toolroll 0.9.82 → 0.9.83

package/dist/repos.js

@@ -10,6 +10,7 @@
  * to edit it by hand or check it into their dotfiles — which also means it is
  * untrusted input and gets validated like any other.
  */
+import { closeSync as closeFd, constants as fsConstants, fstatSync, openSync as openFd, readSync, renameSync as renameFile, writeFileSync } from "node:fs";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { dirname } from "node:path";
 import { configBase, namedPath } from "./names.js";
@@ -213,6 +214,11 @@ export async function updateProjectRegistry(file, transform) {
             held = false; // abandon: no unlink, no publication
             return { ok: false, reason: "abandoned", message: "the registry lock aged out before the update could publish — nothing changed; try again" };
         }
+        // Each line this update removes counts one more removal, written BEFORE the list is published: whoever holds a
+        // start's authority for a saved line (upDeferredRetry) sees that it was removed, even if it was saved again since.
+        const gone = current.repos.filter(one => !next.repos.includes(one));
+        if (gone.length > 0)
+            bumpRegistryRemovals(file, gone, `${process.pid}.${token.slice(0, 8)}`);
         const temp = `${file}.${process.pid}.${token.slice(0, 8)}.tmp`;
         const fd = openSync(temp, "wx");
         writeSync(fd, `${JSON.stringify({ version: CONFIG_VERSION, ...next }, null, 2)}
@@ -267,3 +273,54 @@ function readProjectRegistry(parsed) {
 function sortUnique(repos) {
     return [...new Set(repos)].sort();
 }
+/** Beside the saved list: how many times each line has been removed from it (written under its lock). */
+export function registryRemovalsFile(file) {
+    return `${file}.removals.json`;
+}
+/**
+ * How many times each saved line has been removed, as recorded under the saved list's lock. A file that can't be read
+ * as one answers null: its caller treats every line as changed (fail closed).
+ */
+export function registryRemovals(file) {
+    let fd;
+    try {
+        fd = openFd(registryRemovalsFile(file), fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW | fsConstants.O_NONBLOCK);
+    }
+    catch (error) {
+        return error.code === "ENOENT" ? {} : null;
+    }
+    try {
+        const held = fstatSync(fd);
+        if (!held.isFile() || held.size > 4 * 1024 * 1024)
+            return null;
+        const buffer = Buffer.alloc(held.size);
+        const read = held.size === 0 ? 0 : readSync(fd, buffer, 0, buffer.length, 0);
+        const parsed = JSON.parse(buffer.toString("utf8", 0, read));
+        if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
+            return null;
+        const out = {};
+        for (const [line, count] of Object.entries(parsed)) {
+            if (!Number.isSafeInteger(count) || count < 0)
+                return null;
+            out[line] = count;
+        }
+        return out;
+    }
+    catch {
+        return null;
+    }
+    finally {
+        closeFd(fd);
+    }
+}
+/** One more removal for each of `lines`, written whole and renamed into place. Called only under the list's lock. */
+function bumpRegistryRemovals(file, lines, tag) {
+    const kept = registryRemovals(file);
+    // An unreadable record starts again from the clock, so no count read before can come round again.
+    const counts = kept ?? {};
+    for (const line of lines)
+        counts[line] = kept === null ? Date.now() : (counts[line] ?? 0) + 1;
+    const temp = `${registryRemovalsFile(file)}.${tag}.tmp`;
+    writeFileSync(temp, `${JSON.stringify(counts)}\n`, { flag: "wx", mode: 0o600 });
+    renameFile(temp, registryRemovalsFile(file));
+}

package/dist/serve.js

@@ -1,5 +1,7 @@
 import { secretFolder } from "./tool-secret-store.js";
 import { acceptedIdentities, recoverLearning } from "./project-learning.js";
+import { syncProjectIdentities } from "./project-identity.js";
+import { firstTasksOffThread, recoverLearningOffThread } from "./learning-look.js";
 import { loadOrCreateVapidKeys } from "./push.js";
 import { checkoutPlan } from "./checkout-cleanup.js";
 import { latestReleaseFor } from "./server/render-settings.js";
@@ -38,7 +40,8 @@ import { asReadOnlyRequest } from './read-only-request.js';
 import { connectionsOf, localConnectOf, oneClickOf } from "./mcp-connect.js";
 import { MOBILE_VIEWPORT_SCRIPT } from "./mobile-viewport.js";
 import { projectAuthority } from "./project-access.js";
-import { discoverTools, projectToolsOf, secretsSetFor, TOOL_CATALOG, toolSecretStorage, toolStanding } from "./project-tools.js";
+import { discoverTools, projectToolsOf, savedProjectMcp, secretsSetFor, TOOL_CATALOG, toolSecretStorage, toolStanding } from "./project-tools.js";
+import { lookProjectMcp } from "./folder-look.js";
 import { toolRefusal } from "./policy.js";
 import { isEdgeAddress, refuseEdge } from "./server/edge-refusal.js";
 import { announcePasswordBearer, isPasswordBearer, PASSWORD_BEARER_REFUSED, passwordBearerAccepted } from "./password-bearer.js";
@@ -166,6 +169,9 @@ import { loadConsoleUrl } from "./webhooks.js";
 import { reviewFactsOf } from "./workspace-ui.js";
 import { WorktreePool } from "./worktree.js";
 export function createDecisionServer(options) {
+    // Identities come from what the console's start resolved off its thread (startConsole); a path that didn't answer
+    // stays unresolved, kept restrictive. Without them (embedders, tests) the old synchronous reads apply.
+    const identities = options.identities ?? syncProjectIdentities();
     const { projectFamilyPeek, familiesInView, familyTasksInView, revisionDestination, runIsLive, runIsTaskResult, revisionViewOf, taskViewData, routeViewOf, taskChatFocus, pullRequestTargetOf, failureOf, explainAttempt, taskScreen, armTaskResume, planViewOf, planContractViewOf, revisionDocOf, revisionLedgerOf, resultDetailOf } = createTaskViews({
         get store() { return store; },
         get projectCounts() { return projectCounts; },
@@ -188,6 +194,7 @@ export function createDecisionServer(options) {
     const { authenticateApprover, authenticateCredential, authorizeMutation, projectOf, projectRequestAllowed, identify, lookupSession, restricted, visible, admissionList, codingActorAllowed, codingProjectAllowed, workAccess, familyOf, taskRepoOf, runVisible } = createSharedGuards({
         get store() { return store; },
         get liveCeiling() { return liveCeiling; },
+        identities,
         get codingProjects() { return codingProjects; },
         get unscopedMode() { return unscopedMode; },
         get managedRepos() { return managedRepos; },
@@ -448,18 +455,20 @@ export function createDecisionServer(options) {
     const approvalNonces = new Map();
     // Resolve startup authority once. Missing paths remain restrictive.
     // Native additions come only from the controller after its admission checks.
-    const { ceiling, unresolved: unresolvedRepos } = resolveCeiling([...(options.repo === undefined ? [] : [options.repo]), ...(options.repos ?? [])], options.projectRoots ?? []);
+    const { ceiling: startCeiling, unresolved: unresolvedRepos } = resolveCeiling([...(options.repo === undefined ? [] : [options.repo]), ...(options.repos ?? [])], options.projectRoots ?? [], options.identities === undefined ? undefined : identities.known);
+    const ceiling = { ...startCeiling, canon: identities.strict };
     /** The project every fresh session opens with: the sole configured repo, else none. */
     const defaultProject = ceiling.repos.length === 1 && ceiling.roots.length === 0 ? ceiling.repos[0] : null;
     /** No ceiling configured at all: the legacy trust-everything mode, named. */
-    const unscopedMode = ceiling.repos.length === 0 && ceiling.roots.length === 0;
+    // An `up` console (it is handed its admitted set) is never unscoped: with every saved project away it is empty.
+    const unscopedMode = ceiling.repos.length === 0 && ceiling.roots.length === 0 && options.admittedRepos === undefined;
     /** Per-row visibility under the ceiling — the authorization question for reads. */
     /** The exact repositories this console serves now: `up`'s live admitted set when it supplies one, else startup's. */
     const exactRepos = () => options.admittedRepos?.() ?? ceiling.repos;
     const liveCeiling = () => {
         const repos = [...exactRepos(), ...(options.additionalProjectRepos?.() ?? [])];
         // An admitted set that is empty for now is an empty ceiling, never the legacy unscoped mode.
-        return { repos: repos.length === 0 && ceiling.roots.length === 0 && !unscopedMode ? [NO_PROJECT] : repos, roots: ceiling.roots };
+        return { repos: repos.length === 0 && ceiling.roots.length === 0 && !unscopedMode ? [NO_PROJECT] : repos, roots: ceiling.roots, canon: identities.strict };
     };
     /** The explicit, currently proved project list. The callback is supplied
      * only by `up`, after it has independently checked git-ness and the root
@@ -479,7 +488,7 @@ export function createDecisionServer(options) {
         const repos = [];
         const gone = goneRepos();
         for (const path of [...exactRepos(), ...(options.currentRepos?.() ?? [])]) {
-            const canonical = canonicalProject(path) ?? path;
+            const canonical = identities.hot(path);
             if (seen.has(canonical) || !visible(canonical) || gone.has(canonical))
                 continue;
             seen.add(canonical);
@@ -568,7 +577,8 @@ export function createDecisionServer(options) {
             // A service that connects by signing in (or an app's own Connect) is offered only that way.
             catalog: TOOL_CATALOG.filter(one => !names.has(one.name) && oneClickOf(one.name) === null && localConnectOf(one.name) === null),
             connections: connectionsOf(store, repo, toolHome), kit, wanted,
-            found: discoverTools(repo, codex, toolHome).filter(one => !names.has(one.spec.name)),
+            // The project's own .mcp.json as the background pass last read it off the console's thread (never read here).
+            found: discoverTools(repo, codex, toolHome, process.env, options.identities === undefined ? undefined : savedProjectMcp.get(repo) ?? null).filter(one => !names.has(one.spec.name)),
             storage: toolSecretStorage(),
         };
     };
@@ -1027,7 +1037,7 @@ export function createDecisionServer(options) {
         }
         const known = new Set(["/recipes/prepare", "/recipes/preview", "/recipes/import", "/recipes/save", "/recipes/launch", "/tasks/add", "/queue/move", "/queue/note", "/people/invite", "/people/invite-revoke", "/people/revoke", "/people/projects", "/projects/select", "/projects/open", "/mode/confirm", "/mode/sign", "/mode/revoke", "/settings/chat-approval/save", "/settings/chat-approval/off", "/settings/project/live-view"]);
         const placed = url.pathname === "/tasks/add" ? body?.get("repo")?.trim() : null;
-        return { repo: url.pathname.startsWith("/people/") ? null : placed ? canonicalProject(placed) ?? placed : projectOf(who, request) ?? null, taskId: null, runId: null,
+        return { repo: url.pathname.startsWith("/people/") ? null : placed ? identities.strict(placed) ?? placed : projectOf(who, request) ?? null, taskId: null, runId: null,
             action: known.has(url.pathname) ? url.pathname.slice(1).replaceAll("/", " ") : "console request" };
     }
     async function handleGet(route, url, who, request, response) {
@@ -1955,6 +1965,8 @@ export function createDecisionServer(options) {
                         for (const provider of PROVIDER_IDS.filter(isKeyedProvider).filter(one => one !== "claude" && one !== "codex"))
                             waits.push(connectionCheck(provider).catch(() => undefined));
                     }
+                    // Project identities, resolved off the thread: what pages asked about, and answers gone stale.
+                    waits.push(identities.refresh([...exactRepos(), ...(options.currentRepos?.() ?? []), ...store.listProjects().map(one => one.path), ...store.knownRepos(), ...ceiling.roots]));
                     integrations.refreshIfDue();
                     const sso = ssoSettings();
                     if (sso !== null && (ssoProvider === null || ssoProvider.issuer !== sso.issuer || Date.now() - ssoProvider.at >= 10 * 60_000))
@@ -1991,13 +2003,22 @@ export function createDecisionServer(options) {
                                 continue;
                             const reading = { until: Date.now() + 10 * 60_000, found: entry?.found ?? null, reading: true };
                             firstTasks.set(repo, reading);
-                            waits.push(findFirstTasks(repo, options.firstTaskRunner ?? execRun).then(found => { reading.found = found; }, () => { }).finally(() => { reading.reading = false; }));
+                            // A test's runner reads in-process; otherwise in a process of its own (learning-look.ts), so the hardened
+                            // git's synchronous reads of the project's folder never hold the console's thread.
+                            waits.push((options.firstTaskRunner !== undefined ? findFirstTasks(repo, options.firstTaskRunner) : firstTasksOffThread(repo)).then(found => { reading.found = found; }, () => { }).finally(() => { reading.reading = false; }));
                         }
                     }
                     // Learning recovered from reviewed runs (and a project's saved rows carried to its current identity), which
                     // Settings → Learning and Knowledge used to do as they opened.
                     if (lastChecks.due("learning", 10 * 60_000)) {
                         waits.push(lastChecks.run("learning", async () => {
+                            // Its reads of each project's Git folder are synchronous, so with a database file they run in a process of
+                            // their own (learning-look.ts): a folder that doesn't answer costs its own recovery, never the console. An
+                            // in-memory database (a test) can't be shared, so it is read here.
+                            if (databaseFile !== null) {
+                                await recoverLearningOffThread({ databaseFile, evidenceRoot, repos: managedRepos() }, options.learningRunner === undefined ? {} : { runner: options.learningRunner });
+                                return;
+                            }
                             for (const repo of managedRepos()) {
                                 try {
                                     acceptedIdentities(store, repo);
@@ -2012,6 +2033,11 @@ export function createDecisionServer(options) {
                     }
                     // What Codex has configured, per project, for Settings → Tools to offer.
                     for (const repo of managedRepos()) {
+                        // The project's own .mcp.json, read off the console's thread (folder-look.ts) for the Tools page and the lead.
+                        if (options.identities !== undefined && lastChecks.due(`project-mcp:${repo}`, 10 * 60_000)) {
+                            waits.push(lastChecks.run(`project-mcp:${repo}`, async () => { const looked = await lookProjectMcp(repo); if (looked.ok)
+                                savedProjectMcp.set(repo, looked.value); return looked.ok; }));
+                        }
                         if (lastChecks.due(`codex-tools:${repo}`, 10 * 60_000))
                             waits.push(lastChecks.run(`codex-tools:${repo}`, () => codexServers(repo)));
                     }
@@ -2220,6 +2246,7 @@ export function createDecisionServer(options) {
         get revisionLedgerOf() { return revisionLedgerOf; },
         get firstTasks() { return firstTasks; },
         get authenticateCredential() { return authenticateCredential; },
+        get identities() { return identities; },
     };
     const tasksHandlers = createTasksHandlers(handlerRuntime);
     const pagesHandlers = createPagesHandlers(handlerRuntime);

package/dist/server/flows.js

@@ -43,7 +43,7 @@ import { redirect, respond, SAFETY, taskHref } from "./http.js";
 import { html } from "../html.js";
 import {} from "./session.js";
 export function createFlowsHandlers(runtime) {
-    const { store, clock, sendScreen, chromeFor, consoleProjects, options, visible, liveCeiling, providerHome, toolHome, restricted, evidenceRoot, authenticateApprover, authenticateCredential, projectOf, unscopedMode, ceiling, authorizeMutation } = runtime;
+    const { identities, store, clock, sendScreen, chromeFor, consoleProjects, options, visible, liveCeiling, providerHome, toolHome, restricted, evidenceRoot, authenticateApprover, authenticateCredential, projectOf, unscopedMode, ceiling, authorizeMutation } = runtime;
     // ---- reads ---------------------------------------------------------------
     /** A gallery template's page (Flows → New → Use this): its questions, the preview of these answers, and Create. */
     function sendGalleryUse(response, who, template, projects, repo, given, name, notice, said = null) {
@@ -839,8 +839,14 @@ export function createFlowsHandlers(runtime) {
             if (body.get("repo") !== project || (who.via === "cookie" && body.get("projectRevision") !== String(who.session.projectRevision)))
                 throw new RecipeError("The open project changed. Reopen this recipe in the intended project.", 409);
             const rootMode = !unscopedMode && ceiling.roots.length > 0;
-            if (rootMode && !(await authorizedProject(liveCeiling(), project)))
-                throw new RecipeError("The project is outside this server's access.", 403);
+            if (rootMode) {
+                // A mutation's target is resolved now, off the console's thread, and must still be the project it names.
+                const resolved = await identities.resolveNow(project);
+                if (resolved === "no-answer")
+                    throw new RecipeError("The project's folder didn't answer. It may be on a drive that's disconnected, or waiting on macOS. Try again in a moment.", 503);
+                if (resolved !== project || !(await authorizedProject(liveCeiling(), resolved)))
+                    throw new RecipeError("The project is outside this server's access.", 403);
+            }
             const rechecked = authorizeMutation(request, who, readForm(posted, CONSOLE_FORMS.mutationGuard));
             if (rechecked !== null)
                 throw new RecipeError(rechecked.message, rechecked.status);

package/dist/server/guards.d.ts

@@ -1,3 +1,4 @@
+import { type ProjectIdentities } from "../project-identity.js";
 import { type FormFieldOf, type FormView } from "../contracts/console-api.js";
 import type { TaskFamily } from "../store.js";
 import { type IncomingMessage, type ServerResponse } from "node:http";
@@ -13,8 +14,11 @@ export interface GuardsRuntime {
     liveCeiling: () => {
         repos: string[];
         roots: readonly string[];
+        canon?: (path: string) => string | null;
     };
     codingProjects: () => string[];
+    /** Project identities read without touching folders (project-identity.ts); absent: the synchronous reads. */
+    identities?: ProjectIdentities;
     unscopedMode: boolean;
     managedRepos: () => string[];
     ceiling: import("../project.js").ProjectCeiling;

package/dist/server/guards.js

@@ -1,3 +1,4 @@
+import { syncProjectIdentities } from "../project-identity.js";
 import { OWNER_ACTIONS, sharedActionPayload } from '../chat-actions.js';
 import { CONSOLE_FORMS, readForm } from "../contracts/console-api.js";
 import { timingSafeEqual } from "node:crypto";
@@ -14,6 +15,7 @@ import { refuse } from "./chrome.js";
 import { matchTaskPath } from "./http.js";
 import { PersistentSessions, SESSION_COOKIE, sessionWithinLifetime } from "./session.js";
 export function createSharedGuards(runtime) {
+    const syncIdentities = syncProjectIdentities();
     // v99: wrong passwords. One address guessing across names runs out of tries here; each name
     // locks on its own (sign-in-guard.ts), and every lock, whatever road it came by, is kept.
     /**
@@ -130,8 +132,9 @@ export function createSharedGuards(runtime) {
             return fallback();
         if (Array.isArray(header))
             return undefined;
-        const canonical = canonicalProject(header);
-        if (canonical === null || !visible(canonical))
+        // A request's path, never resolved on this thread (project-identity.ts): a known identity or exactly a saved one.
+        const canonical = identities().vouched(header, savedIdentities);
+        if (canonical === undefined || !visible(canonical))
             return undefined;
         return canonical;
     }
@@ -152,7 +155,8 @@ export function createSharedGuards(runtime) {
             case 'form-path': {
                 const path = body?.get('path')?.trim() ?? '';
                 // Invalid/missing paths keep the opener's existing 400 response and recoverable form.
-                return path === '' ? null : canonicalProject(path);
+                // Never resolved here: an unknown path passes on to the opener, which resolves it off the thread and checks again.
+                return path === '' ? null : identities().vouched(path, savedIdentities) ?? null;
             }
             case 'task': {
                 const task = matchTaskPath(url.pathname, '(?:/[a-z-]+)?$');
@@ -370,5 +374,10 @@ export function createSharedGuards(runtime) {
     function runVisible(run) {
         return visible(taskRepoOf(run.taskRef));
     }
+    // Defined last, so the reviewed functions above keep their places (password-freshness.test.ts).
+    /** Project identities read without touching a folder (project-identity.ts); absent: the synchronous reads. */
+    function identities() { return runtime.identities ?? syncIdentities; }
+    /** The projects `up` proved and admitted (each its own identity): what a request may name without a read. */
+    function savedIdentities() { return runtime.managedRepos(); }
     return { authenticateApprover, authenticateCredential, authorizeMutation, projectOf, resolveRouteProject, projectRequestAllowed, identify, lookupSession, restricted, visible, admissionList, codingActorAllowed, codingProjectAllowed, workAccess, familyOf, taskRepoOf, runVisible };
 }

package/dist/server/http.d.ts

@@ -17,6 +17,9 @@ import { type Store } from "../store.js";
 import { type SubscriptionLeadRunner } from "../subscription-chat.js";
 import { type launchRuntimeUpdate } from "../toolroll-update.js";
 import { type IncomingMessage, type ServerResponse } from "node:http";
+import { type FolderLookRunner } from "../folder-look.js";
+import { type ProjectIdentities } from "../project-identity.js";
+import { type LearningRunner } from "../learning-look.js";
 export type ServeOptions = {
     /** Tests: runs a person's command for the HTTP MCP gateway instead of operate.ts's. */
     runOperateAs?: import("../mcp-person.js").RunOperateAs;
@@ -172,6 +175,14 @@ export type ServeOptions = {
      * how often they run and ask this computer's agents again. */
     backgroundChecks?: boolean;
     backgroundChecksMs?: number;
+    /** Tests: how a person's folders are read off the console's thread (folder-look.ts), and how long a read may take. */
+    folderLook?: FolderLookRunner;
+    folderLookMs?: number;
+    /** Project identities resolved off the console's thread (project-identity.ts); `up` and `serve` pass them. Absent:
+     * the old synchronous reads (embedders and tests). */
+    identities?: ProjectIdentities;
+    /** Tests: how the background pass runs one project's learning recovery in a process of its own. */
+    learningRunner?: LearningRunner;
     connectionHome?: string;
     /** Test seam for Chat's first tasks: the `gh` and `git grep` reads. */
     firstTaskRunner?: typeof execRun;

package/dist/server/http.js

@@ -19,6 +19,9 @@ import {} from "../toolroll-update.js";
 import { timingSafeEqual } from "node:crypto";
 import {} from "node:http";
 import { SIGN_IN_LINK_PATH } from "./session.js";
+import {} from "../folder-look.js";
+import {} from "../project-identity.js";
+import {} from "../learning-look.js";
 // A note is at most NOTE_BYTE_CAP (16,000) UTF-8 bytes, which URL encoding
 // can triple: room for one whole, before canonical text validation.
 export const BODY_CAP = 64 * 1024;

package/dist/server/pages.js

@@ -5,10 +5,11 @@ import { handlersOf } from './handler-registry.js';
 import { html, joinHtml, postForm, reauth } from "../html.js";
 /** pages handlers, moved without changing their route bodies. */
 import { createHmac, randomBytes } from "node:crypto";
-import { existsSync, opendirSync, readdirSync, realpathSync } from "node:fs";
+import { realpathSync } from "node:fs";
 import {} from "node:http";
 import { homedir, hostname } from "node:os";
-import { dirname, join } from "node:path";
+import { dirname, join, resolve } from "node:path";
+import { listFolder, localOrigins } from "../folder-look.js";
 import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import { setImmediate as yieldEventLoop } from "node:timers/promises";
@@ -49,13 +50,13 @@ import { refuse, regionScript, screen, settingsRows, WORKSPACE_STYLE, workToolRo
 import { redirect, respond, safeReturn, SAFETY, taskHref } from "./http.js";
 import { assignmentOf } from "../assignment.js";
 import { assignmentTaskStatusOf } from "../assignment-presentation.js";
-import { browsePage, fleetBody, fleetScript, githubIdentityOf, githubReposPage, homePage, originUrlOf, portfolioOverview, projectsPage, systemPage, workbenchRail } from "./render-pages.js";
+import { browsePage, fleetBody, fleetScript, githubIdentityOf, githubReposPage, homePage, portfolioOverview, projectsPage, systemPage, workbenchRail } from "./render-pages.js";
 import { capsPage } from "./render-settings.js";
 import { decisionAnswerScript, taskBody } from "./render-tasks.js";
 import {} from "./session.js";
 import { rereadBrowser } from "./live.js";
 export function createPagesHandlers(runtime) {
-    const { clock, lastChecks, store, visible, consoleProjects, restricted, ceiling, options, projectFamilyPeek, sendScreen, chromeFor, unscopedMode, admissionList, taskRepoOf, taskViewData, runVisible, evidenceRoot, workAccess, identify, liveCeiling, sessions, deletedRepos, authenticateApprover, authenticateCredential, projectOf, lookupSession } = runtime;
+    const { identities, clock, lastChecks, store, visible, consoleProjects, restricted, ceiling, options, projectFamilyPeek, sendScreen, chromeFor, unscopedMode, admissionList, taskRepoOf, taskViewData, runVisible, evidenceRoot, workAccess, identify, liveCeiling, sessions, deletedRepos, authenticateApprover, authenticateCredential, projectOf, lookupSession } = runtime;
     // The filesystem browser (operator request): pick a project folder by
     // looking, not typing. CONFINED to exactly what opening allows —
     // explicit --repo mode has an enumerable list and gets no browser at
@@ -67,40 +68,32 @@ export function createPagesHandlers(runtime) {
         const { url, who, response } = ctx;
         if (who.via !== "cookie")
             return refuse(response, who, 403, "browsing feeds a browser session's act");
-        const browseRoots = ceiling.roots.length > 0 ? [...ceiling.roots] : unscopedMode ? [realpathSync(homedir())] : [];
+        const browseRoots = ceiling.roots.length > 0 ? [...ceiling.roots] : unscopedMode ? [identities.hot(homedir())] : [];
         if (browseRoots.length === 0) {
             return refuse(response, who, 404, "this server was configured with an explicit repo list — the openable projects are all on the projects page", "/projects");
         }
         const asked = url.searchParams.get("at") ?? browseRoots[0];
-        const canonical = canonicalProject(asked);
-        const inside = canonical !== null &&
-            browseRoots.some(root => canonical === root || canonical.startsWith(`${root}/`));
-        if (canonical === null || !inside) {
+        const within = (path) => browseRoots.some(root => path === root || path.startsWith(`${root}/`));
+        // Spelled outside every root: refused before anything is read. Inside, the look resolves links and checks again.
+        if (!within(resolve(asked))) {
             return refuse(response, who, 403, "that path is outside what this server may browse", "/projects/browse");
         }
-        let entries = [];
-        try {
-            entries = readdirSync(canonical, { withFileTypes: true })
-                .filter(one => one.isDirectory() || one.isSymbolicLink())
-                .filter(one => !one.name.startsWith(".") && one.name !== "node_modules")
-                .slice(0, 400)
-                .map(one => {
-                const path = join(canonical, one.name);
-                // Resolve NOW so a symlink pointing outside the fence renders
-                // as nothing rather than as a door.
-                const resolved = canonicalProject(path);
-                if (resolved === null || !browseRoots.some(root => resolved === root || resolved.startsWith(`${root}/`))) {
-                    return null;
-                }
-                return { name: one.name, path: resolved, git: existsSync(join(resolved, ".git")) };
-            })
-                .filter((one) => one !== null)
-                .sort((a, b) => Number(b.git) - Number(a.git) || a.name.localeCompare(b.name))
-                .slice(0, 200);
+        // Read off the console's thread (folder-look.ts): a folder that doesn't answer never freezes the console.
+        const looked = await listFolder(asked, browseRoots, { ...(options.folderLook === undefined ? {} : { runner: options.folderLook }), ...(options.folderLookMs === undefined ? {} : { deadlineMs: options.folderLookMs }) });
+        if (!looked.ok) {
+            return looked.why === "no-answer"
+                ? refuse(response, who, 503, "This folder didn't answer. It may be on a drive that's disconnected, or waiting on macOS. Try again in a moment.", "/projects")
+                : refuse(response, who, 404, "that directory cannot be read", "/projects/browse");
         }
-        catch {
-            return refuse(response, who, 404, "that directory cannot be read", "/projects/browse");
+        const canonical = looked.value.at;
+        if (canonical === null || !within(canonical)) {
+            return refuse(response, who, 403, "that path is outside what this server may browse", "/projects/browse");
         }
+        // The look kept only folders inside a root; checked here again, as before.
+        const entries = looked.value.entries
+            .filter(one => within(one.path))
+            .sort((a, b) => Number(b.git) - Number(a.git) || a.name.localeCompare(b.name))
+            .slice(0, 200);
         const root = browseRoots.find(one => canonical === one || canonical.startsWith(`${one}/`));
         const parent = canonical === root ? null : canonical.slice(0, canonical.lastIndexOf("/")) || root;
         const csrf = who.session.csrf;
@@ -133,48 +126,28 @@ export function createPagesHandlers(runtime) {
         // (GitHub's rule); the FIRST match wins.
         const localByIdentity = new Map();
         const registered = new Set();
-        for (const project of store.listProjects()) {
-            if (!visible(project.path))
-                continue;
-            registered.add(project.path);
-            const identity = githubIdentityOf(originUrlOf(project.path) ?? "");
-            if (identity !== null && !localByIdentity.has(identity.toLowerCase())) {
-                localByIdentity.set(identity.toLowerCase(), project.path);
-            }
-        }
+        for (const project of store.listProjects())
+            if (visible(project.path))
+                registered.add(project.path);
         // Roots are walked ONLY when there are listed repos to match against
-        // (finding 1), through an iterator that stops at 400 entries — a
-        // directory with a million children costs 400 stats, not a scan.
-        if (listed !== null && listed.ok && listed.repos.length > 0) {
-            for (const root of ceiling.roots) {
-                const children = [];
-                try {
-                    const dir = opendirSync(root);
-                    try {
-                        for (let seen = 0; seen < 400; seen++) {
-                            const entry = dir.readSync();
-                            if (entry === null)
-                                break;
-                            if (entry.isDirectory())
-                                children.push(join(root, entry.name));
-                        }
-                    }
-                    finally {
-                        dir.closeSync();
-                    }
-                }
-                catch {
-                    // an unreadable root offers nothing
-                }
-                for (const child of children) {
-                    if (!existsSync(join(child, ".git")))
-                        continue;
-                    const identity = githubIdentityOf(originUrlOf(child) ?? "");
-                    if (identity !== null && !localByIdentity.has(identity.toLowerCase())) {
-                        localByIdentity.set(identity.toLowerCase(), child);
-                    }
+        // (finding 1), at most 400 folders a root. Every read runs off the
+        // console's thread (folder-look.ts): a folder that doesn't answer
+        // leaves its copies unmatched and the page says so.
+        const roots = listed !== null && listed.ok && listed.repos.length > 0 ? [...ceiling.roots] : [];
+        let localUnanswered = false;
+        if (registered.size > 0 || roots.length > 0) {
+            const looked = await localOrigins([...registered], roots, { ...(options.folderLook === undefined ? {} : { runner: options.folderLook }), ...(options.folderLookMs === undefined ? {} : { deadlineMs: options.folderLookMs }) });
+            if (looked.ok) {
+                const children = looked.value.found.filter(one => roots.some(root => one.path.startsWith(`${root}/`)));
+                for (const one of [...looked.value.registered.filter(row => registered.has(row.path)), ...children]) {
+                    const identity = githubIdentityOf(one.url ?? "");
+                    if (identity !== null && !localByIdentity.has(identity.toLowerCase()))
+                        localByIdentity.set(identity.toLowerCase(), one.path);
                 }
             }
+            else {
+                localUnanswered = looked.why === "no-answer";
+            }
         }
         return sendScreen(response, 200, githubReposPage(chromeFor(who.via === "cookie" ? who.session.project : null, "projects"), {
             listed,
@@ -183,6 +156,7 @@ export function createPagesHandlers(runtime) {
             csrf: who.via === "cookie" ? who.session.csrf : "",
             cloneReady: ceiling.roots.length > 0,
             openProject: who.via === "cookie" ? who.session.project ?? null : null,
+            localUnanswered,
         }));
     }
     // List repositories / Refresh list: ask the GitHub CLI signed in on this machine, then show the page.
@@ -354,7 +328,7 @@ export function createPagesHandlers(runtime) {
             runners: store.listRunners(),
             worktrees: store
                 .listWorktrees()
-                .filter(one => project === null || sameRepo(one.repo, project)),
+                .filter(one => project === null || one.repo === project || identities.hot(one.repo) === identities.hot(project)),
             episode: project === null ? null : store.latestWatchEpisode(project),
             now,
         }));
@@ -378,7 +352,7 @@ export function createPagesHandlers(runtime) {
             }),
             building: store.liveClaims(project, now),
             runners: store.listRunners(),
-            worktrees: store.listWorktrees().filter(one => project === null || sameRepo(one.repo, project)),
+            worktrees: store.listWorktrees().filter(one => project === null || one.repo === project || identities.hot(one.repo) === identities.hot(project)),
             episode: project === null ? null : store.latestWatchEpisode(project),
             outboxPending: store.pendingForAttention().length,
             // External work at a glance (arc 3 finding 24): every dispatch
@@ -665,7 +639,11 @@ export function createPagesHandlers(runtime) {
             return refuse(response, who, 403, "selecting a project is a browser session's act");
         }
         const askedPath = (body.get("path") ?? "").trim();
-        const canonicalPick = askedPath === "" ? null : canonicalProject(askedPath);
+        // Resolved off the console's thread (project-identity.ts): a folder that doesn't answer is said, never waited on.
+        const picked = askedPath === "" ? null : await identities.resolveNow(askedPath);
+        if (picked === "no-answer")
+            return refuse(response, who, 503, "That project's folder didn't answer. It may be on a drive that's disconnected, or waiting on macOS. Try again in a moment.");
+        const canonicalPick = picked;
         if ((askedPath !== "" && canonicalPick === null) || (canonicalPick !== null && (!visible(canonicalPick) || !(await authorizedProject(liveCeiling(), canonicalPick))))) {
             return refuse(response, who, 403, "that project is outside this console's reach");
         }
@@ -702,7 +680,11 @@ export function createPagesHandlers(runtime) {
             return refuse(response, who, 403, "opening a project is a browser session's act");
         }
         const asked = (body.get("path") ?? "").trim();
-        const canonical = asked === "" ? null : canonicalProject(asked);
+        const resolved = asked === "" ? null : await identities.resolveNow(asked);
+        if (resolved === "no-answer") {
+            return void projectsScreen(response, who, "that folder didn't answer — it may be on a drive that's disconnected, or waiting on macOS; try again in a moment", 503, safeReturn(body.get("return")));
+        }
+        const canonical = resolved;
         if (canonical === null) {
             return void projectsScreen(response, who, "that path does not exist on this server", 400, safeReturn(body.get("return")));
         }
@@ -807,13 +789,9 @@ export function createPagesHandlers(runtime) {
         const rootRaw = Number.isInteger(rootIndex) ? ceiling.roots[rootIndex] : undefined;
         if (rootRaw === undefined)
             return projectsScreen(response, who, "pick one of the configured roots", 400);
-        let root;
-        try {
-            root = realpathSync(rootRaw);
-        }
-        catch {
+        const root = await identities.resolveNow(rootRaw);
+        if (root === null || root === "no-answer")
             return projectsScreen(response, who, "that projects root does not resolve right now", 400);
-        }
         const previewed = await (options.ghPreview ?? previewGithubRepo)(shape.owner, shape.name);
         if (!previewed.ok)
             return projectsScreen(response, who, previewed.message, 400);
@@ -886,13 +864,9 @@ export function createPagesHandlers(runtime) {
         const rootRaw = ceiling.roots[record.rootIndex];
         if (rootRaw === undefined)
             return projectsScreen(response, who, "the configured roots changed — preview again", 400);
-        let root;
-        try {
-            root = realpathSync(rootRaw);
-        }
-        catch {
+        const root = await identities.resolveNow(rootRaw);
+        if (root === null || root === "no-answer")
             return projectsScreen(response, who, "that projects root does not resolve right now", 400);
-        }
         if (dirname(record.target) !== root)
             return projectsScreen(response, who, "the configured roots changed — preview again", 400);
         const cloned = await (options.ghClone ?? cloneGithubRepo)(record.nameWithOwner, root, async (cwd) => {
@@ -908,8 +882,8 @@ export function createPagesHandlers(runtime) {
             return projectsScreen(response, who, "the clone answered with a different path than the preview promised — refused; nothing was enrolled", 400);
         }
         // authorizedProject AFTER the repository exists (finding 20).
-        const proved = await authorizedProject(liveCeiling(), cloned.target);
-        const admitted = proved ? (canonicalProject(cloned.target) ?? cloned.target) : null;
+        const clonedAt = await identities.resolveNow(cloned.target);
+        const admitted = typeof clonedAt === "string" && clonedAt !== "no-answer" && (await authorizedProject(liveCeiling(), clonedAt)) ? clonedAt : null;
         if (admitted === null) {
             return projectsScreen(response, who, `the clone landed at ${cloned.target} but did not prove under the ceiling — it was left in place; enroll it by hand`, 400);
         }
@@ -937,7 +911,7 @@ export function createPagesHandlers(runtime) {
         const recentPaths = new Set(recent.map(one => one.path));
         const candidates = new Set();
         for (const path of consoleProjects()) {
-            const canonical = canonicalProject(path) ?? path;
+            const canonical = identities.hot(path);
             if (!recentPaths.has(canonical) && visible(canonical))
                 candidates.add(canonical);
         }