toolroll 0.9.82 → 0.9.83

package/dist/operate.js

@@ -110,7 +110,7 @@ import { claimInstance, clearInstance, openInstanceSocket } from "./console-inst
 import { authorizePlanUnderMode } from "./plan-auto.js";
 import { ghDispatchAdapter, mirrorTaskId, syncPass } from "./sync.js";
 import { LIVE_FILE_BOUND, LIVE_RETAIN_MS, sweepLiveLogs } from "./live.js";
-import { addRepos, removeRepos, updateRepos, loadRepos, loadProjectRegistry, updateProjectRegistry } from "./repos.js";
+import { addRepos, removeRepos, updateRepos, loadRepos, loadProjectRegistry, updateProjectRegistry, registryRemovals } from "./repos.js";
 import { deleteProject, holdingsWords, projectHoldings, projectRunning } from "./project-delete.js";
 import { pushPass } from "./push.js";
 import { chmodSync, closeSync, constants as fsConstants, existsSync, fstatSync, fsyncSync, openSync, readFileSync, readSync, realpathSync, renameSync, unlinkSync, writeSync, writeFileSync } from "node:fs";
@@ -181,6 +181,8 @@ import { createDecisionServer } from "./serve.js";
 import { readTailnetNames } from "./tailnet.js";
 import { daemonLaunchCommand, daemonStatus, installReplacingLegacy, installedLegacyDaemon, planDaemon, uninstallDaemon, awaitFreshHeartbeat, } from "./daemon.js";
 import { bridgePass, clearBotToken, createTransport, followBridge, hashPairingCode, loadBotToken, mintPairingCode, networkFence, networkFenceLine, redactToken, saveBotToken, PAIRING_TTL_MS, TOKEN_ENV, telegramHookSecret, telegramPushUrl, } from "./telegram.js";
+import { projectIdentities } from "./project-identity.js";
+import { lookIdentities } from "./folder-look.js";
 import { scanRepo } from "./capscan.js";
 import { computeGaps, describeCapability } from "./gaps.js";
 import { ask as promptAsk, askHidden as promptHidden, confirm as promptConfirm, interactive as promptInteractive, underAgent } from "./prompt.js";
@@ -3939,7 +3941,13 @@ async function startConsole(options) {
     const { context } = options;
     // A git incident (teardown-git.ts) raises an attention notification in this console's outbox.
     noticeGitIncidents(context.store, context.clock);
+    // Every project folder this console starts with is resolved off its thread, under a deadline: one that doesn't
+    // answer (a drive away, an iCloud folder macOS is holding) stays unresolved, kept restrictive, and is looked at again
+    // by the background pass; the console starts and answers either way (project-identity.ts).
+    const identities = projectIdentities();
+    await identities.refresh([...options.repos ?? [], ...options.projectRoots ?? [], ...context.store.listProjects().map(one => one.path), ...context.store.knownRepos()]);
     const server = createDecisionServer({
+        identities,
         store: context.store,
         // Sign-in, integration and model checks, and the tidy-ups no page visit does (docs/plans/get-side-effects.md).
         backgroundChecks: true,
@@ -7055,6 +7063,8 @@ async function upCommand(flags, context) {
     // folders they may be added from are installation state, not arguments a
     // person must repeat on every start.
     const registryPath = registryPathOf(context);
+    // Read before the list itself: a line removed after this (even if saved again) counts differently from now on.
+    const removalsAtStart = registryRemovals(registryPath);
     const loadedRegistry = await loadProjectRegistry(registryPath);
     if ("error" in loadedRegistry)
         return fail(write, json, "up", "registry", loadedRegistry.error, EXIT.refused);
@@ -7078,23 +7088,28 @@ async function upCommand(flags, context) {
     // soon as a projects folder or saved repository exists.
     const repos = [];
     const proveRepo = async (input) => {
-        const top = await gitRun("git", ["rev-parse", "--show-toplevel"], { cwd: resolve(input) });
-        if (top.code !== 0)
-            return null;
-        try {
-            return realpathSync(top.stdout.trim());
-        }
-        catch {
-            return null;
-        }
+        // The checkout's real path is read off the thread, under a deadline (folder-look.ts): a folder that doesn't answer
+        // is unavailable, never a wait.
+        return (await upProveSaved(gitRun, input))?.root ?? null;
     };
+    // A saved project that doesn't answer now (a drive not connected, a folder macOS is holding) is looked at again
+    // while this start runs, and connects once it answers (upDeferredRetry).
+    const deferredRepos = [];
+    const deferredGenerations = {};
+    // The saved line(s) each project was proved from, so its removal is judged by its own line alone.
+    const repoLines = {};
     for (const input of loadedRegistry.repos) {
         const root = await proveRepo(input);
         if (root === null) {
-            progress(`saved project unavailable — skipped ${input}`);
+            progress(`saved project unavailable — skipped ${input}; it connects when it's back`);
+            deferredRepos.push(input);
+            // An unreadable removal record leaves no count that could match later: the authority can't be used.
+            deferredGenerations[input] = removalsAtStart === null ? -1 : removalsAtStart[input] ?? 0;
         }
-        else if (!repos.includes(root)) {
-            repos.push(root);
+        else {
+            if (!repos.includes(root))
+                repos.push(root);
+            (repoLines[root] ??= []).push(input);
         }
     }
     const explicitRepos = context.repoList ?? [];
@@ -7118,7 +7133,9 @@ async function upCommand(flags, context) {
         if (cwdRepo !== null)
             pinnedRepos.add(cwdRepo);
     }
-    if (repos.length === 0 && projectRoots.length === 0)
+    // Saved projects that are only away for now still start the service: it serves an empty, restrictive set until they
+    // answer (never the unscoped mode), and connects each as it comes back.
+    if (repos.length === 0 && projectRoots.length === 0 && deferredRepos.length === 0)
         return fail(write, json, "up", "no-projects", "choose where your projects live once: `toolroll up --project-root <dir>`", EXIT.refused);
     // A person at a terminal reads three lines (onboarding); the folders are for --verbose, a service log, or an agent.
     const quietStart = !json && !flags.has("verbose") && (context.upSeams?.terminal ?? process.stdout.isTTY === true) && !underAgent(context.upSeams?.env ?? process.env);
@@ -7376,6 +7393,9 @@ async function upCommand(flags, context) {
                 type: "start", role: "worker", databaseFile: context.databaseFile, containment: containmentFlag, build,
                 config: {
                     runner: runnerName, token: runnerToken, repos: generation === 1 ? [...repos] : [...currentRepos], pinnedRepos: [...pinnedRepos], projectRoots, registryPath, pool,
+                    // What this start still holds for its saved projects that were away: a restarted worker never gets back an
+                    // authority an earlier one gave up (connected, or removed from the saved list).
+                    deferredRepos: [...deferredRepos], deferredGenerations: { ...deferredGenerations }, repoLines,
                     forMs: forGiven === undefined ? null : Number(forGiven), publicUrl: publicUrlFlag ?? null, stopGraceMs, verbose: flags.has("verbose"),
                     terminal: context.upSeams?.terminal ?? process.stdout.isTTY === true,
                     // A restart waits out a crashed predecessor's lease (at most a minute), then recovers it: as a fresh `up` after a crash.
@@ -7385,6 +7405,12 @@ async function upCommand(flags, context) {
             onMessage: message => {
                 if (message.type === "log")
                     roleLine("worker")(message.line);
+                else if (message.type === "deferred") {
+                    // Only ever narrows: a worker's word can't give back an authority this start no longer holds.
+                    const narrowed = upNarrowDeferred(deferredRepos, message.repos);
+                    deferredRepos.length = 0;
+                    deferredRepos.push(...narrowed);
+                }
                 else if (message.type === "repos") {
                     // The console's admitted projects widen only to what the builder is bound to in the store (the worker binds
                     // through the authenticated door before it reports): a worker's word alone admits nothing.
@@ -12093,15 +12119,9 @@ async function runUpWorkerRole(context, config, port, build) {
     const pinnedRepos = new Set(config.pinnedRepos);
     const gitRun = context.gitRunner ?? ((file, args, opts) => run(file, [...args], { ...(opts?.cwd === undefined ? {} : { cwd: opts.cwd }), timeoutMs: 10_000 }));
     const proveRepo = async (input) => {
-        const top = await gitRun("git", ["rev-parse", "--show-toplevel"], { cwd: resolve(input) });
-        if (top.code !== 0)
-            return null;
-        try {
-            return realpathSync(top.stdout.trim());
-        }
-        catch {
-            return null;
-        }
+        // The checkout's real path is read off the thread, under a deadline (folder-look.ts): a folder that doesn't answer
+        // is unavailable, never a wait.
+        return (await upProveSaved(gitRun, input))?.root ?? null;
     };
     // The proved set this worker builds; `up` relays each change to the console.
     const activeRepos = new Set(config.repos);
@@ -12286,8 +12306,17 @@ async function runUpWorkerRole(context, config, port, build) {
             await pause(follower === null ? 2_000 : 5_000);
         }
     })();
-    const dynamicCeiling = resolveCeiling(config.repos, config.projectRoots).ceiling;
+    // The start's own projects and folders were resolved by `up`: taken as they are, never read again on this thread.
+    const dynamicCeiling = resolveCeiling(config.repos, config.projectRoots, path => resolve(path)).ceiling;
     const rejected = new Set();
+    // Saved lines' identities, resolved off the thread under a deadline (project-identity.ts): a line whose folder
+    // doesn't answer is skipped this pass, and never holds up the others.
+    const lineIdentities = projectIdentities();
+    /** The saved line(s) each active project came from: `up`'s proof for the start's own, the line admitted for later ones. */
+    const admittedLines = new Map(Object.entries(config.repoLines ?? {}));
+    const deferred = upDeferredRetry(config.deferredRepos ?? [], input => upProveSaved(gitRun, input));
+    const deferredGenerations = config.deferredGenerations ?? {};
+    const reportDeferred = () => port.send({ type: "deferred", repos: deferred.list() });
     const registrySupervisor = (async () => {
         const sleep = (ms) => new Promise(resolveSleep => setTimeout(resolveSleep, ms));
         while (!stopping) {
@@ -12297,11 +12326,19 @@ async function runUpWorkerRole(context, config, port, build) {
                 stop();
                 break;
             }
+            // A saved line removed while this start runs takes the start's authority for it with it, for good.
+            if (deferred.keepOnly(loaded.repos))
+                reportDeferred();
+            const plain = loaded.repos.filter(one => !deferred.has(one));
+            await lineIdentities.refresh(plain);
             // Removed from the saved list: stop building it and take it out of the console. A pinned start keeps its own.
-            const saved = new Set(loaded.repos.map(one => canonicalProject(one) ?? one));
+            // Each project is judged by its own saved line (the one it was proved or admitted from, or itself), never by
+            // whether some other folder answered: an unrelated folder that is away never keeps a removed project building.
+            const saved = new Set(loaded.repos);
             let removed = false;
             for (const repo of [...activeRepos]) {
-                if (stopping || pinnedRepos.has(repo) || saved.has(repo))
+                const lines = admittedLines.get(repo) ?? [repo];
+                if (stopping || pinnedRepos.has(repo) || saved.has(repo) || lines.some(line => saved.has(line)))
                     continue;
                 activeRepos.delete(repo);
                 removed = true;
@@ -12314,12 +12351,23 @@ async function runUpWorkerRole(context, config, port, build) {
             for (const candidate of loaded.repos) {
                 if (stopping)
                     break;
-                const canonical = canonicalProject(candidate);
+                // Skipped at start because it didn't answer: connected on the start's own authority once it does.
+                if (deferred.has(candidate)) {
+                    await connectDeferred(candidate);
+                    continue;
+                }
+                const canonical = lineIdentities.known(candidate);
+                // Not answered yet: looked at again on the next pass.
+                if (canonical === undefined)
+                    continue;
                 // Still letting go of an earlier removal: it rejoins on the next pass after its watch has stopped.
                 if (canonical !== null && (activeRepos.has(canonical) || releasedRepos.has(canonical)))
                     continue;
                 const approvedAdditions = context.additionalProjectRepos?.() ?? [];
-                const admittedCeiling = resolveCeiling([...dynamicCeiling.repos, ...approvedAdditions], dynamicCeiling.roots).ceiling;
+                // A start serving nothing yet (its saved projects all away) is an empty ceiling, never the unscoped mode: a
+                // name that matches no path stands in, so a line saved later still needs its recorded admission.
+                const admittedRepos = [...dynamicCeiling.repos, ...approvedAdditions];
+                const admittedCeiling = { repos: admittedRepos.length === 0 && dynamicCeiling.roots.length === 0 ? ["/\0nothing-admitted"] : admittedRepos, roots: dynamicCeiling.roots, canon: (path) => lineIdentities.known(path) ?? null };
                 // A project added after this start (`repos add`, the lead, the console) carries its recorded admission; a
                 // registry line alone is not authority. Either way the folder is proved to be that Git checkout again.
                 const allowed = canonical !== null &&
@@ -12333,6 +12381,7 @@ async function runUpWorkerRole(context, config, port, build) {
                     continue;
                 }
                 rejected.delete(candidate);
+                admittedLines.set(canonical, [...new Set([...admittedLines.get(canonical) ?? [], candidate])]);
                 await launchRepo(canonical, true);
             }
             if (!stopping)
@@ -12342,6 +12391,61 @@ async function runUpWorkerRole(context, config, port, build) {
         fatal = `the project registry stopped (${describe(error)})`;
         stop();
     });
+    /**
+     * A saved project the start couldn't reach, back now: connected only as the very folder that was saved (a parent
+     * checkout found because the saved one lost its .git is another project, needing its own admission), and only while
+     * the line is still saved, checked under the saved list's lock with the binding made inside it, so a removal racing
+     * the proof always wins.
+     */
+    async function connectDeferred(candidate) {
+        const proved = await deferred.retry(candidate);
+        if (proved === null || stopping)
+            return;
+        // Only the very folder that was saved: the saved line must still resolve to itself, and git's checkout must be that
+        // folder. A parent checkout, or the saved path now leading somewhere else, is another project needing admission.
+        if (proved.line !== candidate || proved.root !== candidate) {
+            deferred.revoke(candidate);
+            reportDeferred();
+            progress(proved.root !== proved.line
+                ? `saved project not connected — ${candidate} came back as part of ${proved.root}; add it again to connect it`
+                : `saved project not connected — ${candidate} now leads to ${proved.line}; add it again to connect it`);
+            return;
+        }
+        const root = candidate;
+        if (activeRepos.has(root) || releasedRepos.has(root)) {
+            deferred.revoke(candidate);
+            reportDeferred();
+            return;
+        }
+        // Bound under the saved list's lock: the line is still saved AND has not been removed since this start read it
+        // (its removal count unchanged, so a removal and a save again during the proof still counts as removed).
+        let launching = null;
+        let removedSince = false;
+        await updateProjectRegistry(registryPath, current => {
+            if (stopping || !deferred.has(candidate))
+                return current;
+            const count = registryRemovals(registryPath)?.[candidate] ?? (registryRemovals(registryPath) === null ? -2 : 0);
+            if (!current.repos.includes(candidate) || count !== deferredGenerations[candidate]) {
+                deferred.revoke(candidate);
+                removedSince = true;
+                return current;
+            }
+            deferred.revoke(candidate);
+            admittedLines.set(root, [candidate]);
+            launching = launchRepo(root, true);
+            return current;
+        });
+        if (removedSince) {
+            reportDeferred();
+            progress(`saved project not connected — ${candidate} was removed while it was away; add it again to connect it`);
+            return;
+        }
+        if (launching === null)
+            return;
+        reportDeferred();
+        progress(`saved project is back — connecting ${root}`);
+        await launching;
+    }
     // Provider readiness (v47): this machine's non-spending observations, recorded under its own runner name ONCE at
     // start — so every route projection can say ready / unavailable / unknown per provider, and the dispatch gate can
     // halt a leg this machine cannot run. Production only: a test's injected agent runner is a fake, and its readiness
@@ -12530,3 +12634,57 @@ async function evalsAbandonCommand(flags, context) {
         return fail(write, json, command, ended.reason, ended.message, EXIT.refused);
     return succeed(write, json, command, { campaign: id, state: "incomplete", attempts: ended.attempts, spending: "unknown" }, () => [`Campaign ${id} ended incomplete. ${ended.attempts} unfinished attempt${ended.attempts === 1 ? "" : "s"} recorded as errors; what it spent is unknown. Nothing was stopped: check for its processes yourself.`]);
 }
+/**
+ * The saved projects an `up` start couldn't reach (upCommand): each is proved again every `everyMs` while the worker
+ * runs, by `prove` (upProveSaved), so a folder that answers again connects without a restart. Only what the start itself
+ * read from the saved list is here, and the set only shrinks: a line connected, removed from the saved list
+ * (`keepOnly`) or come back as some other checkout (`revoke`) is gone for good, so a line saved again later needs its
+ * recorded admission like any other addition. `retry` answers the proof when one is due and answered, else null.
+ */
+export function upDeferredRetry(inputs, prove, everyMs = 5_000, now = Date.now) {
+    // Wall time, not the store's clock (a test's may stand still): this is only how often a folder is asked.
+    const nextAt = new Map(inputs.map(input => [input, now() + everyMs]));
+    return {
+        has: input => nextAt.has(input),
+        list: () => [...nextAt.keys()],
+        retry: async (input) => {
+            const due = nextAt.get(input);
+            if (due === undefined || now() < due)
+                return null;
+            nextAt.set(input, now() + everyMs);
+            return prove(input);
+        },
+        revoke: input => { nextAt.delete(input); },
+        keepOnly: saved => {
+            const keep = new Set(saved);
+            let changed = false;
+            for (const input of [...nextAt.keys()])
+                if (!keep.has(input)) {
+                    nextAt.delete(input);
+                    changed = true;
+                }
+            return changed;
+        },
+    };
+}
+/**
+ * Whether a saved project's folder is a Git checkout now, read without blocking this thread: `git rev-parse
+ * --show-toplevel` (bounded, its own process), then the real paths of the saved line and of the checkout, resolved off
+ * the thread under a deadline (folder-look.ts). Null when it isn't one, or didn't answer.
+ */
+export async function upProveSaved(gitRun, input, look = {}) {
+    const top = await gitRun("git", ["rev-parse", "--show-toplevel"], { cwd: resolve(input) });
+    if (top.code !== 0)
+        return null;
+    const answered = await lookIdentities([resolve(input), top.stdout.trim()], look);
+    if (!answered.ok)
+        return null;
+    const line = answered.value.get(resolve(input)) ?? null, root = answered.value.get(top.stdout.trim()) ?? null;
+    return line === null || root === null ? null : { line, root };
+}
+/** What `up` hands its next worker after the worker reports which saved projects it still holds start authority for:
+ * only what both still hold. A worker's report can give up an authority, never add or give back one. */
+export function upNarrowDeferred(held, reported) {
+    const kept = new Set(reported);
+    return held.filter(one => kept.has(one));
+}

package/dist/project-identity.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Project identities as the console uses them, without touching a person's folders on its thread.
+ *
+ * A project's identity is its real path (project.ts canonicalProject). Resolving one reads the folder, and a folder can
+ * stop answering (folder-look.ts), so the console never resolves one on a page or at startup on its own thread:
+ *
+ * - `hot` (display and grouping only): the last answer, else the path as saved. Nothing is started by asking.
+ * - `strict` (visibility and authorization): only a resolved identity; an unknown one fails closed until the next
+ *   refresh resolves it, so a stored path that leads outside its root never passes on its spelling.
+ * - `vouched` (a path a request names): only a path whose identity is known, or one that is exactly a saved identity.
+ *   Anything else is refused this time and resolved by the next background pass, never resolved inline.
+ * - `resolveNow` (an action that needs a path checked now, a POST): resolved off the thread under the look's deadline.
+ * - `refresh` (the console's start and its background pass): resolves what was asked about and what has gone stale.
+ *
+ * An embedder or test that passes no identities gets `syncProjectIdentities`: the old synchronous reads, unchanged.
+ */
+import { type FolderLookOptions } from "./folder-look.js";
+export type ProjectIdentities = {
+    /** For display and grouping only: the last known identity, else the path as saved (resolved lexically). Reads
+     * nothing. Never an authorization answer: use `strict`. */
+    hot: (path: string) => string;
+    /** For authorization: the known real folder path, else null (unknown or not a folder: fail closed until resolved).
+     * Reads nothing; an unknown path is asked about on the next refresh. */
+    strict: (path: string) => string | null;
+    /** The known identity: a real folder path, null (not a folder), or undefined (never answered). Reads nothing. */
+    known: (path: string) => string | null | undefined;
+    /** A request's path: its known identity, or the path itself when it is exactly one of `saved` (projects the plane
+     * itself proved and admitted); else undefined. */
+    vouched: (path: string, saved: () => Iterable<string>) => string | undefined;
+    /** This path's identity now, off the thread: a real folder path, null, or "no-answer" past the deadline. */
+    resolveNow: (path: string) => Promise<string | null | "no-answer">;
+    /** Resolve `paths`, everything asked about since, and answers older than a minute. False when some didn't answer. */
+    refresh: (paths: Iterable<string>) => Promise<boolean>;
+};
+export declare function projectIdentities(look?: FolderLookOptions, now?: () => number): ProjectIdentities;
+/** The synchronous reads, as before: for embedders and tests that pass no identities. */
+export declare function syncProjectIdentities(): ProjectIdentities;

package/dist/project-identity.js

@@ -0,0 +1,106 @@
+/**
+ * Project identities as the console uses them, without touching a person's folders on its thread.
+ *
+ * A project's identity is its real path (project.ts canonicalProject). Resolving one reads the folder, and a folder can
+ * stop answering (folder-look.ts), so the console never resolves one on a page or at startup on its own thread:
+ *
+ * - `hot` (display and grouping only): the last answer, else the path as saved. Nothing is started by asking.
+ * - `strict` (visibility and authorization): only a resolved identity; an unknown one fails closed until the next
+ *   refresh resolves it, so a stored path that leads outside its root never passes on its spelling.
+ * - `vouched` (a path a request names): only a path whose identity is known, or one that is exactly a saved identity.
+ *   Anything else is refused this time and resolved by the next background pass, never resolved inline.
+ * - `resolveNow` (an action that needs a path checked now, a POST): resolved off the thread under the look's deadline.
+ * - `refresh` (the console's start and its background pass): resolves what was asked about and what has gone stale.
+ *
+ * An embedder or test that passes no identities gets `syncProjectIdentities`: the old synchronous reads, unchanged.
+ */
+import { resolve } from "node:path";
+import { lookIdentities } from "./folder-look.js";
+import { canonicalProject } from "./project.js";
+/** How long an answer stands before the background pass resolves the path again. */
+const STALE_MS = 60_000;
+export function projectIdentities(look = {}, now = Date.now) {
+    const answers = new Map();
+    const wanted = new Set();
+    const known = (path) => answers.get(resolve(path))?.real;
+    const store = (found) => {
+        const at = now();
+        for (const [path, real] of found) {
+            answers.set(resolve(path), { real, at });
+            wanted.delete(resolve(path));
+            // A real path is its own identity.
+            if (real !== null)
+                answers.set(real, { real, at });
+        }
+    };
+    const resolveNow = async (path) => {
+        const looked = await lookIdentities([resolve(path)], look);
+        if (!looked.ok)
+            return "no-answer";
+        store(looked.value);
+        return looked.value.get(resolve(path)) ?? null;
+    };
+    return {
+        hot: path => {
+            const key = resolve(path);
+            const answer = answers.get(key);
+            if (answer === undefined)
+                wanted.add(key);
+            return answer?.real ?? key;
+        },
+        known,
+        strict: path => {
+            const key = resolve(path);
+            const answer = answers.get(key);
+            if (answer === undefined)
+                wanted.add(key);
+            return answer?.real ?? null;
+        },
+        vouched: (path, saved) => {
+            const key = resolve(path);
+            const answer = answers.get(key);
+            if (answer !== undefined && answer.real !== null)
+                return answer.real;
+            for (const one of saved())
+                if (one === key)
+                    return key;
+            wanted.add(key);
+            return undefined;
+        },
+        resolveNow,
+        refresh: async (paths) => {
+            const at = now();
+            const due = new Set(wanted);
+            for (const one of paths) {
+                const key = resolve(one);
+                const answer = answers.get(key);
+                if (answer === undefined || at - answer.at >= STALE_MS)
+                    due.add(key);
+            }
+            for (const [key, answer] of answers)
+                if (at - answer.at >= STALE_MS)
+                    due.add(key);
+            if (due.size === 0)
+                return true;
+            const batch = await lookIdentities([...due], look);
+            if (batch.ok) {
+                store(batch.value);
+                return true;
+            }
+            // One folder that doesn't answer mustn't hold the others: each on its own, in parallel (the looks are capped).
+            const each = await Promise.all([...due].map(one => resolveNow(one)));
+            return each.every(one => one !== "no-answer");
+        },
+    };
+}
+/** The synchronous reads, as before: for embedders and tests that pass no identities. */
+export function syncProjectIdentities() {
+    return {
+        hot: path => canonicalProject(path) ?? path,
+        known: path => canonicalProject(path),
+        strict: path => canonicalProject(path),
+        vouched: path => canonicalProject(path) ?? undefined,
+        resolveNow: async (path) => canonicalProject(path),
+        refresh: async () => true,
+    };
+}

package/dist/project-knowledge.d.ts

@@ -22,19 +22,17 @@ export type KnowledgeView = ReturnType<typeof knowledgeView>;
 export declare function knowledgeVersion(store: Store, repo: string, actor: string, revision: number): Knowledge;
 /** Chat reads only an admitted project. Keep the full source in the project UI. */
 export declare function conversationKnowledge(store: Store, repo: string, actor: string, reference?: string, decision?: number): {
-    title?: never;
-    content?: never;
     history?: never;
     revision: number;
     stale: boolean;
     notice: string;
     decision?: never;
+    title?: never;
+    content?: never;
     instructions?: never;
     references?: never;
     decisions?: never;
 } | {
-    title?: never;
-    content?: never;
     history?: never;
     stale?: never;
     decision: {
@@ -52,6 +50,8 @@ export declare function conversationKnowledge(store: Store, repo: string, actor:
         id: number;
     };
     notice: string;
+    title?: never;
+    content?: never;
     revision?: never;
     instructions?: never;
     references?: never;
@@ -68,10 +68,10 @@ export declare function conversationKnowledge(store: Store, repo: string, actor:
     references?: never;
     decisions?: never;
 } | {
-    title?: never;
-    content?: never;
     stale?: never;
     decision?: never;
+    title?: never;
+    content?: never;
     revision: number;
     history: {
         revision: number;

package/dist/project-tools.d.ts

@@ -103,7 +103,7 @@ export type FoundTool = {
  * Codex's (from `codex mcp list --json`, passed in). The first of each
  * name wins; unusable entries are left out.
  */
-export declare function discoverTools(repo: string, codexServers: unknown[] | null, home?: string, environment?: NodeJS.ProcessEnv): FoundTool[];
+export declare function discoverTools(repo: string, codexServers: unknown[] | null, home?: string, environment?: NodeJS.ProcessEnv, projectConfig?: Record<string, unknown> | null): FoundTool[];
 /** Start the server once, ask for its tools, and stop it: the proof a build can use it. */
 export declare function testTool(spec: ToolSpec, values: Record<string, string>, options: {
     timeoutMs?: number;
@@ -313,3 +313,6 @@ export declare function toolServerFor(store: ToolServerStore, repo: string, opti
     home?: string;
     available?: () => boolean;
 }): ToolServer;
+/** Each project's `.mcp.json` as the console last read it off its thread (its background pass): what its pages and the
+ * lead offer, so neither reads a project folder on the console's thread. */
+export declare const savedProjectMcp: Map<string, Record<string, unknown> | null>;

package/dist/project-tools.js

@@ -496,7 +496,7 @@ function fromCodexEntry(raw, environment) {
  * Codex's (from `codex mcp list --json`, passed in). The first of each
  * name wins; unusable entries are left out.
  */
-export function discoverTools(repo, codexServers, home = homedir(), environment = process.env) {
+export function discoverTools(repo, codexServers, home = homedir(), environment = process.env, projectConfig) {
     const found = [];
     const add = (one) => { if (one !== null && !found.some(other => other.spec.name === one.spec.name))
         found.push(one); };
@@ -509,7 +509,9 @@ export function discoverTools(repo, codexServers, home = homedir(), environment
             return null;
         }
     };
-    const project = readJson(join(repo, ".mcp.json"));
+    // The project's own file as given (the console reads it off its thread: folder-look.ts), else as last read there
+    // (savedProjectMcp), else read here (the CLI and the worker).
+    const project = projectConfig !== undefined ? projectConfig : savedProjectMcp.has(repo) ? savedProjectMcp.get(repo) ?? null : readJson(join(repo, ".mcp.json"));
     for (const [name, raw] of Object.entries((project?.["mcpServers"] ?? {})))
         add(fromClaudeEntry(name, raw, "this project's .mcp.json"));
     const claude = readJson(join(home, ".claude.json"));
@@ -1149,3 +1151,6 @@ export function toolServerFor(store, repo, options = {}) {
     const untrusted = existsSync(cache) ? [realpathSync(cache)] : [];
     return { fence: fenceFor("tool-server", { databaseFile, worktree: null, home, boundary: null, binding: null, runFolders: runFolders(null), poolRoots, extra: untrusted }) };
 }
+/** Each project's `.mcp.json` as the console last read it off its thread (its background pass): what its pages and the
+ * lead offer, so neither reads a project folder on the console's thread. */
+export const savedProjectMcp = new Map();

package/dist/project.d.ts

@@ -29,6 +29,9 @@ export type ProjectCeiling = {
     repos: readonly string[];
     /** Canonical directories: any git repo under one is authorized. */
     roots: readonly string[];
+    /** How this ceiling resolves a path it is asked about (project-identity.ts): the console's saved identities, which
+     * read no folder. Absent: canonicalProject, a synchronous read. */
+    canon?: (path: string) => string | null;
 };
 /**
  * Resolve the startup configuration once. A configured path that does not
@@ -36,7 +39,7 @@ export type ProjectCeiling = {
  * dropping would silently *widen* the server toward unscoped mode, and a
  * ceiling that loosens itself when a disk is unmounted is not a ceiling.
  */
-export declare function resolveCeiling(repos: readonly string[], roots: readonly string[]): {
+export declare function resolveCeiling(repos: readonly string[], roots: readonly string[], canon?: (path: string) => string | null | undefined): {
     ceiling: ProjectCeiling;
     unresolved: string[];
 };

package/dist/project.js

@@ -67,10 +67,10 @@ export async function projectSelection(paths, exec = run) {
  * dropping would silently *widen* the server toward unscoped mode, and a
  * ceiling that loosens itself when a disk is unmounted is not a ceiling.
  */
-export function resolveCeiling(repos, roots) {
+export function resolveCeiling(repos, roots, canon = canonicalProject) {
     const unresolved = [];
     const keep = (paths) => [...new Set(paths.map(path => {
-            const canonical = canonicalProject(path);
+            const canonical = canon(path) ?? null;
             if (canonical !== null)
                 return canonical;
             unresolved.push(path);
@@ -90,7 +90,7 @@ export function unscoped(ceiling) {
 export async function authorizedProject(ceiling, path, exec = run) {
     if (unscoped(ceiling))
         return true;
-    const canonical = canonicalProject(path);
+    const canonical = (ceiling.canon ?? canonicalProject)(path);
     if (canonical === null)
         return false;
     if (ceiling.repos.includes(canonical))
@@ -114,8 +114,15 @@ export function rowVisible(ceiling, repo) {
         return true;
     // Exact saved identities are common. Check the whole set before resolving
     // aliases, so the hundredth project does not stat the other99 directories.
-    if (ceiling.repos.includes(repo) || ceiling.repos.some(one => sameRepo(one, repo)))
+    const canon = ceiling.canon;
+    if (ceiling.repos.includes(repo) || ceiling.repos.some(one => canon === undefined ? sameRepo(one, repo) : (canon(one) ?? null) !== null && canon(one) === canon(repo)))
         return true;
+    // With a resolver (the console's saved identities), an identity it can't vouch for fails closed before any root is
+    // matched: a path's spelling never stands in for where it leads.
+    if (canon !== undefined) {
+        const resolved = canon(repo);
+        return resolved !== null && ceiling.roots.some(root => resolved.startsWith(root + sep));
+    }
     const canonical = canonicalProject(repo) ?? repo;
     return ceiling.roots.some(root => canonical.startsWith(root + sep));
 }

package/dist/repos.d.ts

@@ -57,4 +57,11 @@ export declare function updateProjectRegistry(file: string, transform: (registry
 } | RegistryUpdateFailure>;
 export declare function addRepos(existing: readonly string[], incoming: readonly string[]): string[];
 export declare function removeRepos(existing: readonly string[], targets: readonly string[]): string[];
+/** Beside the saved list: how many times each line has been removed from it (written under its lock). */
+export declare function registryRemovalsFile(file: string): string;
+/**
+ * How many times each saved line has been removed, as recorded under the saved list's lock. A file that can't be read
+ * as one answers null: its caller treats every line as changed (fail closed).
+ */
+export declare function registryRemovals(file: string): Record<string, number> | null;
 export {};