toolroll 0.9.54 → 0.9.55

package/dist/browser-shell.d.ts

@@ -1,8 +1,9 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import { type BrowserWorkspace } from './browser-workspace.js';
+import { type Html } from './html.js';
 export declare function browserAssetsAvailable(): boolean;
 export declare function serveBrowserAsset(request: IncomingMessage, response: ServerResponse, path: string): boolean;
 /** Retain the complete native document as the no-JavaScript/unloaded-bundle
  * fallback. React replaces its root only once the local module has loaded.
  * The data script is escaped for HTML parsing, not merely valid JSON. */
-export declare function browserWorkspaceDocument(html: string, workspace: BrowserWorkspace, nonce: string, functionalScript: string): string;
+export declare function browserWorkspaceDocument(document: Html, workspace: BrowserWorkspace, nonce: string, functionalScript: string): Html;

package/dist/browser-shell.js

@@ -1,7 +1,8 @@
 /** The browser bundle is a presentation client. Only these fixed public assets
  * are readable here; authenticated data stays in the existing page handlers. */
 import { readFileSync } from 'node:fs';
-import { serializeBrowserWorkspace } from './browser-workspace.js';
+import {} from './browser-workspace.js';
+import { html, jsonScript, replaceMarkup, scriptElement } from './html.js';
 const assets = new Map();
 function readAsset(name) {
     // Compiled installation first; the second location supports source-based
@@ -47,16 +48,15 @@ export function serveBrowserAsset(request, response, path) {
 /** Retain the complete native document as the no-JavaScript/unloaded-bundle
  * fallback. React replaces its root only once the local module has loaded.
  * The data script is escaped for HTML parsing, not merely valid JSON. */
-export function browserWorkspaceDocument(html, workspace, nonce, functionalScript) {
+export function browserWorkspaceDocument(document, workspace, nonce, functionalScript) {
     const initialize = `window.addEventListener('standing-orders:workspace-rendered',function initializeWorkspace(){window.removeEventListener('standing-orders:workspace-rendered',initializeWorkspace);${functionalScript}});`;
     // A cross-page fade the browser gives up on rejects its promises; settle them from the head, before the
     // first frame (the app's own listener arrives too late when a page is revealed before the bundle runs).
     const settleFades = `(function(){function s(e){var f=e.viewTransition;if(f)[f.finished,f.ready,f.updateCallbackDone].forEach(function(p){if(p)p.catch(function(){})})}addEventListener('pageswap',s);addEventListener('pagereveal',s)})();`;
-    return html
-        // A page showing a password keeps to its one script (the sensitivity contract), so it goes without.
-        // Replacer functions, never strings: a `$\`` or `$'` in the page's data (an issue title, a TODO) would
-        // otherwise paste part of the page into the data block and close it early.
-        .replace('</head>', () => `<link rel="stylesheet" href="/assets/workspace.css">${workspace.sensitive ? "" : `<script nonce="${nonce}">${settleFades}</script>`}</head>`)
-        .replace('<body>', () => '<body><div id="standing-orders-workspace">')
-        .replace('</body>', () => `</div><script type="application/json" id="standing-orders-workspace-data" nonce="${nonce}">${serializeBrowserWorkspace(workspace)}</script><script nonce="${nonce}">${initialize}</script><script type="module" src="/assets/workspace.js" nonce="${nonce}"></script></body>`);
+    // Each insertion is markup built here; the page's own markup (and its data) is never re-read as a pattern.
+    let out = replaceMarkup(document, /<\/head>/, () => 
+    // A page showing a password keeps to its one script (the sensitivity contract), so it goes without.
+    html `<link rel="stylesheet" href="/assets/workspace.css">${workspace.sensitive ? "" : scriptElement(settleFades, { nonce })}</head>`);
+    out = replaceMarkup(out, /<body>/, () => html `<body><div id="standing-orders-workspace">`);
+    return replaceMarkup(out, /<\/body>/, () => html `</div>${jsonScript(workspace, { id: "standing-orders-workspace-data", nonce })}${scriptElement(initialize, { nonce })}<script type="module" src="/assets/workspace.js" nonce="${nonce}"></script></body>`);
 }

package/dist/browser-workspace.d.ts

@@ -430,9 +430,9 @@ export type BrowserTaskView = {
     } | null;
     /** What the agent did last on the live run, and when; the page words it against its own clock (activity-line.ts). */
     activity?: RunActivity | null;
-    /** The task's live stream (/t/<id>/live): change nudges and who else has it open. Absent: the page reads on its beat. */
+    /** The task's live room (GET /live?room=task:<root>): change nudges and who else has it open. */
     live?: {
-        href: string;
+        room: string;
         at: string | null;
     } | null;
     /** Stop, on the Building card: the exact live build's stop form (posts its run id). */
@@ -1276,7 +1276,6 @@ export type BrowserSignIn = {
 };
 /** Safe inside a script[type=application/json] element. JSON escaping alone
  * does not stop the HTML parser from closing that element at </script>. */
-export declare function serializeBrowserWorkspace(workspace: BrowserWorkspace): string;
 export declare const BROWSER_CREW_LIMIT = 40;
 export type BrowserCrewOptions = {
     evidenceRoot?: string;

package/dist/browser-workspace.js

@@ -9,9 +9,6 @@ export function needsYouLabelOf(count, projectName, saturated = false) {
 }
 /** Safe inside a script[type=application/json] element. JSON escaping alone
  * does not stop the HTML parser from closing that element at </script>. */
-export function serializeBrowserWorkspace(workspace) {
-    return JSON.stringify(workspace).replace(/</g, '\\u003c').replace(/\u2028/g, '\\u2028').replace(/\u2029/g, '\\u2029');
-}
 export const BROWSER_CREW_LIMIT = 40;
 /** A bounded recent family list. The caller supplies its already admitted
  * access; an optional project can only narrow it. Admission and family grouping

package/dist/chat-polish.d.ts

@@ -1,16 +1,17 @@
+import { type Html } from './html.js';
 import type { ChatSnapshot } from './store.js';
 /** Presentation only. These are recorded completions, not a claim that
  * work happened since the user last visited, or that every result passed. */
 export declare function completedWorkHtml(snapshot: ChatSnapshot, projectLabels: readonly string[], assignments?: Readonly<Record<string, {
     state: string;
-}>>): string;
+}>>): Html;
 /** Keep activity truthful: the turn's recorded step count is not a
  * percentage or an invented tool phase. Billing detail stays available. */
 export declare function chatWorkingHtml(input: {
     details: string;
-    stopForm?: string;
+    stopForm?: Html;
     keyed?: boolean;
-}): string;
+}): Html;
 /** Recorded activity is inspectable, not a row of performance badges. */
-export declare function chatActivityDetailsHtml(activity: string | null): string;
+export declare function chatActivityDetailsHtml(activity: string | null): Html;
 export declare const CHAT_POLISH_CSS = "\n  /* Quiet workspace surfaces: color signals state, not an AI aesthetic. */\n  body { background: var(--background); }\n  .chat-workspace .chat-overview, .chat-workspace .chat-plan, .chat-workspace .result-panel,\n  .chat-workspace .decide-card { background: var(--card); box-shadow: none; }\n  .chat-workspace .result-panel { border-radius: .75rem; }\n  .chat-workspace .chat-empty::before { content: none; }\n  .chat-workspace .thread .msg.mate::before { background: var(--muted); box-shadow: none; border: 0; }\n  .chat-workspace .thread .msg.op { box-shadow: none; border: 0; }\n  .chat-workspace .completion-receipt { background: var(--card); box-shadow: none; }\n  .chat-workspace .completion-receipt::after { content: none; }\n  .chat-workspace .thread { min-height: 0; }\n  .chat-workspace .chat-turn-history { margin: 1rem 0; border: 0; border-top: 1px solid var(--border); border-radius: 0; background: transparent; box-shadow: none; padding: 0; }\n  .chat-turn-history > summary { display: flex; align-items: center; gap: .75rem; min-height: 44px; cursor: pointer; font-size: .875rem; }\n  .chat-turn-history > summary .meta { margin-left: auto; }\n  .chat-turn-history .row { display: flex; flex-wrap: wrap; gap: .4rem; }\n  .chat-turn-history .row .right { float: none; margin-left: auto; }\n  .chat-workspace .task-live-summary { margin-bottom: .75rem; padding-bottom: .25rem; }\n  .chat-workspace .task-journey > details, .chat-workspace .result-feedback-history,\n  .chat-workspace .chat-limits, .chat-workspace .task-chat-agents {\n    border: 0; border-radius: 0; background: transparent; box-shadow: none; padding: 0; margin: .25rem 0;\n  }\n  .chat-workspace .task-chat-agents > summary { min-height: 44px; cursor: pointer; font-size: .8125rem; color: var(--muted-foreground); }\n  .chat-workspace .task-chat-agents p { margin: 0 0 .5rem; }\n  .chat-workspace .decide-options .decide-option { border: 0; border-top: 1px solid var(--border); border-radius: 0; background: transparent; padding: .75rem 0; }\n  .chat-workspace .chat-plan { padding: 1rem; margin-top: .5rem; }\n  .chat-workspace .result-knowledge { margin-bottom: .5rem; }\n  .chat-workspace .result-panel [data-result-view] > details { margin-block: 0; padding-block: 0; }\n  .chat-workspace .result-panel [data-result-view] > details > summary { min-height: 44px; display: flex; align-items: center; }\n  .chat-workspace .result-feedback-history > summary { min-height: 44px; }\n  .chat-activity-details { border: 0; background: transparent; box-shadow: none; border-radius: 0; padding: 0; margin: 0; }\n  .chat-activity-details > summary { min-height: 44px; display: flex; align-items: center; gap: .4rem; cursor: pointer; color: var(--muted-foreground); font-size: .75rem; }\n  .chat-activity-details > summary::after { content: '\u2304'; }\n  .chat-activity-details[open] > summary::after { transform: rotate(180deg); }\n  .chat-activity-details .chat-activity { gap: .25rem .75rem; }\n  .chat-activity-details .chat-activity span { border: 0; padding: 0; border-radius: 0; font: inherit; font-size: .75rem; }\n  .chat-workspace .chat-message-foot { justify-content: flex-start; align-items: baseline; margin-top: .25rem; }\n  .chat-activity-row { border: 0; background: transparent; box-shadow: none; padding: .5rem 0; min-height: 44px; gap: .65rem; }\n  .chat-activity-row details { flex: 1; min-width: 0; border: 0; background: transparent; padding: 0; margin: 0; box-shadow: none; }\n  .chat-activity-row summary { min-height: 44px; display: flex; align-items: center; cursor: pointer; width: fit-content; font-size: .875rem; font-weight: 550; }\n  .chat-activity-row summary::after { content: '\u2304'; margin-left: .65rem; color: var(--muted-foreground); }\n  .chat-activity-row details[open] summary::after { transform: rotate(180deg); }\n  .chat-activity-row .meta { padding-bottom: .5rem; overflow-wrap: anywhere; }\n  .activity-dot { width: 6px; height: 6px; border-radius: 50%; background: currentColor; flex: none; }\n  .task-live-summary { border-bottom: 1px solid var(--border); margin-bottom: 1rem; padding-bottom: .5rem; }\n  .task-live-summary .task-journey, .task-live-summary .task-control { border: 0; border-radius: 0; box-shadow: none; background: transparent; margin: 0; padding: .65rem 0; }\n  .task-live-summary .task-journey h2 { font-size: 1rem; }\n  .task-live-summary .agents-strip { margin: .4rem 0; }\n  .chat-decisions .chat-section-head { margin-bottom: .5rem; }\n  .chat-decisions h2 { font-size: .875rem; font-weight: 550; color: var(--muted-foreground); }\n  .decision-context summary { cursor: pointer; min-height: 44px; display: flex; align-items: center; font-size: .8125rem; color: var(--muted-foreground); }\n  .decision-context { border: 0; padding: 0; margin: 0; background: transparent; box-shadow: none; }\n  .decide-options { display: grid; gap: .5rem; }\n  .decide-options .decide-option { margin: 0; padding: .65rem .75rem; border: 1px solid var(--border); border-radius: .75rem; background: var(--background); }\n  .decide-options .decide-option .meta { display: block; margin-top: .3rem; overflow-wrap: anywhere; }\n  .decide-options .decide-option button { min-height: 44px; max-width: 100%; white-space: normal; text-align: left; }\n  .chat-completed { margin-top: 1rem; }\n  .chat-completed h3 { font-size: .8125rem; font-weight: 550; margin: 0 0 .25rem; color: var(--muted-foreground); }\n  .chat-completed-action { flex: none; font-size: .75rem; white-space: nowrap; color: var(--muted-foreground); }\n  .chat-overview .chat-overview-stat { box-shadow: none; border: 0; background: transparent; border-radius: 0; }\n  .chat-overview .chat-overview-stat + .chat-overview-stat { border-left: 1px solid var(--border); }\n  .result-panel .result-request { border-top: 1px solid var(--border); padding-top: 1rem; }\n  .result-panel .result-head h2 { color: var(--foreground); }\n  .result-panel .result-request h3 { color: var(--foreground); font-size: .875rem; text-transform: none; letter-spacing: 0; }\n  .result-panel .result-feedback-actions { display: flex; justify-content: flex-end; align-items: center; flex-wrap: wrap; gap: .5rem; }\n  .result-panel .result-feedback-actions > [data-request-changes] { order: 2; background: var(--foreground); color: var(--background); border-color: var(--foreground); box-shadow: none; }\n  .result-panel .result-feedback-actions > button { width: auto; min-height: 44px; white-space: nowrap; }\n  .result-panel .result-feedback-actions > .quiet { background: transparent; border-color: transparent; box-shadow: none; }\n  .result-panel .result-feedback-actions > button:disabled { opacity: .45; cursor: default; }\n  .result-panel .result-feedback-link { display: inline-flex; align-items: center; min-height: 44px; font-size: .8125rem; text-underline-offset: 3px; }\n  .result-panel .result-pin > summary, .result-panel .result-notes > summary, .result-panel .result-details > summary { min-height: 44px; }\n  .result-panel .diff-comment-form textarea { min-height: 80px; margin: 0; font-size: 1rem; }\n  .result-panel .result-attention { background: transparent; border: 0; border-radius: 0; box-shadow: none; padding: 0; margin: .75rem 0; color: var(--foreground); }\n  .result-panel .result-attention ul { margin: 0; padding-left: 1.15rem; }\n  .result-panel .result-attention ul:has(> li:only-child) { list-style: none; padding-left: 0; }\n  .result-panel .result-knowledge { border: 0; border-top: 1px solid var(--border); background: transparent; box-shadow: none; border-radius: 0; padding: .25rem 0; }\n  .result-panel .revision-from-comments { border: 0; background: transparent; box-shadow: none; padding: .5rem 0; }\n  .result-panel .result-pin summary { font-size: .8125rem; min-height: 44px; display: flex; align-items: center; cursor: pointer; }\n  .result-panel .diff-comment-limit { font-size: .75rem; }\n  .chat-main .chat-plan { box-shadow: none; }\n  .proposal-review-notes { margin: .5rem 0; padding-left: 1.15rem; overflow-wrap: anywhere; }\n  .proposal-review-notes li + li { margin-top: .5rem; }\n  .proposal-actions .button-link, .proposal-actions button { min-height: 44px; white-space: nowrap; }\n  .chat-stop-confirm > summary { min-height: 44px; display: flex; align-items: center; cursor: pointer; }\n  .task-chat-title-line h1, .task-main-title, .resume-target, .resume-ceremony, .proposal-task_action, .chat-stop-confirm { overflow-wrap: anywhere; }\n  .chat-main .chat-task-back { display: none; }\n  .knowledge-library .knowledge-intro { padding: .5rem 0 1.25rem; margin-bottom: 1.5rem; border-bottom: 1px solid var(--border); }\n  .knowledge-library .knowledge-instructions { line-height: 1.65; margin-bottom: .5rem; }\n  .knowledge-library .knowledge-editor summary { width: fit-content; font-size: .875rem; font-weight: 550; }\n  .knowledge-library .knowledge-editor, .knowledge-library > details { border: 0; border-bottom: 1px solid var(--border); border-radius: 0; box-shadow: none; background: transparent; padding: 0; }\n  .knowledge-library .knowledge-editor { border-bottom: 0; }\n  .knowledge-library .card { border: 0; border-bottom: 1px solid var(--border); border-radius: 0; padding: 0 0 .5rem; margin: 0; box-shadow: none; background: transparent; }\n  .knowledge-library .card[open] { padding-bottom: 1rem; }\n  .knowledge-library .card > summary { padding: .85rem 0; }\n  @media (prefers-reduced-motion: no-preference) {\n    .chat-activity-row .activity-dot { animation: quiet-activity 1.8s ease-in-out infinite; }\n    .chat-completed .chat-overview-item { transition: background-color 140ms ease; }\n    @keyframes quiet-activity { 50% { opacity: .35; } }\n  }\n  @media (max-width: 600px) {\n    .chat-workspace .result-panel { background: transparent; border-radius: 0; }\n    .chat-completed .chat-overview-item { align-items: flex-start; flex-wrap: wrap; gap: .35rem; }\n    .chat-completed .chat-overview-copy { flex-basis: 65%; }\n    .task-live-summary .task-journey { gap: .5rem; }\n  }\n";

package/dist/chat-polish.js

@@ -1,4 +1,4 @@
-const escape = (value) => value.replace(/[&<>"']/g, char => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[char]));
+import { html } from './html.js';
 /** Presentation only. These are recorded completions, not a claim that
  * work happened since the user last visited, or that every result passed. */
 export function completedWorkHtml(snapshot, projectLabels, assignments) {
@@ -7,23 +7,22 @@ export function completedWorkHtml(snapshot, projectLabels, assignments) {
         && !task.historyProblem && !task.otherActive?.length
         && task.dispatch?.condition !== 'waiting' : assignments[task.id]?.state === 'complete').slice(0, 3);
     if (!completed.length)
-        return '';
-    return `<section class="chat-completed" aria-label="Completed work"><h3>Completed work</h3>` + completed.map(task => {
-        return `<a class="chat-overview-item" href="/t/${encodeURIComponent(task.rootId ?? task.id)}"><span class="chat-overview-copy"><strong>${escape(task.title)}</strong><span>${escape(projectLabels[task.repoIndex] ?? `Project ${task.repoIndex + 1}`)}</span></span><span class="chat-completed-action">Open task <span aria-hidden="true">→</span></span></a>`;
-    }).join('') + '</section>';
+        return html ``;
+    return html `<section class="chat-completed" aria-label="Completed work"><h3>Completed work</h3>${completed.map(task => {
+        return html `<a class="chat-overview-item" href="/t/${encodeURIComponent(task.rootId ?? task.id)}"><span class="chat-overview-copy"><strong>${task.title}</strong><span>${projectLabels[task.repoIndex] ?? `Project ${task.repoIndex + 1}`}</span></span><span class="chat-completed-action">Open task <span aria-hidden="true">→</span></span></a>`;
+    })}</section>`;
 }
 /** Keep activity truthful: the turn's recorded step count is not a
  * percentage or an invented tool phase. Billing detail stays available. */
 export function chatWorkingHtml(input) {
-    return `<div class="chat-thinking chat-activity-row" id="latest" role="status"${input.keyed ? ' data-key="pending"' : ''}>` +
-        `<span class="activity-dot" aria-hidden="true"></span><details><summary>Working<span class="activity-ellipsis" aria-hidden="true">…</span></summary><p class="meta">${escape(input.details)}</p></details>` +
-        (input.stopForm ?? '') + '</div>';
+    const activity = html `<span class="activity-dot" aria-hidden="true"></span><details><summary>Working<span class="activity-ellipsis" aria-hidden="true">…</span></summary><p class="meta">${input.details}</p></details>`;
+    return html `<div class="chat-thinking chat-activity-row" id="latest" role="status"${input.keyed ? html ` data-key="pending"` : ''}>${activity}${input.stopForm}</div>`;
 }
 /** Recorded activity is inspectable, not a row of performance badges. */
 export function chatActivityDetailsHtml(activity) {
     if (!activity)
-        return '';
-    return `<details class="chat-activity-details"><summary>Activity</summary><div class="chat-activity" aria-label="work performed">${activity.split(' · ').map(one => `<span>${escape(one)}</span>`).join('')}</div></details>`;
+        return html ``;
+    return html `<details class="chat-activity-details"><summary>Activity</summary><div class="chat-activity" aria-label="work performed">${activity.split(' · ').map(one => html `<span>${one}</span>`)}</div></details>`;
 }
 // Local primitives adapted from the researched interaction patterns. No
 // imported kit, animation runtime, simulated progress, or changed authority.

package/dist/check-levels-ui.d.ts

@@ -2,6 +2,7 @@
  * words. One choice (Quick, Full, Off) and the quick command beside the full
  * one. Every change takes the password and lands in the ledger; approving a
  * command restates exactly what will run, unattended, before the yes. */
+import { type Html } from "./html.js";
 import { type CheckLevel } from "./check-levels.js";
 import type { VerifyCommand } from "./store.js";
 export type CheckSettingsView = {
@@ -26,5 +27,5 @@ export type CheckSettingsView = {
     said: string | null;
     problem: string | null;
 };
-export declare function checkSettingsHtml(view: CheckSettingsView): string;
+export declare function checkSettingsHtml(view: CheckSettingsView): Html;
 export declare const CHECK_SETTINGS_CSS = "\n  .check-settings { display: grid; gap: .6rem; max-width: 40rem; }\n  .check-settings p, .check-settings h2 { margin: 0; }\n  .check-settings h2 { font-size: 1rem; }\n  .check-settings fieldset { border: 0; margin: 0; padding: 0; display: grid; gap: .25rem; }\n  .check-settings legend { font-weight: 600; margin-bottom: .25rem; }\n  .check-settings label { display: grid; gap: .25rem; }\n  .check-settings .check-choice { display: flex; align-items: flex-start; gap: .6rem; min-height: 44px; padding: .35rem 0; cursor: pointer; }\n  .check-settings .check-choice > span { display: grid; gap: .1rem; }\n  .check-settings .check-choice input { margin-top: .2rem; }\n  .check-settings input[type=password], .check-settings input[type=number], .check-settings textarea { min-height: 44px; box-sizing: border-box; width: 100%; }\n  .check-settings button { min-height: 44px; justify-self: start; }\n  .check-settings .check-command { overflow-wrap: anywhere; }\n  .check-terms { margin: 0; padding-left: 1.1rem; display: grid; gap: .25rem; }\n  @media (max-width: 480px) { .check-settings button { justify-self: stretch; } }\n  .follow-ups .follow-up-list { margin: .4rem 0; padding-left: 1.1rem; display: grid; gap: .25rem; }\n  .follow-ups .follow-up-acts, .follow-ups .follow-up-act { display: flex; flex-wrap: wrap; gap: .5rem; margin: .5rem 0 0; }\n  .follow-ups .follow-up-act { margin: 0; }\n  .follow-ups button { min-height: 44px; }\n  @media (max-width: 480px) { .follow-ups .follow-up-acts, .follow-ups .follow-up-act { display: grid; } .follow-ups .follow-up-act button { width: 100%; } }\n";

package/dist/check-levels-ui.js

@@ -2,51 +2,33 @@
  * words. One choice (Quick, Full, Off) and the quick command beside the full
  * one. Every change takes the password and lands in the ledger; approving a
  * command restates exactly what will run, unattended, before the yes. */
+import { html, postForm } from "./html.js";
 import { CHECK_LEVELS, CHECK_LEVEL_HINTS, CHECK_LEVEL_WORDS } from "./check-levels.js";
 import { BATCH_HINT } from "./batch-policy.js";
-const escape = (text) => text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 export function checkSettingsHtml(view) {
-    const hidden = (act) => `<input type="hidden" name="csrf" value="${escape(view.csrf)}"><input type="hidden" name="repo" value="${escape(view.repo)}"><input type="hidden" name="act" value="${act}">`;
-    const password = `<label>Password<input type="password" name="password" autocomplete="current-password" required></label>`;
+    const post = (act, body, attrs) => postForm("/settings/checks", body, { attrs, hidden: { repo: view.repo, act } });
+    const password = html `<label>Password<input type="password" name="password" autocomplete="current-password" required></label>`;
     const notes = [
-        view.said === null ? "" : `<p class="notice" role="status">${escape(view.said)}</p>`,
-        view.problem === null ? "" : `<p class="problem" role="alert">${escape(view.problem)}</p>`,
-    ].join("");
-    const head = `<p class="meta">${escape(view.name)} · <span class="mono">${escape(view.repo)}</span></p>${notes}`;
-    const command = (one) => `<p class="mono check-command">${escape(one.command)}</p><p class="meta">Up to ${Math.round(one.timeoutMs / 1000)}s · approved by ${escape(one.approvedBy)}</p>`;
+        view.said === null ? "" : html `<p class="notice" role="status">${view.said}</p>`,
+        view.problem === null ? "" : html `<p class="problem" role="alert">${view.problem}</p>`,
+    ];
+    const head = html `<p class="meta">${view.name} · <span class="mono">${view.repo}</span></p>${notes}`;
+    const command = (one) => html `<p class="mono check-command">${one.command}</p><p class="meta">Up to ${Math.round(one.timeoutMs / 1000)}s · approved by ${one.approvedBy}</p>`;
     // Quick with no quick command runs the full check; say so where the choice is made.
     const fallsBack = view.level === "quick" && view.quick === null;
-    const current = `<p><strong>${CHECK_LEVEL_WORDS[view.level]}</strong> · ${escape(CHECK_LEVEL_HINTS[view.level])}</p>` +
-        (fallsBack ? `<p class="meta">No quick command yet, so builds run the full check.</p>` : "") +
-        (view.level !== "full" && view.full !== null ? `<p class="meta">The full check still runs when a pull request opens, and Merge waits for it.</p>` : "");
+    const current = html `<p><strong>${CHECK_LEVEL_WORDS[view.level]}</strong> · ${CHECK_LEVEL_HINTS[view.level]}</p>${fallsBack ? html `<p class="meta">No quick command yet, so builds run the full check.</p>` : ""}${view.level !== "full" && view.full !== null ? html `<p class="meta">The full check still runs when a pull request opens, and Merge waits for it.</p>` : ""}`;
     if (!view.canChange) {
-        return head + `<section class="card check-settings">${current}</section>` + batchHtml(view, "") + reviewHtml(view, "") +
-            `<section class="card check-settings"><h2>Quick check</h2>${view.quick === null ? `<p class="meta">None yet.</p>` : command(view.quick)}</section>` +
-            `<section class="card check-settings"><h2>Full check</h2>${view.full === null ? `<p class="meta">None yet.</p>` : command(view.full)}</section>`;
+        return html `${head}<section class="card check-settings">${current}</section>${batchHtml(view, null)}${reviewHtml(view, null)}<section class="card check-settings"><h2>Quick check</h2>${view.quick === null ? html `<p class="meta">None yet.</p>` : command(view.quick)}</section><section class="card check-settings"><h2>Full check</h2>${view.full === null ? html `<p class="meta">None yet.</p>` : command(view.full)}</section>`;
     }
-    const choices = CHECK_LEVELS.map(level => `<label class="check-choice"><input type="radio" name="level" value="${level}"${level === view.level ? " checked" : ""}>` +
-        `<span><strong>${CHECK_LEVEL_WORDS[level]}</strong><span class="meta">${escape(CHECK_LEVEL_HINTS[level])}</span></span></label>`).join("");
-    const levelForm = `<form method="post" action="/settings/checks" class="card check-settings">${hidden("level")}` +
-        `<fieldset><legend>After each build</legend>${choices}</fieldset>` +
-        (fallsBack ? `<p class="meta">No quick command yet, so Quick runs the full check.</p>` : "") +
-        `<p class="meta">A task can choose its own checks when it's filed. With Quick or Off, the full check runs when a pull request opens, and Merge waits for it unless you merge anyway.</p>` +
-        `${password}<button type="submit">Save</button></form>`;
-    const quickTerms = `<ul class="check-terms"><li>Runs unattended right after every Quick build, in that build's checkout.</li><li>Plain environment: no credentials.</li><li>A failure shows on the result; nothing is blocked.</li></ul>`;
-    const quickForm = (value, submit) => `<form method="post" action="/settings/checks" class="check-settings">${hidden("quick")}` +
-        `<label>Command<textarea name="command" rows="2" maxlength="2000" spellcheck="false" class="mono" required>${escape(value)}</textarea></label>` +
-        `<label>Time limit (seconds)<input type="number" name="timeout" min="1" max="3600" value="${view.quick === null ? 180 : Math.round(view.quick.timeoutMs / 1000)}" required></label>` +
-        `${quickTerms}${password}<button type="submit">${submit}</button></form>`;
+    const choices = CHECK_LEVELS.map(level => html `<label class="check-choice"><input type="radio" name="level" value="${level}"${level === view.level ? html ` checked` : ""}><span><strong>${CHECK_LEVEL_WORDS[level]}</strong><span class="meta">${CHECK_LEVEL_HINTS[level]}</span></span></label>`);
+    const levelForm = post("level", html `<fieldset><legend>After each build</legend>${choices}</fieldset>${fallsBack ? html `<p class="meta">No quick command yet, so Quick runs the full check.</p>` : ""}<p class="meta">A task can choose its own checks when it's filed. With Quick or Off, the full check runs when a pull request opens, and Merge waits for it unless you merge anyway.</p>${password}<button type="submit">Save</button>`, { class: "card check-settings" });
+    const quickTerms = html `<ul class="check-terms"><li>Runs unattended right after every Quick build, in that build's checkout.</li><li>Plain environment: no credentials.</li><li>A failure shows on the result; nothing is blocked.</li></ul>`;
+    const quickForm = (value, submit) => post("quick", html `<label>Command<textarea name="command" rows="2" maxlength="2000" spellcheck="false" class="mono" required>${value}</textarea></label><label>Time limit (seconds)<input type="number" name="timeout" min="1" max="3600" value="${view.quick === null ? 180 : Math.round(view.quick.timeoutMs / 1000)}" required></label>${quickTerms}${password}<button type="submit">${submit}</button>`, { class: "check-settings" });
     const quick = view.quick === null
-        ? `<section class="card check-settings"><h2>Quick check</h2>` +
-            (view.suggestion === null ? `<p class="meta">Typecheck and the tests near the change, ideally under 2 minutes.</p>` : `<p class="meta">Suggested from the project's scripts. Edit it before approving.</p>`) +
-            quickForm(view.suggestion ?? "", "Approve quick check") + `</section>`
-        : `<section class="card check-settings"><h2>Quick check</h2>${command(view.quick)}` +
-            `<details class="settings-more"><summary>Change quick check</summary>${quickForm(view.quick.command, "Approve change")}</details>` +
-            `<details class="settings-more"><summary>Remove quick check</summary><form method="post" action="/settings/checks" class="check-settings">${hidden("quick-clear")}` +
-            `<p class="meta">Quick builds run the full check instead.</p>${password}<button type="submit" class="danger">Remove</button></form></details></section>`;
-    const full = `<details class="settings-more"><summary>Full check</summary><section class="card check-settings">` +
-        (view.full === null ? `<p class="meta">None yet. Approve one with <span class="mono">toolroll verify set --repo … --command "…"</span>.</p>` : command(view.full)) + `</section></details>`;
-    return head + levelForm + batchHtml(view, password) + reviewHtml(view, password) + quick + full;
+        ? html `<section class="card check-settings"><h2>Quick check</h2>${view.suggestion === null ? html `<p class="meta">Typecheck and the tests near the change, ideally under 2 minutes.</p>` : html `<p class="meta">Suggested from the project's scripts. Edit it before approving.</p>`}${quickForm(view.suggestion ?? "", "Approve quick check")}</section>`
+        : html `<section class="card check-settings"><h2>Quick check</h2>${command(view.quick)}<details class="settings-more"><summary>Change quick check</summary>${quickForm(view.quick.command, "Approve change")}</details><details class="settings-more"><summary>Remove quick check</summary>${post("quick-clear", html `<p class="meta">Quick builds run the full check instead.</p>${password}<button type="submit" class="danger">Remove</button>`, { class: "check-settings" })}</details></section>`;
+    const full = html `<details class="settings-more"><summary>Full check</summary><section class="card check-settings">${view.full === null ? html `<p class="meta">None yet. Approve one with <span class="mono">toolroll verify set --repo … --command "…"</span>.</p>` : command(view.full)}</section></details>`;
+    return html `${head}${levelForm}${batchHtml(view, password)}${reviewHtml(view, password)}${quick}${full}`;
 }
 /** Batch checks: one state and one sentence; turning it on restates exactly what happens, behind a disclosure with the password. */
 function batchHtml(view, password) {
@@ -54,17 +36,11 @@ function batchHtml(view, password) {
     if (batch === undefined)
         return "";
     const act = batch.on ? "Turn off" : "Turn on";
-    const terms = batch.on ? `<p class="meta">Each result runs its own full check again. Results already waiting are checked now.</p>`
-        : `<ul class="check-terms"><li>When results finish within 10 minutes of each other, they're merged in a temporary checkout and the full check runs once.</li>` +
-            `<li>If it fails, the batch is split until the result that breaks it is found. Results that conflict are checked on their own.</li>` +
-            `<li>Nothing is merged into a real branch. Each result still lands on its own.</li></ul>`;
-    const change = password === "" ? ""
-        : `<details class="settings-more"><summary>${act}</summary><form method="post" action="/settings/checks" class="check-settings">` +
-            `<input type="hidden" name="csrf" value="${escape(view.csrf)}"><input type="hidden" name="repo" value="${escape(view.repo)}"><input type="hidden" name="act" value="batch">` +
-            `<input type="hidden" name="on" value="${batch.on ? "0" : "1"}">${terms}${password}<button type="submit">${act}</button></form></details>`;
-    return `<section class="card check-settings" data-batch-checks="${batch.on ? "on" : "off"}"><h2>Batch checks</h2>` +
-        `<p><strong>${batch.on ? "On" : "Off"}</strong> · ${escape(BATCH_HINT)}</p>` +
-        (batch.on && view.level !== "full" ? `<p class="meta">Only Full checks are batched.</p>` : "") + `${change}</section>`;
+    const terms = batch.on ? html `<p class="meta">Each result runs its own full check again. Results already waiting are checked now.</p>`
+        : html `<ul class="check-terms"><li>When results finish within 10 minutes of each other, they're merged in a temporary checkout and the full check runs once.</li><li>If it fails, the batch is split until the result that breaks it is found. Results that conflict are checked on their own.</li><li>Nothing is merged into a real branch. Each result still lands on its own.</li></ul>`;
+    const change = password === null ? ""
+        : html `<details class="settings-more"><summary>${act}</summary>${postForm("/settings/checks", html `${terms}${password}<button type="submit">${act}</button>`, { attrs: { class: "check-settings" }, hidden: { repo: view.repo, act: "batch", on: batch.on ? "0" : "1" } })}</details>`;
+    return html `<section class="card check-settings" data-batch-checks="${batch.on ? "on" : "off"}"><h2>Batch checks</h2><p><strong>${batch.on ? "On" : "Off"}</strong> · ${BATCH_HINT}</p>${batch.on && view.level !== "full" ? html `<p class="meta">Only Full checks are batched.</p>` : ""}${change}</section>`;
 }
 /** Automatic review: one state, one sentence, and its one change behind a disclosure (the password). */
 function reviewHtml(view, password) {
@@ -73,12 +49,9 @@ function reviewHtml(view, password) {
         return "";
     const state = review.on ? (review.source === "hands-off" ? "On while hands-off lasts" : "On") : "Off";
     const act = review.on ? "Turn off" : "Turn on";
-    const change = password === "" ? ""
-        : `<details class="settings-more"><summary>${act}</summary><form method="post" action="/settings/checks" class="check-settings">` +
-            `<input type="hidden" name="csrf" value="${escape(view.csrf)}"><input type="hidden" name="repo" value="${escape(view.repo)}"><input type="hidden" name="act" value="review">` +
-            `<input type="hidden" name="on" value="${review.on ? "0" : "1"}">${password}<button type="submit">${act}</button></form></details>`;
-    return `<section class="card check-settings" data-review-switch="${review.on ? "on" : "off"}"><h2>Automatic review</h2>` +
-        `<p><strong>${state}</strong> · One read-only review after each build passes its checks. Only high findings send it back, once.</p>${change}</section>`;
+    const change = password === null ? ""
+        : html `<details class="settings-more"><summary>${act}</summary>${postForm("/settings/checks", html `${password}<button type="submit">${act}</button>`, { attrs: { class: "check-settings" }, hidden: { repo: view.repo, act: "review", on: review.on ? "0" : "1" } })}</details>`;
+    return html `<section class="card check-settings" data-review-switch="${review.on ? "on" : "off"}"><h2>Automatic review</h2><p><strong>${state}</strong> · One read-only review after each build passes its checks. Only high findings send it back, once.</p>${change}</section>`;
 }
 export const CHECK_SETTINGS_CSS = `
   .check-settings { display: grid; gap: .6rem; max-width: 40rem; }

package/dist/cli.d.ts

@@ -15,6 +15,7 @@ import { type SessionCliOptions } from "./session-cli.js";
 import { type TeamCliOptions } from "./team-cli.js";
 import { type RemoteExecOptions } from "./remote-exec.js";
 import { type UpdateCliDeps } from "./toolroll-update-cli.js";
+import { type ReleaseCliDeps } from "./release-cli.js";
 import { type OperateOptions } from "./operate.js";
 export type CliOptions = {
     roots: string[];
@@ -40,7 +41,7 @@ export type ParseResult = {
     error: string;
 };
 type Write = (line: string) => void;
-export declare const HELP = "toolroll \u2014 a control plane for unattended coding agents\n\nUsage\n  toolroll [path...]        report what is in flight\n  toolroll pulls            report what is waiting on a person\n  toolroll graph            report which work graph is already here\n  toolroll repos            list connected repositories, and how to adjust\n  toolroll repos add <path> add a project; it is in the console at once (no path: the repo you are in)\n  toolroll repos remove <path>\n                                   take it out of the console; its tasks and results stay\n  toolroll repos add-from-github <owner/name> --root <dir>\n                                   preview, then clone and connect (--yes)\n  toolroll link             put `toolroll` on your PATH\n  toolroll unlink           take it off again\n  toolroll update           update to the latest release: verified, drained, undoable\n                                   (preview first; --yes, --now, --at HH:MM, --rollback)\n  toolroll contract         the machine contract: envelope version + capabilities\n                                   (--commands dumps the declared command guide)\n  toolroll skills install --claude-code [--dir <path>]\n                                   install this binary's guides for Claude Code (preview first)\n  toolroll skills install   teach a repo's agents this queue exists (preview first)\n  toolroll skills list      the guides this exact binary serves\n  toolroll skills get <name>  print one guide (version-matched, never stale)\n  toolroll demo             a seeded throwaway sandbox \u2014 see it working in 90 seconds\n  toolroll up               app + builder for every saved project \u2014 the normal start\n  toolroll onboard          make your agent Toolroll's lead: add this repo, install its skill (--yes), offer starter flows (--starter)\n  toolroll status           running, queued, ready results, release check and plan windows\n  toolroll health           recent server latency, write waits and live streams\n  toolroll integrations     which integrations work, and what to do about the ones that don't (--json)\n  toolroll session          native coding sessions through the running service\n  toolroll connect          save a private connection to your central service\n  toolroll lead             named leads on the connected service\n  toolroll lead token       mint your lead agent's credential: its own work pings nobody\n  toolroll lead say \"<text>\"  (the lead) one short message in its person's chat\n  toolroll conversation     shared and private conversations on that service\n  toolroll chat --lead <id> --conversation <id>  central chat (use --local for local chat)\n\nOperating the queue \u2014 `toolroll task` prints the whole surface,\nand any queue command + --help prints it too\n  toolroll approver add <name>\n                               mint the credential that lets a person say yes\n  toolroll ready            what could be dispatched right now\n  toolroll check-progress <run>  current or final approved check progress\n  toolroll task wait <id> [--timeout <seconds>]\n                               wait for this attempt to finish or need a person\n  toolroll task add <title> queue work\n  toolroll task scope <id> --goal <text>\n                               state what success is; approval binds to it\n  toolroll task approve <id>\n                               the yes \u2014 nothing builds without one\n  toolroll claim <id> --runner <name>\n  toolroll heartbeat <lease> / release <lease> / reap\n  toolroll tick --runner <name> --token <t> --repo <path>\n                               one unattended pass over the ready set\n  toolroll flows list | show <id> | create | edit | trigger | script | card | archive\n                               set up and inspect flows (writes preview until --yes)\n  toolroll chat --as <you> --token <t>\n                               talk to the mate: one conversation across every\n                               project; it proposes, you confirm (--say \"\u2026\" for one turn)\n  toolroll serve --repo <path>  advanced: run only the console\n                               (--editor vscode with --runner: file links\n                               open in VS Code on the device you browse from)\n  toolroll watch / daemon install   advanced: run only the builder\n  toolroll reconcile        recover what the last stretch left behind\n\nWith nothing connected it reports everything it can find below the working\ndirectory. Once you connect repositories it reports those instead.\n\nOptions\n  --all         report everything discoverable, ignoring connected repos\n  --depth <n>   directory levels to descend (default: 6)\n  --hidden      include dot-directories, which are skipped by default\n  --dirty       also read each working tree for uncommitted files\n  --local       branches only: no network, no pull requests, no issues\n  --json        emit a machine-readable envelope instead of a report\n  -o <file>     also write that envelope to a file (requires --json)\n  -h, --help    show this\n\nNothing is written, installed, or configured. Every repository is read\nthrough git with --no-optional-locks, so a scan never contends for the\nindex lock with an editor you have open.\n\n--dirty is off by default because reading a working tree is unbounded\nwork: on a large or cloud-synced repo `git status` can take minutes,\nwhere listing branches takes milliseconds.\n\nlink shows what it would do and changes nothing; add --yes to apply it,\nor --to <dir> to choose where. It never uses sudo, never leaves your\nhome directory, and never touches a file it did not create.";
+export declare const HELP = "toolroll \u2014 a control plane for unattended coding agents\n\nUsage\n  toolroll [path...]        report what is in flight\n  toolroll pulls            report what is waiting on a person\n  toolroll graph            report which work graph is already here\n  toolroll repos            list connected repositories, and how to adjust\n  toolroll repos add <path> add a project; it is in the console at once (no path: the repo you are in)\n  toolroll repos remove <path>\n                                   take it out of the console; its tasks and results stay\n  toolroll repos add-from-github <owner/name> --root <dir>\n                                   preview, then clone and connect (--yes)\n  toolroll link             put `toolroll` on your PATH\n  toolroll unlink           take it off again\n  toolroll update           update to the latest release: verified, drained, undoable\n                                   (preview first; --yes, --now, --at HH:MM, --rollback)\n  toolroll release <branch> release Toolroll itself: gate, your approval, deploy, merge, tag, publish\n                                   (resumable: rerun to continue; --help)\n  toolroll contract         the machine contract: envelope version + capabilities\n                                   (--commands dumps the declared command guide)\n  toolroll skills install --claude-code [--dir <path>]\n                                   install this binary's guides for Claude Code (preview first)\n  toolroll skills install   teach a repo's agents this queue exists (preview first)\n  toolroll skills list      the guides this exact binary serves\n  toolroll skills get <name>  print one guide (version-matched, never stale)\n  toolroll demo             a seeded throwaway sandbox \u2014 see it working in 90 seconds\n  toolroll up               app + builder for every saved project \u2014 the normal start\n  toolroll onboard          make your agent Toolroll's lead: add this repo, install its skill (--yes), offer starter flows (--starter)\n  toolroll status           running, queued, ready results, release check and plan windows\n  toolroll health           recent server latency, write waits and live streams\n  toolroll integrations     which integrations work, and what to do about the ones that don't (--json)\n  toolroll session          native coding sessions through the running service\n  toolroll connect          save a private connection to your central service\n  toolroll lead             named leads on the connected service\n  toolroll lead token       mint your lead agent's credential: its own work pings nobody\n  toolroll lead say \"<text>\"  (the lead) one short message in its person's chat\n  toolroll conversation     shared and private conversations on that service\n  toolroll chat --lead <id> --conversation <id>  central chat (use --local for local chat)\n\nOperating the queue \u2014 `toolroll task` prints the whole surface,\nand any queue command + --help prints it too\n  toolroll approver add <name>\n                               mint the credential that lets a person say yes\n  toolroll ready            what could be dispatched right now\n  toolroll check-progress <run>  current or final approved check progress\n  toolroll task wait <id> [--timeout <seconds>]\n                               wait for this attempt to finish or need a person\n  toolroll task add <title> queue work\n  toolroll task scope <id> --goal <text>\n                               state what success is; approval binds to it\n  toolroll task approve <id>\n                               the yes \u2014 nothing builds without one\n  toolroll claim <id> --runner <name>\n  toolroll heartbeat <lease> / worker release <lease> / reap\n  toolroll tick --runner <name> --token <t> --repo <path>\n                               one unattended pass over the ready set\n  toolroll flows list | show <id> | create | edit | trigger | script | card | archive\n                               set up and inspect flows (writes preview until --yes)\n  toolroll chat --as <you> --token <t>\n                               talk to the mate: one conversation across every\n                               project; it proposes, you confirm (--say \"\u2026\" for one turn)\n  toolroll serve --repo <path>  advanced: run only the console\n                               (--editor vscode with --runner: file links\n                               open in VS Code on the device you browse from)\n  toolroll watch / daemon install   advanced: run only the builder\n  toolroll reconcile        recover what the last stretch left behind\n\nWith nothing connected it reports everything it can find below the working\ndirectory. Once you connect repositories it reports those instead.\n\nOptions\n  --all         report everything discoverable, ignoring connected repos\n  --depth <n>   directory levels to descend (default: 6)\n  --hidden      include dot-directories, which are skipped by default\n  --dirty       also read each working tree for uncommitted files\n  --local       branches only: no network, no pull requests, no issues\n  --json        emit a machine-readable envelope instead of a report\n  -o <file>     also write that envelope to a file (requires --json)\n  -h, --help    show this\n\nNothing is written, installed, or configured. Every repository is read\nthrough git with --no-optional-locks, so a scan never contends for the\nindex lock with an editor you have open.\n\n--dirty is off by default because reading a working tree is unbounded\nwork: on a large or cloud-synced repo `git status` can take minutes,\nwhere listing branches takes milliseconds.\n\nlink shows what it would do and changes nothing; add --yes to apply it,\nor --to <dir> to choose where. It never uses sudo, never leaves your\nhome directory, and never touches a file it did not create.";
 export declare function parseArgs(argv: readonly string[]): ParseResult;
 /** The commands that operate the queue rather than report on the world. */
 /** Every verb the CLI routes OUTSIDE runOperate. Exported (with
@@ -65,6 +66,7 @@ export type MainOptions = {
         clone?: typeof cloneGithubRepo;
     };
     update?: UpdateCliDeps;
+    release?: ReleaseCliDeps;
 };
 /**
  * Strip `-o <file>` / `--output <file>` before dispatch. The flag belongs to

package/dist/cli.js

@@ -35,6 +35,7 @@ import { detectGraphs, chooseBackend, setupOptions, LABELS as GRAPH_LABELS, } fr
 import { openStore, openStoreReadOnly, databasePath } from "./store.js";
 import { PACKAGE_VERSION } from "./version.js";
 import { runUpdateCommand } from "./toolroll-update-cli.js";
+import { runReleaseCommand } from "./release-cli.js";
 import { runOperate, OPERATE_HELP } from "./operate.js";
 import { renderReport, renderPulls, renderGraph } from "./render.js";
 import { readRemote } from "./remote.js";
@@ -57,6 +58,8 @@ Usage
   toolroll unlink           take it off again
   toolroll update           update to the latest release: verified, drained, undoable
                                    (preview first; --yes, --now, --at HH:MM, --rollback)
+  toolroll release <branch> release Toolroll itself: gate, your approval, deploy, merge, tag, publish
+                                   (resumable: rerun to continue; --help)
   toolroll contract         the machine contract: envelope version + capabilities
                                    (--commands dumps the declared command guide)
   toolroll skills install --claude-code [--dir <path>]
@@ -92,7 +95,7 @@ and any queue command + --help prints it too
   toolroll task approve <id>
                                the yes — nothing builds without one
   toolroll claim <id> --runner <name>
-  toolroll heartbeat <lease> / release <lease> / reap
+  toolroll heartbeat <lease> / worker release <lease> / reap
   toolroll tick --runner <name> --token <t> --repo <path>
                                one unattended pass over the ready set
   toolroll flows list | show <id> | create | edit | trigger | script | card | archive
@@ -196,7 +199,7 @@ export function parseArgs(argv) {
  * which answers as `scan`. */
 export const TOP_LEVEL_COMMANDS = [
     "", "pulls", "graph", "repos", "repos add", "repos remove", "repos add-from-github",
-    "link", "unlink", "update", "contract", "skills list", "skills get", "skills install", "demo",
+    "link", "unlink", "update", "release", "contract", "skills list", "skills get", "skills install", "demo",
     ...SESSION_CLI_ACTIONS.map(action => `session ${action}`),
     ...TEAM_CLI_ACTIONS,
 ];
@@ -230,7 +233,7 @@ export const OPERATE_COMMANDS = new Set([
     "models",
     "claim",
     "heartbeat",
-    "release",
+    "worker",
     "reap",
     "enroll",
     "grants",
@@ -417,6 +420,9 @@ async function dispatch(argv, write, mainOptions) {
     }
     if (first === "update")
         return runUpdateCommand(rest, write, mainOptions.update);
+    if (first === "release") {
+        return runReleaseCommand(rest, write, { releaseLease: lease => runOperate("worker", ["release", ...lease], write, mainOptions.operate ?? {}), ...mainOptions.release });
+    }
     if (first === "contract")
         return runContractCommand(rest, write);
     if (first === "session")

package/dist/coding-shipping-ui.d.ts

@@ -1,4 +1,5 @@
 import type { CodingHandoffPreview } from './coding-handoff.js';
+import { type Html } from './html.js';
 /** A reviewable handoff. The next screen retains the existing approval terms. */
-export declare function codingShippingHtml(preview: CodingHandoffPreview, csrf: string, values?: URLSearchParams, error?: string): string;
+export declare function codingShippingHtml(preview: CodingHandoffPreview, values?: URLSearchParams, error?: string): Html;
 export declare const CODING_SHIPPING_CSS = ".coding-workspace.coding-handoff{display:block;max-width:780px}.coding-handoff h1{margin-bottom:12px}.coding-handoff>p{margin-top:12px}.coding-workspace .coding-check{display:flex;align-items:center;gap:10px;min-height:44px}.coding-workspace .coding-check input{width:20px;height:20px;flex:0 0 20px}";

package/dist/coding-shipping-ui.js

@@ -1,12 +1,12 @@
-const escape = (value) => value.replace(/[&<>"']/g, c => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
+import { html, postForm } from './html.js';
 /** A reviewable handoff. The next screen retains the existing approval terms. */
-export function codingShippingHtml(preview, csrf, values, error) {
-    const hidden = (name, value) => `<input type="hidden" name="${name}" value="${escape(value)}">`;
+export function codingShippingHtml(preview, values, error) {
     const goal = values?.get('goal') ?? preview.title;
     const criteria = values?.get('acceptance') ?? '';
     const notice = error?.startsWith('Review screenshots are not ready.')
-        ? `<p class="coding-notice" role="alert">Screenshots needed. Ask Codex to capture and commit them, then try again.</p><details><summary>Technical details</summary><p>${escape(error)}</p></details>`
-        : error ? `<p class="coding-notice" role="alert">${escape(error)}</p>` : '';
-    return `<section class="coding-workspace coding-handoff" data-coding-session=""><h1>Review for shipping</h1><p>${escape(preview.title)}</p>${notice}<form method="post" action="/code/${escape(preview.sessionId)}/ship" class="coding-start">${hidden('csrf', csrf)}${hidden('base', preview.base)}${hidden('candidate', preview.candidate)}${hidden('title', preview.title)}<label>Outcome<textarea name="goal" rows="4" required maxlength="16000">${escape(goal)}</textarea></label><label>Checks for review<textarea name="acceptance" rows="4" required maxlength="16000" placeholder="One observable result per line">${escape(criteria)}</textarea></label><label class="coding-check"><input type="checkbox" name="visual" value="yes"${values?.get('visual') === 'yes' ? ' checked' : ''}>Include desktop and phone screenshots</label><details><summary>${preview.changedPaths.length} changed files · commit ${escape(preview.candidate.slice(0, 8))}</summary><ul>${preview.changedPaths.map(path => `<li><code>${escape(path)}</code></li>`).join('')}</ul><p class="coding-meta">Review covers the complete change from ${escape(preview.base)} to ${escape(preview.candidate)}.</p></details><p class="coding-terms">Verification and publication use this project’s existing approval process.</p><button type="submit">Create review task</button></form><p><a href="/code/${escape(preview.sessionId)}">Back to coding</a></p></section>`;
+        ? html `<p class="coding-notice" role="alert">Screenshots needed. Ask Codex to capture and commit them, then try again.</p><details><summary>Technical details</summary><p>${error}</p></details>`
+        : error ? html `<p class="coding-notice" role="alert">${error}</p>` : '';
+    const form = postForm(`/code/${preview.sessionId}/ship`, html `<label>Outcome<textarea name="goal" rows="4" required maxlength="16000">${goal}</textarea></label><label>Checks for review<textarea name="acceptance" rows="4" required maxlength="16000" placeholder="One observable result per line">${criteria}</textarea></label><label class="coding-check"><input type="checkbox" name="visual" value="yes"${values?.get('visual') === 'yes' ? html ` checked` : ''}>Include desktop and phone screenshots</label><details><summary>${preview.changedPaths.length} changed files · commit ${preview.candidate.slice(0, 8)}</summary><ul>${preview.changedPaths.map(path => html `<li><code>${path}</code></li>`)}</ul><p class="coding-meta">Review covers the complete change from ${preview.base} to ${preview.candidate}.</p></details><p class="coding-terms">Verification and publication use this project’s existing approval process.</p><button type="submit">Create review task</button>`, { attrs: { class: 'coding-start' }, hidden: { base: preview.base, candidate: preview.candidate, title: preview.title } });
+    return html `<section class="coding-workspace coding-handoff" data-coding-session=""><h1>Review for shipping</h1><p>${preview.title}</p>${notice}${form}<p><a href="/code/${preview.sessionId}">Back to coding</a></p></section>`;
 }
 export const CODING_SHIPPING_CSS = `.coding-workspace.coding-handoff{display:block;max-width:780px}.coding-handoff h1{margin-bottom:12px}.coding-handoff>p{margin-top:12px}.coding-workspace .coding-check{display:flex;align-items:center;gap:10px;min-height:44px}.coding-workspace .coding-check input{width:20px;height:20px;flex:0 0 20px}`;

package/dist/coding-ui.d.ts

@@ -1,4 +1,5 @@
 import type { CodingSession, CodingSnapshot } from './coding-types.js';
+import { type Html } from './html.js';
 export declare function codingWorkspaceHtml(input: {
     projects: {
         path: string;
@@ -6,12 +7,13 @@ export declare function codingWorkspaceHtml(input: {
     }[];
     sessions: CodingSession[];
     selected: CodingSnapshot | null;
+    /** The page script posts with it (data-coding-csrf); the forms get theirs from postForm. */
     csrf: string;
     project: string | null;
     error?: string;
     draft?: string;
     available: boolean;
     owner?: string;
-}): string;
+}): Html;
 export declare const CODING_CSS = "\n.coding-workspace{display:grid;grid-template-columns:224px minmax(0,1fr);gap:24px;max-width:1220px;min-width:0;margin:0 auto;overflow-wrap:anywhere}\n.coding-workspace *{box-sizing:border-box}.coding-workspace [hidden]{display:none!important}.coding-workspace h1{font-size:1.45rem;line-height:1.25;margin:0}.coding-workspace h2{font-size:1rem;margin:0}.coding-workspace h3{font-size:1rem;margin:0 0 12px}.coding-workspace p{margin:0 0 12px}.coding-main,.coding-sidebar{min-width:0}.coding-meta,.coding-workspace small{font-size:.83rem;color:var(--muted-foreground,#747981)}\n.coding-sidebar-top,.coding-header,.coding-state-row,.coding-actions{display:flex;align-items:center;gap:12px;justify-content:space-between}.coding-sidebar-top{margin-bottom:12px}.coding-header{align-items:flex-start;margin-bottom:16px}.coding-header .coding-meta{margin:6px 0 0}.coding-session-detail{max-width:220px}.coding-session-detail summary{font-size:.82rem}.coding-session-detail dl{font-size:.82rem}.coding-session-detail dt{font-weight:600;margin-top:8px}.coding-session-detail dd{margin:2px 0 0}.coding-state-row{flex-wrap:wrap;padding:10px 0;border-bottom:1px solid var(--border,#353940);margin-bottom:12px}.coding-state-row p{margin:0;font-weight:600}.coding-state-row form{margin:0}\n.coding-session-list{max-height:74vh;overflow:auto}.coding-sidebar ul{list-style:none;margin:0;padding:0;display:grid;gap:4px}.coding-sidebar nav a{display:block;padding:12px;border-radius:10px;text-decoration:none;color:inherit}.coding-sidebar nav a:hover,.coding-sidebar nav a[aria-current]{background:var(--muted,#22252a)}.coding-sidebar nav a[aria-current]{box-shadow:inset 3px 0 var(--primary,#90bfa7)}.coding-sidebar nav span,.coding-sidebar nav small{display:block}.coding-sidebar nav [data-coding-status-for]{display:inline}.coding-sidebar nav small{margin-top:5px}.coding-mobile-sessions{display:none}\n.coding-workspace form:not(.coding-state-row form){display:grid;gap:12px;margin:0}.coding-workspace label{display:grid;gap:6px;font-size:.9rem;font-weight:500}.coding-workspace input,.coding-workspace textarea,.coding-workspace select{width:100%;min-width:0;max-width:100%;font-size:16px;border:1px solid var(--border,#353940);border-radius:8px;padding:11px 12px;background:var(--background,#14161a);color:var(--foreground,#f0f1f3)}.coding-workspace textarea{resize:vertical;line-height:1.5}.coding-workspace input:focus-visible,.coding-workspace textarea:focus-visible,.coding-workspace select:focus-visible,.coding-workspace button:focus-visible,.coding-workspace summary:focus-visible,.coding-workspace a:focus-visible{outline:2px solid var(--ring,#79acff);outline-offset:3px}.coding-workspace button,.coding-link-button{min-height:44px;padding:10px 15px;white-space:nowrap;border-radius:8px;max-width:100%;font-size:.9rem}.coding-workspace button{justify-self:start;cursor:pointer}.coding-workspace button:disabled{cursor:default;opacity:.55}.coding-workspace .coding-secondary{background:transparent;color:inherit;border:1px solid var(--border,#353940)}.coding-link-button{display:inline-flex;align-items:center;justify-content:center;text-decoration:none;color:inherit;border:1px solid var(--border,#353940)}.coding-workspace summary{cursor:pointer;min-height:44px;padding:12px 0}.coding-actions{justify-content:flex-start;flex-wrap:wrap}.coding-start{max-width:680px}.coding-options label+label{margin-top:12px}.coding-terms{font-size:.9rem;line-height:1.6;margin:0!important}.coding-empty{padding:28px 0}\n.coding-notice{border:1px solid var(--destructive,#bd7674);border-radius:10px;padding:12px;line-height:1.5;margin-bottom:16px}.coding-conversation{max-height:min(58vh,640px);min-height:140px;overflow:auto;overscroll-behavior:contain;scrollbar-gutter:stable;padding:4px 10px 12px 0}.coding-message{padding:14px 0}.coding-message strong{display:block;font-size:.78rem;margin-bottom:7px;color:var(--muted-foreground,#747981)}.coding-user{margin:8px 0 8px 32px;padding:14px 16px;border-radius:12px;background:var(--muted,#22252a)}.coding-text{white-space:pre-wrap;line-height:1.6;overflow-wrap:anywhere}.coding-tool{border-bottom:1px solid var(--border,#353940);font-size:.88rem}.coding-workspace pre{white-space:pre-wrap;overflow-wrap:anywhere;max-width:100%;font-size:.8rem;line-height:1.5;margin:0 0 12px}.coding-tool summary{display:list-item}.coding-tool summary span{margin-left:6px}.coding-composer{border-top:1px solid var(--border,#353940);padding-top:14px;margin-top:8px!important}.coding-composer label{font-size:.83rem}.coding-request{border:1px solid var(--border,#353940);border-radius:12px;padding:16px;margin:12px 0}.coding-permission-detail{max-height:240px;overflow:auto}.coding-changes{margin-top:20px;border-top:1px solid var(--border,#353940)}.coding-changes pre{max-height:min(50dvh,480px);overflow:auto}.coding-change-meta{font-size:.8rem}.coding-workspace #coding-latest{margin:8px 0}.coding-workspace #coding-connection{line-height:1.4}\n.coding-workspace .coding-start>button[type=\"submit\"],.coding-workspace .coding-composer button[type=\"submit\"]{background:var(--primary,#171717);color:var(--primary-foreground,#fff);border:1px solid var(--primary,#171717);font-weight:600;box-shadow:none}.coding-workspace .coding-start>button[type=\"submit\"]:not(:disabled):hover,.coding-workspace .coding-composer button[type=\"submit\"]:not(:disabled):hover{filter:brightness(.9)}\n.coding-workspace:not([data-coding-session=\"\"]) .coding-main{display:flex;flex-direction:column;min-height:calc(100dvh - 180px)}.coding-main>.coding-header,.coding-main>.coding-state-row,.coding-main>#coding-requests,.coding-main>.coding-composer,.coding-main>.coding-changes,.coding-main>.coding-notice,.coding-main>#coding-connection{flex-shrink:0}.coding-workspace:not([data-coding-session=\"\"]) .coding-conversation{flex:1 1 120px;min-height:100px;max-height:min(58dvh,640px)}.coding-workspace .coding-tool{margin:4px 0;padding:0 10px;border-radius:8px}.coding-workspace .coding-session-detail{margin:0;padding:0 10px;flex-shrink:0}.coding-workspace .coding-changes{padding:0 12px;margin-top:12px}.coding-text strong{display:inline;font-size:inherit;color:inherit;margin:0;font-weight:600}.coding-composer textarea{min-height:72px;max-height:180px}\n@media(max-width:760px){.coding-workspace{grid-template-columns:minmax(0,1fr);gap:16px}.coding-sidebar{border-bottom:1px solid var(--border,#353940);padding-bottom:12px}.coding-sidebar-top h2,.coding-session-list{display:none}.coding-sidebar-top{float:right;margin:0 0 8px 12px}.coding-mobile-sessions{display:block;max-width:100%;margin:0}.coding-mobile-sessions>nav{max-height:260px;overflow:auto;clear:both}.coding-mobile-sessions>summary{min-height:44px}.coding-header{display:block}.coding-session-detail{max-width:none;margin-top:4px}.coding-session-detail summary{padding:10px 0}.coding-conversation{max-height:52vh;min-height:100px;padding-right:4px}.coding-user{margin-left:16px}.coding-workspace h1{font-size:1.25rem}.coding-workspace button,.coding-link-button{padding:10px 12px}.coding-start{max-width:none}}\n@media(max-width:760px){.coding-workspace:not([data-coding-session=\"\"]) .coding-main{min-height:calc(100dvh - 245px - env(safe-area-inset-bottom,0px))}.coding-workspace:not([data-coding-session=\"\"]) .coding-conversation{min-height:80px}.coding-header{display:flex;gap:12px}.coding-header>div{min-width:0;flex:1}.coding-header:has(.coding-session-detail[open]){flex-wrap:wrap}.coding-workspace .coding-session-detail{max-width:100px}.coding-workspace .coding-session-detail[open]{max-width:100%;flex-basis:100%}.coding-session-detail summary{white-space:nowrap}.coding-workspace .coding-mobile-sessions{padding:0 12px}.coding-composer{gap:8px!important}.coding-composer textarea{height:72px}.coding-state-row{padding:8px 0;margin-bottom:8px}}\n@media(prefers-reduced-motion:reduce){.coding-workspace *{scroll-behavior:auto!important}}\n";
 export declare function codingWorkspaceScript(): string;