toolroll 0.9.93 → 0.9.95

package/dist/task-status.js

@@ -13,7 +13,7 @@
 import { DEFAULT_LEAD_NAME } from "./lead-identity.js";
 import { html } from "./html.js";
 import { FAILED_CHECK } from "./result-acts.js";
-import { CODE_NEED, NEEDS, needSentence, waitSentence } from "./needs-you.js";
+import { CODE_READING, NEEDS, needSentence, waitSentence } from "./needs-you.js";
 /** A cancelled task with a successor reads "Replaced by <id>" everywhere, never "Cancelled". */
 export const replacedWords = (successor) => `Replaced by ${successor}`;
 const REPLACED = /^Replaced by \S+/;
@@ -28,6 +28,8 @@ export const CHECKS_LABEL = "Project checks";
 export const PR_CI_LABEL = "PR CI";
 /** The one verb for opening a saved result, on every surface. */
 export const OPEN_RESULT = "Open result";
+/** A machine-run check under way (a prepared candidate: no agent runs), on every surface that has no richer words. */
+export const MACHINE_CHECK_RUNNING = "Running the check on the prepared version.";
 export const CHECKED_AT_RELEASE = "Checked at release";
 export function releaseStateOf(checks) {
     if (checks?.level !== "off" || checks.status === "passed" || checks.status === "failed")
@@ -162,46 +164,47 @@ function sentenceOf(headline, facts) {
     const reason = facts.reason?.trim() || null;
     const sha = short(facts.checks?.head ?? null);
     switch (headline) {
-        case "Queued": return reason ?? "Waiting for a worker.";
+        case "Queued": return reason ?? "Waiting for a builder.";
         case "Planning": return reason ?? "The lead is writing the plan.";
         // One plain sentence per need (needs-you.ts); a recorded reason only where the need keeps one.
         case "Needs you": return facts.stage === "finished" ? resultAsk(facts) ?? needSentence("review-result", reason, facts.needContext) : needSentence(facts.need ?? "other", reason, facts.needContext);
         case "Waiting": return waitSentence(facts.wait, reason, facts.needContext);
         case "Building": return facts.stage === "checking" ? "Checks are running on the change."
-            : facts.stage === "reviewing" ? "Reviewing the change before it reaches you." : reason ?? "An agent is working on it.";
+            : facts.stage === "reviewing" ? "Reviewing the change before it reaches you."
+                : facts.machine === true ? MACHINE_CHECK_RUNNING : reason ?? "An agent is working on it.";
         case "Ready for review":
             if (facts.report)
-                return "The report is ready to read. Read it, then mark it complete.";
+                return "The report is ready to read. Read it, then accept it.";
             if (releaseStateOf(facts.checks) === "covered")
-                return `Checked at release on ${short(facts.checks.release.head) ?? "its release"}. Review the change, then mark it complete.`;
+                return `Checked at release on ${short(facts.checks.release.head) ?? "its release"}. Review the change, then accept it.`;
             if (facts.checks?.level === "off" && facts.checks.status !== "passed")
-                return "Checked at release. Review the change, then mark it complete.";
+                return "Checked at release. Review the change, then accept it.";
             if (facts.checks?.status === "passed") {
                 // The Checks row names the others and the batch commit; the sentence doesn't repeat them.
                 const peers = facts.checks.batch?.state === "together" ? facts.checks.batch.peers.length : 0;
                 if (peers > 0)
-                    return `Checks passed together with ${peers === 1 ? "1 other result" : `${peers} other results`}. Review the change, then mark it complete.`;
-                return `${facts.checks.level === "quick" ? "Quick checks" : "Checks"} passed${sha === null ? "" : ` on ${sha}`}. Review the change, then mark it complete.`;
+                    return `Checks passed together with ${peers === 1 ? "1 other result" : `${peers} other results`}. Review the change, then accept it.`;
+                return `${facts.checks.level === "quick" ? "Quick checks" : "Checks"} passed${sha === null ? "" : ` on ${sha}`}. Review the change, then accept it.`;
             }
             if (facts.checks?.batch?.state === "waiting")
-                return "Its full check runs with other results within 10 minutes. Review the change, then mark it complete.";
+                return "Its full check runs with other results within 10 minutes. Review the change, then accept it.";
             if (facts.checks?.status === "unavailable")
-                return `${facts.checks.cause === "command-changed" ? CHECK_COMMAND_CHANGED : CHECK_UNREADABLE} Review the change, then mark it complete.`;
+                return `${facts.checks.cause === "command-changed" ? CHECK_COMMAND_CHANGED : CHECK_UNREADABLE} Review the change, then accept it.`;
             // Never claim a check that isn't known to have passed.
             if (facts.checks == null)
-                return "Review the change, then mark it complete.";
-            return "Built without a passing project check. Review the change, then mark it complete.";
+                return "Review the change, then accept it.";
+            return "Built without a passing project check. Review the change, then accept it.";
         case "Complete": {
             // Landed work says why once; its merged pull request is that reason, not a second sentence.
             if (facts.landed)
-                return `Marked complete automatically: ${facts.landed}.`;
-            const by = facts.completedBy ? `Marked complete by ${facts.completedBy}.` : "Marked complete.";
+                return `Accepted automatically: ${facts.landed}.`;
+            const by = facts.completedBy ? `Accepted by ${facts.completedBy}.` : "Accepted.";
             const pr = facts.pullRequest;
             return pr?.state === "merged" ? `${by} ${pr.number === null ? "Its pull request" : `Pull request #${pr.number}`} merged.` : by;
         }
         case "Failed":
             if (facts.checks?.status === "failed")
-                return `${facts.checks.level === "quick" ? "Quick checks" : "Checks"} failed${sha === null ? "" : ` on ${sha}`}. See what broke, then retry or ask for changes.`;
+                return `${facts.checks.level === "quick" ? "Quick checks" : "Checks"} failed${sha === null ? "" : ` on ${sha}`}. See what broke, then retry or send it back.`;
             return reason ?? "The last attempt stopped before it finished. Review it, then retry.";
         case "Stopped": return reason ?? "Stopped by a person. The work so far is kept.";
     }
@@ -291,13 +294,13 @@ function detailsOf(headline, facts) {
     if (evidence != null) {
         const action = { label: "See what was kept", href: facts.links?.result ?? null };
         if (evidence.damaged > 0)
-            row("evidence", "Saved evidence", "Some saved files changed", problem(headline), headline === "Failed" ? {} : { action });
+            row("evidence", "Saved files", "Some saved files changed", problem(headline), headline === "Failed" ? {} : { action });
         else if (evidence.missing > 0)
-            row("evidence", "Saved evidence", "Some saved files are missing", problem(headline), headline === "Failed" ? {} : { action });
+            row("evidence", "Saved files", "Some saved files are missing", problem(headline), headline === "Failed" ? {} : { action });
         else if (evidence.shortened > 0)
-            row("evidence", "Saved evidence", "Some output shortened", "note", { action });
+            row("evidence", "Saved files", "Some output shortened", "note", { action });
         else
-            row("evidence", "Saved evidence", "Complete", "ok");
+            row("evidence", "Saved files", "All kept", "ok");
     }
     return rows;
 }
@@ -331,24 +334,9 @@ export function statusOf(facts) {
 /** The name most surfaces already import. */
 export const taskStatusOf = statusOf;
 // ---- reading the existing projections ----------------------------------------
-/** Every dispatch or work-index code, as the stage it means. Unknown codes that
- * wait on a person stay Needs you; everything else waits in the queue. */
-const CODE_STAGE = {
-    queued: ["queued"], ready: ["queued"], "worker-at-capacity": ["queued"], "retry-scheduled": ["queued"], updating: ["queued"],
-    "waiting-dependency": ["queued"], "scouting-ready": ["queued"], "planning-ready": ["queued"], "provider-quota": ["queued"],
-    // A request the planner cannot be given (too long to hand back, say) waits on a person to shorten it.
-    "planner-source": ["needs-you", "fix-request"],
-    running: ["building"], reviewing: ["reviewing"], "review-pending": ["building"], "checks-running": ["checking"],
-    "signed-out": ["needs-you", "sign-in"],
-    "needs-approval": ["needs-you", "approval"],
-    "waiting-decision": ["needs-you", "answer"], "decision-queue": ["needs-you", "answer"],
-    "build-stopping": ["waiting"], "other-computer": ["waiting"],
-    stopping: ["stopped"], stopped: ["stopped"], paused: ["stopped"], cancelled: ["stopped"],
-    failed: ["failed"], "waiting-incident": ["failed"], "checks-failed": ["failed"],
-    "ready-to-check": ["finished"], "ready-to-review": ["finished"], "report-ready": ["finished"], "no-change": ["finished"],
-    "pr-opened": ["finished"], "merge-observed": ["finished"], "pr-closed": ["finished"], "agent-attested": ["finished"], "accepted-exception": ["finished"],
-    complete: ["complete"],
-};
+/** Codes that read Needs you whoever asks (their reason is a person's by nature). Any other need reads Needs you
+ * only when the caller says a person is needed; otherwise it waits in the queue. */
+const ALWAYS_NEEDS = new Set(["planner-source", "signed-out", "needs-approval", "waiting-decision", "decision-queue"]);
 /** Queue reasons worth a sentence of their own; any other queued or
  * building reason is scheduler wording, and the default sentence is plainer. */
 const QUEUED_REASONS = new Set(["worker-at-capacity", "waiting-dependency", "retry-scheduled", "updating", "planning-ready", "scouting-ready", "provider-quota"]);
@@ -359,15 +347,18 @@ export function plainReasonOf(stage, code, detail) {
         return QUEUED_REASONS.has(code) ? detail ?? null : null;
     return detail ?? null;
 }
+/** Every dispatch or work-index code, as the stage it means (needs-you.ts CODE_READING, the one table). Unknown
+ * codes that wait on a person stay Needs you; everything else waits in the queue. */
 export function stageOfCode(code, options = {}) {
     if (code === "running" && options.planning)
         return { stage: "planning" };
     if (code === "held")
         return options.operatorHold === false ? { stage: "needs-you", need: "hold" } : { stage: "stopped" };
-    const known = CODE_STAGE[code];
-    if (known !== undefined)
-        return known[1] === undefined ? { stage: known[0] } : { stage: known[0], need: known[1] };
-    return options.needsPerson === false ? { stage: "queued" } : { stage: "needs-you", need: CODE_NEED[code] ?? "other" };
+    const known = Object.prototype.hasOwnProperty.call(CODE_READING, code) ? CODE_READING[code] : undefined;
+    if (known !== undefined && (known.stage !== "needs-you" || ALWAYS_NEEDS.has(code))) {
+        return { stage: known.stage, ...(known.need === undefined ? {} : { need: known.need }), ...(known.wait === undefined ? {} : { wait: known.wait }) };
+    }
+    return options.needsPerson === false ? { stage: "queued" } : { stage: "needs-you", need: known?.need ?? "other" };
 }
 /** The pull request as the task page's follower reports it, or the bare publication row. */
 export function pullRequestFactOf(publication) {
@@ -394,6 +385,9 @@ export function pullRequestFactOf(publication) {
 /** The assignment's stage. The work status, when the caller read one, names
  * the exact reason (a running planner, a pause, a failed attempt, a sign-in). */
 export function assignmentStageOf(assignment, work, planning = false) {
+    // A finding held for a person outlives the stage the work is in, a saved result included: only a person closes it.
+    if (work?.token === "finding-held" && assignment.state !== "cancelled")
+        return { stage: "needs-you", need: "finding" };
     // The assignment's own reading (a build Toolroll can't confirm stopped) comes first.
     const own = assignment.need ?? null;
     if (own !== null && (assignment.state === "working" || assignment.state === "needs-decision"))
@@ -416,6 +410,8 @@ export function assignmentStageOf(assignment, work, planning = false) {
                 return { stage: "needs-you", need: "answer" };
             if (action === "inspect-decisions")
                 return { stage: "needs-you", need: "questions" };
+            if (action === "inspect-findings")
+                return { stage: "needs-you", need: "finding" };
             const token = work?.token ?? "";
             // A failed attempt is Failed. A saved result that still needs a decision
             // (its scope, a hold, a process exit) is Needs you, even if its checks
@@ -473,7 +469,7 @@ const quoted = (statement) => {
 function unresolvedAsk(row, word) {
     const what = word === "Not shown yet" && screenshotMissing(row) ? "A screenshot is missing for"
         : word === "Not shown yet" ? "Nothing shows this requirement is met" : word === "Unverified" ? "This requirement couldn't be verified" : "This requirement isn't met";
-    return `${what}: ${quoted(row.statement) || row.id || "a requirement"}. Ask for changes, or accept the result with a reason.`;
+    return `${what}: ${quoted(row.statement) || row.id || "a requirement"}. Send it back, or accept the result with a reason.`;
 }
 /** Requirements from the stored matrix: met, the ones only a person confirms, and the total. */
 export function requirementsOf(matrix, release) {
@@ -482,7 +478,7 @@ export function requirementsOf(matrix, release) {
     const words = matrix.map(row => requirementWordOf(row, null, release));
     const yours = matrix.find((_, index) => words[index] === "You check");
     const unshown = matrix.filter((row, index) => words[index] === "Not shown yet" && screenshotMissing(row));
-    const ask = yours !== undefined ? `Check this requirement yourself, then mark it complete: ${quoted(yours.statement)}`
+    const ask = yours !== undefined ? `Check this requirement yourself, then accept it: ${quoted(yours.statement)}`
         : unshown.length > 0 ? unresolvedAsk(unshown[0], "Not shown yet") : null;
     return { met: words.filter(word => word === "Met").length, total: matrix.length, yours: words.filter(word => word === "You check").length,
         missed: words.filter(word => word === "Not met" || word === "Not shown yet").length,
@@ -499,12 +495,12 @@ export function completionBlockersOf(f) {
     const release = releaseStateOf(f.checks);
     const backing = checkBackingOf(f.checks);
     if (!f.report && f.checks?.status === "failed") {
-        blockers.push({ key: "check-failed", message: `Checks failed${f.checks.exitCode === null ? "" : ` (exit ${f.checks.exitCode})`}. Fix them and run checks again, or ask for changes.` });
+        blockers.push({ key: "check-failed", message: `Checks failed${f.checks.exitCode === null ? "" : ` (exit ${f.checks.exitCode})`}. Fix them and run checks again, or send it back.` });
     }
     else if (!f.report && f.checkRequired && f.checks?.status !== "passed" && release === undefined) {
-        blockers.push({ key: "check-missing", message: checksUnderway(f.checks) ? "Its project check hasn't finished yet. Mark it complete once it passes."
-                : f.checks?.status === "unavailable" ? f.checks.cause === "command-changed" ? `${CHECK_COMMAND_CHANGED.replace(/; run checks again\.$/, ".")} Run checks again, then mark it complete.` : `${CHECK_UNREADABLE} Run checks on it, then mark it complete.`
-                    : "No passing project check is recorded for this result. Run checks on it, then mark it complete." });
+        blockers.push({ key: "check-missing", message: checksUnderway(f.checks) ? "Its project check hasn't finished yet. Accept it once it passes."
+                : f.checks?.status === "unavailable" ? f.checks.cause === "command-changed" ? `${CHECK_COMMAND_CHANGED.replace(/; run checks again\.$/, ".")} Run checks again, then accept it.` : `${CHECK_UNREADABLE} Run checks on it, then accept it.`
+                    : "No passing project check is recorded for this result. Run checks on it, then accept it." });
     }
     if (!f.accepted && f.checks?.status !== "failed") {
         const refuted = f.verdict === "refuted";
@@ -514,11 +510,11 @@ export function completionBlockersOf(f) {
             blockers.push({ key: "criteria", message: unresolvedAsk(unresolved[0].row, unresolved[0].word) });
         else if (unresolved.length > 1) {
             const ids = unresolved.map(one => one.row.id ?? "?");
-            blockers.push({ key: "criteria", message: `${unresolved.length} requirements ${unresolved.every(one => one.word === "Unverified") ? "couldn't be verified" : "aren't met yet"} (${ids.slice(0, 6).join(", ")}${ids.length > 6 ? ", …" : ""}). Ask for changes, or accept the result with a reason.` });
+            blockers.push({ key: "criteria", message: `${unresolved.length} requirements ${unresolved.every(one => one.word === "Unverified") ? "couldn't be verified" : "aren't met yet"} (${ids.slice(0, 6).join(", ")}${ids.length > 6 ? ", …" : ""}). Send it back, or accept the result with a reason.` });
         }
     }
     if (f.high > 0)
-        blockers.push({ key: "high", message: `The automatic review found ${f.high === 1 ? "a high-severity problem" : `${f.high} high-severity problems`}. Ask for changes before marking it complete.` });
+        blockers.push({ key: "high", message: `The automatic review found ${f.high === 1 ? "a high-severity problem" : `${f.high} high-severity problems`}. Send it back before accepting it.` });
     return blockers;
 }
 /** A refuted report verifies none of its requirements, whatever it marked met (a person's acceptance doesn't change that). */

package/dist/teardown-git.d.ts

@@ -46,6 +46,12 @@ export declare const INCLUDE_PARSE_TIMED_OUT = "Git didn't finish reading it in
 export type GitBinding = {
     repo?: string | null;
 };
+/** The shared git folder of a recorded project, read from disk and proven as boundDirs proves it: the project's own
+ * real `.git` folder, holding no `commondir`. No pointer file or `commondir` an agent can write decides it, and no git
+ * runs (a page visit reads this). Throws with the reason otherwise. */
+export declare function recordedCommonDir(repo: string): string;
+/** Where git incidents are recorded: beside the fenced views folder (git-incident.ts). */
+export declare function gitIncidentRecord(): string;
 /** Settings fixed on every write through a view: `worktree add` records absolute paths (relative ones would need a
  * config write, which a view keeps); no transport at all (a caller that fetches allows its one protocol by name, as the
  * nightly check's local fetch does with protocol.file.allow); and no split index (its shared index files would be
@@ -55,6 +61,12 @@ export declare const WRITE_VIEW_FLAGS: readonly string[];
  * program (anything but INERT_LFS). A file that
  * isn't a plain one, or doesn't parse, counts as naming one. */
 export declare function lfsExtensionIn(checkout: string, gitFile?: string, limit?: Limit): boolean;
+/** The hardened runners' own reads before the caller's command (the checkout's config listing): their own bounds, never
+ * the caller's. A caller's small `maxBuffer` is for its own command's output (builder.ts reads one ls-tree line with
+ * 2 KiB): inherited, it failed the config listing once a project's .git/config grew past 2 KiB (one [branch] section per
+ * work branch), and every prepared release check then failed as "its config couldn't be read" (runs 3316–3324). */
+export declare const CONFIG_READ_BYTES: number;
+export declare const CONFIG_READ_MS = 30000;
 /** Every command runs against a view of the checkout's repository (gitView) whose config and info are copies the
  * plane made, inspected there, so neither can change between the inspection and the run. `mode` "read" is for reading
  * a checkout an agent may still be writing (the code page): every command also takes readFlags(), and the view holds
@@ -143,4 +155,10 @@ export declare function lazyFetchSetting(listing: string): string | null;
  * command and protocol settings refused, a partial clone refused) is the config git then runs with.
  */
 export declare function lazyFetchSafeGit(inner?: Runner): Runner;
+/**
+ * The checkout a folder sits in, for choosing a folder (easy-start): the nearest parent holding a `.git`, then read
+ * through checkoutGitSync, so a config that includes another file (a FIFO), or sets a command, is refused and the read
+ * is bounded. Null when there is no checkout or it can't be read that way.
+ */
+export declare function checkoutTop(dir: string, timeoutMs?: number): string | null;
 export {};

package/dist/teardown-git.js

@@ -191,7 +191,7 @@ function nestedRepository(path) {
  * repository (boundDirs; `binding.repo` when the caller has the project's), is refused; so is a command whose
  * repository changed under it while git ran.
  */
-async function inView(cwd, binding, work, after = true, lockTimeoutMs, gitFile = "git") {
+async function inView(cwd, binding, work, after = true, lockTimeoutMs, doing, gitFile = "git") {
     const root = checkoutRootOf(cwd);
     if (root === null)
         return NOT_A_REPOSITORY;
@@ -207,7 +207,7 @@ async function inView(cwd, binding, work, after = true, lockTimeoutMs, gitFile =
         return await withCheckoutLock(realpathSync(homedir()), key, async () => {
             let view;
             try {
-                view = gitView(root, "write", binding, gitFile);
+                view = gitView(root, "write", binding, gitFile, undefined, doing);
             }
             catch (error) {
                 return refused(error instanceof Error ? error.message : "the checkout couldn't be read");
@@ -255,6 +255,7 @@ export function teardownGit(runner = run, binding = {}, lockTimeoutMs, gitFile =
         const forced = removal && args.includes("--force");
         const inspection = args.includes("status") || args.includes("diff");
         const target = removal ? resolve(cwd, args.at(-1)) : cwd;
+        const doing = teardownDoing(args);
         const safeArgs = [...args];
         if (inspection && !safeArgs.includes("--ignore-submodules=all")) {
             const command = safeArgs.findIndex(arg => arg === "status" || arg === "diff");
@@ -288,8 +289,22 @@ export function teardownGit(runner = run, binding = {}, lockTimeoutMs, gitFile =
             // the target's view, inspected above, so it judges the target by the target's own settings.
             return ran(removal && !forced ? { ...view.env, GIT_COMMON_DIR: targetView.env["GIT_COMMON_DIR"] } : view.env);
             // A removed target has no git directory left to prove: the folder it was removed from is proven instead.
-        }, !removal, lockTimeoutMs, gitFile);
-    }, true, lockTimeoutMs, gitFile);
+        }, !removal, lockTimeoutMs, doing, gitFile);
+    }, true, lockTimeoutMs, teardownDoing(args), gitFile);
+}
+/** What teardown git is doing, for an incident's notice: removing a checkout, or looking one over to tidy it. */
+function teardownDoing(args) {
+    return args.includes("worktree") && args.includes("remove") ? "removing an old checkout" : "tidying an old checkout";
+}
+/** What a build's git is doing, for an incident's notice. */
+function checkoutDoing(args) {
+    if (args.includes("worktree"))
+        return args.includes("remove") ? "removing a checkout" : args.includes("add") ? "making a checkout" : "listing checkouts";
+    if (args.some(arg => arg === "commit" || arg === "add" || arg === "merge" || arg === "rebase" || arg === "reset" || arg === "checkout" || arg === "switch"))
+        return "saving a build's work";
+    if (args.some(arg => arg === "fetch" || arg === "push"))
+        return "updating a repository";
+    return "reading a build's checkout";
 }
 /** A setup call's time limit: its own five seconds, or less when a caller's deadline leaves less (never below 1 ms;
  * a caller checks the deadline itself before calling). */
@@ -330,7 +345,7 @@ function regularFile(path) {
 }
 /** A checkout's git directory and common directory, as git finds them from its `.git` (a folder, or a one-line
  * `gitdir: ` file); null when the pointer isn't one git would read the same way. */
-function gitDirsOf(checkout) {
+function gitDirsOf(checkout, vouched = NO_VOUCHED) {
     let gitdir = join(checkout, ".git");
     try {
         if (!lstatSync(gitdir).isDirectory()) {
@@ -350,11 +365,14 @@ function gitDirsOf(checkout) {
     // Where the checkout's own files point (a build can write both): read, in the console, only while that folder
     // answered a look lately, and never vouched for by the checkout pool's spelling (folder-gate.ts). Held back: not one
     // git would read the same way, so every caller refuses.
-    if (gitdir !== join(checkout, ".git") && !folderAnswers(gitdir, true))
+    // `vouched`: the very folders this view was made from, read again after git ran (settle). They answered moments ago
+    // and git just ran in them; the gate's staleness is no evidence about them. Anything they now point elsewhere is
+    // gated as ever, so a re-pointed `.git` or `commondir` is never read on the console's thread on its say.
+    if (gitdir !== join(checkout, ".git") && !vouched.has(gitdir) && !folderAnswers(gitdir, true))
         return null;
     const named = regularFile(join(gitdir, "commondir"))?.trim();
     const common = named === undefined || named === "" ? gitdir : resolve(gitdir, named);
-    if (common !== gitdir && !folderAnswers(common, true))
+    if (common !== gitdir && !vouched.has(common) && !folderAnswers(common, true))
         return null;
     return { gitdir, common };
 }
@@ -382,7 +400,8 @@ function includeIn(path, gitFile = "git", limit) {
         return named.toLowerCase();
     return /^\s*\[\s*include(if)?\b/im.test(text) ? "include" : null;
 }
-function boundDirs(checkout, binding = {}) {
+const NO_VOUCHED = new Set();
+function boundDirs(checkout, binding = {}, vouched = NO_VOUCHED) {
     const fail = (why) => { throw new Error(`the checkout's .git ${why}`); };
     let top;
     try {
@@ -403,12 +422,12 @@ function boundDirs(checkout, binding = {}) {
     if (held.isDirectory()) {
         if (existsSync(join(dotgit, "commondir")))
             fail("names another repository (commondir)");
-        dirs = { checkout: top, gitdir: dotgit, common: dotgit, linked: false };
+        dirs = { checkout: top, gitdir: dotgit, common: dotgit, linked: false, spelled: [dotgit] };
     }
     else {
         if (!held.isFile())
             fail("is a link");
-        const named = gitDirsOf(top);
+        const named = gitDirsOf(top, vouched);
         if (named === null)
             return fail("couldn't be read as git reads it");
         let gitdir;
@@ -444,7 +463,7 @@ function boundDirs(checkout, binding = {}) {
         }
         if (backReal !== dotgit)
             fail("belongs to a git directory that names another checkout");
-        dirs = { checkout: top, gitdir, common, linked: true };
+        dirs = { checkout: top, gitdir, common, linked: true, spelled: [named.gitdir, named.common, gitdir, common] };
     }
     // The common folder is a main checkout's own `.git` folder, a real one.
     if (basename(dirs.common) !== ".git")
@@ -477,6 +496,12 @@ function boundDirs(checkout, binding = {}) {
     }
     return dirs;
 }
+/** The shared git folder of a recorded project, read from disk and proven as boundDirs proves it: the project's own
+ * real `.git` folder, holding no `commondir`. No pointer file or `commondir` an agent can write decides it, and no git
+ * runs (a page visit reads this). Throws with the reason otherwise. */
+export function recordedCommonDir(repo) {
+    return boundDirs(repo, { repo }).common;
+}
 /** What git keeps only per worktree and the plane never links: HEAD (git won't take it as a link) and the pointers. */
 /** What the plane links of a worktree's own git folder (git writes them in place through the link: the index and its
  * logs by lockfile, per-worktree refs and logs inside the folders), whether or not they exist yet; a rebase's,
@@ -484,7 +509,12 @@ function boundDirs(checkout, binding = {}) {
 const ADMIN_LINKED = ["index", "logs", "refs", "reftable"];
 /** What git keeps in a common directory (its path.c common_list, and reftable), linked whether or not it exists yet. */
 const COMMON_NAMES = ["branches", "gc.pid", "logs", "lost-found", "modules", "objects", "packed-refs", "reftable", "refs", "remotes", "rr-cache", "shallow", "svn", "worktrees"];
-function gitView(checkout, kind, binding = {}, gitFile = "git", limit) {
+/** Where git incidents are recorded: beside the fenced views folder (git-incident.ts). */
+export function gitIncidentRecord() {
+    return join(dirname(ensureGitViewsRoot(realpathSync(homedir()))), "git-incidents.jsonl");
+}
+/** `doing`: what the plane was doing, in a person's words ("tidying an old checkout"), for an incident's notice. */
+function gitView(checkout, kind, binding = {}, gitFile = "git", limit, doing) {
     const dirs = boundDirs(checkout, binding);
     const root = ensureGitViewsRoot(realpathSync(homedir()));
     const view = realpathSync(mkdtempSync(join(root, `${kind}-`)));
@@ -652,8 +682,10 @@ function gitView(checkout, kind, binding = {}, gitFile = "git", limit) {
     const settle = () => {
         const now = pinned(dirs);
         let bound = false;
+        // The same proof as before git ran, of the same folders: re-read past the console's folder gate only where they are
+        // the very ones this view was made from (vouched), so a gate whose answer went stale mid-run is never read as a swap.
         try {
-            const again = boundDirs(checkout, binding);
+            const again = boundDirs(checkout, binding, new Set(dirs.spelled));
             bound = again.gitdir === dirs.gitdir && again.common === dirs.common;
         }
         catch {
@@ -663,7 +695,7 @@ function gitView(checkout, kind, binding = {}, gitFile = "git", limit) {
             // Too late to prevent: recorded and told (git-incident.ts), never rolled back where the swap leads.
             if (kind === "write") {
                 gitIncident({ checkout: dirs.checkout, repository: dirs.common, swapped: now.swapped.length > 0 ? now.swapped.map(({ path, leadsTo }) => ({ path, leadsTo })) : [{ path: join(dirs.checkout, ".git"), leadsTo: null }],
-                    record: join(dirname(ensureGitViewsRoot(realpathSync(homedir()))), "git-incidents.jsonl") });
+                    cause: now.swapped.length > 0 ? "swapped" : "rebound", ...(doing === undefined ? {} : { doing }), record: gitIncidentRecord() });
             }
             return "the checkout's repository changed while git ran";
         }
@@ -677,7 +709,7 @@ function gitView(checkout, kind, binding = {}, gitFile = "git", limit) {
             catch (error) {
                 if (!(error instanceof AnchorMoved))
                     return "the checkout's git state couldn't be carried back after git ran";
-                gitIncident({ checkout: dirs.checkout, repository: dirs.common, swapped: [{ path: error.message, leadsTo: null }], record: join(dirname(ensureGitViewsRoot(realpathSync(homedir()))), "git-incidents.jsonl") });
+                gitIncident({ checkout: dirs.checkout, repository: dirs.common, swapped: [{ path: error.message, leadsTo: null }], cause: "moved", ...(doing === undefined ? {} : { doing }), record: gitIncidentRecord() });
                 return "the checkout's repository changed while git ran";
             }
             if (left.length > 0)
@@ -1061,6 +1093,28 @@ export function lfsExtensionIn(checkout, gitFile = "git", limit) {
     const parsed = spawnSync(gitFile, ["config", "--file", path, "--no-includes", "--name-only", "--list", "-z"], { cwd: "/", encoding: "utf8", timeout: setupTimeout(limit), killSignal: "SIGKILL", env: { PATH: process.env["PATH"] ?? "", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", HOME: "/nonexistent" } });
     return parsed.status !== 0 || parsed.stdout.split("\0").filter(Boolean).some(name => lfsCommand(name) || ["include", "includeif"].includes(keyParts(name).section));
 }
+/** The hardened runners' own reads before the caller's command (the checkout's config listing): their own bounds, never
+ * the caller's. A caller's small `maxBuffer` is for its own command's output (builder.ts reads one ls-tree line with
+ * 2 KiB): inherited, it failed the config listing once a project's .git/config grew past 2 KiB (one [branch] section per
+ * work branch), and every prepared release check then failed as "its config couldn't be read" (runs 3316–3324). */
+export const CONFIG_READ_BYTES = 16 * 1024 * 1024;
+export const CONFIG_READ_MS = 30_000;
+/** What of a caller's options an internal read keeps: where it runs and with what environment and containment —
+ * never its time limit, output limit, stdin or output callbacks. */
+function internalOptions(options, env) {
+    const { cwd, envAllowlist, omitEnv, fence, fenceGrants, confinement, processGroup, owner, signal } = options ?? {};
+    return { ...(cwd === undefined ? {} : { cwd }), ...(envAllowlist === undefined ? {} : { envAllowlist }), ...(omitEnv === undefined ? {} : { omitEnv }),
+        ...(fence === undefined ? {} : { fence }), ...(fenceGrants === undefined ? {} : { fenceGrants }), ...(confinement === undefined ? {} : { confinement }),
+        ...(processGroup === undefined ? {} : { processGroup }), ...(owner === undefined ? {} : { owner }), ...(signal === undefined ? {} : { signal }),
+        env, timeoutMs: CONFIG_READ_MS, maxBuffer: CONFIG_READ_BYTES };
+}
+/** Why the checkout's config listing failed, in words, for the refusal: git's own first line, or what stopped it. */
+function listingFailure(result) {
+    if (result.timedOut)
+        return `its config couldn't be read (the read ran past ${CONFIG_READ_MS / 1000} s)`;
+    const said = `${result.stderr}`.split("\n").map(line => line.trim()).find(line => line !== "");
+    return `its config couldn't be read${said === undefined ? ` (git exited ${result.code})` : ` (${said.slice(0, 300)})`}`;
+}
 /** Every command runs against a view of the checkout's repository (gitView) whose config and info are copies the
  * plane made, inspected there, so neither can change between the inspection and the run. `mode` "read" is for reading
  * a checkout an agent may still be writing (the code page): every command also takes readFlags(), and the view holds
@@ -1082,17 +1136,17 @@ export function checkoutGit(inner = run, mode = "build", binding = {}) {
         const once = async () => {
             let view;
             try {
-                view = gitView(cwd, mode === "read" ? "read" : "write", binding);
+                view = gitView(cwd, mode === "read" ? "read" : "write", binding, "git", undefined, checkoutDoing(args));
             }
             catch (error) {
                 return refused(error instanceof Error ? error.message : "the checkout couldn't be read");
             }
             try {
                 const viewed = { ...options, env: { ...(options?.env ?? {}), ...view.env } };
-                // The checkout's own config may name no command.
-                const own = await inner("git", ["--no-optional-locks", "config", "--list", "--show-scope", "-z"], viewed);
+                // The checkout's own config may name no command. Read with this runner's own bounds (internalOptions).
+                const own = await inner("git", ["--no-optional-locks", "config", "--list", "--show-scope", "-z"], internalOptions(options, viewed.env));
                 if (own.code !== 0)
-                    return refused("its config couldn't be read");
+                    return refused(listingFailure(own));
                 const key = commandSetting(own.stdout, { lfsChecked: true });
                 if (key !== null)
                     return refused(`the checkout's git config sets ${key}, which can run a command`);
@@ -1185,9 +1239,11 @@ export function viewedGitSync(cwd, args, options = {}) {
         const env = { PATH: process.env["PATH"] ?? "", HOME: process.env["HOME"] ?? "", LANG: "C", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", GIT_TERMINAL_PROMPT: "0", ...view.env };
         const timeoutNow = () => { expire(); return limit === undefined ? options.timeoutMs ?? 60_000 : Math.max(1, Math.min(options.timeoutMs ?? 60_000, limit())); };
         const fixed = { cwd, env, encoding: "utf8", killSignal: "SIGKILL", maxBuffer: options.maxBuffer ?? 1_048_576, stdio: ["ignore", "pipe", "pipe"] };
-        const own = spawnSync(gitFile, ["--no-optional-locks", "config", "--list", "--show-scope", "-z"], { ...fixed, timeout: timeoutNow() });
+        // Its own bounds, never the caller's output limit (CONFIG_READ_BYTES); a caller's deadline still holds.
+        const own = spawnSync(gitFile, ["--no-optional-locks", "config", "--list", "--show-scope", "-z"], { ...fixed, maxBuffer: CONFIG_READ_BYTES,
+            timeout: limit === undefined ? CONFIG_READ_MS : Math.max(1, Math.min(CONFIG_READ_MS, limit())) });
         if (own.status !== 0)
-            throw new Error("its config couldn't be read");
+            throw new Error(own.error !== undefined ? `its config couldn't be read (${own.error.message.slice(0, 300)})` : "its config couldn't be read");
         const key = commandSetting(own.stdout, { lfsChecked: true });
         if (key !== null)
             throw new Error(`the checkout's git config sets ${key}, which can run a command`);
@@ -1333,3 +1389,31 @@ export function lazyFetchSafeGit(inner = run) {
     // repository's config and its includes as git found them, and an include naming a FIFO could hang the plane.
     return checkoutGit(inner, "read");
 }
+/**
+ * The checkout a folder sits in, for choosing a folder (easy-start): the nearest parent holding a `.git`, then read
+ * through checkoutGitSync, so a config that includes another file (a FIFO), or sets a command, is refused and the read
+ * is bounded. Null when there is no checkout or it can't be read that way.
+ */
+export function checkoutTop(dir, timeoutMs = 10_000) {
+    let at;
+    try {
+        at = realpathSync(dir);
+    }
+    catch {
+        return null;
+    }
+    for (;;) {
+        if (existsSync(join(at, ".git"))) {
+            try {
+                return checkoutGitSync(at, ["rev-parse", "--show-toplevel"], { timeoutMs }).trim() || null;
+            }
+            catch {
+                return null;
+            }
+        }
+        const up = dirname(at);
+        if (up === at)
+            return null;
+        at = up;
+    }
+}

package/dist/telegram-lead.js

@@ -1,5 +1,7 @@
+import { telegramCardMessage } from "./card-render.js";
+import { cardOfProposal, cardPlainOf, cardsFirst, cardWithin, isCardProposal } from "./chat-card.js";
 import { CHAT_ACTIONS, sharedActionAllowsChallenge, sharedActionPayload } from "./chat-actions.js";
-import { taskInCeiling, mirrorToTaskChat, couldNotAnswerText, channelRepos as telegramConversationRepos, resolveChannelLead as resolveTelegramLead, NO_PHONE_LINK, NO_TASK_LINK, phoneProposalLink, confirmedLink, phoneProposalPreview, proposalOutcomeText, handoffCardText, confirmedCardText } from "./chat-channel.js";
+import { armedQuestion, taskInCeiling, mirrorToTaskChat, couldNotAnswerText, channelRepos as telegramConversationRepos, resolveChannelLead as resolveTelegramLead, NO_PHONE_LINK, NO_TASK_LINK, phoneProposalLink, confirmedLink, phoneProposalPreview, proposalOutcomeText, handoffCardText, confirmedCardText } from "./chat-channel.js";
 export { channelRepos as telegramConversationRepos, resolveChannelLead as resolveTelegramLead, tooLongText, whichTaskText, replyContextFor, NO_PHONE_LINK, NO_TASK_LINK, proposalLink, confirmedLink, proposalPreview, proposalOutcomeText, handoffCardText, confirmedCardText, CHAT_ACTION_PARITY as TELEGRAM_ACTION_PARITY, parityGaps } from "./chat-channel.js";
 /**
  * The paired phone as one more way to use the same assistant.
@@ -260,7 +262,7 @@ export function applyProposalTap(store, binding, token, message, repos, options,
         const body = preview.text.split("\n\nConfirm or Dismiss below")[0];
         if (challenged) {
             ack("confirm it");
-            edit(`${body}\n\nThis records that you handled this exact result. Confirm?`, [
+            edit(`${body}\n\n${armedQuestion(proposal)}`, [
                 [telegramButton(`✓ Yes, ${CHAT_ACTIONS[sharedAction.operation].label.toLowerCase()}`, yes)],
                 [telegramButton("Cancel", cancel)],
             ]);
@@ -288,6 +290,7 @@ export function applyProposalTap(store, binding, token, message, repos, options,
         // The paired phone speaks for its account's full authority (pairing is a full session's act).
         authority: "full",
         via: "telegram",
+        binding: binding.id,
         evidenceRoot: options.evidenceRoot,
         confirm: action.phase === "yes",
         deferSignal: signal => effects.push({ kind: "signal", run: signal }),
@@ -549,17 +552,26 @@ async function runTelegramConversation(row, args) {
                 const origin = proposal === null ? null : options.phoneOrigin?.() ?? null;
                 const wanted = proposal === null ? null : phoneProposalLink(store, proposal, repos);
                 const keyboard = keyboardWith(part.keyboard, phoneLinkButton(origin, wanted));
+                // A Toolroll card: read again now, shown only where every project behind it is still reachable. An unreadable
+                // one goes out as its saved plain words.
+                const isCard = proposal !== null && isCardProposal(proposal);
+                const rich = isCard ? cardOfProposal(proposal) : null;
+                const shown = rich !== null && cardWithin(rich, repos) ? telegramCardMessage(rich) : null;
+                const links = rich === null ? [] : rich.buttons.flatMap(one => phoneLinkButton(origin, one) ?? []).map(one => [one]);
                 // The lead's own words carry their bold anchors and labelled links as entities, never as Markdown characters.
                 const voiced = part.kind === "reply" ? telegramReply(part.text) : null;
-                const text = proposal !== null && part.keyboard === null ? handoffCardText(part.text, linkNote(origin, wanted)) : voiced?.text ?? part.text;
+                const text = isCard ? shown?.text ?? (rich === null ? part.text : "This card's projects changed, so it wasn't sent.")
+                    : proposal !== null && part.keyboard === null ? handoffCardText(part.text, linkNote(origin, wanted)) : voiced?.text ?? part.text;
+                const entities = isCard ? shown?.entities ?? [] : voiced?.entities ?? [];
+                const buttons = isCard ? (shown === null || links.length === 0 ? undefined : links) : keyboard;
                 method = "sendMessage";
                 send = () => transport("sendMessage", {
                     chat_id: chatId,
                     text,
-                    ...(voiced === null || voiced.entities.length === 0 ? {} : { entities: voiced.entities }),
+                    ...(entities.length === 0 ? {} : { entities }),
                     link_preview_options: { is_disabled: true },
                     ...(part.replyTo === null ? {} : { reply_parameters: { message_id: Number(part.replyTo) } }),
-                    ...(keyboard === undefined ? {} : { reply_markup: { inline_keyboard: keyboard } }),
+                    ...(buttons === undefined ? {} : { reply_markup: { inline_keyboard: buttons } }),
                 });
             }
             // The first time the answer itself fails to go out, the person hears so once,
@@ -626,7 +638,12 @@ async function runTelegramConversation(row, args) {
                 const selected = store.getLeadTurn(turn)?.state === "answered" ? store.listLeadTurnEvidence(turn) : [];
                 for (const image of selected)
                     parts.push({ kind: "image", text: image.caption, taskId: image.taskId, run: image.run, artifact: image.artifact, sha256: image.sha256 });
-                for (const proposal of proposals) {
+                // Cards first, so what a card leads to sits right under it. A card mints no tokens: it confirms nothing.
+                for (const proposal of cardsFirst(proposals)) {
+                    if (isCardProposal(proposal)) {
+                        parts.push({ kind: "card", text: cardPlainOf(proposal), proposal: proposal.id, keyboard: null });
+                        continue;
+                    }
                     const preview = phoneProposalPreview(store, proposal, repos);
                     const keyboard = preview.buttons ? mintCardTokens(store, binding, proposal.id, now).keyboard : null;
                     parts.push({ kind: "card", text: preview.text, proposal: proposal.id, keyboard });