toolroll 0.9.102 → 0.9.104

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 0.9.104 — 2026-11-12
+
+- **Accept, plan and retry from the terminal, without a password.** On your own computer (laptop mode), pressing `c` on a Ready result opens "Accept this result?": the summary, the changed files, each requirement and the real check status. You answer "Did you check it yourself?", give a reason for an exception, or just say yes. The answer is tied to the result you read; if it changed meanwhile, you're shown the new one. A bigger first task now asks for its plan straight away, and `p` asks for one; you still approve the plan before anything is built. After a crash or a model error, `r` retries your own approved build, up to 3 times per approval, with the same plan, agent and limits. Merging, releasing, hands-off modes and settings still need your password; API tokens, the lead and chat bots can't do any of this.
+- **Password-free mode is tighter.** The password-free session now has to come from this computer on every request, not only when it starts. It can no longer accept release, protected or coordinator results, or open pull requests; those need your password.
+- **The release page says why it couldn't read what changed.** "What changed couldn't be read" now gives the reason, and a slow machine no longer drops the list after 15 seconds.
+- **No security warning on first start.** discord.js is updated to 14.28.1, so `npx toolroll` no longer opens with npm's deprecation warning.
+- **Docs match the app.** The getting-started guide, CONTRIBUTING and the README describe the terminal's first run as it is (`b` sends back, `r` retries), and Ready is described as showing the check status.
+
+## 0.9.103 — 2026-11-11
+
+- **Home shows releases, flow decisions and setup.** Home's list gains three groups. **Approve a release** lists releases waiting for your yes and releases whose publishing is held for you; the button opens the release page, where the approval happens. **Flow decisions** lists flow cards that wait on you (to decide, choose, answer a question, allow the browser, or move on after no reply); the button opens the card on its flow page. **Finish setting up** lists first-run steps you have not done yet, each with its own button. The top line now reads like "3 tasks and 2 other things need you"; the Tasks count in the menu stays a task count.
+- **A release can only be approved under the release rules.** Before, approving a release from the plain task page, from Home or with `toolroll task approve` skipped some of the release page's checks. Now every approval road refuses a release for the same reasons the release page does: CI failed, the release check failed on this commit, the terms changed after an earlier approval, or the task was put away.
+
 ## 0.9.102 — 2026-11-11
 
 - **Pages change in place.** Moving between Home, Tasks, a task page, Projects, Agents, Search and Settings no longer reloads the whole page. The menu stays put and the page changes with a short cross-fade: going deeper slides in, going back slides out (off when your system asks for reduced motion). Resting the pointer on a link reads its page ahead, so the click shows it at once. Back and Forward change the page the same way and return you to the spot you left. The link you pressed is marked, and a thin loading line shows when a page is slow.

package/README.md

@@ -8,7 +8,7 @@
 ### Your agents build. You decide.
 
 For Claude Code, Codex and Gemini, on your own machine.<br>
-Approve the exact scope once. Get results back Ready with the diff, the passing check and screenshots.
+Approve the exact scope once. Get results back Ready with the diff, the check status and screenshots.
 
 [![npm](https://img.shields.io/npm/v/toolroll?color=171717)](https://www.npmjs.com/package/toolroll)
 [![CI](https://github.com/ap9000/toolroll/actions/workflows/ci.yml/badge.svg)](https://github.com/ap9000/toolroll/actions/workflows/ci.yml)
@@ -44,11 +44,12 @@ toolroll
 ```
 
 Toolroll opens in your terminal and runs while that window is open. No
-password and no login file: on your own computer you're already in. Pick an
-agent, a project (or the sample one) and a first task; approve the plan, and
-the result comes back **Ready**. Press `w` for the browser, or run
-`toolroll --web`. To look around first, `toolroll demo` opens a seeded
-sandbox with no model calls and no spend.
+password and no login file: on your own computer you're already in. Started
+in a git repository, that repository is your project; press `n` for a first
+task, approve the plan, and the result comes back **Ready**. Elsewhere, add a
+project with `toolroll repos add <folder>`, or open the browser (press `w`, or
+run `toolroll --web`), which also offers a sample project. To look around
+first, `toolroll demo` opens a seeded sandbox with no model calls and no spend.
 
 **Letting agents work on their own.** Approving work you start on this
 computer needs no password. Hands-off modes, merging, releasing and most
@@ -100,8 +101,9 @@ the CLI or MCP. Every act lands in one ledger.
 
 - **You approve scope once.** The approval binds to the exact goal, bounds,
   criteria, agent and model. No model sits in any approval path.
-- **Evidence, not trust.** Ready means the check ran on that commit. A failed
-  check stays failed.
+- **Evidence, not trust.** Ready shows the result and its check status;
+  merging needs the project's required check to pass on that exact result. A
+  failed check stays failed.
 - **Your machine, your logins.** Agents use the Claude and Codex subscriptions
   you already have. An OS-level fence keeps them away from Toolroll's secrets.
 - **Any agent.** Claude Code, Codex, Gemini and OpenRouter, routed per phase.

package/dist/assignment.d.ts

@@ -315,4 +315,36 @@ export declare function assignmentUpdates(store: Store, now: Date, access: Assig
     nextCursor: number;
     hasMore: boolean;
 };
+/** What a machine caller hears when the result owes a person's own check. */
+export declare const MACHINE_CANT_CHECK = "Only a person can say they checked this result. Open it in Toolroll and accept it there.";
+/** The terminal's accept, as the ledger keeps it: the exact request (run and receipt as read) and the receipt it made. */
+export declare const LOCAL_ACCEPT_ACTION = "task complete (local owner)";
+/** What the terminal's accept answers: done (or done already, by this same request), or why not. */
+export type LocalAcceptance = {
+    ok: true;
+    replayed: boolean;
+    accepted: "person-check" | "exception" | null;
+    assignment: AssignmentSnapshot;
+} | {
+    ok: false;
+    reason: string;
+    message: string;
+};
+/**
+ * The terminal's Accept (local-owner plan §3, slice 1): the laptop's local owner, with no password, accepts the exact
+ * result its screen read (`runId` and `receiptDigest`, pinned when the screen opened) and completes it, in one
+ * transaction. Never a password check: the owner is the one in flight now, acting as exactly `complete-task`, still
+ * standing (local mode on at its generation, the account at its generation), and the approver is minted from that,
+ * then re-proved by `acceptAndCompleteAsOperator`, which keeps every rule a completion has (exact receipt and run,
+ * project access, slice 0's work rule, failed-check and protected-work blockers, rollback of the acceptance if the
+ * completion is refused). What is owed decides what the request must carry: a person's own check needs `checked`, an
+ * exception needs `reason` (already trimmed and validated by the command). The request and the receipt it produced are
+ * recorded; the same request again answers "already" after re-proving the owner, and writes nothing.
+ */
+export declare function completeAsLocalOwner(store: Store, taskId: string, input: {
+    runId: number;
+    receiptDigest: string;
+    checked: boolean;
+    reason: string | null;
+}, now: Date, root?: string): LocalAcceptance;
 export {};

package/dist/assignment.js

@@ -8,12 +8,13 @@ import { replacedWords } from "./task-status.js";
 import { COMPLETER_ACTOR, COMPLETION_ACTION, COMPLETION_BY_MACHINE, COMPLETION_BY_PERSON, familyChangedFiles, landedReasonOf, personCompletionOwed } from "./result-completion.js";
 import { homedir } from "node:os";
 import { readSchemaVersion, refArchived, stopFactOf } from "./store.js";
-import { approvalOf, liveReleaseOf, machineActing } from "./scope.js";
+import { approvalOf, liveReleaseOf, localWorkEligible, machineActing } from "./scope.js";
+import { LOCAL_OWNER_LAPSED, currentLocalOwner, localActNow, localOwnerInFlight, localOwnerRefusal, localOwnerStandsNow } from "./local-owner.js";
 import { openWorkDecisionOf, taskWorkSummaryOf, workDecisionAction } from "./work-summary.js";
 import { evidenceRoot, readVerifiedArtifact, readVerifiedReport, verifyArtifact } from "./evidence.js";
 import { sweepIfMoved } from "./sweep-gate.js";
 import { verificationEvidence } from "./verification-evidence.js";
-import { reproveApprover } from "./principal.js";
+import { reproveApprover, verifyApproverStanding } from "./principal.js";
 import { noteAssignmentStatus } from "./assignment-status.js";
 import { historicalAssessmentReason } from "./assignment-presentation.js";
 import { manualReviewOnly, shownVerdictOf } from "./proof.js";
@@ -493,6 +494,11 @@ function acknowledgeCurrent(store, current, receiptDigest, actor, now, root, acc
     const release = liveReleaseOf(store, current.receipt.taskId, "complete", now);
     if (release.applies && !release.ok)
         return { ok: false, reason: "release", message: `This release can't be completed: ${release.why}.` };
+    // A laptop's local owner (no password) completes ordinary work only: its exact act, still standing, and the one work
+    // rule (scope.ts localWorkEligible), read here in the completion's own transaction, on every road that completes.
+    const local = localCompletionRefusal(store, actor, [receipt.taskId, current.rootId], receipt.runId, root);
+    if (local !== null)
+        return local;
     // Who is completing, from trusted context (approval policy §1.7a): a person, or a machine credential (the lead's
     // token, a remote API run) that may complete ordinary work but is never the second person on protected work.
     const person = actor.startsWith("operator:") && !machineActing() ? actor.slice("operator:".length) : null;
@@ -592,7 +598,9 @@ export function owedAcceptance(receipt, blockers = []) {
  * request passes its own). */
 export function acceptAndCompleteAsOperator(store, taskId, input, who, now, root = evidenceRoot(homedir()), finish = digest => checkAssignmentAsOperator(store, taskId, digest, who, now, root)) {
     try {
-        return withActor(currentActor() ?? { account: who.name, lead: false }, () => store.transact(() => {
+        // A savepoint inside the transaction: a refused completion takes its acceptance back with it even when a caller's
+        // own transaction holds this one (the terminal's local accept, a chat tap), not only when this one is outermost.
+        return withActor(currentActor() ?? { account: who.name, lead: false }, () => store.transact(() => store.savepoint(() => {
             if (!reproveApprover(store, who).ok)
                 return { ok: false, reason: "unauthenticated", message: "Sign in again before accepting this result." };
             const access = { principal: "operator", repos: who.repos };
@@ -603,11 +611,19 @@ export function acceptAndCompleteAsOperator(store, taskId, input, who, now, root
             if (receipt === null || (input.runId !== null && receipt.runId !== input.runId) || !/^[a-f0-9]{64}$/.test(input.receiptDigest) || receipt.digest !== input.receiptDigest) {
                 return { ok: false, reason: "stale", message: "This result changed. Open the current result before accepting it." };
             }
+            // A local owner's acceptance: the same rule as its completion, before any acceptance is written.
+            const local = localCompletionRefusal(store, `operator:${who.name}`, [receipt.taskId, taskId, before.rootId], receipt.runId, root);
+            if (local !== null)
+                return local;
             // Already complete, or nothing owed: the plain completion of the receipt as read.
             const owed = before.state === "ready-to-check" ? owedAcceptance(receipt, before.readiness?.blockers ?? []) : null;
             // An exception is accepted only with its reason: never a completion that skips it.
             if (owed === "exception" && input.note === null)
                 return { ok: false, reason: "needs-reason", message: `${ACCEPT_NEEDS_REASON}.` };
+            // A person's own check is a person's, whoever holds the approver: never the lead's token or a remote API token in
+            // this chain (local-owner plan v2, item 4), whatever the caller decided before calling.
+            if (owed === "person-check" && machineActing())
+                return { ok: false, reason: "person-required", message: MACHINE_CANT_CHECK };
             let digest = receipt.digest;
             if (owed !== null) {
                 store.acceptProof(receipt.runId, who.name, input.note, now);
@@ -621,7 +637,7 @@ export function acceptAndCompleteAsOperator(store, taskId, input, who, now, root
             if (!done.ok)
                 throw new Undone(done);
             return done;
-        }));
+        })));
     }
     catch (error) {
         if (error instanceof Undone)
@@ -687,3 +703,123 @@ export function assignmentUpdates(store, now, access, query, root) {
 }
 /** The waits of a build Toolroll is still proving stopped by itself (needs-you.ts processNeedOf). */
 const STOP_WAITS = new Set(["build-finishing", "build-checking", "build-stopping"]);
+/**
+ * Local-owner slice 0 (docs/plans/local-owner-acts.md): when a laptop's local owner (no password) is the one completing
+ * or accepting, the refusal it hears, or null (anyone else, or an ordinary result it may complete). The owner must be
+ * in flight, still standing, acting as exactly `complete-task`, completing as itself; and every task named (the result's
+ * own and its family's root) must pass the shared work rule — no release, no protected work (declared or actually
+ * changed), nothing a coordinator filed. Read inside the completion's transaction.
+ */
+function localCompletionRefusal(store, actor, taskIds, runId, root) {
+    const local = currentLocalOwner();
+    if (local === null)
+        return null;
+    if (!localOwnerInFlight(local) || !localOwnerStandsNow(store, local))
+        return { ok: false, reason: "local-owner", message: LOCAL_OWNER_LAPSED };
+    const instead = localOwnerRefusal(store.accountOf(local.account)?.passwordSet === true, "/");
+    const then = instead.action === "Set a password" ? "Set a password first: run `toolroll password set`." : instead.message;
+    if (local.act !== "complete-task" || actor !== `operator:${local.account}`)
+        return { ok: false, reason: "local-owner", message: `This needs your password. ${then}` };
+    // An earlier build in the family whose inventory is missing, and that its record doesn't prove committed nothing, is
+    // unknown here, and unknown counts as protected (localWorkEligible).
+    const changed = familyChangedFiles(store, taskIds[0], runId, root, { missing: "unknown" });
+    for (const taskId of new Set(taskIds)) {
+        const eligible = localWorkEligible(store, local.account, taskId, { act: "complete", changed });
+        if (!eligible.ok)
+            return { ok: false, reason: "local-owner", message: `${eligible.message} ${then}` };
+    }
+    return null;
+}
+// ---- Local owner, slice 1 (docs/plans/local-owner-acts.md §3): accept a result in the terminal. Kept last.
+/** What a machine caller hears when the result owes a person's own check. */
+export const MACHINE_CANT_CHECK = "Only a person can say they checked this result. Open it in Toolroll and accept it there.";
+/** The terminal's accept, as the ledger keeps it: the exact request (run and receipt as read) and the receipt it made. */
+export const LOCAL_ACCEPT_ACTION = "task complete (local owner)";
+const LOCAL_STALE = { ok: false, reason: "stale", message: "This result changed. Look at the new one before accepting it." };
+/** This owner's earlier terminal accept of exactly this run and receipt, from its ledger binding; null when none. */
+function localAcceptanceOf(store, rootId, account, runId, digest, request) {
+    const rows = store.handle.prepare("SELECT outcome, detail FROM action_ledger WHERE action = ? AND task_id = ? AND actor = ? AND run_id = ? ORDER BY id DESC")
+        .all(LOCAL_ACCEPT_ACTION, rootId, `operator:${account}`, runId);
+    for (const row of rows) {
+        let detail;
+        try {
+            detail = JSON.parse(String(row["detail"] ?? ""));
+        }
+        catch {
+            continue;
+        }
+        const bound = detail;
+        if (bound.v !== 1 || bound.digest !== digest || typeof bound.completed !== "string")
+            continue;
+        const outcome = String(row["outcome"]);
+        // A replay is the whole request again (Codex review 3, finding 2): the same pins, the same "I checked it", the same
+        // reason. Anything else about an accepted result is a different request, never reported as saved.
+        const same = bound.checked === request.checked && (bound.reason ?? null) === request.reason;
+        return { completed: bound.completed, accepted: outcome === "person-check" || outcome === "exception" ? outcome : null, same };
+    }
+    return null;
+}
+/**
+ * The terminal's Accept (local-owner plan §3, slice 1): the laptop's local owner, with no password, accepts the exact
+ * result its screen read (`runId` and `receiptDigest`, pinned when the screen opened) and completes it, in one
+ * transaction. Never a password check: the owner is the one in flight now, acting as exactly `complete-task`, still
+ * standing (local mode on at its generation, the account at its generation), and the approver is minted from that,
+ * then re-proved by `acceptAndCompleteAsOperator`, which keeps every rule a completion has (exact receipt and run,
+ * project access, slice 0's work rule, failed-check and protected-work blockers, rollback of the acceptance if the
+ * completion is refused). What is owed decides what the request must carry: a person's own check needs `checked`, an
+ * exception needs `reason` (already trimmed and validated by the command). The request and the receipt it produced are
+ * recorded; the same request again answers "already" after re-proving the owner, and writes nothing.
+ */
+export function completeAsLocalOwner(store, taskId, input, now, root = evidenceRoot(homedir())) {
+    try {
+        return store.transact(() => {
+            const local = localActNow(store, "complete-task");
+            if (local === null)
+                return { ok: false, reason: "local-owner", message: LOCAL_OWNER_LAPSED };
+            const standing = verifyApproverStanding(store, local.account, local.accountGeneration, store.knownRepos().filter(repo => store.accountCanAccess(local.account, repo)));
+            if (!standing.ok)
+                return { ok: false, reason: "local-owner", message: LOCAL_OWNER_LAPSED };
+            const who = standing.who;
+            const access = { principal: "operator", repos: who.repos };
+            const before = assignmentOf(store, taskId, now, access, root);
+            if (before === null || !store.accountCanAccess(who.name, before.repo))
+                return { ok: false, reason: "not-found", message: "That task is unavailable in your projects." };
+            // The same request again: recognised from its binding and the receipt it produced, with the owner proved above.
+            const bound = localAcceptanceOf(store, before.rootId, who.name, input.runId, input.receiptDigest, { checked: input.checked, reason: input.reason });
+            if (bound !== null && !bound.same)
+                return { ok: false, reason: "already-complete", message: "This result is already accepted." };
+            if (bound !== null) {
+                return before.state === "complete" && before.receipt?.runId === input.runId && before.receipt.digest === bound.completed
+                    ? { ok: true, replayed: true, accepted: bound.accepted, assignment: before } : LOCAL_STALE;
+            }
+            const receipt = before.receipt;
+            if (receipt === null || receipt.runId !== input.runId || receipt.digest !== input.receiptDigest)
+                return LOCAL_STALE;
+            if (before.state === "complete")
+                return { ok: false, reason: "already-complete", message: "This result is already accepted." };
+            const owed = before.state === "ready-to-check" ? owedAcceptance(receipt, before.readiness?.blockers ?? []) : null;
+            if (owed === "person-check" && !input.checked)
+                return { ok: false, reason: "needs-check", message: "This result needs your own check. Look at it, then say you checked it." };
+            if (owed === "exception" && input.reason === null)
+                return { ok: false, reason: "needs-reason", message: `${ACCEPT_NEEDS_REASON}.` };
+            const done = acceptAndCompleteAsOperator(store, taskId, { runId: input.runId, receiptDigest: input.receiptDigest, note: owed === null ? null : input.reason }, who, now, root);
+            if (!done.ok)
+                throw new Undone(done);
+            const after = assignmentOf(store, taskId, now, access, root);
+            if (after === null || after.state !== "complete" || after.receipt?.runId !== input.runId)
+                throw new Undone(LOCAL_STALE);
+            store.recordAction({ at: now.toISOString(), actor: `operator:${who.name}`, repo: after.repo, taskId: after.rootId, runId: input.runId, action: LOCAL_ACCEPT_ACTION,
+                outcome: owed ?? "completed", source: "request",
+                detail: JSON.stringify({ v: 1, digest: input.receiptDigest, completed: after.receipt.digest, checked: input.checked, reason: input.reason, via: local.transport }) });
+            return { ok: true, replayed: false, accepted: owed, assignment: after };
+        });
+    }
+    catch (error) {
+        if (error instanceof Undone)
+            return error.result;
+        // Store.transact's own re-check found the bound owner no longer standing: the same refusal, said, never a crash.
+        if (error instanceof Error && error.message === LOCAL_OWNER_LAPSED)
+            return { ok: false, reason: "local-owner", message: LOCAL_OWNER_LAPSED };
+        throw error;
+    }
+}