feat(run_task): [tasks.<lang>] env, and run/verbose test filters

[atlas-from-plumb]

Fixes #537
Fixes #538

Defect

#537. A [tasks.<lang>] slot could not set an environment variable. plumb's CI runs make test, which sets GOTMPDIR=$(CURDIR)/.testcache so t.TempDir() lands inside the checkout; run_task test ran go test with the daemon's environment, so temp dirs landed in the system temp dir. A test depending on that difference passed under run_task and failed on CI (#518), and agents fell back to a shell to set the variable.

#538. run_task's target fills one {target} placeholder, in practice a package. There was no way to run one test or a pattern (go test -run 'X|Y', pytest -k, a cargo filter) or to see skipped tests, and mutation_test paid for the whole package on every mutant (~2.5 min for internal/tools).

Design

[tasks.<lang>] env (table of string → string)

• Applied by RunTaskArgv for run_task and mutation_test's compile and test steps, and by the plumb build|test|… CLI. Entries replace inherited values of the same name. They are in place before the automatic GOWORK=off decision (fix: run worktree hooks and mutation_test in the right tree [PLAN-442] #506), so an explicit GOWORK there is used as is, the same rule an inherited GOWORK follows. A GOENV/PATH set there also informs the decision. PWD is still pinned to the command's directory.
• {workspace} and {working_dir} expand at run time, not at resolution. TaskCommand carries the templates and a Root, and mutation_test's re-root moves Root with the command, so GOTMPDIR follows a mutant into its worktree. Any other {…} token is rejected at load.
• GOTMPDIR/TMPDIR directories inside the workspace (checked after symlink resolution) are created, the job make test's $(TESTCACHE) prerequisite does. Without this, every fresh worktree's run_task test would fail before a test ran. Nothing outside the workspace is created.
• run_task prints env: K=V …. A value is withheld when its name marks it as a credential (…TOKEN, …SECRET, …PASSWORD, …) or internal/redact recognises it. plumb config show has a tasks.<lang> section listing each entry with its provenance.
• Composition follows [git] env: project over global per name, the same for all three TOML spellings. cloneTasks now deep-copies Env, so a project sub-table cannot write into the base config.

Trust / security policy

• An env var decides what a command runs (PATH, GOFLAGS=-toolexec=…, LD_LIBRARY_PATH), so a project env is trust-gated like a command. Every entry enters the plumb trust hash as a TaskCommandSpec{Slot: "env.<NAME>"}, which is injective because real slot names cannot contain . and a forged quoted key fails validation. The [TASKS.go] ENV = … spelling is hashed too. A project env makes every slot of the language project-supplied, including the shipped defaults (the working_dir rule).
• plumb trust lists the entries and adds a warning to keys that steer execution (PATH, GOFLAGS, GOTOOLCHAIN, GIT_*, NODE_OPTIONS, PYTHONPATH, RUSTC_WRAPPER, DYLD_*, LD_LIBRARY_PATH, …).
• Refused outright, in every layer: LD_PRELOAD, LD_AUDIT, DYLD_INSERT_LIBRARIES, DYLD_FORCE_FLAT_NAMESPACE. They run extra code in every process a command starts, and no build or test needs them. Names must match ^[A-Za-z_][A-Za-z0-9_]*$, and NUL is refused in values. env is classified ClassTrustGated and is not agent-writable.

{run} / {verbose} (#538)

• New placeholders modelled on {target:<default>}, where an absent value adds nothing: {run} / {run:<flag>} → <flag> <filter>, and {verbose:<flag>} → <flag>. Shipped defaults: go test {verbose:-v} {run:-run} {target:./...}, pytest {verbose:-v} {run:-k} {target:}, cargo test {target:} {run:--}. Rust puts the filter after -- because cargo's one positional is already {target}, and it gets no verbose placeholder because cargo already lists every test. With nothing asked for, all of them build the argv they built before.
• Reconciliation extends the existing equivalence. A stored go test {target:./...} (the previous default) or go test ./... reconciles to the new default, and the response notes it.
• The filter is one argv element and no shell sees it. It allows letters, digits, space and ._/:@|^$*+?()[]-, up to 256 characters, and may not start with - or a space, since a bare {run} must not smuggle in -exec=….
• A run on a command without {run} is refused, quoting the stored command and the placeholder to add (as {target} is). An unplaceable verbose is noted. On composite verify, verbose reaches both steps, while target/run are not applied and a note says so.
• New arguments: run_task run + verbose, mutation_test test_run (test command only; the compile gate stays unscoped). TaskResolverFn now takes a TaskRequest struct.

plumb's own config. .plumb/config.toml is committed (.gitignore now excludes .plumb/* except config.toml) with [tasks.go.env] GOTMPDIR = "{workspace}/.testcache", matching make test. Heads-up: a project env gates the Go slots, so plumb trust is needed once per plumb checkout before run_task runs Go commands there.

Housekeeping: the mutation_test arguments moved to mutationtest_args.go and the run_task notes to conn_tasks_notes.go to keep files ≤600 lines. tools/list pinned payload is 44,958 / 45,000 bytes: run_task wording was trimmed rather than raising the cap, and the mutation_test description is back under 2,000 chars.

Verification

• Red on origin/main: the new test files fail to compile against main (TasksConfig.Env, RunTaskArgv(…, env, …), TaskRequest do not exist).
• Green: GOWORK=off GOTMPDIR=$PWD/.testcache go test ./... -count=1 passes on the whole module, with .plumb/config.toml present as on CI. golangci-lint run ./... (v2.13.2) reports 0 issues. make check-size check-brief check-changelog passes.
• Mutation (each mutant reverts one piece; all KILLED, with scoped tests, file restored via git checkout):
  • Env: dropped from the trust hash; composition removed; Env clone removed; denylist dropped; unknown placeholder accepted; env decoded as an extra slot; steering keys not flagged; name validation weakened; validation not wired; TaskEnvKeyOf prefix check dropped. Also: env not applied in runArgv; temp dir not created; temp dir created outside the workspace; credential redaction removed; mutation_test step ignoring env; rerootedRoot call removed or keeping the old tree; CLI streamArgv env dropped; project env not gating provenance; env not carried by the resolver.
  • Run/verbose: leading - allowed; test_run dropped; run flag dropped; verbose ignored; run silently dropped without placeholder; previous default not reconciled; target/run swapped; verbose note and composite run note dropped; trust-gated label dropped; go default losing {run}.
  • The first round had two SURVIVED mutants: the rerootedRoot call site and the CLI env. Tests for both were added in follow-up commits, and they were then KILLED.

🤖 Generated with Claude Code

[golimpio]

Two independent review rounds. Round 1's blocker (the committed config broke run_task until plumb trust) is fixed with a GOTMPDIR-only exemption and a refusal that names the setting. Round 2 found nothing blocking, and its small findings are folded in. Each change is proven by mutation.

[golimpio]

Re-approve after updating with main (#542).