toolroll 0.8.0 → 0.8.1

package/dist/daemon.d.ts

@@ -148,8 +148,12 @@ export declare function installLaunchdService(definition: ServiceDefinition, run
 /** Replace a file whole: a flushed temporary beside it, renamed over it, and the directory flushed, so a crash
  * leaves the old text or the new, never a torn one. */
 export declare function writeFileDurably(file: string, content: string | Uint8Array, mode?: number): void;
-/** Explicit stop: unload AND disable, so nothing relaunches it until a person installs again. */
-export declare function stopLaunchdService(definition: ServiceDefinition, run: SupervisorRunner): Promise<{
+/** Explicit stop: unload AND disable, so nothing relaunches it until a person installs again. `waitMs` is how long
+ * the job may take to leave launchd (5 s by default; a watch's `toolroll up` can take 45 s to exit). */
+export declare function stopLaunchdService(definition: ServiceDefinition, run: SupervisorRunner, wait?: {
+    waitMs?: number;
+    sleep?: (ms: number) => Promise<void>;
+}): Promise<{
     ok: true;
     wasLoaded: boolean;
 } | {

package/dist/daemon.js

@@ -52,12 +52,12 @@ export function definitionDigest(unitContent) {
  * appears to succeed, then the pending bootout removes the new job too. Wait
  * for the observable supervisor boundary before loading the replacement.
  */
-async function waitForLaunchdBootout(run, service, attempts = 50) {
+async function waitForLaunchdBootout(run, service, attempts = 50, sleep = ms => new Promise(resolve => setTimeout(resolve, ms))) {
     for (let attempt = 0; attempt < attempts; attempt += 1) {
         const status = await run("launchctl", ["print", service]);
         if (status.code !== 0)
             return true;
-        await new Promise(resolve => setTimeout(resolve, 100));
+        await sleep(100);
     }
     return false;
 }
@@ -406,8 +406,9 @@ export function writeFileDurably(file, content, mode = 0o600) {
         }
     }
 }
-/** Explicit stop: unload AND disable, so nothing relaunches it until a person installs again. */
-export async function stopLaunchdService(definition, run) {
+/** Explicit stop: unload AND disable, so nothing relaunches it until a person installs again. `waitMs` is how long
+ * the job may take to leave launchd (5 s by default; a watch's `toolroll up` can take 45 s to exit). */
+export async function stopLaunchdService(definition, run, wait = {}) {
     const service = `gui/${launchdUid()}/${definition.label}`;
     const disabled = await run("launchctl", ["disable", service]);
     if (disabled.code !== 0)
@@ -415,7 +416,7 @@ export async function stopLaunchdService(definition, run) {
     const modern = await run("launchctl", ["bootout", service]);
     if (modern.code !== 0)
         await run("launchctl", ["unload", definition.unitPath]);
-    if (!(await waitForLaunchdBootout(run, service)))
+    if (!(await waitForLaunchdBootout(run, service, Math.ceil((wait.waitMs ?? 5000) / 100), wait.sleep)))
         return { ok: false, message: `launchctl did not stop ${definition.label}; the service is still loaded` };
     return { ok: true, wasLoaded: modern.code === 0 };
 }

package/dist/first-run.d.ts

@@ -46,8 +46,11 @@ export declare function firstTaskSuggestions(found: {
     issues: readonly OpenIssue[];
     todos: readonly TodoComment[];
 }): FirstTaskSuggestion[];
-/** `git grep` lines ("file:line:text") to TODO or FIXME notes, one per file. */
+/** `git grep -z -n` records ("file\0line\0text\n") to TODO or FIXME notes, one per file. NUL-separated so a
+ * file name with a colon or a newline in it is still one file name. */
 export declare function parseTodoLines(stdout: string, limit?: number): TodoComment[];
+/** The TODO search: no colour and no column whatever the person's git config says, NUL after each file name. */
+export declare const TODO_GREP_ARGS: readonly string[];
 /** Read the project's own sources for suggestions: its open issues through the `gh` login, then its TODO comments. Failures fall through quietly. */
 export declare function findFirstTasks(repo: string, runner?: Runner): Promise<FirstTaskSuggestion[]>;
 /** "First result in 7 min": how long after the installation began its first Ready result arrived. */

package/dist/first-run.js

@@ -42,24 +42,27 @@ export function firstTaskSuggestions(found) {
     return [...fromIssues, ...fromTodos, ...GENERIC_FIRST_TASKS].slice(0, 3);
 }
 const SKIPPED = /(^|\/)(node_modules|dist|build|vendor|third_party|\.git)\//;
-/** `git grep` lines ("file:line:text") to TODO or FIXME notes, one per file. */
+/** `git grep -z -n` records ("file\0line\0text\n") to TODO or FIXME notes, one per file. NUL-separated so a
+ * file name with a colon or a newline in it is still one file name. */
 export function parseTodoLines(stdout, limit = 3) {
     const found = [];
     const seen = new Set();
-    for (const line of stdout.split("\n")) {
-        const match = /^(.+?):(\d+):(.*)$/.exec(line);
-        if (match === null || SKIPPED.test(match[1]) || seen.has(match[1]))
+    for (const match of stdout.matchAll(/([^\0]*)\0(\d+)\0([^\n]*)(?:\n|$)/g)) {
+        const file = match[1];
+        if (file === "" || SKIPPED.test(file) || seen.has(file))
             continue;
         const note = /\b(?:TODO|FIXME)\b(?:\([^)]*\))?[:\s-]*(.*)$/.exec(match[3]);
         if (note === null)
             continue;
-        seen.add(match[1]);
-        found.push({ file: match[1], line: Number(match[2]), text: clip(note[1].replace(/\s*(\*\/|-->)\s*$/, "").trim(), 120) });
+        seen.add(file);
+        found.push({ file, line: Number(match[2]), text: clip(note[1].replace(/\s*(\*\/|-->)\s*$/, "").trim(), 120) });
         if (found.length === limit)
             break;
     }
     return found;
 }
+/** The TODO search: no colour and no column whatever the person's git config says, NUL after each file name. */
+export const TODO_GREP_ARGS = ["-c", "grep.column=false", "grep", "--no-color", "-z", "-n", "-I", "-w", "--max-count=1", "-E", "TODO|FIXME"];
 /** Read the project's own sources for suggestions: its open issues through the `gh` login, then its TODO comments. Failures fall through quietly. */
 export async function findFirstTasks(repo, runner = run) {
     let issues = [];
@@ -74,7 +77,7 @@ export async function findFirstTasks(repo, runner = run) {
     let todos = [];
     if (issues.length < 3) {
         try {
-            const result = await runner("git", ["grep", "-n", "-I", "-w", "--max-count=1", "-E", "TODO|FIXME"], { cwd: repo, timeoutMs: 5_000 });
+            const result = await runner("git", [...TODO_GREP_ARGS], { cwd: repo, timeoutMs: 5_000 });
             if (result.code === 0 || result.stdout !== "")
                 todos = parseTodoLines(result.stdout);
         }

package/dist/install-method.d.ts

@@ -3,7 +3,7 @@
  * the one command that updates it that way. Only the path is read: nothing is
  * run and nothing leaves the computer.
  */
-export type InstallKind = "npm" | "pnpm" | "bun" | "yarn" | "homebrew" | "npx" | "source" | "managed";
+export type InstallKind = "npm" | "pnpm" | "bun" | "yarn" | "homebrew" | "npx" | "source" | "managed" | "desktop";
 export type InstallMethod = {
     kind: InstallKind;
     updateCommand: string;

package/dist/install-method.js

@@ -15,6 +15,8 @@ export const UPDATE_COMMANDS = {
     source: "git pull && npm install && npm run build",
     // A runtime `toolroll update` installed (staged-upgrades/release-* or rollback-*): it updates itself.
     managed: "toolroll update",
+    // The Toolroll app carries its own runtime and updates as a whole app, never through a package manager.
+    desktop: "Update from the Toolroll app",
 };
 /** The install method of the bin at `bin` (the running one by default). Unknown shapes read as npm, the common case. */
 export function installMethod(bin = process.argv[1], probe = {}) {
@@ -36,6 +38,8 @@ function installKind(bin, probe) {
     // by deploying from source, never from npm.
     if (path.includes("/staged-upgrades/browser-"))
         return "source";
+    if (/\.app\/Contents\/Resources\//.test(path))
+        return "desktop";
     if (/\/staged-upgrades\/(release|rollback)-/.test(path))
         return "managed";
     if (/\/Cellar\/toolroll\//i.test(path))

package/dist/operate.d.ts

@@ -72,6 +72,7 @@ export type OperateOptions = {
     /** Injected by tests: whether `up` has a person at a terminal, and how it opens a browser. */
     upSeams?: {
         terminal?: boolean;
+        env?: Record<string, string | undefined>;
         openBrowser?: (url: string) => void;
     };
 };
@@ -115,6 +116,7 @@ export declare function runOperate(command: string, argv: readonly string[], wri
  * finding 27): exclusive, 0600, fsynced — file and directory both — so the
  * row only ever follows a durable secret. Throws on any failure. */
 export declare function writeLoginFileDurably(path: string, name: string, password: string): void;
+export declare function readUpConsoleUrl(dir: string): string | null;
 /**
  * The people allowed to agree to a scope.
  *

package/dist/operate.js

@@ -74,7 +74,7 @@ import { sweepLiveLogs } from "./live.js";
 import { configPath, addRepos, removeRepos, updateRepos, loadRepos, loadProjectRegistry, updateProjectRegistry } from "./repos.js";
 import { deleteProject, holdingsWords, projectHoldings, projectRunning } from "./project-delete.js";
 import { pushPass } from "./push.js";
-import { chmodSync, closeSync, constants as fsConstants, existsSync, fstatSync, fsyncSync, openSync, readFileSync, readSync, realpathSync, unlinkSync, writeSync, writeFileSync, mkdirSync } from "node:fs";
+import { chmodSync, closeSync, constants as fsConstants, existsSync, fstatSync, fsyncSync, openSync, readFileSync, readSync, realpathSync, renameSync, unlinkSync, writeSync, writeFileSync, mkdirSync } from "node:fs";
 import { BRANCH_PREFIX, envTwins, envValue, existingOrFirst, namedPath, taskBranches } from "./names.js";
 import { createServer as createNetServer } from "node:net";
 import { spawn as spawnChild } from "node:child_process";
@@ -128,7 +128,7 @@ import { daemonLaunchCommand, daemonStatus, installReplacingLegacy, installedLeg
 import { bridgePass, clearBotToken, createTransport, followBridge, hashPairingCode, loadBotToken, mintPairingCode, redactToken, saveBotToken, PAIRING_TTL_MS, TOKEN_ENV, telegramHookSecret, telegramPushUrl, } from "./telegram.js";
 import { scanRepo } from "./capscan.js";
 import { computeGaps, describeCapability } from "./gaps.js";
-import { ask, askHidden, confirm, interactive } from "./prompt.js";
+import { ask, askHidden, confirm, interactive, underAgent } from "./prompt.js";
 import { runMateCli, answerContextLines } from "./mate-cli.js";
 import { confirmCoordinatorProposal, dismissCoordinatorProposal } from "./mate-doors.js";
 import { verifyApproverByPassword } from "./principal.js";
@@ -7665,6 +7665,38 @@ function openBrowser(url) {
         // A browser that will not open is a URL the greeting already printed.
     }
 }
+/** Where `up` last served its console, kept beside the database so `onboard` names the same address. */
+const UP_CONSOLE_FILE = "up-console.json";
+function recordUpConsoleUrl(dir, url, now) {
+    try {
+        const file = join(dir, UP_CONSOLE_FILE), temporary = `${file}.${process.pid}.tmp`;
+        writeFileSync(temporary, `${JSON.stringify({ url, at: now.toISOString() })}\n`, { mode: 0o600 });
+        renameSync(temporary, file);
+    }
+    catch {
+        // A display fact: a failed write only leaves onboard on the default port.
+    }
+}
+export function readUpConsoleUrl(dir) {
+    try {
+        const parsed = JSON.parse(readFileSync(join(dir, UP_CONSOLE_FILE), "utf8"));
+        return typeof parsed.url === "string" && /^https?:\/\/[^\s]+$/.test(parsed.url) ? parsed.url.replace(/\/+$/, "") : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** How onboard says to sign in: the saved login file only while it still works (as `up` advertises it), else the
+ * account and its password; null only when there is no account yet. Never the password itself. */
+function onboardLogin(store, loginFile) {
+    const names = store.listApprovers().map(one => one.name);
+    const saved = readLoginFile(loginFile);
+    if (names.length === 0)
+        return saved === null ? null : { account: saved.name, file: loginFile }; // the next `up` adopts it
+    if (saved !== null && authenticateApprover(store, saved.name, saved.password).ok)
+        return { account: saved.name, file: loginFile };
+    return { account: names.length === 1 ? names[0] : null, file: null };
+}
 /**
  * `onboard`: the agent that installed Toolroll becomes its lead. The work
  * lives in agent-onboard.ts; this wires it to the installation: the same
@@ -7679,8 +7711,11 @@ async function onboardCommand(flags, context) {
     if (portGiven !== undefined && (!Number.isInteger(port) || port < 1 || port >= 65536)) {
         return fail(write, json, "onboard", "usage", "--port is a whole number under 65536", EXIT.usage);
     }
+    // The console where `up` last served, unless --port says otherwise.
+    const served = portGiven === undefined ? readUpConsoleUrl(dirname(context.databaseFile)) : null;
     const home = seams.home ?? homedir();
     const env = seams.env ?? process.env;
+    const loginFile = join(dirname(context.databaseFile), UP_LOGIN_FILE);
     const gitRun = context.gitRunner ?? ((file, args, opts) => run(file, [...args], { ...(opts?.cwd === undefined ? {} : { cwd: opts.cwd }), timeoutMs: 10_000 }));
     const registryPath = registryPathOf(context);
     const checker = createConnectionChecker({ home, env });
@@ -7690,18 +7725,31 @@ async function onboardCommand(flags, context) {
         yes: flag(flags, "yes"),
         remove: flag(flags, "remove"),
         agentFlag: text(flags, "agent"),
-        url: `http://127.0.0.1:${port}`,
-        loginFile: join(dirname(context.databaseFile), UP_LOGIN_FILE),
+        url: served ?? `http://127.0.0.1:${port}`,
+        login: onboardLogin(store, loginFile),
         home,
+        worktrees: join(dirname(context.databaseFile), "worktrees"),
         env,
         version: PACKAGE_VERSION,
         cwd: seams.cwd ?? process.cwd(),
-        interactive: seams.interactive ?? interactive(),
+        // An agent's shell may be a terminal, but nobody answers y/N there.
+        interactive: seams.interactive ?? (interactive() && !underAgent(env)),
         confirm: seams.confirm ?? (async (question) => /^y(es)?$/i.test(await ask(`${question} `))),
         findRepo: seams.findRepo ?? (async (cwd) => {
             const top = await gitRun("git", ["rev-parse", "--show-toplevel"], { cwd });
-            return top.code === 0 ? canonicalProject(top.stdout.trim()) : null;
+            const topPath = top.code === 0 ? canonicalProject(top.stdout.trim()) : null;
+            if (topPath === null)
+                return null;
+            // A linked worktree's project is its main checkout: the folder whose .git is the common one.
+            const common = await gitRun("git", ["rev-parse", "--path-format=absolute", "--git-common-dir"], { cwd });
+            const commonDir = common.code === 0 ? common.stdout.trim() : "";
+            const main = basename(commonDir) === ".git" ? canonicalProject(dirname(commonDir)) : null;
+            return { top: topPath, main: main ?? topPath };
         }),
+        enrolled: async (repo) => {
+            const registry = await loadProjectRegistry(registryPath);
+            return !("error" in registry) && registry.repos.includes(repo);
+        },
         enroll: async (repo) => {
             const before = await loadProjectRegistry(registryPath);
             const enrolled = await updateRepos(registryPath, repos => addRepos(repos, [repo]));
@@ -7839,7 +7887,10 @@ async function upCommand(flags, context) {
     if (!reserved) {
         return fail(write, json, "up", "port-busy", `port ${port} is taken — another \`up\` or \`serve\` may already be running; stop it, or pick a different --port`, EXIT.refused);
     }
-    const canPrompt = !json && process.stdin.isTTY === true && process.stdout.isTTY === true;
+    // Under a coding agent nothing is asked and no secret is printed, even in a real terminal: what is shown lands in
+    // its transcript.
+    const agentRunning = underAgent(context.upSeams?.env ?? process.env);
+    const canPrompt = !json && !agentRunning && process.stdin.isTTY === true && process.stdout.isTTY === true;
     let runnerName = "";
     let runnerToken = "";
     let approver = null;
@@ -8152,8 +8203,12 @@ async function upCommand(flags, context) {
     // 9. Readiness, then the ONE startup envelope / greeting (finding 11/20).
     const approverPlan2 = approver;
     const url = console_.url;
-    const terminal = context.upSeams?.terminal ?? process.stdout.isTTY === true;
-    const upHandoff = buildHandoff({ url, loginFile: approverPlan2.passwordFile, account: approverPlan2.passwordFile === null ? approverPlan2.approver : loginAccount(approverPlan2.passwordFile) ?? approverPlan2.approver });
+    const terminal = !agentRunning && (context.upSeams?.terminal ?? process.stdout.isTTY === true);
+    const upHandoff = buildHandoff({
+        url,
+        login: { account: approverPlan2.passwordFile === null ? approverPlan2.approver : loginAccount(approverPlan2.passwordFile) ?? approverPlan2.approver, file: approverPlan2.passwordFile },
+    });
+    recordUpConsoleUrl(dirname(context.databaseFile), url, clock());
     if (fatal === null) {
         if (json) {
             write(envelopeJson({

package/dist/prompt.d.ts

@@ -7,6 +7,12 @@
  */
 /** Whether asking is even possible: a human on both ends of the pipe. */
 export declare function interactive(): boolean;
+/**
+ * Whether a coding agent is running this command. An agent's shell can be a
+ * real terminal, yet whatever is printed lands in its transcript and nobody
+ * types at the prompt, so it is treated like no terminal at all.
+ */
+export declare function underAgent(env?: Record<string, string | undefined>): boolean;
 export declare function ask(question: string): Promise<string>;
 /** Like ask, but what is typed never echoes — passwords live here. */
 /**

package/dist/prompt.js

@@ -10,6 +10,18 @@ import { createInterface } from "node:readline";
 export function interactive() {
     return process.stdin.isTTY === true && process.stdout.isTTY === true;
 }
+/** Variables a coding agent sets for the commands it runs. CODEX_HOME and CODEX_API_KEY are a person's own settings. */
+const AGENT_VARIABLES = ["CLAUDECODE", "CLAUDE_CODE_ENTRYPOINT", "GEMINI_CLI", "CURSOR_AGENT", "OPENCODE"];
+const PERSON_CODEX_VARIABLES = new Set(["CODEX_HOME", "CODEX_API_KEY"]);
+/**
+ * Whether a coding agent is running this command. An agent's shell can be a
+ * real terminal, yet whatever is printed lands in its transcript and nobody
+ * types at the prompt, so it is treated like no terminal at all.
+ */
+export function underAgent(env = process.env) {
+    return Object.entries(env).some(([name, value]) => value !== undefined && value !== ""
+        && (AGENT_VARIABLES.includes(name) || (name.startsWith("CODEX_") && !PERSON_CODEX_VARIABLES.has(name))));
+}
 export function ask(question) {
     const rl = createInterface({ input: process.stdin, output: process.stdout });
     return new Promise(resolve => rl.question(question, answer => {

package/dist/serve.js

@@ -1883,7 +1883,7 @@ export function createDecisionServer(options) {
                 })),
                 cancelledBlockers: cancelled,
                 gaps: project === null ? [] : computeGaps(store, project, now).filter(gap => gap.unblocks.length > 0).slice(0, 10),
-                wizard: await firstRunStepsNow(now),
+                wizard: firstRunStepsNow(now),
                 worker: (() => {
                     // The one fact the inbox must never hide (install review): with
                     // no worker answering, nothing here will ever build, and every
@@ -3377,7 +3377,7 @@ export function createDecisionServer(options) {
                 }
             }
             // The first run belongs to the lead conversation, for someone who can act on it.
-            const firstRun = focusTask === null && who.role === "approver" ? await chatFirstRun(now, chatProject) : undefined;
+            const firstRun = focusTask === null && who.role === "approver" ? chatFirstRun(now, chatProject) : undefined;
             const withFirstRun = (shown) => firstRun === undefined ? shown : { ...shown, workspace: { ...shown.workspace, firstRun } };
             if (enabled.ok && mateSession !== null && principal !== null && !ceilingStale) {
                 {
@@ -3865,38 +3865,64 @@ export function createDecisionServer(options) {
      * review, finding 14). Each step is either something this console can do,
      * or the exact command where only the CLI can (finding e).
      */
-    async function firstRunStepsNow(now) {
+    function firstRunStepsNow(now) {
         if (restricted() || store.isDemo() || store.firstSuccessAt(now) !== null)
             return null;
-        return firstRunSteps({ agentSignedIn: await agentSignedIn(), projects: managedRepos().length, hasTask: store.hasAnyWork(), firstResultAt: null });
+        return firstRunSteps({ agentSignedIn: agentSignedIn(now), projects: managedRepos().length, hasTask: store.hasAnyWork(), firstResultAt: null });
     }
-    /** Whether any coding agent on this computer is signed in: the same
-     * non-spending checks Settings makes, cached briefly. */
-    async function agentSignedIn() {
-        const states = await Promise.all(["claude", "codex"].map(one => connectionCheck(one).then(value => value.state, () => "unverified")));
-        return states.some(state => state === "connected" || state === "key-works" || state === "key-present");
-    }
-    /** First tasks per project, read at most every ten minutes: a `gh`
-     * round trip and a `git grep` never run on every render. */
+    /**
+     * Whether a coding agent is signed in where the work runs. This machine's
+     * own checks (the ones Settings makes) speak only for a worker on this
+     * machine; a worker elsewhere speaks through its own readiness report, and
+     * the console never claims to have checked that machine (finding 15).
+     * Nothing here waits on a probe: this machine's answer is the last one
+     * seen, refreshed in the background.
+     */
+    function agentSignedIn(now) {
+        const here = hostname();
+        const workers = store.listRunners().filter(one => one.retiredAt === null && runnerAlive(one, now));
+        if ((options.localRunner !== undefined || workers.some(one => one.host === here)) && localAgentSignedIn())
+            return true;
+        return workers.some(one => one.host !== here && store.providerReadiness(one.name).some(seen => seen.state === "ready"));
+    }
+    let localSignIn = null;
+    let localSignInChecking = false;
+    function localAgentSignedIn() {
+        if (!localSignInChecking && (localSignIn === null || Date.now() - localSignIn.at > 30_000)) {
+            localSignInChecking = true;
+            void Promise.all(["claude", "codex"].map(one => connectionCheck(one).then(value => value.state, () => "unverified")))
+                .then(states => { localSignIn = { at: Date.now(), signedIn: states.some(state => state === "connected" || state === "key-works" || state === "key-present") }; })
+                .catch(() => { })
+                .finally(() => { localSignInChecking = false; });
+        }
+        return localSignIn?.signedIn ?? false;
+    }
+    /** First tasks per project: the last ones found (safe generic ones until then), re-read in the background at most
+     * every ten minutes. A render never waits on `gh` or `git grep`. */
     const firstTasks = new Map();
     function firstTasksFor(repo) {
-        const at = Date.now(), hit = firstTasks.get(repo);
-        if (hit !== undefined && hit.until > at)
-            return hit.value;
-        const value = findFirstTasks(repo, options.firstTaskRunner ?? execRun).catch(() => firstTaskSuggestions({ issues: [], todos: [] }));
-        firstTasks.set(repo, { until: at + 10 * 60_000, value });
-        return value;
+        const at = Date.now();
+        let entry = firstTasks.get(repo);
+        if (entry === undefined || (entry.until <= at && !entry.reading)) {
+            const reading = { until: at + 10 * 60_000, found: entry?.found ?? null, reading: true };
+            firstTasks.set(repo, reading);
+            entry = reading;
+            void findFirstTasks(repo, options.firstTaskRunner ?? execRun)
+                .then(found => { reading.found = found; }, () => { })
+                .finally(() => { reading.reading = false; });
+        }
+        return entry.found ?? firstTaskSuggestions({ issues: [], todos: [] });
     }
     /** Chat's first run: the steps, first tasks until the first task exists, and the sandbox while no agent is signed in. */
-    async function chatFirstRun(now, project) {
-        const steps = await firstRunStepsNow(now);
+    function chatFirstRun(now, project) {
+        const steps = firstRunStepsNow(now);
         if (steps === null)
             return undefined;
         const taskFiled = steps.find(one => one.key === "task")?.done ?? true;
         const repo = project ?? managedRepos()[0] ?? null;
         return {
             steps,
-            suggestions: taskFiled || repo === null ? [] : await firstTasksFor(repo),
+            suggestions: taskFiled || repo === null ? [] : firstTasksFor(repo),
             sandbox: steps.find(one => one.key === "agent")?.done === false ? SANDBOX_COMMAND : null,
         };
     }
@@ -6555,8 +6581,8 @@ export function createDecisionServer(options) {
             if (!newerThan(version, current))
                 return back("problem", `Toolroll ${version} is not newer than ${current}. To go back, run toolroll update --rollback.`);
             const method = options.updates?.method ?? installMethod();
-            if (method.kind === "npx" || method.kind === "source")
-                return back("problem", method.kind === "npx" ? "npx runs the latest release each time; there is nothing to update." : "This runs from a source checkout. Update it with git.");
+            if (method.kind === "npx" || method.kind === "source" || method.kind === "desktop")
+                return back("problem", method.kind === "npx" ? "npx runs the latest release each time; there is nothing to update." : method.kind === "desktop" ? "Update it from the Toolroll app." : "This runs from a source checkout. Update it with git.");
             const before = runtimeUpdateStatus(stateDir).journal;
             if (before !== null && !runtimeUpdateTerminal(before.phase))
                 return back("problem", "An update is already under way.");

package/dist/store.d.ts

@@ -4337,7 +4337,7 @@ export declare class Store {
      * createConsoleTask. Set-once: an already-stamped row never changes. */
     stampFiledVia(refId: number, via: string): void;
     /**
-     * When this installation first finished a run successfully — the
+     * When this installation first finished a run with a change — the
      * moment the first-run checklist retires, permanently. Derived from run
      * history the first time it is observed, then stamped as an append-only
      * installation fact so later pruning of those rows cannot resurrect the

package/dist/store.js

@@ -14391,7 +14391,7 @@ export class Store {
         this.db.prepare("UPDATE task_ref SET filed_via = ? WHERE id = ? AND filed_via IS NULL").run(via, refId);
     }
     /**
-     * When this installation first finished a run successfully — the
+     * When this installation first finished a run with a change — the
      * moment the first-run checklist retires, permanently. Derived from run
      * history the first time it is observed, then stamped as an append-only
      * installation fact so later pruning of those rows cannot resurrect the
@@ -14402,7 +14402,7 @@ export class Store {
         if (fact !== null)
             return fact;
         const row = this.db
-            .prepare("SELECT finished_at FROM run WHERE outcome IN ('built','no-change') AND finished_at IS NOT NULL ORDER BY id LIMIT 1")
+            .prepare("SELECT finished_at FROM run WHERE outcome = 'built' AND finished_at IS NOT NULL ORDER BY id LIMIT 1")
             .get();
         if (row === undefined)
             return null;
@@ -15938,8 +15938,9 @@ export class Store {
             this.recordRunProcessExits(id, result.now);
             this.settleRunStop(id, result.stopSettlement ?? "finished", result.now);
             // The first Ready result is an installation fact the moment it lands,
-            // not only when something later looks for it.
-            if (result.outcome === "built" || result.outcome === "no-change")
+            // not only when something later looks for it. A run that changed
+            // nothing is not a first result.
+            if (result.outcome === "built")
                 this.firstSuccessAt(result.now);
             // The park rate is *measured* — parked over concluded builder attempts —
             // and maintained where attempts conclude, because the attention budget's

package/dist/toolroll-update-cli.js

@@ -11,7 +11,7 @@ import { installMethod } from "./install-method.js";
 import { isNewer, latestVersionNow } from "./releases.js";
 import { databasePath } from "./store.js";
 import { PACKAGE_VERSION } from "./version.js";
-import { currentRuntime, machineSystem, readRuntimeUpdate, requestRuntimeUpdateCancel, resumeRuntimeUpdate, retireUpdateJob, runtimeUpdateTerminal, startRuntimeRollback, startRuntimeUpdate, } from "./toolroll-update.js";
+import { currentRuntime, lastCompletedUpdate, machineSystem, readRuntimeUpdate, requestRuntimeUpdateCancel, resumeRuntimeUpdate, retireUpdateJob, startRuntimeRollback, startRuntimeUpdate, } from "./toolroll-update.js";
 /** Loaded on first use (as backup.ts and store.ts do), so modules that only import this one (the console,
  * and tests that load it in a browser-like environment) never need `node:sqlite` itself. */
 function sqlite() {
@@ -90,9 +90,13 @@ export async function runUpdateCommand(args, write, deps = {}) {
         write("This Toolroll runs from a source checkout. Update it with git; toolroll update replaces installed releases only.");
         return 1;
     }
+    if (method.kind === "desktop") {
+        write("This Toolroll is the Toolroll app, which updates as a whole app. Update it from the Toolroll app.");
+        return 1;
+    }
     if (has("rollback")) {
-        const last = readRuntimeUpdate(stateDir);
-        if (!last || last.kind !== "update" || last.phase !== "complete" || !runtimeUpdateTerminal(last.phase)) {
+        const last = lastCompletedUpdate(stateDir);
+        if (!last) {
             write("There is no completed update to roll back.");
             return 1;
         }

package/dist/toolroll-update-ui.js

@@ -59,11 +59,12 @@ export function updatesHtml(view, notice) {
     const newer = latest !== null && newerThan(latest, view.current);
     const state = view.method.kind === "npx" ? `<h2>Toolroll ${e(view.current)}</h2><p class="meta">npx runs the latest release each time, so this is current.</p>`
         : view.method.kind === "source" ? `<h2>Toolroll ${e(view.current)}</h2><p class="meta">This runs from a source checkout. Update it with git.</p>`
-            : newer ? `<h2>Toolroll ${e(latest)} is available</h2><p class="meta">You have ${e(view.current)}. Running work finishes first, and your current version is kept so you can go back.</p>`
-                : "off" in view.latest ? `<h2>Toolroll ${e(view.current)}</h2><p class="meta">Update checks are off.</p><form method="get" action="/settings/updates" class="update-actions"><input type="hidden" name="check" value="now"><button type="submit">Check now</button></form>`
-                    : latest === null ? `<h2>Toolroll ${e(view.current)}</h2><p class="meta">Couldn’t check for a newer release: ${e("problem" in view.latest ? view.latest.problem : "")}</p>`
-                        : `<h2>Toolroll ${e(view.current)} is up to date</h2>`;
-    const form = newer && !["npx", "source"].includes(view.method.kind)
+            : newer && view.method.kind === "desktop" ? `<h2>Toolroll ${e(latest)} is available</h2><p class="meta">You have ${e(view.current)}. Update it from the Toolroll app.</p>`
+                : newer ? `<h2>Toolroll ${e(latest)} is available</h2><p class="meta">You have ${e(view.current)}. Running work finishes first, and your current version is kept so you can go back.</p>`
+                    : "off" in view.latest ? `<h2>Toolroll ${e(view.current)}</h2><p class="meta">Update checks are off.</p><form method="get" action="/settings/updates" class="update-actions"><input type="hidden" name="check" value="now"><button type="submit">Check now</button></form>`
+                        : latest === null ? `<h2>Toolroll ${e(view.current)}</h2><p class="meta">Couldn’t check for a newer release: ${e("problem" in view.latest ? view.latest.problem : "")}</p>`
+                            : `<h2>Toolroll ${e(view.current)} is up to date</h2>`;
+    const form = newer && !["npx", "source", "desktop"].includes(view.method.kind)
         ? `<form method="post" action="/settings/updates">${csrf}<input type="hidden" name="version" value="${e(latest)}">` +
             `<label class="step-up">Your Toolroll password<input type="password" name="password" autocomplete="current-password" required></label>` +
             `<div class="update-actions"><button type="submit" name="when" value="now" class="primary">Update now</button>` +