toolroll 0.6.0 → 0.7.0

package/dist/releases.js

@@ -0,0 +1,225 @@
+/**
+ * Knowing, calmly, when a newer Toolroll exists.
+ *
+ * At most once a day one anonymous GET asks the npm registry for the latest
+ * version, and one more reads that version's GitHub release notes (the body
+ * only). Nothing identifies this installation: no telemetry, no id, no
+ * query string. The answer is cached in a small JSON file beside the
+ * database; offline or any other failure is silent and changes nothing.
+ * TOOLROLL_NO_UPDATE_CHECK=1 or the switch on Settings → Updates turns the
+ * check off entirely.
+ */
+import { existsSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { envValue } from "./names.js";
+export const RELEASE_CACHE_FILE = "latest-release.json";
+/** Holds "off" while a person has switched the daily check off on Settings → Updates. */
+export const UPDATE_SWITCH_FILE = "update-check";
+export const RUNNER_VERSIONS_FILE = "runner-versions.json";
+export const CHECK_EVERY_MS = 24 * 60 * 60 * 1000;
+export const CHECK_TIMEOUT_MS = 5_000;
+export const REGISTRY_URL = "https://registry.npmjs.org/toolroll/latest";
+export const RELEASES_PAGE = "https://github.com/ap9000/toolroll/releases/tag/";
+const NOTES_API = "https://api.github.com/repos/ap9000/toolroll/releases/tags/";
+const NOTES_MAX = 20_000;
+const VERSION = /^\d{1,6}\.\d{1,6}\.\d{1,6}(?:-[0-9A-Za-z.-]{1,40})?$/;
+/** Off by the environment (it wins) or by the Settings switch. */
+export function updateChecksOff(env, dir) {
+    const flag = envValue(env, "NO_UPDATE_CHECK");
+    if (flag !== undefined && flag !== "" && flag !== "0")
+        return { off: true, byEnv: true };
+    try {
+        return { off: readFileSync(join(dir, UPDATE_SWITCH_FILE), "utf8").trim() === "off", byEnv: false };
+    }
+    catch {
+        return { off: false, byEnv: false };
+    }
+}
+export function setUpdateChecks(dir, on) {
+    writeAtomic(join(dir, UPDATE_SWITCH_FILE), on ? "on\n" : "off\n");
+}
+/** What the last check found, whenever it ran; null when none has succeeded. Never touches the network. */
+export function cachedRelease(dir) {
+    return readCache(dir)?.release ?? null;
+}
+/**
+ * The latest published release, checked at most once a day. Returns what the
+ * cache knows while it is fresh, asks again once it is a day old, and on any
+ * failure keeps what it knew before (null when it knew nothing). Never throws.
+ */
+export async function latestRelease(dir, io = {}) {
+    const env = io.env ?? process.env;
+    if (updateChecksOff(env, dir).off)
+        return null;
+    const now = (io.now ?? (() => new Date()))();
+    const cache = readCache(dir);
+    if (cache !== null && now.getTime() - Date.parse(cache.checkedAt) < CHECK_EVERY_MS && Date.parse(cache.checkedAt) <= now.getTime())
+        return cache.release;
+    const request = io.fetch ?? fetch;
+    let release = cache?.release ?? null;
+    try {
+        const version = await askVersion(request);
+        if (version !== null) {
+            const notes = version === cache?.release?.version && cache.release.notes !== "" ? cache.release.notes : await askNotes(request, version);
+            release = { version, notes, url: `${RELEASES_PAGE}v${version}`, security: isSecurityRelease(notes) };
+        }
+    }
+    catch {
+        // Offline, slow or refused: nothing to say.
+    }
+    // The attempt is stamped either way, so a failure does not ask again until tomorrow.
+    try {
+        writeAtomic(join(dir, RELEASE_CACHE_FILE), `${JSON.stringify({ checkedAt: now.toISOString(), release })}\n`);
+    }
+    catch {
+        // A read-only folder only means asking again next time.
+    }
+    return release;
+}
+/** Notes that mention "Security" mark a security release. */
+/** A release marks itself as a security release with a line or heading that starts with "Security" (for example
+ * "## Security" or "- **Security fix.**"), not by mentioning the word ("no security changes"). */
+export function isSecurityRelease(notes) {
+    return /^\s*(?:#{1,6}\s*|[-*]\s*(?:\*\*)?)?security\b/im.test(notes);
+}
+/** a > b for dotted versions; a pre-release sorts before its release. */
+export function isNewer(a, b) {
+    const parse = (value) => {
+        const [core = "", pre] = value.replace(/^v/, "").split("-", 2);
+        return { parts: core.split(".").map(part => Number.parseInt(part, 10) || 0), pre: pre ?? null };
+    };
+    const left = parse(a), right = parse(b);
+    for (let index = 0; index < 3; index++) {
+        const diff = (left.parts[index] ?? 0) - (right.parts[index] ?? 0);
+        if (diff !== 0)
+            return diff > 0;
+    }
+    if (left.pre === right.pre)
+        return false;
+    if (left.pre === null)
+        return true;
+    if (right.pre === null)
+        return false;
+    return left.pre.localeCompare(right.pre, "en", { numeric: true }) > 0;
+}
+/** The release worth mentioning: newer than `current`, else null. */
+export function newerRelease(release, current) {
+    return release !== null && isNewer(release.version, current) ? release : null;
+}
+/** The one status line, only when a newer release exists. */
+export function updateLine(release, current, updateCommand) {
+    const newer = newerRelease(release, current);
+    return newer === null ? null : `${newer.version} is available — ${updateCommand} · ${newer.url}`;
+}
+/**
+ * A security release tells each instance operator once per version, through
+ * the outbox and addressed to them (like a sign-in pause): only someone at
+ * this computer can update it. Returns how many messages were queued.
+ */
+export function notifySecurityRelease(store, release, current, updateCommand, now) {
+    const newer = newerRelease(release, current);
+    if (newer === null || !newer.security)
+        return 0;
+    const operators = store.accountFacts().map(one => one.name).filter(name => store.isInstanceOperator(name));
+    let queued = 0;
+    for (const recipient of operators) {
+        const added = store.enqueueNotification({
+            dedupeKey: `release:security:${newer.version}:${recipient}`,
+            kind: "security-release",
+            pushClass: "attention",
+            link: "/settings#updates",
+            subject: `Toolroll ${newer.version} is a security release`,
+            body: `This computer runs ${current}. Update with \`${updateCommand}\`. Notes: ${newer.url}`,
+            recipient,
+            source: { installation: true },
+        }, now);
+        if (added)
+            queued++;
+    }
+    return queued;
+}
+export function recordRunnerVersion(dir, runner, version, now) {
+    const known = runnerVersions(dir).filter(one => one.runner !== runner);
+    known.push({ runner, version, at: now.toISOString() });
+    try {
+        writeAtomic(join(dir, RUNNER_VERSIONS_FILE), `${JSON.stringify(known.sort((a, b) => a.runner.localeCompare(b.runner)))}\n`);
+    }
+    catch {
+        // The version is a display fact; a failed write only leaves it unknown.
+    }
+}
+export function runnerVersions(dir) {
+    try {
+        const parsed = JSON.parse(readFileSync(join(dir, RUNNER_VERSIONS_FILE), "utf8"));
+        if (!Array.isArray(parsed))
+            return [];
+        return parsed.filter((one) => typeof one === "object" && one !== null
+            && typeof one.runner === "string" && typeof one.version === "string" && VERSION.test(one.version) && typeof one.at === "string");
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * The console's background check: at start and then hourly (the daily limit
+ * is latestRelease's own), and a security release notifies operators.
+ */
+export function startUpdateChecks(store, dir, current, updateCommand, io = {}) {
+    let stopped = false;
+    const pass = async () => {
+        const release = await latestRelease(dir, io);
+        if (!stopped) {
+            try {
+                notifySecurityRelease(store, release, current, updateCommand, (io.now ?? (() => new Date()))());
+            }
+            catch {
+                // A closed store at shutdown: nothing to tell.
+            }
+        }
+    };
+    void pass();
+    const timer = setInterval(() => void pass(), io.everyMs ?? 60 * 60_000);
+    timer.unref?.();
+    return () => { stopped = true; clearInterval(timer); };
+}
+async function askVersion(request) {
+    const answer = await request(REGISTRY_URL, { headers: { accept: "application/json" }, signal: AbortSignal.timeout(CHECK_TIMEOUT_MS), credentials: "omit", referrerPolicy: "no-referrer" });
+    if (!answer.ok)
+        return null;
+    const version = (await answer.json()).version;
+    return typeof version === "string" && VERSION.test(version) ? version : null;
+}
+async function askNotes(request, version) {
+    try {
+        const answer = await request(`${NOTES_API}v${version}`, { headers: { accept: "application/vnd.github+json" }, signal: AbortSignal.timeout(CHECK_TIMEOUT_MS), credentials: "omit", referrerPolicy: "no-referrer" });
+        if (!answer.ok)
+            return "";
+        const body = (await answer.json()).body;
+        return typeof body === "string" ? body.replace(/\r\n/g, "\n").slice(0, NOTES_MAX) : "";
+    }
+    catch {
+        return "";
+    }
+}
+function readCache(dir) {
+    const file = join(dir, RELEASE_CACHE_FILE);
+    if (!existsSync(file))
+        return null;
+    try {
+        const parsed = JSON.parse(readFileSync(file, "utf8"));
+        if (typeof parsed.checkedAt !== "string" || Number.isNaN(Date.parse(parsed.checkedAt)))
+            return null;
+        const release = parsed.release;
+        const valid = release !== null && typeof release === "object" && release !== undefined
+            && typeof release.version === "string" && VERSION.test(release.version) && typeof release.notes === "string";
+        return { checkedAt: parsed.checkedAt, release: valid ? { version: release.version, notes: release.notes, url: `${RELEASES_PAGE}v${release.version}`, security: isSecurityRelease(release.notes) } : null };
+    }
+    catch {
+        return null;
+    }
+}
+function writeAtomic(file, content) {
+    const temporary = `${file}.${process.pid}.tmp`;
+    writeFileSync(temporary, content, { mode: 0o600 });
+    renameSync(temporary, file);
+}

package/dist/serve.d.ts

@@ -14,6 +14,8 @@ import { type Phase } from "./provider.js";
 import type { RevisionLineage } from "./store.js";
 import type { SubscriptionMateRunner } from "./subscription-chat.js";
 export type ServeOptions = {
+    /** Tests: the bin whose real path says how Toolroll was installed (Settings → Updates' command). */
+    installBin?: string;
     /** Native coding workspace injection for isolated integration tests. */
     codingWorkspace?: CodingWorkspace;
     store: Store;

package/dist/serve.js

@@ -231,6 +231,10 @@ import { verifyApproverByPassword, verifyApproverStanding } from "./principal.js
 import { runMateTurn, MATE_MESSAGE_MAX_CHARS } from "./mate.js";
 import { confirmCoordinatorProposal, confirmMateProposal, dismissCoordinatorProposal, dismissMateProposal } from "./mate-doors.js";
 import { envValue } from "./names.js";
+import { cachedRelease, isNewer, runnerVersions, setUpdateChecks, updateChecksOff } from "./releases.js";
+import { installMethod } from "./install-method.js";
+import { PACKAGE_VERSION } from "./version.js";
+import { updateNoticeWords } from "./update-notice.js";
 const SESSION_COOKIE = "standing-orders_session";
 const BODY_CAP = 16 * 1024;
 // URL encoding can triple UTF-8 bytes. Admit the existing bounded task
@@ -386,6 +390,32 @@ export function createDecisionServer(options) {
         }
     }
     const clock = options.clock ?? (() => new Date());
+    const install = installMethod(options.installBin);
+    /** What the last daily check found (the cache only, never the network), or nothing while checks are off. */
+    const updateFacts = () => {
+        if (options.configDir === undefined)
+            return null;
+        const switched = updateChecksOff(process.env, options.configDir);
+        const release = switched.off ? null : cachedRelease(options.configDir);
+        return { release, newer: release !== null && isNewer(release.version, PACKAGE_VERSION), on: !switched.off, byEnv: switched.byEnv };
+    };
+    /** Settings → Updates, for everyone who can open Settings; only an operator may flip the switch. */
+    const settingsUpdates = (actor, csrf) => {
+        const facts = updateFacts();
+        if (facts === null)
+            return null;
+        const known = new Map(runnerVersions(options.configDir).map(one => [one.runner, one.version]));
+        return {
+            current: PACKAGE_VERSION,
+            latest: facts.release === null ? null : { version: facts.release.version, newer: facts.newer, security: facts.release.security, notes: facts.release.notes, url: facts.release.url },
+            updateCommand: install.updateCommand,
+            check: { on: facts.on, byEnv: facts.byEnv, canManage: csrf !== "" && store.isInstanceOperator(actor) },
+            workers: store.listRunners().filter(one => one.retiredAt === null).map(one => {
+                const version = known.get(one.name) ?? null;
+                return { name: one.name, version, older: version !== null && isNewer(PACKAGE_VERSION, version) };
+            }),
+        };
+    };
     const workspaceRevision = prepareWorkspaceRevision(store);
     const workspaceIncarnation = randomBytes(16).toString('hex');
     const workspaceValidators = new WorkspaceValidatorCache();
@@ -1349,6 +1379,7 @@ export function createDecisionServer(options) {
         const requestFacts = {
             theme: pinnedTheme(request.headers.cookie),
             accent: pinnedAccent(request.headers.cookie),
+            updateSeen: /(?:^|;\s*)so-update-seen=([0-9A-Za-z.-]{1,60})(?:;|$)/.exec(request.headers.cookie ?? "")?.[1] ?? null,
             actor: who.name,
             csrf: who.via === "cookie" ? who.session.csrf : "",
             returnTo: safeReturn(url.pathname + url.search),
@@ -3763,7 +3794,7 @@ export function createDecisionServer(options) {
                 const googleView = { connected: googleConnected(options.configDir ?? null)?.address ?? null, clientId: google?.clientId ?? "", redirect: origin === null ? null : `${origin}${GOOGLE_CALLBACK}` };
                 return email === null ? { set: false, host: "", port: 587, secure: false, user: "", from: "", imapHost: "", imapPort: 993, google: googleView }
                     : { set: true, host: email.host, port: email.port, secure: email.secure, user: email.user, from: email.from, imapHost: email.imap?.host ?? "", imapPort: email.imap?.port ?? 993, google: googleView };
-            })() : null, telegramDeliveryWords(store, loadBotToken(process.env, options.telegramTokenFile)), settingsWorkers(store, now)));
+            })() : null, telegramDeliveryWords(store, loadBotToken(process.env, options.telegramTokenFile)), settingsWorkers(store, now), settingsUpdates(who.name, csrf)));
         }
         if (url.pathname === "/push/key") {
             // Session-gated: the key is not secret, but strangers get nothing.
@@ -4441,6 +4472,7 @@ export function createDecisionServer(options) {
                 chats,
                 ...(s.refreshSeconds === undefined ? {} : { refreshSeconds: Math.max(5, Math.floor(s.refreshSeconds)) }),
                 ...(s.chrome.signIn === undefined ? {} : { signIn: s.chrome.signIn }),
+                ...(s.chrome.update === undefined ? {} : { update: s.chrome.update }),
             };
             if (requestFacts.workspaceRead) {
                 const validator = requestFacts.workspaceValidator;
@@ -4557,6 +4589,15 @@ export function createDecisionServer(options) {
             settings: true,
             ...(store.isDemo() ? { demo: true } : {}),
             ...(() => { const signIn = signInNotices(store); return signIn.length === 0 ? {} : { signIn }; })(),
+            ...(() => {
+                // Operators only (only someone at this computer can update it), and gone once this version is dismissed.
+                if (!facts?.csrf || !actor || !store.isInstanceOperator(actor))
+                    return {};
+                const update = updateFacts();
+                if (update === null || !update.newer || update.release === null || facts.updateSeen === update.release.version)
+                    return {};
+                return { update: { version: update.release.version, security: update.release.security, href: "/settings#updates", dismissHref: "/settings/updates/dismiss" } };
+            })(),
             ...(liveMode === null || liveModeTerms === null
                 ? {}
                 : {
@@ -5754,6 +5795,29 @@ export function createDecisionServer(options) {
             liftAuthPause(store, provider, "person", who.name, clock());
             return redirect(response, "/work");
         }
+        // The update notice is dismissed per browser and per version: a newer release shows it again.
+        if (url.pathname === "/settings/updates/dismiss") {
+            const version = body.get("version") ?? "";
+            if (!/^[0-9A-Za-z.-]{1,60}$/.test(version))
+                return refuse(response, who, 400, "Choose a version to dismiss.", "/settings#updates");
+            response.setHeader("Set-Cookie", `so-update-seen=${version}; SameSite=Lax; Path=/; Max-Age=31536000`);
+            if (body.get("quiet") === "1") {
+                response.writeHead(204);
+                response.end();
+                return;
+            }
+            return redirect(response, safeReturn(body.get("return") ?? "/settings#updates"));
+        }
+        // The daily check's switch: an installation setting, so an operator's.
+        if (url.pathname === "/settings/updates") {
+            if (options.configDir === undefined)
+                return refuse(response, who, 404, "Updates are not set up on this console.", "/settings");
+            if (!store.isInstanceOperator(who.name))
+                return refuse(response, who, 403, "Only an operator can change update checks.", "/settings#updates");
+            const on = body.get("check") === "on";
+            setUpdateChecks(options.configDir, on);
+            return redirect(response, `/settings?said=${encodeURIComponent(on ? "Toolroll looks for a newer version once a day." : "Update checks are off.")}#updates`);
+        }
         if (url.pathname === '/code' || url.pathname.startsWith('/code/')) {
             const wantsJson = request.headers.accept?.includes('application/json') === true;
             const fail = (status, message, delivery = 'rejected', sessionId) => wantsJson
@@ -13917,7 +13981,7 @@ button.pick-file { min-height: 1.75rem; padding: 0 .55rem; font-size: .75rem; }
 }
 `;
 /** Appearance: a three-way segmented switch, one tap per choice. */
-const THEME_CONTROLS_CSS = `.task-repo select{width:100%;min-height:2.75rem;font-size:1rem}.task-repo-add{margin:.35rem .1rem .5rem}.task-repo-add a{display:inline-flex;align-items:center;min-height:2.25rem}details.result-request-open.result-request-form>summary{border:0;background:transparent;padding:.5rem 0;min-height:2.75rem;font-weight:600;display:list-item;list-style:revert}details.result-request-open.result-request-form>summary::-webkit-details-marker{display:revert}form.js-autosave button[type=submit]{display:none}.provider-row{border-bottom:1px solid var(--so-line);padding:.35rem 0}.provider-row:first-of-type{border-top:1px solid var(--so-line)}.provider-head{display:flex;align-items:center;gap:.75rem;margin:.4rem 0 0}.provider-status{display:inline-flex;align-items:center;gap:.4rem;color:var(--so-muted);font-size:.875rem}.provider-status i{width:.5rem;height:.5rem;border-radius:50%;background:var(--so-muted)}.provider-status--ok i{background:var(--so-success)}.provider-status--warn i{background:var(--so-attention)}.provider-status--off i{background:transparent;border:1.5px solid var(--so-muted)}details.provider-manage>summary{cursor:pointer;color:var(--so-accent-text);font-size:.875rem;min-height:2.5rem;display:list-item;padding-block:.5rem}.card.props .row{display:grid;gap:.1rem;margin:0 0 .75rem}.card.props .row>.meta{display:block;font-size:.75rem}.card.props .row>.meta::first-letter{text-transform:uppercase}.card.props .row>.mono{font-family:var(--font-sans);font-size:.875rem}.card.props .row>.mono .seal{font-family:var(--font-mono);font-size:.8125rem}details.evidence-files{margin:1rem 0}details.evidence-files>summary{cursor:pointer;min-height:2.75rem;display:list-item;padding-block:.7rem;font-weight:600}details.evidence-files ul{list-style:none;margin:0;padding:0}details.evidence-files li{display:flex;justify-content:space-between;gap:1rem;padding:.5rem 0;border-bottom:1px solid var(--so-line)}.result-action .result-feedback-link{display:inline-flex;align-items:center;min-height:2.5rem;padding:.5rem 1rem;border:1px solid var(--so-input-line);border-radius:.5rem;background:var(--so-paper);color:var(--so-ink);font-weight:600;text-decoration:none}@media(hover:hover) and (pointer:fine){.result-action .result-feedback-link:hover{background:var(--so-raised)}}.so-sr-only{position:absolute!important;width:1px!important;height:1px!important;padding:0!important;margin:-1px!important;overflow:hidden!important;clip:rect(0,0,0,0)!important;white-space:nowrap!important;border:0!important}.verdict{margin:.5rem 0 .75rem}.verdict-chips{display:flex;flex-wrap:wrap;gap:.4rem;list-style:none;padding:0;margin:0}.verdict-chip{display:inline-flex;align-items:center;gap:.3rem;min-height:1.75rem;padding:.2rem .65rem;border-radius:999px;font-size:.8125rem;font-weight:600;background:var(--so-neutral-soft);color:var(--so-neutral-ink)}.verdict-chip svg{width:.9rem;height:.9rem}.verdict-chip--success{background:var(--so-success-soft);color:var(--so-success)}.verdict-chip--danger{background:var(--so-danger-soft);color:var(--so-danger)}.verdict-chip--warning{background:var(--so-warning-soft);color:var(--so-warning)}.verdict-chip--info{background:var(--so-info-soft);color:var(--so-info)}.verdict-by{margin:.4rem 0 0}details.result-request-open{margin:.5rem 0}details.result-request-open>summary{display:inline-flex;align-items:center;min-height:2.5rem;padding:.5rem 1rem;border:1px solid var(--so-input-line);border-radius:.5rem;background:var(--so-paper);color:var(--so-ink);font-weight:600;cursor:pointer;list-style:none}details.result-request-open>summary::-webkit-details-marker{display:none}details.result-request-open[open]>summary{margin-bottom:.75rem}.settings-tiles{display:grid;grid-template-columns:repeat(auto-fill,minmax(8.5rem,1fr));gap:.5rem;margin:0 0 2rem}.settings-tiles a{display:flex;align-items:center;gap:.6rem;min-height:3rem;padding:.65rem .8rem;border:1px solid var(--so-line);border-radius:.625rem;background:var(--so-paper);color:var(--so-ink);text-decoration:none;font-weight:550;font-size:.875rem}@media(hover:hover) and (pointer:fine){.settings-tiles a:hover{border-color:var(--so-input-line);background:var(--so-raised)}}.settings-tiles svg{width:1.1rem;height:1.1rem;flex-shrink:0;color:var(--so-accent-text)}details.settings-more{margin:.25rem 0 1.25rem}details.settings-more>summary{cursor:pointer;min-height:2.75rem;display:list-item;padding-block:.7rem;font-weight:550}details.settings-more>summary .meta{font-weight:400;margin-left:.35rem}.settings-changed{margin-top:-.25rem}.appearance{margin:0 0 28px}.appearance h2{margin:0 0 10px}.theme-switch{display:inline-flex;flex-wrap:nowrap;max-width:100%;gap:4px;padding:4px;margin:0;border:1px solid var(--so-line);border-radius:10px;background:var(--so-raised)}.theme-switch .theme-choice,.so-native-region .theme-switch .theme-choice{flex:1 1 0;width:auto;white-space:nowrap;min-height:40px;padding:8px 16px;border:0;border-radius:7px;background:transparent;color:var(--so-muted);font:inherit;font-weight:550;box-shadow:none;cursor:pointer}@media(hover:hover) and (pointer:fine){.theme-switch .theme-choice:hover{color:var(--so-ink)}}.theme-switch .theme-choice[aria-pressed="true"]{background:var(--so-paper);color:var(--so-ink);box-shadow:0 1px 2px rgb(0 0 0 / .1)}.appearance .meta{margin:8px 0 0}@media(max-width:600px){.theme-switch .theme-choice{min-height:44px}}`;
+const THEME_CONTROLS_CSS = `.task-repo select{width:100%;min-height:2.75rem;font-size:1rem}.task-repo-add{margin:.35rem .1rem .5rem}.task-repo-add a{display:inline-flex;align-items:center;min-height:2.25rem}details.result-request-open.result-request-form>summary{border:0;background:transparent;padding:.5rem 0;min-height:2.75rem;font-weight:600;display:list-item;list-style:revert}details.result-request-open.result-request-form>summary::-webkit-details-marker{display:revert}form.js-autosave button[type=submit]{display:none}.provider-row{border-bottom:1px solid var(--so-line);padding:.35rem 0}.provider-row:first-of-type{border-top:1px solid var(--so-line)}.provider-head{display:flex;align-items:center;gap:.75rem;margin:.4rem 0 0}.provider-status{display:inline-flex;align-items:center;gap:.4rem;color:var(--so-muted);font-size:.875rem}.provider-status i{width:.5rem;height:.5rem;border-radius:50%;background:var(--so-muted)}.provider-status--ok i{background:var(--so-success)}.provider-status--warn i{background:var(--so-attention)}.provider-status--off i{background:transparent;border:1.5px solid var(--so-muted)}details.provider-manage>summary{cursor:pointer;color:var(--so-accent-text);font-size:.875rem;min-height:2.5rem;display:list-item;padding-block:.5rem}.card.props .row{display:grid;gap:.1rem;margin:0 0 .75rem}.card.props .row>.meta{display:block;font-size:.75rem}.card.props .row>.meta::first-letter{text-transform:uppercase}.card.props .row>.mono{font-family:var(--font-sans);font-size:.875rem}.card.props .row>.mono .seal{font-family:var(--font-mono);font-size:.8125rem}details.evidence-files{margin:1rem 0}details.evidence-files>summary{cursor:pointer;min-height:2.75rem;display:list-item;padding-block:.7rem;font-weight:600}details.evidence-files ul{list-style:none;margin:0;padding:0}details.evidence-files li{display:flex;justify-content:space-between;gap:1rem;padding:.5rem 0;border-bottom:1px solid var(--so-line)}.result-action .result-feedback-link{display:inline-flex;align-items:center;min-height:2.5rem;padding:.5rem 1rem;border:1px solid var(--so-input-line);border-radius:.5rem;background:var(--so-paper);color:var(--so-ink);font-weight:600;text-decoration:none}@media(hover:hover) and (pointer:fine){.result-action .result-feedback-link:hover{background:var(--so-raised)}}.so-sr-only{position:absolute!important;width:1px!important;height:1px!important;padding:0!important;margin:-1px!important;overflow:hidden!important;clip:rect(0,0,0,0)!important;white-space:nowrap!important;border:0!important}.verdict{margin:.5rem 0 .75rem}.verdict-chips{display:flex;flex-wrap:wrap;gap:.4rem;list-style:none;padding:0;margin:0}.verdict-chip{display:inline-flex;align-items:center;gap:.3rem;min-height:1.75rem;padding:.2rem .65rem;border-radius:999px;font-size:.8125rem;font-weight:600;background:var(--so-neutral-soft);color:var(--so-neutral-ink)}.verdict-chip svg{width:.9rem;height:.9rem}.verdict-chip--success{background:var(--so-success-soft);color:var(--so-success)}.verdict-chip--danger{background:var(--so-danger-soft);color:var(--so-danger)}.verdict-chip--warning{background:var(--so-warning-soft);color:var(--so-warning)}.verdict-chip--info{background:var(--so-info-soft);color:var(--so-info)}.verdict-by{margin:.4rem 0 0}details.result-request-open{margin:.5rem 0}details.result-request-open>summary{display:inline-flex;align-items:center;min-height:2.5rem;padding:.5rem 1rem;border:1px solid var(--so-input-line);border-radius:.5rem;background:var(--so-paper);color:var(--so-ink);font-weight:600;cursor:pointer;list-style:none}details.result-request-open>summary::-webkit-details-marker{display:none}details.result-request-open[open]>summary{margin-bottom:.75rem}.settings-tiles{display:grid;grid-template-columns:repeat(auto-fill,minmax(8.5rem,1fr));gap:.5rem;margin:0 0 2rem}.settings-tiles a{display:flex;align-items:center;gap:.6rem;min-height:3rem;padding:.65rem .8rem;border:1px solid var(--so-line);border-radius:.625rem;background:var(--so-paper);color:var(--so-ink);text-decoration:none;font-weight:550;font-size:.875rem}@media(hover:hover) and (pointer:fine){.settings-tiles a:hover{border-color:var(--so-input-line);background:var(--so-raised)}}.settings-tiles svg{width:1.1rem;height:1.1rem;flex-shrink:0;color:var(--so-accent-text)}details.settings-more{margin:.25rem 0 1.25rem}details.settings-more>summary{cursor:pointer;min-height:2.75rem;display:list-item;padding-block:.7rem;font-weight:550}details.settings-more>summary .meta{font-weight:400;margin-left:.35rem}.settings-changed{margin-top:-.25rem}.appearance{margin:0 0 28px}.appearance h2{margin:0 0 10px}.theme-switch{display:inline-flex;flex-wrap:nowrap;max-width:100%;gap:4px;padding:4px;margin:0;border:1px solid var(--so-line);border-radius:10px;background:var(--so-raised)}.theme-switch .theme-choice,.so-native-region .theme-switch .theme-choice{flex:1 1 0;width:auto;white-space:nowrap;min-height:40px;padding:8px 16px;border:0;border-radius:7px;background:transparent;color:var(--so-muted);font:inherit;font-weight:550;box-shadow:none;cursor:pointer}@media(hover:hover) and (pointer:fine){.theme-switch .theme-choice:hover{color:var(--so-ink)}}.theme-switch .theme-choice[aria-pressed="true"]{background:var(--so-paper);color:var(--so-ink);box-shadow:0 1px 2px rgb(0 0 0 / .1)}.appearance .meta{margin:8px 0 0}@media(max-width:600px){.theme-switch .theme-choice{min-height:44px}}.update-notes{white-space:pre-wrap;overflow-wrap:anywhere;font:inherit;max-height:18rem;overflow:auto}`;
 /** The page CSS this module writes itself (not the imported modules'), for the stylesheet contract tests. */
 export const PAGE_CSS = STYLE + THEME_CONTROLS_CSS;
 const WORKSPACE_STYLE = styleAsset(STYLE + APPROVAL_RULES_CSS + SPEND_CSS + RETENTION_CSS + LIMITS_CSS + MONITORING_CSS + BACKUP_CSS + EXPORT_CSS + PROJECT_DELETE_CSS + POLICY_CSS + EVIDENCE_PACK_CSS + THEME_CONTROLS_CSS + CODING_CSS + CODING_SHIPPING_CSS + RECIPE_CSS + SKILLS_CSS + TOOLS_CSS + FLOWS_CSS + TEAMMATE_CSS + KITS_CSS + SSO_CSS + CREDENTIALS_CSS + KNOWLEDGE_CSS + MODELS_CSS + CHAT_POLISH_CSS + TRANSITIONS_CSS + WORKSPACE_MOTION_CSS + ASSIGNMENT_CSS + LEAD_CONTEXT_CSS + '.learning{min-width:0;overflow-wrap:anywhere}.learning .card{min-width:0}.learning code,.learning blockquote,.learning pre{white-space:pre-wrap;overflow-wrap:anywhere;word-break:break-word}.learning button,.learning summary,.learning .button-link{min-height:44px}.learning button{white-space:nowrap}.learning summary{padding:12px 0;cursor:pointer}.learning form{margin:12px 0}.learning select{max-width:100%}.learning blockquote{margin:8px 0}.learning ul{padding-left:20px}');
@@ -14327,7 +14391,11 @@ function shell(title, body, options = {}) {
             ? ""
             : `<div class="banner"><span class="badge badge-running">mode</span>${escape(chrome.modeBanner.words)} \u00b7 <a href="/mode">the terms \u00b7 end it</a></div>`) +
         (chrome.signIn ?? []).map(one => `<div class="banner sign-in-banner" data-sign-in="${escape(one.provider)}"><strong>${escape(one.title)}</strong> \u00b7 run <code>${escape(one.command)}</code> on this computer, then resume.${one.detail === "" ? "" : ` ${escape(one.detail)}`}` +
-            `<form method="post" action="${escape(one.resumeHref)}" class="inline"><input type="hidden" name="csrf" value="${escape(chrome.csrf ?? "")}"><button type="submit">${escape(one.resumeLabel)}</button></form></div>`).join("");
+            `<form method="post" action="${escape(one.resumeHref)}" class="inline"><input type="hidden" name="csrf" value="${escape(chrome.csrf ?? "")}"><button type="submit">${escape(one.resumeLabel)}</button></form></div>`).join("") +
+        (chrome.update === undefined
+            ? ""
+            : `<div class="banner update-banner" data-update="${escape(chrome.update.version)}">${escape(updateNoticeWords(chrome.update))} \u00b7 <a href="${escape(chrome.update.href)}">What's new</a>` +
+                `<form method="post" action="${escape(chrome.update.dismissHref)}" class="inline"><input type="hidden" name="csrf" value="${escape(chrome.csrf ?? "")}"><input type="hidden" name="version" value="${escape(chrome.update.version)}"><button type="submit">Dismiss</button></form></div>`);
     // The scope bar sits between the banners and the main/split body, so it
     // can never disappear with a responsive pane (portfolio arc §1).
     const content = chrome.listPane === undefined
@@ -21345,7 +21413,7 @@ function telegramDeliveryWords(store, bot) {
         return `Telegram pushes new messages to ${state.url}${state.problem === null ? "." : `, but ${state.problem.charAt(0).toLowerCase()}${state.problem.slice(1)}.`}`;
     return `Toolroll asks Telegram for new messages every few seconds${state?.problem ? ` (${state.problem})` : ""}.`;
 }
-function settingsPage(chrome, existing, hasEnv, csrf, problem, messaging = null, push = null, providerKeys = null, digest = null, permissionDefault = null, qualityDefault = null, email = null, telegramDelivery = null, workers = null) {
+function settingsPage(chrome, existing, hasEnv, csrf, problem, messaging = null, push = null, providerKeys = null, digest = null, permissionDefault = null, qualityDefault = null, email = null, telegramDelivery = null, workers = null, updates = null) {
     const permissionCard = permissionDefault === null
         ? ""
         : [
@@ -21541,6 +21609,7 @@ function settingsPage(chrome, existing, hasEnv, csrf, problem, messaging = null,
         telegram: { state: hasEnv ? "from the environment" : existing === null ? "not set" : "saved", current, delivery: telegramDelivery },
         email,
         workers,
+        updates,
     };
     return screen("Settings", [
         "<h1>Settings</h1>",
@@ -21550,6 +21619,7 @@ function settingsPage(chrome, existing, hasEnv, csrf, problem, messaging = null,
         qualityCard,
         keysCard,
         workersCard(workers),
+        updatesCard(updates, csrf),
         pushCard === "" && messagingCard === "" && digestCard === "" ? "" : `<h2>Notifications</h2>`,
         messagingCard,
         pushCard,
@@ -21604,6 +21674,23 @@ function workersCard(workers) {
                 `<p class="meta">To change how many a worker runs at once: <code>toolroll runner capacity &lt;name&gt; &lt;n&gt;</code></p>`) +
         `</section>`;
 }
+/** Settings → Updates, for browsers without the app script. */
+function updatesCard(updates, csrf) {
+    if (updates === null)
+        return "";
+    const latest = updates.latest;
+    return `<section id="updates" aria-labelledby="updates-title"><h2 id="updates-title">Updates</h2>` +
+        `<p class="row">This version <span class="mono">${escape(updates.current)}</span> \u00b7 ${!updates.check.on ? "Update checks are off" : latest === null ? "Not checked yet" : latest.newer ? `Latest <span class="mono">${escape(latest.version)}</span>` : "Up to date"}</p>` +
+        (latest !== null && latest.newer
+            ? `<p>Update with <code>${escape(updates.updateCommand)}</code> \u00b7 <a href="${escape(latest.url)}">Release notes</a></p>` +
+                (latest.notes === "" ? "" : `<details class="settings-more"><summary>What's new in ${escape(latest.version)}</summary><pre class="update-notes">${escape(latest.notes)}</pre></details>`)
+            : "") +
+        (updates.check.canManage && !updates.check.byEnv
+            ? `<form method="post" action="/settings/updates" class="inline"><input type="hidden" name="csrf" value="${escape(csrf)}"><input type="hidden" name="check" value="${updates.check.on ? "off" : "on"}"><button type="submit">${updates.check.on ? "Turn off daily check" : "Turn on daily check"}</button></form>`
+            : updates.check.byEnv ? `<p class="meta">Off by TOOLROLL_NO_UPDATE_CHECK.</p>` : "") +
+        (updates.workers.length === 0 ? "" : `<ul>${updates.workers.map(one => `<li data-worker-version="${escape(one.name)}">${escape(one.name)} <span class="mono">${escape(one.version ?? "unknown")}</span>${one.older ? " \u00b7 older" : ""}</li>`).join("")}</ul>`) +
+        `</section>`;
+}
 /** Choices save the moment they change; without the script the Save
  * button stays and the form works the same. */
 const SETTINGS_AUTOSAVE_SCRIPT = `(function(){document.querySelectorAll('form[data-autosave]').forEach(function(form){form.classList.add('js-autosave');form.addEventListener('change',function(ev){var t=ev.target;if(t&&(t.type==='radio'||t.tagName==='SELECT')){if(form.requestSubmit)form.requestSubmit();else form.submit();}});});})();`;

package/dist/update-notice.d.ts

@@ -0,0 +1,5 @@
+/** The update notice's words, shared by the server page and the console. Plain text; callers escape. */
+export declare function updateNoticeWords(notice: {
+    version: string;
+    security: boolean;
+}): string;

package/dist/update-notice.js

@@ -0,0 +1,4 @@
+/** The update notice's words, shared by the server page and the console. Plain text; callers escape. */
+export function updateNoticeWords(notice) {
+    return notice.security ? `Toolroll ${notice.version} is available, with security fixes` : `Toolroll ${notice.version} is available`;
+}

package/dist/work-index.js

@@ -2,7 +2,7 @@
  * not verify artifacts, inspect processes, or authorize task operations. */
 import { createHash } from 'node:crypto';
 import { readProjectAccess } from './project-access.js';
-import { providerName, signInReason } from './provider-auth.js';
+import { pauseOnTaskProviders, providerName, signInReason } from './provider-auth.js';
 import { scopeTermsProblem } from './store.js';
 export const WORK_INDEX_PAGE_LIMIT = 40;
 export const WORK_INDEX_MAX_LIMIT = 100;
@@ -15,6 +15,8 @@ const s = (row, key) => row[key] == null ? null : String(row[key]);
  * admitted child needs its parent's exact revision brief, in the same repo.
  * All subsequent reads are scalar/indexed metadata, never artifact bytes.
  * MATERIALIZED prevents counts + page selection repeating correlated reads. */
+/** A gate note counts only while its pause is on one of the task's current providers. */
+const GATE_PAUSE_ON_TASK = pauseOnTaskProviders('p', 'c.ref_id');
 const PROJECTION = `WITH RECURSIVE admitted AS MATERIALIZED (
   SELECT t.id, t.title, t.state, t.created_at, t.updated_at, r.id ref_id, r.repo,
     r.revision_of, r.revision_brief_artifact, r.assigned_runner, r.plan,
@@ -85,8 +87,8 @@ const PROJECTION = `WITH RECURSIVE admitted AS MATERIALIZED (
     sc.task_id scope_id,sc.digest,sc.approved_at,sc.proposed_at,sc.profile_state,
     -- The pause the dispatch gate itself left this task waiting on (the provider it resolved, pins,
     -- configuration and planners included) first; the approved terms answer before any gate has looked.
-    EXISTS(SELECT 1 FROM provider_auth_pause p WHERE p.id=c.auth_wait_pause AND p.lifted_at IS NULL) gate_signed_out,
-    COALESCE((SELECT p.provider||':'||p.auth_mode FROM provider_auth_pause p WHERE p.id=c.auth_wait_pause AND p.lifted_at IS NULL),
+    EXISTS(SELECT 1 FROM provider_auth_pause p WHERE p.id=c.auth_wait_pause AND p.lifted_at IS NULL AND ${GATE_PAUSE_ON_TASK}) gate_signed_out,
+    COALESCE((SELECT p.provider||':'||p.auth_mode FROM provider_auth_pause p WHERE p.id=c.auth_wait_pause AND p.lifted_at IS NULL AND ${GATE_PAUSE_ON_TASK}),
     (SELECT p.provider||':'||p.auth_mode FROM provider_auth_pause p WHERE p.lifted_at IS NULL AND p.provider IN (
       SELECT json_extract(sc.approved_profile_json,'$.provider') WHERE json_valid(sc.approved_profile_json)
       UNION ALL SELECT json_extract(leg.value,'$.provider') FROM json_each(CASE WHEN json_valid(sc.approved_route_json) THEN sc.approved_route_json ELSE '{}' END,'$.legs') leg

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolroll",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "A control plane for unattended coding agents — queue tasks, walk away, come back to pull requests. Agents build in leased worktrees, never touch your default branch, and interrupt you only for decisions that need a human.",
   "directories": {
     "doc": "docs"