toolroll 0.9.72 → 0.9.73

package/dist/chat-actions.js

@@ -36,7 +36,7 @@ import { requestUndo, undoFor } from "./subagent-week.js";
 import { kitInstalled, kitOf, KITS, setUpKitNow } from "./kits.js";
 import { starterFlowOf, starterOf, startersFor, starterTerms, STARTER_FLOWS, switchOnStarter } from "./flow-starters.js";
 import { answerSubagentQuestion } from "./subagent-work.js";
-import { callWords, checkRule, defaultRule, grantListed, revokeTool, ruleWords, setToolRules } from "./subagent-tools.js";
+import { callWords, checkRule, defaultRule, grantListed, revokeTool, ruleLoosens, ruleWords, setToolRules } from "./subagent-tools.js";
 import { aboutYouOf, checkAboutYouLine, saveAboutYou, withAboutYouLine } from "./lead-about.js";
 import { CHAT_ACTION_FIELDS, readChatActionRequest, readSharedAction, SHARED_ACTION_VERSION } from "./contracts/chat-actions.js";
 export { CHAT_ACTION_FIELDS };
@@ -441,12 +441,10 @@ export function prepareSharedAction(store, who, operation, input, root, now = ne
                     throw Error(`${project} has no tool called ${tool}.${named.length === 0 ? " Add it on the Tools page first." : ` Its tools: ${named.join(", ")}.`}${uses}`);
                 if (grant !== null)
                     throw Error(`${name} can already use ${tool}.`);
-                const actions = found.lastTest?.tools ?? [];
-                if (actions.length === 0)
+                if ((found.lastTest?.tools ?? []).length === 0)
                     throw Error(`${tool} hasn't said what it can do yet. Test it on the Tools page first.`);
-                state = { rules: "" };
-                title = `Let ${name} use ${tool}`;
-                terms.push(...actions.map(one => `${one}: ${defaultRule({ name: one, readOnly: false }).use === "free" ? "does it" : "asks you first"}`), `${name} asks for each call on its turn; Toolroll makes it by these rules, and every call is kept on the card. Change a rule any time.`);
+                // Giving a subagent a tool takes the person's password (chat-management.md §0a.3), which never goes in chat.
+                throw Error(`Giving ${name} a tool takes your password. Open ${name}'s page in Toolroll, then Tools → Let ${name} use ${tool}.`);
             }
             else if (change === "revoke") {
                 if (grant === null)
@@ -463,6 +461,10 @@ export function prepareSharedAction(store, who, operation, input, root, now = ne
                 const checked = checkRule(grant, action, { use: input["use"], limit, undo: input["undoWith"] ?? grant.rules[action]?.undo ?? "" });
                 if (!checked.ok)
                     throw Error(checked.said);
+                // Letting it do more on its own takes the person's password (chat-management.md §0a.3), never a card.
+                const info = grant.actions.find(one => one.name === action);
+                if (ruleLoosens(grant.rules[action] ?? defaultRule(info), checked.rule))
+                    throw Error(`Letting ${name} do more with ${action} on its own takes your password. Change the rule on ${name}'s page in Toolroll.`);
                 state = { rules: JSON.stringify(grant.rules) };
                 title = `${name}: ${action} — ${ruleWords(checked.rule)}`;
                 terms.push(`${tool} → ${action}: ${ruleWords(checked.rule)}.`, `Was: ${ruleWords(grant.rules[action] ?? { use: "ask" })}.`, ...(checked.rule.undo === undefined ? [] : [`A person can undo it with ${checked.rule.undo}, called with the same input.`]));
@@ -1168,7 +1170,7 @@ export function executeSharedAction(store, who, id, payload, now, options) {
             }
             else if (payload.operation === "kit_setup") {
                 const kit = kitOf(String(req["kit"]));
-                const made = setUpKitNow(store, kit, repo, actor, now, null, true);
+                const made = setUpKitNow(store, kit, repo, actor, now, null);
                 if (!made.ok)
                     throw Error(made.said);
                 return { ok: true, taskId: null, said: `${made.said} Try it with a sample card from its page.`, href: `/kits/${kit.id}?repo=${encodeURIComponent(repo)}` };
@@ -1431,7 +1433,10 @@ function runSubagentAction(store, payload, actor, now) {
         if ((grant === null ? "" : JSON.stringify(grant.rules)) !== payload.state["rules"])
             throw Error("Someone changed its tools since. Ask for a fresh proposal.");
         const found = projectToolsOf(store, mate.repo).find(one => one.name === tool);
-        const done = req["change"] === "grant" ? found === undefined ? { ok: false, said: `There's no tool called ${tool} any more.` } : grantListed(store, mate, found, null, actor, now)
+        // A grant takes the person's password on the subagent's page (chat-management.md §0a.3): never from a card.
+        if (req["change"] === "grant")
+            throw Error("Giving a subagent a tool takes your password. Do it on its page in Toolroll.");
+        const done = req["change"] === "grant" ? found === undefined ? { ok: false, said: `There's no tool called ${tool} any more.` } : grantListed(store, mate, found, null, actor, now, {})
             : req["change"] === "revoke" ? revokeTool(store, mate, tool, actor, now)
                 : setToolRules(store, mate, tool, { [String(req["action"])]: { use: req["use"], limit: req["limitField"] === undefined || req["limitField"] === null || req["limitField"] === "" ? null : { field: req["limitField"], over: req["limitOver"] },
                         undo: req["undoWith"] ?? grant?.rules[String(req["action"])]?.undo ?? "" } }, actor, now);

package/dist/chat-decide.d.ts

@@ -2,6 +2,7 @@ import { DECIDE_ACTS } from "./contracts/chat-callback-rows.js";
 import { type ChatApprovalLimits } from "./chat-approval.js";
 import { type VerifiedApprover } from "./principal.js";
 import type { Scope } from "./scope.js";
+import { type ReleaseCard } from "./release-card.js";
 import type { Store } from "./store.js";
 /** The tokens live in chat_decide_action and the open "What should change?" in chat_decide_prompt (store.ts). */
 export type DecideAct = (typeof DECIDE_ACTS)[number];
@@ -59,11 +60,17 @@ type ActSpec = {
     act: DecideAct;
     run: number | null;
     digest: string;
+    label?: string;
 };
-/** What a card offers: an optional replacement text (the plan card) and rows of acts and links. */
+/** What a card offers: an optional replacement text (the plan card) and rows of acts and links; a release card also
+ * sends its full terms as a file with it (`file`), where the chat app can. */
 export type DecideOffer = {
     text: string | null;
     rows: Array<Array<ActSpec | DecideLink>>;
+    file?: {
+        name: string;
+        text: string;
+    };
 };
 /** What lets this person's chat on `channel` approve on this repository now: their lasting chat-approval setting
  * (chat-approval.ts), or else a live signed mode carrying the chatApprove term, signed by them, that names this chat
@@ -127,12 +134,24 @@ export declare function hasLiveDecideTokens(store: Store, channel: DecideChannel
 export declare function isDecideToken(store: Store, token: string): boolean;
 export type DecideTapOutcome = {
     ack: string;
+    /** A release card's full terms, sent as a file before its Approve is offered (chat apps that limit a message). */
+    file?: {
+        name: string;
+        text: string;
+    };
     /** The card repainted: its text and buttons now. */
     edit?: {
         text: string;
         rows: DecideButton[][];
         tokens: string[];
     };
+    /** With `file`, where the chat app carries the terms only as a file: the card instead of `edit` when the file didn't
+     * arrive. No Approve, a fresh Continue to send it again; the channel drops whichever set it doesn't show. */
+    unsent?: {
+        text: string;
+        rows: DecideButton[][];
+        tokens: string[];
+    };
     /** Ask "What should change?": the person's next message is the feedback. `id` names the prompt, so the channel can
      * record the message it sent (a reply to anything else is not the feedback). */
     prompt?: {
@@ -152,6 +171,33 @@ export type ChatMerge = {
     repo: string;
     via: string;
 };
+/** Where a release card is tapped: the person's binding and the chat the tap came from. */
+export type ReleaseSeat = Pick<DecideSeat, "channel" | "binding" | "chat" | "approver">;
+/**
+ * Whether a release card's tap comes from the person's own private chat with Toolroll (chat-management.md §0a.5), from
+ * the binding's own record, failing closed: Telegram, a private chat (a positive id, which Telegram makes equal to the
+ * user's own id) that is the binding's chat and its user's; Slack, a direct-message channel (D…) that is the binding's.
+ * Any other chat app, a missing chat or binding, or another person's binding is not.
+ */
+export declare function privateReleaseChat(store: Store, seat: ReleaseSeat): boolean;
+/**
+ * A deploy gate this person may approve from this chat now, through its release card: every plain-plan rule
+ * (planInChat: their Approve from chat setting and limits, no coordinator-, lead- or scout-written text, organisation
+ * policy, protected work), never a nightly check, only in their private chat, and the card as the live records say
+ * it now (chat-management.md §0a.5).
+ */
+export declare function releaseInChat(store: Store, taskId: string, approver: string, now: Date, channel: DecideChannel, 
+/** The seat a tap came from, checked strictly; "offer" only where the card is drawn for the binding's own chat (no act). */
+seat: ReleaseSeat | "offer", root?: string): {
+    ok: true;
+    card: ReleaseCard;
+    modeDigest: string;
+    source: "setting" | "mode";
+    scope: Scope;
+} | {
+    ok: false;
+    why: string;
+};
 /** The links a card keeps once its acts are spent or stale: where to look, never a token. */
 export declare function linksFor(target: DecideTarget): DecideButton[][];
 /** Where a plan card's task is now, for a card whose buttons no longer act: the family's current version, named only

package/dist/chat-decide.js

@@ -28,7 +28,8 @@ import { verifyApproverStanding } from "./principal.js";
 import { pullRequestFollowOf } from "./pull-request-flow.js";
 import { requestResultChanges } from "./result-actions.js";
 import { revisionSourceOf } from "./result-review.js";
-import { APPROVAL_PROOF, approvalOf, approvalProofDetail, quarantinedAuthor } from "./scope.js";
+import { APPROVAL_PROOF, approvalOf, approvalProofDetail, deployGateScope, quarantinedAuthor } from "./scope.js";
+import { releaseCardOf } from "./release-card.js";
 import { phoneText } from "./telegram-status.js";
 /** The words, said once. */
 export const DECIDE_LABELS = {
@@ -44,6 +45,7 @@ export const DECIDE_LABELS = {
     cancel: "Cancel",
 };
 const OFFER_TTL_MS = 7 * 86_400_000;
+const CHANNEL_NAMES = { telegram: "Telegram", slack: "Slack", discord: "Discord", teams: "Teams" };
 const CONFIRM_TTL_MS = 10 * 60_000;
 const PROMPT_TTL_MS = 30 * 60_000;
 export const WHAT_SHOULD_CHANGE = "What should change?";
@@ -262,6 +264,30 @@ export function decideOffer(store, target, who, now, channel, root) {
             const plan = planInChat(store, target.taskId, who.name, now, channel, root);
             if (!plan.ok)
                 return null;
+            const release = deployGateScope(plan.scope);
+            // Checks beyond the sandbox seal only on the person's password (store.ts sealScopeApproval): the card says so and
+            // links to the approval in Toolroll, and offers no Continue or Approve that would dead-end. A release or a plan.
+            if (passwordOnlySeal(plan.scope)) {
+                let head;
+                try {
+                    head = release ? releaseCardOf(store, plan.scope, plan.digest, { profile: permissionPlainWords }).short.split("\n").slice(0, 3)
+                        : planCardText(store, target.taskId, plan.scope, root, channel).split("\n").slice(0, 1);
+                }
+                catch {
+                    head = [title(store, target.taskId)];
+                }
+                return { text: [...head, "", needsPassword(plan.scope)].join("\n"), rows: [[{ label: "Approve in Toolroll", path: chatControlHref("approval", target.taskId) }]] };
+            }
+            // A deploy gate is approved from chat only through its release card (chat-management.md §0a.5).
+            if (release) {
+                const release = releaseInChat(store, target.taskId, who.name, now, channel, "offer", root);
+                if (!release.ok)
+                    return null;
+                const card = release.card;
+                return { text: channel === "telegram" ? card.short : `${card.short}\n\n${card.full}`,
+                    rows: [[{ act: "approve", run: null, digest: releaseDigest(card), label: "Continue" }], [{ label: DECIDE_LABELS.edit, path: chatControlHref("approval", target.taskId) }, { act: "not-now", run: null, digest: releaseDigest(card) }]],
+                    ...(channel === "telegram" ? { file: { name: card.fileName, text: card.full } } : {}) };
+            }
             return { text: planCardText(store, target.taskId, plan.scope, root, channel),
                 rows: [[{ act: "approve", run: null, digest: plan.digest }], [{ label: DECIDE_LABELS.edit, path: chatControlHref("approval", target.taskId) }, { act: "not-now", run: null, digest: plan.digest }]] };
         }
@@ -320,7 +346,7 @@ export function mintDecideButtons(store, seat, target, offer, now, message = nul
             return { label: one.label, link: one };
         const token = mint(store, seat, message, one, target.taskId, "offer", now);
         tokens.push(token);
-        return { label: DECIDE_LABELS[one.act], token };
+        return { label: one.label ?? DECIDE_LABELS[one.act], token };
     }));
     return { rows, tokens };
 }
@@ -350,6 +376,66 @@ export function hasLiveDecideTokens(store, channel, chat, message, now) {
 export function isDecideToken(store, token) {
     return token.startsWith("d:") && store.handle.prepare("SELECT 1 FROM chat_decide_action WHERE token = ?").get(token) !== undefined;
 }
+/** A release card's acts carry its card digest (release-card.ts), never a plan's. */
+const RELEASE_DIGEST = "release:";
+/** Why a password-only scope (passwordOnlySeal) isn't approved from chat, for a release or a plan. */
+const needsPassword = (scope) => `This ${deployGateScope(scope) ? "release" : "plan"}'s checks run outside the sandbox, so it's approved in Toolroll with your password.`;
+/** Whether only a person's password ceremony seals this scope (store.ts sealScopeApproval): checks that reach beyond the
+ * sandbox (sign-ins, or none at all) or extra macOS services, sealed into its profile. */
+const passwordOnlySeal = (scope) => {
+    const profile = scope.profile;
+    return profile != null && (profile["checkAccess"] !== undefined || profile["machLookup"] !== undefined);
+};
+const releaseDigest = (card) => `${RELEASE_DIGEST}${card.digest}`;
+/**
+ * Whether a release card's tap comes from the person's own private chat with Toolroll (chat-management.md §0a.5), from
+ * the binding's own record, failing closed: Telegram, a private chat (a positive id, which Telegram makes equal to the
+ * user's own id) that is the binding's chat and its user's; Slack, a direct-message channel (D…) that is the binding's.
+ * Any other chat app, a missing chat or binding, or another person's binding is not.
+ */
+export function privateReleaseChat(store, seat) {
+    const row = store.handle.prepare("SELECT member, channel, approver FROM chat_binding WHERE provider = ? AND id = ? AND revoked IS NULL").get(seat.channel, seat.binding);
+    if (row === undefined || String(row["approver"]) !== seat.approver || seat.chat !== String(row["channel"]))
+        return false;
+    if (seat.channel === "telegram")
+        return /^[1-9][0-9]*$/.test(seat.chat) && seat.chat === String(row["member"]);
+    if (seat.channel === "slack")
+        return /^D[A-Z0-9]+$/.test(seat.chat);
+    return false;
+}
+/**
+ * A deploy gate this person may approve from this chat now, through its release card: every plain-plan rule
+ * (planInChat: their Approve from chat setting and limits, no coordinator-, lead- or scout-written text, organisation
+ * policy, protected work), never a nightly check, only in their private chat, and the card as the live records say
+ * it now (chat-management.md §0a.5).
+ */
+export function releaseInChat(store, taskId, approver, now, channel, 
+/** The seat a tap came from, checked strictly; "offer" only where the card is drawn for the binding's own chat (no act). */
+seat, root) {
+    const plan = planInChat(store, taskId, approver, now, channel, root);
+    if (!plan.ok)
+        return plan;
+    if (!deployGateScope(plan.scope))
+        return { ok: false, why: "This plan isn't a release." };
+    if (passwordOnlySeal(plan.scope))
+        return { ok: false, why: needsPassword(plan.scope) };
+    const ref = store.lookupRef(taskId);
+    if (ref === null || nightlyTaskRef(store, ref.id))
+        return { ok: false, why: NIGHTLY_CHECK_ONLY };
+    if (seat !== "offer" && (seat.channel !== channel || !privateReleaseChat(store, seat)))
+        return { ok: false, why: "A release is approved only in your private chat with Toolroll." };
+    let card;
+    try {
+        card = releaseCardOf(store, plan.scope, plan.digest, { profile: permissionPlainWords });
+    }
+    catch {
+        return { ok: false, why: "This release's terms can't be shown here, so you approve it in Toolroll." };
+    }
+    // What changed is part of what's approved: a list that couldn't be read (or was refused as rewritten history) is no card.
+    if (plan.scope.releaseTerms != null && card.changes.commits === null)
+        return { ok: false, why: "This release's list of changes couldn't be read, so you approve it in Toolroll." };
+    return { ok: true, card, modeDigest: plan.modeDigest, source: plan.source, scope: plan.scope };
+}
 const QUESTIONS = {
     accept: name => `Accept and finish "${name}"?`,
     retry: name => `Retry "${name}"? It queues another attempt.`,
@@ -366,6 +452,24 @@ function targetOf(row) {
     }
 }
 /** Why the card's act no longer applies, or null while it still does — checked at the offer and again at the yes. */
+/**
+ * A release card's terms, then its Approve (Continue, and a release card refreshed after it changed): the full terms
+ * (a file on Telegram, where a message is limited; inline elsewhere), Approve and Cancel bound to this card's digest,
+ * and on Telegram the card to show instead when the file didn't arrive: no Approve, a Continue to send it again.
+ */
+function releaseContinue(store, seat, message, taskId, name, card, now, ack, lead) {
+    const spec = { act: "approve", run: null, digest: releaseDigest(card) };
+    const yes = mint(store, seat, message, spec, taskId, "yes", now);
+    const cancel = mint(store, seat, message, spec, taskId, "cancel", now);
+    const text = `${seat.channel === "telegram" ? card.short : `${card.short}\n\n${card.full}`}${lead === null ? "" : `\n\n${lead}`}`;
+    // Telegram carries the terms only as the file: Approve shows only once that file has arrived (telegram.ts).
+    const again = seat.channel === "telegram" ? mint(store, seat, message, spec, taskId, "offer", now) : null;
+    return { ack, file: { name: card.fileName, text: card.full },
+        edit: { text: `${text}\n\nApprove release "${name}"? This approves exactly these terms${seat.channel === "telegram" ? `, every one in ${card.fileName}` : ""}.`,
+            rows: [[{ label: "Approve", token: yes }, { label: DECIDE_LABELS.cancel, token: cancel }]], tokens: [yes, cancel] },
+        ...(again === null ? {} : { unsent: { text: `${text}\n\nThe terms file didn't arrive, so Approve isn't shown. Tap Continue to send it again.`,
+                rows: [[{ label: "Continue", token: again }]], tokens: [again] } }) };
+}
 function staleWhy(store, row, who, now, channel, root) {
     switch (row.act) {
         case "accept":
@@ -384,9 +488,21 @@ function staleWhy(store, row, who, now, channel, root) {
         }
         case "approve":
         case "not-now": {
+            if (row.digest.startsWith(RELEASE_DIGEST)) {
+                // The button's own seat as it was minted: its binding's chat, checked against the binding's record.
+                const release = releaseInChat(store, row.taskId, who.name, now, channel, { channel, binding: row.binding ?? -1, chat: row.chat ?? "", approver: who.name }, root);
+                if (!release.ok)
+                    return release.why;
+                return releaseDigest(release.card) === row.digest ? null : "This release changed while you were reading.";
+            }
             const plan = planInChat(store, row.taskId, who.name, now, channel, root);
             if (!plan.ok)
                 return plan.why;
+            // A deploy gate's plain plan card never approves it: only its release card does.
+            if (deployGateScope(plan.scope))
+                return "This is a release: approve it from its release card.";
+            if (passwordOnlySeal(plan.scope))
+                return needsPassword(plan.scope);
             return plan.digest === row.digest ? null : "The plan changed since this card was sent.";
         }
         case "merge": {
@@ -427,7 +543,7 @@ export function planWhereNow(store, taskId, who, now, root) {
     }
     return { said: `"${name}" is under way.`, rows: [] };
 }
-const QUESTION_STARTS = ["Accept and finish \"", "Retry \"", "Approve and start \"", "Merge \""];
+const QUESTION_STARTS = ["Accept and finish \"", "Retry \"", "Approve and start \"", "Merge \"", "Approve release "];
 /** The card's words without a question this module appended. */
 function cardBody(shown) {
     const at = shown.lastIndexOf("\n\n");
@@ -484,8 +600,24 @@ export function applyDecideTap(store, seat, input) {
         return { ack: "Cancelled.", edit: { text: offer.text ?? body, ...minted } };
     }
     const why = staleWhy(store, row, who, now, seat.channel, input.root);
-    if (why !== null)
+    if (why !== null) {
+        // A release that changed while it was read: the new card, with fresh buttons, so the person reads it again.
+        // Through the same gate as Continue: the new terms go first (as a file where the chat app limits a message), and
+        // Approve shows only once they arrived; else a Continue to send them again. A release that is now password-only
+        // gets its card with the link to Toolroll.
+        if (row.digest.startsWith(RELEASE_DIGEST) && row.act === "approve" && why === "This release changed while you were reading.") {
+            spend();
+            const release = releaseInChat(store, row.taskId, who.name, now, seat.channel, seat, input.root);
+            if (release.ok)
+                return releaseContinue(store, seat, input.message, row.taskId, name, release.card, now, why, `${why} Here it is now.`);
+            const offer = decideOffer(store, target, who, now, seat.channel, input.root);
+            if (offer !== null && offer.file === undefined) {
+                const minted = mintDecideButtons(store, seat, target, offer, now, input.message);
+                return { ack: why, edit: { text: `${offer.text ?? body}\n\n${why} Here it is now.`, ...minted } };
+            }
+        }
         return stale(why);
+    }
     if (row.phase === "offer") {
         if (row.act === "changes") {
             const id = openDecidePrompt(store, seat, row.taskId, row.run ?? 0, row.digest, now);
@@ -496,6 +628,14 @@ export function applyDecideTap(store, seat, input) {
             return { ack: "Okay, it waits.", edit: { text: `${body}\n\nNot now. It waits for you in Tasks.`,
                     rows: [[{ label: DECIDE_LABELS.edit, link: { label: DECIDE_LABELS.edit, path: chatControlHref("approval", row.taskId) } }]], tokens: [] } };
         }
+        // A release card's Continue: the card again from the live records, its full terms as a file, then Approve.
+        if (row.act === "approve" && row.digest.startsWith(RELEASE_DIGEST)) {
+            const release = releaseInChat(store, row.taskId, who.name, now, seat.channel, seat, input.root);
+            if (!release.ok)
+                return stale(release.why);
+            spend();
+            return releaseContinue(store, seat, input.message, row.taskId, name, release.card, now, "Read the terms, then approve.", null);
+        }
         // The first tap asks; only the yes acts, bound to exactly what this button was.
         spend();
         const spec = { act: row.act, run: row.run, digest: row.digest };
@@ -521,9 +661,35 @@ export function applyDecideTap(store, seat, input) {
             return retried.ok ? done("✓ Queued again. Existing approvals and holds still apply.") : notDone(retried.message);
         }
         case "approve": {
+            if (row.digest.startsWith(RELEASE_DIGEST)) {
+                const release = releaseInChat(store, row.taskId, who.name, now, seat.channel, seat, input.root);
+                if (!release.ok)
+                    return notDone(release.why);
+                const cardDigest = release.card.digest;
+                // The seal knows which card it came from: a chat seal of a deploy gate needs this evidence (store.ts).
+                if (!store.sealScopeApproval(row.taskId, who.name, now, {}, { kind: "chat", modeDigest: release.modeDigest, card: "release", cardDigest }))
+                    return notDone("the release couldn't be approved from chat. Open it in Toolroll.");
+                const sealedDigest = store.getScope(row.taskId)?.approvedDigest ?? "";
+                store.recordAction({ at: now.toISOString(), actor: who.name, repo: ref.repo, taskId: row.taskId, runId: null, action: APPROVAL_PROOF, outcome: "chat", source: "request",
+                    detail: JSON.stringify({ v: 1, at: now.toISOString(), generation: store.accountOf(who.name)?.generation ?? 0, digest: sealedDigest, card: "release", cardDigest }) });
+                const where = `${CHANNEL_NAMES[seat.channel]} · chat binding #${seat.binding}`;
+                store.recordAction({ at: now.toISOString(), actor: who.name, repo: ref.repo, taskId: row.taskId, runId: null, action: "release approved in chat", outcome: "approved",
+                    source: "request", detail: `via ${where} · ${release.source} ${release.modeDigest} · card ${cardDigest}` });
+                // Said everywhere the person hears from Toolroll (their other chats and push), naming the chat it came from.
+                const terms = release.scope.releaseTerms ?? null;
+                store.enqueueNotification({ dedupeKey: `release-approved-chat:${row.taskId}:${cardDigest}`, kind: "release-approved", recipient: who.name, pushClass: "attention",
+                    subject: `Release${terms === null ? "" : ` ${terms.packageVersion}`} approved from ${CHANNEL_NAMES[seat.channel]}`,
+                    body: `You approved "${name}"${terms === null ? "" : ` (${terms.approvedSha.slice(0, 7)}, pull request #${terms.pr})`} from ${CHANNEL_NAMES[seat.channel]}. If that wasn't you, stop it in Toolroll now.`,
+                    link: chatControlHref("task", row.taskId), source: { taskRef: ref.id } }, now);
+                return done("✓ Release approved. It deploys when its check passes and someone runs the release.");
+            }
             const plan = planInChat(store, row.taskId, who.name, now, seat.channel, input.root);
             if (!plan.ok)
                 return notDone(plan.why);
+            if (deployGateScope(plan.scope))
+                return notDone("This is a release: approve it from its release card.");
+            if (passwordOnlySeal(plan.scope))
+                return notDone(needsPassword(plan.scope));
             // The owner's own yes, sealed as theirs ("chat"), never as a mode's: it stands like the console's after the mode or setting ends.
             if (!store.sealScopeApproval(row.taskId, who.name, now, {}, { kind: "chat", modeDigest: plan.modeDigest }))
                 return notDone("the plan couldn't be approved from chat. Open it in Toolroll.");

package/dist/check-report.js

@@ -127,7 +127,8 @@ export function prepareCheckAttempt(store, root, input, now) {
         planDigest: plan === null ? null : payloadDigest(plan), snapshotDigest: snapshot === null ? null : payloadDigest(snapshot),
         inventoryDigest: payloadDigest(inventory), contextDigest: payloadDigest(context), nonceHash: sha256(nonce),
     }, now);
-    const stdin = JSON.stringify({ nonce, mode, plan, watch: [...(input.watch ?? [])] });
+    // The command's own limit rides along, so the check ends itself (logs and report printed) before the plane stops it.
+    const stdin = JSON.stringify({ nonce, mode, plan, watch: [...(input.watch ?? [])], limitMs: input.command.timeoutMs });
     return { runId: input.runId, nonce, stdin, mode, inventory, context, plan, snapshot, watch: [...(input.watch ?? [])] };
 }
 /** Seal one JSON payload as a structured-output artifact under its capture label. */

package/dist/coding-provider.js

@@ -10,6 +10,7 @@ import { createContainer, currentContainment } from "./containment.js";
 import { processMayBeAlive } from "./process-liveness.js";
 import { observeProcessTree, sampleProcessTree, stopProcessTree } from "./process-tree.js";
 import { isOwnEnv } from "./names.js";
+import { isProtectedEnvName } from "./protected-storage.js";
 import { sleep } from "./sleep.js";
 /** A response from the server, distinct from an ambiguous transport failure. */
 export class CodingProviderRequestError extends Error {
@@ -54,8 +55,9 @@ export function codingEnvironment() {
         // Preserve native Codex auth, HOME, PATH, CODEX_HOME and project config.
         // A parent desktop session's control pipe and identity do not belong to
         // this independent native client. Keep install/runtime paths such as
-        // CODEX_MCP_NODE_PATH. Service credentials stay with the web service.
-        if (isOwnEnv(key) || /^(TELEGRAM|SLACK|DISCORD)_.*(TOKEN|SECRET|KEY)$/i.test(key) || /^CODEX_APP_TOOLS_/.test(key) || invokingSession.has(key) || key === "NODE_OPTIONS" || key === "NODE_PATH")
+        // CODEX_MCP_NODE_PATH. Service credentials stay with the web service; no chat or vault variable reaches it
+        // (protected-storage.ts).
+        if (isOwnEnv(key) || isProtectedEnvName(key) || /^CODEX_APP_TOOLS_/.test(key) || invokingSession.has(key) || key === "NODE_OPTIONS" || key === "NODE_PATH")
             delete env[key];
     }
     return env;

package/dist/commit-extract.d.ts

@@ -60,6 +60,12 @@ export type Verified<T> = {
     ok: false;
     message: string;
 };
+/** Which Git runs and with what environment: the release path's fixed absolute Git and its own environment, or by
+ * default the checkout Git environment's. The hardening settings are added over either. */
+export type GitRunner = {
+    git?: string;
+    env?: NodeJS.ProcessEnv;
+};
 /** One commit, hashed here and parsed from its own bytes. */
 export declare function readVerifiedCommit(gitDir: string, sha: string): Verified<VerifiedCommit>;
 /**
@@ -91,4 +97,15 @@ export declare function verifiedBlobs(gitDir: string, tree: string, paths: reado
     id: string;
     bytes: Buffer;
 }>>;
+/**
+ * The commits reachable from `to` and not from `from`, as Git lists them (newest first), each read from its own verified
+ * bytes: what a release card says changed (release-card.ts). Git only names them. Each is hashed here and its parents
+ * checked against Git's listing; every commit the range stops at (a parent outside it) must be reached from `from`
+ * through verified parents within `reach` commits, so history a build rewrote around the objects can't shorten the
+ * list. A shallow boundary, grafts or replacement refs refuse (verifiedReader), as does a range longer than `max`.
+ */
+export declare function verifiedRange(gitDir: string, from: string, to: string, options?: GitRunner & {
+    max?: number;
+    reach?: number;
+}): Verified<VerifiedCommit[]>;
 export {};

package/dist/commit-extract.js

@@ -167,10 +167,11 @@ export function extractCommit(gitDir, sha, dest, limits = EXTRACTION_LIMITS) {
     return { ok: true, files: files.length };
 }
 /** A reader over the project's object store that hashes every object it hands back, or why it can't be one. */
-function verifiedReader(gitDir) {
+function verifiedReader(gitDir, runner = {}) {
     const refuse = (message) => ({ ok: false, message });
-    const env = { ...checkoutGitEnv(), GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", GIT_NO_REPLACE_OBJECTS: "1", GIT_NO_LAZY_FETCH: "1", GIT_ATTR_NOSYSTEM: "1" };
-    const git = (args, input) => spawnSync("git", ["--git-dir", gitDir, "--no-replace-objects", ...HARDENED_GIT_ARGS, ...args], { env, input, maxBuffer: MAX_BYTES, timeout: 300_000 });
+    const env = { ...(runner.env ?? checkoutGitEnv()), GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", GIT_NO_REPLACE_OBJECTS: "1", GIT_NO_LAZY_FETCH: "1", GIT_ATTR_NOSYSTEM: "1" };
+    // The commit-graph file is a cache a build can write: parents come from the objects themselves, never from it.
+    const git = (args, input) => spawnSync(runner.git ?? "git", ["--git-dir", gitDir, "--no-replace-objects", ...HARDENED_GIT_ARGS, "-c", "core.commitGraph=false", ...args], { cwd: "/", env, input, maxBuffer: MAX_BYTES, timeout: 300_000 });
     // History a build could have rewritten around the objects: a shallow boundary, grafts, or replacement refs. Each is
     // refused outright, so no reader here ever has to decide whether to believe one.
     if (existsSync(join(gitDir, "shallow")))
@@ -221,7 +222,7 @@ function verifiedReader(gitDir) {
         }
         return found;
     };
-    return { ok: true, value: { format, hexLength, read } };
+    return { ok: true, value: { format, hexLength, read, git } };
 }
 /** Parse a commit from its verified bytes: tree, parents, message. Null when malformed. */
 function parseCommit(id, bytes, hexLength) {
@@ -434,3 +435,80 @@ export function verifiedBlobs(gitDir, tree, paths) {
         return { ok: false, message: `A file couldn't be verified: ${blobs}.` };
     return { ok: true, value: new Map(wanted.map(one => [one.path, { id: one.id, bytes: blobs.get(one.id).bytes }])) };
 }
+/**
+ * The commits reachable from `to` and not from `from`, as Git lists them (newest first), each read from its own verified
+ * bytes: what a release card says changed (release-card.ts). Git only names them. Each is hashed here and its parents
+ * checked against Git's listing; every commit the range stops at (a parent outside it) must be reached from `from`
+ * through verified parents within `reach` commits, so history a build rewrote around the objects can't shorten the
+ * list. A shallow boundary, grafts or replacement refs refuse (verifiedReader), as does a range longer than `max`.
+ */
+export function verifiedRange(gitDir, from, to, options = {}) {
+    const { max = 1_000, reach = 5_000 } = options;
+    const reader = verifiedReader(gitDir, options);
+    if (!reader.ok)
+        return reader;
+    const { git, read, hexLength } = reader.value;
+    const id = new RegExp(`^[0-9a-f]{${hexLength}}$`);
+    if (!id.test(from) || !id.test(to))
+        return { ok: false, message: "A commit id isn't a full id." };
+    /** Git's listing: each line's commit (`-` marks a boundary) and the parents it names. */
+    const listing = (args) => {
+        const listed = git(["rev-list", "--parents", ...args]);
+        if (listed.status !== 0)
+            return null;
+        const rows = String(listed.stdout).split("\n").filter(line => line !== "").map(line => {
+            const [first = "", ...parents] = line.split(" ");
+            return { id: first.replace(/^-/, ""), boundary: first.startsWith("-"), parents };
+        });
+        return rows.every(row => id.test(row.id) && row.parents.every(one => id.test(one))) ? rows : null;
+    };
+    const range = listing(["--boundary", `${from}..${to}`, "--"]);
+    if (range === null)
+        return { ok: false, message: "The commits between the releases couldn't be listed." };
+    const inside = range.filter(row => !row.boundary), stops = new Set(range.filter(row => row.boundary).map(row => row.id));
+    if (inside.length > max)
+        return { ok: false, message: `More than ${max} commits lie between the releases.` };
+    const objects = read(inside.map(row => row.id));
+    if (typeof objects === "string")
+        return { ok: false, message: `A commit couldn't be verified: ${objects}.` };
+    const listed = new Set(inside.map(row => row.id));
+    const commits = [];
+    for (const row of inside) {
+        const object = objects.get(row.id);
+        const commit = object.type === "commit" ? parseCommit(row.id, object.bytes, hexLength) : null;
+        if (commit === null)
+            return { ok: false, message: `${row.id.slice(0, 7)} isn't a commit.` };
+        // Git's parents must be the commit's own, and each one inside the range or where it stops.
+        if (commit.parents.join(" ") !== row.parents.join(" "))
+            return { ok: false, message: `Git's history of ${row.id.slice(0, 7)} isn't its own.` };
+        if (commit.parents.some(parent => !listed.has(parent) && !stops.has(parent)))
+            return { ok: false, message: `The history of ${row.id.slice(0, 7)} is incomplete.` };
+        commits.push(commit);
+    }
+    if (inside.length > 0 && !listed.has(to))
+        return { ok: false, message: `${to.slice(0, 7)} isn't in its own range.` };
+    // Where the range stops: each must be `from` or one of its verified ancestors. An empty range says `to` is already in
+    // the last release: that too is proved, never taken from Git's listing.
+    const wanted = [...stops, ...(inside.length === 0 ? [to] : [])].filter(one => one !== from);
+    if (wanted.length === 0)
+        return { ok: true, value: commits };
+    const before = listing([`--max-count=${reach}`, from, "--"]);
+    if (before === null)
+        return { ok: false, message: "The last release's history couldn't be listed." };
+    const ancestry = read(before.map(row => row.id));
+    if (typeof ancestry === "string")
+        return { ok: false, message: `The last release's history couldn't be verified: ${ancestry}.` };
+    const reached = new Set([from]);
+    const queue = [from];
+    while (queue.length > 0) {
+        const object = ancestry.get(queue.shift());
+        const commit = object === undefined || object.type !== "commit" ? null : parseCommit("", object.bytes, hexLength);
+        for (const parent of commit?.parents ?? [])
+            if (!reached.has(parent)) {
+                reached.add(parent);
+                queue.push(parent);
+            }
+    }
+    const unreached = wanted.find(one => !reached.has(one));
+    return unreached === undefined ? { ok: true, value: commits } : { ok: false, message: `${unreached.slice(0, 7)} isn't verified as part of the last release's history.` };
+}

package/dist/contracts/console-api.d.ts

@@ -75,8 +75,8 @@ export declare const CONSOLE_FORMS: {
     readonly term: FormContract<"password" | "program" | "repo">;
     readonly skillsRevise: FormContract<"feedback" | "nonce" | "repo" | "run">;
     readonly skillsChange: FormContract<"action" | "content" | "files" | "identity" | "method" | "nonce" | "repo" | "restore" | "revision" | "sample" | "sha" | "url">;
-    readonly kit: FormContract<"repo">;
-    readonly subagents: FormContract<"choice" | "dailyTurns" | "id" | "manager" | "model" | "name" | "note" | "op" | "repo" | "schedule" | "soul" | "state" | "template" | "text" | "tool" | `field.${string}` | `over.${string}` | `undo.${string}` | `use.${string}`>;
+    readonly kit: FormContract<"password" | "repo">;
+    readonly subagents: FormContract<"choice" | "dailyTurns" | "id" | "manager" | "model" | "name" | "note" | "op" | "password" | "repo" | "schedule" | "soul" | "state" | "template" | "text" | "tool" | `field.${string}` | `over.${string}` | `undo.${string}` | `use.${string}`>;
     readonly galleryUse: FormContract<string>;
     readonly flows: FormContract<"about" | "address" | "answers" | "approve" | "body" | "budget" | "choice" | "confirm" | "days" | "decision" | "definition" | "description" | "document" | "draft" | "entry" | "file" | "include" | "key" | "label" | "language" | "name" | "note" | "owner" | "password" | "previewed" | "project" | "remove" | "repo" | "revision" | "runs" | "schedules" | "secret" | "sender" | "stage" | "team" | "template" | "timeoutMinutes" | "title" | "trigger" | "url" | "value" | "watching" | `param.${string}`>;
     readonly spendBudget: FormContract<"action" | "password" | "stop" | "target" | "usd">;
@@ -118,7 +118,7 @@ export declare const CONSOLE_FORMS: {
     readonly teams: FormContract<"app-id" | "password" | "secret" | "tenant">;
     readonly discord: FormContract<"bot-token" | "password">;
     readonly messaging: FormContract<"primary">;
-    readonly permissionDefault: FormContract<"permission-mode">;
+    readonly permissionDefault: FormContract<"password" | "permission-mode">;
     readonly qualityDefault: FormContract<"quality-mode">;
     readonly notifications: FormContract<"digest" | "mode" | "screenshots">;
     readonly notificationsMute: FormContract<"pings" | "repo">;

package/dist/contracts/console-api.js

@@ -84,9 +84,9 @@ export const CONSOLE_FORMS = {
     term: formContract("POST /term/start, /term/<terminal>/close, /term/<terminal>/remove", ["repo", "program", "password"]),
     skillsRevise: formContract("POST /settings/skills/revise", ["run", "repo", "feedback", "nonce"]),
     skillsChange: formContract("POST /settings/skills/import, /settings/skills/change", ["repo", "identity", "revision", "method", "content", "files", "url", "action", "sha", "sample", "nonce", "restore"]),
-    kit: formContract("POST /kits/<kit>/<act>", ["repo"]),
-    subagents: formContract("POST /settings/lead/subagents/new, /settings/lead/subagents/<id>/<part>, /settings/lead/subagents/questions/<id>/answer", ["choice", "text", "repo", "template", "name", "soul", "op", "id", "schedule", "tool", "state", "note", "model", "dailyTurns", "manager"], { prefixes: ["use.", "undo.", "field.", "over."] }),
-    galleryUse: formContract("POST /flows/new/<template>", ["repo", "send-result", "name", "intent", "previewed"], { dynamic: true }),
+    kit: formContract("POST /kits/<kit>/<act>", ["repo", "password"]),
+    subagents: formContract("POST /settings/lead/subagents/new, /settings/lead/subagents/<id>/<part>, /settings/lead/subagents/questions/<id>/answer", ["choice", "text", "repo", "template", "name", "soul", "op", "id", "schedule", "tool", "state", "note", "model", "dailyTurns", "manager", "password"], { prefixes: ["use.", "undo.", "field.", "over."] }),
+    galleryUse: formContract("POST /flows/new/<template>", ["repo", "send-result", "name", "intent", "previewed", "password"], { dynamic: true }),
     flows: formContract("POST /flows/new, /flows/example, /flows/import, /flows/<id>/<act>, /flows/<id>/cards/<card>/<act>, /flows/<id>/triggers/<trigger>/<act>", ["repo", "document", "url", "confirm", "previewed", "template", "name", "answers", "password", "secret", "sender", "project", "team", "trigger", "approve", "remove", "about", "body", "timeoutMinutes", "language", "file", "address", "key", "definition", "owner", "revision", "value", "title", "description", "stage", "decision", "note", "draft", "choice", "entry", "label", "watching", "days", "budget", "runs", "include", "schedules"], { prefixes: ["param."] }),
     spendBudget: formContract("POST /spend/budget", ["password", "target", "action", "usd", "stop"]),
     projectConcurrency: formContract("POST /settings/project/concurrency", ["repo", "concurrency"]),
@@ -127,7 +127,7 @@ export const CONSOLE_FORMS = {
     teams: formContract("POST /settings/teams/connect|pair|unpair|disconnect|alerts", ["password", "app-id", "tenant", "secret"]),
     discord: formContract("POST /settings/discord/connect|pair|unpair|disconnect|alerts", ["password", "bot-token"]),
     messaging: formContract("POST /settings/messaging", ["primary"]),
-    permissionDefault: formContract("POST /settings/permission-default", ["permission-mode"]),
+    permissionDefault: formContract("POST /settings/permission-default", ["permission-mode", "password"]),
     qualityDefault: formContract("POST /settings/quality-default", ["quality-mode"]),
     notifications: formContract("POST /settings/notifications", ["mode", "digest", "screenshots"]),
     notificationsMute: formContract("POST /settings/notifications/mute", ["repo", "pings"]),