toolroll 0.6.0 → 0.8.0

package/dist/update-notice.d.ts

@@ -0,0 +1,5 @@
+/** The update notice's words, shared by the server page and the console. Plain text; callers escape. */
+export declare function updateNoticeWords(notice: {
+    version: string;
+    security: boolean;
+}): string;

package/dist/update-notice.js

@@ -0,0 +1,4 @@
+/** The update notice's words, shared by the server page and the console. Plain text; callers escape. */
+export function updateNoticeWords(notice) {
+    return notice.security ? `Toolroll ${notice.version} is available, with security fixes` : `Toolroll ${notice.version} is available`;
+}

package/dist/work-index.js

@@ -2,7 +2,7 @@
  * not verify artifacts, inspect processes, or authorize task operations. */
 import { createHash } from 'node:crypto';
 import { readProjectAccess } from './project-access.js';
-import { providerName, signInReason } from './provider-auth.js';
+import { pauseOnTaskProviders, providerName, signInReason } from './provider-auth.js';
 import { scopeTermsProblem } from './store.js';
 export const WORK_INDEX_PAGE_LIMIT = 40;
 export const WORK_INDEX_MAX_LIMIT = 100;
@@ -15,6 +15,8 @@ const s = (row, key) => row[key] == null ? null : String(row[key]);
  * admitted child needs its parent's exact revision brief, in the same repo.
  * All subsequent reads are scalar/indexed metadata, never artifact bytes.
  * MATERIALIZED prevents counts + page selection repeating correlated reads. */
+/** A gate note counts only while its pause is on one of the task's current providers. */
+const GATE_PAUSE_ON_TASK = pauseOnTaskProviders('p', 'c.ref_id');
 const PROJECTION = `WITH RECURSIVE admitted AS MATERIALIZED (
   SELECT t.id, t.title, t.state, t.created_at, t.updated_at, r.id ref_id, r.repo,
     r.revision_of, r.revision_brief_artifact, r.assigned_runner, r.plan,
@@ -85,8 +87,8 @@ const PROJECTION = `WITH RECURSIVE admitted AS MATERIALIZED (
     sc.task_id scope_id,sc.digest,sc.approved_at,sc.proposed_at,sc.profile_state,
     -- The pause the dispatch gate itself left this task waiting on (the provider it resolved, pins,
     -- configuration and planners included) first; the approved terms answer before any gate has looked.
-    EXISTS(SELECT 1 FROM provider_auth_pause p WHERE p.id=c.auth_wait_pause AND p.lifted_at IS NULL) gate_signed_out,
-    COALESCE((SELECT p.provider||':'||p.auth_mode FROM provider_auth_pause p WHERE p.id=c.auth_wait_pause AND p.lifted_at IS NULL),
+    EXISTS(SELECT 1 FROM provider_auth_pause p WHERE p.id=c.auth_wait_pause AND p.lifted_at IS NULL AND ${GATE_PAUSE_ON_TASK}) gate_signed_out,
+    COALESCE((SELECT p.provider||':'||p.auth_mode FROM provider_auth_pause p WHERE p.id=c.auth_wait_pause AND p.lifted_at IS NULL AND ${GATE_PAUSE_ON_TASK}),
     (SELECT p.provider||':'||p.auth_mode FROM provider_auth_pause p WHERE p.lifted_at IS NULL AND p.provider IN (
       SELECT json_extract(sc.approved_profile_json,'$.provider') WHERE json_valid(sc.approved_profile_json)
       UNION ALL SELECT json_extract(leg.value,'$.provider') FROM json_each(CASE WHEN json_valid(sc.approved_route_json) THEN sc.approved_route_json ELSE '{}' END,'$.legs') leg

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolroll",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "description": "A control plane for unattended coding agents — queue tasks, walk away, come back to pull requests. Agents build in leased worktrees, never touch your default branch, and interrupt you only for decisions that need a human.",
   "directories": {
     "doc": "docs"
@@ -77,6 +77,7 @@
   },
   "files": [
     "dist",
+    "CHANGELOG.md",
     "scripts/provider-canary.mjs",
     "scripts/canary-assertions.mjs",
     "scripts/recovery-canary.mjs",