toolroll 0.9.67 → 0.9.68

package/CHANGELOG.md

@@ -1,5 +1,41 @@
 # Changelog
 
+## 0.9.68 — 2026-10-23
+
+- **The lead chat is redesigned.** Your messages sit in grey bubbles and the
+  lead's replies read as plain text, with code blocks. Its work folds into one
+  "Worked …" line, live steps show a spinner and then a check, and anything
+  waiting on you carries a "Needs you" chip. The message box is one row that
+  grows as you type, with a send arrow (Queue while a reply runs).
+- **Comment on a line of a change.** In a result's Changes tab, a pin on any
+  line opens a one-line comment. Enter sends it to the lead as its next
+  message, naming the file, line and run and quoting the line. The thread
+  shows it as a reference, the quoted line, and your words. On a phone the
+  result opens as a sheet over the chat.
+- **A fenced check can build bundles from the shared dependencies.** On a Mac
+  the sandbox let a build look up the linked copy's folder but not list it,
+  so esbuild couldn't find node_modules ("could not resolve react"). That one
+  folder may now be listed; nothing in it is readable beyond node_modules.
+  The console's own browser build also resolves through the checkout's links.
+- The release check passes inside the plane's macOS check sandbox: tests that
+  need to create a sandbox or watch other processes skip there and still run
+  in CI, and the browser journeys' throwaway planes run their agents inside
+  the check's own sandbox.
+- A Claude build no longer refuses to start when a sandbox around Toolroll
+  hides your Claude settings file: it signs in from the keychain as before,
+  and a sign-in that needed the file still fails quickly and says so.
+- The test suite reads its own home and temp folders, never yours, so it runs
+  the same on your machine and inside a check's sandbox. Tests that need a
+  socket path shorter than any folder the sandbox allows, and the one browser
+  journey that resumes a saved Claude session, skip inside the sandbox and
+  still run in CI.
+- `toolroll release` no longer stops at merge when GitHub has already deleted
+  the merged branch: it looks a few times, 2 seconds apart, before calling the
+  delete a failure (0.9.66 and 0.9.67 both stopped there).
+- Leaner code, with every feature kept (about 5,600 fewer lines). The
+  deprecated team and native session commands are gone, and `chat` and
+  `brief` without `--local` refuse when a central profile is saved.
+
 ## 0.9.67 — 2026-10-23
 
 - **A project's checks read their own dependencies again.** 0.9.66 began

package/dist/acp-client.js

@@ -1,3 +1,4 @@
+import { isRecord } from "./is-record.js";
 /**
  * The Agent Client Protocol, from the plane's side (docs/plans/acp-adapter.md).
  *
@@ -37,9 +38,6 @@ const TEXT_CAP = 2048;
 const USAGE_CAP = 8 * 1024;
 const PROTOCOL_VERSION = 1;
 const STOP_REASONS = new Set(["end_turn", "max_tokens", "max_turn_requests", "refusal", "cancelled"]);
-function isRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 function bounded(text, cap) {
     return text.length <= cap ? text : text.slice(0, cap);
 }

package/dist/agent-board.d.ts

@@ -1,6 +1,5 @@
 import type { Store } from "./store.js";
 export type AgentTurn = "busy" | "idle" | "crashed";
-export declare const AGENT_TURNS: readonly AgentTurn[];
 export type AgentSaid = "working" | "blocked" | "done";
 /** A busy run whose transcript and activity are both this old is Stuck. */
 export declare const STUCK_AFTER_MS: number;

package/dist/agent-board.js

@@ -27,7 +27,6 @@
  * Display state, never evidence: nothing here changes a run's outcome.
  */
 import { randomBytes } from "node:crypto";
-export const AGENT_TURNS = ["busy", "idle", "crashed"];
 /** A busy run whose transcript and activity are both this old is Stuck. */
 export const STUCK_AFTER_MS = 4 * 60_000;
 /** With a tool call still open (a long test run is silent), it is Stuck only after this long. */

package/dist/agent-fence.js

@@ -883,6 +883,9 @@ export function macosFenceProfile(fence, grants = NO_GRANTS) {
         ...(grants.lookup.length === 0 ? [] : [`(allow file-read-metadata ${paths("literal", grants.lookup)})`]),
         // Denied whole above, granted back narrowly here (a later rule wins): an entry made after launch beside it stays denied.
         ...(grants.readable.length === 0 ? [] : [`(allow file-read* file-test-existence ${paths("subpath", grants.readable)})`]),
+        // Each readable copy's own folder can be listed, never read: bundlers such as esbuild find node_modules by listing
+        // its parent, which a lookup alone refuses (the Linux and Codex fences list it as read-only already).
+        ...(grants.readable.length === 0 ? [] : [`(allow file-read-data ${paths("literal", [...new Set(grants.readable.map(one => dirname(one)))])})`]),
         ...(folders?.own == null ? [] : [`(allow file-read* file-write* ${paths("subpath", [folders.own])})`]),
         '(deny sysctl-read (sysctl-name-prefix "kern.procargs"))',
         "(deny process-info-pidinfo)",