toolroll 0.9.92 → 0.9.94

package/dist/code-map-store.js

@@ -0,0 +1,233 @@
+/**
+ * The code map's records (docs/plans/code-map.md §3): immutable versions, the pointer to the current one, and the
+ * per-project refresh record whose lease fences every later write. Delivery and measurement rows sit here too. The
+ * rows are Toolroll's own; nothing goes in a repository.
+ */
+import { createHash } from "node:crypto";
+import { gunzipSync, gzipSync } from "node:zlib";
+import { trustedRemoteIdentity } from "./store.js";
+import { LIMITS } from "./code-map-shape.js";
+export const V152_SCHEMA = `
+CREATE TABLE IF NOT EXISTS code_map_version (
+  id INTEGER PRIMARY KEY, repo TEXT NOT NULL, remote_digest TEXT NOT NULL, remote_record INTEGER NOT NULL, commit_sha TEXT NOT NULL,
+  extractor TEXT NOT NULL, built_at TEXT NOT NULL, manifest BLOB NOT NULL, manifest_sha TEXT NOT NULL, graph BLOB NOT NULL, graph_sha TEXT NOT NULL, report TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS code_map_version_repo ON code_map_version (repo, id);
+CREATE TABLE IF NOT EXISTS code_map_current (repo TEXT PRIMARY KEY, version INTEGER NOT NULL REFERENCES code_map_version(id));
+CREATE TABLE IF NOT EXISTS code_map_refresh (
+  repo TEXT PRIMARY KEY, lease_token INTEGER NOT NULL DEFAULT 0, lease_owner TEXT, lease_until TEXT,
+  request_id INTEGER NOT NULL DEFAULT 0, requested_at TEXT, requested_by TEXT,
+  failures INTEGER NOT NULL DEFAULT 0, retry_after TEXT, last_error TEXT, last_checked_at TEXT,
+  seen_digest TEXT, seen_record INTEGER, seen_commit TEXT, seen_extractor TEXT, seen_state TEXT,
+  spawn_pid INTEGER, spawn_pgid INTEGER, spawn_started TEXT, spawn_folder TEXT, enforced TEXT, proxy TEXT
+);
+CREATE TABLE IF NOT EXISTS code_map_family (
+  root_task TEXT PRIMARY KEY, repo TEXT NOT NULL, arm TEXT NOT NULL CHECK (arm IN ('map','holdout')), enrolled_at TEXT NOT NULL, observe_until TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS code_map_family_repo ON code_map_family (repo);
+CREATE TABLE IF NOT EXISTS code_map_snapshot (
+  run INTEGER PRIMARY KEY, state TEXT NOT NULL CHECK (state IN ('map','off','none','remote-changed','holdout','unavailable')),
+  version INTEGER, excerpt TEXT NOT NULL, excerpt_sha TEXT NOT NULL, file_selected INTEGER NOT NULL CHECK (file_selected IN (0,1))
+);
+CREATE INDEX IF NOT EXISTS code_map_snapshot_version ON code_map_snapshot (version);
+CREATE TABLE IF NOT EXISTS code_map_delivery (
+  id INTEGER PRIMARY KEY, run INTEGER NOT NULL, attempt INTEGER NOT NULL, at TEXT NOT NULL,
+  outcome TEXT NOT NULL CHECK (outcome IN ('delivered','not-delivered')),
+  reason TEXT CHECK (reason IS NULL OR reason IN ('no-confinement','write-failed','sha-mismatch','version-pruned','not-selected')), path_sha TEXT,
+  UNIQUE (run, attempt)
+);
+CREATE TABLE IF NOT EXISTS code_map_meta (id INTEGER PRIMARY KEY CHECK (id = 1), run_watermark INTEGER NOT NULL);
+CREATE TRIGGER IF NOT EXISTS code_map_version_no_update BEFORE UPDATE ON code_map_version BEGIN SELECT RAISE(ABORT,'a code map version is immutable'); END;
+CREATE TRIGGER IF NOT EXISTS code_map_version_guarded_delete BEFORE DELETE ON code_map_version
+WHEN EXISTS (SELECT 1 FROM code_map_current WHERE version = OLD.id)
+  OR EXISTS (SELECT 1 FROM code_map_snapshot s JOIN run r ON r.id = s.run WHERE s.version = OLD.id AND r.outcome IS NULL)
+BEGIN SELECT RAISE(ABORT,'a code map version in use stays'); END;
+CREATE TRIGGER IF NOT EXISTS code_map_family_no_update BEFORE UPDATE ON code_map_family BEGIN SELECT RAISE(ABORT,'a family arm is frozen'); END;
+CREATE TRIGGER IF NOT EXISTS code_map_family_no_delete BEFORE DELETE ON code_map_family BEGIN SELECT RAISE(ABORT,'a family arm is frozen'); END;
+CREATE TRIGGER IF NOT EXISTS code_map_snapshot_no_update BEFORE UPDATE ON code_map_snapshot BEGIN SELECT RAISE(ABORT,'a code map snapshot is immutable'); END;
+CREATE TRIGGER IF NOT EXISTS code_map_snapshot_no_delete BEFORE DELETE ON code_map_snapshot BEGIN SELECT RAISE(ABORT,'a code map snapshot is immutable'); END;
+CREATE TRIGGER IF NOT EXISTS code_map_delivery_no_update BEFORE UPDATE ON code_map_delivery BEGIN SELECT RAISE(ABORT,'a code map delivery is immutable'); END;
+CREATE TRIGGER IF NOT EXISTS code_map_delivery_no_delete BEFORE DELETE ON code_map_delivery BEGIN SELECT RAISE(ABORT,'a code map delivery is immutable'); END;
+CREATE TRIGGER IF NOT EXISTS code_map_meta_no_update BEFORE UPDATE ON code_map_meta BEGIN SELECT RAISE(ABORT,'the watermark is set once'); END;
+CREATE TRIGGER IF NOT EXISTS code_map_meta_no_delete BEFORE DELETE ON code_map_meta BEGIN SELECT RAISE(ABORT,'the watermark is set once'); END;
+`;
+/** The tables and triggers V152_SCHEMA makes, for the startup check and the tests. */
+export const V152_TABLES = Object.freeze(["code_map_version", "code_map_current", "code_map_refresh", "code_map_family", "code_map_snapshot", "code_map_delivery", "code_map_meta"]);
+export const V152_TRIGGERS = Object.freeze(["code_map_version_no_update", "code_map_version_guarded_delete", "code_map_family_no_update", "code_map_family_no_delete", "code_map_snapshot_no_update",
+    "code_map_snapshot_no_delete", "code_map_delivery_no_update", "code_map_delivery_no_delete", "code_map_meta_no_update", "code_map_meta_no_delete"]);
+/** v152: a saved project reads the map on, with no enrollment yet. */
+export const V152_ADDED_COLUMNS = Object.freeze({
+    project: {
+        code_map: { definition: "INTEGER NOT NULL DEFAULT 1 CHECK (code_map IN (0,1))", saved: "1" },
+        code_map_enroll_until: { definition: "TEXT", saved: "NULL" },
+    },
+});
+const sha = (value) => createHash("sha256").update(value).digest("hex");
+export const digestOfUrl = (url) => sha(url);
+export const CODE_MAP_ACT = "code map check";
+const sameIdentity = (a, b) => a !== null && b !== null && a.url === b.url && a.record === b.record;
+export function codeMapOn(store, repo) {
+    const row = store.handle.prepare("SELECT code_map FROM project WHERE path = ?").get(repo);
+    return row !== undefined && Number(row["code_map"]) === 1;
+}
+const textOf = (value) => (typeof value === "string" ? value : null);
+const intOf = (value) => (value === null || value === undefined ? null : Number(value));
+function refreshOf(row) {
+    return {
+        repo: String(row["repo"]), leaseToken: Number(row["lease_token"]), leaseOwner: textOf(row["lease_owner"]), leaseUntil: textOf(row["lease_until"]), requestId: Number(row["request_id"]),
+        requestedAt: textOf(row["requested_at"]), requestedBy: textOf(row["requested_by"]), failures: Number(row["failures"]), retryAfter: textOf(row["retry_after"]), lastError: textOf(row["last_error"]),
+        lastCheckedAt: textOf(row["last_checked_at"]), seen: { digest: textOf(row["seen_digest"]), record: intOf(row["seen_record"]), commit: textOf(row["seen_commit"]), extractor: textOf(row["seen_extractor"]), state: textOf(row["seen_state"]) },
+        spawn: { pid: intOf(row["spawn_pid"]), pgid: intOf(row["spawn_pgid"]), startedAt: textOf(row["spawn_started"]), folder: textOf(row["spawn_folder"]) }, enforced: textOf(row["enforced"]), proxy: textOf(row["proxy"]),
+    };
+}
+export function readRefresh(store, repo) {
+    const row = store.handle.prepare("SELECT * FROM code_map_refresh WHERE repo = ?").get(repo);
+    return row === undefined ? null : refreshOf(row);
+}
+const ensureRefresh = (store, repo) => { store.handle.prepare("INSERT OR IGNORE INTO code_map_refresh (repo) VALUES (?)").run(repo); };
+export const LEASE_MS = 10 * 60_000;
+/** Take the lease in one statement. A takeover always gets a higher token; null when it is held. */
+export function takeLease(store, repo, owner, now) {
+    ensureRefresh(store, repo);
+    const before = readRefresh(store, repo);
+    const taken = store.handle.prepare(`UPDATE code_map_refresh SET lease_token = lease_token + 1, lease_owner = ?, lease_until = ?
+    WHERE repo = ? AND (lease_owner IS NULL OR lease_until < ?)`).run(owner, new Date(now.getTime() + LEASE_MS).toISOString(), repo, now.toISOString());
+    if (Number(taken.changes) !== 1)
+        return null;
+    const after = readRefresh(store, repo);
+    return { repo, token: after.leaseToken, owner, requestId: after.requestId, previous: before.spawn };
+}
+/** A fenced write: changes rows only while this lease stands. Zero rows means the lease was lost. */
+function fenced(store, lease, set, values, extra = "", extraValues = []) {
+    const ran = store.handle.prepare(`UPDATE code_map_refresh SET ${set} WHERE repo = ? AND lease_token = ? AND lease_owner = ?${extra}`).run(...values, lease.repo, lease.token, lease.owner, ...extraValues);
+    return Number(ran.changes) === 1;
+}
+export const extendLease = (store, lease, now) => fenced(store, lease, "lease_until = ?", [new Date(now.getTime() + LEASE_MS).toISOString()]);
+export const releaseLease = (store, lease) => fenced(store, lease, "lease_owner = NULL, lease_until = NULL, spawn_pid = NULL, spawn_pgid = NULL, spawn_started = NULL, spawn_folder = NULL", []);
+export const clearOldSpawn = (store, lease) => fenced(store, lease, "spawn_pid = NULL, spawn_pgid = NULL, spawn_started = NULL, spawn_folder = NULL", []);
+export const recordFolder = (store, lease, folder) => fenced(store, lease, "spawn_folder = ?", [folder]);
+export const recordSpawn = (store, lease, spawn) => fenced(store, lease, "spawn_pid = ?, spawn_pgid = ?, spawn_started = ?", [spawn.pid, spawn.pgid, spawn.startedAt]);
+/** Clear the request this lease saw, and only that one: a request made during the build stays queued. */
+export const clearRequest = (store, lease) => fenced(store, lease, "requested_at = NULL, requested_by = NULL", [], " AND request_id = ?", [lease.requestId]);
+/** A finished check that found nothing wrong: failures reset. */
+export const recordCheck = (store, lease, facts, now) => fenced(store, lease, "failures = 0, retry_after = NULL, last_error = NULL, last_checked_at = ?, seen_digest = ?, seen_record = ?, seen_commit = ?, seen_extractor = ?, seen_state = ?, enforced = COALESCE(?, enforced), proxy = ?", [now.toISOString(), facts.digest, facts.record, facts.commit, facts.extractor, facts.state, facts.enforced ?? null, facts.proxy ?? null]);
+/** What the peek saw, kept even if the build then fails: the page's "Main has moved to …". */
+export const recordPeek = (store, lease, commit) => fenced(store, lease, "seen_commit = ?", [commit]);
+export const BACKOFF_MS = [30 * 60_000, 2 * 3_600_000, 6 * 3_600_000];
+/** A failed check: 30 minutes, then 2 hours, then 6 hours. */
+export function recordFailure(store, lease, why, state, now) {
+    const failures = readRefresh(store, lease.repo)?.failures ?? 0;
+    const wait = BACKOFF_MS[Math.min(failures, BACKOFF_MS.length - 1)];
+    return fenced(store, lease, "failures = failures + 1, retry_after = ?, last_error = ?, last_checked_at = ?, seen_state = ?", [new Date(now.getTime() + wait).toISOString(), why.slice(0, 300), now.toISOString(), state]);
+}
+export const REQUEST_GAP_MS = 10 * 60_000;
+/** Queue a manual check: at most one per project per 10 minutes. It never bypasses back-off. */
+export function requestRefresh(store, repo, by, now) {
+    return store.transact(() => {
+        ensureRefresh(store, repo);
+        const held = readRefresh(store, repo);
+        if (held.requestedAt !== null)
+            return "already-queued";
+        const last = store.handle.prepare("SELECT at FROM action_ledger WHERE repo = ? AND action = 'code map refresh asked' ORDER BY id DESC LIMIT 1").get(repo);
+        if (last !== undefined && now.getTime() - Date.parse(String(last["at"])) < REQUEST_GAP_MS)
+            return "already-queued";
+        store.handle.prepare("UPDATE code_map_refresh SET request_id = request_id + 1, requested_at = ?, requested_by = ? WHERE repo = ?").run(now.toISOString(), by, repo);
+        store.recordAction({ at: now.toISOString(), actor: by, repo, taskId: null, runId: null, action: "code map refresh asked", outcome: "queued", source: "request", detail: null });
+        return "queued";
+    });
+}
+/** The remote-change transaction's part: the pointer clears and a build still running for the old remote is fenced out.
+ * Called from store.recordProjectRemote, inside the transaction that records the new remote. */
+export function codeMapRemoteChanged(store, repo) {
+    store.handle.prepare("DELETE FROM code_map_current WHERE repo = ?").run(repo);
+    store.handle.prepare("UPDATE code_map_refresh SET lease_token = lease_token + 1, lease_owner = NULL, lease_until = NULL, seen_commit = NULL, seen_digest = NULL, seen_record = NULL, failures = 0, retry_after = NULL WHERE repo = ?").run(repo);
+}
+const versionOf = (row) => ({ id: Number(row["id"]), repo: String(row["repo"]), remoteDigest: String(row["remote_digest"]), remoteRecord: Number(row["remote_record"]),
+    commit: String(row["commit_sha"]), extractor: String(row["extractor"]), builtAt: String(row["built_at"]), report: String(row["report"]) });
+const VERSION_COLUMNS = "id, repo, remote_digest, remote_record, commit_sha, extractor, built_at, report";
+export function currentVersion(store, repo) {
+    const row = store.handle.prepare(`SELECT ${VERSION_COLUMNS} FROM code_map_version WHERE id = (SELECT version FROM code_map_current WHERE repo = ?)`).get(repo);
+    return row === undefined ? null : versionOf(row);
+}
+export function versionRow(store, id) {
+    const row = store.handle.prepare(`SELECT ${VERSION_COLUMNS} FROM code_map_version WHERE id = ?`).get(id);
+    return row === undefined ? null : versionOf(row);
+}
+/** The stored bytes, checked against their digests before they are parsed; null when they don't verify. */
+export function readVersionMap(store, id) {
+    const row = store.handle.prepare("SELECT manifest, manifest_sha, graph, graph_sha FROM code_map_version WHERE id = ?").get(id);
+    if (row === undefined)
+        return null;
+    try {
+        const manifest = gunzipSync(row["manifest"], { maxOutputLength: LIMITS.storedBytes * 2 });
+        const graph = gunzipSync(row["graph"], { maxOutputLength: LIMITS.storedBytes * 2 });
+        if (sha(manifest) !== row["manifest_sha"] || sha(graph) !== row["graph_sha"])
+            return null;
+        return { ...JSON.parse(manifest.toString("utf8")), ...JSON.parse(graph.toString("utf8")) };
+    }
+    catch {
+        return null;
+    }
+}
+export function encodeMap(map) {
+    const { edges, ...rest } = map;
+    const manifest = Buffer.from(JSON.stringify(rest));
+    const graph = Buffer.from(JSON.stringify({ edges }));
+    return { manifest: gzipSync(manifest), manifestSha: sha(manifest), graph: gzipSync(graph), graphSha: sha(graph), bytes: manifest.length + graph.length };
+}
+/**
+ * Store a built version and, in the same transaction, make it current only if the identity captured before the fetch
+ * still stands, the map is still on, the build still holds its lease, and the pointer is where it found it. A build that
+ * lost its lease stores nothing at all.
+ */
+export function publishVersion(store, lease, input, now) {
+    return store.transact(() => {
+        const held = readRefresh(store, lease.repo);
+        if (held === null || held.leaseToken !== lease.token || held.leaseOwner !== lease.owner)
+            return null;
+        const { map, encoded } = input;
+        const stored = store.handle.prepare(`INSERT INTO code_map_version (repo, remote_digest, remote_record, commit_sha, extractor, built_at, manifest, manifest_sha, graph, graph_sha, report)
+      VALUES (?,?,?,?,?,?,?,?,?,?,?)`).run(lease.repo, map.remote.urlDigest, map.remote.record, map.commit, map.extractor, now.toISOString(), encoded.manifest, encoded.manifestSha, encoded.graph, encoded.graphSha, input.report);
+        const version = Number(stored.lastInsertRowid);
+        const pointer = store.handle.prepare("SELECT version FROM code_map_current WHERE repo = ?").get(lease.repo);
+        const at = pointer === undefined ? null : Number(pointer["version"]);
+        if (!sameIdentity(input.identity, trustedRemoteIdentity(store, lease.repo)))
+            return { version, current: false, why: "remote-changed" };
+        if (!codeMapOn(store, lease.repo))
+            return { version, current: false, why: "off" };
+        if (at !== input.startedFrom)
+            return { version, current: false, why: "pointer-moved" };
+        store.handle.prepare("INSERT INTO code_map_current (repo, version) VALUES (?, ?) ON CONFLICT (repo) DO UPDATE SET version = excluded.version").run(lease.repo, version);
+        return { version, current: true, why: "published" };
+    });
+}
+/** Keep the current version, the 10 before it and any named by an unfinished run. */
+export function tidyVersions(store, repo) {
+    return store.transact(() => {
+        const current = store.handle.prepare("SELECT version FROM code_map_current WHERE repo = ?").get(repo);
+        if (current === undefined)
+            return 0;
+        const ran = store.handle.prepare(`DELETE FROM code_map_version WHERE repo = ? AND id < ? AND id NOT IN (
+        SELECT id FROM code_map_version WHERE repo = ? AND id < ? ORDER BY id DESC LIMIT 10)
+      AND id NOT IN (SELECT s.version FROM code_map_snapshot s JOIN run r ON r.id = s.run WHERE s.version IS NOT NULL AND r.outcome IS NULL)`).run(repo, Number(current["version"]), repo, Number(current["version"]));
+        return Number(ran.changes);
+    });
+}
+/** A project removed from the lists: its map rows go with it, except what stays with its runs (snapshots, deliveries,
+ * family arms) and any version an unfinished run still names. */
+export function forgetCodeMap(store, repo) {
+    store.handle.prepare("DELETE FROM code_map_current WHERE repo = ?").run(repo);
+    store.handle.prepare("DELETE FROM code_map_refresh WHERE repo = ?").run(repo);
+    store.handle.prepare(`DELETE FROM code_map_version WHERE repo = ? AND id NOT IN (SELECT s.version FROM code_map_snapshot s JOIN run r ON r.id = s.run WHERE s.version IS NOT NULL AND r.outcome IS NULL)`).run(repo);
+}
+/** The startup check: a store at this version holds every table and trigger, or its map can't be trusted. */
+export function codeMapShapeProblem(db) {
+    const has = db.prepare("SELECT 1 FROM sqlite_master WHERE type = ? AND name = ?");
+    for (const table of V152_TABLES)
+        if (has.get("table", table) === undefined)
+            return `the code map table ${table} is missing`;
+    for (const trigger of V152_TRIGGERS)
+        if (has.get("trigger", trigger) === undefined)
+            return `the code map trigger ${trigger} is missing`;
+    return null;
+}

package/dist/coding-provider.d.ts

@@ -15,6 +15,8 @@ export type CodingCustody = {
     observationFailures?: ProcessObservationFailure[];
     host: string;
     bootId: string | null;
+    /** v150: this machine's stable id (machine-identity.ts); absent in custody saved before it. */
+    machineId?: string | null;
     container?: {
         backend: string;
         id: string;

package/dist/coding-provider.js

@@ -6,6 +6,7 @@ import { dirname, join } from "node:path";
 import { codexFenceConfig, fenceFor, FENCE_POLICY_CURRENT, runFolders, taskBoundary, trustedWorktreeBinding } from "./agent-fence.js";
 import { poolRootOf } from "./worktree.js";
 import { currentBootId } from "./boot-identity.js";
+import { currentMachineId } from "./machine-identity.js";
 import { createContainer, currentContainment } from "./containment.js";
 import { processMayBeAlive } from "./process-liveness.js";
 import { observeProcessTree, sampleProcessTree, stopProcessTree } from "./process-tree.js";
@@ -82,7 +83,7 @@ export function createCodexCodingProvider(options = {}) {
     const descendants = new Map();
     let ancestryUnknown = false;
     const observationFailures = [];
-    const host = hostname();
+    const host = hostname(), machineId = currentMachineId();
     // Bind the boot at creation, not when an old snapshot is requested later.
     const bootId = currentBootId();
     let nextId = 0;
@@ -94,7 +95,7 @@ export function createCodexCodingProvider(options = {}) {
         return {
             pid, group: pid !== null && process.platform !== "win32",
             descendants: [...descendants.values()].map(one => ({ ...one })),
-            observationUnknown: ancestryUnknown, host, bootId,
+            observationUnknown: ancestryUnknown, host, bootId, machineId,
             ...(observationFailures.length === 0 ? {} : { observationFailures: observationFailures.map(one => ({ ...one })) }),
             ...(container === null ? {} : { container: { backend: container.backend, id: container.id, ...(container.identity === undefined ? {} : { identity: container.identity }) } }),
         };

package/dist/coding-update.js

@@ -1,6 +1,6 @@
 import { createHash } from 'node:crypto';
 import { chmodSync, closeSync, fsyncSync, lstatSync, openSync } from 'node:fs';
-import { hostname } from 'node:os';
+import { isThisMachine } from './machine-identity.js';
 import { sqliteRuntime } from './sqlite-runtime.js';
 import { processMayBeAlive } from './process-liveness.js';
 const gatePrefix = 'so_coding_update_';
@@ -141,7 +141,8 @@ export function releaseStaleCodingOwner(orders, stoppedPids, alive = processMayB
                     c = {};
                 }
                 const processes = Array.isArray(c.descendants) ? c.descendants : null;
-                if (c.host !== hostname() || c.container || c.observationUnknown !== false || processes === null)
+                if (typeof c.host !== 'string' || (c.machineId !== undefined && c.machineId !== null && typeof c.machineId !== 'string')
+                    || !isThisMachine({ host: c.host, machineId: (c.machineId ?? null) }) || c.container || c.observationUnknown !== false || processes === null)
                     refuse("the agent's tool processes could not be accounted for");
                 const recorded = [...(c.pid === null ? [] : [{ pid: c.pid, group: c.group }]), ...processes];
                 for (const one of recorded) {

package/dist/coding-workspace.js

@@ -2,8 +2,8 @@ import { checkoutGit } from './teardown-git.js';
 import { createHash, randomUUID } from 'node:crypto';
 import { mkdirSync, chmodSync, realpathSync } from 'node:fs';
 import { dirname, join } from 'node:path';
-import { hostname } from 'node:os';
-import { provenDeadByBootChange } from './boot-identity.js';
+import { currentBootId, provenDeadByBootChange } from './boot-identity.js';
+import { isThisMachine } from './machine-identity.js';
 import { containerEmptiness } from './container-state.js';
 import { sqliteRuntime } from './sqlite-runtime.js';
 import { run } from './exec.js';
@@ -536,9 +536,9 @@ export class CodingWorkspace {
             return false;
         try {
             const c = readCodingCustodyWitness(String(row['payload']));
-            if (c === null || c.host !== hostname())
+            if (c === null || typeof c.host !== 'string' || !isThisMachine(c))
                 return false;
-            if (provenDeadByBootChange(c))
+            if (provenDeadByBootChange(c, { host: c.host, bootId: currentBootId() }))
                 return true;
             if (c.container)
                 return containerEmptiness(c.container.backend, c.container.id, process.platform, c.container.identity) === 'empty';

package/dist/console-chrome.js

@@ -49,11 +49,11 @@ export function projectSummaryOf(store, now, access, actor, projects, evidenceRo
     };
     const rows = projects.map(one => {
         const state = states.get(one.path);
-        return { path: one.path, name: one.name, href: `/work?project=${encodeURIComponent(one.path)}`, state: state?.state ?? "idle", counts: state?.counts ?? { ...NO_COUNTS }, ...railOf(state) };
+        return { path: one.path, name: one.name, href: `/tasks?project=${encodeURIComponent(one.path)}`, state: state?.state ?? "idle", counts: state?.counts ?? { ...NO_COUNTS }, ...railOf(state) };
     });
     const unplaced = states.get(null);
     if (unplaced !== undefined && unplaced.state !== "idle")
-        rows.push({ path: null, name: "No project", href: "/work", state: unplaced.state, counts: unplaced.counts, ...railOf(unplaced) });
+        rows.push({ path: null, name: "No project", href: "/tasks", state: unplaced.state, counts: unplaced.counts, ...railOf(unplaced) });
     return boundProjectSummary(rows);
 }
 /** One access, canonically and in full (every field it has, so a field added later keys too): the same reader and

package/dist/containment.d.ts

@@ -161,6 +161,11 @@ export type Container = {
     waitEmpty(timeoutMs: number): Promise<boolean>;
     /** Remove the OS object (only an empty one can go) and dismiss the janitor. */
     release(): void;
+    /** Hard limits on the whole object, set before `launch`; false when this object can't enforce them. */
+    limit?(limits: {
+        memoryBytes: number;
+        pids: number;
+    }): boolean;
 };
 export type ContainerFactory = (effective: EffectiveContainment, label: string) => Container;
 /** Tests: substitute the OS object (a scripted or file-backed stand-in). */

package/dist/containment.js

@@ -353,6 +353,17 @@ export function cgroup2Container(capability, label, mountOverride) {
         backend: "cgroup2",
         id: dir,
         identity,
+        limit({ memoryBytes, pids }) {
+            // The controllers exist here only if the delegated parent enabled them for its children.
+            try {
+                writeFileSync(join(dir, "memory.max"), String(memoryBytes));
+                writeFileSync(join(dir, "pids.max"), String(pids));
+                return true;
+            }
+            catch {
+                return false;
+            }
+        },
         launch(file, args) {
             return {
                 file: "/bin/sh",
@@ -445,6 +456,7 @@ export function jobObjectContainer(capability, label) {
     let authorized = false;
     let cancelled = false;
     let helperChild = null;
+    let memoryLimit = 0;
     const fail = (detail) => { failure ??= detail; if (state !== "empty")
         state = "lost"; connection?.destroy(); };
     const authorize = () => {
@@ -517,10 +529,11 @@ export function jobObjectContainer(capability, label) {
     };
     return {
         backend: "job-object", id, identity,
+        limit({ memoryBytes }) { memoryLimit = memoryBytes; return true; },
         launch(file, args) {
             return {
                 file: capability.powershell,
-                args: ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-File", capability.helper, "-Pipe", pipe, "-Encoded", Buffer.from(JSON.stringify([file, ...args]), "utf8").toString("base64"), "-JobName", id],
+                args: ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-File", capability.helper, "-Pipe", pipe, "-Encoded", Buffer.from(JSON.stringify([file, ...args]), "utf8").toString("base64"), "-JobName", id, ...(memoryLimit > 0 ? ["-MemoryLimit", String(memoryLimit)] : [])],
                 extraStdio: [],
                 async attach(child) {
                     // Called only after the durable onSpawn callback succeeded.

package/dist/contracts/chat-actions.d.ts

@@ -260,6 +260,13 @@ export declare const chatActionRequestSchemas: {
         repo: z.ZodString;
         trial: z.ZodInt;
     }, z.core.$strict>;
+    readonly code_map_switch: z.ZodObject<{
+        repo: z.ZodString;
+        on: z.ZodBoolean;
+    }, z.core.$strict>;
+    readonly code_map_holdout_end: z.ZodObject<{
+        repo: z.ZodString;
+    }, z.core.$strict>;
     /** The line, and (from 1) the line it replaces; 0 or none adds it. */
     readonly lead_about_you: z.ZodObject<{
         line: z.ZodString;
@@ -295,6 +302,8 @@ export declare const SHARED_ACTION_VERSION = 1;
 export declare const sharedActionSchema: z.ZodObject<{
     version: z.ZodLiteral<1>;
     operation: z.ZodEnum<{
+        code_map_holdout_end: "code_map_holdout_end";
+        code_map_switch: "code_map_switch";
         decision_record: "decision_record";
         decision_retire: "decision_retire";
         flow_browser: "flow_browser";

package/dist/contracts/chat-actions.js

@@ -85,6 +85,8 @@ export const chatActionRequestSchemas = {
     suggestion_not_now: z.strictObject({ repo: words, suggestion: words }),
     // Slice 3: stopping a trial (starting one stays in Settings → Models, behind a step-up).
     trial_stop: z.strictObject({ repo: words, trial: id }),
+    code_map_switch: z.strictObject({ repo: words, on: z.boolean() }),
+    code_map_holdout_end: z.strictObject({ repo: words }),
     /** The line, and (from 1) the line it replaces; 0 or none adds it. */
     lead_about_you: z.strictObject({ line: words, replaces: z.int().min(0).optional() }),
     scope_approve: z.strictObject({ task: words }),

package/dist/contracts/cli.d.ts

@@ -566,6 +566,58 @@ export declare const COMMAND_OUTPUTS: {
         reason: z.ZodString;
         message: z.ZodOptional<z.ZodString>;
     }, z.core.$loose>], "ok">;
+    readonly "task ready": z.ZodDiscriminatedUnion<[z.ZodObject<{
+        envelopeVersion: z.ZodLiteral<1>;
+        ok: z.ZodLiteral<true>;
+        command: z.ZodLiteral<"task ready">;
+        taskId: z.ZodString;
+        activeTaskId: z.ZodString;
+        run: z.ZodNullable<z.ZodNumber>;
+        head: z.ZodNullable<z.ZodString>;
+        answer: z.ZodEnum<{
+            merged: "merged";
+            no: "no";
+            "not-yet": "not-yet";
+            yes: "yes";
+        }>;
+        sentence: z.ZodString;
+        rows: z.ZodArray<z.ZodObject<{
+            key: z.ZodEnum<{
+                build: "build";
+                checks: "checks";
+                comments: "comments";
+                conflicts: "conflicts";
+                plan: "plan";
+                "pr-ci": "pr-ci";
+                "pull-request": "pull-request";
+                release: "release";
+                requirements: "requirements";
+                "up-to-date": "up-to-date";
+            }>;
+            label: z.ZodString;
+            mark: z.ZodEnum<{
+                no: "no";
+                skip: "skip";
+                unknown: "unknown";
+                waiting: "waiting";
+                yes: "yes";
+            }>;
+            say: z.ZodString;
+            act: z.ZodNullable<z.ZodObject<{
+                kind: z.ZodEnum<{
+                    fix: "fix";
+                    retry: "retry";
+                    "run-checks": "run-checks";
+                }>;
+            }, z.core.$loose>>;
+        }, z.core.$loose>>;
+    }, z.core.$loose>, z.ZodObject<{
+        envelopeVersion: z.ZodLiteral<1>;
+        ok: z.ZodLiteral<false>;
+        command: z.ZodLiteral<"task ready">;
+        reason: z.ZodString;
+        message: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>], "ok">;
     readonly "task hold": z.ZodDiscriminatedUnion<[z.ZodObject<{
         envelopeVersion: z.ZodLiteral<1>;
         ok: z.ZodLiteral<true>;

package/dist/contracts/cli.js

@@ -183,6 +183,10 @@ export const COMMAND_OUTPUTS = {
     // `status` is the observation's own answer (the one merges read); the rows are each check's timing.
     "task ship": answers("task ship", { task: str, pullRequest: int, githubRepo: str, head: str, observedAt: str, status: z.enum(["passing", "failing", "running", "none"]),
         checks: rows({ name: str, workflow: nullable(str), state: z.enum(["queued", "running", "passed", "failed", "skipped", "cancelled", "neutral"]), startedAt: nullable(str), completedAt: nullable(str), url: nullable(str), kind: z.enum(["run", "status"]), seconds: nullable(int) }) }),
+    // "Can I merge?" (merge-checklist.ts): the answer, its sentence, and one row per fact, each blocker with its act.
+    "task ready": answers("task ready", { taskId: str, activeTaskId: str, run: nullable(int), head: nullable(str), answer: z.enum(["yes", "no", "not-yet", "merged"]), sentence: str,
+        rows: rows({ key: z.enum(["plan", "build", "checks", "requirements", "pull-request", "pr-ci", "up-to-date", "conflicts", "comments", "release"]), label: str,
+            mark: z.enum(["yes", "no", "waiting", "unknown", "skip"]), say: str, act: nullable(z.looseObject({ kind: z.enum(["run-checks", "retry", "fix"]) })) }) }),
     "task hold": answers("task hold", { id: str, reason: str, until: nullable(str) }),
     "task unhold": answers("task unhold", { id: str }),
     "task wait": answers("task wait", { task: str, outcome: str }),

package/dist/contracts/console-api.d.ts

@@ -98,7 +98,7 @@ export declare const CONSOLE_FORMS: {
     readonly signIn: FormContract<"action" | "client-id" | "client-secret" | "groups-claim" | "issuer" | "label" | "password" | "passwords" | "scopes" | `group-${string}` | `projects-${string}` | `role-${string}`>;
     readonly updates: FormContract<"password" | "version" | "when">;
     readonly retention: FormContract<"chat" | "checkouts" | "evidence" | "notifications" | "password">;
-    readonly storage: FormContract<"cleanup" | "password" | "path" | "preview">;
+    readonly storage: FormContract<"cleanup" | "idle" | "password" | "path" | "preview">;
     readonly pullRequests: FormContract<"act" | "base" | "github" | "method" | "password" | "repo" | "when-green">;
     readonly checks: FormContract<"act" | "command" | "level" | "on" | "password" | "repo" | "timeout">;
     readonly backups: FormContract<"every" | "folder" | "keep" | "live_every" | "live_folder" | "password">;
@@ -115,6 +115,8 @@ export declare const CONSOLE_FORMS: {
     readonly modelsRules: FormContract<"id" | "password" | "rule" | "scope">;
     readonly knowledgeRefresh: FormContract<"repo">;
     readonly knowledgeProposal: FormContract<"decision" | "proposal" | "repo">;
+    readonly knowledgeNote: FormContract<"claim" | "decision" | "proposal" | "repo">;
+    readonly knowledgeTidy: FormContract<"action" | "choice" | "claim" | "proposal" | "repo" | "revision" | "target" | "why">;
     readonly knowledgeDecision: FormContract<"action" | "claim" | "decision" | "reason" | "repo" | "why">;
     readonly knowledgeChange: FormContract<"action" | "content" | "id" | "identity" | "instructions" | "path" | "repo" | "restore" | "revision" | "title">;
     readonly learningChange: FormContract<"action" | "identity" | "lesson" | "repo" | "revision" | "sha" | "version">;
@@ -140,7 +142,12 @@ export declare const CONSOLE_FORMS: {
     readonly projectsSelect: FormContract<"path" | "return">;
     readonly projectsRemove: FormContract<"repo">;
     readonly projectsOpen: FormContract<"path" | "return">;
-    readonly tasksAdd: FormContract<"acceptance" | "after" | "goal" | "id" | "not" | "permission-mode" | "plan-first" | "planning-policy" | "projectRevision" | "quality-mode" | "repo" | "scout" | "title" | "touches">;
+    readonly codeMap: FormContract<"on" | "repo">;
+    readonly codeMapRefresh: FormContract<never>;
+    readonly tasksFast: FormContract<"digest" | "preview">;
+    readonly keepGrown: FormContract<never>;
+    readonly releaseGoOn: FormContract<"password">;
+    readonly tasksAdd: FormContract<"acceptance" | "after" | "from" | "from-head" | "from-read" | "goal" | "id" | "not" | "permission-mode" | "plain" | "plan-first" | "planning-policy" | "projectRevision" | "quality-mode" | "repo" | "scout" | "title" | "touches">;
     readonly queue: FormContract<"before" | "column" | "from" | "note" | "projectRevision" | "queueRevision" | "respond" | "runner" | "task">;
     readonly runnerRegister: FormContract<"capacity" | "name" | "token">;
     readonly mode: FormContract<"auto-approve" | "chat-approve" | "days" | "digest" | "expiry" | "name" | "nonce" | "plan-auto" | "publication" | "repair-auto" | "review-auto" | "review-retry-auto" | "token">;
@@ -150,7 +157,7 @@ export declare const CONSOLE_FORMS: {
     readonly peopleRevoke: FormContract<"name" | "token">;
     readonly runnerRetire: FormContract<"name" | "token">;
     readonly decisionAnswer: FormContract<"choice" | "confirm" | "note" | "return">;
-    readonly confirmStopped: FormContract<"checked" | "return" | "run" | "token">;
+    readonly recheckStopped: FormContract<"return" | "run">;
     readonly merge: FormContract<"anyway" | "run" | "token">;
     readonly onboard: FormContract<"big-ok" | "nonce" | "repo" | "root" | "token">;
     readonly pushSubscribe: FormContract<"auth" | "endpoint" | "p256dh" | "token">;
@@ -198,8 +205,8 @@ export declare const CONSOLE_FORMS: {
     readonly taskRevision: FormContract<"revision-id" | "token">;
     readonly taskCancel: FormContract<"reason">;
     readonly taskRoute: FormContract<"agent" | "clear-phase" | "model" | "phase" | "provider" | "return" | "risky" | "sawDigest" | "size">;
-    readonly taskScope: FormContract<"acceptance" | "budget-microusd" | "budget-usd" | "goal" | "goal-brief" | "not" | "permission-mode" | "quality-mode" | "requirement" | "requirement-new" | "sawDigest" | "touches">;
-    readonly taskApprove: FormContract<"digest" | "nonce" | "rebuild" | "return" | "token">;
+    readonly taskScope: FormContract<"acceptance" | "budget-microusd" | "budget-usd" | "goal" | "goal-brief" | "not" | "permission-mode" | "quality-mode" | "requirement" | "requirement-how" | "requirement-new" | "requirement-new-how" | "sawDigest" | "touches">;
+    readonly taskApprove: FormContract<"digest" | "nonce" | "rebuild" | "return" | "sheet" | "token">;
     readonly taskAcceptProof: FormContract<"note" | "return" | "run">;
     readonly taskComplete: FormContract<"accept" | "note" | "publish" | "receipt" | "return" | "run">;
     readonly taskStop: FormContract<"return" | "run">;

package/dist/contracts/console-api.js

@@ -107,7 +107,7 @@ export const CONSOLE_FORMS = {
     signIn: formContract("POST /settings/sign-in", ["action", "password", "issuer", "client-id", "client-secret", "label", "scopes", "groups-claim", "passwords"], { prefixes: ["group-", "role-", "projects-"] }),
     updates: formContract("POST /settings/updates, /settings/updates/seen, /settings/updates/cancel", ["password", "version", "when"]),
     retention: formContract("POST /settings/retention", ["password", "evidence", "checkouts", "chat", "notifications"]),
-    storage: formContract("POST /settings/storage, /settings/storage/clean, /settings/storage/discard", ["password", "cleanup", "preview", "path"]),
+    storage: formContract("POST /settings/storage, /settings/storage/clean, /settings/storage/discard", ["password", "cleanup", "idle", "preview", "path"]),
     pullRequests: formContract("POST /settings/pull-requests", ["repo", "act", "password", "github", "base", "method", "when-green"]),
     checks: formContract("POST /settings/checks", ["repo", "password", "act", "on", "level", "command", "timeout"]),
     backups: formContract("POST /settings/backups", ["password", "every", "keep", "folder", "live_every", "live_folder"]),
@@ -129,6 +129,8 @@ export const CONSOLE_FORMS = {
     modelsRules: formContract("POST /settings/models/accept, /settings/models/keep, /settings/models/suggest-on, /settings/models/turn-off, /settings/models/not-now, /settings/models/suggest-off, /settings/models/try, /settings/models/stop", ["password", "scope", "id", "rule"]),
     knowledgeRefresh: formContract("POST /settings/knowledge/refresh", ["repo"]),
     knowledgeProposal: formContract("POST /settings/knowledge/proposal", ["repo", "decision", "proposal"]),
+    knowledgeNote: formContract("POST /settings/knowledge/note", ["repo", "decision", "proposal", "claim"]),
+    knowledgeTidy: formContract("POST /settings/knowledge/tidy", ["repo", "action", "proposal", "choice", "claim", "why", "target", "revision"]),
     knowledgeDecision: formContract("POST /settings/knowledge/decision", ["repo", "action", "claim", "why", "decision", "reason"]),
     knowledgeChange: formContract("POST /settings/knowledge/change", ["repo", "action", "identity", "revision", "instructions", "title", "content", "path", "id", "restore"]),
     learningChange: formContract("POST /settings/learning/change", ["repo", "action", "identity", "revision", "lesson", "version", "sha"]),
@@ -155,7 +157,12 @@ export const CONSOLE_FORMS = {
     projectsSelect: formContract("POST /projects/select", ["path", "return"]),
     projectsRemove: formContract("POST /projects/remove", ["repo"]),
     projectsOpen: formContract("POST /projects/open", ["path", "return"]),
-    tasksAdd: formContract("POST /tasks/add", ["projectRevision", "id", "title", "repo", "goal", "not", "touches", "scout", "permission-mode", "quality-mode", "after", "acceptance", "planning-policy", "plan-first"]),
+    codeMap: formContract("POST /settings/project/code-map, /settings/project/code-map/holdout", ["repo", "on"]),
+    codeMapRefresh: formContract("POST /projects/<project>/map/refresh", []),
+    tasksFast: formContract("POST /tasks/fast", ["preview", "digest"]),
+    keepGrown: formContract("POST /t/<id>/keep-grown", []),
+    releaseGoOn: formContract("POST /t/<id>/release/go-on", ["password"]),
+    tasksAdd: formContract("POST /tasks/add", ["projectRevision", "plain", "from", "from-head", "from-read", "id", "title", "repo", "goal", "not", "touches", "scout", "permission-mode", "quality-mode", "after", "acceptance", "planning-policy", "plan-first"]),
     queue: formContract("POST /queue/move, /queue/note", ["runner", "note", "from", "projectRevision", "respond", "task", "column", "before", "queueRevision"]),
     runnerRegister: formContract("POST /fleet/runner/register", ["token", "name", "capacity"]),
     mode: formContract("POST /mode/confirm, /mode/sign", ["name", "days", "auto-approve", "plan-auto", "chat-approve", "publication", "expiry", "nonce", "digest", "token", "review-auto", "review-retry-auto", "repair-auto"]),
@@ -165,7 +172,7 @@ export const CONSOLE_FORMS = {
     peopleRevoke: formContract("POST /people/revoke", ["token", "name"]),
     runnerRetire: formContract("POST /fleet/runner/retire", ["token", "name"]),
     decisionAnswer: formContract("POST /d/<id>/answer", ["return", "choice", "confirm", "note"]),
-    confirmStopped: formContract("POST /t/<task>/confirm-stopped", ["run", "token", "checked", "return"]),
+    recheckStopped: formContract("POST /t/<task>/recheck-stopped", ["run", "return"]),
     merge: formContract("POST /t/<task>/merge", ["run", "token", "anyway"]),
     onboard: formContract("POST /projects/onboard-preview, /projects/onboard-confirm", ["repo", "root", "token", "nonce", "big-ok"]),
     pushSubscribe: formContract("POST /push/subscribe", ["token", "endpoint", "p256dh", "auth"]),
@@ -216,8 +223,8 @@ export const CONSOLE_FORMS = {
     taskRevision: formContract("POST /t/<task>/accept-revision|reject-revision", ["revision-id", "token"]),
     taskCancel: formContract("POST /t/<task>/cancel", ["reason"]),
     taskRoute: formContract("POST /t/<task>/route", ["size", "risky", "phase", "clear-phase", "agent", "provider", "model", "sawDigest", "return"]),
-    taskScope: formContract("POST /t/<task>/scope", ["sawDigest", "permission-mode", "quality-mode", "budget-usd", "budget-microusd", "requirement", "requirement-new", "goal-brief", "goal", "not", "touches", "acceptance"]),
-    taskApprove: formContract("POST /t/<task>/approve", ["return", "digest", "token", "nonce", "rebuild"]),
+    taskScope: formContract("POST /t/<task>/scope", ["sawDigest", "permission-mode", "quality-mode", "budget-usd", "budget-microusd", "requirement", "requirement-new", "requirement-how", "requirement-new-how", "goal-brief", "goal", "not", "touches", "acceptance"]),
+    taskApprove: formContract("POST /t/<task>/approve", ["return", "digest", "token", "nonce", "rebuild", "sheet"]),
     taskAcceptProof: formContract("POST /t/<task>/accept-proof", ["run", "note", "return"]),
     taskComplete: formContract("POST /t/<task>/complete", ["receipt", "run", "accept", "note", "publish", "return"]),
     taskStop: formContract("POST /t/<task>/stop", ["run", "return"]),