toolroll 0.9.71 → 0.9.73

package/dist/operate.js

@@ -56,6 +56,8 @@ import { readHooksBase, scheduleFromWords } from "./flow-triggers.js";
 import { sendSubagentSummaries } from "./subagent-admin.js";
 import { runRequestedUndos, sendSubagentWeeklies } from "./subagent-week.js";
 import { refreshConnections } from "./mcp-connect.js";
+import { releaseTermsFor } from "./release-carry.js";
+import { refreshTrustedMains, settleReleaseChecks } from "./nightly-check.js";
 import { SECRETS_FIRST, startToolSecrets, toolSecretStorage } from "./project-tools.js";
 import { followDiscord } from "./discord.js";
 import { followTeams } from "./teams.js";
@@ -192,7 +194,7 @@ import { register, authenticate, heartbeat as heartbeatRunner, isAlive, recoverD
 import { mintCoordinator, revokeCoordinator, listCoordinators } from "./coordinator.js";
 import { serveMcp } from "./mcp.js";
 import { createInterface } from "node:readline";
-import { propose, approve, addApprover, authenticateAccount, authenticateApprover as passwordApprover, describeScope, approvalOf, hashToken as hashApproverToken, modeFilingCoverage, acceptanceLinesToInput, parseAcceptanceCriteria, splitAcceptanceRubric, rubricIsPlaceholder, isCommitSha, credentialProof, rememberedLogin } from "./scope.js";
+import { propose, approve, addApprover, authenticateAccount, authenticateApprover as passwordApprover, describeScope, approvalOf, hashToken as hashApproverToken, modeFilingCoverage, acceptanceLinesToInput, parseAcceptanceCriteria, splitAcceptanceRubric, rubricIsPlaceholder, isCommitSha, credentialProof, rememberedLogin, personApprovalOf } from "./scope.js";
 import { CHAT_APPROVE_ALL, presetTerms, modeTermsJson, modeDigestOf, modeTermsFromJson, modeWords, MODE_MAX_DAYS } from "./modes.js";
 import { WorktreePool } from "./worktree.js";
 import { baseStandingWords, freshBaseFor, taskBaseOf } from "./task-base.js";
@@ -694,8 +696,12 @@ export const OPERATE_VALUE_FLAGS = new Set([
     "request",
     // project sandbox (sandbox parity C9): read denies and macOS services.
     "read-deny", "mach",
+    // task scope --release <version>:<pr>:<branch>: a release scope's terms (release-once.md).
+    "release",
 ]);
 export const OPERATE_BOOLEAN_FLAGS = new Set([
+    // task scope --release ... --no-carry: every later commit asks again.
+    "no-carry",
     "json", "yes", "all", "brief", "local", "history", "latest-watch", "dry-run", "file",
     "clear", "follow", "ready", "all-tasks", "inbound-only", "help", "undo", "anyone", "allow-dispatch", "allow-merge", "merge-delete-branch",
     "no-open", "remove", "no-verify", "no-follow", "end", "report", "off", "tmux",
@@ -6225,6 +6231,11 @@ async function runWatchLoop(args) {
             const ran = await runWaitingChecks(store, context.evidenceRoot, { now: context.clock, shouldStop: stopping });
             if (ran > 0)
                 progress(`watch: ran ${ran} follow-up check(s)`);
+            // The nightly check of main and the release checks that clear its failures (release-once.md, part 3).
+            await refreshTrustedMains(store, context.evidenceRoot, context.clock(), context.gitRunner);
+            const settledChecks = settleReleaseChecks(store, context.evidenceRoot, context.clock());
+            if (settledChecks > 0)
+                progress(`watch: settled ${settledChecks} release check(s)`);
             // A finished check may send a build's card down its failure path: now, not on the next beat.
             if (ran + batched > 0)
                 moveCards(store, repo, context.clock(), context.evidenceRoot);
@@ -9031,6 +9042,8 @@ function showTask(positional, context) {
         claim: currentClaim(store, ref.id, now),
         scope,
         approval: approvalOf(scope),
+        // Whether a person gave that approval, with their proof (approval policy): what the release gate reads.
+        personApproval: personApprovalOf(store, id),
         route: taskRouteView(routed, readiness),
         // Fresh base: the commit this task's work starts from, and how far current main has moved past it.
         base,
@@ -9719,6 +9732,25 @@ async function scopeTask(positional, flags, context) {
     const candidateGiven = text(flags, "candidate");
     if (candidateGiven !== undefined && !isCommitSha(candidateGiven))
         return fail(write, json, "task scope", "usage", "--candidate is the full 40-character commit hash the machine will check out", EXIT.usage);
+    // A release scope's terms (release-once.md), filled in from the plane's own records: `--release
+    // <version>:<pull request>:<branch>` with the candidate. Terms that can't be made (the checks run outside the
+    // sandbox, say) file the scope without them: every later commit then asks again, as before.
+    const releaseGiven = text(flags, "release");
+    let releaseTerms;
+    let releaseNote = null;
+    if (releaseGiven !== undefined) {
+        const spec = /^(\d+\.\d+\.\d+):([1-9][0-9]*):([A-Za-z0-9._/-]+)$/.exec(releaseGiven);
+        if (spec === null || candidateGiven === undefined)
+            return fail(write, json, "task scope", "usage", "--release takes <version>:<pull request>:<branch>, with --candidate <commit>", EXIT.usage);
+        const repo = store.lookupRef(id)?.repo ?? null;
+        if (repo === null)
+            return fail(write, json, "task scope", "usage", "a release scope's task has to be placed in its project first", EXIT.usage);
+        const made = releaseTermsFor(store, { repo, version: spec[1], pr: Number(spec[2]), branch: spec[3], candidate: candidateGiven, now, noCarry: flags.get("no-carry") === true });
+        if (made.ok)
+            releaseTerms = made.terms;
+        else
+            releaseNote = `Later commits on this release will each ask for approval: ${made.why}.`;
+    }
     if (acceptanceParse.criteria.length === 0)
         return fail(write, json, "task scope", "acceptance-required", "--acceptance named no valid criteria", EXIT.usage);
     const touches = (text(flags, "touches") ?? "").split(",").map(one => one.trim()).filter(Boolean);
@@ -9785,6 +9817,7 @@ async function scopeTask(positional, flags, context) {
             : null;
         const proposed = propose(store, {
             ...(candidateGiven === undefined ? {} : { candidate: candidateGiven }),
+            ...(releaseTerms === undefined ? {} : { releaseTerms }),
             taskId: id,
             goal,
             outOfScope: text(flags, "not") ?? null,
@@ -9836,7 +9869,8 @@ async function scopeTask(positional, flags, context) {
     }
     // A changed scope on a planning task plans again (v119): say so once, instead of leaving the old plan implied.
     const replanned = (store.lookupRef(id)?.planningGeneration ?? 0) > generationBefore;
-    return succeed(write, json, "task scope", { scope, ...(replanned ? { planningRestarted: true } : {}) }, () => [
+    return succeed(write, json, "task scope", { scope, ...(replanned ? { planningRestarted: true } : {}), ...(releaseNote === null ? {} : { releaseNote }) }, () => [
+        ...(releaseNote === null ? [] : [releaseNote]),
         replanned
             ? `Scope written for ${id}. The scope changed, so planning starts again; nothing builds until somebody approves the new plan.`
             : `Scope written for ${id}. Nothing will build it until somebody approves it.`,
@@ -10059,6 +10093,9 @@ function describeApproveFailure(reason, id) {
         return `you filed ${id}, and this project needs someone else to approve it`;
     if (reason === "person-required")
         return `${id} is protected work: a person has to approve it, not an operating mode, a schedule or a subagent`;
+    // Approval policy, phase 1: the lead's token (or a remote API token) proves a credential, not a person.
+    if (reason === "machine-proof")
+        return "only a person can approve this — approve it on the task page or from your paired chat";
     if (reason === "second-approver")
         return `your approval of ${id} is recorded; it is protected work, so a second person needs to approve it (toolroll task approve ${id} as them)`;
     if (reason === "no-approvers") {

package/dist/person-proof.d.ts

@@ -0,0 +1,2 @@
+/** Whether a recorded proof is a person's. A runtime string: a missing, corrupt or future value is never a person. */
+export declare function personProof(proof: string | null | undefined): boolean;

package/dist/person-proof.js

@@ -0,0 +1,14 @@
+/** Every credential method, classified: a person proved now (or by their own remembered sign-in), or a machine
+ * credential standing in for them. A new method fails to compile here until someone decides which it is. */
+const METHOD_IS_PERSON = {
+    "password-now": true, "sso-now": true, "fresh-password": true, "fresh-sso": true, "session": true, "cli-login": true,
+    "remote-token": false, "lead-token": false,
+};
+/** Proofs that aren't credential methods: the paired-chat tap, and the phone plan's passkey ceremony. */
+const OTHER_PERSON_PROOFS = new Set(["chat", "passkey"]);
+/** Whether a recorded proof is a person's. A runtime string: a missing, corrupt or future value is never a person. */
+export function personProof(proof) {
+    if (typeof proof !== "string")
+        return false;
+    return Object.prototype.hasOwnProperty.call(METHOD_IS_PERSON, proof) ? METHOD_IS_PERSON[proof] : OTHER_PERSON_PROOFS.has(proof);
+}

package/dist/plan-auto.js

@@ -1,7 +1,7 @@
 import { releaseUnattendedRun, reserveUnattendedRun, unattendedGrantStands } from "./flow-unattended.js";
 import { modeTermsFromJson } from "./modes.js";
 import { plannerContractOf, plannerSourceDigest } from "./planner-source.js";
-import { modeFilingCoverage, propose } from "./scope.js";
+import { modeFilingCoverage, propose, quarantinedAuthor } from "./scope.js";
 export const PLAN_AUTO_SCHEMA = `CREATE TABLE IF NOT EXISTS plan_authorization (
   task_id TEXT PRIMARY KEY REFERENCES task(id),
   source_digest TEXT NOT NULL,
@@ -21,7 +21,7 @@ export function applyModeToNewFiling(store, taskId, actor, now) {
     const ref = store.lookupRef(taskId);
     const scope = store.getScope(taskId);
     const coverage = modeFilingCoverage(store, ref?.repo ?? null, actor, now);
-    if (ref === null || scope === null || scope.proposedVia != null || coverage === null)
+    if (ref === null || scope === null || quarantinedAuthor(scope.proposedVia) || coverage === null)
         return;
     const filed = propose(store, { taskId, goal: scope.goal, outOfScope: scope.outOfScope, touches: scope.touches, acceptance: scope.acceptance,
         budgetMicrousd: scope.budgetMicrousd ?? coverage.defaultBudgetMicrousd,
@@ -48,7 +48,7 @@ export function authorizePlanUnderMode(store, taskId, actor, now) {
         if (!source.ok || source.contract.scope === null || source.contract.revision !== null)
             return false;
         const scope = source.contract.scope;
-        if (scope.proposedVia !== null || scope.acceptance.length === 0 || scope.touches.length === 0 || scope.terms.profileState !== "resolved" || store.scopeSealed(taskId))
+        if (quarantinedAuthor(scope.proposedVia) || scope.acceptance.length === 0 || scope.touches.length === 0 || scope.terms.profileState !== "resolved" || store.scopeSealed(taskId))
             return false;
         store.raw().prepare(`INSERT INTO plan_authorization(task_id,source_digest,scope_digest,mode_digest,signed_by,created_at,basis) VALUES (?,?,?,?,?,?,'mode')
       ON CONFLICT(task_id) DO UPDATE SET source_digest=excluded.source_digest,scope_digest=excluded.scope_digest,mode_digest=excluded.mode_digest,signed_by=excluded.signed_by,created_at=excluded.created_at,basis='mode'`)
@@ -72,7 +72,7 @@ function escalatedPosture(store, taskId) {
 export function sealFlowFilingUnderGrant(store, taskId, grant, card, now) {
     const ref = store.lookupRef(taskId);
     const scope = store.getScope(taskId);
-    if (ref === null || scope === null || scope.proposedVia != null || scope.profileState !== "resolved" || escalatedPosture(store, taskId))
+    if (ref === null || scope === null || quarantinedAuthor(scope.proposedVia) || scope.profileState !== "resolved" || escalatedPosture(store, taskId))
         return false;
     if (!unattendedGrantStands(store, grant.digest, grant.signedBy, ref.repo, scope.touches, now))
         return false;

package/dist/planner-source.d.ts

@@ -81,7 +81,7 @@ export type PlannerContractScope = ContractTerms & {
         approvedDigest: string | null;
         approvedBy: string | null;
     };
-    proposedVia: "mate" | "coordinator" | "scout" | null;
+    proposedVia: import("./scope.js").ScopeAuthor | null;
 };
 export type PlannerContract = {
     /** null: no scope was filed — the title is the only filed intent, and

package/dist/project-delete-ui.js

@@ -96,7 +96,7 @@ function checkAccessHtml(view) {
     const setting = unavailable !== null && saved === "sign-ins" ? "sandboxed" : saved;
     const network = view.network?.setting ?? null;
     const names = { sandboxed: "Sandboxed", "sign-ins": "Sandboxed, with model and GitHub sign-ins", unsandboxed: "Not sandboxed" };
-    const meaning = { sandboxed: null, "sign-ins": "Checks can read your Claude, Codex and GitHub sign-ins, and on a Mac your Keychain (any item every program may read).", unsandboxed: "Checks run with your full access to this machine and to Toolroll." };
+    const meaning = { sandboxed: null, "sign-ins": "Checks can read your Claude, Codex and GitHub sign-ins.", unsandboxed: "Checks run with your full access to this machine and to Toolroll." };
     // The sign-ins never widen the network: how many hosts they'd still need, and where to add them (a change of its own).
     const missing = setting === "sign-ins" && network !== null ? signInHostsMissing(network) : [];
     const hosts = missing.length === 0 ? "" : html `<p class="meta" data-sign-in-hosts>${missing.length} sign-in ${missing.length === 1 ? "host isn't" : "hosts aren't"} allowed yet · <a href="#network">Add them</a></p><details class="hosts"><summary>Show hosts</summary><p class="tool-name">${missing.join(", ")}</p></details>`;

package/dist/project-tools.js

@@ -22,6 +22,7 @@
 import { toolRefusal } from "./policy.js";
 import { createHash } from "node:crypto";
 import { spawn } from "node:child_process";
+import { isProtectedEnvName } from "./protected-storage.js";
 import { chmodSync, existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import { realpathSync } from "node:fs";
@@ -572,7 +573,8 @@ function exchangeStdio(spec, values, timeoutMs, base, omit, request, fence) {
         let child;
         try {
             const launch = confined(spec.command, spec.args, { ...(fence ?? {}), temp: env["TMPDIR"] });
-            child = spawn(launch.file, launch.args, { env: { ...env, ...launch.env }, stdio: ["pipe", "pipe", "pipe"], detached: process.platform !== "win32" });
+            // A fenced server gets no chat or vault variable (protected-storage.ts) but the tool's own secrets, set by name.
+            child = spawn(launch.file, launch.args, { env: fence === null ? { ...env, ...launch.env } : { ...Object.fromEntries(Object.entries(env).filter(([name]) => !isProtectedEnvName(name) || Object.hasOwn(values, name))), ...launch.env }, stdio: ["pipe", "pipe", "pipe"], detached: process.platform !== "win32" });
         }
         catch (error) {
             if (error instanceof ContainmentRefusal) {

package/dist/proof.js

@@ -620,6 +620,8 @@ function verificationFailureWords(failure) {
                 return "the retried verification command timed out after automatic recovery";
             case "custody-lost":
                 return "automatic recovery stopped because this worker no longer owned the build";
+            case "coverage-incomplete":
+                return "the release check didn't cover everything it owed, or a required test went missing or was skipped";
             case "timed-out":
                 return "the approved verification command timed out before checks finished";
             case "spawn-failed":

package/dist/protected-storage.d.ts

@@ -0,0 +1,67 @@
+/** One app's storage, relative to the home folder, per platform. */
+export type ProtectedApp = {
+    app: string;
+    darwin: readonly string[];
+    linux: readonly string[];
+};
+/**
+ * Every listed root. Checked against a real Mac (2026-10-25): existence only, never a file's contents. The 1Password
+ * containers and the extra Chrome, Edge and other browsers' folders below were found there and added.
+ */
+export declare const PROTECTED_STORAGE: readonly ProtectedApp[];
+/** The chat and vault variables no launch gets. */
+export declare const PROTECTED_ENV_PREFIXES: readonly string[];
+export declare function isProtectedEnvName(name: string): boolean;
+/** `env` without a chat or vault variable. */
+export declare function withoutProtectedEnv<T extends Record<string, string | undefined>>(env: T): T;
+/** How far the link walk goes in each present root. */
+export declare const PROTECTED_WALK: {
+    readonly depth: 4;
+    readonly entries: 5000;
+};
+/** The roots by name, under the (real) home folder and the overrides the plane's environment names. */
+export declare function protectedStorageNames(home?: string, env?: Readonly<Record<string, string | undefined>>, platform?: NodeJS.Platform): string[];
+/**
+ * Every protected path one launch denies: each root by name and by real path, every link inside a present root that
+ * leads outward (where it leads, by real path and as spelled), and the overrides. Resolved at each launch, never kept.
+ * A link macOS makes in a sandboxed app's container to the same place under the home folder (its Desktop, Downloads,
+ * Fonts…) is the system's own mirror of the person's folders, not the app's data, and isn't followed (systemMirror).
+ *
+ * On a Mac, listing inside another app's container waits for the person to answer macOS's "access data from other apps"
+ * prompt when the process asking has no answer yet (a plane run by launchd: every launch, and the console with it, hung
+ * there in release check 3249). So the containers are walked only after a time-limited look in a child process
+ * (`containers`, containersListable) shows they can be listed without waiting. A look that fails any other way refuses
+ * the launch (it throws). When macOS is waiting on the person, the containers stay denied by name and real path, and
+ * the outward links the last complete walk found (kept in the plane's own state folder, linkCacheFile) stay denied too;
+ * with none kept, only the roots are denied, and that is said once.
+ */
+export declare function protectedStorageDenies(home?: string, env?: Readonly<Record<string, string | undefined>>, platform?: NodeJS.Platform, say?: (line: string) => void, containers?: (roots: readonly string[]) => boolean, list?: (path: string) => import("node:fs").Dirent[]): string[];
+/** How long the look at other apps' containers may take before Toolroll takes it that macOS is waiting on the person. */
+export declare const CONTAINER_LOOK_MS = 3000;
+/** What a look at the containers found: listable without waiting, macOS waiting on the person (the look timed out), or
+ * the look itself failing (it couldn't start, crashed or was killed by anything but its own limit). */
+export type ContainerLook = "listable" | "waiting" | "failed";
+/**
+ * Whether this process can list inside these app containers without macOS stopping to ask the person: the walk run
+ * first in a child process that is killed at CONTAINER_LOOK_MS. Finishing in time (listed, or refused outright) means
+ * the walk can run here too; only running into that limit means macOS is waiting on the person (only the child waited).
+ * A look that fails any other way is tried once more, then throws: the launch is refused rather than fenced with less.
+ * A yes is kept (macOS keeps the person's answer); a no is looked at again after CONTAINER_RELOOK_MS.
+ */
+export declare function containersListable(roots: readonly string[], look?: (roots: readonly string[]) => ContainerLook, now?: () => number): boolean;
+/** A look's outcome from its child's result: only its own limit (ETIMEDOUT) is macOS waiting; any other error, signal
+ * or exit code is a failed look. */
+export declare function lookOutcome(result: {
+    error?: Error;
+    signal: NodeJS.Signals | null;
+    status: number | null;
+}): ContainerLook;
+/** Where the outward links the last complete container walk found are kept: the plane's own state folder (fenced from
+ * every build), one file per user. */
+export declare function linkCacheFile(home: string, env?: Readonly<Record<string, string | undefined>>): string;
+/** The kept links for this home: only a plain file of this user's (no link), at most LINK_CACHE_MAX, of exactly the
+ * kept shape; anything else is no cache at all. */
+export declare function readLinkCache(file: string, home: string): string[] | null;
+/** Keep a complete walk's links: written aside (owner-only) and renamed into place, only into a state folder that is
+ * already there. A failed write keeps whatever was kept before. */
+export declare function writeLinkCache(file: string, home: string, targets: readonly string[]): void;