toolroll 0.9.93 → 0.9.94

package/dist/remote-main.js

@@ -13,7 +13,7 @@
  * Every doubt fails closed: no recorded remote, a URL that isn't allowed, a failed fetch or a remote without main all
  * read as "not proven", and the task stays for a person.
  */
-import { mkdirSync, mkdtempSync, rmSync, existsSync } from "node:fs";
+import { lstatSync, mkdirSync, mkdtempSync, readFileSync, rmSync, existsSync } from "node:fs";
 import { isAbsolute, join } from "node:path";
 import { run } from "./exec.js";
 /** The ref a fetched remote main is kept under, inside the private directory only. */
@@ -35,7 +35,9 @@ export const CREDENTIAL_HELPER = process.platform === "darwin" ? "osxkeychain" :
 function hardened(helper, file = "never") {
     return ["-c", "core.hooksPath=/dev/null", "-c", "protocol.allow=never", "-c", "protocol.https.allow=always", "-c", "protocol.ssh.allow=always",
         "-c", `protocol.file.allow=${file}`, "-c", "protocol.ext.allow=never", "-c", "credential.helper=", ...(helper === "" ? [] : ["-c", `credential.helper=${helper}`]),
-        "-c", "gc.auto=0", "-c", "maintenance.auto=false", "-c", "fetch.recurseSubmodules=false", "-c", "core.fsmonitor=false"];
+        "-c", "gc.auto=0", "-c", "maintenance.auto=false", "-c", "fetch.recurseSubmodules=false", "-c", "core.fsmonitor=false",
+        // Never to an address the recorded URL doesn't name: a moved repository is a person's choice to record (MOVED).
+        "-c", "http.followRedirects=false"];
 }
 /**
  * A URL Toolroll may fetch remote main from: https or ssh (either form). Local paths, file URLs and loopback hosts
@@ -96,6 +98,14 @@ export function remoteUrlProblem(url) {
     const parsed = parseRemoteUrl(url);
     return "why" in parsed ? parsed.why : null;
 }
+/** What every reader of a remote main shows when its address redirects. The target is remote-supplied text: it is never
+ * shown, stored or followed, and the new remote is never adopted automatically. */
+export const REMOTE_MOVED = "The repository moved: its address now redirects. Update the project's remote in Toolroll (Settings → Projects), then try again.";
+/** git's words for a refused redirect (http.followRedirects=false), read for the status code alone. */
+export function redirected(stderr) {
+    return /returned error: 30[12378]\b/.test(stderr);
+}
+const UNREAD = "Toolroll couldn't read the project's remote main";
 /**
  * One pass's reads of recorded remotes. Every `read` fetches again (the pre-teardown re-check is never older than
  * the teardown); a project's private directory lasts until `close`, so a fetch after the first only brings what
@@ -145,14 +155,16 @@ export class RemoteMains {
             return { ok: false, why: problem };
         const dir = await this.dirFor(repo);
         if (dir === null)
-            return { ok: false, why: "Toolroll couldn't read the project's remote main" };
+            return { ok: false, why: UNREAD };
         const fetched = await this.exec(dir, ["fetch", "--quiet", "--no-tags", "--no-write-fetch-head", "--", url, `+refs/heads/main:${REMOTE_MAIN}`]);
+        if (fetched.code !== 0 && redirected(fetched.stderr))
+            return { ok: false, why: REMOTE_MOVED, reason: "moved" };
         if (fetched.code !== 0 || !this.clean(dir))
-            return { ok: false, why: "Toolroll couldn't read the project's remote main" };
+            return { ok: false, why: UNREAD };
         const resolved = await this.exec(dir, ["rev-parse", "--verify", "--quiet", `${REMOTE_MAIN}^{commit}`]);
         const main = resolved.stdout.trim();
         if (resolved.code !== 0 || !SHA.test(main))
-            return { ok: false, why: "Toolroll couldn't read the project's remote main" };
+            return { ok: false, why: UNREAD };
         const git = args => this.exec(dir, args);
         const bring = async (from, head) => {
             if (!SHA.test(head))
@@ -177,3 +189,70 @@ export class RemoteMains {
         this.dirs.clear();
     }
 }
+// ---- the code map's own read: pinned, depth 1, bounded (docs/plans/code-map.md §1) ---------------------------------
+const MAP_MAIN = "refs/toolroll/map-main";
+/** What keeps git's own memory down. index-pack still materializes delta bases, so these reduce; they don't bound. */
+const LOW_MEMORY = ["-c", "pack.threads=1", "-c", "core.deltaBaseCacheLimit=32m", "-c", "core.bigFileThreshold=1m"];
+export const MAP_FETCH_LIMITS = { timeoutMs: 120_000, memoryBytes: 1024 ** 3, diskBytes: 1024 ** 3, fileBytes: 512 * 1024 ** 2, maxStderr: 64 * 1024 };
+/** Git in a private directory under the map's rules: the same hardening as `RemoteMains`, plus the pin. */
+export function mapGitArgs(dir, pin, args, options = {}) {
+    return ["--git-dir", dir, ...hardened(options.helper ?? CREDENTIAL_HELPER), ...pin.gitArgs, ...(options.extra ?? []), ...args];
+}
+/** The environment for it: exactly the allowed names, the fixed settings, and the pin's. */
+export function mapGitEnv(pin, from = process.env) {
+    const env = {};
+    for (const name of ENV_ALLOWLIST) {
+        const value = from[name];
+        if (value !== undefined)
+            env[name] = value;
+    }
+    return { ...env, ...ENV, ...pin.env };
+}
+export function initPrivateDir(dir, bounded) {
+    return bounded("git", ["init", "--quiet", "--bare", "--template=", dir], { cwd: dir, env: mapGitEnv({ gitArgs: [], env: {}, proxy: null }), timeoutMs: 30_000, maxStdout: 4096, maxStderr: 4096, label: "code-map-init" });
+}
+/** The commit the recorded remote's main is at, without fetching: null when the remote has no `main`. */
+export async function peekMain(url, dir, pin, bounded, helper) {
+    const ran = await bounded("git", mapGitArgs(dir, pin, ["ls-remote", "--", url, "refs/heads/main"], helper === undefined ? {} : { helper }), { cwd: dir, env: mapGitEnv(pin), timeoutMs: 30_000, maxStdout: 64 * 1024, maxStderr: MAP_FETCH_LIMITS.maxStderr, label: "code-map-peek" });
+    if (ran.code !== 0 && redirected(ran.stderr))
+        return { ok: false, why: REMOTE_MOVED, reason: "moved" };
+    if (ran.code !== 0 || ran.killed !== null)
+        return { ok: false, why: UNREAD };
+    const line = ran.stdout.toString("utf8").split("\n").find(one => one.endsWith("\trefs/heads/main"));
+    if (line === undefined)
+        return ran.stdout.length === 0 ? { ok: true, commit: null } : { ok: false, why: UNREAD };
+    const commit = line.slice(0, line.indexOf("\t"));
+    return SHA.test(commit) ? { ok: true, commit } : { ok: false, why: UNREAD };
+}
+/** A depth-1 private folder is clean when it holds only what the fetch made: a `shallow` file naming exactly the fetched
+ * commit, and no grafts or alternates. */
+export function shallowClean(dir, commit) {
+    if ([join("info", "grafts"), join("objects", "info", "alternates"), join("objects", "info", "http-alternates")].some(name => existsSync(join(dir, name))))
+        return false;
+    try {
+        const held = lstatSync(join(dir, "shallow"));
+        if (!held.isFile() || held.size > 128)
+            return false;
+        return readFileSync(join(dir, "shallow"), "utf8").trim() === commit;
+    }
+    catch (error) {
+        // A history of one commit needs no shallow boundary, and git writes none.
+        return error.code === "ENOENT";
+    }
+}
+/** Fetch main at depth 1 into `dir`, under the map's limits. `onStart` records the spawn for crash cleanup. */
+export async function readShallowMain(url, dir, pin, bounded, onStart, helper) {
+    const fetched = await bounded("git", mapGitArgs(dir, pin, ["fetch", "--quiet", "--depth=1", "--no-tags", "--no-write-fetch-head", "--", url, `+refs/heads/main:${MAP_MAIN}`], { extra: LOW_MEMORY, ...(helper === undefined ? {} : { helper }) }), { cwd: dir, env: mapGitEnv(pin), timeoutMs: MAP_FETCH_LIMITS.timeoutMs, maxStdout: 4096, maxStderr: MAP_FETCH_LIMITS.maxStderr, memoryBytes: MAP_FETCH_LIMITS.memoryBytes,
+        diskBytes: MAP_FETCH_LIMITS.diskBytes, fileBytes: MAP_FETCH_LIMITS.fileBytes, folder: dir, label: "code-map-fetch", ...(onStart === undefined ? {} : { onStart }) });
+    if (fetched.code !== 0 && redirected(fetched.stderr))
+        return { ok: false, why: REMOTE_MOVED, reason: "moved" };
+    if (fetched.killed !== null)
+        return { ok: false, why: `the fetch went past its ${fetched.killed} limit` };
+    if (fetched.code !== 0)
+        return { ok: false, why: UNREAD };
+    const resolved = await bounded("git", mapGitArgs(dir, pin, ["rev-parse", "--verify", "--quiet", `${MAP_MAIN}^{commit}`]), { cwd: dir, env: mapGitEnv(pin), timeoutMs: 30_000, maxStdout: 4096, maxStderr: 4096, label: "code-map-rev" });
+    const commit = resolved.stdout.toString("utf8").trim();
+    if (resolved.code !== 0 || !SHA.test(commit) || !shallowClean(dir, commit))
+        return { ok: false, why: UNREAD };
+    return { ok: true, commit, enforced: fetched.enforced };
+}

package/dist/repository-context.d.ts

@@ -3,7 +3,8 @@ export type RepositoryContextRequest = {
     query: string;
     mode?: 'search' | 'impact';
     audience?: 'lead' | 'crew';
-    /** Canonical admitted project when repo is a crew worktree. Must share its Git common directory. */
+    /** The admitted project from Toolroll's records: repo itself, or the project a crew worktree belongs to. Every read is
+     * bound to its git folder. */
     project?: string;
     baseRevision?: string;
     cacheRoot?: string;
@@ -16,7 +17,7 @@ export type RepositoryCheckout = {
     head: string;
     baseRevision: string;
     sourceHash: string;
-    source: 'working-tree';
+    source: 'working-tree' | 'base-commit';
 };
 export type RepositoryRelationship = {
     from: string;

package/dist/repository-context.js

@@ -1,11 +1,12 @@
 /** Optional repository context. Callers admit project access; this module grants no authority.
  * The index is disposable. Every read hashes the current bounded tracked source set;
  * a missing/changed/unreadable index falls back to ordinary text search, never a task gate. */
-import { checkoutGitSync } from './teardown-git.js';
+import { checkoutGitSync, viewedGitSync } from './teardown-git.js';
 import { createHash, randomUUID } from 'node:crypto';
 import { existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
 import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { scanForSecrets } from './evidence.js';
+import { compilerOptionsOf, extractFile, resolveAll } from './code-extract.js';
 const VERSION = 1;
 const MAX_FILES = 1200, MAX_FILE_BYTES = 256_000, MAX_SOURCE_BYTES = 12_000_000;
 const CODE = /\.(?:[cm]?[jt]sx?)$/i;
@@ -15,31 +16,23 @@ const sha = (value) => createHash('sha256').update(value).digest('hex');
 // Read-only and bounded, and always the hardened checkout git (a crew worktree is agent-written, and a page read or a
 // lead's refresh reads it alike): no filter, hook, program or network, its config and info frozen in a view of the
 // plane's own before they're inspected (teardown-git.ts checkoutGitSync).
-const git = (repo, args) => checkoutGitSync(repo, args, { timeoutMs: 10_000, maxBuffer: 2_000_000 }).trimEnd();
+// Bound to the project's record, so a pointer or commondir can't turn the read to another repository.
+const git = (repo, args, binding) => checkoutGitSync(repo, args, { timeoutMs: 10_000, maxBuffer: 2_000_000, binding }).trimEnd();
 const inside = (root, path) => { const r = relative(root, path); return r !== '..' && !r.startsWith('..' + sep) && !isAbsolute(r); };
-function capture(request) {
-    const repo = realpathSync(request.repo);
-    if (repo !== resolve(request.repo))
-        throw Error('The project location changed.');
-    if (realpathSync(git(repo, ['rev-parse', '--show-toplevel'])) !== repo)
-        throw Error('Choose the project checkout root.');
-    const head = git(repo, ['rev-parse', '--verify', 'HEAD']);
-    const baseRevision = request.baseRevision ?? head;
-    if (!/^[a-f0-9]{40,64}$/.test(baseRevision) || git(repo, ['rev-parse', '--verify', `${baseRevision}^{commit}`]) !== baseRevision)
-        throw Error('The requested context base is unavailable.');
-    if (request.audience === 'crew' && baseRevision !== head)
-        throw Error('Crew context must start at its exact task base.');
-    const gitDir = realpathSync(git(repo, ['rev-parse', '--absolute-git-dir']));
-    if (request.project && realpathSync(git(repo, ['rev-parse', '--path-format=absolute', '--git-common-dir'])) !== realpathSync(git(request.project, ['rev-parse', '--path-format=absolute', '--git-common-dir'])))
-        throw Error('The worktree belongs to a different project.');
-    const files = git(repo, ['ls-files', '-z', '--cached']).split('\0').filter(Boolean).sort();
-    const sources = [], warnings = [];
+/** Whether a tracked path is one the index reads, by its name alone. */
+const skippedPath = (file) => !TEXT.test(file) || /(?:^|\/)(?:node_modules|vendor|dist|build|coverage|\.git)(?:\/|$)/.test(file);
+const unsafePath = (file) => file.split('/').some(p => p === '..') || /[\x00-\x1f]/.test(file);
+const unreadableText = (data, text) => data.length > MAX_FILE_BYTES || /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f\ufffd]/u.test(text) || scanForSecrets(text).length > 0;
+/** The working tree's tracked files, for a lead or a person looking at the project's own checkout. */
+function workingTreeSources(repo, binding) {
+    const files = git(repo, ['ls-files', '-z', '--cached'], binding).split('\0').filter(Boolean).sort();
+    const sources = [];
     let omitted = 0, omittedBytes = 0, bytes = 0;
     for (const file of [...new Set(files)]) {
-        if (!TEXT.test(file) || /(?:^|\/)(?:node_modules|vendor|dist|build|coverage|\.git)(?:\/|$)/.test(file))
+        if (skippedPath(file))
             continue;
         const path = resolve(repo, file);
-        if (!inside(repo, path) || file.split('/').some(p => p === '..') || /[\x00-\x1f]/.test(file)) {
+        if (!inside(repo, path) || unsafePath(file)) {
             omitted++;
             continue;
         }
@@ -57,7 +50,7 @@ function capture(request) {
             }
             const data = readFileSync(path);
             const text = data.toString('utf8');
-            if (data.length > MAX_FILE_BYTES || /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f\ufffd]/u.test(text) || scanForSecrets(text).length) {
+            if (unreadableText(data, text)) {
                 omitted++;
                 omittedBytes += data.length;
                 continue;
@@ -69,13 +62,91 @@ function capture(request) {
             omitted++;
         }
     }
-    if (git(repo, ['rev-parse', '--verify', 'HEAD']) !== head)
+    return { sources, omitted, omittedBytes };
+}
+/**
+ * A crew's sources: the task base's tree and raw blobs, never the working tree an agent writes. A dirty tracked file,
+ * a symlink swapped in or a replace ref is not read; no filter runs on a raw blob.
+ */
+function baseCommitSources(repo, base, binding) {
+    const read = (args, maxBuffer, input) => {
+        const ran = viewedGitSync(repo, ['--no-replace-objects', ...args], { timeoutMs: 10_000, maxBuffer, binding, buffer: true, ...(input === undefined ? {} : { input }) });
+        if (ran.status !== 0)
+            throw Error('The task base could not be read.');
+        return ran.stdout;
+    };
+    const wanted = [];
+    let omitted = 0, omittedBytes = 0, bytes = 0;
+    for (const entry of read(['ls-tree', '-r', '-l', '-z', base], 16_000_000).toString('utf8').split('\0')) {
+        const match = /^(\d{6}) (\w+) ([0-9a-f]{40,64}) +(\d+|-)\t(.+)$/s.exec(entry);
+        if (!match)
+            continue;
+        const [, mode, kind, oid, sized, file] = match;
+        if (skippedPath(file))
+            continue;
+        const size = sized === '-' ? 0 : Number(sized);
+        if (unsafePath(file) || kind !== 'blob' || (mode !== '100644' && mode !== '100755')) {
+            omitted++;
+            continue;
+        }
+        if (wanted.length >= MAX_FILES || size > MAX_FILE_BYTES || bytes + size > MAX_SOURCE_BYTES) {
+            omitted++;
+            omittedBytes += size;
+            continue;
+        }
+        wanted.push({ file, oid });
+        bytes += size;
+    }
+    wanted.sort((a, b) => (a.file < b.file ? -1 : a.file > b.file ? 1 : 0));
+    const sources = [];
+    if (wanted.length === 0)
+        return { sources, omitted, omittedBytes };
+    const out = read(['cat-file', '--batch'], MAX_SOURCE_BYTES + wanted.length * 128 + 4096, Buffer.from(wanted.map(w => w.oid).join('\n') + '\n'));
+    let at = 0;
+    for (const { file, oid } of wanted) {
+        const end = out.indexOf(0x0a, at);
+        const header = end < 0 ? null : /^([0-9a-f]{40,64}) blob (\d+)$/.exec(out.subarray(at, end).toString('latin1'));
+        if (end < 0 || header === null || header[1] !== oid)
+            throw Error('The task base could not be read.');
+        const size = Number(header[2]);
+        const data = out.subarray(end + 1, end + 1 + size);
+        at = end + 1 + size + 1;
+        const text = data.toString('utf8');
+        if (unreadableText(data, text)) {
+            omitted++;
+            omittedBytes += data.length;
+            continue;
+        }
+        sources.push({ file, text, sha256: sha(data) });
+    }
+    return { sources, omitted, omittedBytes };
+}
+function capture(request) {
+    const repo = realpathSync(request.repo);
+    if (repo !== resolve(request.repo))
+        throw Error('The project location changed.');
+    // The project's record, never the checkout's own pointer files: the admitted project, or the one a crew worktree
+    // belongs to. Only a person's local look at an unrecorded folder has none.
+    const binding = { repo: request.project ?? null };
+    if (realpathSync(git(repo, ['rev-parse', '--show-toplevel'], binding)) !== repo)
+        throw Error('Choose the project checkout root.');
+    const head = git(repo, ['rev-parse', '--verify', 'HEAD'], binding);
+    const baseRevision = request.baseRevision ?? head;
+    if (!/^[a-f0-9]{40,64}$/.test(baseRevision) || git(repo, ['rev-parse', '--verify', `${baseRevision}^{commit}`], binding) !== baseRevision)
+        throw Error('The requested context base is unavailable.');
+    if (request.audience === 'crew' && baseRevision !== head)
+        throw Error('Crew context must start at its exact task base.');
+    const gitDir = realpathSync(git(repo, ['rev-parse', '--absolute-git-dir'], binding));
+    const crew = request.audience === 'crew';
+    const { sources, omitted, omittedBytes } = crew ? baseCommitSources(repo, baseRevision, binding) : workingTreeSources(repo, binding);
+    if (git(repo, ['rev-parse', '--verify', 'HEAD'], binding) !== head)
         throw Error('The checkout changed while context was being read.');
+    const warnings = [];
     if (omitted)
         warnings.push(`${omitted} source files were omitted because they were unavailable, excluded, sensitive or beyond the read limits.`);
     warnings.push('Tracked files only. Static imports do not establish every runtime dependency or sufficient test coverage.');
     const sourceHash = sha(JSON.stringify(sources.map(({ file, sha256 }) => [file, sha256])));
-    return { checkout: { repo, gitDir, head, baseRevision, sourceHash, source: 'working-tree' }, sources, omitted, omittedBytes, warnings };
+    return { checkout: { repo, gitDir, head, baseRevision, sourceHash, source: crew ? 'base-commit' : 'working-tree' }, sources, omitted, omittedBytes, warnings };
 }
 function cacheFile(root, checkout) {
     const absolute = resolve(root);
@@ -135,62 +206,33 @@ async function buildIndex(snapshot) {
             dir = dirname(dir);
         }
     }
-    let options = { module: compiler.ModuleKind.NodeNext, moduleResolution: compiler.ModuleResolutionKind.NodeNext, allowJs: true, resolveJsonModule: true };
     const config = byPath.get(join(snapshot.checkout.repo, 'tsconfig.json'));
+    const { options, problem } = compilerOptionsOf(compiler, join(snapshot.checkout.repo, 'tsconfig.json'), config?.text, snapshot.checkout.repo);
     const warnings = [];
-    if (config) {
-        const parsed = compiler.parseConfigFileTextToJson(join(snapshot.checkout.repo, config.file), config.text);
-        if (!parsed.error && parsed.config?.compilerOptions) {
-            const converted = compiler.convertCompilerOptionsFromJson(parsed.config.compilerOptions, snapshot.checkout.repo);
-            options = { ...options, ...converted.options };
-            if (parsed.config.extends)
-                warnings.push('Inherited tsconfig settings are not indexed; unresolved aliases remain omitted.');
-        }
-        else
-            warnings.push('TypeScript configuration could not be read; relative imports still work.');
-    }
+    if (problem === 'extends')
+        warnings.push('Inherited tsconfig settings are not indexed; unresolved aliases remain omitted.');
+    else if (problem === 'unreadable')
+        warnings.push('TypeScript configuration could not be read; relative imports still work.');
+    const resolveOne = resolveAll(compiler, snapshot.checkout.repo, byPath, directories, options, resolve);
     const nodes = [], relationships = [];
     let unresolved = 0, parseFailures = 0;
-    const host = {
-        fileExists: file => byPath.has(resolve(file)),
-        readFile: file => byPath.get(resolve(file))?.text,
-        directoryExists: dir => directories.has(resolve(dir)),
-        getCurrentDirectory: () => snapshot.checkout.repo,
-        realpath: file => resolve(file),
-    };
     for (const source of snapshot.sources.filter(s => CODE.test(s.file))) {
         const fileName = resolve(snapshot.checkout.repo, source.file);
-        const tree = compiler.createSourceFile(fileName, source.text, compiler.ScriptTarget.Latest, true);
-        if (tree.parseDiagnostics?.length)
+        const read = extractFile(compiler, fileName, source.text);
+        if (read.parseFailed)
             parseFailures++;
-        const line = (pos) => tree.getLineAndCharacterOfPosition(Math.min(pos, source.text.length)).line + 1;
-        const relationship = (specifier, kind, at) => {
-            const resolved = compiler.resolveModuleName(specifier, fileName, options, host).resolvedModule?.resolvedFileName;
-            if (!resolved || !byPath.has(resolve(resolved))) {
+        for (const one of read.declarations)
+            if (nodes.length < MAX_NODES)
+                nodes.push({ file: source.file, name: one.name, line: one.line, endLine: one.endLine });
+        for (const one of read.specifiers) {
+            const resolved = resolveOne(one.specifier, fileName);
+            if (resolved === null) {
                 unresolved++;
-                return;
+                continue;
             }
             if (relationships.length < MAX_EDGES)
-                relationships.push({ from: source.file, to: byPath.get(resolve(resolved)).file, kind, file: source.file, line: line(at), provenance: 'explicit' });
-        };
-        const visit = (node) => {
-            if (nodes.length < MAX_NODES && (compiler.isFunctionDeclaration(node) || compiler.isClassDeclaration(node) || compiler.isInterfaceDeclaration(node) || compiler.isTypeAliasDeclaration(node) || compiler.isEnumDeclaration(node) || compiler.isMethodDeclaration(node) || compiler.isVariableDeclaration(node))) {
-                const name = node.name;
-                if (name && compiler.isIdentifier(name))
-                    nodes.push({ file: source.file, name: name.text, line: line(node.getStart(tree)), endLine: line(node.end) });
-            }
-            if (compiler.isImportDeclaration(node) && compiler.isStringLiteral(node.moduleSpecifier))
-                relationship(node.moduleSpecifier.text, 'imports', node.getStart(tree));
-            if (compiler.isExportDeclaration(node) && node.moduleSpecifier && compiler.isStringLiteral(node.moduleSpecifier))
-                relationship(node.moduleSpecifier.text, 're-exports', node.getStart(tree));
-            if (compiler.isCallExpression(node) && node.arguments.length === 1 && compiler.isStringLiteral(node.arguments[0])) {
-                if (node.expression.kind === compiler.SyntaxKind.ImportKeyword)
-                    relationship(node.arguments[0].text, 'dynamic-import', node.getStart(tree));
-                // require may be shadowed; do not present a guessed call as a proven relationship.
-            }
-            compiler.forEachChild(node, visit);
-        };
-        visit(tree);
+                relationships.push({ from: source.file, to: byPath.get(resolved).file, kind: one.kind, file: source.file, line: one.line, provenance: 'explicit' });
+        }
     }
     if (unresolved)
         warnings.push(`${unresolved} external or unresolved imports were omitted.`);

package/dist/restart-certification.d.ts

@@ -77,6 +77,7 @@ export type RestartBaseline = {
             bootId: string | null;
             containment: string | null;
             open: boolean;
+            machineId?: string | null;
         }[];
     };
     limits: readonly string[];

package/dist/restart-certification.js

@@ -25,6 +25,7 @@ import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { existsSync, readFileSync, realpathSync, readdirSync, statSync } from "node:fs";
 import { bootIdentity, provenDeadByBootChange } from "./boot-identity.js";
+import { sameMachineHost } from "./machine-identity.js";
 import { containmentStatus, currentContainment } from "./containment.js";
 import { daemonStatus } from "./daemon.js";
 import { isAlive } from "./runner.js";
@@ -70,8 +71,8 @@ export async function recordRestartBaseline(inputs) {
         .map(row => ({ run: Number(row["run"]), taskRef: Number(row["task_ref"]), requestedAt: String(row["requested_at"]), problem: store.stopQuiescenceProblem(Number(row["run"])) }));
     const openRuns = raw.prepare("SELECT id, task_ref, role, runner, lease_id FROM run WHERE outcome IS NULL ORDER BY id").all()
         .map(row => ({ id: Number(row["id"]), taskRef: Number(row["task_ref"]), role: String(row["role"]), runner: String(row["runner"]), leaseId: String(row["lease_id"]) }));
-    const witnesses = raw.prepare("SELECT run, pid, host, boot_id, containment, exited_at FROM run_process WHERE exited_at IS NULL ORDER BY id").all()
-        .map(row => ({ run: Number(row["run"]), pid: row["pid"] === null ? null : Number(row["pid"]), host: String(row["host"]), bootId: row["boot_id"] === null ? null : String(row["boot_id"]), containment: row["containment"] === null ? null : String(row["containment"]), open: true }));
+    const witnesses = raw.prepare("SELECT run, pid, host, boot_id, containment, exited_at, machine_id FROM run_process WHERE exited_at IS NULL ORDER BY id").all()
+        .map(row => ({ run: Number(row["run"]), pid: row["pid"] === null ? null : Number(row["pid"]), host: String(row["host"]), bootId: row["boot_id"] === null ? null : String(row["boot_id"]), containment: row["containment"] === null ? null : String(row["containment"]), open: true, machineId: row["machine_id"] == null ? null : String(row["machine_id"]) }));
     return {
         version: 2,
         runnerName: inputs.runnerName ?? null,
@@ -123,7 +124,8 @@ export async function verifyRestartRecovery(inputs) {
     const sameDatabase = baseline.version === 2 && baseline.database.identity === current.database.identity;
     checks.push({ name: "database", ok: sameDatabase, detail: sameDatabase ? "same database file identity" : "database identity differs or baseline predates identity verification; no recovery mutations performed" });
     // 1. Boot identity, as the OS reports it.
-    const sameHost = baseline.host === current.host;
+    // This machine under any of its own names (machine-identity.ts): a reboot onto another network can move the hostname.
+    const sameHost = sameMachineHost(baseline.host, current.host);
     const bootChanged = !sameHost || baseline.boot.id === null || current.boot.id === null
         ? null
         : provenDeadByBootChange({ host: current.host, bootId: baseline.boot.id }, { host: current.host, bootId: current.boot.id });
@@ -153,7 +155,7 @@ export async function verifyRestartRecovery(inputs) {
     }
     const baselineBeats = new Map(baseline.database.runners.map(one => [one.name, one.heartbeatAt]));
     const liveRunners = current.database.runners.filter(one => !one.retired);
-    const fresh = liveRunners.filter(one => one.host === current.host && one.alive && (baseline.runnerName === null || one.name === baseline.runnerName) && baselineBeats.has(one.name) && one.heartbeatAt > baselineBeats.get(one.name));
+    const fresh = liveRunners.filter(one => sameMachineHost(one.host, current.host) && one.alive && (baseline.runnerName === null || one.name === baseline.runnerName) && baselineBeats.has(one.name) && one.heartbeatAt > baselineBeats.get(one.name));
     checks.push({
         name: "heartbeat",
         ok: fresh.length > 0,
@@ -187,8 +189,8 @@ export async function verifyRestartRecovery(inputs) {
                 ? `every run open at the baseline has ended (${baseline.database.openRuns.map(run => `#${run.id}`).join(", ")})`
                 : `still open from before: ${staleOpen.map(run => `#${run.id} (${run.role}, ${run.runner})`).join(", ")} — recovery has not run, or its lease is still live`,
     });
-    const oldWitnesses = baseline.database.witnesses.filter(one => one.bootId !== null && current.boot.id !== null && one.host === current.host);
-    const survivors = oldWitnesses.filter(one => !provenDeadByBootChange({ host: one.host, bootId: one.bootId }, { host: current.host, bootId: current.boot.id }));
+    const oldWitnesses = baseline.database.witnesses.filter(one => one.bootId !== null && current.boot.id !== null && sameMachineHost(one.host, current.host, one.machineId));
+    const survivors = oldWitnesses.filter(one => !provenDeadByBootChange({ host: one.host, bootId: one.bootId }, { host: one.host, bootId: current.boot.id }));
     checks.push({
         name: "old-boot-custody",
         ok: bootChanged !== true || survivors.length === 0,

package/dist/result-acts.d.ts

@@ -1,26 +1,25 @@
-/** The result page's acts (2026-10-02), chosen in one place: exactly one ink
- * act, the one that resolves the result's state, and never navigation; at
- * most one outline act beside it. A result that can't be accepted says why
- * in one line before them.
+/** The result page's acts (2026-10-02; docs/plans/plain-toolroll.md P1.3), chosen in one place: three verbs, each a
+ * relabel over the post it has always made. Exactly one ink act at most, the one that resolves the result's state,
+ * and never navigation; at most one outline act beside it. A result that can't be accepted says why in one line
+ * before them. Run checks stays in the Checks row, and a person's own checks in the Checks list: neither is an act here.
  *
- *   everything met                      → Accept and finish
- *   a "You check this one" unanswered   → the next check, then Accept without your check
- *   a check you marked Not right        → Request changes, then Accept anyway
- *   checks queued or running            → Checks running (disabled), then Accept without checks
- *   checks didn't run, a check exists   → Run checks, then Accept without checks
+ *   everything met                      → Accept
+ *   a "You check this one" unanswered   → (the check itself, above), then Accept without your check
+ *   a check you marked Not right        → Send back, then Accept anyway
+ *   checks queued or running            → (Checks running, in its row), then Accept without checks
+ *   checks didn't run, a check exists   → (Run checks, in its row), then Accept without checks
  *   report and changes disagree,
- *   or the proof is refuted             → Request changes, then Accept (as allowed);
+ *   or the proof is refuted             → Send back, then Accept (as allowed);
  *                                         never Accept as ink, even with no form here
- *   a Needs you form resolves it        → that form (Build again, Check again)
- *   saved notes or a failing PR         → Revise / Draft a repair task
- *   a failed build                      → Retry (its note starts with what to change), then Run checks when they
- *                                         didn't run; never Accept: a failed build is not a result to accept
+ *   a Needs you form resolves it        → that form (Retry: Build again; Check again)
+ *   saved notes or a failing PR         → Send back (the revision from the notes, or the repair of the PR)
+ *   a failed build                      → Retry (its note starts with what to change); never Accept: a failed build
+ *                                         is not a result to accept
  *   a failed task's delivered result    → Retry, then Accept anyway (in outline, with a reason) where it may be
- *                                         accepted; Run checks stays in its Checks row
+ *                                         accepted
  *
- * Accepting finishes the task in one request (Accept and finish): the person's
- * acceptance, when one is owed, and the completion together. This only decides
- * which act is ink; the page recomputes it as the person answers each check. */
+ * Accepting finishes the task in one request: the person's acceptance, when one is owed, and the completion
+ * together. This only decides which act is ink; the page recomputes it as the person answers each check. */
 import type { ProofVerdict } from "./proof.js";
 /** The words over the reason field an Accept of a refuted result requires. */
 export declare const ACCEPT_NEEDS_REASON = "Accepting needs a reason";
@@ -74,12 +73,21 @@ export type ResultActs = {
     /** The one line before the acts: why it can't be accepted yet. */
     line: string | null;
 };
+/** The three verbs, and the posts each one makes (docs/plans/plain-toolroll.md P1.3): Accept is today's Accept (and
+ * finish), or Accept anyway with a reason; Send back is today's request for changes and its revision from saved notes
+ * for an unpublished result, or the repair of a published one; Retry is today's Retry, or Build again. Check again
+ * keeps its own words (its act stands on the build, not on the result). */
+export type ResultVerb = "Accept" | "Send back" | "Retry";
+export declare const RESULT_VERB: Readonly<Record<ResultActKind, ResultVerb | null>>;
+/** What Send back does, said on its own confirm line: the rule is fixed by whether the result is already published. */
+export declare const SEND_BACK_UNPUBLISHED = "Sends it back with your notes. The same task builds again once you approve the revision.";
+export declare const SEND_BACK_PUBLISHED = "It's already published, so this files a fix as a new version for you to approve.";
 export declare function resultActsOf(facts: ResultActFacts): ResultActs;
 /** The words a result's Accept wears and the one line before it, given the
  * server's words for everything but the person's own checks (`base`) and how
  * those stand on this page: an unanswered check names itself; a check marked
  * Not right says so; otherwise the base words stand. */
-export type AcceptLabel = "Accept and finish" | "Accept without checks" | "Accept without your check" | "Accept anyway";
+export type AcceptLabel = "Accept" | "Accept without checks" | "Accept without your check" | "Accept anyway";
 export declare function acceptWithChecksOf(base: {
     label: AcceptLabel;
     ready: boolean;

package/dist/result-acts.js

@@ -1,26 +1,25 @@
-/** The result page's acts (2026-10-02), chosen in one place: exactly one ink
- * act, the one that resolves the result's state, and never navigation; at
- * most one outline act beside it. A result that can't be accepted says why
- * in one line before them.
+/** The result page's acts (2026-10-02; docs/plans/plain-toolroll.md P1.3), chosen in one place: three verbs, each a
+ * relabel over the post it has always made. Exactly one ink act at most, the one that resolves the result's state,
+ * and never navigation; at most one outline act beside it. A result that can't be accepted says why in one line
+ * before them. Run checks stays in the Checks row, and a person's own checks in the Checks list: neither is an act here.
  *
- *   everything met                      → Accept and finish
- *   a "You check this one" unanswered   → the next check, then Accept without your check
- *   a check you marked Not right        → Request changes, then Accept anyway
- *   checks queued or running            → Checks running (disabled), then Accept without checks
- *   checks didn't run, a check exists   → Run checks, then Accept without checks
+ *   everything met                      → Accept
+ *   a "You check this one" unanswered   → (the check itself, above), then Accept without your check
+ *   a check you marked Not right        → Send back, then Accept anyway
+ *   checks queued or running            → (Checks running, in its row), then Accept without checks
+ *   checks didn't run, a check exists   → (Run checks, in its row), then Accept without checks
  *   report and changes disagree,
- *   or the proof is refuted             → Request changes, then Accept (as allowed);
+ *   or the proof is refuted             → Send back, then Accept (as allowed);
  *                                         never Accept as ink, even with no form here
- *   a Needs you form resolves it        → that form (Build again, Check again)
- *   saved notes or a failing PR         → Revise / Draft a repair task
- *   a failed build                      → Retry (its note starts with what to change), then Run checks when they
- *                                         didn't run; never Accept: a failed build is not a result to accept
+ *   a Needs you form resolves it        → that form (Retry: Build again; Check again)
+ *   saved notes or a failing PR         → Send back (the revision from the notes, or the repair of the PR)
+ *   a failed build                      → Retry (its note starts with what to change); never Accept: a failed build
+ *                                         is not a result to accept
  *   a failed task's delivered result    → Retry, then Accept anyway (in outline, with a reason) where it may be
- *                                         accepted; Run checks stays in its Checks row
+ *                                         accepted
  *
- * Accepting finishes the task in one request (Accept and finish): the person's
- * acceptance, when one is owed, and the completion together. This only decides
- * which act is ink; the page recomputes it as the person answers each check. */
+ * Accepting finishes the task in one request: the person's acceptance, when one is owed, and the completion
+ * together. This only decides which act is ink; the page recomputes it as the person answers each check. */
 /** The words over the reason field an Accept of a refuted result requires. */
 export const ACCEPT_NEEDS_REASON = "Accepting needs a reason";
 export const FAILED_CHECK = /^the repository's approved verification command exited (-?[0-9]+)/;
@@ -42,34 +41,46 @@ export function cantAcceptYetOf(verdict, reasons, accepted) {
         ? "Can't accept yet: the project's check failed on these changes."
         : ACCEPT_NEEDS_REASON;
 }
+export const RESULT_VERB = {
+    accept: "Accept", "accept-anyway": "Accept",
+    "request-changes": "Send back", revise: "Send back", "draft-repair": "Send back",
+    retry: "Retry", rebuild: "Retry",
+    "recheck-stopped": null,
+    // Never in the act row: Run checks lives in the Checks row, and a person's own checks in the Checks list.
+    "next-check": null, "checks-running": null, "run-checks": null,
+};
+/** What Send back does, said on its own confirm line: the rule is fixed by whether the result is already published. */
+export const SEND_BACK_UNPUBLISHED = "Sends it back with your notes. The same task builds again once you approve the revision.";
+export const SEND_BACK_PUBLISHED = "It's already published, so this files a fix as a new version for you to approve.";
 export function resultActsOf(facts) {
     const request = facts.canRequest ? "request-changes" : null;
     const accept = facts.accept === null ? null : "accept";
     if (facts.failed != null) {
-        const checks = facts.runChecks && !facts.checksRunning ? "run-checks" : facts.checksRunning ? "checks-running" : null;
         const anyway = facts.failed.acceptAnyway === true ? "accept-anyway" : null;
-        return facts.failed.retry ? { primary: "retry", secondary: anyway ?? checks, line: null } : { primary: checks, secondary: anyway, line: null };
+        return facts.failed.retry ? { primary: "retry", secondary: anyway, line: null } : { primary: null, secondary: anyway, line: null };
     }
     if (facts.need !== null)
         return { primary: facts.need, secondary: request, line: null };
+    // Saved notes or a failing pull request: Send back is ink, and Accept the quiet other way.
     if (facts.next !== null)
-        return { primary: facts.next, secondary: accept ?? request, line: null };
+        return { primary: facts.next, secondary: accept, line: null };
     // Can't be accepted yet: Accept is never the ink act, even when the feedback form isn't here.
     if (facts.blocked !== null)
         return { primary: request, secondary: accept, line: facts.blocked };
-    // The person's own checks come first: the next one is ink until each is answered.
+    // The person's own checks come first, in the Checks list above: nothing here is ink until each is answered.
     if (accept !== null && (facts.unanswered ?? 0) > 0)
-        return { primary: "next-check", secondary: accept, line: null };
+        return { primary: null, secondary: accept, line: null };
     if (accept !== null && (facts.notRight ?? 0) > 0)
         return { primary: request, secondary: accept, line: null };
+    // Checks running, or not run: their row says so and offers Run checks; Accept waits in outline.
     if (facts.checksRunning)
-        return { primary: "checks-running", secondary: accept ?? request, line: null };
+        return { primary: null, secondary: accept ?? request, line: null };
     if (facts.accept === null)
         return { primary: null, secondary: request, line: null };
     if (facts.accept.ready)
         return { primary: "accept", secondary: request, line: null };
     if (facts.runChecks)
-        return { primary: "run-checks", secondary: "accept", line: null };
+        return { primary: null, secondary: "accept", line: null };
     return { primary: "accept", secondary: request, line: null };
 }
 export function acceptWithChecksOf(base, checks) {