toolroll 0.9.63 → 0.9.67

package/dist/quick-start.js

@@ -0,0 +1,127 @@
+/**
+ * BARE `toolroll` IN A REPOSITORY (docs/plans/agents-cockpit.md B1): the two-action start.
+ *
+ * Inside a git repository, `toolroll` with nothing else (or only --json) either starts the console for it (`up`), or —
+ * when this installation's console is already running and PROVES it is (console-instance.ts: a fresh challenge on the
+ * discovery socket and on its HTTP listener, answered with the secret in the database this CLI opened itself) —
+ * adds the repository through the ordinary project admission and opens that proved console. Under an agent, or with
+ * --json, it starts nothing and changes nothing: it says what it would do. Outside a repository, it scans as before
+ * (the scan is also `toolroll scan`).
+ */
+import { lstatSync, realpathSync } from "node:fs";
+import { proveLiveConsole } from "./console-instance.js";
+import { underAgent } from "./prompt.js";
+import { envelopeJson } from "./envelope.js";
+import { createRequire } from "node:module";
+import { openStoreReadOnly, readSchemaVersion, SCHEMA_VERSION } from "./store.js";
+const EXIT = { ok: 0, refused: 3 };
+/** Whether argv is a bare `toolroll` (nothing, or only --json). */
+export const isBareInvocation = (argv) => argv.every(one => one === "--json");
+/** The database's schema version by the store's own strict reader, read without changing anything. */
+function schemaOf(file) {
+    try {
+        // Loaded only here, as the store loads it: the CLI's other commands never pay for (or warn about) it.
+        const { DatabaseSync } = createRequire(import.meta.url)("node:sqlite");
+        const db = new DatabaseSync(file, { readOnly: true });
+        try {
+            const read = readSchemaVersion(db);
+            return read.ok ? read : { ok: false };
+        }
+        finally {
+            db.close();
+        }
+    }
+    catch {
+        return { ok: false };
+    }
+}
+/** Whether the database file is there: "absent" only when the system says so (ENOENT), never for a path it won't show. */
+function databasePresence(file) {
+    try {
+        lstatSync(file);
+        return "present";
+    }
+    catch (error) {
+        return error.code === "ENOENT" ? "absent" : "unknown";
+    }
+}
+async function prove(seams) {
+    // Read only, never created or migrated, never cleaned up: proving changes nothing. "None" only when nothing of this
+    // build can be running on it (no database yet, or one older than this build, which `up` brings up to date); a
+    // database that can't be read, is mid-upgrade or is newer than this build can't be checked, so it is refused.
+    const none = { ok: false, state: "none", message: "no console is running" };
+    const unverifiable = (why) => ({ ok: false, state: "refused", message: `${why}, so a running console can't be checked — run \`toolroll up\` to see what's wrong` });
+    const presence = databasePresence(seams.databaseFile);
+    if (presence === "absent")
+        return none;
+    if (presence === "unknown")
+        return unverifiable("Toolroll's database can't be reached");
+    const schema = schemaOf(seams.databaseFile);
+    if (!schema.ok)
+        return unverifiable("Toolroll's database can't be read");
+    if (schema.version === null || (schema.version > 0 && schema.version < SCHEMA_VERSION))
+        return none;
+    if (schema.version !== SCHEMA_VERSION)
+        return unverifiable("Toolroll's database is being upgraded");
+    const store = openStoreReadOnly(seams.databaseFile);
+    if (store === null)
+        return unverifiable("Toolroll's database can't be read");
+    try {
+        return await proveLiveConsole(seams.databaseFile, store, seams.build, seams.attach ?? {});
+    }
+    catch {
+        return unverifiable("the running console couldn't be checked");
+    }
+    finally {
+        store.close();
+    }
+}
+/** null: not this command (outside a repository) — the caller scans as before. */
+export async function runQuickStart(argv, write, seams) {
+    const found = await seams.findRepo(seams.cwd);
+    if (found === null)
+        return null;
+    let repo = found;
+    try {
+        repo = realpathSync(found);
+    }
+    catch { /* as found */ }
+    const json = argv.includes("--json");
+    const dry = json || (seams.underAgent ?? underAgent(seams.env));
+    const proof = await prove(seams);
+    const enrolled = await seams.enrolled(repo);
+    const would = proof.ok ? (enrolled ? "open" : "add-and-open") : proof.state === "none" ? "start" : "refuse";
+    if (dry) {
+        // Nothing starts, nothing is added, nothing opens: what a person would get, in words or one envelope.
+        const words = would === "start" ? `Would start Toolroll for ${repo} (toolroll up).`
+            : would === "refuse" ? `Would refuse: ${proof.message}.`
+                : `Would ${would === "add-and-open" ? `add ${repo} and ` : ""}open the running console at ${proof.url}.`;
+        if (json)
+            write(envelopeJson({ ok: would !== "refuse", command: "toolroll", repo, would, ...(proof.ok ? { url: proof.url } : { console: proof.state, message: proof.message }), dryRun: true }));
+        else
+            write(words);
+        return would === "refuse" ? EXIT.refused : EXIT.ok;
+    }
+    if (!proof.ok && proof.state === "refused") {
+        write(`Toolroll can't attach: ${proof.message}.`);
+        return EXIT.refused;
+    }
+    if (!proof.ok)
+        return seams.startUp();
+    if (!enrolled) {
+        const admitted = await seams.admit(repo);
+        if (admitted !== 0)
+            return admitted;
+    }
+    // Whatever happened since the first proof (reading the registry, adding the project), the console is proved again,
+    // on both channels, right before its address is shown or opened — never a listener that took the port meanwhile.
+    const again = await prove(seams);
+    if (!again.ok || again.url !== proof.url || again.pid !== proof.pid) {
+        write(`Toolroll can't attach: ${again.ok ? "the console changed while the project was being added" : again.message} — run \`toolroll up\`.`);
+        return EXIT.refused;
+    }
+    write(`Toolroll is on ${proof.url}`);
+    if (seams.terminal)
+        await seams.openBrowser(proof.url);
+    return EXIT.ok;
+}

package/dist/release-adapters.d.ts

@@ -55,6 +55,12 @@ export type AdapterOptions = {
     sleep?: (ms: number) => Promise<void>;
 };
 export declare function releaseAdapters(options: AdapterOptions): ReleaseAdapters;
+/**
+ * Whether a workflow's triggers (its top-level `on:` as a name, a list or a map) include a change to the repository.
+ * A file that doesn't parse, or whose triggers aren't one of those shapes, counts as running, so the release waits
+ * rather than skipping checks it owes.
+ */
+export declare function workflowRunsOnChange(text: string): boolean;
 /** The formula with its first `url` and `sha256` replaced; anything else is left exactly as it was. */
 export declare function bumpFormula(text: string, url: string, sha256: string): string;
 export {};

package/dist/release-adapters.js

@@ -10,6 +10,7 @@ import { existsSync, readdirSync, readFileSync, realpathSync } from "node:fs";
 import { homedir } from "node:os";
 import { basename, delimiter, dirname, join } from "node:path";
 import { createRequire } from "node:module";
+import { parse as parseYaml } from "yaml";
 // Loaded on first use, like the store: a static import prints Node's SQLite warning before the CLI can quiet it.
 const sqlite = () => createRequire(import.meta.url)("node:sqlite");
 import { activeUpdateWork } from "./desktop-update-gate.js";
@@ -225,7 +226,14 @@ export function releaseAdapters(options) {
                     return;
                 if (current !== head)
                     throw new Error(`${branch} moved after merging; its new head was not deleted.`);
-                await must(git("push", `--force-with-lease=${ref}:${head}`, "origin", `:${ref}`), `deleting merged branch ${branch}`);
+                const pushed = await git("push", `--force-with-lease=${ref}:${head}`, "origin", `:${ref}`);
+                if (pushed.code === 0)
+                    return;
+                // GitHub may delete a merged branch itself between the look and the push; gone is what was wanted.
+                const after = (await must(git("ls-remote", "origin", ref), "git ls-remote")).trim().split(/\s+/)[0] || null;
+                if (after === null)
+                    return;
+                throw new Error(`deleting merged branch ${branch} failed: ${pushed.stderr.trim() || `exit ${pushed.code}`}`);
             },
             async tree(sha) { return (await must(git("rev-parse", `${sha}^{tree}`), `git rev-parse ${sha.slice(0, 7)}^{tree}`)).trim(); },
             async fileAt(sha, path) {
@@ -338,10 +346,10 @@ export function releaseAdapters(options) {
                 return prs.find(one => one.state === "open") ?? prs.filter(one => one.state === "merged").sort((a, b) => b.number - a.number)[0] ?? null;
             },
             async checks(repo, sha) {
-                const out = await must(gh("api", "--paginate", `repos/${repo}/commits/${sha}/check-runs?per_page=100`, "--jq", ".check_runs[] | {id, name, status, conclusion}"), "gh api check-runs");
+                const out = await must(gh("api", "--paginate", `repos/${repo}/commits/${sha}/check-runs?per_page=100`, "--jq", ".check_runs[] | {id, name, status, conclusion, app: .app.slug}"), "gh api check-runs");
                 const runs = out.split("\n").filter(Boolean).map(line => object(JSON.parse(line)));
                 // Oldest first, so a rerun's attempt is the last one listed for its name.
-                return runs.sort((a, b) => Number(a["id"]) - Number(b["id"])).map((one) => ({ name: String(one["name"]), status: String(one["status"]), conclusion: textOr(one["conclusion"]) }));
+                return runs.sort((a, b) => Number(a["id"]) - Number(b["id"])).map((one) => ({ name: String(one["name"]), status: String(one["status"]), conclusion: textOr(one["conclusion"]), app: textOr(one["app"]) }));
             },
             async merge(repo, pr, head) {
                 const merged = object(await ghJson("gh api pulls merge", "api", "-X", "PUT", `repos/${repo}/pulls/${pr}/merge`, "-f", "merge_method=squash", "-f", `sha=${head}`));
@@ -379,6 +387,37 @@ export function releaseAdapters(options) {
         },
         homebrew: {
             repo: tap,
+            async checked(head) {
+                // Only a workflow that runs on pull requests (or pushes) puts checks on the tap's change; apps that open a
+                // check suite and never run it don't count. Workflows are read as the change has them and as the tap's default
+                // branch has them (pull_request_target runs from there); a file this can't read counts as checking.
+                for (const ref of [head, await defaultBranch()]) {
+                    const listed = await gh("api", `repos/${tap}/contents/.github/workflows?ref=${encodeURIComponent(ref)}`, "--jq", ".[] | select(.type == \"file\") | .path");
+                    if (listed.code !== 0) {
+                        if (/Not Found|HTTP 404/.test(listed.stderr + listed.stdout))
+                            continue;
+                        throw new Error(`listing ${tap}'s workflows at ${ref}: ${listed.stderr.trim()}`);
+                    }
+                    for (const path of listed.stdout.split("\n").filter(Boolean)) {
+                        if (!/\.ya?ml$/.test(path))
+                            continue;
+                        const file = await gh("api", `repos/${tap}/contents/${path}?ref=${encodeURIComponent(ref)}`, "--jq", ".content");
+                        if (file.code !== 0)
+                            return true;
+                        if (workflowRunsOnChange(Buffer.from(file.stdout.replace(/\\n|\s/g, ""), "base64").toString("utf8")))
+                            return true;
+                    }
+                }
+                return false;
+            },
+            async statuses(head) {
+                // The older commit-status API, which some CI reports through instead of checks; newest first, so reversed.
+                const out = await must(gh("api", "--paginate", `repos/${tap}/commits/${head}/statuses?per_page=100`, "--jq", ".[] | {context, state}"), "gh api statuses");
+                return out.split("\n").filter(Boolean).map(line => object(JSON.parse(line))).reverse().map((one) => {
+                    const state = String(one["state"]);
+                    return { name: `status: ${String(one["context"])}`, status: state === "pending" ? "in_progress" : "completed", conclusion: state === "pending" ? null : state === "success" ? "success" : "failure" };
+                });
+            },
             async state(version) {
                 const branch = await defaultBranch();
                 const current = await formulaAt(branch);
@@ -427,6 +466,34 @@ export function releaseAdapters(options) {
     }
 }
 const brewBranch = (version) => `toolroll-${version}`;
+/** The events that put checks on a change. */
+const CHANGE_EVENTS = new Set(["pull_request", "pull_request_target", "push", "merge_group"]);
+/**
+ * Whether a workflow's triggers (its top-level `on:` as a name, a list or a map) include a change to the repository.
+ * A file that doesn't parse, or whose triggers aren't one of those shapes, counts as running, so the release waits
+ * rather than skipping checks it owes.
+ */
+export function workflowRunsOnChange(text) {
+    let parsed;
+    try {
+        parsed = parseYaml(text);
+    }
+    catch {
+        return true;
+    }
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
+        return true;
+    const workflow = parsed;
+    // YAML 1.1 readers take a bare `on` for true; either key names the triggers.
+    const on = "on" in workflow ? workflow["on"] : workflow["true"];
+    const events = typeof on === "string" ? [on]
+        : Array.isArray(on) ? on
+            : on !== null && typeof on === "object" ? Object.keys(on)
+                : null;
+    if (events === null || !events.every(one => typeof one === "string"))
+        return true;
+    return events.some(one => CHANGE_EVENTS.has(one));
+}
 /** The formula with its first `url` and `sha256` replaced; anything else is left exactly as it was. */
 export function bumpFormula(text, url, sha256) {
     if (!/^\s*url "[^"]*"/m.test(text) || !/^\s*sha256 "[0-9a-f]{64}"/m.test(text))

package/dist/release.d.ts

@@ -17,7 +17,7 @@
  * skipped or failed never merges. merge
  * squash-merges with the head pinned to the gated commit, tree proves main's new commit has exactly the gated tree,
  * and only then tag pushes the version tag, whose macOS matrix must pass before npm publication (publish.yml). publish
- * waits for npm, the GitHub release and the macOS checks; homebrew updates the tap's formula and merges it.
+ * waits for npm, the GitHub release and the macOS checks; homebrew updates the tap's formula and merges it (after its checks, when the tap runs any).
  *
  * A private journal (mode 0600, written whole then renamed) records what each step is about to do before it does
  * anything outside this machine, and what it saw after. A stop — a time limit, a failure, a crash, Ctrl-C — leaves the
@@ -38,10 +38,12 @@ export type ReleaseStep = typeof RELEASE_STEPS[number];
 type WaitingStep = "approval" | "check" | "quiet" | "deploy" | "ci" | "publish" | "homebrew";
 /** How long each waiting step may take, in minutes, before the release stops there (rerunning continues from it). */
 export declare const RELEASE_LIMITS: Readonly<Record<WaitingStep, number>>;
+/** One check attempt; `app` is the GitHub App that made it (github-actions for a workflow), when known. */
 export type CheckRun = {
     name: string;
     status: string;
     conclusion: string | null;
+    app?: string | null;
 };
 export type PullRequest = {
     number: number;
@@ -195,6 +197,10 @@ export type ReleaseAdapters = {
     };
     homebrew: {
         repo: string;
+        /** Whether any of the tap's workflows, at the change or its base, runs on a change; if none does, no checks are owed. */
+        checked(head: string): Promise<boolean>;
+        /** The change's commit statuses, as check runs oldest first. */
+        statuses(head: string): Promise<CheckRun[]>;
         state(version: string): Promise<HomebrewState>;
         propose(version: string): Promise<{
             pr: number;
@@ -226,10 +232,13 @@ export type ReleaseJournal = {
         by: string;
         at: string;
     } | null;
+    /** The passing result: its run, receipt and checkout, and the commit it built (`head`), which a prepared candidate
+     * records as a commit of its own with exactly the candidate's tree (absent in a journal from before that was known). */
     check: {
         run: number;
         receipt: string;
         worktree: string;
+        head?: string;
     } | null;
     completion: {
         actor: string;

package/dist/release.js

@@ -17,7 +17,7 @@
  * skipped or failed never merges. merge
  * squash-merges with the head pinned to the gated commit, tree proves main's new commit has exactly the gated tree,
  * and only then tag pushes the version tag, whose macOS matrix must pass before npm publication (publish.yml). publish
- * waits for npm, the GitHub release and the macOS checks; homebrew updates the tap's formula and merges it.
+ * waits for npm, the GitHub release and the macOS checks; homebrew updates the tap's formula and merges it (after its checks, when the tap runs any).
  *
  * A private journal (mode 0600, written whole then renamed) records what each step is about to do before it does
  * anything outside this machine, and what it saw after. A stop — a time limit, a failure, a crash, Ctrl-C — leaves the
@@ -213,9 +213,11 @@ export async function runRelease(options, adapters) {
             if (gate.result.check !== "passed")
                 throw new Stop("check-failed", `The Full release check of ${j.candidate.sha.slice(0, 7)} did not pass (run ${gate.result.run}: ${gate.result.check}). It stays as it is: fix the branch and release the new commit with --new.`);
         };
+        /** The commit the passing build recorded: what the deployed runtime is stamped with. */
+        const builtHead = () => j.check?.head ?? j.candidate.sha;
         const checked = (gate) => {
             approved(gate);
-            if (gate.result?.head !== j.candidate.sha || gate.result?.receipt !== j.check?.receipt)
+            if (gate.result?.head !== builtHead() || gate.result?.receipt !== j.check?.receipt)
                 throw new Stop("drift", `Task ${j.task.id}'s result changed since its check passed.`);
             fullCheck(gate);
         };
@@ -268,12 +270,16 @@ export async function runRelease(options, adapters) {
                             throw new Stop("check-failed", `The release build of ${j.task.id} failed: ${gate.failed}. Fix it and release the new commit with --new.`);
                         if (gate.result === null || gate.result.check === "running" || gate.result.check === "pending")
                             return null;
-                        if (gate.result.head !== j.candidate.sha)
-                            throw new Stop("drift", `The release result is for ${gate.result.head?.slice(0, 7) ?? "no commit"}, not ${j.candidate.sha.slice(0, 7)}.`);
+                        // The build records a prepared candidate as a commit of its own (its message names the task): it must hold
+                        // exactly the candidate's tree, or it isn't the release.
+                        const head = gate.result.head;
+                        if (head === null || (head !== j.candidate.sha && await adapters.repo.tree(head) !== await adapters.repo.tree(j.candidate.sha))) {
+                            throw new Stop("drift", `The release result is for ${head?.slice(0, 7) ?? "no commit"}, which doesn't hold exactly ${j.candidate.sha.slice(0, 7)}'s files.`);
+                        }
                         fullCheck(gate);
                         if (gate.result.worktree === null)
                             throw new Stop("worktree", `Run ${gate.result.run} names no checkout to deploy from.`);
-                        return { run: gate.result.run, receipt: gate.result.receipt, worktree: gate.result.worktree };
+                        return { run: gate.result.run, receipt: gate.result.receipt, worktree: gate.result.worktree, head };
                     });
                     j.check = result;
                     say(`  run ${result.run} passed on ${j.candidate.sha.slice(0, 7)}`);
@@ -310,7 +316,7 @@ export async function runRelease(options, adapters) {
                     await recoverDeploy();
                     checked(await adapters.toolroll.gate(j.task.id));
                     // A deployment that finished but whose answer was lost: the services already run a runtime of this commit.
-                    let runtime = await served(adapters, j.candidate.sha);
+                    let runtime = await served(adapters, builtHead());
                     if (runtime === null) {
                         await pinned();
                         j.deployAttempt = { stage: join(options.stateDir, "staged-upgrades", `browser-${j.candidate.sha.slice(0, 7)}-${randomUUID()}`) };
@@ -326,7 +332,7 @@ export async function runRelease(options, adapters) {
                         save();
                     }
                     const want = runtime;
-                    await waitFor("deploy", `the console and worker to run the gated commit from ${want}`, async () => (await served(adapters, j.candidate.sha)) === want ? true : null);
+                    await waitFor("deploy", `the console and worker to run the gated commit from ${want}`, async () => (await served(adapters, builtHead())) === want ? true : null);
                     j.deploy = { runtime: want, at: j.deploy?.runtime === want ? j.deploy.at : adapters.now().toISOString() };
                     j.deployAttempt = null;
                     delete j.intents.deploy;
@@ -336,7 +342,7 @@ export async function runRelease(options, adapters) {
                 }
                 case "link": {
                     const runtime = j.deploy.runtime;
-                    if (await served(adapters, j.candidate.sha) !== runtime)
+                    if (await served(adapters, builtHead()) !== runtime)
                         throw new Stop("drift", `The console and worker no longer run ${runtime}; the CLI names were not moved.`);
                     if (j.links === undefined || j.links === null) {
                         j.links = await adapters.toolroll.cliLinks();
@@ -348,7 +354,7 @@ export async function runRelease(options, adapters) {
                     catch (error) {
                         throw new Stop("link", `The CLI names were not moved to ${runtime} (they point where they did): ${error.message}. The service already runs the new build; rerun to try again.`);
                     }
-                    const everywhere = await deployed(adapters, j.candidate.sha);
+                    const everywhere = await deployed(adapters, builtHead());
                     if (everywhere !== runtime)
                         throw new Stop("mixed-runtime", `After relinking, the console, worker and both CLI names don't all run ${runtime} at ${j.candidate.sha.slice(0, 7)}.`);
                     say(`  toolroll and standing-orders run ${join(runtime, "bin.js")}`);
@@ -448,15 +454,28 @@ export async function runRelease(options, adapters) {
                         const proposed = state;
                         j.homebrew = { pr: proposed.pr, head: proposed.head, merged: false };
                         save();
+                        // Whatever checks do register are always judged; an empty set passes only for a tap whose workflows never run
+                        // on a change, and only when it's still empty a poll later.
+                        const checked = await brew.checked(proposed.head);
+                        let emptyLooks = 0;
                         await waitFor("homebrew", `the Homebrew change's checks (${brew.repo} #${proposed.pr})`, async () => {
-                            const runs = await adapters.github.checks(brew.repo, proposed.head);
+                            // Check runs and commit statuses are judged apart, so neither stands in for the other or hides its failure.
+                            // Two apps may name a check alike; each app's attempts stand for themselves.
+                            const runs = (await adapters.github.checks(brew.repo, proposed.head)).map(run => ({ ...run, name: `${run.app ?? "unknown app"}: ${run.name}` }));
+                            const statuses = await brew.statuses(proposed.head);
+                            const verdicts = [runs, statuses].filter(one => one.length > 0).map(one => checksVerdict(one, [...new Set(one.map(run => run.name))]));
+                            const failed = verdicts.flatMap(one => one.state === "failed" ? one.failed : []);
+                            if (failed.length > 0)
+                                throw new Stop("homebrew-failed", `The Homebrew change's checks failed: ${failed.join(", ")}.`);
+                            if (verdicts.some(one => one.state === "pending"))
+                                return null;
                             // GitHub registers checks asynchronously; an empty set says nothing about success.
-                            if (runs.length === 0)
+                            // A workflow is owed: only its own run counts, not another app's green check.
+                            if (checked && !runs.some(run => run.app === "github-actions"))
                                 return null;
-                            const verdict = checksVerdict(runs, [...new Set(runs.map(one => one.name))]);
-                            if (verdict.state === "failed")
-                                throw new Stop("homebrew-failed", `The Homebrew change's checks failed: ${verdict.failed.join(", ")}.`);
-                            return verdict.state === "passed" ? true : null;
+                            if (runs.length === 0 && statuses.length === 0)
+                                return ++emptyLooks >= 2 ? true : null;
+                            return true;
                         });
                         await brew.merge(proposed.pr, proposed.head);
                     }

package/dist/request-budget-ui.js

@@ -1,4 +1,4 @@
-import { html, postForm } from "./html.js";
+import { html, postForm, reauth } from "./html.js";
 import { effectiveLimits, limitOverrides, PER_DAY_MAX, PER_MINUTE_MAX, REQUEST_BUDGET_DEFAULTS } from "./request-budget.js";
 const n = (value) => value.toLocaleString("en-US");
 export const REQUEST_LIMITS_CSS = `.credentials .limits{display:grid;gap:14px}.credentials .limits form{display:grid;gap:10px}.credentials .limits label{display:grid;gap:6px}` +
@@ -14,7 +14,7 @@ export function requestLimitsHtml(db, tokens, now) {
     const overrides = limitOverrides(db);
     const everyone = overrides.get("*") ?? { readPerMinute: null, actPerMinute: null, perDay: null };
     const field = (name, label, value, placeholder, max) => html `<label>${label}<input type="number" name="${name}" min="1" max="${max}" step="1" inputmode="numeric" value="${value === null ? "" : value}" placeholder="${placeholder}"></label>`;
-    const password = html `<label>Your Toolroll password<input type="password" name="password" autocomplete="current-password"></label>`;
+    const password = html `${reauth(html `<label>Your Toolroll password<input type="password" name="password" autocomplete="current-password"></label>`)}`;
     const buttons = html `<div class="actions"><button name="action" value="save">Save limits</button><button class="secondary" name="action" value="clear">Use defaults</button></div>`;
     const live = tokens.filter(one => one.revokedAt === null && Date.parse(one.expiresAt) > now);
     const installation = postForm("/settings/request-limits", html `\

package/dist/result-follow-ups.js

@@ -9,6 +9,7 @@
  *
  * Add tests files a small task, unapproved like any other filing, to write
  * tests for that change. */
+import { fencedCheckoutCommands } from "./invoke.js";
 import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -201,7 +202,7 @@ export async function runFollowUpCheck(store, root, request, deps = {}) {
             let ready = true;
             if (setup !== null) {
                 const shell = approvedCommandShell(setup.command);
-                const prepared = await runWithIsolatedDatabase(runner, shell.file, shell.args, { cwd: checkout, timeoutMs: setup.timeoutMs, processGroup: true, envAllowlist: SETUP_ENV_ALLOWLIST, omitEnv: SETUP_ENV_DENYLIST });
+                const prepared = await runWithIsolatedDatabase(fencedCheckoutCommands(store, target.repo, checkout, runner), shell.file, shell.args, { cwd: checkout, timeoutMs: setup.timeoutMs, processGroup: true, envAllowlist: SETUP_ENV_ALLOWLIST, omitEnv: SETUP_ENV_DENYLIST });
                 note("Approved project setup", setup.command, prepared);
                 if (prepared.code !== 0 || prepared.timedOut || prepared.notFound) {
                     ready = false;
@@ -216,7 +217,7 @@ export async function runFollowUpCheck(store, root, request, deps = {}) {
                 }
                 else {
                     const shell = approvedCommandShell(live.command);
-                    const ran = await runWithIsolatedDatabase(runner, shell.file, shell.args, { cwd: checkout, timeoutMs: live.timeoutMs, processGroup: true, envAllowlist: SETUP_ENV_ALLOWLIST, omitEnv: SETUP_ENV_DENYLIST });
+                    const ran = await runWithIsolatedDatabase(fencedCheckoutCommands(store, target.repo, checkout, runner), shell.file, shell.args, { cwd: checkout, timeoutMs: live.timeoutMs, processGroup: true, envAllowlist: SETUP_ENV_ALLOWLIST, omitEnv: SETUP_ENV_DENYLIST });
                     note(`${CHECK_LEVEL_WORDS[target.level]} check`, live.command, ran);
                     result = ran.timedOut ? { ran: false, failure: "The check ran out of time." } : ran.notFound ? { ran: false, failure: "The check couldn't start." } : { ran: true, exitCode: ran.code };
                 }

package/dist/result-review.d.ts

@@ -149,7 +149,7 @@ export declare const RESULT_FACT_KEYS: readonly ["run", "head", "base", "head-so
 export declare function resultFactsFromHtml(html: string): Record<string, string>[];
 /** Where a result form may send its reader back: the review cockpit's
  * own deep link, the chat's result detail, the page of a task named in
- * `tasks` (the run's own), or the run page. Anything else lands on the run
+ * `tasks` (the run's own) or its Result tab at this run, or the run page. Anything else lands on the run
  * page. Matched exactly — never a bare open redirect. */
 export declare function resultReturnTarget(raw: string | null | undefined, runId: number, tasks?: readonly string[]): string;
 /** A form's own request token, minted per render — the same shape the

package/dist/result-review.js

@@ -147,7 +147,7 @@ export function resultFactsFromHtml(html) {
 }
 /** Where a result form may send its reader back: the review cockpit's
  * own deep link, the chat's result detail, the page of a task named in
- * `tasks` (the run's own), or the run page. Anything else lands on the run
+ * `tasks` (the run's own) or its Result tab at this run, or the run page. Anything else lands on the run
  * page. Matched exactly — never a bare open redirect. */
 export function resultReturnTarget(raw, runId, tasks = []) {
     if (raw !== null && raw !== undefined) {
@@ -160,6 +160,10 @@ export function resultReturnTarget(raw, runId, tasks = []) {
         // The run's own task page, which offered Run checks in place; never another task's.
         if (tasks.some(task => raw === `/t/${encodeURIComponent(task)}`))
             return raw;
+        // That task page's Result tab at this run (docs/plans/one-page-task-and-agent.md), its version and view kept.
+        const tab = /^\/t\/([A-Za-z0-9._~%-]{1,200})\?(?:version=[A-Za-z0-9._~%-]{1,200}&)?tab=result&run=([0-9]{1,15})(?:&section=(?:summary|changes|checks))?$/.exec(raw);
+        if (tab !== null && Number(tab[2]) === runId && tasks.some(task => tab[1] === encodeURIComponent(task)))
+            return raw;
     }
     return `/r/${runId}`;
 }
@@ -240,6 +244,8 @@ export const RESULT_REVIEW_SCRIPT = String.raw `
   var user=panel?panel.getAttribute('data-result-user')||'':'';
   var task=panel?panel.getAttribute('data-result-task')||'':'';
   var run=panel?panel.getAttribute('data-result-run')||'':'';
+  // The address parameter that holds the result's own view: 'tab' on its page, 'section' on a task page's Result tab.
+  var viewParam=panel&&panel.getAttribute('data-result-param')==='section'?'section':'tab';
   var draftPrefix='standing-orders:review-draft:',scrollPrefix='standing-orders:result-scroll:';
   var day=86400000,storage=true,rememberPosition=null;
   function read(key){try{return JSON.parse(sessionStorage.getItem(key)||'null');}catch(e){return null;}}
@@ -262,7 +268,7 @@ export const RESULT_REVIEW_SCRIPT = String.raw `
       tab.addEventListener('click',function(ev){
         if(ev.metaKey||ev.ctrlKey||ev.shiftKey||ev.altKey||ev.button!==0)return;
         ev.preventDefault();var name=tab.getAttribute('data-result-tab');show(name);
-        try{var url=new URL(location.href);url.searchParams.set('tab',name);url.hash='';history.replaceState(history.state,'',url.toString());}catch(e){}
+        try{var url=new URL(location.href);url.searchParams.set(viewParam,name);url.hash='';history.replaceState(history.state,'',url.toString());}catch(e){}
         if(rememberPosition)rememberPosition();
       });
       tab.addEventListener('keydown',function(ev){
@@ -383,7 +389,7 @@ export const RESULT_REVIEW_SCRIPT = String.raw `
   // view the URL now names.
   var returnKey=scrollPrefix+user+':'+task+':return';
   function scrollKeyFor(){var url=null;try{url=new URL(location.href);}catch(e){}
-    return scrollPrefix+user+':'+task+':'+(url?(url.searchParams.get('result')||run)+':'+(url.searchParams.get('tab')||'summary'):run);}
+    return scrollPrefix+user+':'+task+':'+(url?(url.searchParams.get('result')||run)+':'+(url.searchParams.get(viewParam)||'summary'):run);}
   // Once a navigation has begun (pageswap / beforeunload) the document's
   // scroll is no longer the reader's — a cross-document transition can
   // move it to the top while it is captured — so remembering stops.

package/dist/retention-ui.js

@@ -3,7 +3,7 @@
  * the next daily sweep would remove. An instance operator's page; changes
  * take a step-up.
  */
-import { html, postForm } from "./html.js";
+import { html, postForm, reauth } from "./html.js";
 import { bytesWords } from "./storage.js";
 import { RETENTION_KINDS, countWords, periodChoices, periodLabel } from "./retention.js";
 export const RETENTION_CSS = `.retention{max-width:720px;min-width:0}.retention-next{margin:0 0 16px}` +
@@ -31,5 +31,5 @@ export function retentionHtml(view, notice) {
         return html `<div class="kind" data-kind="${kind}"><label class="name" for="keep-${kind}">${label}</label><p class="meta">${detail}</p><select id="keep-${kind}" name="${kind}">${options}</select></div>`;
     });
     const last = view.lastSweep === null ? "" : ` Last sweep ${view.lastSweep.slice(0, 10)}.`;
-    return html `<article class="retention">${note}<p class="retention-next" data-retention-next>${nextWords(view)}${last}</p>${postForm("/settings/retention", html `${rows}<label class="step-up">Your Toolroll password<input type="password" name="password" autocomplete="current-password" required></label><button type="submit">Save</button>`)}<p class="meta">Never removed: the action ledger, and anything a task still needs (unfinished tasks, results Ready for review, anything on hold).</p></article>`;
+    return html `<article class="retention">${note}<p class="retention-next" data-retention-next>${nextWords(view)}${last}</p>${postForm("/settings/retention", html `${rows}${reauth(html `<label class="step-up">Your Toolroll password<input type="password" name="password" autocomplete="current-password" required></label>`)}<button type="submit">Save</button>`)}<p class="meta">Never removed: the action ledger, and anything a task still needs (unfinished tasks, results Ready for review, anything on hold).</p></article>`;
 }

package/dist/retention.js

@@ -24,6 +24,10 @@ import { RETENTION_NOTE } from "./evidence.js";
 import { COMPLETION_ACTION } from "./result-completion.js";
 import { bytesWords, treeBytes } from "./storage.js";
 import { RETENTION_DAYS, retentionDaysSchema, retentionKindSchema } from "./contracts/retention.js";
+/** A personal lead-queue row the sweep keeps (with its message): one still waiting, running or uncertain, and any of a
+ * conversation that is still open — its request id is the tombstone that stops a removed message being sent again. */
+const KEPT_QUEUE_ROW = (message) => `lead_queue lq WHERE lq.message = ${message}
+  AND (lq.status IN ('queued', 'running', 'uncertain') OR EXISTS (SELECT 1 FROM lead_session ls WHERE ls.id = lq.session AND ls.ended_at IS NULL))`;
 const RETENTION_TABLE = (name) => `
 CREATE TABLE IF NOT EXISTS ${name} (
   kind       TEXT PRIMARY KEY CHECK (kind IN ('evidence', 'checkouts', 'chat', 'notifications')),
@@ -177,6 +181,7 @@ export function retentionPlan(store, evidenceRoot, now, periods = store.retentio
         const rows = db.prepare(`SELECT m.id AS id, length(m.text) + COALESCE(length(m.activity), 0) + 64 AS bytes FROM lead_message m JOIN lead_thread th ON th.id = m.thread
       WHERE m.created_at < ?
         AND NOT EXISTS (SELECT 1 FROM team_message tm WHERE tm.message = m.id AND tm.status IN ('queued', 'running', 'uncertain'))
+        AND NOT EXISTS (SELECT 1 FROM ${KEPT_QUEUE_ROW("m.id")})
         AND NOT EXISTS (SELECT 1 FROM mate_turn turn WHERE turn.id = m.turn AND turn.state IN ('queued', 'running'))
         AND NOT (th.scope_kind = 'task' AND NOT EXISTS (SELECT 1 FROM task_ref r WHERE r.external_id = th.scope_key AND ${finishedTask("r")}))
       ORDER BY m.id LIMIT ?`).all(cutoff(now, periods.chat), SWEEP_BATCH + 1);
@@ -263,14 +268,18 @@ export function sweepRetention(store, evidenceRoot, now, actor = "worker") {
         }
         if (periods.chat !== null) {
             const team = db.prepare("DELETE FROM team_message WHERE message = ? AND status NOT IN ('queued', 'running', 'uncertain')");
-            const message = db.prepare("DELETE FROM lead_message WHERE id = ? AND NOT EXISTS (SELECT 1 FROM team_message WHERE message = ?)");
+            const message = db.prepare(`DELETE FROM lead_message WHERE id = ? AND NOT EXISTS (SELECT 1 FROM team_message WHERE message = ?)
+        AND NOT EXISTS (SELECT 1 FROM ${KEPT_QUEUE_ROW("lead_message.id")})`);
             const asked = db.prepare("SELECT turn FROM lead_message WHERE id = ? AND role = 'assistant' AND turn IS NOT NULL");
+            const searchCopy = db.prepare("DELETE FROM memory_search WHERE kind = 'conversation' AND ref = ?");
             // The lead's question goes with the reply that asked it; its buttons then say it expired.
             const ask = db.prepare("DELETE FROM lead_ask WHERE turn = ? AND NOT EXISTS (SELECT 1 FROM lead_message WHERE turn = ? AND role = 'assistant')");
             for (const one of plan.items.chat) {
                 team.run(one.id);
                 const turn = asked.get(one.id)?.["turn"];
                 if (Number(message.run(one.id, one.id).changes) === 1) {
+                    // Its search copy goes with it (search never shows words the store no longer keeps).
+                    searchCopy.run(`message:${one.id}`);
                     done.chat.count++;
                     done.chat.bytes += one.bytes;
                     if (turn !== undefined && turn !== null)