toolroll 0.9.65 → 0.9.68

package/dist/run-closeout.js

@@ -18,6 +18,7 @@ import { existsSync, readdirSync, readlinkSync, realpathSync } from "node:fs";
 import { hostname } from "node:os";
 import { basename, sep } from "node:path";
 import { ownedProcessCount, runOwnerTag } from "./exec.js";
+import { sleep as defaultSleep } from "./sleep.js";
 /** How long a process has after SIGTERM before SIGKILL. */
 export const STOP_GRACE_MS = 10_000;
 /** `ps` reports age in whole seconds: a process born this close after the run saw its pid is still that process. */
@@ -86,7 +87,7 @@ export async function stopProcesses(targets, options = {}) {
     const graceMs = options.graceMs ?? STOP_GRACE_MS;
     const census = options.census ?? (() => processCensus());
     const signal = options.signal ?? ((pid, name) => process.kill(pid, name));
-    const sleep = options.sleep ?? (ms => new Promise(done => setTimeout(done, ms)));
+    const sleep = options.sleep ?? defaultSleep;
     const send = (rows, name) => {
         for (const row of rows) {
             try {

package/dist/scope.d.ts

@@ -3,6 +3,7 @@ import { AsyncLocalStorage } from "node:async_hooks";
 import { isAcpProfile, type AcpProviderId } from "./acp-agents.js";
 export { isAcpProfile };
 import { type NetworkProfile } from "./egress.js";
+import { type WritesMode } from "./writes-mode.js";
 import { type EvidenceKind } from "./contracts/acceptance-terms.js";
 import { type AcceptanceCriterion, type AcceptanceProblem, type ScopeTerms } from "./contracts/scope.js";
 import type { Store, Mutation } from "./store.js";
@@ -74,6 +75,9 @@ export type ClaudeProfile = {
     /** What the build may reach (egress.ts), resolved when the scope was written; absent on approvals sealed before
      * network policies, which run narrowed (egress.ts legacyNetwork). */
     network?: NetworkProfile;
+    /** Where the build may write (writes-mode.ts), resolved when the scope was written; absent on approvals sealed before
+     * write allowlists, which keep writing anywhere their fence allows. */
+    writes?: WritesMode;
 };
 export type CodexShapedProfile = {
     provider: "codex" | "openrouter";
@@ -91,6 +95,9 @@ export type CodexShapedProfile = {
     repairTimeoutSeconds: number;
     repairModel: string;
     network?: NetworkProfile;
+    /** Where the build may write (writes-mode.ts), resolved when the scope was written; absent on approvals sealed before
+     * write allowlists, which keep writing anywhere their fence allows. */
+    writes?: WritesMode;
 };
 export type GeminiProfile = {
     provider: "gemini";
@@ -110,6 +117,9 @@ export type GeminiProfile = {
     repairTimeoutSeconds: number;
     repairModel: string;
     network?: NetworkProfile;
+    /** Where the build may write (writes-mode.ts), resolved when the scope was written; absent on approvals sealed before
+     * write allowlists, which keep writing anywhere their fence allows. */
+    writes?: WritesMode;
 };
 /**
  * An agent over the Agent Client Protocol (acp-agents.ts, docs/plans/acp-adapter.md).
@@ -130,6 +140,9 @@ export type AcpProfile = {
     repairIdleTimeoutSeconds: number;
     repairModel: string;
     network?: NetworkProfile;
+    /** Where the build may write (writes-mode.ts), resolved when the scope was written; absent on approvals sealed before
+     * write allowlists, which keep writing anywhere their fence allows. */
+    writes?: WritesMode;
 };
 export type ExecutionProfile = ClaudeProfile | CodexShapedProfile | GeminiProfile | AcpProfile;
 /** Whether a profile's clock is a no-progress window (an ACP profile has both clocks; its overall one is a deadline). */

package/dist/scope.js

@@ -11,6 +11,7 @@ import { claimActor, currentActor } from "./actor.js";
 import { parseLeadToken } from "./api-tokens.js";
 import { isAcpProfile, isAcpProvider } from "./acp-agents.js";
 import { levelOfProfile } from "./policy.js";
+import { canonicalJson } from "./canonical-json.js";
 export { isAcpProfile };
 /**
  * What a task is allowed to become, agreed before anything builds it.
@@ -39,6 +40,7 @@ export { isAcpProfile };
  */
 import { createHash, randomBytes, scryptSync, timingSafeEqual } from "node:crypto";
 import { networkFromValue, networkWords } from "./egress.js";
+import { isWritesMode, writesWords } from "./writes-mode.js";
 import { z } from "zod";
 import {} from "./contracts/acceptance-terms.js";
 import { parseContract } from "./contracts/contract.js";
@@ -132,19 +134,6 @@ export function watchdogsOf(profile, timeoutMs, repair = false) {
     return profile.timeoutKind === "idle" ? { idleTimeoutMs: timeoutMs } : { timeoutMs };
 }
 export const PROFILE_DIGEST_VERSION = 2;
-/** Deterministic JSON: object keys sorted recursively, arrays in order. */
-function canonicalJson(value) {
-    if (Array.isArray(value))
-        return `[${value.map(canonicalJson).join(",")}]`;
-    if (value !== null && typeof value === "object") {
-        const entries = Object.entries(value)
-            .filter(([, v]) => v !== undefined)
-            .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
-            .map(([k, v]) => `${JSON.stringify(k)}:${canonicalJson(v)}`);
-        return `{${entries.join(",")}}`;
-    }
-    return JSON.stringify(value);
-}
 /** The stored snapshot bytes: version embedded IN the snapshot (finding 17). */
 export function canonicalProfileJson(profile) {
     return canonicalJson({ digestVersion: PROFILE_DIGEST_VERSION, profile });
@@ -362,9 +351,12 @@ export function profileFromJson(json) {
     const network = p["network"] === undefined ? undefined : networkFromValue(p["network"]);
     if (network === null)
         return null;
-    const withNetwork = network === undefined ? {} : { network };
+    const writes = p["writes"];
+    if (writes !== undefined && !isWritesMode(writes))
+        return null;
+    const withNetwork = { ...(network === undefined ? {} : { network }), ...(writes === undefined ? {} : { writes }) };
     if (p["provider"] === "claude") {
-        if (exactKeys(p, [...PROVIDER_KEYS, "permissionArgv"], ["timeoutKind", "network"]) &&
+        if (exactKeys(p, [...PROVIDER_KEYS, "permissionArgv"], ["timeoutKind", "network", "writes"]) &&
             str(p["model"]) &&
             (p["permissionArgv"] === "auto" || p["permissionArgv"] === "acceptEdits" || p["permissionArgv"] === "bypassPermissions") &&
             num(p["maxTurns"]) && num(p["repairMaxTurns"]) &&
@@ -386,7 +378,7 @@ export function profileFromJson(json) {
         return null;
     }
     if (p["provider"] === "codex" || p["provider"] === "openrouter") {
-        if (exactKeys(p, [...PROVIDER_KEYS, "sandboxMode"], ["timeoutKind", "network"]) &&
+        if (exactKeys(p, [...PROVIDER_KEYS, "sandboxMode"], ["timeoutKind", "network", "writes"]) &&
             str(p["model"]) &&
             (p["sandboxMode"] === "workspace-write" || p["sandboxMode"] === "danger-full-access") &&
             p["maxTurns"] === "unsupported" && p["repairMaxTurns"] === "unsupported" &&
@@ -408,7 +400,7 @@ export function profileFromJson(json) {
         return null;
     }
     if (p["provider"] === "gemini") {
-        if (exactKeys(p, [...PROVIDER_KEYS, "approvalArgv"], ["timeoutKind", "network"]) &&
+        if (exactKeys(p, [...PROVIDER_KEYS, "approvalArgv"], ["timeoutKind", "network", "writes"]) &&
             str(p["model"]) &&
             (p["approvalArgv"] === "auto_edit" || p["approvalArgv"] === "yolo") &&
             p["maxTurns"] === "unsupported" && p["repairMaxTurns"] === "unsupported" &&
@@ -430,7 +422,7 @@ export function profileFromJson(json) {
         return null;
     }
     if (typeof p["provider"] === "string" && isAcpProvider(p["provider"])) {
-        if (exactKeys(p, [...PROVIDER_KEYS, "permission", "idleTimeoutSeconds", "repairIdleTimeoutSeconds"], ["network"]) &&
+        if (exactKeys(p, [...PROVIDER_KEYS, "permission", "idleTimeoutSeconds", "repairIdleTimeoutSeconds"], ["network", "writes"]) &&
             str(p["model"]) &&
             p["permission"] === "full" &&
             p["maxTurns"] === "unsupported" && p["repairMaxTurns"] === "unsupported" &&
@@ -1278,6 +1270,7 @@ export function describeScope(scope, readiness = NO_READINESS) {
         ...scopeRouteWords(scope, readiness),
         // What the build may reach (egress.ts), part of what the yes agrees to.
         ...(scope.profile === null || scope.profile === undefined ? [] : [`  network      ${networkWords(scope.profile.network ?? null).replace(/^Network: /, "")}`]),
+        ...(scope.profile === null || scope.profile === undefined ? [] : [`  writes       ${writesWords(scope.profile.writes)}`]),
         `  reference    ${scope.digest}`,
         `  approved     ${describeApproval(approval)}`,
     ];

package/dist/scout-browser.js

@@ -16,6 +16,7 @@ import { request as httpRequest } from "node:http";
 import { connect, createServer } from "node:net";
 import { readdirSync, rmSync } from "node:fs";
 import { join } from "node:path";
+import { sleep } from "./sleep.js";
 /** The public page the check opens through the scout's proxy. */
 export const PREFLIGHT_PAGE = "https://example.com/";
 const PREFLIGHT_TIMEOUT_MS = 60_000;
@@ -90,7 +91,7 @@ async function serveBrowser(launch, options, deadline, late) {
     };
     // First runs download the pinned tool; it listens once it is ready.
     while (stopped === null && Date.now() < deadline && !(await answers(port)))
-        await new Promise(done => setTimeout(done, 250));
+        await sleep(250);
     if (stopped !== null || Date.now() >= deadline) {
         const reason = stopped ?? late;
         await close();

package/dist/serve.js

@@ -151,7 +151,7 @@ import { loadConsoleUrl } from "./webhooks.js";
 import { reviewFactsOf } from "./workspace-ui.js";
 import { WorktreePool } from "./worktree.js";
 export function createDecisionServer(options) {
-    const { guided, projectFamilyPeek, familiesInView, familyTasksInView, revisionDestination, earlierLiveVersions, familyHistory, freshAssignment, workRowOf, taskListPane, runIsLive, runIsTaskResult, revisionViewOf, taskViewData, routeViewOf, taskChatFocus, pullRequestTargetOf, taskPullRequestOf, failureOf, explainAttempt, runChecksHere, taskScreen, armTaskResume, planViewOf, planContractViewOf, revisionDocOf, revisionLedgerOf, progressOf, resultDetailOf } = createTaskViews({
+    const { projectFamilyPeek, familiesInView, familyTasksInView, revisionDestination, runIsLive, runIsTaskResult, revisionViewOf, taskViewData, routeViewOf, taskChatFocus, pullRequestTargetOf, failureOf, explainAttempt, taskScreen, armTaskResume, planViewOf, planContractViewOf, revisionDocOf, revisionLedgerOf, resultDetailOf } = createTaskViews({
         get store() { return store; },
         get projectCounts() { return projectCounts; },
         get admissionList() { return admissionList; },
@@ -170,7 +170,7 @@ export function createDecisionServer(options) {
         get dockedConversation() { return dockedConversation; },
         get liveRefreshSeconds() { return liveRefreshSeconds; },
     });
-    const { authenticateApprover, authenticateCredential, authorizeMutation, projectOf, resolveRouteProject, projectRequestAllowed, identify, lookupSession, restricted, visible, admissionList, codingActorAllowed, codingProjectAllowed, workAccess, familyOf, taskRepoOf, runVisible } = createSharedGuards({
+    const { authenticateApprover, authenticateCredential, authorizeMutation, projectOf, projectRequestAllowed, identify, lookupSession, restricted, visible, admissionList, codingActorAllowed, codingProjectAllowed, workAccess, familyOf, taskRepoOf, runVisible } = createSharedGuards({
         get store() { return store; },
         get liveCeiling() { return liveCeiling; },
         get codingProjects() { return codingProjects; },
@@ -447,6 +447,7 @@ export function createDecisionServer(options) {
         builds: projectBuildsOf(repo, who),
         access: projectAccessOf(repo),
         network: { setting: store.projectNetwork(repo), canChange: who.via === "cookie" && who.role === "approver" && !store.isDemo() && store.accountCanAccess(who.name, repo) },
+        writes: { setting: store.projectWrites(repo), canChange: who.via === "cookie" && who.role === "approver" && !store.isDemo() && store.accountCanAccess(who.name, repo) },
         liveView: (() => {
             const commands = liveCommandsShown(store, repo);
             const canChange = who.via === "cookie" && who.role === "approver" && !store.isDemo() && store.accountCanAccess(who.name, repo);

package/dist/server/chrome.d.ts

@@ -128,7 +128,9 @@ export type Chrome = {
  * at the sink like every page, fetched same-origin — and the nonce'd CSP
  * refuses to execute anything the region could smuggle. Nothing reads on a timer.
  */
-export declare function regionScript(regionId: string, fragmentName: string, path?: string): string;
+export declare function regionScript(regionId: string, fragmentName: string, path?: string, options?: {
+    animate?: boolean;
+}): string;
 /**
  * The live transcript's DEDICATED poller (arc 1 §4): a JSON byte-offset
  * protocol, not an HTML fragment — the response is raw sanitized text and
@@ -297,3 +299,10 @@ export declare function safePrUrl(url: string | null): string | null;
 export declare function shortDigest(digest: string): Html;
 /** One display line, bounded — turn text is data, never layout. */
 export declare function oneLineOf(text: string, cap: number): string;
+/**
+ * The board's clocks tick in the page: each <time data-tick> counts up from
+ * its datetime, measured against the server's own now (the board's data-now)
+ * so a skewed device clock cannot run them backwards. The server-rendered
+ * minutes are the answer without script.
+ */
+export declare function boardTickScript(regionId?: string): string;

package/dist/server/chrome.js

@@ -161,7 +161,7 @@ export const WORKSPACE_STYLE = styleAsset(STYLE + BRAND_MARK_CSS + INBOX_TABS_CS
  * at the sink like every page, fetched same-origin — and the nonce'd CSP
  * refuses to execute anything the region could smuggle. Nothing reads on a timer.
  */
-export function regionScript(regionId, fragmentName, path) {
+export function regionScript(regionId, fragmentName, path, options = {}) {
     // Where the fragment lives: the page's own URL by default; an explicit
     // path when a page embeds another entity's region (the task page embeds
     // the live run's peek, slice 1c — no proxy route exists for it).
@@ -184,7 +184,7 @@ export function regionScript(regionId, fragmentName, path) {
         `function keep(){var data={lanes:[],focus:null,pager:-1,fold:{}};` +
         `region.querySelectorAll("details.lane").forEach(function(d){var k=laneKey(d);if(k)data.fold[k]=d.open;});` +
         `var act=document.activeElement;` +
-        `if(act&&region.contains(act)&&act.matches&&act.matches("a.row, a.lane-card"))data.focus=act.getAttribute("href");` +
+        `if(act&&region.contains(act)&&act.matches&&act.matches("a.row, a.lane-card, a.worker-job")){data.focus=act.getAttribute("href");data.focusKind=act.matches("a.worker-job")?"a.worker-job":"a.row, a.lane-card";}` +
         `var board=region.querySelector(".board");` +
         `if(board&&board.scrollLeft>0){var lanes=board.querySelectorAll(".lane");` +
         `var bc=board.getBoundingClientRect();var mid=bc.left+bc.width/2;var best=-1,bd=1e9;` +
@@ -208,17 +208,41 @@ export function regionScript(regionId, fragmentName, path) {
         `if(board){var lanes=board.querySelectorAll(".lane");var at=Math.min(data.pager,lanes.length-1);` +
         `if(at>=0){var br=board.getBoundingClientRect();var lr=lanes[at].getBoundingClientRect();` +
         `board.scrollLeft=board.scrollLeft+(lr.left+lr.width/2)-(br.left+br.width/2);}}}` +
-        `if(data.focus!==null){var links=region.querySelectorAll("a.row, a.lane-card");` +
+        `if(data.focus!==null){var links=region.querySelectorAll(data.focusKind);` +
         `for(var i=0;i<links.length;i++){if(links[i].getAttribute("href")===data.focus){links[i].focus({preventScroll:true});break;}}}}` +
         `function tell(){if(!stamp||stopped)return;var s=Math.round((Date.now()-last)/1000);` +
         `stamp.textContent=failed?"stale — retrying ("+s+"s old)":"updated "+s+"s ago";}` +
         `setInterval(tell,1000);` +
+        // The animated swap (the live board): a card that changed lane slides there and a new one drops in, through one
+        // same-document view transition keyed by each card's data-vt; a worker whose builds changed flashes once
+        // (data-flash). Never under reduced motion, in a hidden tab, or where the browser lacks view transitions — there
+        // the swap is the plain instant one. Names are set only for the swap and cleared after it.
+        `var animate=${options.animate === true ? "true" : "false"};` +
+        // A name spells the whole key in hex — two tasks can never share one, so a card's identity never jumps to another.
+        `function vtName(v){var n="so-c";for(var i=0;i<v.length;i++){n+=("000"+v.charCodeAt(i).toString(16)).slice(-4);}return n;}` +
+        `function nameAll(){var seen={};region.querySelectorAll("[data-vt]").forEach(function(e){var n=vtName(e.getAttribute("data-vt"));if(seen[n])return;seen[n]=1;e.style.setProperty("view-transition-name",n);});}` +
+        `function flashes(){var m={};region.querySelectorAll("[data-flash]").forEach(function(e){m[e.getAttribute("data-flash")]=e.getAttribute("data-flash-value");});return m;}` +
+        `function apply(t){var before=animate?flashes():{};var kept=keep();region.innerHTML=t;restore(kept);` +
+        `if(animate)region.querySelectorAll("[data-flash]").forEach(function(e){var k=e.getAttribute("data-flash"),v=e.getAttribute("data-flash-value");if(k in before&&before[k]!==v&&v!=="")e.classList.add("flash");});}` +
+        // The swap resolves when its transition has finished, and the next fetch waits for it (refresh holds busy), so
+        // one transition runs at a time; each cleans up only its own (the generation), never a later one's.
+        `var generation=0;` +
+        `function swap(t){var calm=!window.matchMedia||matchMedia("(prefers-reduced-motion: reduce)").matches;` +
+        `if(!animate||calm||document.hidden||typeof document.startViewTransition!=="function"){apply(t);return Promise.resolve();}` +
+        // Bounded: a transition that never settles (or never runs its update) is let go after 1.5 s — the fragment is
+        // applied exactly once either way, so the board can never stop refreshing behind an animation.
+        `var root=document.documentElement;var mine=++generation;var applied=false;var settled=false;nameAll();root.classList.add("so-swap");` +
+        `var once=function(){if(applied)return false;applied=true;apply(t);return true;};` +
+        `var end=function(){if(settled)return;settled=true;once();if(mine!==generation)return;root.classList.remove("so-swap");region.querySelectorAll("[data-vt]").forEach(function(e){e.style.removeProperty("view-transition-name");});};` +
+        `var vt;try{vt=document.startViewTransition(function(){if(once())nameAll();});}catch(e){end();return Promise.resolve();}` +
+        `return new Promise(function(done){var timer=setTimeout(function(){end();done();},1500);` +
+        `var fin=function(){clearTimeout(timer);end();done();};try{Promise.resolve(vt&&vt.finished).then(fin,fin);}catch(e){fin();}});}` +
         `function refresh(){if(stopped)return;if(busy){again=true;return;}busy=true;again=false;` +
         `var q=location.search?location.search+"&fragment="+${JSON.stringify(fragmentName)}:"?fragment="+${JSON.stringify(fragmentName)};` +
         `fetch(${target},{redirect:"manual",cache:"no-store"})` +
         `.then(function(r){if(r.type==="opaqueredirect"||r.status===401||r.status===403){location.href="/login";return null;}` +
         `return r.ok?r.text():null;})` +
-        `.then(function(t){if(t){var kept=keep();region.innerHTML=t;restore(kept);last=Date.now();failed=false;}else{failed=true;}})` +
+        `.then(function(t){if(t){return swap(t).then(function(){last=Date.now();failed=false;});}failed=true;})` +
         `.catch(function(){failed=true;})` +
         // A fragment that marks itself final stops: a finished or abandoned build is not fetched again.
         `.then(function(){busy=false;tell();if(region.querySelector("[data-region-stop]")){stopped=true;if(stamp)stamp.textContent="";return;}if(again)refresh();});}` +
@@ -760,3 +784,20 @@ export function oneLineOf(text, cap) {
     const flat = text.replace(/\s+/g, " ").trim();
     return flat.length <= cap ? flat : `${flat.slice(0, cap - 1)}…`;
 }
+/**
+ * The board's clocks tick in the page: each <time data-tick> counts up from
+ * its datetime, measured against the server's own now (the board's data-now)
+ * so a skewed device clock cannot run them backwards. The server-rendered
+ * minutes are the answer without script.
+ */
+export function boardTickScript(regionId = "board-region") {
+    return (`(function(){var seen=null,offset=0;var region=document.getElementById(${JSON.stringify(regionId)});` +
+        `function fmt(s){if(s<0)s=0;var h=Math.floor(s/3600),m=Math.floor(s%3600/60),x=s%60;return h>0?h+"h "+(m<10?"0":"")+m+"m":m+":"+(x<10?"0":"")+x;}` +
+        `function run(){var scope=region||document;var anchor=scope.querySelector("[data-now]");var v=anchor?anchor.getAttribute("data-now"):null;` +
+        `if(v!==null&&v!==seen){seen=v;var n=Number(v);offset=isFinite(n)?n-Date.now():0;}` +
+        `var now=Date.now()+offset;scope.querySelectorAll("time[data-tick]").forEach(function(t){var at=Date.parse(t.getAttribute("datetime")||"");if(isNaN(at))return;var text=fmt(Math.floor((now-at)/1000));if(t.textContent!==text)t.textContent=text;});}` +
+        // A swapped region brings back the server's minutes, so a swap (the region's children replaced — never a clock's
+        // own text) ticks at once and no clock flickers back to them. Hidden tabs do not tick.
+        `run();setInterval(function(){if(!document.hidden)run();},1000);document.addEventListener("visibilitychange",function(){if(!document.hidden)run();});` +
+        `if(region&&typeof MutationObserver==="function")new MutationObserver(run).observe(region,{childList:true});})();`);
+}