toolroll 0.9.81 → 0.9.83

package/dist/operate.d.ts

@@ -2,14 +2,16 @@ import { type IntegrationIo } from "./integrations.js";
 import { type OnboardIo } from "./agent-onboard.js";
 import { type Sizer } from "./task-sizing.js";
 import { type TriggerIo } from "./flow-triggers.js";
+import { type GhRead } from "./nightly-github.js";
 import type { StepIo } from "./flow-steps.js";
 import type { FetchLike } from "./flow-share.js";
 import { type Store } from "./store.js";
 import { type DispatchAdapter } from "./sync.js";
 import { type RolePort, type UpRoleStart } from "./up-processes.js";
 import { type TelegramTransport } from "./telegram.js";
+import { type FolderLookOptions } from "./folder-look.js";
 import { type LeadCliSeams } from "./lead-cli.js";
-import { type Principal, type RemoteSource } from "./operate-remote.js";
+import { type Principal, type RemoteRun, type RemoteSource } from "./operate-remote.js";
 import { type PublishExec } from "./publish.js";
 import { type Runner as CommandRunner } from "./builder.js";
 import { type ReleaseIo } from "./releases.js";
@@ -150,6 +152,79 @@ export declare function runOperateAs(argv: string[], opts: {
     tool?: string;
     options?: OperateOptions;
 }): Promise<number>;
+type Context = {
+    /** A remote run's person (runOperateAs): every credential check resolves to them. Absent for every local command. */
+    principal?: RemoteRun;
+    /** The lead token this command runs under: it signs in as its owner. */
+    leadToken?: string;
+    desktopIdentity?: string;
+    /** A desktop service directory is state, never an implicitly enrolled project. */
+    inferProjectFromCwd?: boolean;
+    /** Exact additions approved by the native project picker, independent of the enrollment registry. */
+    additionalProjectRepos?: () => readonly string[];
+    store: Store;
+    write: Write;
+    json: boolean;
+    /** Every --repo occurrence in order (arc 2) — only `up` reads it. */
+    repoList?: string[];
+    now: Date;
+    clock: () => Date;
+    evidenceRoot: string;
+    /** The directory holding the database — where credential files live. */
+    databaseFile: string;
+    /** Where `storage` looks for leftover test temp folders; default the temp folder and /tmp. */
+    tempRoots?: readonly string[];
+    /** The long-lived service's token: only a pass carrying it may start the automatic storage sweep. */
+    sweepOwner?: object;
+    telegramTokenFile: string;
+    agentRunner?: CommandRunner;
+    gitRunner?: CommandRunner;
+    telegramTransport?: TelegramTransport;
+    telegramEnv?: Record<string, string | undefined>;
+    /** Injected by tests: what `publish` runs for git and gh. */
+    publishExec?: PublishExec;
+    leadSeams?: LeadCliSeams;
+    /** Injected by tests: the external-dispatch gh surface. */
+    dispatchAdapter?: DispatchAdapter;
+    /** Injected by tests: how flow triggers reach GitHub (gh) and Linear (fetch), and where their secrets live. */
+    flowTriggerIo?: Partial<TriggerIo>;
+    /** Injected by tests: how flow check and update steps run commands and reach GitHub and Linear. */
+    flowStepIo?: Partial<StepIo>;
+    /** Injected by tests: how often a worker's flow passes run beside its builds (default FLOW_EVERY_MS). */
+    flowEveryMs?: number;
+    /** Injected by tests: the operating system this runs on (default process.platform). */
+    platform?: NodeJS.Platform;
+    /** Injected by tests: whether this machine has an OS fence for checks (default: probed). */
+    fenceAvailable?: () => boolean;
+    /** Injected by tests: how `flows import` fetches a flow file's address. */
+    flowFetch?: FetchLike;
+    integrationIo?: Partial<IntegrationIo>;
+    /**
+     * The stop fence (Codex M5-M8 audit, IV-1): set by the watch when a
+     * signal lands. A pass that sees true admits NOTHING more — no schedule
+     * fires, no claim, no run, no spawn. The in-flight build finishes under
+     * its own bounds (or the grace kill); admission is what stops.
+     */
+    shouldStop?: () => boolean;
+    /** A failed recovery pass pauses new admissions without stopping an owned build. */
+    shouldPauseAdmission?: () => boolean;
+    /** Test seam for task wait; production uses a timer. */
+    waitSleep?: (milliseconds: number) => Promise<void>;
+    releaseIo?: ReleaseIo;
+    installBin?: string;
+    onboardSeams?: OnboardSeams;
+    upSeams?: {
+        terminal?: boolean;
+        env?: Record<string, string | undefined>;
+        openBrowser?: (url: string) => void;
+    };
+    /** This process is one role of a `toolroll up`, started by it (never from the command line). */
+    upRole?: UpRoleHost;
+    /** In-memory seams a child process can't receive: `up` runs its console and worker in this one process. */
+    upOneProcess?: boolean;
+    /** Test seam: this computer's tailnet names (production asks `tailscale status`). */
+    tailnetNames?: () => Promise<readonly string[]>;
+};
 /** Durably create the login file BEFORE the bootstrap commits (arc 2
  * finding 27): exclusive, 0600, fsynced — file and directory both — so the
  * row only ever follows a durable secret. Throws on any failure. */
@@ -181,3 +256,50 @@ export type UpRoleHost = {
 /** A role child's whole run (up-role-child.ts): the ordinary command prelude (containment, secrets, limits), then the
  * role itself. Only a process started by `up` gets here; no command line selects a role. */
 export declare function runUpRole(start: UpRoleStart, port: RolePort): Promise<number>;
+/** GitHub's nightly as release debt (docs/plans/evals-nightly.md, part A): the watch loop's background read of each
+ * opted-in project's nightly runs, at most every 30 minutes, within a 60 s overall deadline, through the plane's own gh
+ * (release-adapters.ts githubReads). Nothing is read for a project that never opted in. */
+export declare function refreshGithubNightlies(store: Store, now: () => Date, reads?: GhRead): Promise<number>;
+/**
+ * `toolroll evals run | attempt | cases | recover` (docs/plans/evals-nightly.md, part C).
+ *
+ * - `run [--diagnostic] [--case a,b] [--k n] --as <you> --token <password>`: admit a campaign (a person's proof, the
+ *   no release busy) and run it to its end from this installed plane. With no flags it is canonical,
+ *   refused while any case is a draft. Each attempt is a child process: `evals attempt`.
+ * - `attempt <campaign> <case> <n> --world <dir> --db <world db>`: one attempt's world (eval-world.ts). Only under its
+ *   runner's dispatch gate, and only on the world's own database.
+ * - `cases`: each installed case, its version, its pin, and whether a person has validated it yet.
+ * - `recover [--abandon <campaign>]`: settle campaigns whose runner stopped; with --abandon, a person ends a stuck one.
+ */
+export declare function evalsCommand(positional: readonly string[], flags: Map<string, string | true>, context: Context): Promise<number>;
+/**
+ * The saved projects an `up` start couldn't reach (upCommand): each is proved again every `everyMs` while the worker
+ * runs, by `prove` (upProveSaved), so a folder that answers again connects without a restart. Only what the start itself
+ * read from the saved list is here, and the set only shrinks: a line connected, removed from the saved list
+ * (`keepOnly`) or come back as some other checkout (`revoke`) is gone for good, so a line saved again later needs its
+ * recorded admission like any other addition. `retry` answers the proof when one is due and answered, else null.
+ */
+export declare function upDeferredRetry<T>(inputs: readonly string[], prove: (input: string) => Promise<T | null>, everyMs?: number, now?: () => number): {
+    has: (input: string) => boolean;
+    list: () => string[];
+    retry: (input: string) => Promise<T | null>;
+    revoke: (input: string) => void;
+    keepOnly: (saved: readonly string[]) => boolean;
+};
+/**
+ * Whether a saved project's folder is a Git checkout now, read without blocking this thread: `git rev-parse
+ * --show-toplevel` (bounded, its own process), then the real paths of the saved line and of the checkout, resolved off
+ * the thread under a deadline (folder-look.ts). Null when it isn't one, or didn't answer.
+ */
+export declare function upProveSaved(gitRun: (file: string, args: readonly string[], opts?: {
+    cwd?: string;
+}) => Promise<{
+    code: number | null;
+    stdout: string;
+}>, input: string, look?: FolderLookOptions): Promise<{
+    line: string;
+    root: string;
+} | null>;
+/** What `up` hands its next worker after the worker reports which saved projects it still holds start authority for:
+ * only what both still hold. A worker's report can give up an authority, never add or give back one. */
+export declare function upNarrowDeferred(held: readonly string[], reported: readonly string[]): string[];