toolroll 0.9.3 → 0.9.5

package/dist/task-outcome-cli.js

@@ -4,9 +4,11 @@ import { assignmentOf, checkAssignmentAsOperator } from './assignment.js';
 import { assignmentForCoordinator, coordinatorToken } from './assignment-adapters.js';
 import { authenticateCoordinator } from './coordinator.js';
 import { reproveApprover } from './principal.js';
+import { authenticateApprover } from './scope.js';
 import { requestResultChanges } from './result-actions.js';
 import { commentSourceKey, revisionSourceOf } from './result-review.js';
 import { envelopeJson } from './envelope.js';
+import { completeAndOpenPullRequest, mergeAsPerson, newestPullRequestOf, publishingOf, pullRequestViewOf } from './pull-request-flow.js';
 export async function runTaskOutcomeCommand(action, positional, flags, context) {
     const command = `task ${action}`;
     const emit = (result, lines) => {
@@ -14,18 +16,21 @@ export async function runTaskOutcomeCommand(action, positional, flags, context)
         return result.ok ? 0 : result.reason === 'usage' ? 2 : 3;
     };
     const fail = (reason, message) => emit({ ok: false, reason, message });
-    const allowed = new Set(['json', 'db', 'as', 'token', 'token-env', 'token-file', ...(action === 'complete' ? ['digest'] : ['feedback', 'run', 'source', 'key'])]);
+    const allowed = new Set(['json', 'db', 'as', 'token', 'token-env', 'token-file', ...(action === 'complete' ? ['digest', 'pull-request'] : ['feedback', 'run', 'source', 'key'])]);
     for (const key of flags.keys())
         if (!allowed.has(key))
             return fail('usage', `--${key} is not a task ${action} option.`);
     const task = positional[0];
     if (positional.length !== 1 || !task || task.length > 64 || /[\x00-\x1f]/.test(task))
-        return fail('usage', `Use task ${action} <task>${action === 'complete' ? ' --digest <receipt>' : ' --feedback "requested change"'}.`);
+        return fail('usage', `Use task ${action} <task>${action === 'complete' ? ' --digest <receipt> [--pull-request]' : ' --feedback "requested change"'}.`);
+    const pullRequest = flags.has('pull-request');
     const credential = coordinatorToken(flags, process.env);
     if ('ok' in credential)
         return emit(credential);
     if (credential.token !== null && (flags.has('as') || flags.has('token')))
         return fail('usage', 'Choose a scoped credential or your operator sign-in.');
+    if (credential.token !== null && pullRequest)
+        return fail('unauthenticated', 'Opening a pull request is an approver\'s act. Use your operator sign-in (--as and --token), not a scoped credential.');
     const operator = credential.token === null ? await context.operator() : null;
     if (credential.token === null && operator === null)
         return fail('unauthenticated', 'Sign in with up, or supply --as and --token. Agents can use --token-file or --token-env with a scoped credential.');
@@ -49,6 +54,28 @@ export async function runTaskOutcomeCommand(action, positional, flags, context)
             const digest = typeof supplied === 'string' ? supplied : current.receipt?.digest;
             if (!digest)
                 return fail('not-ready', 'This task has no finished result to mark complete.');
+            if (pullRequest) {
+                // The console's "Complete and open a pull request": the same exact-receipt completion and owed PR, one transaction.
+                const repo = store.lookupRef(current.activeTaskId)?.repo ?? null;
+                const publishing = publishingOf(store, repo);
+                if (!publishing.on)
+                    return fail('pull-requests-off', `Pull requests aren't set up for this project. Turn them on with: toolroll publish setup --repo ${repo ?? '<path>'} --yes`);
+                if (publishing.legacy)
+                    return fail('pull-requests-off', 'This project opens a pull request for every build. Complete without --pull-request.');
+                const runId = current.receipt?.runId;
+                if (runId === undefined)
+                    return fail('not-ready', 'This task has no finished result to mark complete.');
+                const opened = completeAndOpenPullRequest(store, { taskId: task, digest, runId, who: operator, root: evidenceRoot }, now);
+                if (!opened.ok)
+                    return emit(opened);
+                const link = opened.publication.prUrl;
+                return emit({ ok: true, result: assignmentOf(store, task, now, { principal: 'operator', repos }, evidenceRoot), pullRequest: pullRequestViewOf(store, runId) }, [
+                    `${current.rootId} · Complete`,
+                    `Result: ${current.activeTaskId} · run ${runId} · ${opened.publication.headSha}`,
+                    link === null ? `Pull request: opening from ${opened.publication.headSha.slice(0, 12)} into ${publishing.githubRepo} ${publishing.base}. toolroll task show ${current.rootId} prints its link.` : `Pull request: ${link}`,
+                    `Next: CI is watched on GitHub. Merge when green: toolroll task merge ${current.rootId}`,
+                ]);
+            }
             const changed = credential.token !== null
                 ? assignmentForCoordinator(store, credential.token, 'check', { ref: task, digest }, now, evidenceRoot)
                 : checkAssignmentAsOperator(store, task, digest, operator, now, evidenceRoot);
@@ -90,3 +117,49 @@ export async function runTaskOutcomeCommand(action, positional, flags, context)
         return emit({ ok: true, result: { id: revised.id, rootId: current.rootId, sourceRun: run.id, source, key, approved, planning } }, [`${current.rootId} · Revision created`, `Execution: ${revised.id}`, approved ? 'Covered by your existing operating mode.' : planning ? 'Updating the plan with your notes; approve it when it is ready.' : 'The revision is waiting for approval.']);
     });
 }
+/** `task merge <task>`: the console's Merge — the newest pull request any version of the task opened through
+ * Complete, merged behind the approver's password once a fresh read shows its checks passing. */
+export async function runTaskMergeCommand(positional, flags, context) {
+    const command = 'task merge';
+    const emit = (result, lines) => {
+        context.write(context.json ? envelopeJson({ ...result, command }) : result.ok ? (lines ?? []).join('\n') : result.message ?? 'The merge was refused.');
+        return result.ok ? 0 : result.reason === 'usage' ? 2 : 3;
+    };
+    const fail = (reason, message) => emit({ ok: false, reason, message });
+    const allowed = new Set(['json', 'db', 'as', 'token']);
+    for (const key of flags.keys())
+        if (!allowed.has(key))
+            return fail('usage', `--${key} is not a task merge option.`);
+    const task = positional[0];
+    if (positional.length !== 1 || !task || task.length > 64 || /[\x00-\x1f]/.test(task))
+        return fail('usage', 'Use task merge <task> --as <you> --token <password>.');
+    if (context.demo)
+        return fail('demo', 'The demo merges nothing.');
+    const acting = await context.credentials();
+    if (acting === null)
+        return fail('unauthenticated', 'Merging takes your password: --as <you> --token <password>.');
+    const { store } = context;
+    if (!authenticateApprover(store, acting.name, acting.token).ok)
+        return fail('not-an-approver', 'That password didn\'t work, or you can\'t merge.');
+    const family = store.taskFamilyOf(task, store.knownRepos().filter(repo => store.accountCanAccess(acting.name, repo)), false);
+    if (family === null)
+        return fail('not-found', 'That task is unavailable in your projects.');
+    const view = newestPullRequestOf(store, family.versions.map(one => one.id));
+    if (view === null)
+        return fail('no-pr', 'This task has no pull request. Open one with task complete --pull-request.');
+    const merged = await mergeAsPerson(store, { runId: view.runId, name: acting.name, password: acting.token, ...(context.exec === undefined ? {} : { exec: context.exec }), clock: context.clock });
+    if (!merged.ok)
+        return emit({ ...merged, reason: merged.reason === 'password' ? 'not-an-approver' : merged.reason, pullRequest: view });
+    const after = newestPullRequestOf(store, family.versions.map(one => one.id));
+    return emit({ ok: true, pullRequest: after }, [
+        `${family.root.id} · Merged`,
+        `Pull request: ${after?.prUrl ?? view.prUrl ?? `#${view.prNumber}`}`,
+        `Merge commit: ${merged.commit ?? 'recorded by GitHub'} (${after?.mergeMethod ?? view.mergeMethod}, branch deleted)`,
+    ]);
+}
+/** The lines `task show` prints for a task's pull request. */
+export function pullRequestLines(view) {
+    if (view === null)
+        return [];
+    return [`  pull request: ${view.prUrl ?? 'opening'} · ${view.label}`, `    ${view.detail}`, ...(view.mergeCommit === null ? [] : [`    merge commit: ${view.mergeCommit}`])];
+}

package/dist/workspace-ui.js

@@ -187,7 +187,7 @@ function storedResultStatusOf(result, publication) {
             label: "Result saved, but its record does not match",
             // A structural refutation is settled before the approved check is
             // weighed, so it says nothing about whether that check passed.
-            detail: withPublication("The proof's claims disagree with the sealed record. Whether the approved check passed is not settled by this verdict."),
+            detail: withPublication("What the agent reported doesn't match the changes it saved. This doesn't say whether the project check passed."),
             tone: "problem",
             action: { label: "Open the record", kind: "open-review" },
         };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolroll",
-  "version": "0.9.3",
+  "version": "0.9.5",
   "description": "A control plane for unattended coding agents — queue tasks, walk away, come back to pull requests. Agents build in leased worktrees, never touch your default branch, and interrupt you only for decisions that need a human.",
   "directories": {
     "doc": "docs"