toolroll 0.8.1 → 0.8.2

package/dist/prompt.js

@@ -5,22 +5,51 @@
  * gets the same immediate usage refusal as always, because a scheduler
  * hanging on "password:" at 3am is the one bug this module must not have.
  */
+import { spawnSync } from "node:child_process";
+import { basename } from "node:path";
 import { createInterface } from "node:readline";
 /** Whether asking is even possible: a human on both ends of the pipe. */
 export function interactive() {
     return process.stdin.isTTY === true && process.stdout.isTTY === true;
 }
-/** Variables a coding agent sets for the commands it runs. CODEX_HOME and CODEX_API_KEY are a person's own settings. */
-const AGENT_VARIABLES = ["CLAUDECODE", "CLAUDE_CODE_ENTRYPOINT", "GEMINI_CLI", "CURSOR_AGENT", "OPENCODE"];
-const PERSON_CODEX_VARIABLES = new Set(["CODEX_HOME", "CODEX_API_KEY"]);
+/** Variables a coding agent sets for the commands it runs. Only Codex's own CODEX_ names: a person exports others
+ * (CODEX_HOME, CODEX_API_KEY, a profile) for themselves. */
+const AGENT_VARIABLES = ["CLAUDECODE", "CLAUDE_CODE_ENTRYPOINT", "GEMINI_CLI", "CURSOR_AGENT", "OPENCODE", "GOOSE_TERMINAL", "AIDER_CHAT",
+    "CODEX_SANDBOX", "CODEX_SANDBOX_NETWORK_DISABLED", "CODEX_THREAD_ID", "CODEX_CI", "CODEX_MANAGED_BY_NPM", "CODEX_MANAGED_BY_BUN"];
+/** Agents known by the program running this command, for those that set no variable of their own. */
+const AGENT_PROGRAMS = new Set(["claude", "codex", "gemini", "cursor-agent", "opencode", "aider", "copilot", "amp", "goose", "crush", "qwen"]);
+/** The program names of this process's ancestors, nearest first: each one's command and, for a script run by node
+ * or python, the script's name. Empty where `ps` cannot say. */
+export function ancestorPrograms() {
+    if (process.platform === "win32")
+        return [];
+    const names = [];
+    let pid = process.ppid;
+    for (let depth = 0; depth < 12 && pid > 1; depth++) {
+        const answered = spawnSync("/bin/ps", ["-o", "ppid=,args=", "-p", String(pid)], { encoding: "utf8", timeout: 2000 });
+        const found = answered.status === 0 ? /^\s*(\d+)\s+(.*)$/.exec(answered.stdout.trim()) : null;
+        if (!found)
+            break;
+        const words = found[2].split(/\s+/);
+        const program = basename(words[0] ?? "");
+        names.push(program);
+        if (/^(node|bun|deno|python[\d.]*)$/.test(program) && words[1] !== undefined && !words[1].startsWith("-"))
+            names.push(basename(words[1]));
+        pid = Number(found[1]);
+    }
+    return names;
+}
 /**
  * Whether a coding agent is running this command. An agent's shell can be a
  * real terminal, yet whatever is printed lands in its transcript and nobody
- * types at the prompt, so it is treated like no terminal at all.
+ * types at the prompt, so it is treated like no terminal at all. The agent is
+ * known by a variable it sets or, for one that sets none, by the program above
+ * this one. `programs` is read only for this process's own environment.
  */
-export function underAgent(env = process.env) {
-    return Object.entries(env).some(([name, value]) => value !== undefined && value !== ""
-        && (AGENT_VARIABLES.includes(name) || (name.startsWith("CODEX_") && !PERSON_CODEX_VARIABLES.has(name))));
+export function underAgent(env = process.env, programs = env === process.env ? ancestorPrograms : () => []) {
+    if (AGENT_VARIABLES.some(name => env[name] !== undefined && env[name] !== ""))
+        return true;
+    return programs().some(name => AGENT_PROGRAMS.has(name.replace(/\.(?:js|mjs|cjs|py|exe)$/, "")));
 }
 export function ask(question) {
     const rl = createInterface({ input: process.stdin, output: process.stdout });

package/dist/serve.js

@@ -206,6 +206,9 @@ import { BACKUP_EVERY_HOURS, MAX_KEEP, backupFolderOf, backupNow, checkBackupFol
 import { prometheusMetrics } from "./metrics.js";
 import { SPEND_CSS, spendCsv, spendHtml } from "./spend-ui.js";
 import { RETENTION_CSS, retentionHtml } from "./retention-ui.js";
+import { STORAGE_CSS, storageHtml } from "./storage-ui.js";
+import { bytesWords, parseCleanup } from "./storage.js";
+import { checkoutPlan, cleanCheckouts, discardCheckout, previewDigest } from "./checkout-cleanup.js";
 import { UPDATES_CSS, newerThan, updateStepsHtml, updatesHtml, updatesScript } from "./toolroll-update-ui.js";
 import { abandonRuntimeUpdate, launchRuntimeUpdate, markWhatsNewSeen, prepareRuntimeUpdate, requestRuntimeUpdateCancel, runningWorkWords, runtimeUpdateStatus, runtimeUpdateTerminal, currentRuntime } from "./toolroll-update.js";
 import { latestVersionNow } from "./releases.js";
@@ -393,6 +396,8 @@ export function createDecisionServer(options) {
         }
     }
     const clock = options.clock ?? (() => new Date());
+    /** Task checkouts, for Settings → Storage: the pool's own root, or the folder beside the database. */
+    const storagePool = (databaseFile) => new WorktreePool(store, { root: options.poolRoot ?? join(dirname(databaseFile), "worktrees") });
     const install = installMethod(options.installBin);
     /** What the last daily check found (the cache only, never the network), or nothing while checks are off. */
     const updateFacts = () => {
@@ -1411,7 +1416,7 @@ export function createDecisionServer(options) {
                             !url.searchParams.has('task') && !url.searchParams.has('result') && !url.searchParams.has('request')) {
                             const key = createHash('sha256').update(JSON.stringify([workspaceIncarnation, who.name,
                                 who.session.generation, who.session.csrf, who.session.project, who.session.projectRevision,
-                                admissionList(), url.pathname + url.search])).digest('hex');
+                                admissionList(), url.pathname + url.search, localSignIn?.signedIn ?? null])).digest('hex');
                             const revision = workspaceRevision.current(), now = clock();
                             const prior = workspaceValidators.get(key);
                             if (prior && prior.revision === revision && prior.expiresAt > now.getTime() && request.headers['if-none-match'] === prior.etag) {
@@ -3635,7 +3640,7 @@ export function createDecisionServer(options) {
             const current = options.updates?.current ?? PACKAGE_VERSION;
             // While update checks are off the page asks npm nothing until Check now.
             const checksOff = updateChecksOff(process.env, options.configDir ?? dirname(databaseFile)).off && url.searchParams.get("check") !== "now";
-            const view = { current, latest: active ? { version: current } : checksOff ? { off: true } : await latestReleaseFor(options.updates?.latest), method: options.updates?.method ?? installMethod(), journal: status.journal, running: status.running, whatsNew: status.whatsNew, csrf: who.session.csrf };
+            const view = { current, latest: active ? { version: current } : checksOff ? { off: true } : await latestReleaseFor(options.updates?.latest), method: options.updates?.method ?? installMethod(), journal: status.journal, running: status.running, whatsNew: status.whatsNew, rollbackTo: status.lastUpdate?.to === current ? status.lastUpdate.from : null, csrf: who.session.csrf };
             return sendScreen(response, 200, screen("Updates", `<p><a href="/settings">Settings</a></p><h1>Updates</h1>${updatesHtml(view, { said: url.searchParams.get("said"), problem: url.searchParams.get("problem") })}`, { chrome: chromeFor(project, "settings"), ...(active ? { functional: { script: updatesScript(), fetches: true } } : {}) }));
         }
         // v105: Settings → Retention, how long each kind of data is kept. An instance operator's page.
@@ -3645,6 +3650,15 @@ export function createDecisionServer(options) {
             const view = { periods: store.retentionPeriods(), next: retentionPlan(store, evidenceRoot, now).counts, lastSweep: lastSweepAt(store), csrf: who.session.csrf };
             return sendScreen(response, 200, screen("Retention", `<p><a href="/settings">Settings</a></p><h1>Retention</h1>${retentionHtml(view, { said: url.searchParams.get("said"), problem: url.searchParams.get("problem") })}`, { chrome: chromeFor(project, "settings") }));
         }
+        // Settings → Storage: what task checkouts use, cleaning up now (the preview behind the password), and when a
+        // finished task's clean checkout goes by itself. An instance operator's page.
+        if (url.pathname === "/settings/storage") {
+            const databaseFile = store.databaseFile();
+            if (who.via !== "cookie" || !store.isInstanceOperator(who.name) || databaseFile === null)
+                return refuse(response, who, 403, "An instance operator looks after storage.", "/settings");
+            const plan = await checkoutPlan(store, storagePool(databaseFile), now, { manual: true });
+            return sendScreen(response, 200, screen("Storage", `<p><a href="/settings">Settings</a></p><h1>Storage</h1>${storageHtml({ plan, csrf: who.session.csrf }, { said: url.searchParams.get("said"), problem: url.searchParams.get("problem") })}`, { chrome: chromeFor(project, "settings") }));
+        }
         // Sprint 8: Settings → Backups, how the last backup went and the schedule. An instance operator's page.
         if (url.pathname === "/settings/backups") {
             const databaseFile = store.databaseFile();
@@ -3873,17 +3887,19 @@ export function createDecisionServer(options) {
     /**
      * Whether a coding agent is signed in where the work runs. This machine's
      * own checks (the ones Settings makes) speak only for a worker on this
-     * machine; a worker elsewhere speaks through its own readiness report, and
+     * machine, or for the first one while none is registered yet (it is started
+     * here); a worker elsewhere speaks through its own readiness report, and
      * the console never claims to have checked that machine (finding 15).
      * Nothing here waits on a probe: this machine's answer is the last one
-     * seen, refreshed in the background.
+     * seen, refreshed in the background, and null until the first one is in.
      */
     function agentSignedIn(now) {
         const here = hostname();
-        const workers = store.listRunners().filter(one => one.retiredAt === null && runnerAlive(one, now));
-        if ((options.localRunner !== undefined || workers.some(one => one.host === here)) && localAgentSignedIn())
+        const registered = store.listRunners().filter(one => one.retiredAt === null);
+        const workers = registered.filter(one => runnerAlive(one, now));
+        if (workers.some(one => one.host !== here && store.providerReadiness(one.name).some(seen => seen.state === "ready")))
             return true;
-        return workers.some(one => one.host !== here && store.providerReadiness(one.name).some(seen => seen.state === "ready"));
+        return options.localRunner !== undefined || registered.length === 0 || workers.some(one => one.host === here) ? localAgentSignedIn() : false;
     }
     let localSignIn = null;
     let localSignInChecking = false;
@@ -3895,7 +3911,7 @@ export function createDecisionServer(options) {
                 .catch(() => { })
                 .finally(() => { localSignInChecking = false; });
         }
-        return localSignIn?.signedIn ?? false;
+        return localSignIn?.signedIn ?? null;
     }
     /** First tasks per project: the last ones found (safe generic ones until then), re-read in the background at most
      * every ten minutes. A render never waits on `gh` or `git grep`. */
@@ -3923,7 +3939,7 @@ export function createDecisionServer(options) {
         return {
             steps,
             suggestions: taskFiled || repo === null ? [] : firstTasksFor(repo),
-            sandbox: steps.find(one => one.key === "agent")?.done === false ? SANDBOX_COMMAND : null,
+            sandbox: steps.find(one => one.key === "agent" && !one.done && !one.checking) ? SANDBOX_COMMAND : null,
         };
     }
     // ---- fleet chat (v13) ----------------------------------------------------
@@ -6620,6 +6636,38 @@ export function createDecisionServer(options) {
                 store.setRetentionPeriod(one.kind, one.days ?? null, who.name, now);
             return back("said", changed.length === 0 ? "Nothing changed." : "Saved. The next daily sweep uses these periods.");
         }
+        // Settings → Storage: when a finished task's clean checkout goes, cleaning up what the preview showed, and throwing
+        // away a checkout kept for its changes. Each takes the password; the ledger keeps every change and removal.
+        if (url.pathname === "/settings/storage" || url.pathname === "/settings/storage/clean" || url.pathname === "/settings/storage/discard") {
+            const databaseFile = store.databaseFile();
+            if (who.via !== "cookie" || !store.isInstanceOperator(who.name) || databaseFile === null)
+                return refuse(response, who, 403, "An instance operator looks after storage.", "/settings");
+            const back = (key, words) => redirect(response, `/settings/storage?${key}=${encodeURIComponent(words)}`);
+            const what = url.pathname.endsWith("/clean") ? "clean up" : url.pathname.endsWith("/discard") ? "discard a checkout" : "change checkout cleanup";
+            if (!authenticateApprover(store, who.name, body.get("password") ?? "").ok)
+                return back("problem", `Enter your Toolroll password to ${what}.`);
+            if (url.pathname === "/settings/storage") {
+                const cleanup = parseCleanup(body.get("cleanup") ?? "");
+                if (cleanup === undefined)
+                    return back("problem", "Choose when a finished task's checkout is removed.");
+                const before = store.checkoutCleanup();
+                store.setCheckoutCleanup(cleanup, who.name, now);
+                return back("said", cleanup === before ? "Nothing changed." : "Saved.");
+            }
+            const pool = storagePool(databaseFile);
+            if (url.pathname.endsWith("/clean")) {
+                // Only what the preview showed goes: when that changed since, the person looks again.
+                const plan = await checkoutPlan(store, pool, clock(), { manual: true });
+                if (plan.go.length === 0)
+                    return back("said", "Nothing to clean up.");
+                if (body.get("preview") !== previewDigest(plan))
+                    return back("problem", "What a clean-up would remove changed since you looked. Check the list again.");
+                const done = await cleanCheckouts(store, pool, clock, { manual: true, actor: who.name, only: new Set(plan.go.map(one => one.path)) });
+                return back("said", done.removed.length === 0 ? "Nothing was removed: those checkouts are no longer ready to go." : `Removed ${done.removed.length} checkout${done.removed.length === 1 ? "" : "s"}, about ${bytesWords(done.freed)}. Their branches stay.`);
+            }
+            const done = await discardCheckout(store, pool, body.get("path") ?? "", now, who.name);
+            return done.ok ? back("said", `Discarded, about ${bytesWords(done.bytes)}. Its branch stays.`) : back("problem", done.message);
+        }
         // Sprint 8: back up now. An instance operator; the outcome is kept like a scheduled one's.
         if (url.pathname === "/settings/backups/now") {
             const databaseFile = store.databaseFile();
@@ -14066,7 +14114,7 @@ button.pick-file { min-height: 1.75rem; padding: 0 .55rem; font-size: .75rem; }
 const THEME_CONTROLS_CSS = `.task-repo select{width:100%;min-height:2.75rem;font-size:1rem}.task-repo-add{margin:.35rem .1rem .5rem}.task-repo-add a{display:inline-flex;align-items:center;min-height:2.25rem}details.result-request-open.result-request-form>summary{border:0;background:transparent;padding:.5rem 0;min-height:2.75rem;font-weight:600;display:list-item;list-style:revert}details.result-request-open.result-request-form>summary::-webkit-details-marker{display:revert}form.js-autosave button[type=submit]{display:none}.provider-row{border-bottom:1px solid var(--so-line);padding:.35rem 0}.provider-row:first-of-type{border-top:1px solid var(--so-line)}.provider-head{display:flex;align-items:center;gap:.75rem;margin:.4rem 0 0}.provider-status{display:inline-flex;align-items:center;gap:.4rem;color:var(--so-muted);font-size:.875rem}.provider-status i{width:.5rem;height:.5rem;border-radius:50%;background:var(--so-muted)}.provider-status--ok i{background:var(--so-success)}.provider-status--warn i{background:var(--so-attention)}.provider-status--off i{background:transparent;border:1.5px solid var(--so-muted)}details.provider-manage>summary{cursor:pointer;color:var(--so-accent-text);font-size:.875rem;min-height:2.5rem;display:list-item;padding-block:.5rem}.card.props .row{display:grid;gap:.1rem;margin:0 0 .75rem}.card.props .row>.meta{display:block;font-size:.75rem}.card.props .row>.meta::first-letter{text-transform:uppercase}.card.props .row>.mono{font-family:var(--font-sans);font-size:.875rem}.card.props .row>.mono .seal{font-family:var(--font-mono);font-size:.8125rem}details.evidence-files{margin:1rem 0}details.evidence-files>summary{cursor:pointer;min-height:2.75rem;display:list-item;padding-block:.7rem;font-weight:600}details.evidence-files ul{list-style:none;margin:0;padding:0}details.evidence-files li{display:flex;justify-content:space-between;gap:1rem;padding:.5rem 0;border-bottom:1px solid var(--so-line)}.result-action .result-feedback-link{display:inline-flex;align-items:center;min-height:2.5rem;padding:.5rem 1rem;border:1px solid var(--so-input-line);border-radius:.5rem;background:var(--so-paper);color:var(--so-ink);font-weight:600;text-decoration:none}@media(hover:hover) and (pointer:fine){.result-action .result-feedback-link:hover{background:var(--so-raised)}}.so-sr-only{position:absolute!important;width:1px!important;height:1px!important;padding:0!important;margin:-1px!important;overflow:hidden!important;clip:rect(0,0,0,0)!important;white-space:nowrap!important;border:0!important}.verdict{margin:.5rem 0 .75rem}.verdict-chips{display:flex;flex-wrap:wrap;gap:.4rem;list-style:none;padding:0;margin:0}.verdict-chip{display:inline-flex;align-items:center;gap:.3rem;min-height:1.75rem;padding:.2rem .65rem;border-radius:999px;font-size:.8125rem;font-weight:600;background:var(--so-neutral-soft);color:var(--so-neutral-ink)}.verdict-chip svg{width:.9rem;height:.9rem}.verdict-chip--success{background:var(--so-success-soft);color:var(--so-success)}.verdict-chip--danger{background:var(--so-danger-soft);color:var(--so-danger)}.verdict-chip--warning{background:var(--so-warning-soft);color:var(--so-warning)}.verdict-chip--info{background:var(--so-info-soft);color:var(--so-info)}.verdict-by{margin:.4rem 0 0}details.result-request-open{margin:.5rem 0}details.result-request-open>summary{display:inline-flex;align-items:center;min-height:2.5rem;padding:.5rem 1rem;border:1px solid var(--so-input-line);border-radius:.5rem;background:var(--so-paper);color:var(--so-ink);font-weight:600;cursor:pointer;list-style:none}details.result-request-open>summary::-webkit-details-marker{display:none}details.result-request-open[open]>summary{margin-bottom:.75rem}.settings-tiles{display:grid;grid-template-columns:repeat(auto-fill,minmax(8.5rem,1fr));gap:.5rem;margin:0 0 2rem}.settings-tiles a{display:flex;align-items:center;gap:.6rem;min-height:3rem;padding:.65rem .8rem;border:1px solid var(--so-line);border-radius:.625rem;background:var(--so-paper);color:var(--so-ink);text-decoration:none;font-weight:550;font-size:.875rem}@media(hover:hover) and (pointer:fine){.settings-tiles a:hover{border-color:var(--so-input-line);background:var(--so-raised)}}.settings-tiles svg{width:1.1rem;height:1.1rem;flex-shrink:0;color:var(--so-accent-text)}details.settings-more{margin:.25rem 0 1.25rem}details.settings-more>summary{cursor:pointer;min-height:2.75rem;display:list-item;padding-block:.7rem;font-weight:550}details.settings-more>summary .meta{font-weight:400;margin-left:.35rem}.settings-changed{margin-top:-.25rem}.appearance{margin:0 0 28px}.appearance h2{margin:0 0 10px}.theme-switch{display:inline-flex;flex-wrap:nowrap;max-width:100%;gap:4px;padding:4px;margin:0;border:1px solid var(--so-line);border-radius:10px;background:var(--so-raised)}.theme-switch .theme-choice,.so-native-region .theme-switch .theme-choice{flex:1 1 0;width:auto;white-space:nowrap;min-height:40px;padding:8px 16px;border:0;border-radius:7px;background:transparent;color:var(--so-muted);font:inherit;font-weight:550;box-shadow:none;cursor:pointer}@media(hover:hover) and (pointer:fine){.theme-switch .theme-choice:hover{color:var(--so-ink)}}.theme-switch .theme-choice[aria-pressed="true"]{background:var(--so-paper);color:var(--so-ink);box-shadow:0 1px 2px rgb(0 0 0 / .1)}.appearance .meta{margin:8px 0 0}@media(max-width:600px){.theme-switch .theme-choice{min-height:44px}}.update-notes{white-space:pre-wrap;overflow-wrap:anywhere;font:inherit;max-height:18rem;overflow:auto}`;
 /** The page CSS this module writes itself (not the imported modules'), for the stylesheet contract tests. */
 export const PAGE_CSS = STYLE + THEME_CONTROLS_CSS;
-const WORKSPACE_STYLE = styleAsset(STYLE + APPROVAL_RULES_CSS + SPEND_CSS + RETENTION_CSS + UPDATES_CSS + LIMITS_CSS + MONITORING_CSS + BACKUP_CSS + EXPORT_CSS + PROJECT_DELETE_CSS + POLICY_CSS + EVIDENCE_PACK_CSS + THEME_CONTROLS_CSS + CODING_CSS + CODING_SHIPPING_CSS + RECIPE_CSS + SKILLS_CSS + TOOLS_CSS + FLOWS_CSS + TEAMMATE_CSS + KITS_CSS + SSO_CSS + CREDENTIALS_CSS + KNOWLEDGE_CSS + MODELS_CSS + CHAT_POLISH_CSS + TRANSITIONS_CSS + WORKSPACE_MOTION_CSS + ASSIGNMENT_CSS + LEAD_CONTEXT_CSS + '.learning{min-width:0;overflow-wrap:anywhere}.learning .card{min-width:0}.learning code,.learning blockquote,.learning pre{white-space:pre-wrap;overflow-wrap:anywhere;word-break:break-word}.learning button,.learning summary,.learning .button-link{min-height:44px}.learning button{white-space:nowrap}.learning summary{padding:12px 0;cursor:pointer}.learning form{margin:12px 0}.learning select{max-width:100%}.learning blockquote{margin:8px 0}.learning ul{padding-left:20px}');
+const WORKSPACE_STYLE = styleAsset(STYLE + APPROVAL_RULES_CSS + SPEND_CSS + RETENTION_CSS + STORAGE_CSS + UPDATES_CSS + LIMITS_CSS + MONITORING_CSS + BACKUP_CSS + EXPORT_CSS + PROJECT_DELETE_CSS + POLICY_CSS + EVIDENCE_PACK_CSS + THEME_CONTROLS_CSS + CODING_CSS + CODING_SHIPPING_CSS + RECIPE_CSS + SKILLS_CSS + TOOLS_CSS + FLOWS_CSS + TEAMMATE_CSS + KITS_CSS + SSO_CSS + CREDENTIALS_CSS + KNOWLEDGE_CSS + MODELS_CSS + CHAT_POLISH_CSS + TRANSITIONS_CSS + WORKSPACE_MOTION_CSS + ASSIGNMENT_CSS + LEAD_CONTEXT_CSS + '.learning{min-width:0;overflow-wrap:anywhere}.learning .card{min-width:0}.learning code,.learning blockquote,.learning pre{white-space:pre-wrap;overflow-wrap:anywhere;word-break:break-word}.learning button,.learning summary,.learning .button-link{min-height:44px}.learning button{white-space:nowrap}.learning summary{padding:12px 0;cursor:pointer}.learning form{margin:12px 0}.learning select{max-width:100%}.learning blockquote{margin:8px 0}.learning ul{padding-left:20px}');
 /**
  * The board's liveness: fetch this page's own fragment on a timer and swap
  * it in place — no flicker, no scroll reset, no long-lived stream to manage,
@@ -14725,7 +14773,7 @@ function inboxPage(chrome, data) {
             `<p><strong>Get to your first result</strong></p>` +
             data.wizard
                 .map(step => `<p class="row" data-step="${step.key}"><span class="mono" aria-hidden="true">${step.done ? "\u2713" : "\u25cb"}</span> <strong>${escape(step.title)}</strong>` +
-                (step.action === null ? ` <span class="meta">done</span>`
+                (step.checking ? ` <span class="meta">checking…</span>` : step.action === null ? ` <span class="meta">done</span>`
                     : step.action.kind === "link" ? ` <a href="${escape(step.action.href)}">${escape(step.action.label)}</a>`
                         : ` <code>${escape(step.action.command)}</code>`) +
                 `</p>`)
@@ -21810,6 +21858,7 @@ const SETTINGS_TILE_ICONS = [
     ["/settings/approval", "Approval rules", `<path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/><path d="m9 12 2 2 4-4"/>`],
     ["/settings/monitoring", "Monitoring", `<path d="M22 12h-4l-3 9L9 3l-3 9H2"/>`],
     ["/settings/retention", "Retention", `<circle cx="12" cy="12" r="9"/><path d="M12 7v5l3 2"/>`],
+    ["/settings/storage", "Storage", `<path d="M22 12H2"/><path d="M5.45 5.11 2 12v6a2 2 0 0 0 2 2h16a2 2 0 0 0 2-2v-6l-3.45-6.89A2 2 0 0 0 16.76 4H7.24a2 2 0 0 0-1.79 1.11z"/><path d="M6 16h.01M10 16h.01"/>`],
     ["/settings/updates", "Updates", `<path d="M21 12a9 9 0 1 1-2.64-6.36"/><path d="M21 3v6h-6"/>`],
     ["/settings/backups", "Backups", `<ellipse cx="12" cy="5" rx="9" ry="3"/><path d="M3 5v14c0 1.7 4 3 9 3s9-1.3 9-3V5"/><path d="M3 12c0 1.7 4 3 9 3s9-1.3 9-3"/>`],
     ["/settings/data", "Data", `<path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4"/><path d="m7 10 5 5 5-5"/><path d="M12 15V3"/>`],

package/dist/storage-ui.d.ts

@@ -0,0 +1,10 @@
+import { type CheckoutPlan } from "./checkout-cleanup.js";
+export declare const STORAGE_CSS: string;
+export type StorageView = {
+    plan: CheckoutPlan;
+    csrf: string;
+};
+export declare function storageHtml(view: StorageView, notice: {
+    said?: string | null;
+    problem?: string | null;
+}): string;

package/dist/storage-ui.js

@@ -0,0 +1,67 @@
+/**
+ * Settings → Storage: how much space task checkouts use, what a clean-up would free now, a Clean up button whose
+ * preview (what goes, what stays and why, with paths) sits behind the password, and when a finished task's clean
+ * checkout goes by itself. An instance operator's page.
+ */
+import { homedir } from "node:os";
+import { basename } from "node:path";
+import { previewDigest, whyWords } from "./checkout-cleanup.js";
+import { CLEANUP_CHOICES, bytesWords } from "./storage.js";
+const e = (value) => String(value ?? "").replace(/[&<>"']/g, c => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
+const plural = (count, one, many = `${one}s`) => `${count} ${count === 1 ? one : many}`;
+export const STORAGE_CSS = `.storage{max-width:720px;min-width:0;overflow-wrap:anywhere}.storage h2{font-size:1.0625rem;margin:24px 0 4px}` +
+    `.storage .storage-state{display:grid;gap:12px}.storage .storage-state h2{margin:0}.storage .storage-state p{margin:0}` +
+    `.storage details.clean-up,.storage details.discard{border:0;padding:0;margin:0;background:transparent}` +
+    `.storage details.clean-up>summary{list-style:none;display:inline-flex;align-items:center;min-height:2.125rem;padding:.35rem .75rem;border-radius:calc(var(--radius) - 3px);` +
+    `background:var(--primary);color:var(--primary-foreground);font-weight:600;font-size:.8125rem;cursor:pointer;white-space:nowrap}` +
+    `.storage details.clean-up>summary::-webkit-details-marker{display:none}.storage details.clean-up[open]>summary{background:var(--card);color:var(--foreground);border:1px solid var(--input)}` +
+    `.storage .preview{display:grid;gap:12px;margin-top:12px;padding-top:12px;border-top:1px solid var(--border)}.storage .preview h3{font-size:.875rem;margin:0}` +
+    `.storage ul.checkouts{list-style:none;padding:0;margin:0}` +
+    `.storage ul.checkouts li{display:grid;grid-template-columns:minmax(0,1fr) auto;gap:2px 12px;padding:8px 0;border-top:1px solid var(--border);font-size:.8125rem}` +
+    `.storage ul.checkouts .name{font-weight:500;min-width:0}.storage ul.checkouts .size{font-variant-numeric:tabular-nums;white-space:nowrap}` +
+    `.storage ul.checkouts .path{grid-column:1/-1;font-family:var(--font-mono, ui-monospace, monospace);font-size:.6875rem;color:var(--muted-foreground);word-break:break-all}` +
+    `.storage ul.checkouts .why{grid-column:1/-1}` +
+    `.storage details.discard{grid-column:1/-1}.storage details.discard>summary{cursor:pointer;color:var(--destructive);min-height:2.25rem;display:inline-flex;align-items:center}` +
+    `.storage form{display:grid;gap:10px;margin:0}.storage label{display:grid;gap:4px;font-size:.8125rem;font-weight:500;max-width:20rem}` +
+    `.storage select,.storage input[type=password]{width:100%;box-sizing:border-box;min-height:2.125rem}.storage form button{justify-self:start;white-space:nowrap}` +
+    `.storage form.setting button[type=submit],.storage .preview form.remove button[type=submit]{background:var(--primary);color:var(--primary-foreground);border-color:var(--primary);font-weight:600}` +
+    `@media (max-width:900px){.storage details.clean-up>summary,.storage form button{min-height:44px}.storage label{max-width:none}.storage select,.storage input[type=password]{min-height:44px;font-size:16px}.storage .preview form.remove button{width:100%}}`;
+function item(one, csrf) {
+    const discard = one.why === "has changes"
+        ? `<details class="discard"><summary>Discard</summary><form method="post" action="/settings/storage/discard"><input type="hidden" name="csrf" value="${e(csrf)}"><input type="hidden" name="path" value="${e(one.path)}">` +
+            `<p class="meta">Throws away this checkout and its uncommitted changes. Its branch stays.</p>` +
+            `<label>Your Toolroll password<input type="password" name="password" autocomplete="current-password" required></label><button type="submit" class="danger">Discard changes</button></form></details>`
+        : "";
+    // The task it was for, then where it is (the home folder as ~), then why it stays.
+    const home = homedir();
+    const where = home !== "" && one.path.startsWith(`${home}/`) ? `~${one.path.slice(home.length)}` : one.path;
+    return `<li data-checkout="${e(one.path)}"><span class="name">${e(one.taskId ?? basename(one.path))}</span><span class="size">${e(bytesWords(one.bytes))}</span>` +
+        `<span class="path">${e(where)}</span>` +
+        (one.why === null ? "" : `<span class="why">${e(whyWords(one)[0].toUpperCase() + whyWords(one).slice(1))}</span>`) + discard + `</li>`;
+}
+export function storageHtml(view, notice) {
+    const { plan, csrf } = view;
+    const note = notice.problem ? `<p class="problem" role="alert">${e(notice.problem)}</p>` : notice.said ? `<p role="status">${e(notice.said)}</p>` : "";
+    const hidden = `<input type="hidden" name="csrf" value="${e(csrf)}">`;
+    const facts = [plural(plan.count, "checkout"), `${plan.waitingReview} waiting for review`, `${plan.withChanges} kept for their changes`].join(" · ");
+    const frees = plan.go.length === 0 ? "Nothing to clean up now." : `Cleaning up now frees about ${bytesWords(plan.freeBytes)}.`;
+    const remove = plan.go.length === 0 ? "" :
+        `<form method="post" action="/settings/storage/clean" class="remove">${hidden}<input type="hidden" name="preview" value="${e(previewDigest(plan))}">` +
+            `<label>Your Toolroll password<input type="password" name="password" autocomplete="current-password" required></label>` +
+            `<button type="submit">Remove ${plural(plan.go.length, "checkout")}</button></form>`;
+    const preview = `<details class="clean-up" data-clean-up${notice.problem?.startsWith("Enter your Toolroll password to clean") ? " open" : ""}><summary>Clean up</summary><div class="preview">` +
+        (plan.go.length === 0 ? `<p>Nothing to remove now.</p>` :
+            `<h3>Removes ${plural(plan.go.length, "checkout")}, about ${e(bytesWords(plan.freeBytes))}</h3><p class="meta">Their branches stay, so nothing committed is lost.</p>` +
+                `<ul class="checkouts" data-goes>${plan.go.map(one => item(one, csrf)).join("")}</ul>`) +
+        (plan.stay.length === 0 ? "" : `<h3>Stays (${plan.stay.length})</h3><ul class="checkouts" data-stays>${plan.stay.map(one => item(one, csrf)).join("")}</ul>`) +
+        remove + `</div></details>`;
+    const options = CLEANUP_CHOICES.map(one => `<option value="${one.value}"${one.value === plan.cleanup ? " selected" : ""}>${e(one.label)}</option>`).join("");
+    return `<section class="storage">${note}` +
+        `<div class="card storage-state"><h2 data-checkout-bytes="${plan.totalBytes}">Checkouts use ${e(bytesWords(plan.totalBytes))}</h2><p class="meta">${e(facts)}</p>` +
+        `<p data-clean-bytes="${plan.freeBytes}">${e(frees)}</p>${preview}</div>` +
+        `<h2>Automatic cleanup</h2>` +
+        `<form method="post" action="/settings/storage" class="setting">${hidden}` +
+        `<label>Remove a finished task's clean checkout<select name="cleanup">${options}</select></label>` +
+        `<p class="meta">Its branch always stays. Checkouts with changes, commits on no branch, in use, or waiting for review are kept.</p>` +
+        `<label>Your Toolroll password<input type="password" name="password" autocomplete="current-password" required></label><button type="submit">Save</button></form></section>`;
+}

package/dist/storage.d.ts

@@ -1,4 +1,18 @@
 import type { Store } from "./store.js";
+/** Settings → Storage: when a finished task's clean checkout is removed. One row, or none (the default). */
+export declare const CHECKOUT_CLEANUP_SCHEMA = "\nCREATE TABLE IF NOT EXISTS checkout_cleanup_setting (\n  id         INTEGER PRIMARY KEY CHECK (id = 1),\n  cleanup    TEXT NOT NULL CHECK (cleanup IN ('finished', '2d', '7d', 'never')),\n  updated_by TEXT NOT NULL,\n  updated_at TEXT NOT NULL\n);\n";
+export type CheckoutCleanup = "finished" | "2d" | "7d" | "never";
+export declare const DEFAULT_CLEANUP: CheckoutCleanup;
+export declare const CLEANUP_CHOICES: readonly {
+    value: CheckoutCleanup;
+    label: string;
+    days: number | null;
+}[];
+/** `finished` (or complete, cancelled), `2d`, `7d` (or week, 1w), `never` (or off); undefined when it's none of those. */
+export declare function parseCleanup(text: string): CheckoutCleanup | undefined;
+export declare function cleanupWords(cleanup: CheckoutCleanup): string;
+/** Bytes each path holds on disk: one `du` for them all (fast on a 300 MB checkout), a walk where it can't answer. */
+export declare function diskBytes(paths: readonly string[]): Map<string, number>;
 export type StorageLine = {
     what: string;
     bytes: number;
@@ -7,7 +21,7 @@ export type StorageLine = {
 };
 /** Bytes a tree holds on disk (allocated blocks; links not followed). */
 export declare function treeBytes(path: string): number;
-export declare function storageReport(store: Store, databaseFile: string, now: Date, keepMs: number): {
+export declare function storageReport(store: Store, databaseFile: string, checkoutNote?: string): {
     folder: string;
     total: number;
     lines: StorageLine[];

package/dist/storage.js

@@ -2,11 +2,67 @@
  * Where Toolroll's disk goes (`toolroll storage`): the folder
  * beside the database, by kind, and what storage retention takes care of.
  * Build checkouts and staged releases are the big ones; the worker removes a
- * finished task's clean checkout two days after it was let go, and a deploy
- * keeps its last few releases.
+ * finished task's clean checkout as the checkout cleanup setting says
+ * (checkout-cleanup.ts), and a deploy keeps its last few releases.
  */
+import { spawnSync } from "node:child_process";
 import { lstatSync, readdirSync } from "node:fs";
 import { basename, dirname, join } from "node:path";
+/** Settings → Storage: when a finished task's clean checkout is removed. One row, or none (the default). */
+export const CHECKOUT_CLEANUP_SCHEMA = `
+CREATE TABLE IF NOT EXISTS checkout_cleanup_setting (
+  id         INTEGER PRIMARY KEY CHECK (id = 1),
+  cleanup    TEXT NOT NULL CHECK (cleanup IN ('finished', '2d', '7d', 'never')),
+  updated_by TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);
+`;
+export const DEFAULT_CLEANUP = "finished";
+export const CLEANUP_CHOICES = [
+    { value: "finished", label: "When its task is complete or cancelled", days: 0 },
+    { value: "2d", label: "2 days after that", days: 2 },
+    { value: "7d", label: "A week after that", days: 7 },
+    { value: "never", label: "Never (only when you clean up)", days: null },
+];
+/** `finished` (or complete, cancelled), `2d`, `7d` (or week, 1w), `never` (or off); undefined when it's none of those. */
+export function parseCleanup(text) {
+    const value = text.trim().toLowerCase().replace(/\s+/g, " ");
+    if (["finished", "complete", "completed", "cancelled", "done", "0", "0d"].includes(value))
+        return "finished";
+    if (["2d", "2", "2 days", "2days"].includes(value))
+        return "2d";
+    if (["7d", "7", "7 days", "7days", "week", "a week", "1w"].includes(value))
+        return "7d";
+    if (["never", "off"].includes(value))
+        return "never";
+    return undefined;
+}
+export function cleanupWords(cleanup) {
+    return cleanup === "finished" ? "when its task is complete or cancelled"
+        : cleanup === "never" ? "never (only when you clean up)"
+            : `${cleanup === "2d" ? "2 days" : "a week"} after its task is complete or cancelled`;
+}
+/** Bytes each path holds on disk: one `du` for them all (fast on a 300 MB checkout), a walk where it can't answer. */
+export function diskBytes(paths) {
+    const sizes = new Map();
+    if (paths.length === 0)
+        return sizes;
+    if (process.platform !== "win32") {
+        for (let at = 0; at < paths.length; at += 200) {
+            const batch = paths.slice(at, at + 200);
+            const du = spawnSync("du", ["-sk", ...batch], { encoding: "utf8", maxBuffer: 16 * 1024 * 1024 });
+            for (const line of (du.stdout ?? "").split("\n")) {
+                const match = /^(\d+)\t(.+)$/.exec(line);
+                if (match !== null && batch.includes(match[2]))
+                    sizes.set(match[2], Number(match[1]) * 1024);
+            }
+        }
+    }
+    for (const path of paths)
+        if (!sizes.has(path))
+            sizes.set(path, treeBytes(path));
+    return sizes;
+}
 /** Bytes a tree holds on disk (allocated blocks; links not followed). */
 export function treeBytes(path) {
     let total = 0;
@@ -35,7 +91,7 @@ export function treeBytes(path) {
     }
     return total;
 }
-export function storageReport(store, databaseFile, now, keepMs) {
+export function storageReport(store, databaseFile, checkoutNote) {
     const folder = dirname(databaseFile);
     const base = basename(databaseFile);
     let names = [];
@@ -45,7 +101,8 @@ export function storageReport(store, databaseFile, now, keepMs) {
     catch {
         names = [];
     }
-    const sizes = new Map(names.map(name => [name, treeBytes(join(folder, name))]));
+    const measured = diskBytes(names.map(name => join(folder, name)));
+    const sizes = new Map(names.map(name => [name, measured.get(join(folder, name)) ?? 0]));
     const take = (match) => {
         let bytes = 0;
         for (const [name, size] of sizes)
@@ -56,7 +113,6 @@ export function storageReport(store, databaseFile, now, keepMs) {
         return bytes;
     };
     const checkouts = store.listWorktrees();
-    const due = checkouts.filter(row => row.releasedAt !== null && row.runner === null && now.getTime() - Date.parse(row.releasedAt) >= keepMs).length;
     let staged = 0;
     try {
         staged = readdirSync(join(folder, "staged-upgrades")).length;
@@ -66,8 +122,7 @@ export function storageReport(store, databaseFile, now, keepMs) {
     }
     const lines = [
         { what: "Database", bytes: take(name => name.startsWith(base)) },
-        { what: "Build checkouts", bytes: take(name => name === "worktrees"), count: checkouts.length,
-            note: due === 0 ? "none due for removal" : `${due} let go over ${Math.round(keepMs / 86_400_000)} days ago: removed on the next pass if their task is finished and they're clean` },
+        { what: "Build checkouts", bytes: take(name => name === "worktrees"), count: checkouts.length, ...(checkoutNote === undefined ? {} : { note: checkoutNote }) },
         { what: "Staged releases", bytes: take(name => name === "staged-upgrades"), count: staged, note: "a deploy keeps the release it installed, the one before and the newest few" },
         { what: "Evidence", bytes: take(name => name === "evidence"), note: "the audit record of every run; kept" },
         { what: "Backups", bytes: take(name => name === "backups") },

package/dist/store.d.ts

@@ -16,6 +16,7 @@ import type { LimitReading, LimitWindow } from "./provider-limits.js";
 import { underCeiling, type OrgPolicy, type SavedPolicy } from "./policy.js";
 import { type Billing, type Budget, type BudgetAgent, type BudgetHold, type BudgetScope, type BudgetState, type SpendItem } from "./spend.js";
 import { type RetentionKind, type RetentionPeriods } from "./retention.js";
+import { type CheckoutCleanup } from "./storage.js";
 import { type LedgerChainReport } from "./ledger-chain.js";
 import { type ApprovalGate, type ApprovalRules, type ApproverKind, type Filer } from "./approval-policy.js";
 export type BackupSettings = {
@@ -2645,11 +2646,6 @@ export declare class Store {
     getWorktree(path: string): WorktreeRow | null;
     /** Drop a row whose directory is gone; a lease over nothing only refuses work. */
     forgetWorktree(path: string): void;
-    /** The branches storage retention keeps a repository's checkouts of: every task not done or cancelled (a failed
-     * one included: it can be requeued), and unplaced ones (they're dispatched anywhere); and a done task whose result
-     * was marked complete (the completion names its family's root; its run names the version), or a release candidate
-     * done, within `resultMs` (a deploy installs the build in its checkout). Each task's own branch and every branch its runs used. */
-    keptBranches(repo: string, now: Date, resultMs: number): string[];
     /**
      * Approve one repo's setup, revoking any predecessor in the same
      * transaction — exactly one live setup per repo, enforced by the partial
@@ -5068,6 +5064,10 @@ export declare class Store {
     retentionPeriods(): RetentionPeriods;
     /** Set how long one kind is kept (null: forever); the ledger keeps before → after. */
     setRetentionPeriod(kind: RetentionKind, days: number | null, by: string, now: Date): RetentionPeriods;
+    /** Settings → Storage: when a finished task's clean checkout is removed (the default until someone chooses). */
+    checkoutCleanup(): CheckoutCleanup;
+    /** Choose when a finished task's clean checkout is removed; the ledger keeps before → after. */
+    setCheckoutCleanup(cleanup: CheckoutCleanup, by: string, now: Date): CheckoutCleanup;
     /** v105: keep a provider's latest reading of its plan's usage windows (a window it no longer reports is dropped). */
     recordProviderLimits(reading: LimitReading, now: Date): void;
     /** The latest reading of every provider's plan windows, shortest window first. */

package/dist/store.js

@@ -67,9 +67,10 @@ import { POLICY_SCHEMA, agentRefusal, approvalRefusal, attendedRefusal, policyPa
 import { PROVIDER_AUTH_SCHEMA } from "./provider-auth.js";
 import { SPEND_SCHEMA, billingOf, budgetStates, canPrice, claudeMachineBilling, countsToward, filersOf, monthOf, priceWork, seenBilling as seenBillingOf, spendItems, teammateFilers, usd } from "./spend.js";
 import { FOREVER, RETENTION_SCHEMA, periodWords } from "./retention.js";
+import { CHECKOUT_CLEANUP_SCHEMA, DEFAULT_CLEANUP, cleanupWords } from "./storage.js";
 import { IN_RANGE, LEDGER_CHAIN_SCHEMA, safeWhole, sealLedger, verifyLedgerChain } from "./ledger-chain.js";
 import { NO_RULES, filerFor, isProtectedWork, protectedChanges, rulesWords } from "./approval-policy.js";
-import { BRANCH_PREFIXES, configBase, envValue, namedPath } from "./names.js";
+import { configBase, envValue, namedPath } from "./names.js";
 // v60 fenced older readers before the chat action cards; v61 adds notification
 // provenance and Telegram destination receipts, and readers below v61 refuse it.
 // v62 adds the durable Telegram conversation queue and proposal-card tokens,
@@ -3695,6 +3696,7 @@ function initializeStore(db, file) {
     // The sign-in pause the dispatch gate last left this task waiting on (null: none), for the work index.
     addColumn(db, "task_ref", "auth_wait_pause", "INTEGER REFERENCES provider_auth_pause(id)");
     db.exec(RETENTION_SCHEMA);
+    db.exec(CHECKOUT_CLEANUP_SCHEMA);
     db.exec(BACKUP_SCHEMA);
     // Sprint 8: the organisation policy (one row, or none: nothing restricted).
     db.exec(POLICY_SCHEMA);
@@ -9805,21 +9807,6 @@ export class Store {
     forgetWorktree(path) {
         this.db.prepare("DELETE FROM worktree WHERE path = ?").run(path);
     }
-    /** The branches storage retention keeps a repository's checkouts of: every task not done or cancelled (a failed
-     * one included: it can be requeued), and unplaced ones (they're dispatched anywhere); and a done task whose result
-     * was marked complete (the completion names its family's root; its run names the version), or a release candidate
-     * done, within `resultMs` (a deploy installs the build in its checkout). Each task's own branch and every branch its runs used. */
-    keptBranches(repo, now, resultMs) {
-        const since = new Date(now.getTime() - resultMs).toISOString();
-        const tasks = `SELECT r.id AS ref, r.external_id AS id FROM task_ref r JOIN task t ON t.id = r.external_id LEFT JOIN task_scope s ON s.task_id = t.id
-      WHERE (r.repo = ? OR r.repo IS NULL) AND (t.state NOT IN ('done', 'cancelled') OR (t.state = 'done' AND (
-        (s.candidate IS NOT NULL AND t.updated_at >= ?) OR EXISTS (SELECT 1 FROM action_ledger l JOIN run ON run.id = l.run_id
-          WHERE run.task_ref = r.id AND l.action = 'assignment handoff checked' AND l.at >= ?))))`;
-        const own = this.db.prepare(tasks).all(repo, since, since).flatMap(row => BRANCH_PREFIXES.map(prefix => `${prefix}${String(row["id"])}`));
-        const used = this.db.prepare(`SELECT DISTINCT run.branch AS branch FROM run WHERE run.branch IS NOT NULL AND run.task_ref IN (SELECT ref FROM (${tasks}))`).all(repo, since, since)
-            .map(row => String(row["branch"]));
-        return [...new Set([...own, ...used])];
-    }
     // ---- worktree setup (M5.7) ---------------------------------------------
     /**
      * Approve one repo's setup, revoking any predecessor in the same
@@ -16243,6 +16230,21 @@ export class Store {
             return this.retentionPeriods();
         });
     }
+    /** Settings → Storage: when a finished task's clean checkout is removed (the default until someone chooses). */
+    checkoutCleanup() {
+        const row = this.db.prepare("SELECT cleanup FROM checkout_cleanup_setting WHERE id = 1").get();
+        return row === undefined ? DEFAULT_CLEANUP : String(row["cleanup"]);
+    }
+    /** Choose when a finished task's clean checkout is removed; the ledger keeps before → after. */
+    setCheckoutCleanup(cleanup, by, now) {
+        return this.transact(() => {
+            const before = this.checkoutCleanup();
+            this.db.prepare("INSERT INTO checkout_cleanup_setting (id, cleanup, updated_by, updated_at) VALUES (1, ?, ?, ?) ON CONFLICT(id) DO UPDATE SET cleanup = excluded.cleanup, updated_by = excluded.updated_by, updated_at = excluded.updated_at")
+                .run(cleanup, by, now.toISOString());
+            this.recordPolicy(by, null, "checkout cleanup changed", cleanupWords(before), cleanupWords(cleanup), now);
+            return this.checkoutCleanup();
+        });
+    }
     /** v105: keep a provider's latest reading of its plan's usage windows (a window it no longer reports is dropped). */
     recordProviderLimits(reading, now) {
         this.transact(() => {

package/dist/toolroll-update-ui.d.ts

@@ -24,6 +24,8 @@ export type UpdatesView = {
         version: string;
         notes: string[];
     } | null;
+    /** The version `toolroll update --rollback` returns to: the last completed update's, while it is what runs. */
+    rollbackTo: string | null;
     csrf: string;
 };
 /** The steps, each done, current, failed or waiting. Also the live region's fragment. */

package/dist/toolroll-update-ui.js

@@ -70,7 +70,7 @@ export function updatesHtml(view, notice) {
             `<div class="update-actions"><button type="submit" name="when" value="now" class="primary">Update now</button>` +
             `<button type="submit" name="when" value="when-idle">When idle</button><button type="submit" name="when" value="tonight">Tonight (03:00)</button></div></form>`
         : "";
-    const rollback = j?.kind === "update" && j.phase === "complete" ? `<p class="meta">To go back to ${e(j.from.version)}: <code>toolroll update --rollback</code></p>` : "";
+    const rollback = view.rollbackTo !== null ? `<p class="meta">To go back to ${e(view.rollbackTo)}: <code>toolroll update --rollback</code></p>` : "";
     return `<section class="updates">${note}${whatsNew}${j ? outcomeHtml(j) : ""}<div class="card" data-update-state="${newer ? "available" : "current"}">${state}${form}${rollback}</div></section>`;
 }
 export function newerThan(a, b) {