toolroll 0.9.6 → 0.9.8

package/dist/chat-actions.js

@@ -1,5 +1,6 @@
 /** Shared, exact-state actions. Models may prepare; only the existing human
  * confirmation door executes. Protected actions use a one-use review receipt. */
+import { withActor } from "./actor.js";
 import { publicChatText } from "./chat-display.js";
 import { gateWords } from "./approval-policy.js";
 import { createHash, randomBytes } from "node:crypto";
@@ -1102,7 +1103,7 @@ export function executeSharedAction(store, who, id, payload, now, options) {
                     throw Error(completed.message);
             }
             else if (payload.operation === "task_cancel") {
-                const result = store.cancelTask(task, now);
+                const result = withActor({ account: who.name, lead: false }, () => store.cancelTask(task, now));
                 if (!result.ok)
                     throw Error(`Task was not cancelled: ${result.reason}.`);
             }

package/dist/chat-delivery.js

@@ -627,6 +627,8 @@ export async function planChatNotifications(options) {
                 const personal = notification.recipient !== null;
                 if (notification.createdAt >= binding.created &&
                     notification.resolvedAt === null &&
+                    // Pings follow responsibility: the lead's work, this person's own act and a muted project stay in the console.
+                    store.pingAllowed(notification, binding.approver) &&
                     // A flow decision for "anyone who approves" reaches every approver who can see the project.
                     // A notification addressed to this person reaches them whatever project
                     // their channel follows (a sign-in pause is the installation's, v108).

package/dist/chat-quiet.js

@@ -7,7 +7,7 @@
 import { assignmentOf } from "./assignment.js";
 import { chatControlHref } from "./chat-controls.js";
 import { telegramProgressCard } from "./telegram-progress.js";
-import { assignmentStatusFacts, headlineEmoji, taskStatusOf } from "./task-status.js";
+import { assignmentStatusFacts, headlineEmoji, replacedWords, taskStatusOf } from "./task-status.js";
 import { phoneText, projectLabel } from "./telegram-status.js";
 import { isLifecycleNotification } from "./store.js";
 /** What always makes a new message, even in quiet mode: a question or approval waiting, a failure or other
@@ -55,6 +55,16 @@ function taskLine(store, taskRef, now, root) {
         return null;
     const task = store.getTask(ref.externalId);
     const title = phoneText(task?.title ?? ref.externalId, 88);
+    // Replaced, never "Cancelled": the card names its successor and links to it.
+    const successor = task?.state === "cancelled" ? store.replacementOf(ref.externalId) : null;
+    if (successor !== null) {
+        const heading = `${headlineEmoji("Stopped")} ${replacedWords(successor)}`;
+        const text = [title, heading, "", `${projectLabel(ref.repo)} · ${ref.externalId}`].join("\n");
+        return { title, icon: headlineEmoji("Stopped"), status: replacedWords(successor), project: ref.repo, view: {
+                text, entities: [{ type: "bold", offset: 0, length: title.length }, { type: "bold", offset: title.length + 1, length: heading.length }],
+                link: { label: `Open ${phoneText(successor, 40)}`, path: chatControlHref("task", successor) },
+            } };
+    }
     const run = cardRun(store, taskRef);
     if (run !== null) {
         const view = telegramProgressCard(store, run, ref.externalId, ref.repo, now, root);

package/dist/chat-task-actions.d.ts

@@ -26,6 +26,18 @@ export declare const CHAT_TASK_ACTIONS: {
         readonly label: "Remove dependency";
         readonly detail: "Stops waiting for the selected task. Other requirements still apply.";
     };
+    readonly run_checks: {
+        readonly label: "Run checks";
+        readonly detail: "Runs the project's quick check on this result's exact commit. A pass upgrades its status; a failure stays visible.";
+    };
+    readonly run_full_checks: {
+        readonly label: "Run full checks";
+        readonly detail: "Runs the project's full check on this result's exact commit. A pass upgrades its status; a failure stays visible.";
+    };
+    readonly add_tests: {
+        readonly label: "Add tests";
+        readonly detail: "Files a small task to write tests for this change. Nothing runs until it is approved.";
+    };
 };
 export declare function isChatTaskAction(value: unknown): value is keyof typeof CHAT_TASK_ACTIONS;
 /** Bind cards to a specific execution and its current state, not the family's moving pointer. */
@@ -34,6 +46,7 @@ export declare function chatTaskStamp(store: Store, who: VerifiedApprover, task:
 export declare function chatTaskRun(store: Store, task: string, operation: "stop" | "resume", now: Date): number | null;
 export declare function applyChatTaskAction(store: Store, who: VerifiedApprover, payload: Record<string, unknown>, now: Date, web: boolean, controls?: Pick<StopRequest, "held" | "deferSignal"> & {
     via?: StopRequest["via"];
+    evidenceRoot?: string;
 }): {
     ok: true;
     taskId: string;

package/dist/chat-task-actions.js

@@ -1,6 +1,7 @@
 import { verifiedAuthor } from "./store.js";
 import { requestTaskStop, taskControlOf } from "./task-control.js";
 import { authorizePlanUnderMode } from "./plan-auto.js";
+import { fileAddTestsTask, requestFollowUpChecks } from "./result-follow-ups.js";
 export const CHAT_TASK_ACTIONS = {
     // Build #1604 feedback: one short consequence that still says saved work
     // remains, other tasks continue, and the pause waits for acknowledgement.
@@ -10,6 +11,10 @@ export const CHAT_TASK_ACTIONS = {
     plan: { label: "Plan first", detail: "Requests a plan. Building still requires approval." },
     wait_for: { label: "Add dependency", detail: "Waits for the selected task to finish." },
     stop_waiting: { label: "Remove dependency", detail: "Stops waiting for the selected task. Other requirements still apply." },
+    // Follow-ups on a result (result-follow-ups.ts): the same actions as the result page.
+    run_checks: { label: "Run checks", detail: "Runs the project's quick check on this result's exact commit. A pass upgrades its status; a failure stays visible." },
+    run_full_checks: { label: "Run full checks", detail: "Runs the project's full check on this result's exact commit. A pass upgrades its status; a failure stays visible." },
+    add_tests: { label: "Add tests", detail: "Files a small task to write tests for this change. Nothing runs until it is approved." },
 };
 export function isChatTaskAction(value) {
     return typeof value === "string" && Object.hasOwn(CHAT_TASK_ACTIONS, value);
@@ -52,7 +57,7 @@ export function applyChatTaskAction(store, who, payload, now, web, controls = {}
         // Resume remains the existing nonce + password ceremony. A proposal only opens it.
         if (operation === "resume")
             return { ok: true, taskId: task, said: `Resume review requested for ${task}. Complete the password confirmation on the task to resume.` };
-        const { via, ...rest } = controls;
+        const { via, evidenceRoot: _root, ...rest } = controls;
         const result = requestTaskStop(store, { taskId: task, runId: run, by: verifiedAuthor(who.name), via: via ?? (web ? "web" : "cli"), ...rest }, now);
         return result.ok ? { ok: true, taskId: task, said: `Stop requested for ${task}, run #${run}.` }
             : { ok: false, message: result.detail };
@@ -61,6 +66,19 @@ export function applyChatTaskAction(store, who, payload, now, web, controls = {}
         const result = store.requeueTask(task, who.name, now);
         return result.ok ? { ok: true, taskId: task, said: "Task queued again." } : { ok: false, message: result.reason === "claimed" ? "This task is already running." : result.reason === "not-stalled" ? "This task does not need another attempt." : "That task is no longer available." };
     }
+    if (operation === "run_checks" || operation === "run_full_checks" || operation === "add_tests") {
+        const result = store.runsFor(ref.id).find(one => one.role === "builder" && one.finishedAt !== null && one.headRevision !== null) ?? null;
+        if (result === null)
+            return { ok: false, message: "This task has no finished result yet." };
+        if (operation === "add_tests") {
+            const filed = fileAddTestsTask(store, controls.evidenceRoot ?? null, { runId: result.id, actor: who.name, filedVia: web ? "console" : "cli", admittedRepos: who.repos }, now);
+            return filed.ok ? { ok: true, taskId: filed.id, said: filed.existing ? `Tests are already filed as ${filed.id}.` : `Filed ${filed.id} to add tests. Review and approve it to start.` }
+                : { ok: false, message: filed.message };
+        }
+        const asked = requestFollowUpChecks(store, { runId: result.id, level: operation === "run_full_checks" ? "full" : "quick", actor: who.name }, now);
+        return asked.ok ? { ok: true, taskId: task, said: `${asked.level === "full" ? "Full" : "Quick"} checks ${asked.existing ? "are already" : "are"} queued on this result's commit.` }
+            : { ok: false, message: asked.message };
+    }
     if (operation === "plan") {
         const result = store.requestPlan(ref.id, now);
         if (!result.ok)

package/dist/check-levels-ui.d.ts

@@ -0,0 +1,26 @@
+/** Settings → Projects → Checks: how much checks after each build, in plain
+ * words. One choice (Quick, Full, Off) and the quick command beside the full
+ * one. Every change takes the password and lands in the ledger; approving a
+ * command restates exactly what will run, unattended, before the yes. */
+import { type CheckLevel } from "./check-levels.js";
+import type { VerifyCommand } from "./store.js";
+export type CheckSettingsView = {
+    repo: string;
+    name: string;
+    csrf: string;
+    canChange: boolean;
+    level: CheckLevel;
+    full: VerifyCommand | null;
+    quick: VerifyCommand | null;
+    /** A starting point for the quick command, from the project's scripts. */
+    suggestion: string | null;
+    /** The project's automatic review switch (review-switch.ts), beside its checks. */
+    review?: {
+        on: boolean;
+        source: "project" | "hands-off" | "default";
+    };
+    said: string | null;
+    problem: string | null;
+};
+export declare function checkSettingsHtml(view: CheckSettingsView): string;
+export declare const CHECK_SETTINGS_CSS = "\n  .check-settings { display: grid; gap: .6rem; max-width: 40rem; }\n  .check-settings p, .check-settings h2 { margin: 0; }\n  .check-settings h2 { font-size: 1rem; }\n  .check-settings fieldset { border: 0; margin: 0; padding: 0; display: grid; gap: .25rem; }\n  .check-settings legend { font-weight: 600; margin-bottom: .25rem; }\n  .check-settings label { display: grid; gap: .25rem; }\n  .check-settings .check-choice { display: flex; align-items: flex-start; gap: .6rem; min-height: 44px; padding: .35rem 0; cursor: pointer; }\n  .check-settings .check-choice > span { display: grid; gap: .1rem; }\n  .check-settings .check-choice input { margin-top: .2rem; }\n  .check-settings input[type=password], .check-settings input[type=number], .check-settings textarea { min-height: 44px; box-sizing: border-box; width: 100%; }\n  .check-settings button { min-height: 44px; justify-self: start; }\n  .check-settings .check-command { overflow-wrap: anywhere; }\n  .check-terms { margin: 0; padding-left: 1.1rem; display: grid; gap: .25rem; }\n  @media (max-width: 480px) { .check-settings button { justify-self: stretch; } }\n  .follow-ups .follow-up-list { margin: .4rem 0; padding-left: 1.1rem; display: grid; gap: .25rem; }\n  .follow-ups .follow-up-acts, .follow-ups .follow-up-act { display: flex; flex-wrap: wrap; gap: .5rem; margin: .5rem 0 0; }\n  .follow-ups .follow-up-act { margin: 0; }\n  .follow-ups button { min-height: 44px; }\n  @media (max-width: 480px) { .follow-ups .follow-up-acts, .follow-ups .follow-up-act { display: grid; } .follow-ups .follow-up-act button { width: 100%; } }\n";

package/dist/check-levels-ui.js

@@ -0,0 +1,84 @@
+/** Settings → Projects → Checks: how much checks after each build, in plain
+ * words. One choice (Quick, Full, Off) and the quick command beside the full
+ * one. Every change takes the password and lands in the ledger; approving a
+ * command restates exactly what will run, unattended, before the yes. */
+import { CHECK_LEVELS, CHECK_LEVEL_HINTS, CHECK_LEVEL_WORDS } from "./check-levels.js";
+const escape = (text) => text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+export function checkSettingsHtml(view) {
+    const hidden = (act) => `<input type="hidden" name="csrf" value="${escape(view.csrf)}"><input type="hidden" name="repo" value="${escape(view.repo)}"><input type="hidden" name="act" value="${act}">`;
+    const password = `<label>Password<input type="password" name="password" autocomplete="current-password" required></label>`;
+    const notes = [
+        view.said === null ? "" : `<p class="notice" role="status">${escape(view.said)}</p>`,
+        view.problem === null ? "" : `<p class="problem" role="alert">${escape(view.problem)}</p>`,
+    ].join("");
+    const head = `<p class="meta">${escape(view.name)} · <span class="mono">${escape(view.repo)}</span></p>${notes}`;
+    const command = (one) => `<p class="mono check-command">${escape(one.command)}</p><p class="meta">Up to ${Math.round(one.timeoutMs / 1000)}s · approved by ${escape(one.approvedBy)}</p>`;
+    // Quick with no quick command runs the full check; say so where the choice is made.
+    const fallsBack = view.level === "quick" && view.quick === null;
+    const current = `<p><strong>${CHECK_LEVEL_WORDS[view.level]}</strong> · ${escape(CHECK_LEVEL_HINTS[view.level])}</p>` +
+        (fallsBack ? `<p class="meta">No quick command yet, so builds run the full check.</p>` : "") +
+        (view.level !== "full" && view.full !== null ? `<p class="meta">The full check still runs when a pull request opens, and Merge waits for it.</p>` : "");
+    if (!view.canChange) {
+        return head + `<section class="card check-settings">${current}</section>` + reviewHtml(view, "") +
+            `<section class="card check-settings"><h2>Quick check</h2>${view.quick === null ? `<p class="meta">None yet.</p>` : command(view.quick)}</section>` +
+            `<section class="card check-settings"><h2>Full check</h2>${view.full === null ? `<p class="meta">None yet.</p>` : command(view.full)}</section>`;
+    }
+    const choices = CHECK_LEVELS.map(level => `<label class="check-choice"><input type="radio" name="level" value="${level}"${level === view.level ? " checked" : ""}>` +
+        `<span><strong>${CHECK_LEVEL_WORDS[level]}</strong><span class="meta">${escape(CHECK_LEVEL_HINTS[level])}</span></span></label>`).join("");
+    const levelForm = `<form method="post" action="/settings/checks" class="card check-settings">${hidden("level")}` +
+        `<fieldset><legend>After each build</legend>${choices}</fieldset>` +
+        (fallsBack ? `<p class="meta">No quick command yet, so Quick runs the full check.</p>` : "") +
+        `<p class="meta">A task can choose its own checks when it's filed. With Quick or Off, the full check runs when a pull request opens, and Merge waits for it unless you merge anyway.</p>` +
+        `${password}<button type="submit">Save</button></form>`;
+    const quickTerms = `<ul class="check-terms"><li>Runs unattended right after every Quick build, in that build's checkout.</li><li>Plain environment: no credentials.</li><li>A failure shows on the result; nothing is blocked.</li></ul>`;
+    const quickForm = (value, submit) => `<form method="post" action="/settings/checks" class="check-settings">${hidden("quick")}` +
+        `<label>Command<textarea name="command" rows="2" maxlength="2000" spellcheck="false" class="mono" required>${escape(value)}</textarea></label>` +
+        `<label>Time limit (seconds)<input type="number" name="timeout" min="1" max="3600" value="${view.quick === null ? 180 : Math.round(view.quick.timeoutMs / 1000)}" required></label>` +
+        `${quickTerms}${password}<button type="submit">${submit}</button></form>`;
+    const quick = view.quick === null
+        ? `<section class="card check-settings"><h2>Quick check</h2>` +
+            (view.suggestion === null ? `<p class="meta">Typecheck and the tests near the change, ideally under 2 minutes.</p>` : `<p class="meta">Suggested from the project's scripts. Edit it before approving.</p>`) +
+            quickForm(view.suggestion ?? "", "Approve quick check") + `</section>`
+        : `<section class="card check-settings"><h2>Quick check</h2>${command(view.quick)}` +
+            `<details class="settings-more"><summary>Change quick check</summary>${quickForm(view.quick.command, "Approve change")}</details>` +
+            `<details class="settings-more"><summary>Remove quick check</summary><form method="post" action="/settings/checks" class="check-settings">${hidden("quick-clear")}` +
+            `<p class="meta">Quick builds run the full check instead.</p>${password}<button type="submit" class="danger">Remove</button></form></details></section>`;
+    const full = `<details class="settings-more"><summary>Full check</summary><section class="card check-settings">` +
+        (view.full === null ? `<p class="meta">None yet. Approve one with <span class="mono">toolroll verify set --repo … --command "…"</span>.</p>` : command(view.full)) + `</section></details>`;
+    return head + levelForm + reviewHtml(view, password) + quick + full;
+}
+/** Automatic review: one state, one sentence, and its one change behind a disclosure (the password). */
+function reviewHtml(view, password) {
+    const review = view.review;
+    if (review === undefined)
+        return "";
+    const state = review.on ? (review.source === "hands-off" ? "On while hands-off lasts" : "On") : "Off";
+    const act = review.on ? "Turn off" : "Turn on";
+    const change = password === "" ? ""
+        : `<details class="settings-more"><summary>${act}</summary><form method="post" action="/settings/checks" class="check-settings">` +
+            `<input type="hidden" name="csrf" value="${escape(view.csrf)}"><input type="hidden" name="repo" value="${escape(view.repo)}"><input type="hidden" name="act" value="review">` +
+            `<input type="hidden" name="on" value="${review.on ? "0" : "1"}">${password}<button type="submit">${act}</button></form></details>`;
+    return `<section class="card check-settings" data-review-switch="${review.on ? "on" : "off"}"><h2>Automatic review</h2>` +
+        `<p><strong>${state}</strong> · One read-only review after each build passes its checks. Only high findings send it back, once.</p>${change}</section>`;
+}
+export const CHECK_SETTINGS_CSS = `
+  .check-settings { display: grid; gap: .6rem; max-width: 40rem; }
+  .check-settings p, .check-settings h2 { margin: 0; }
+  .check-settings h2 { font-size: 1rem; }
+  .check-settings fieldset { border: 0; margin: 0; padding: 0; display: grid; gap: .25rem; }
+  .check-settings legend { font-weight: 600; margin-bottom: .25rem; }
+  .check-settings label { display: grid; gap: .25rem; }
+  .check-settings .check-choice { display: flex; align-items: flex-start; gap: .6rem; min-height: 44px; padding: .35rem 0; cursor: pointer; }
+  .check-settings .check-choice > span { display: grid; gap: .1rem; }
+  .check-settings .check-choice input { margin-top: .2rem; }
+  .check-settings input[type=password], .check-settings input[type=number], .check-settings textarea { min-height: 44px; box-sizing: border-box; width: 100%; }
+  .check-settings button { min-height: 44px; justify-self: start; }
+  .check-settings .check-command { overflow-wrap: anywhere; }
+  .check-terms { margin: 0; padding-left: 1.1rem; display: grid; gap: .25rem; }
+  @media (max-width: 480px) { .check-settings button { justify-self: stretch; } }
+  .follow-ups .follow-up-list { margin: .4rem 0; padding-left: 1.1rem; display: grid; gap: .25rem; }
+  .follow-ups .follow-up-acts, .follow-ups .follow-up-act { display: flex; flex-wrap: wrap; gap: .5rem; margin: .5rem 0 0; }
+  .follow-ups .follow-up-act { margin: 0; }
+  .follow-ups button { min-height: 44px; }
+  @media (max-width: 480px) { .follow-ups .follow-up-acts, .follow-ups .follow-up-act { display: grid; } .follow-ups .follow-up-act button { width: 100%; } }
+`;

package/dist/check-levels.d.ts

@@ -0,0 +1,67 @@
+import type { Store, VerifyCommand } from "./store.js";
+export declare const CHECK_LEVELS: readonly ["quick", "full", "off"];
+export type CheckLevel = (typeof CHECK_LEVELS)[number];
+export declare const isCheckLevel: (value: unknown) => value is CheckLevel;
+export declare const CHECK_LEVEL_WORDS: Readonly<Record<CheckLevel, string>>;
+export declare const CHECK_LEVEL_HINTS: Readonly<Record<CheckLevel, string>>;
+/** Ledger actions. The ledger is append-only, so the newest entry is the setting. */
+export declare const PROJECT_LEVEL_ACTION = "check level changed";
+export declare const TASK_LEVEL_ACTION = "task checks chosen";
+export declare const RUN_LEVEL_ACTION = "checks used";
+/** The quick command's grant lives beside the full one under its own key. */
+export declare const quickVerifyKey: (repo: string) => string;
+export declare function liveQuickCommand(store: Store, repo: string): VerifyCommand | null;
+/** Ledger reads go through the repo index: `repo = ?` (or IS NULL for unplaced work). */
+export declare const repoClause: (repo: string | null) => [string, string[]];
+export declare function repoOfRun(store: Store, runId: number): string | null;
+export type ProjectCheckLevel = {
+    level: CheckLevel;
+    setBy: string | null;
+    at: string | null;
+};
+/** A project's level. With nothing recorded it is Full: a project that existed
+ * before levels keeps exactly the check it had. New projects are stamped Quick
+ * when they are added (stampNewProjectLevel). */
+export declare function projectCheckLevel(store: Store, repo: string): ProjectCheckLevel;
+/** An approver's act: set the project's level. The ledger keeps before → after. */
+export declare function setProjectCheckLevel(store: Store, repo: string, level: CheckLevel, by: string, now: Date): {
+    changed: boolean;
+    before: CheckLevel;
+};
+/** A project added from now on starts on Quick. One that already has a level,
+ * or an approved check from before levels existed, is left exactly as it is. */
+export declare function stampNewProjectLevel(store: Store, repo: string, now: Date): boolean;
+/** A task's own choice, if it made one; a revision inherits the task it revises. */
+export declare function taskCheckLevel(store: Store, taskId: string): CheckLevel | null;
+/** A filing choice: this task's checks, overriding the project. Fixed once its
+ * plan is approved, so what the approver saw is what runs. */
+export declare function setTaskCheckLevel(store: Store, taskId: string, level: CheckLevel, by: string, now: Date): {
+    ok: true;
+} | {
+    ok: false;
+    message: string;
+};
+export type EffectiveCheckLevel = {
+    level: CheckLevel;
+    from: "task" | "project";
+};
+export declare function effectiveCheckLevel(store: Store, repo: string | null, taskId: string | null): EffectiveCheckLevel;
+/** The command a level runs. Quick without its own command runs the full one
+ * (and says so: the level that ran is Full). Off runs nothing. */
+export declare function checkCommandFor(store: Store, repo: string, level: CheckLevel): {
+    level: CheckLevel;
+    command: VerifyCommand | null;
+};
+/** The builder records which level a run used, so its result says it honestly. */
+export declare function recordRunCheckLevel(store: Store, run: {
+    id: number;
+    taskId: string;
+    repo: string | null;
+}, level: CheckLevel, from: EffectiveCheckLevel["from"], now: Date): void;
+/** The level a finished run's checks used; null for a run from before levels. */
+export declare function runCheckLevel(store: Store, runId: number): CheckLevel | null;
+/** A starting point for the quick command, from the project's own scripts.
+ * It is only a suggestion: a person approves the exact command. */
+export declare function suggestQuickCommand(repo: string): string | null;
+/** "skip the tests", "run the full checks": a filing request in chat, as a level. */
+export declare function checkLevelFromWords(text: string): CheckLevel | null;

package/dist/check-levels.js

@@ -0,0 +1,171 @@
+/** Check levels: how much of the project check runs after a build.
+ *
+ * - Quick: a fast check while work is in progress (typecheck plus the tests
+ *   near the change). New projects start here.
+ * - Full: the project's approved check, as before. Projects that already
+ *   had a check keep it.
+ * - Off: no check. The result reads Ready for review, with "Checks: Off for this project" underneath.
+ *
+ * Nothing here needs a new table. A project's level and a task's choice are
+ * append-only ledger entries (the newest one wins, and the ledger already
+ * says who changed what, when). The quick command is a second approved
+ * verification grant with its own digest, kept under a `quick:` key beside
+ * the full one, so approving it is the same ceremony as `verify set`. */
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { approvalOf } from "./scope.js";
+export const CHECK_LEVELS = ["quick", "full", "off"];
+export const isCheckLevel = (value) => typeof value === "string" && CHECK_LEVELS.includes(value);
+export const CHECK_LEVEL_WORDS = { quick: "Quick", full: "Full", off: "Off" };
+export const CHECK_LEVEL_HINTS = {
+    quick: "A fast check while building: typecheck and the tests near the change.",
+    full: "The project's full check after every build.",
+    off: "No check. Results are Ready for review, and say no check ran.",
+};
+/** Ledger actions. The ledger is append-only, so the newest entry is the setting. */
+export const PROJECT_LEVEL_ACTION = "check level changed";
+export const TASK_LEVEL_ACTION = "task checks chosen";
+export const RUN_LEVEL_ACTION = "checks used";
+/** The quick command's grant lives beside the full one under its own key. */
+export const quickVerifyKey = (repo) => `quick:${repo}`;
+export function liveQuickCommand(store, repo) {
+    return store.liveVerifyCommand(quickVerifyKey(repo));
+}
+/** Ledger reads go through the repo index: `repo = ?` (or IS NULL for unplaced work). */
+export const repoClause = (repo) => repo === null ? ["repo IS NULL", []] : ["repo = ?", [repo]];
+export function repoOfRun(store, runId) {
+    const run = store.getRun(runId);
+    return run === null ? null : store.refById(run.taskRef)?.repo ?? null;
+}
+function newest(store, sql, ...params) {
+    const row = store.handle.prepare(sql).get(...params);
+    return row === undefined ? null : { actor: String(row["actor"]), at: String(row["at"]), outcome: String(row["outcome"]) };
+}
+/** A project's level. With nothing recorded it is Full: a project that existed
+ * before levels keeps exactly the check it had. New projects are stamped Quick
+ * when they are added (stampNewProjectLevel). */
+export function projectCheckLevel(store, repo) {
+    const row = newest(store, "SELECT actor, at, outcome FROM action_ledger WHERE repo = ? AND task_id IS NULL AND action = ? ORDER BY id DESC LIMIT 1", repo, PROJECT_LEVEL_ACTION);
+    if (row === null || !isCheckLevel(row.outcome))
+        return { level: "full", setBy: null, at: null };
+    return { level: row.outcome, setBy: row.actor, at: row.at };
+}
+/** An approver's act: set the project's level. The ledger keeps before → after. */
+export function setProjectCheckLevel(store, repo, level, by, now) {
+    const before = projectCheckLevel(store, repo);
+    if (before.level === level && before.setBy !== null)
+        return { changed: false, before: before.level };
+    store.recordAction({ at: now.toISOString(), actor: by, repo, taskId: null, runId: null, action: PROJECT_LEVEL_ACTION, outcome: level, source: "policy",
+        detail: `${CHECK_LEVEL_WORDS[before.level]} → ${CHECK_LEVEL_WORDS[level]}` });
+    return { changed: before.level !== level, before: before.level };
+}
+/** A project added from now on starts on Quick. One that already has a level,
+ * or an approved check from before levels existed, is left exactly as it is. */
+export function stampNewProjectLevel(store, repo, now) {
+    const known = newest(store, "SELECT actor, at, outcome FROM action_ledger WHERE repo = ? AND task_id IS NULL AND action = ? LIMIT 1", repo, PROJECT_LEVEL_ACTION);
+    if (known !== null)
+        return false;
+    const hadCheck = store.handle.prepare("SELECT 1 FROM verify_command WHERE repo = ? LIMIT 1").get(repo) !== undefined;
+    if (hadCheck)
+        return false;
+    store.recordAction({ at: now.toISOString(), actor: "system", repo, taskId: null, runId: null, action: PROJECT_LEVEL_ACTION, outcome: "quick", source: "policy",
+        detail: "New project → Quick" });
+    return true;
+}
+/** A task's own choice, if it made one; a revision inherits the task it revises. */
+export function taskCheckLevel(store, taskId) {
+    let id = taskId;
+    for (let depth = 0; id !== null && depth < 64; depth++) {
+        const ref = store.lookupRef(id);
+        const [where, params] = repoClause(ref?.repo ?? null);
+        const row = newest(store, `SELECT actor, at, outcome FROM action_ledger WHERE ${where} AND task_id = ? AND action = ? ORDER BY id DESC LIMIT 1`, ...params, id, TASK_LEVEL_ACTION);
+        if (row !== null && isCheckLevel(row.outcome))
+            return row.outcome;
+        id = ref?.revisionOf ?? null;
+    }
+    return null;
+}
+/** A filing choice: this task's checks, overriding the project. Fixed once its
+ * plan is approved, so what the approver saw is what runs. */
+export function setTaskCheckLevel(store, taskId, level, by, now) {
+    const ref = store.lookupRef(taskId);
+    if (ref === null)
+        return { ok: false, message: `No task ${taskId}.` };
+    if (approvalOf(store.getScope(taskId)).approved) {
+        return { ok: false, message: "This task's plan is already approved, so its checks are fixed. File a new task to change them." };
+    }
+    if (taskCheckLevel(store, taskId) === level)
+        return { ok: true };
+    store.recordAction({ at: now.toISOString(), actor: by, repo: ref.repo, taskId, runId: null, action: TASK_LEVEL_ACTION, outcome: level, source: "request",
+        detail: `Checks for this task: ${CHECK_LEVEL_WORDS[level]}` });
+    return { ok: true };
+}
+export function effectiveCheckLevel(store, repo, taskId) {
+    const own = taskId === null ? null : taskCheckLevel(store, taskId);
+    if (own !== null)
+        return { level: own, from: "task" };
+    return { level: repo === null ? "full" : projectCheckLevel(store, repo).level, from: "project" };
+}
+/** The command a level runs. Quick without its own command runs the full one
+ * (and says so: the level that ran is Full). Off runs nothing. */
+export function checkCommandFor(store, repo, level) {
+    if (level === "off")
+        return { level: "off", command: null };
+    if (level === "quick") {
+        const quick = liveQuickCommand(store, repo);
+        if (quick !== null)
+            return { level: "quick", command: quick };
+    }
+    return { level: "full", command: store.liveVerifyCommand(repo) };
+}
+/** The builder records which level a run used, so its result says it honestly. */
+export function recordRunCheckLevel(store, run, level, from, now) {
+    store.recordAction({ at: now.toISOString(), actor: "system", repo: run.repo, taskId: run.taskId, runId: run.id, action: RUN_LEVEL_ACTION, outcome: level, source: "work",
+        detail: `${CHECK_LEVEL_WORDS[level]} checks (${from === "task" ? "this task's choice" : "project setting"})` });
+}
+/** The level a finished run's checks used; null for a run from before levels. */
+export function runCheckLevel(store, runId) {
+    const [where, params] = repoClause(repoOfRun(store, runId));
+    const row = newest(store, `SELECT actor, at, outcome FROM action_ledger WHERE ${where} AND run_id = ? AND action = ? ORDER BY id DESC LIMIT 1`, ...params, runId, RUN_LEVEL_ACTION);
+    return row !== null && isCheckLevel(row.outcome) ? row.outcome : null;
+}
+/** A starting point for the quick command, from the project's own scripts.
+ * It is only a suggestion: a person approves the exact command. */
+export function suggestQuickCommand(repo) {
+    const file = join(repo, "package.json");
+    if (!existsSync(file))
+        return null;
+    let scripts = {};
+    let deps = {};
+    try {
+        const parsed = JSON.parse(readFileSync(file, "utf8"));
+        scripts = parsed.scripts ?? {};
+        deps = { ...(parsed.dependencies ?? {}), ...(parsed.devDependencies ?? {}) };
+    }
+    catch {
+        return null;
+    }
+    const has = (name) => typeof scripts[name] === "string";
+    const runner = existsSync(join(repo, "pnpm-lock.yaml")) ? "pnpm" : existsSync(join(repo, "yarn.lock")) ? "yarn" : "npm";
+    const run = (name) => runner === "npm" ? `npm run ${name}` : `${runner} ${name}`;
+    const exec = runner === "npm" ? "npx" : `${runner} exec`;
+    const typecheck = ["typecheck", "type-check", "check-types", "tsc"].find(has) ?? null;
+    const changed = "$(git diff --name-only HEAD~1)";
+    const tests = "vitest" in deps ? `${exec} vitest related --run ${changed}`
+        : "jest" in deps ? `${exec} jest --findRelatedTests --passWithNoTests ${changed}` : null;
+    const parts = [typecheck === null ? null : run(typecheck), tests].filter((one) => one !== null);
+    if (parts.length > 0)
+        return parts.join(" && ");
+    return has("lint") ? run("lint") : null;
+}
+/** "skip the tests", "run the full checks": a filing request in chat, as a level. */
+export function checkLevelFromWords(text) {
+    const said = text.toLowerCase().replace(/[’']/g, "'");
+    if (/\b(skip|without|no|don't run|do not run|turn off|switch off)\b[^.!?\n]{0,20}\b(the )?(tests|checks)\b/.test(said) || /\b(tests|checks) off\b/.test(said))
+        return "off";
+    if (/\b(full|all the|every|complete)\s+(test|check)s?\b/.test(said))
+        return "full";
+    if (/\bquick\s+(test|check)s?\b/.test(said))
+        return "quick";
+    return null;
+}

package/dist/claim.d.ts

@@ -411,6 +411,28 @@ export declare function finalizeInterruptedFenced(store: Store, args: {
     committed?: boolean;
     now: Date;
 }): InterruptSeal;
+/**
+ * Hand an attempt back because the SERVICE stopped (its builder is
+ * stopping or restarting), not because anyone stopped the task: one fenced
+ * transaction releases the claim as `interrupted`, ends the run (and every
+ * open run it owns) as `failed` / `interrupted` — the words dead-runner
+ * recovery writes, so the next attempt inherits the preserved work in the
+ * same checkout exactly as after a crash — and returns the task to the
+ * queue with no strike, no backoff and no hold, so the next builder pass
+ * resumes it. A lease the world moved past still ends the run, touching no
+ * task state.
+ */
+export declare function finalizeHandBackFenced(store: Store, args: {
+    leaseId: string;
+    runId: number;
+    taskId: string;
+    message: string;
+    now: Date;
+}): {
+    ok: true;
+    requeued: boolean;
+    fenced: boolean;
+};
 /**
  * THE STOP FENCE at settlement (v52): when a stop applies to the run —
  * its own or an owning ancestor's — seal the attempt as interrupted and

package/dist/claim.js

@@ -1003,6 +1003,49 @@ export function finalizeInterruptedFenced(store, args) {
         return { ok: true, stopRun, requeued: Number(requeued.changes) > 0, fenced: false };
     });
 }
+/**
+ * Hand an attempt back because the SERVICE stopped (its builder is
+ * stopping or restarting), not because anyone stopped the task: one fenced
+ * transaction releases the claim as `interrupted`, ends the run (and every
+ * open run it owns) as `failed` / `interrupted` — the words dead-runner
+ * recovery writes, so the next attempt inherits the preserved work in the
+ * same checkout exactly as after a crash — and returns the task to the
+ * queue with no strike, no backoff and no hold, so the next builder pass
+ * resumes it. A lease the world moved past still ends the run, touching no
+ * task state.
+ */
+export function finalizeHandBackFenced(store, args) {
+    const { leaseId, runId, taskId, now } = args;
+    const db = store.handle;
+    return inTransaction(store, () => {
+        const run = store.getRun(runId);
+        if (run === null || run.leaseId !== leaseId || run.outcome !== null) {
+            throw new Error(`run ${runId} is not ${leaseId}'s open attempt — a hand-back seals exactly one`);
+        }
+        const { changes } = db
+            .prepare(`UPDATE claim SET released_at = ?, released_by = 'interrupted'
+          WHERE lease_id = ? AND released_at IS NULL AND ${NOT_SUPERSEDED}`)
+            .run(now.toISOString(), leaseId);
+        const fenced = Number(changes) === 0;
+        if (args.message.trim() !== "")
+            store.recordOutcomeFacts(runId, { handoff: args.message });
+        for (const owned of store.ownedRunsOf(runId)) {
+            if (owned === runId)
+                continue;
+            const child = store.getRun(owned);
+            if (child !== null && child.outcome === null)
+                store.finishRun(owned, { outcome: "failed", reason: "interrupted", now });
+        }
+        store.finishRun(runId, { outcome: "failed", reason: "interrupted", now });
+        if (fenced)
+            return { ok: true, requeued: false, fenced: true };
+        const requeued = db
+            .prepare("UPDATE task SET state = 'queued', updated_at = ? WHERE id = ? AND state = 'running'")
+            .run(now.toISOString(), taskId);
+        store.bumpWake();
+        return { ok: true, requeued: Number(requeued.changes) > 0, fenced: false };
+    });
+}
 /**
  * THE STOP FENCE at settlement (v52): when a stop applies to the run —
  * its own or an owning ancestor's — seal the attempt as interrupted and

package/dist/cli.d.ts

@@ -39,7 +39,7 @@ export type ParseResult = {
     error: string;
 };
 type Write = (line: string) => void;
-export declare const HELP = "toolroll \u2014 a control plane for unattended coding agents\n\nUsage\n  toolroll [path...]        report what is in flight\n  toolroll pulls            report what is waiting on a person\n  toolroll graph            report which work graph is already here\n  toolroll repos            list connected repositories, and how to adjust\n  toolroll repos add <path> connect one (no path: the repo you are in)\n  toolroll repos remove <path>\n  toolroll repos add-from-github <owner/name> --root <dir>\n                                   preview, then clone and connect (--yes)\n  toolroll link             put `toolroll` on your PATH\n  toolroll unlink           take it off again\n  toolroll update           update to the latest release: verified, drained, undoable\n                                   (preview first; --yes, --now, --at HH:MM, --rollback)\n  toolroll contract         the machine contract: envelope version + capabilities\n                                   (--commands dumps the declared command guide)\n  toolroll skills install --claude-code [--dir <path>]\n                                   install this binary's guides for Claude Code (preview first)\n  toolroll skills install   teach a repo's agents this queue exists (preview first)\n  toolroll skills list      the guides this exact binary serves\n  toolroll skills get <name>  print one guide (version-matched, never stale)\n  toolroll demo             a seeded throwaway sandbox \u2014 see it working in 90 seconds\n  toolroll up               app + builder for every saved project \u2014 the normal start\n  toolroll onboard          make your agent Toolroll's lead: add this repo, install its skill (--yes), offer starter flows (--starter)\n  toolroll status           running, queued, ready results, release check and plan windows\n  toolroll integrations     which integrations work, and what to do about the ones that don't (--json)\n  toolroll session          native coding sessions through the running service\n  toolroll connect          save a private connection to your central service\n  toolroll lead             named leads on the connected service\n  toolroll conversation     shared and private conversations on that service\n  toolroll chat --lead <id> --conversation <id>  central chat (use --local for local chat)\n\nOperating the queue \u2014 `toolroll task` prints the whole surface,\nand any queue command + --help prints it too\n  toolroll approver add <name>\n                               mint the credential that lets a person say yes\n  toolroll ready            what could be dispatched right now\n  toolroll check-progress <run>  current or final approved check progress\n  toolroll task wait <id> [--timeout <seconds>]\n                               wait for this attempt to finish or need a person\n  toolroll task add <title> queue work\n  toolroll task scope <id> --goal <text>\n                               state what success is; approval binds to it\n  toolroll task approve <id>\n                               the yes \u2014 nothing builds without one\n  toolroll claim <id> --runner <name>\n  toolroll heartbeat <lease> / release <lease> / reap\n  toolroll tick --runner <name> --token <t> --repo <path>\n                               one unattended pass over the ready set\n  toolroll flows list | show <id> | create | edit | trigger | script | card | archive\n                               set up and inspect flows (writes preview until --yes)\n  toolroll chat --as <you> --token <t>\n                               talk to the mate: one conversation across every\n                               project; it proposes, you confirm (--say \"\u2026\" for one turn)\n  toolroll serve --repo <path>  advanced: run only the console\n                               (--editor vscode with --runner: file links\n                               open in VS Code on the device you browse from)\n  toolroll watch / daemon install   advanced: run only the builder\n  toolroll reconcile        recover what the last stretch left behind\n\nWith nothing connected it reports everything it can find below the working\ndirectory. Once you connect repositories it reports those instead.\n\nOptions\n  --all         report everything discoverable, ignoring connected repos\n  --depth <n>   directory levels to descend (default: 6)\n  --hidden      include dot-directories, which are skipped by default\n  --dirty       also read each working tree for uncommitted files\n  --local       branches only: no network, no pull requests, no issues\n  --json        emit a machine-readable envelope instead of a report\n  -o <file>     also write that envelope to a file (requires --json)\n  -h, --help    show this\n\nNothing is written, installed, or configured. Every repository is read\nthrough git with --no-optional-locks, so a scan never contends for the\nindex lock with an editor you have open.\n\n--dirty is off by default because reading a working tree is unbounded\nwork: on a large or cloud-synced repo `git status` can take minutes,\nwhere listing branches takes milliseconds.\n\nlink shows what it would do and changes nothing; add --yes to apply it,\nor --to <dir> to choose where. It never uses sudo, never leaves your\nhome directory, and never touches a file it did not create.";
+export declare const HELP = "toolroll \u2014 a control plane for unattended coding agents\n\nUsage\n  toolroll [path...]        report what is in flight\n  toolroll pulls            report what is waiting on a person\n  toolroll graph            report which work graph is already here\n  toolroll repos            list connected repositories, and how to adjust\n  toolroll repos add <path> connect one (no path: the repo you are in)\n  toolroll repos remove <path>\n  toolroll repos add-from-github <owner/name> --root <dir>\n                                   preview, then clone and connect (--yes)\n  toolroll link             put `toolroll` on your PATH\n  toolroll unlink           take it off again\n  toolroll update           update to the latest release: verified, drained, undoable\n                                   (preview first; --yes, --now, --at HH:MM, --rollback)\n  toolroll contract         the machine contract: envelope version + capabilities\n                                   (--commands dumps the declared command guide)\n  toolroll skills install --claude-code [--dir <path>]\n                                   install this binary's guides for Claude Code (preview first)\n  toolroll skills install   teach a repo's agents this queue exists (preview first)\n  toolroll skills list      the guides this exact binary serves\n  toolroll skills get <name>  print one guide (version-matched, never stale)\n  toolroll demo             a seeded throwaway sandbox \u2014 see it working in 90 seconds\n  toolroll up               app + builder for every saved project \u2014 the normal start\n  toolroll onboard          make your agent Toolroll's lead: add this repo, install its skill (--yes), offer starter flows (--starter)\n  toolroll status           running, queued, ready results, release check and plan windows\n  toolroll integrations     which integrations work, and what to do about the ones that don't (--json)\n  toolroll session          native coding sessions through the running service\n  toolroll connect          save a private connection to your central service\n  toolroll lead             named leads on the connected service\n  toolroll lead token       mint your lead agent's credential: its own work pings nobody\n  toolroll conversation     shared and private conversations on that service\n  toolroll chat --lead <id> --conversation <id>  central chat (use --local for local chat)\n\nOperating the queue \u2014 `toolroll task` prints the whole surface,\nand any queue command + --help prints it too\n  toolroll approver add <name>\n                               mint the credential that lets a person say yes\n  toolroll ready            what could be dispatched right now\n  toolroll check-progress <run>  current or final approved check progress\n  toolroll task wait <id> [--timeout <seconds>]\n                               wait for this attempt to finish or need a person\n  toolroll task add <title> queue work\n  toolroll task scope <id> --goal <text>\n                               state what success is; approval binds to it\n  toolroll task approve <id>\n                               the yes \u2014 nothing builds without one\n  toolroll claim <id> --runner <name>\n  toolroll heartbeat <lease> / release <lease> / reap\n  toolroll tick --runner <name> --token <t> --repo <path>\n                               one unattended pass over the ready set\n  toolroll flows list | show <id> | create | edit | trigger | script | card | archive\n                               set up and inspect flows (writes preview until --yes)\n  toolroll chat --as <you> --token <t>\n                               talk to the mate: one conversation across every\n                               project; it proposes, you confirm (--say \"\u2026\" for one turn)\n  toolroll serve --repo <path>  advanced: run only the console\n                               (--editor vscode with --runner: file links\n                               open in VS Code on the device you browse from)\n  toolroll watch / daemon install   advanced: run only the builder\n  toolroll reconcile        recover what the last stretch left behind\n\nWith nothing connected it reports everything it can find below the working\ndirectory. Once you connect repositories it reports those instead.\n\nOptions\n  --all         report everything discoverable, ignoring connected repos\n  --depth <n>   directory levels to descend (default: 6)\n  --hidden      include dot-directories, which are skipped by default\n  --dirty       also read each working tree for uncommitted files\n  --local       branches only: no network, no pull requests, no issues\n  --json        emit a machine-readable envelope instead of a report\n  -o <file>     also write that envelope to a file (requires --json)\n  -h, --help    show this\n\nNothing is written, installed, or configured. Every repository is read\nthrough git with --no-optional-locks, so a scan never contends for the\nindex lock with an editor you have open.\n\n--dirty is off by default because reading a working tree is unbounded\nwork: on a large or cloud-synced repo `git status` can take minutes,\nwhere listing branches takes milliseconds.\n\nlink shows what it would do and changes nothing; add --yes to apply it,\nor --to <dir> to choose where. It never uses sudo, never leaves your\nhome directory, and never touches a file it did not create.";
 export declare function parseArgs(argv: readonly string[]): ParseResult;
 /** The commands that operate the queue rather than report on the world. */
 /** Every verb the CLI routes OUTSIDE runOperate. Exported (with