toolroll 0.9.72 → 0.9.74

package/dist/browser-workspace.d.ts

@@ -211,6 +211,10 @@ export type BrowserTasksView = {
     newTask: BrowserLink;
     /** v105: subscription windows and monthly budgets, one tile each (an instance operator's; null when there are none). */
     limits: BrowserLimits | null;
+    /** The stored-state filter (Any state, Queued, Running, Done, Failed, Cancelled), each a real link starting on page one. */
+    states?: (BrowserLink & {
+        active: boolean;
+    })[];
 };
 /** One limit: a plan's usage window ("Claude · 5-hour, 48%") or a monthly budget ("shop · Budget, $4.20 of $10"). */
 export type BrowserTaskGroup = WorkIndexGroup;
@@ -1445,6 +1449,8 @@ export type BrowserAgentsView = {
     selected: BrowserAgentDetail | null;
     /** Shown when nothing is on the board. */
     empty: string | null;
+    /** The Live grid (?view=live): every running agent's live output, watching only. */
+    live?: boolean;
 };
 export type BrowserView = BrowserTasksView | BrowserSettingsView | BrowserTaskView | BrowserProjectsView | BrowserResultView | BrowserFlowView | BrowserAgentsView;
 export type BrowserWorkspace = {

package/dist/builder.js

@@ -1240,7 +1240,7 @@ export async function build(store, request) {
     // Every streaming transport emits events now (peek); a file that cannot
     // open is a null, and a null never costs a build.
     // What the agent did last rides the same stream into one row (live tasks).
-    const liveLog = withAgentTurns(withRunActivity(openLiveLog(root, request.runId, liveLogContext(store, taskRef, worktree)), store, request.runId, clock), (state, at) => { if (attemptKey !== null)
+    const liveLog = withAgentTurns(withRunActivity(openLiveLog(root, request.runId, liveLogContext(store, request.runId, taskRef, worktree, clock())), store, request.runId, clock), (state, at) => { if (attemptKey !== null)
         recordAgentTurn(store, { run: request.runId, attemptKey, state, at }); }, clock, (open, at) => { if (attemptKey !== null)
         noteOpenTool(store, request.runId, attemptKey, open, at); });
     // The retry base (steering fix for run 1465's proof): the SAME pinned

package/dist/chat-actions.js

@@ -36,7 +36,7 @@ import { requestUndo, undoFor } from "./subagent-week.js";
 import { kitInstalled, kitOf, KITS, setUpKitNow } from "./kits.js";
 import { starterFlowOf, starterOf, startersFor, starterTerms, STARTER_FLOWS, switchOnStarter } from "./flow-starters.js";
 import { answerSubagentQuestion } from "./subagent-work.js";
-import { callWords, checkRule, defaultRule, grantListed, revokeTool, ruleWords, setToolRules } from "./subagent-tools.js";
+import { callWords, checkRule, defaultRule, grantListed, revokeTool, ruleLoosens, ruleWords, setToolRules } from "./subagent-tools.js";
 import { aboutYouOf, checkAboutYouLine, saveAboutYou, withAboutYouLine } from "./lead-about.js";
 import { CHAT_ACTION_FIELDS, readChatActionRequest, readSharedAction, SHARED_ACTION_VERSION } from "./contracts/chat-actions.js";
 export { CHAT_ACTION_FIELDS };
@@ -441,12 +441,10 @@ export function prepareSharedAction(store, who, operation, input, root, now = ne
                     throw Error(`${project} has no tool called ${tool}.${named.length === 0 ? " Add it on the Tools page first." : ` Its tools: ${named.join(", ")}.`}${uses}`);
                 if (grant !== null)
                     throw Error(`${name} can already use ${tool}.`);
-                const actions = found.lastTest?.tools ?? [];
-                if (actions.length === 0)
+                if ((found.lastTest?.tools ?? []).length === 0)
                     throw Error(`${tool} hasn't said what it can do yet. Test it on the Tools page first.`);
-                state = { rules: "" };
-                title = `Let ${name} use ${tool}`;
-                terms.push(...actions.map(one => `${one}: ${defaultRule({ name: one, readOnly: false }).use === "free" ? "does it" : "asks you first"}`), `${name} asks for each call on its turn; Toolroll makes it by these rules, and every call is kept on the card. Change a rule any time.`);
+                // Giving a subagent a tool takes the person's password (chat-management.md §0a.3), which never goes in chat.
+                throw Error(`Giving ${name} a tool takes your password. Open ${name}'s page in Toolroll, then Tools → Let ${name} use ${tool}.`);
             }
             else if (change === "revoke") {
                 if (grant === null)
@@ -463,6 +461,10 @@ export function prepareSharedAction(store, who, operation, input, root, now = ne
                 const checked = checkRule(grant, action, { use: input["use"], limit, undo: input["undoWith"] ?? grant.rules[action]?.undo ?? "" });
                 if (!checked.ok)
                     throw Error(checked.said);
+                // Letting it do more on its own takes the person's password (chat-management.md §0a.3), never a card.
+                const info = grant.actions.find(one => one.name === action);
+                if (ruleLoosens(grant.rules[action] ?? defaultRule(info), checked.rule))
+                    throw Error(`Letting ${name} do more with ${action} on its own takes your password. Change the rule on ${name}'s page in Toolroll.`);
                 state = { rules: JSON.stringify(grant.rules) };
                 title = `${name}: ${action} — ${ruleWords(checked.rule)}`;
                 terms.push(`${tool} → ${action}: ${ruleWords(checked.rule)}.`, `Was: ${ruleWords(grant.rules[action] ?? { use: "ask" })}.`, ...(checked.rule.undo === undefined ? [] : [`A person can undo it with ${checked.rule.undo}, called with the same input.`]));
@@ -1168,7 +1170,7 @@ export function executeSharedAction(store, who, id, payload, now, options) {
             }
             else if (payload.operation === "kit_setup") {
                 const kit = kitOf(String(req["kit"]));
-                const made = setUpKitNow(store, kit, repo, actor, now, null, true);
+                const made = setUpKitNow(store, kit, repo, actor, now, null);
                 if (!made.ok)
                     throw Error(made.said);
                 return { ok: true, taskId: null, said: `${made.said} Try it with a sample card from its page.`, href: `/kits/${kit.id}?repo=${encodeURIComponent(repo)}` };
@@ -1431,7 +1433,10 @@ function runSubagentAction(store, payload, actor, now) {
         if ((grant === null ? "" : JSON.stringify(grant.rules)) !== payload.state["rules"])
             throw Error("Someone changed its tools since. Ask for a fresh proposal.");
         const found = projectToolsOf(store, mate.repo).find(one => one.name === tool);
-        const done = req["change"] === "grant" ? found === undefined ? { ok: false, said: `There's no tool called ${tool} any more.` } : grantListed(store, mate, found, null, actor, now)
+        // A grant takes the person's password on the subagent's page (chat-management.md §0a.3): never from a card.
+        if (req["change"] === "grant")
+            throw Error("Giving a subagent a tool takes your password. Do it on its page in Toolroll.");
+        const done = req["change"] === "grant" ? found === undefined ? { ok: false, said: `There's no tool called ${tool} any more.` } : grantListed(store, mate, found, null, actor, now, {})
             : req["change"] === "revoke" ? revokeTool(store, mate, tool, actor, now)
                 : setToolRules(store, mate, tool, { [String(req["action"])]: { use: req["use"], limit: req["limitField"] === undefined || req["limitField"] === null || req["limitField"] === "" ? null : { field: req["limitField"], over: req["limitOver"] },
                         undo: req["undoWith"] ?? grant?.rules[String(req["action"])]?.undo ?? "" } }, actor, now);

package/dist/chat-continuity.js

@@ -125,6 +125,8 @@ export const CHAT_CONTINUITY_SCRIPT = String.raw `
         if(got===null)return;
         var data=got.data||{};
         if(data.ok===true){
+          // A conversation shown before it existed (session 0) is started by its first send: that is this one.
+          if(session==='0'&&typeof data.session==='number'&&data.session>0)adopt(String(data.session));
           if(String(data.session)!==session){changed();return;}
           say(data.queued===true?'Queued. It goes to the lead after the reply in progress.':'Sent. Waiting for the reply…');later(300);return;
         }
@@ -273,6 +275,9 @@ export const CHAT_CONTINUITY_SCRIPT = String.raw `
     }
     return true;
   }
+  // The conversation this page's first send started: its binding and its draft move to it (a reload restores from there).
+  function adopt(started){session=started;document.querySelectorAll('form[action="/chat"] [name="request-session"]').forEach(function(bound){bound.value=started;});
+    try{sessionStorage.removeItem(key);}catch(e){}key='standing-orders:chat-draft:'+session+':'+task;save();}
   function later(ms){if(stale)return;clearTimeout(timer);timer=setTimeout(check,ms);}
   async function check(){
     if(polling||stale)return;
@@ -289,6 +294,11 @@ export const CHAT_CONTINUITY_SCRIPT = String.raw `
       if(!r.ok)throw new Error('connection');
       var data=await r.json();
       if(!valid(data))throw new Error('response');
+      // Not started yet (session 0): only this send's own receipt in the started conversation proves it is the one.
+      if(session==='0'&&typeof data.session==='number'&&data.session>0&&asked&&data.received===true)adopt(String(data.session));
+      // A poll that lands while the first send is on its way decides nothing: that send's answer (or the poll it
+      // asks for afterwards, with its request) says whether the started conversation is this page's.
+      if(session==='0'&&sending&&data.session!==null&&String(data.session)!=='0'){later(1000);return;}
       if(data.session===null||String(data.session)!==session){changed();return;}
       // A late answer for another lens never lands here; the poll goes on.
       if(data.task!==task){later(5000);return;}

package/dist/chat-decide.d.ts

@@ -2,6 +2,7 @@ import { DECIDE_ACTS } from "./contracts/chat-callback-rows.js";
 import { type ChatApprovalLimits } from "./chat-approval.js";
 import { type VerifiedApprover } from "./principal.js";
 import type { Scope } from "./scope.js";
+import { type ReleaseCard } from "./release-card.js";
 import type { Store } from "./store.js";
 /** The tokens live in chat_decide_action and the open "What should change?" in chat_decide_prompt (store.ts). */
 export type DecideAct = (typeof DECIDE_ACTS)[number];
@@ -59,11 +60,17 @@ type ActSpec = {
     act: DecideAct;
     run: number | null;
     digest: string;
+    label?: string;
 };
-/** What a card offers: an optional replacement text (the plan card) and rows of acts and links. */
+/** What a card offers: an optional replacement text (the plan card) and rows of acts and links; a release card also
+ * sends its full terms as a file with it (`file`), where the chat app can. */
 export type DecideOffer = {
     text: string | null;
     rows: Array<Array<ActSpec | DecideLink>>;
+    file?: {
+        name: string;
+        text: string;
+    };
 };
 /** What lets this person's chat on `channel` approve on this repository now: their lasting chat-approval setting
  * (chat-approval.ts), or else a live signed mode carrying the chatApprove term, signed by them, that names this chat
@@ -127,12 +134,24 @@ export declare function hasLiveDecideTokens(store: Store, channel: DecideChannel
 export declare function isDecideToken(store: Store, token: string): boolean;
 export type DecideTapOutcome = {
     ack: string;
+    /** A release card's full terms, sent as a file before its Approve is offered (chat apps that limit a message). */
+    file?: {
+        name: string;
+        text: string;
+    };
     /** The card repainted: its text and buttons now. */
     edit?: {
         text: string;
         rows: DecideButton[][];
         tokens: string[];
     };
+    /** With `file`, where the chat app carries the terms only as a file: the card instead of `edit` when the file didn't
+     * arrive. No Approve, a fresh Continue to send it again; the channel drops whichever set it doesn't show. */
+    unsent?: {
+        text: string;
+        rows: DecideButton[][];
+        tokens: string[];
+    };
     /** Ask "What should change?": the person's next message is the feedback. `id` names the prompt, so the channel can
      * record the message it sent (a reply to anything else is not the feedback). */
     prompt?: {
@@ -152,6 +171,33 @@ export type ChatMerge = {
     repo: string;
     via: string;
 };
+/** Where a release card is tapped: the person's binding and the chat the tap came from. */
+export type ReleaseSeat = Pick<DecideSeat, "channel" | "binding" | "chat" | "approver">;
+/**
+ * Whether a release card's tap comes from the person's own private chat with Toolroll (chat-management.md §0a.5), from
+ * the binding's own record, failing closed: Telegram, a private chat (a positive id, which Telegram makes equal to the
+ * user's own id) that is the binding's chat and its user's; Slack, a direct-message channel (D…) that is the binding's.
+ * Any other chat app, a missing chat or binding, or another person's binding is not.
+ */
+export declare function privateReleaseChat(store: Store, seat: ReleaseSeat): boolean;
+/**
+ * A deploy gate this person may approve from this chat now, through its release card: every plain-plan rule
+ * (planInChat: their Approve from chat setting and limits, no coordinator-, lead- or scout-written text, organisation
+ * policy, protected work), never a nightly check, only in their private chat, and the card as the live records say
+ * it now (chat-management.md §0a.5).
+ */
+export declare function releaseInChat(store: Store, taskId: string, approver: string, now: Date, channel: DecideChannel, 
+/** The seat a tap came from, checked strictly; "offer" only where the card is drawn for the binding's own chat (no act). */
+seat: ReleaseSeat | "offer", root?: string): {
+    ok: true;
+    card: ReleaseCard;
+    modeDigest: string;
+    source: "setting" | "mode";
+    scope: Scope;
+} | {
+    ok: false;
+    why: string;
+};
 /** The links a card keeps once its acts are spent or stale: where to look, never a token. */
 export declare function linksFor(target: DecideTarget): DecideButton[][];
 /** Where a plan card's task is now, for a card whose buttons no longer act: the family's current version, named only

package/dist/chat-decide.js

@@ -28,7 +28,8 @@ import { verifyApproverStanding } from "./principal.js";
 import { pullRequestFollowOf } from "./pull-request-flow.js";
 import { requestResultChanges } from "./result-actions.js";
 import { revisionSourceOf } from "./result-review.js";
-import { APPROVAL_PROOF, approvalOf, approvalProofDetail, quarantinedAuthor } from "./scope.js";
+import { APPROVAL_PROOF, approvalOf, approvalProofDetail, deployGateScope, quarantinedAuthor } from "./scope.js";
+import { releaseCardOf } from "./release-card.js";
 import { phoneText } from "./telegram-status.js";
 /** The words, said once. */
 export const DECIDE_LABELS = {
@@ -44,6 +45,7 @@ export const DECIDE_LABELS = {
     cancel: "Cancel",
 };
 const OFFER_TTL_MS = 7 * 86_400_000;
+const CHANNEL_NAMES = { telegram: "Telegram", slack: "Slack", discord: "Discord", teams: "Teams" };
 const CONFIRM_TTL_MS = 10 * 60_000;
 const PROMPT_TTL_MS = 30 * 60_000;
 export const WHAT_SHOULD_CHANGE = "What should change?";
@@ -262,6 +264,30 @@ export function decideOffer(store, target, who, now, channel, root) {
             const plan = planInChat(store, target.taskId, who.name, now, channel, root);
             if (!plan.ok)
                 return null;
+            const release = deployGateScope(plan.scope);
+            // Checks beyond the sandbox seal only on the person's password (store.ts sealScopeApproval): the card says so and
+            // links to the approval in Toolroll, and offers no Continue or Approve that would dead-end. A release or a plan.
+            if (passwordOnlySeal(plan.scope)) {
+                let head;
+                try {
+                    head = release ? releaseCardOf(store, plan.scope, plan.digest, { profile: permissionPlainWords }).short.split("\n").slice(0, 3)
+                        : planCardText(store, target.taskId, plan.scope, root, channel).split("\n").slice(0, 1);
+                }
+                catch {
+                    head = [title(store, target.taskId)];
+                }
+                return { text: [...head, "", needsPassword(plan.scope)].join("\n"), rows: [[{ label: "Approve in Toolroll", path: chatControlHref("approval", target.taskId) }]] };
+            }
+            // A deploy gate is approved from chat only through its release card (chat-management.md §0a.5).
+            if (release) {
+                const release = releaseInChat(store, target.taskId, who.name, now, channel, "offer", root);
+                if (!release.ok)
+                    return null;
+                const card = release.card;
+                return { text: channel === "telegram" ? card.short : `${card.short}\n\n${card.full}`,
+                    rows: [[{ act: "approve", run: null, digest: releaseDigest(card), label: "Continue" }], [{ label: DECIDE_LABELS.edit, path: chatControlHref("approval", target.taskId) }, { act: "not-now", run: null, digest: releaseDigest(card) }]],
+                    ...(channel === "telegram" ? { file: { name: card.fileName, text: card.full } } : {}) };
+            }
             return { text: planCardText(store, target.taskId, plan.scope, root, channel),
                 rows: [[{ act: "approve", run: null, digest: plan.digest }], [{ label: DECIDE_LABELS.edit, path: chatControlHref("approval", target.taskId) }, { act: "not-now", run: null, digest: plan.digest }]] };
         }
@@ -320,7 +346,7 @@ export function mintDecideButtons(store, seat, target, offer, now, message = nul
             return { label: one.label, link: one };
         const token = mint(store, seat, message, one, target.taskId, "offer", now);
         tokens.push(token);
-        return { label: DECIDE_LABELS[one.act], token };
+        return { label: one.label ?? DECIDE_LABELS[one.act], token };
     }));
     return { rows, tokens };
 }
@@ -350,6 +376,66 @@ export function hasLiveDecideTokens(store, channel, chat, message, now) {
 export function isDecideToken(store, token) {
     return token.startsWith("d:") && store.handle.prepare("SELECT 1 FROM chat_decide_action WHERE token = ?").get(token) !== undefined;
 }
+/** A release card's acts carry its card digest (release-card.ts), never a plan's. */
+const RELEASE_DIGEST = "release:";
+/** Why a password-only scope (passwordOnlySeal) isn't approved from chat, for a release or a plan. */
+const needsPassword = (scope) => `This ${deployGateScope(scope) ? "release" : "plan"}'s checks run outside the sandbox, so it's approved in Toolroll with your password.`;
+/** Whether only a person's password ceremony seals this scope (store.ts sealScopeApproval): checks that reach beyond the
+ * sandbox (sign-ins, or none at all) or extra macOS services, sealed into its profile. */
+const passwordOnlySeal = (scope) => {
+    const profile = scope.profile;
+    return profile != null && (profile["checkAccess"] !== undefined || profile["machLookup"] !== undefined);
+};
+const releaseDigest = (card) => `${RELEASE_DIGEST}${card.digest}`;
+/**
+ * Whether a release card's tap comes from the person's own private chat with Toolroll (chat-management.md §0a.5), from
+ * the binding's own record, failing closed: Telegram, a private chat (a positive id, which Telegram makes equal to the
+ * user's own id) that is the binding's chat and its user's; Slack, a direct-message channel (D…) that is the binding's.
+ * Any other chat app, a missing chat or binding, or another person's binding is not.
+ */
+export function privateReleaseChat(store, seat) {
+    const row = store.handle.prepare("SELECT member, channel, approver FROM chat_binding WHERE provider = ? AND id = ? AND revoked IS NULL").get(seat.channel, seat.binding);
+    if (row === undefined || String(row["approver"]) !== seat.approver || seat.chat !== String(row["channel"]))
+        return false;
+    if (seat.channel === "telegram")
+        return /^[1-9][0-9]*$/.test(seat.chat) && seat.chat === String(row["member"]);
+    if (seat.channel === "slack")
+        return /^D[A-Z0-9]+$/.test(seat.chat);
+    return false;
+}
+/**
+ * A deploy gate this person may approve from this chat now, through its release card: every plain-plan rule
+ * (planInChat: their Approve from chat setting and limits, no coordinator-, lead- or scout-written text, organisation
+ * policy, protected work), never a nightly check, only in their private chat, and the card as the live records say
+ * it now (chat-management.md §0a.5).
+ */
+export function releaseInChat(store, taskId, approver, now, channel, 
+/** The seat a tap came from, checked strictly; "offer" only where the card is drawn for the binding's own chat (no act). */
+seat, root) {
+    const plan = planInChat(store, taskId, approver, now, channel, root);
+    if (!plan.ok)
+        return plan;
+    if (!deployGateScope(plan.scope))
+        return { ok: false, why: "This plan isn't a release." };
+    if (passwordOnlySeal(plan.scope))
+        return { ok: false, why: needsPassword(plan.scope) };
+    const ref = store.lookupRef(taskId);
+    if (ref === null || nightlyTaskRef(store, ref.id))
+        return { ok: false, why: NIGHTLY_CHECK_ONLY };
+    if (seat !== "offer" && (seat.channel !== channel || !privateReleaseChat(store, seat)))
+        return { ok: false, why: "A release is approved only in your private chat with Toolroll." };
+    let card;
+    try {
+        card = releaseCardOf(store, plan.scope, plan.digest, { profile: permissionPlainWords });
+    }
+    catch {
+        return { ok: false, why: "This release's terms can't be shown here, so you approve it in Toolroll." };
+    }
+    // What changed is part of what's approved: a list that couldn't be read (or was refused as rewritten history) is no card.
+    if (plan.scope.releaseTerms != null && card.changes.commits === null)
+        return { ok: false, why: "This release's list of changes couldn't be read, so you approve it in Toolroll." };
+    return { ok: true, card, modeDigest: plan.modeDigest, source: plan.source, scope: plan.scope };
+}
 const QUESTIONS = {
     accept: name => `Accept and finish "${name}"?`,
     retry: name => `Retry "${name}"? It queues another attempt.`,
@@ -366,6 +452,24 @@ function targetOf(row) {
     }
 }
 /** Why the card's act no longer applies, or null while it still does — checked at the offer and again at the yes. */
+/**
+ * A release card's terms, then its Approve (Continue, and a release card refreshed after it changed): the full terms
+ * (a file on Telegram, where a message is limited; inline elsewhere), Approve and Cancel bound to this card's digest,
+ * and on Telegram the card to show instead when the file didn't arrive: no Approve, a Continue to send it again.
+ */
+function releaseContinue(store, seat, message, taskId, name, card, now, ack, lead) {
+    const spec = { act: "approve", run: null, digest: releaseDigest(card) };
+    const yes = mint(store, seat, message, spec, taskId, "yes", now);
+    const cancel = mint(store, seat, message, spec, taskId, "cancel", now);
+    const text = `${seat.channel === "telegram" ? card.short : `${card.short}\n\n${card.full}`}${lead === null ? "" : `\n\n${lead}`}`;
+    // Telegram carries the terms only as the file: Approve shows only once that file has arrived (telegram.ts).
+    const again = seat.channel === "telegram" ? mint(store, seat, message, spec, taskId, "offer", now) : null;
+    return { ack, file: { name: card.fileName, text: card.full },
+        edit: { text: `${text}\n\nApprove release "${name}"? This approves exactly these terms${seat.channel === "telegram" ? `, every one in ${card.fileName}` : ""}.`,
+            rows: [[{ label: "Approve", token: yes }, { label: DECIDE_LABELS.cancel, token: cancel }]], tokens: [yes, cancel] },
+        ...(again === null ? {} : { unsent: { text: `${text}\n\nThe terms file didn't arrive, so Approve isn't shown. Tap Continue to send it again.`,
+                rows: [[{ label: "Continue", token: again }]], tokens: [again] } }) };
+}
 function staleWhy(store, row, who, now, channel, root) {
     switch (row.act) {
         case "accept":
@@ -384,9 +488,21 @@ function staleWhy(store, row, who, now, channel, root) {
         }
         case "approve":
         case "not-now": {
+            if (row.digest.startsWith(RELEASE_DIGEST)) {
+                // The button's own seat as it was minted: its binding's chat, checked against the binding's record.
+                const release = releaseInChat(store, row.taskId, who.name, now, channel, { channel, binding: row.binding ?? -1, chat: row.chat ?? "", approver: who.name }, root);
+                if (!release.ok)
+                    return release.why;
+                return releaseDigest(release.card) === row.digest ? null : "This release changed while you were reading.";
+            }
             const plan = planInChat(store, row.taskId, who.name, now, channel, root);
             if (!plan.ok)
                 return plan.why;
+            // A deploy gate's plain plan card never approves it: only its release card does.
+            if (deployGateScope(plan.scope))
+                return "This is a release: approve it from its release card.";
+            if (passwordOnlySeal(plan.scope))
+                return needsPassword(plan.scope);
             return plan.digest === row.digest ? null : "The plan changed since this card was sent.";
         }
         case "merge": {
@@ -427,7 +543,7 @@ export function planWhereNow(store, taskId, who, now, root) {
     }
     return { said: `"${name}" is under way.`, rows: [] };
 }
-const QUESTION_STARTS = ["Accept and finish \"", "Retry \"", "Approve and start \"", "Merge \""];
+const QUESTION_STARTS = ["Accept and finish \"", "Retry \"", "Approve and start \"", "Merge \"", "Approve release "];
 /** The card's words without a question this module appended. */
 function cardBody(shown) {
     const at = shown.lastIndexOf("\n\n");
@@ -484,8 +600,24 @@ export function applyDecideTap(store, seat, input) {
         return { ack: "Cancelled.", edit: { text: offer.text ?? body, ...minted } };
     }
     const why = staleWhy(store, row, who, now, seat.channel, input.root);
-    if (why !== null)
+    if (why !== null) {
+        // A release that changed while it was read: the new card, with fresh buttons, so the person reads it again.
+        // Through the same gate as Continue: the new terms go first (as a file where the chat app limits a message), and
+        // Approve shows only once they arrived; else a Continue to send them again. A release that is now password-only
+        // gets its card with the link to Toolroll.
+        if (row.digest.startsWith(RELEASE_DIGEST) && row.act === "approve" && why === "This release changed while you were reading.") {
+            spend();
+            const release = releaseInChat(store, row.taskId, who.name, now, seat.channel, seat, input.root);
+            if (release.ok)
+                return releaseContinue(store, seat, input.message, row.taskId, name, release.card, now, why, `${why} Here it is now.`);
+            const offer = decideOffer(store, target, who, now, seat.channel, input.root);
+            if (offer !== null && offer.file === undefined) {
+                const minted = mintDecideButtons(store, seat, target, offer, now, input.message);
+                return { ack: why, edit: { text: `${offer.text ?? body}\n\n${why} Here it is now.`, ...minted } };
+            }
+        }
         return stale(why);
+    }
     if (row.phase === "offer") {
         if (row.act === "changes") {
             const id = openDecidePrompt(store, seat, row.taskId, row.run ?? 0, row.digest, now);
@@ -496,6 +628,14 @@ export function applyDecideTap(store, seat, input) {
             return { ack: "Okay, it waits.", edit: { text: `${body}\n\nNot now. It waits for you in Tasks.`,
                     rows: [[{ label: DECIDE_LABELS.edit, link: { label: DECIDE_LABELS.edit, path: chatControlHref("approval", row.taskId) } }]], tokens: [] } };
         }
+        // A release card's Continue: the card again from the live records, its full terms as a file, then Approve.
+        if (row.act === "approve" && row.digest.startsWith(RELEASE_DIGEST)) {
+            const release = releaseInChat(store, row.taskId, who.name, now, seat.channel, seat, input.root);
+            if (!release.ok)
+                return stale(release.why);
+            spend();
+            return releaseContinue(store, seat, input.message, row.taskId, name, release.card, now, "Read the terms, then approve.", null);
+        }
         // The first tap asks; only the yes acts, bound to exactly what this button was.
         spend();
         const spec = { act: row.act, run: row.run, digest: row.digest };
@@ -521,9 +661,35 @@ export function applyDecideTap(store, seat, input) {
             return retried.ok ? done("✓ Queued again. Existing approvals and holds still apply.") : notDone(retried.message);
         }
         case "approve": {
+            if (row.digest.startsWith(RELEASE_DIGEST)) {
+                const release = releaseInChat(store, row.taskId, who.name, now, seat.channel, seat, input.root);
+                if (!release.ok)
+                    return notDone(release.why);
+                const cardDigest = release.card.digest;
+                // The seal knows which card it came from: a chat seal of a deploy gate needs this evidence (store.ts).
+                if (!store.sealScopeApproval(row.taskId, who.name, now, {}, { kind: "chat", modeDigest: release.modeDigest, card: "release", cardDigest }))
+                    return notDone("the release couldn't be approved from chat. Open it in Toolroll.");
+                const sealedDigest = store.getScope(row.taskId)?.approvedDigest ?? "";
+                store.recordAction({ at: now.toISOString(), actor: who.name, repo: ref.repo, taskId: row.taskId, runId: null, action: APPROVAL_PROOF, outcome: "chat", source: "request",
+                    detail: JSON.stringify({ v: 1, at: now.toISOString(), generation: store.accountOf(who.name)?.generation ?? 0, digest: sealedDigest, card: "release", cardDigest }) });
+                const where = `${CHANNEL_NAMES[seat.channel]} · chat binding #${seat.binding}`;
+                store.recordAction({ at: now.toISOString(), actor: who.name, repo: ref.repo, taskId: row.taskId, runId: null, action: "release approved in chat", outcome: "approved",
+                    source: "request", detail: `via ${where} · ${release.source} ${release.modeDigest} · card ${cardDigest}` });
+                // Said everywhere the person hears from Toolroll (their other chats and push), naming the chat it came from.
+                const terms = release.scope.releaseTerms ?? null;
+                store.enqueueNotification({ dedupeKey: `release-approved-chat:${row.taskId}:${cardDigest}`, kind: "release-approved", recipient: who.name, pushClass: "attention",
+                    subject: `Release${terms === null ? "" : ` ${terms.packageVersion}`} approved from ${CHANNEL_NAMES[seat.channel]}`,
+                    body: `You approved "${name}"${terms === null ? "" : ` (${terms.approvedSha.slice(0, 7)}, pull request #${terms.pr})`} from ${CHANNEL_NAMES[seat.channel]}. If that wasn't you, stop it in Toolroll now.`,
+                    link: chatControlHref("task", row.taskId), source: { taskRef: ref.id } }, now);
+                return done("✓ Release approved. It deploys when its check passes and someone runs the release.");
+            }
             const plan = planInChat(store, row.taskId, who.name, now, seat.channel, input.root);
             if (!plan.ok)
                 return notDone(plan.why);
+            if (deployGateScope(plan.scope))
+                return notDone("This is a release: approve it from its release card.");
+            if (passwordOnlySeal(plan.scope))
+                return notDone(needsPassword(plan.scope));
             // The owner's own yes, sealed as theirs ("chat"), never as a mode's: it stands like the console's after the mode or setting ends.
             if (!store.sealScopeApproval(row.taskId, who.name, now, {}, { kind: "chat", modeDigest: plan.modeDigest }))
                 return notDone("the plan couldn't be approved from chat. Open it in Toolroll.");

package/dist/chat-quiet.js

@@ -101,7 +101,7 @@ export function quietCardView(store, taskRefs, now, root, viewer) {
     const heading = `${lines.length} tasks`;
     const projects = [...new Set(lines.map(one => projectLabel(one.project)))];
     const text = [heading, ...lines.map(one => `${one.icon} ${phoneText(one.title, 60)} · ${one.status}`), "", projects.join(", ")].join("\n");
-    return { text, entities: [{ type: "bold", offset: 0, length: heading.length }], link: { label: "Open tasks", path: "/tasks" } };
+    return { text, entities: [{ type: "bold", offset: 0, length: heading.length }], link: { label: "Open tasks", path: "/work" } };
 }
 /** Facts that carry their own controls or must stand alone (a security alert, a decision, a flow card, a
  * screenshot, an acceptance packet) are never folded into a batch. */
@@ -176,7 +176,7 @@ export function finishedView(store, batch, now, root, viewer) {
         return null;
     const text = batchLine(lines.map(one => one.fact));
     if (lines.length > 1)
-        return { text, entities: [], link: { label: "Open", path: "/tasks" } };
+        return { text, entities: [], link: { label: "Open", path: "/work" } };
     const target = lines[0].target ?? null;
     return { text, entities: [], link: lines[0].link, ...(lines[0].also.length === 0 ? {} : { also: lines[0].also }), ...(target === null ? {} : { target }) };
 }
@@ -242,7 +242,7 @@ export function enqueueEveningDigests(store, now, root) {
             if (body === null)
                 return;
             if (store.enqueueNotification({ dedupeKey: `digest:evening:${person.account}:${day}`, kind: "evening-digest", subject: "Evening digest", body,
-                link: "/tasks", source: { installation: true }, recipient: person.account }, now))
+                link: "/work", source: { installation: true }, recipient: person.account }, now))
                 queued++;
         });
     }

package/dist/check-report.js

@@ -127,7 +127,8 @@ export function prepareCheckAttempt(store, root, input, now) {
         planDigest: plan === null ? null : payloadDigest(plan), snapshotDigest: snapshot === null ? null : payloadDigest(snapshot),
         inventoryDigest: payloadDigest(inventory), contextDigest: payloadDigest(context), nonceHash: sha256(nonce),
     }, now);
-    const stdin = JSON.stringify({ nonce, mode, plan, watch: [...(input.watch ?? [])] });
+    // The command's own limit rides along, so the check ends itself (logs and report printed) before the plane stops it.
+    const stdin = JSON.stringify({ nonce, mode, plan, watch: [...(input.watch ?? [])], limitMs: input.command.timeoutMs });
     return { runId: input.runId, nonce, stdin, mode, inventory, context, plan, snapshot, watch: [...(input.watch ?? [])] };
 }
 /** Seal one JSON payload as a structured-output artifact under its capture label. */

package/dist/coding-provider.js

@@ -10,6 +10,7 @@ import { createContainer, currentContainment } from "./containment.js";
 import { processMayBeAlive } from "./process-liveness.js";
 import { observeProcessTree, sampleProcessTree, stopProcessTree } from "./process-tree.js";
 import { isOwnEnv } from "./names.js";
+import { isProtectedEnvName } from "./protected-storage.js";
 import { sleep } from "./sleep.js";
 /** A response from the server, distinct from an ambiguous transport failure. */
 export class CodingProviderRequestError extends Error {
@@ -54,8 +55,9 @@ export function codingEnvironment() {
         // Preserve native Codex auth, HOME, PATH, CODEX_HOME and project config.
         // A parent desktop session's control pipe and identity do not belong to
         // this independent native client. Keep install/runtime paths such as
-        // CODEX_MCP_NODE_PATH. Service credentials stay with the web service.
-        if (isOwnEnv(key) || /^(TELEGRAM|SLACK|DISCORD)_.*(TOKEN|SECRET|KEY)$/i.test(key) || /^CODEX_APP_TOOLS_/.test(key) || invokingSession.has(key) || key === "NODE_OPTIONS" || key === "NODE_PATH")
+        // CODEX_MCP_NODE_PATH. Service credentials stay with the web service; no chat or vault variable reaches it
+        // (protected-storage.ts).
+        if (isOwnEnv(key) || isProtectedEnvName(key) || /^CODEX_APP_TOOLS_/.test(key) || invokingSession.has(key) || key === "NODE_OPTIONS" || key === "NODE_PATH")
             delete env[key];
     }
     return env;

package/dist/commit-extract.d.ts

@@ -60,6 +60,12 @@ export type Verified<T> = {
     ok: false;
     message: string;
 };
+/** Which Git runs and with what environment: the release path's fixed absolute Git and its own environment, or by
+ * default the checkout Git environment's. The hardening settings are added over either. */
+export type GitRunner = {
+    git?: string;
+    env?: NodeJS.ProcessEnv;
+};
 /** One commit, hashed here and parsed from its own bytes. */
 export declare function readVerifiedCommit(gitDir: string, sha: string): Verified<VerifiedCommit>;
 /**
@@ -91,4 +97,15 @@ export declare function verifiedBlobs(gitDir: string, tree: string, paths: reado
     id: string;
     bytes: Buffer;
 }>>;
+/**
+ * The commits reachable from `to` and not from `from`, as Git lists them (newest first), each read from its own verified
+ * bytes: what a release card says changed (release-card.ts). Git only names them. Each is hashed here and its parents
+ * checked against Git's listing; every commit the range stops at (a parent outside it) must be reached from `from`
+ * through verified parents within `reach` commits, so history a build rewrote around the objects can't shorten the
+ * list. A shallow boundary, grafts or replacement refs refuse (verifiedReader), as does a range longer than `max`.
+ */
+export declare function verifiedRange(gitDir: string, from: string, to: string, options?: GitRunner & {
+    max?: number;
+    reach?: number;
+}): Verified<VerifiedCommit[]>;
 export {};