ts usageOf), else null. */
+export type ProviderReport = {
+    modelReported: string | null;
+    providerTurns: number | null;
+    reportedCostUsd: number | null;
+    tokensIn: number | null;
+    cacheReadTokens: number | null;
+    cacheWriteTokens: number | null;
+};
+/** What the session's own `system`/`init` events named: the one model they agree on, or that they disagree. */
+export type ClaudeInitModel = {
+    model: string | null;
+    conflict: boolean;
+};
+/** A Claude primary `result` (streamed or buffered `--output-format json`), with what the session's inits named. The
+ * init's model is the session's own; inits that disagree leave it unknown; with no init naming one, the result's
+ * `modelUsage` counts only when it names exactly one model. */
+export declare function claudeResultReport(result: Record<string, unknown>, init?: ClaudeInitModel): ProviderReport;
+/** Codex's `turn.completed` usage: its input already counts what came from cache; it reports no cache writes, no
+ * model and no cost in `exec --json`, so those stay unknown. */
+export declare function codexUsageReport(usage: unknown): ProviderReport;
+/** One of the three amounts, never added to another. */
+export type ReportedAmount = {
+    kind: "api";
+    microusd: number;
+}
+/** The provider's own reported cost of work a subscription covers: usage, not billed (null: it reported none). */
+ | {
+    kind: "subscription";
+    reportedUsd: number | null;
+} | {
+    kind: "unknown";
+};
+/** A run's amount, from its fixed billing and its priced spend (run_spend). Subscription work reads its provider's
+ * reported cost as usage, never as dollars; billed work without a reported or priced cost is unknown. v141 (Codex
+ * round 1 #4, #10): billing this computer's default guessed (`basis` not evidence) is unknown, and so is a run whose
+ * cost the provider never reported (its `cost_usd` then holds a conservative charge, never a measurement). */
+export declare function runAmountOf(run: {
+    billing: Billing | null;
+    spendMicrousd: number | null;
+    costUsd: number | null;
+    basis?: "evidence" | "default" | null;
+    costUnknown?: boolean;
+}): ReportedAmount;
+/** A chat request's amount: a subscription chat's reported cost is usage; an API chat's settled charge is dollars,
+ * unless its spend is unknown (then the amount is, whatever was settled against the reservation). v141 (Codex round 1
+ * #4): a subscription harness's request is subscription usage only when its own events said it was billed to the plan
+ * (`billingReported`); one they said used a key is API dollars at its reported cost; one they said nothing of is
+ * unknown. Absent `billingReported` keeps the older reading for callers that predate it. */
+export declare function chatTurnAmountOf(turn: {
+    provider: string;
+    settledMicrousd: number | null;
+    unknownSpend: boolean;
+    reportedCostUsd: number | null;
+    billingReported?: "subscription" | "api-key" | null;
+}): ReportedAmount;

package/dist/reported-usage.js

@@ -0,0 +1,97 @@
+/**
+ * What a provider itself reported about one call (docs/plans/evals-nightly.md, part B1): the exact model, its turn
+ * count, its reported cost and its cache usage. Read only from the provider's own events and response bodies (Claude's
+ * session `system`/`init` and primary `result`, Codex's `turn.completed`, an API's response body), never from text an
+ * agent or a candidate wrote. Anything unreported or malformed is unknown (null), never 0.
+ *
+ * Three amounts are kept apart and never summed into one number: API dollars (work billed by use, with a reported or
+ * priced cost), subscription usage (the provider's own reported cost of work a plan covers: not billed), and unknown.
+ */
+import { usageOf } from "./run-efficiency.js";
+/** A model id as a provider reports it: printable ASCII with no spaces, at most 200 characters. Anything else is
+ * unknown, never trimmed into something that could read as a different model. */
+const MODEL_ID = /^[\x21-\x7e]{1,200}$/;
+/** Several reported models are kept as their sorted ids joined by this (it has spaces, so no one id can equal it):
+ * a run whose calls ran different models never reads as any one of them. */
+export const MODELS_JOIN = " + ";
+export function reportedModelOf(value) {
+    return typeof value === "string" && MODEL_ID.test(value) ? value : null;
+}
+/** The one model a Claude result's `modelUsage` names; null when it names none, several, or anything malformed. */
+export function soleReportedModel(modelUsage) {
+    if (typeof modelUsage !== "object" || modelUsage === null || Array.isArray(modelUsage))
+        return null;
+    const keys = Object.keys(modelUsage);
+    return keys.length === 1 ? reportedModelOf(keys[0]) : null;
+}
+/** Two reports of the same piece of work (a resumed turn, a second init): unknown if either is, the model when they
+ * agree, otherwise every model named, sorted (never one chosen). */
+export function combineReportedModels(a, b) {
+    if (a === null || b === null)
+        return null;
+    if (a === b)
+        return a;
+    return [...new Set([...a.split(MODELS_JOIN), ...b.split(MODELS_JOIN)])].sort().join(MODELS_JOIN);
+}
+export function providerTurnsOf(value) {
+    return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : null;
+}
+export function reportedCostUsdOf(value) {
+    return typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : null;
+}
+/** A Claude primary `result` (streamed or buffered `--output-format json`), with what the session's inits named. The
+ * init's model is the session's own; inits that disagree leave it unknown; with no init naming one, the result's
+ * `modelUsage` counts only when it names exactly one model. */
+export function claudeResultReport(result, init = { model: null, conflict: false }) {
+    const usage = usageOf({ provider: "claude", model: null, tokensIn: null, tokensOut: null, usageJson: usageJsonOf(result["usage"]) });
+    return {
+        modelReported: init.conflict ? null : init.model ?? soleReportedModel(result["modelUsage"]),
+        providerTurns: providerTurnsOf(result["num_turns"]),
+        reportedCostUsd: reportedCostUsdOf(result["total_cost_usd"]),
+        tokensIn: usage.in,
+        cacheReadTokens: usage.cacheRead,
+        cacheWriteTokens: usage.cacheWrite,
+    };
+}
+/** Codex's `turn.completed` usage: its input already counts what came from cache; it reports no cache writes, no
+ * model and no cost in `exec --json`, so those stay unknown. */
+export function codexUsageReport(usage) {
+    const read = usageOf({ provider: "codex", model: null, tokensIn: null, tokensOut: null, usageJson: usageJsonOf(usage) });
+    return { modelReported: null, providerTurns: null, reportedCostUsd: null, tokensIn: read.in, cacheReadTokens: read.cacheRead, cacheWriteTokens: null };
+}
+function usageJsonOf(usage) {
+    return typeof usage === "object" && usage !== null && !Array.isArray(usage) ? JSON.stringify(usage) : null;
+}
+/** A run's amount, from its fixed billing and its priced spend (run_spend). Subscription work reads its provider's
+ * reported cost as usage, never as dollars; billed work without a reported or priced cost is unknown. v141 (Codex
+ * round 1 #4, #10): billing this computer's default guessed (`basis` not evidence) is unknown, and so is a run whose
+ * cost the provider never reported (its `cost_usd` then holds a conservative charge, never a measurement). */
+export function runAmountOf(run) {
+    if (run.basis !== undefined && run.basis !== "evidence")
+        return { kind: "unknown" };
+    if (run.costUnknown === true)
+        return { kind: "unknown" };
+    if (run.billing === "subscription")
+        return { kind: "subscription", reportedUsd: reportedCostUsdOf(run.costUsd) };
+    if (run.billing === "api-key" && run.spendMicrousd !== null && Number.isSafeInteger(run.spendMicrousd) && run.spendMicrousd >= 0) {
+        return { kind: "api", microusd: run.spendMicrousd };
+    }
+    return { kind: "unknown" };
+}
+const SUBSCRIPTION_CHAT = new Set(["claude-subscription", "codex-subscription"]);
+/** A chat request's amount: a subscription chat's reported cost is usage; an API chat's settled charge is dollars,
+ * unless its spend is unknown (then the amount is, whatever was settled against the reservation). v141 (Codex round 1
+ * #4): a subscription harness's request is subscription usage only when its own events said it was billed to the plan
+ * (`billingReported`); one they said used a key is API dollars at its reported cost; one they said nothing of is
+ * unknown. Absent `billingReported` keeps the older reading for callers that predate it. */
+export function chatTurnAmountOf(turn) {
+    if (SUBSCRIPTION_CHAT.has(turn.provider)) {
+        if (turn.billingReported === undefined || turn.billingReported === "subscription")
+            return { kind: "subscription", reportedUsd: reportedCostUsdOf(turn.reportedCostUsd) };
+        const cost = reportedCostUsdOf(turn.reportedCostUsd);
+        return turn.billingReported === "api-key" && cost !== null ? { kind: "api", microusd: Math.round(cost * 1_000_000) } : { kind: "unknown" };
+    }
+    if (turn.unknownSpend || turn.settledMicrousd === null || !Number.isSafeInteger(turn.settledMicrousd) || turn.settledMicrousd < 0)
+        return { kind: "unknown" };
+    return { kind: "api", microusd: turn.settledMicrousd };
+}

package/dist/repos.d.ts

@@ -57,4 +57,11 @@ export declare function updateProjectRegistry(file: string, transform: (registry
 } | RegistryUpdateFailure>;
 export declare function addRepos(existing: readonly string[], incoming: readonly string[]): string[];
 export declare function removeRepos(existing: readonly string[], targets: readonly string[]): string[];
+/** Beside the saved list: how many times each line has been removed from it (written under its lock). */
+export declare function registryRemovalsFile(file: string): string;
+/**
+ * How many times each saved line has been removed, as recorded under the saved list's lock. A file that can't be read
+ * as one answers null: its caller treats every line as changed (fail closed).
+ */
+export declare function registryRemovals(file: string): Record<string, number> | null;
 export {};

package/dist/repos.js

@@ -10,6 +10,7 @@
  * to edit it by hand or check it into their dotfiles — which also means it is
  * untrusted input and gets validated like any other.
  */
+import { closeSync as closeFd, constants as fsConstants, fstatSync, openSync as openFd, readSync, renameSync as renameFile, writeFileSync } from "node:fs";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { dirname } from "node:path";
 import { configBase, namedPath } from "./names.js";
@@ -213,6 +214,11 @@ export async function updateProjectRegistry(file, transform) {
             held = false; // abandon: no unlink, no publication
             return { ok: false, reason: "abandoned", message: "the registry lock aged out before the update could publish — nothing changed; try again" };
         }
+        // Each line this update removes counts one more removal, written BEFORE the list is published: whoever holds a
+        // start's authority for a saved line (upDeferredRetry) sees that it was removed, even if it was saved again since.
+        const gone = current.repos.filter(one => !next.repos.includes(one));
+        if (gone.length > 0)
+            bumpRegistryRemovals(file, gone, `${process.pid}.${token.slice(0, 8)}`);
         const temp = `${file}.${process.pid}.${token.slice(0, 8)}.tmp`;
         const fd = openSync(temp, "wx");
         writeSync(fd, `${JSON.stringify({ version: CONFIG_VERSION, ...next }, null, 2)}
@@ -267,3 +273,54 @@ function readProjectRegistry(parsed) {
 function sortUnique(repos) {
     return [...new Set(repos)].sort();
 }
+/** Beside the saved list: how many times each line has been removed from it (written under its lock). */
+export function registryRemovalsFile(file) {
+    return `${file}.removals.json`;
+}
+/**
+ * How many times each saved line has been removed, as recorded under the saved list's lock. A file that can't be read
+ * as one answers null: its caller treats every line as changed (fail closed).
+ */
+export function registryRemovals(file) {
+    let fd;
+    try {
+        fd = openFd(registryRemovalsFile(file), fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW | fsConstants.O_NONBLOCK);
+    }
+    catch (error) {
+        return error.code === "ENOENT" ? {} : null;
+    }
+    try {
+        const held = fstatSync(fd);
+        if (!held.isFile() || held.size > 4 * 1024 * 1024)
+            return null;
+        const buffer = Buffer.alloc(held.size);
+        const read = held.size === 0 ? 0 : readSync(fd, buffer, 0, buffer.length, 0);
+        const parsed = JSON.parse(buffer.toString("utf8", 0, read));
+        if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
+            return null;
+        const out = {};
+        for (const [line, count] of Object.entries(parsed)) {
+            if (!Number.isSafeInteger(count) || count < 0)
+                return null;
+            out[line] = count;
+        }
+        return out;
+    }
+    catch {
+        return null;
+    }
+    finally {
+        closeFd(fd);
+    }
+}
+/** One more removal for each of `lines`, written whole and renamed into place. Called only under the list's lock. */
+function bumpRegistryRemovals(file, lines, tag) {
+    const kept = registryRemovals(file);
+    // An unreadable record starts again from the clock, so no count read before can come round again.
+    const counts = kept ?? {};
+    for (const line of lines)
+        counts[line] = kept === null ? Date.now() : (counts[line] ?? 0) + 1;
+    const temp = `${registryRemovalsFile(file)}.${tag}.tmp`;
+    writeFileSync(temp, `${JSON.stringify(counts)}\n`, { flag: "wx", mode: 0o600 });
+    renameFile(temp, registryRemovalsFile(file));
+}

package/dist/serve.js

@@ -1,5 +1,7 @@
 import { secretFolder } from "./tool-secret-store.js";
 import { acceptedIdentities, recoverLearning } from "./project-learning.js";
+import { syncProjectIdentities } from "./project-identity.js";
+import { firstTasksOffThread, recoverLearningOffThread } from "./learning-look.js";
 import { loadOrCreateVapidKeys } from "./push.js";
 import { checkoutPlan } from "./checkout-cleanup.js";
 import { latestReleaseFor } from "./server/render-settings.js";
@@ -38,7 +40,8 @@ import { asReadOnlyRequest } from './read-only-request.js';
 import { connectionsOf, localConnectOf, oneClickOf } from "./mcp-connect.js";
 import { MOBILE_VIEWPORT_SCRIPT } from "./mobile-viewport.js";
 import { projectAuthority } from "./project-access.js";
-import { discoverTools, projectToolsOf, secretsSetFor, TOOL_CATALOG, toolSecretStorage, toolStanding } from "./project-tools.js";
+import { discoverTools, projectToolsOf, savedProjectMcp, secretsSetFor, TOOL_CATALOG, toolSecretStorage, toolStanding } from "./project-tools.js";
+import { lookProjectMcp } from "./folder-look.js";
 import { toolRefusal } from "./policy.js";
 import { isEdgeAddress, refuseEdge } from "./server/edge-refusal.js";
 import { announcePasswordBearer, isPasswordBearer, PASSWORD_BEARER_REFUSED, passwordBearerAccepted } from "./password-bearer.js";
@@ -166,6 +169,9 @@ import { loadConsoleUrl } from "./webhooks.js";
 import { reviewFactsOf } from "./workspace-ui.js";
 import { WorktreePool } from "./worktree.js";
 export function createDecisionServer(options) {
+    // Identities come from what the console's start resolved off its thread (startConsole); a path that didn't answer
+    // stays unresolved, kept restrictive. Without them (embedders, tests) the old synchronous reads apply.
+    const identities = options.identities ?? syncProjectIdentities();
     const { projectFamilyPeek, familiesInView, familyTasksInView, revisionDestination, runIsLive, runIsTaskResult, revisionViewOf, taskViewData, routeViewOf, taskChatFocus, pullRequestTargetOf, failureOf, explainAttempt, taskScreen, armTaskResume, planViewOf, planContractViewOf, revisionDocOf, revisionLedgerOf, resultDetailOf } = createTaskViews({
         get store() { return store; },
         get projectCounts() { return projectCounts; },
@@ -188,6 +194,7 @@ export function createDecisionServer(options) {
     const { authenticateApprover, authenticateCredential, authorizeMutation, projectOf, projectRequestAllowed, identify, lookupSession, restricted, visible, admissionList, codingActorAllowed, codingProjectAllowed, workAccess, familyOf, taskRepoOf, runVisible } = createSharedGuards({
         get store() { return store; },
         get liveCeiling() { return liveCeiling; },
+        identities,
         get codingProjects() { return codingProjects; },
         get unscopedMode() { return unscopedMode; },
         get managedRepos() { return managedRepos; },
@@ -448,18 +455,20 @@ export function createDecisionServer(options) {
     const approvalNonces = new Map();
     // Resolve startup authority once. Missing paths remain restrictive.
     // Native additions come only from the controller after its admission checks.
-    const { ceiling, unresolved: unresolvedRepos } = resolveCeiling([...(options.repo === undefined ? [] : [options.repo]), ...(options.repos ?? [])], options.projectRoots ?? []);
+    const { ceiling: startCeiling, unresolved: unresolvedRepos } = resolveCeiling([...(options.repo === undefined ? [] : [options.repo]), ...(options.repos ?? [])], options.projectRoots ?? [], options.identities === undefined ? undefined : identities.known);
+    const ceiling = { ...startCeiling, canon: identities.strict };
     /** The project every fresh session opens with: the sole configured repo, else none. */
     const defaultProject = ceiling.repos.length === 1 && ceiling.roots.length === 0 ? ceiling.repos[0] : null;
     /** No ceiling configured at all: the legacy trust-everything mode, named. */
-    const unscopedMode = ceiling.repos.length === 0 && ceiling.roots.length === 0;
+    // An `up` console (it is handed its admitted set) is never unscoped: with every saved project away it is empty.
+    const unscopedMode = ceiling.repos.length === 0 && ceiling.roots.length === 0 && options.admittedRepos === undefined;
     /** Per-row visibility under the ceiling — the authorization question for reads. */
     /** The exact repositories this console serves now: `up`'s live admitted set when it supplies one, else startup's. */
     const exactRepos = () => options.admittedRepos?.() ?? ceiling.repos;
     const liveCeiling = () => {
         const repos = [...exactRepos(), ...(options.additionalProjectRepos?.() ?? [])];
         // An admitted set that is empty for now is an empty ceiling, never the legacy unscoped mode.
-        return { repos: repos.length === 0 && ceiling.roots.length === 0 && !unscopedMode ? [NO_PROJECT] : repos, roots: ceiling.roots };
+        return { repos: repos.length === 0 && ceiling.roots.length === 0 && !unscopedMode ? [NO_PROJECT] : repos, roots: ceiling.roots, canon: identities.strict };
     };
     /** The explicit, currently proved project list. The callback is supplied
      * only by `up`, after it has independently checked git-ness and the root
@@ -479,7 +488,7 @@ export function createDecisionServer(options) {
         const repos = [];
         const gone = goneRepos();
         for (const path of [...exactRepos(), ...(options.currentRepos?.() ?? [])]) {
-            const canonical = canonicalProject(path) ?? path;
+            const canonical = identities.hot(path);
             if (seen.has(canonical) || !visible(canonical) || gone.has(canonical))
                 continue;
             seen.add(canonical);
@@ -568,7 +577,8 @@ export function createDecisionServer(options) {
             // A service that connects by signing in (or an app's own Connect) is offered only that way.
             catalog: TOOL_CATALOG.filter(one => !names.has(one.name) && oneClickOf(one.name) === null && localConnectOf(one.name) === null),
             connections: connectionsOf(store, repo, toolHome), kit, wanted,
-            found: discoverTools(repo, codex, toolHome).filter(one => !names.has(one.spec.name)),
+            // The project's own .mcp.json as the background pass last read it off the console's thread (never read here).
+            found: discoverTools(repo, codex, toolHome, process.env, options.identities === undefined ? undefined : savedProjectMcp.get(repo) ?? null).filter(one => !names.has(one.spec.name)),
             storage: toolSecretStorage(),
         };
     };
@@ -1027,7 +1037,7 @@ export function createDecisionServer(options) {
         }
         const known = new Set(["/recipes/prepare", "/recipes/preview", "/recipes/import", "/recipes/save", "/recipes/launch", "/tasks/add", "/queue/move", "/queue/note", "/people/invite", "/people/invite-revoke", "/people/revoke", "/people/projects", "/projects/select", "/projects/open", "/mode/confirm", "/mode/sign", "/mode/revoke", "/settings/chat-approval/save", "/settings/chat-approval/off", "/settings/project/live-view"]);
         const placed = url.pathname === "/tasks/add" ? body?.get("repo")?.trim() : null;
-        return { repo: url.pathname.startsWith("/people/") ? null : placed ? canonicalProject(placed) ?? placed : projectOf(who, request) ?? null, taskId: null, runId: null,
+        return { repo: url.pathname.startsWith("/people/") ? null : placed ? identities.strict(placed) ?? placed : projectOf(who, request) ?? null, taskId: null, runId: null,
             action: known.has(url.pathname) ? url.pathname.slice(1).replaceAll("/", " ") : "console request" };
     }
     async function handleGet(route, url, who, request, response) {
@@ -1955,6 +1965,8 @@ export function createDecisionServer(options) {
                         for (const provider of PROVIDER_IDS.filter(isKeyedProvider).filter(one => one !== "claude" && one !== "codex"))
                             waits.push(connectionCheck(provider).catch(() => undefined));
                     }
+                    // Project identities, resolved off the thread: what pages asked about, and answers gone stale.
+                    waits.push(identities.refresh([...exactRepos(), ...(options.currentRepos?.() ?? []), ...store.listProjects().map(one => one.path), ...store.knownRepos(), ...ceiling.roots]));
                     integrations.refreshIfDue();
                     const sso = ssoSettings();
                     if (sso !== null && (ssoProvider === null || ssoProvider.issuer !== sso.issuer || Date.now() - ssoProvider.at >= 10 * 60_000))
@@ -1991,13 +2003,22 @@ export function createDecisionServer(options) {
                                 continue;
                             const reading = { until: Date.now() + 10 * 60_000, found: entry?.found ?? null, reading: true };
                             firstTasks.set(repo, reading);
-                            waits.push(findFirstTasks(repo, options.firstTaskRunner ?? execRun).then(found => { reading.found = found; }, () => { }).finally(() => { reading.reading = false; }));
+                            // A test's runner reads in-process; otherwise in a process of its own (learning-look.ts), so the hardened
+                            // git's synchronous reads of the project's folder never hold the console's thread.
+                            waits.push((options.firstTaskRunner !== undefined ? findFirstTasks(repo, options.firstTaskRunner) : firstTasksOffThread(repo)).then(found => { reading.found = found; }, () => { }).finally(() => { reading.reading = false; }));
                         }
                     }
                     // Learning recovered from reviewed runs (and a project's saved rows carried to its current identity), which
                     // Settings → Learning and Knowledge used to do as they opened.
                     if (lastChecks.due("learning", 10 * 60_000)) {
                         waits.push(lastChecks.run("learning", async () => {
+                            // Its reads of each project's Git folder are synchronous, so with a database file they run in a process of
+                            // their own (learning-look.ts): a folder that doesn't answer costs its own recovery, never the console. An
+                            // in-memory database (a test) can't be shared, so it is read here.
+                            if (databaseFile !== null) {
+                                await recoverLearningOffThread({ databaseFile, evidenceRoot, repos: managedRepos() }, options.learningRunner === undefined ? {} : { runner: options.learningRunner });
+                                return;
+                            }
                             for (const repo of managedRepos()) {
                                 try {
                                     acceptedIdentities(store, repo);
@@ -2012,6 +2033,11 @@ export function createDecisionServer(options) {
                     }
                     // What Codex has configured, per project, for Settings → Tools to offer.
                     for (const repo of managedRepos()) {
+                        // The project's own .mcp.json, read off the console's thread (folder-look.ts) for the Tools page and the lead.
+                        if (options.identities !== undefined && lastChecks.due(`project-mcp:${repo}`, 10 * 60_000)) {
+                            waits.push(lastChecks.run(`project-mcp:${repo}`, async () => { const looked = await lookProjectMcp(repo); if (looked.ok)
+                                savedProjectMcp.set(repo, looked.value); return looked.ok; }));
+                        }
                         if (lastChecks.due(`codex-tools:${repo}`, 10 * 60_000))
                             waits.push(lastChecks.run(`codex-tools:${repo}`, () => codexServers(repo)));
                     }
@@ -2220,6 +2246,7 @@ export function createDecisionServer(options) {
         get revisionLedgerOf() { return revisionLedgerOf; },
         get firstTasks() { return firstTasks; },
         get authenticateCredential() { return authenticateCredential; },
+        get identities() { return identities; },
     };
     const tasksHandlers = createTasksHandlers(handlerRuntime);
     const pagesHandlers = createPagesHandlers(handlerRuntime);