toolroll 0.9.73 → 0.9.75

package/dist/browser-workspace.d.ts

@@ -211,6 +211,10 @@ export type BrowserTasksView = {
     newTask: BrowserLink;
     /** v105: subscription windows and monthly budgets, one tile each (an instance operator's; null when there are none). */
     limits: BrowserLimits | null;
+    /** The stored-state filter (Any state, Queued, Running, Done, Failed, Cancelled), each a real link starting on page one. */
+    states?: (BrowserLink & {
+        active: boolean;
+    })[];
 };
 /** One limit: a plan's usage window ("Claude · 5-hour, 48%") or a monthly budget ("shop · Budget, $4.20 of $10"). */
 export type BrowserTaskGroup = WorkIndexGroup;
@@ -272,7 +276,7 @@ export type BrowserSettingsView = {
         connection: {
             words: string;
             facts: string;
-            checkHref: string;
+            checkAction: string;
         } | null;
         usage: string;
         envName: string;
@@ -1445,6 +1449,8 @@ export type BrowserAgentsView = {
     selected: BrowserAgentDetail | null;
     /** Shown when nothing is on the board. */
     empty: string | null;
+    /** The Live grid (?view=live): every running agent's live output, watching only. */
+    live?: boolean;
 };
 export type BrowserView = BrowserTasksView | BrowserSettingsView | BrowserTaskView | BrowserProjectsView | BrowserResultView | BrowserFlowView | BrowserAgentsView;
 export type BrowserWorkspace = {

package/dist/builder.js

@@ -1240,7 +1240,7 @@ export async function build(store, request) {
     // Every streaming transport emits events now (peek); a file that cannot
     // open is a null, and a null never costs a build.
     // What the agent did last rides the same stream into one row (live tasks).
-    const liveLog = withAgentTurns(withRunActivity(openLiveLog(root, request.runId, liveLogContext(store, taskRef, worktree)), store, request.runId, clock), (state, at) => { if (attemptKey !== null)
+    const liveLog = withAgentTurns(withRunActivity(openLiveLog(root, request.runId, liveLogContext(store, request.runId, taskRef, worktree, clock())), store, request.runId, clock), (state, at) => { if (attemptKey !== null)
         recordAgentTurn(store, { run: request.runId, attemptKey, state, at }); }, clock, (open, at) => { if (attemptKey !== null)
         noteOpenTool(store, request.runId, attemptKey, open, at); });
     // The retry base (steering fix for run 1465's proof): the SAME pinned

package/dist/chat-acceptance.d.ts

@@ -4,12 +4,15 @@
 import type { Store } from "./store.js";
 import type { VerifiedApprover } from "./principal.js";
 import { type CriterionMatrixRow } from "./proof.js";
+import { type ApprovedCheckState } from "./task-status.js";
 export declare const ACCEPTANCE_PAGE_SIZE = 3;
+/** `check`: the approved check read now (task-status.ts approvedCheckOf); undefined when this read had no saved files,
+ * and then a verified result claims nothing about its check. */
 export declare function acceptanceStatus(proof: {
     verdict: string;
     reasons: readonly string[];
     matrix: readonly CriterionMatrixRow[];
-} | null, accepted: boolean): string;
+} | null, accepted: boolean, check?: ApprovedCheckState | null): string;
 export declare function readAcceptanceEvidence(store: Store, who: VerifiedApprover, root: string | undefined, task: string, runId?: number, offset?: number): {
     ok: false;
     message: string;

package/dist/chat-acceptance.js

@@ -1,12 +1,19 @@
 import { readVerifiedArtifact, readVerifiedProofForRun, scanForSecrets } from "./evidence.js";
 import { verificationEvidence } from "./verification-evidence.js";
 import { manualReviewOnly } from "./proof.js";
+import { assignmentChecksForRun } from "./assignment.js";
+import { approvedCheckOf, approvedCheckStateOf, checksFactOf } from "./task-status.js";
 export const ACCEPTANCE_PAGE_SIZE = 3;
-export function acceptanceStatus(proof, accepted) {
+/** `check`: the approved check read now (task-status.ts approvedCheckOf); undefined when this read had no saved files,
+ * and then a verified result claims nothing about its check. */
+export function acceptanceStatus(proof, accepted, check) {
     if (accepted)
         return manualReviewOnly(proof) ? "Accepted by a person" : "Accepted with an exception";
     if (manualReviewOnly(proof))
         return "You check the remaining requirements";
+    if (proof?.verdict === "verified" && check !== "passed") {
+        return check === undefined ? "Open the result to see its checks" : check === "failed" ? "Checks failed" : check === "running" ? "Checks running" : "The check result couldn't be read";
+    }
     return proof === null ? "No checks recorded" : ({ verified: "Checks passed", attested: "Checks reported by the agent", short: "Some required material is missing", refuted: "Saved result conflicts with the approved scope" }[proof.verdict] ?? "Some required material is missing");
 }
 export function readAcceptanceEvidence(store, who, root, task, runId, offset = 0) {
@@ -48,6 +55,9 @@ export function readAcceptanceEvidence(store, who, root, task, runId, offset = 0
     else if (!proof.ok)
         problems.push("The saved proof is unavailable or cannot be read.");
     const verification = root === undefined ? null : verificationEvidence(store, root, run.id);
+    // The one answer to "did the approved check pass" (task-status.ts), with follow-ups on the same commit.
+    const checkNow = root === undefined || run.role === "scout" ? undefined
+        : approvedCheckStateOf(approvedCheckOf(recorded?.verdict ?? null, recorded?.reasons ?? [], checksFactOf(assignmentChecksForRun(store, root, run.id, new Date()), run.headRevision)));
     let gate = { status: "No machine verification receipt available" };
     if (verification !== null && !verification.ok) {
         problems.push(verification.problem);
@@ -55,7 +65,7 @@ export function readAcceptanceEvidence(store, who, root, task, runId, offset = 0
     }
     else if (verification?.ok && verification.bytes !== null) {
         const receipt = JSON.parse(verification.bytes);
-        gate = { status: receipt.result.ran ? (receipt.result.exitCode === 0 ? "Passed" : "Failed") : "Did not run", exitCode: receipt.result.exitCode ?? null, command: "The approved project verification command", logShortened: receipt.log.truncated };
+        gate = { status: receipt.result.ran ? (receipt.result.exitCode === 0 ? checkNow === undefined || checkNow === "passed" ? "Passed" : "Passed when it ran; not counted now" : "Failed") : "Did not run", exitCode: receipt.result.exitCode ?? null, command: "The approved project verification command", logShortened: receipt.log.truncated };
     }
     // These are summaries for conversation, not substitute approval terms.
     // Full statements, caveats and references remain on the authenticated screen.
@@ -71,7 +81,7 @@ export function readAcceptanceEvidence(store, who, root, task, runId, offset = 0
     return { ok: true, body: {
             task, run: run.id, title: store.getTask(task)?.title ?? task, currentExecution: family.current.id,
             isCurrent: family.current.id === task && store.runsFor(ref.id).find(one => one.finishedAt !== null && ["builder", "repair", "scout"].includes(one.role))?.id === run.id,
-            status: acceptanceStatus(recorded, acceptance !== null), recordedVerdict: recorded?.verdict ?? null,
+            status: acceptanceStatus(recorded, acceptance !== null, checkNow), recordedVerdict: recorded?.verdict ?? null,
             accepted: acceptance !== null, acceptance: acceptance === null ? null : { at: acceptance.acceptedAt, note: brief(acceptance.note) },
             reasons: (recorded?.reasons ?? []).map(one => brief(one)), gate,
             criteriaTotal: matrix.length, nextCriterionOffset: offset + page.length < matrix.length ? offset + page.length : null,

package/dist/chat-continuity.js

@@ -125,6 +125,8 @@ export const CHAT_CONTINUITY_SCRIPT = String.raw `
         if(got===null)return;
         var data=got.data||{};
         if(data.ok===true){
+          // A conversation shown before it existed (session 0) is started by its first send: that is this one.
+          if(session==='0'&&typeof data.session==='number'&&data.session>0)adopt(String(data.session));
           if(String(data.session)!==session){changed();return;}
           say(data.queued===true?'Queued. It goes to the lead after the reply in progress.':'Sent. Waiting for the reply…');later(300);return;
         }
@@ -273,6 +275,9 @@ export const CHAT_CONTINUITY_SCRIPT = String.raw `
     }
     return true;
   }
+  // The conversation this page's first send started: its binding and its draft move to it (a reload restores from there).
+  function adopt(started){session=started;document.querySelectorAll('form[action="/chat"] [name="request-session"]').forEach(function(bound){bound.value=started;});
+    try{sessionStorage.removeItem(key);}catch(e){}key='standing-orders:chat-draft:'+session+':'+task;save();}
   function later(ms){if(stale)return;clearTimeout(timer);timer=setTimeout(check,ms);}
   async function check(){
     if(polling||stale)return;
@@ -289,6 +294,11 @@ export const CHAT_CONTINUITY_SCRIPT = String.raw `
       if(!r.ok)throw new Error('connection');
       var data=await r.json();
       if(!valid(data))throw new Error('response');
+      // Not started yet (session 0): only this send's own receipt in the started conversation proves it is the one.
+      if(session==='0'&&typeof data.session==='number'&&data.session>0&&asked&&data.received===true)adopt(String(data.session));
+      // A poll that lands while the first send is on its way decides nothing: that send's answer (or the poll it
+      // asks for afterwards, with its request) says whether the started conversation is this page's.
+      if(session==='0'&&sending&&data.session!==null&&String(data.session)!=='0'){later(1000);return;}
       if(data.session===null||String(data.session)!==session){changed();return;}
       // A late answer for another lens never lands here; the poll goes on.
       if(data.task!==task){later(5000);return;}

package/dist/chat-quiet.js

@@ -101,7 +101,7 @@ export function quietCardView(store, taskRefs, now, root, viewer) {
     const heading = `${lines.length} tasks`;
     const projects = [...new Set(lines.map(one => projectLabel(one.project)))];
     const text = [heading, ...lines.map(one => `${one.icon} ${phoneText(one.title, 60)} · ${one.status}`), "", projects.join(", ")].join("\n");
-    return { text, entities: [{ type: "bold", offset: 0, length: heading.length }], link: { label: "Open tasks", path: "/tasks" } };
+    return { text, entities: [{ type: "bold", offset: 0, length: heading.length }], link: { label: "Open tasks", path: "/work" } };
 }
 /** Facts that carry their own controls or must stand alone (a security alert, a decision, a flow card, a
  * screenshot, an acceptance packet) are never folded into a batch. */
@@ -176,7 +176,7 @@ export function finishedView(store, batch, now, root, viewer) {
         return null;
     const text = batchLine(lines.map(one => one.fact));
     if (lines.length > 1)
-        return { text, entities: [], link: { label: "Open", path: "/tasks" } };
+        return { text, entities: [], link: { label: "Open", path: "/work" } };
     const target = lines[0].target ?? null;
     return { text, entities: [], link: lines[0].link, ...(lines[0].also.length === 0 ? {} : { also: lines[0].also }), ...(target === null ? {} : { target }) };
 }
@@ -242,7 +242,7 @@ export function enqueueEveningDigests(store, now, root) {
             if (body === null)
                 return;
             if (store.enqueueNotification({ dedupeKey: `digest:evening:${person.account}:${day}`, kind: "evening-digest", subject: "Evening digest", body,
-                link: "/tasks", source: { installation: true }, recipient: person.account }, now))
+                link: "/work", source: { installation: true }, recipient: person.account }, now))
                 queued++;
         });
     }

package/dist/cli.js

@@ -1301,7 +1301,7 @@ async function runDemoCommand(argv, write) {
     const now = new Date();
     const { sandbox, store, seed, evidenceRoot, passwordFile, lead } = createDemoSandbox(now);
     const server = createDecisionServer({
-        store, evidenceRoot, clock: () => new Date(), repos: seed.repos, demoLead: lead,
+        store, evidenceRoot, clock: () => new Date(), repos: seed.repos, demoLead: lead, backgroundChecks: true,
         ...(allowedHosts.length === 0 ? {} : { allowedHosts }),
     });
     await new Promise((ready, failed) => {

package/dist/coding-handoff.js

@@ -1,4 +1,5 @@
 /** A committed native session enters the existing review flow, never another executor. */
+import { checkoutGitSync } from './teardown-git.js';
 import { execFileSync } from 'node:child_process';
 import { lstatSync, realpathSync } from 'node:fs';
 import { sqliteRuntime } from './sqlite-runtime.js';
@@ -52,11 +53,11 @@ function catalog(store, readOnly) {
         throw error;
     }
 }
+// The coding checkout is written by an agent (its config, hooks, filters): every read goes through the hardened
+// checkout git, which the code page's GET preview also uses (docs/plans/get-side-effects.md).
 function git(repo, args) {
     try {
-        return execFileSync('git', ['--no-optional-locks', '--no-replace-objects', '--no-lazy-fetch', '-c', 'core.hooksPath=/dev/null', '-C', repo, ...args], {
-            encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 60_000, maxBuffer: 1_048_576,
-        }).trimEnd();
+        return checkoutGitSync(repo, ['--no-replace-objects', '--no-lazy-fetch', ...args]).trimEnd();
     }
     catch {
         throw Error('The committed coding result could not be verified in Git. Check the project and try again.');

package/dist/coding-ui.js

@@ -76,7 +76,7 @@ export function codingWorkspaceHtml(input) {
         const blocked = !s.nativeThreadId || !['ready', 'working', 'failed', 'interrupted'].includes(s.status);
         const messages = selected.items.filter(item => item.type !== 'reasoning').map(itemHtml);
         const composer = postForm(`${sessionUrl(s.id)}/send`, html `<label for="coding-prompt">Message Codex</label><textarea id="coding-prompt" name="prompt" rows="2" maxlength="24000" required placeholder="Describe a change or ask about the result…">${input.draft ?? ''}</textarea><div class="coding-actions"><button type="submit"${blocked ? html ` disabled` : ''}>${s.status === 'working' ? 'Send update' : 'Send message'}</button></div>`, { attrs: { 'data-coding-form': 'send', class: 'coding-composer', hidden: s.status === 'closed' }, hidden: { requestId: randomUUID() } });
-        main = html `<header class="coding-header"><div><h1>${s.title}</h1><p class="coding-meta">${projectName(s.repo)} · Codex${s.model ? html ` · ${s.model}` : ''}</p></div><details class="coding-session-detail"><summary aria-label="Session details">Details</summary><dl><dt>Branch</dt><dd>${s.branch}</dd><dt>Worktree</dt><dd>${s.worktree}</dd><dt>Native session</dt><dd>${s.nativeThreadId ?? 'Not established'}</dd>${s.initialRequest ? html `<dt>Initial request</dt><dd class="coding-text">${s.initialRequest.prompt}</dd>` : ''}</dl></details></header><div class="coding-state-row"><p id="coding-state" role="status">${stateLabel(s, selected.requests)}</p><div id="coding-controls">${controlsHtml(s)}</div></div><div id="coding-requests">${selected.requests.map(r => requestHtml(r, s.id))}</div><div id="coding-conversation" class="coding-conversation" tabindex="0" aria-label="Conversation"${s.status === 'closed' && messages.length === 0 ? html ` hidden` : ''}>${messages.length ? messages : html `<p class="coding-meta coding-no-messages">No messages yet.</p>`}</div><button type="button" id="coding-latest" class="coding-secondary" hidden>Latest update ↓</button>${composer}<details id="coding-changes" class="coding-changes"><summary>Changes</summary><div id="coding-change-content"><p class="coding-meta">Open to load the current changes.</p></div><button type="button" id="coding-refresh-changes" class="coding-secondary">Refresh changes</button><noscript><a href="${sessionUrl(s.id)}/changes">View changes</a></noscript><p id="coding-shipping"${['closed', 'uncertain'].includes(s.status) ? html ` hidden` : ''}><a class="coding-link-button" href="${sessionUrl(s.id)}/ship">Review for shipping</a></p></details>`;
+        main = html `<header class="coding-header"><div><h1>${s.title}</h1><p class="coding-meta">${projectName(s.repo)} · Codex${s.model ? html ` · ${s.model}` : ''}</p></div><details class="coding-session-detail"><summary aria-label="Session details">Details</summary><dl><dt>Branch</dt><dd>${s.branch}</dd><dt>Worktree</dt><dd>${s.worktree}</dd><dt>Native session</dt><dd>${s.nativeThreadId ?? 'Not established'}</dd>${s.initialRequest ? html `<dt>Initial request</dt><dd class="coding-text">${s.initialRequest.prompt}</dd>` : ''}</dl></details></header><div class="coding-state-row"><p id="coding-state" role="status">${stateLabel(s, selected.requests)}</p><div id="coding-controls">${controlsHtml(s)}</div></div><div id="coding-requests">${selected.requests.map(r => requestHtml(r, s.id))}</div><div id="coding-conversation" class="coding-conversation" tabindex="0" aria-label="Conversation"${s.status === 'closed' && messages.length === 0 ? html ` hidden` : ''}>${messages.length ? messages : html `<p class="coding-meta coding-no-messages">No messages yet.</p>`}</div><button type="button" id="coding-latest" class="coding-secondary" hidden>Latest update ↓</button>${composer}<details id="coding-changes" class="coding-changes"><summary>Changes</summary><div id="coding-change-content"><p class="coding-meta">Open to load the current changes.</p></div><button type="button" id="coding-refresh-changes" class="coding-secondary">Refresh changes</button><noscript>${postForm(`${sessionUrl(s.id)}/changes`, html `<button type="submit" class="coding-secondary">View changes</button>`)}</noscript><p id="coding-shipping"${['closed', 'uncertain'].includes(s.status) ? html ` hidden` : ''}>${postForm(`${sessionUrl(s.id)}/ship/preview`, html `<button type="submit" class="coding-link-button">Review for shipping</button>`)}</p></details>`;
     }
     return html `<section class="coding-workspace" data-coding-session="${selected?.session.id ?? ''}" data-coding-owner="${selected?.session.owner ?? input.owner ?? ''}" data-coding-project="${selectedRepo ?? input.projects[0]?.path ?? ''}" data-coding-status="${selected?.session.status ?? ''}" data-coding-native-thread="${String(Boolean(selected?.session.nativeThreadId))}" data-coding-revision="${selected?.revision ?? -1}" data-coding-csrf="${csrf}">${sidebar}<div class="coding-main"><div id="coding-error" class="coding-notice" role="alert"${error ? '' : html ` hidden`}>${noticeHtml(error)}</div><p id="coding-connection" class="coding-meta" role="status" hidden></p>${main}</div></section>`;
 }
@@ -276,7 +276,7 @@ export function codingWorkspaceScript() {
     const area = root.querySelector('#coding-change-content');
     const button = root.querySelector('#coding-refresh-changes'); button.disabled = true;
     try {
-      const response = await fetch(base + '/changes', {headers:{accept:'application/json'},credentials:'same-origin',cache:'no-store',signal:requestSignal()});
+      const response = await fetch(base + '/changes', {method:'POST',headers:{accept:'application/json'},body:new URLSearchParams({csrf}),credentials:'same-origin',cache:'no-store',signal:requestSignal()});
       if (response.status === 401 || response.redirected) { signedOut(); return; }
       if (!response.ok) throw new Error('Could not load changes. Try Refresh changes.');
       const changes = await response.json();

package/dist/coding-workspace.js

@@ -1,3 +1,4 @@
+import { checkoutGit } from './teardown-git.js';
 import { createHash, randomUUID } from 'node:crypto';
 import { mkdirSync, chmodSync, realpathSync } from 'node:fs';
 import { dirname, join } from 'node:path';
@@ -729,10 +730,21 @@ export class CodingWorkspace {
     }
     async changes(id, actor) {
         const session = this.get(id, actor);
+        // The code page reads this on a GET (docs/plans/get-side-effects.md), from a checkout the agent writes: every git
+        // here is the hardened checkout git, which refuses a config that could run a command and reads no global config.
+        // Read mode: the read flags, and the checkout's config and info/attributes as read once (teardown-git.ts readView),
+        // hold even if the agent changes them after checkoutGit read them: no hook, pager, filter or network.
+        const safe = checkoutGit(run, 'read');
+        const read = async (args) => {
+            const result = await safe('git', args, { cwd: session.worktree, timeoutMs: 60_000, maxBuffer: 1_048_576 });
+            if (result.code !== 0)
+                throw Error('Git could not complete this workspace operation. Check the repository and try again.');
+            return result.stdout;
+        };
         const [head, status, tracked, untracked] = await Promise.all([
-            this.git(session.worktree, ['rev-parse', 'HEAD']), this.git(session.worktree, ['status', '--short']),
-            run('git', ['--no-optional-locks', 'diff', '--no-ext-diff', '--no-textconv', session.base, '--'], { cwd: session.worktree, timeoutMs: 60_000, maxBuffer: 1_048_576 }),
-            this.git(session.worktree, ['ls-files', '--others', '--exclude-standard', '-z']),
+            read(['rev-parse', 'HEAD']), read(['status', '--short']),
+            safe('git', ['diff', '--no-ext-diff', '--no-textconv', session.base, '--'], { cwd: session.worktree, timeoutMs: 60_000, maxBuffer: 1_048_576 }),
+            read(['ls-files', '--others', '--exclude-standard', '-z']),
         ]);
         let diff = tracked.stdout, truncated = tracked.code !== 0;
         // git's no-index diff describes symlinks themselves; it does not follow a
@@ -743,7 +755,7 @@ export class CodingWorkspace {
                 truncated = true;
                 break;
             }
-            const part = await run('git', ['--no-optional-locks', 'diff', '--no-index', '--no-ext-diff', '--no-textconv', '--', '/dev/null', paths[index]], { cwd: session.worktree, timeoutMs: 60_000, maxBuffer: 131_072 });
+            const part = await safe('git', ['diff', '--no-index', '--no-ext-diff', '--no-textconv', '--', '/dev/null', paths[index]], { cwd: session.worktree, timeoutMs: 60_000, maxBuffer: 131_072 });
             diff += part.stdout;
             if (part.code !== 0 && part.code !== 1)
                 truncated = true;

package/dist/contracts/console-api.d.ts

@@ -123,6 +123,9 @@ export declare const CONSOLE_FORMS: {
     readonly notifications: FormContract<"digest" | "mode" | "screenshots">;
     readonly notificationsMute: FormContract<"pings" | "repo">;
     readonly telegramDigest: FormContract<"every">;
+    readonly pullRequestsCheck: FormContract<"repo">;
+    readonly connectionCheck: FormContract<"auth-mode" | "provider" | "return" | "value">;
+    readonly modelsRefresh: FormContract<"command" | "fingerprint" | "model" | "nonce" | "provider" | "repo" | "seconds" | "task" | "token">;
     readonly providerKey: FormContract<"auth-mode" | "provider" | "value">;
     readonly telegramToken: FormContract<"token">;
     readonly email: FormContract<"from" | "host" | "imapHost" | "imapPort" | "password" | "port" | "secure" | "user">;
@@ -149,6 +152,7 @@ export declare const CONSOLE_FORMS: {
     readonly leadIdentity: FormContract<"name" | "persona">;
     readonly leadAbout: FormContract<"about">;
     readonly leadPromiseCancel: FormContract<"promise">;
+    readonly leadCheck: FormContract<"return">;
     readonly chatConfig: FormContract<"daily-turns" | "forget-key" | "key" | "model" | "off" | "provider" | "return" | "token" | "weekly-usd">;
     readonly leadMint: FormContract<"ceiling-usd" | "follow" | "return" | "token">;
     readonly leadFollow: FormContract<"enabled" | "return">;
@@ -190,7 +194,7 @@ export declare const CONSOLE_FORMS: {
 };
 export type ConsoleFormName = keyof typeof CONSOLE_FORMS;
 /** The console POSTs whose handlers read no field (sign-out not even the shared guard): their contract is the empty form. */
-export declare const BODILESS_POSTS: readonly ["POST /settings/models/<unknown action>", "POST /settings/lead/on", "POST /r/<run>/draft-repair", "POST /ledger/checkpoint", "POST /settings/backups/now", "POST /mode/revoke", "POST /settings/telegram/retry", "POST /providers/<provider>/resume", "POST /logout", "POST /t/<task>/unhold", "POST /t/<task>/stop-carrying", "POST /t/<task>/plan", "POST /t/<task>/retry-review"];
+export declare const BODILESS_POSTS: readonly ["POST /settings/models/<unknown action>", "POST /settings/lead/on", "POST /r/<run>/draft-repair", "POST /ledger/checkpoint", "POST /settings/backups/now", "POST /mode/revoke", "POST /settings/telegram/retry", "POST /providers/<provider>/resume", "POST /logout", "POST /t/<task>/unhold", "POST /t/<task>/stop-carrying", "POST /t/<task>/plan", "POST /t/<task>/retry-review", "POST /settings/updates/check", "POST /settings/storage/check", "POST /projects/github", "POST /code/<session>/ship/preview"];
 /** The field names a console form's handler may read. */
 export type FormFieldOf<N extends ConsoleFormName> = (typeof CONSOLE_FORMS)[N] extends FormContract<infer K> ? K : never;
 /** `GET /ledger?format=json`: the chain's state, a page of entries (newest first) and the cursor for the next. */

package/dist/contracts/console-api.js

@@ -132,6 +132,10 @@ export const CONSOLE_FORMS = {
     notifications: formContract("POST /settings/notifications", ["mode", "digest", "screenshots"]),
     notificationsMute: formContract("POST /settings/notifications/mute", ["repo", "pings"]),
     telegramDigest: formContract("POST /settings/telegram-digest", ["every"]),
+    // Check again sits in the provider-key form and the setup card; Refresh models in the setup form.
+    pullRequestsCheck: formContract("POST /settings/pull-requests/check", ["repo"]),
+    connectionCheck: formContract("POST /settings/connection/check", ["provider", "auth-mode", "value", "return"]),
+    modelsRefresh: formContract("POST /control/models-refresh", ["repo", "nonce", "fingerprint", "token", "provider", "model", "command", "seconds", "task"]),
     providerKey: formContract("POST /settings/provider-key, /settings/provider-key-clear", ["provider", "auth-mode", "value"]),
     telegramToken: formContract("POST /settings/telegram-token", ["token"]),
     email: formContract("POST /settings/email, /settings/email-test, /settings/email-read-test", ["host", "port", "secure", "user", "from", "password", "imapHost", "imapPort"]),
@@ -158,6 +162,7 @@ export const CONSOLE_FORMS = {
     leadIdentity: formContract("POST /settings/lead/identity", ["name", "persona"]),
     leadAbout: formContract("POST /settings/lead/about", ["about"]),
     leadPromiseCancel: formContract("POST /settings/lead/promise/cancel", ["promise"]),
+    leadCheck: formContract("POST /lead/check", ["return"]),
     chatConfig: formContract("POST /chat/config", ["return", "token", "off", "forget-key", "provider", "model", "weekly-usd", "daily-turns", "key"]),
     leadMint: formContract("POST /chat/mate/mint", ["return", "ceiling-usd", "token", "follow"]),
     leadFollow: formContract("POST /chat/mate/follow", ["enabled", "return"]),
@@ -216,6 +221,11 @@ export const BODILESS_POSTS = [
     "POST /t/<task>/stop-carrying",
     "POST /t/<task>/plan",
     "POST /t/<task>/retry-review",
+    // Check now and its kin (docs/plans/get-side-effects.md): the form token only, no fields read.
+    "POST /settings/updates/check",
+    "POST /settings/storage/check",
+    "POST /projects/github",
+    "POST /code/<session>/ship/preview",
 ];
 // ---- the JSON API ------------------------------------------------------------------------------------------------
 const ledgerEntrySchema = z.looseObject({

package/dist/control-ui.d.ts

@@ -6,14 +6,15 @@ import { type ModelChoice } from "./setup-guide.js";
 import type { SetupInputs } from "./control-setup.js";
 import { type OpenRouterModels } from "./openrouter-models.js";
 export declare function connectionWords(connection: ProviderConnection): string;
-export declare function connectionHtml(provider: ProviderId, connection: ProviderConnection, task?: string): Html;
+/** The last sign-in check (null: none yet). Check again posts: a page never runs a check (docs/plans/get-side-effects.md). */
+export declare function connectionHtml(provider: ProviderId, connection: ProviderConnection | null, task?: string): Html;
 export declare function controlSetupHtml(data: {
     repo: string;
     csrf: string;
     provider: ProviderId;
     inputs: SetupInputs;
     models: ModelChoice[];
-    connection: ProviderConnection;
+    connection: ProviderConnection | null;
     catalog: OpenRouterModels | null;
     task?: string;
     preparation: {

package/dist/control-ui.js

@@ -8,15 +8,20 @@ export function connectionWords(connection) {
         unverified: "Not verified", "key-present": "API key saved · not verified", "key-works": "API key works", "key-refused": "API key refused", "missing-key": "API key needed",
     }[connection.state];
 }
+/** The last sign-in check (null: none yet). Check again posts: a page never runs a check (docs/plans/get-side-effects.md). */
 export function connectionHtml(provider, connection, task = "") {
     const query = new URLSearchParams({ provider, ...(task ? { task } : {}) });
-    return html `<div class="card assistant-account"><p><strong>${ASSISTANTS[provider].name} · ${connectionWords(connection)}</strong></p><p class="meta">${[connection.email, connection.plan, connection.method].filter(Boolean).join(" · ")}</p><p class="meta">Checked ${new Date(connection.checkedAt).toLocaleTimeString("en-US", { hour: "numeric", minute: "2-digit", timeZoneName: "short" })} on the computer running this console. Sign-in does not prove model access or remaining quota.</p><a class="button-link" href="/control/connection?${query.toString()}">${connection.state === "connected" ? "Manage connection" : "Connect account"}</a> · <a href="/control?${query.toString()}&amp;check-connection=1">Check again</a></div>`;
+    const back = `/control?${query.toString()}`;
+    const check = postForm("/settings/connection/check", html `<button type="submit" class="secondary">${connection === null ? "Check now" : "Check again"}</button>`, { attrs: { class: "inline" }, returnTo: back, hidden: { provider } });
+    if (connection === null)
+        return html `<div class="card assistant-account"><p><strong>${ASSISTANTS[provider].name} · Not checked yet</strong></p>${check}</div>`;
+    return html `<div class="card assistant-account"><p><strong>${ASSISTANTS[provider].name} · ${connectionWords(connection)}</strong></p><p class="meta">${[connection.email, connection.plan, connection.method].filter(Boolean).join(" · ")}</p><p class="meta">Checked ${new Date(connection.checkedAt).toLocaleTimeString("en-US", { hour: "numeric", minute: "2-digit", timeZoneName: "short" })} on the computer running this console. Sign-in does not prove model access or remaining quota.</p><a class="button-link" href="/control/connection?${query.toString()}">${connection.state === "connected" ? "Manage connection" : "Connect account"}</a> ${check}</div>`;
 }
 export function controlSetupHtml(data) {
     const { provider, inputs, task = "" } = data;
     const query = new URLSearchParams({ provider, ...(task ? { task } : {}) });
     const model = data.catalog !== null
-        ? openRouterPicker(data.catalog, inputs.model || null, `/control?${query}&refresh-models=1`)
+        ? openRouterPicker(data.catalog, inputs.model || null, "/control/models-refresh")
         : html `<label>Model<input type="text" name="model" value="${inputs.model}" list="setup-models" required autocomplete="off" placeholder="Exact model id or supported alias"></label><datalist id="setup-models">${data.models.map(one => html `<option value="${one.value}">${one.label}</option>`)}</datalist>`;
     return html `<h1>Project setup</h1><p>${data.repo}</p><p class="meta">Choose the default builder for new tasks and the preparation command for this project.</p><nav class="assistant-picker row" aria-label="Choose provider">${joinHtml(Object.keys(ASSISTANTS).map(id => html `<a class="button-link" href="/control?${new URLSearchParams({ provider: id, ...(task ? { task } : {}) }).toString()}"${id === provider ? html ` aria-current="page"` : ""}>${ASSISTANTS[id].name}</a>`), " ")}</nav>${connectionHtml(provider, data.connection, task)}${postForm("/control/setup-preview", html `${model}<details class="setup-advanced"><summary>Project preparation</summary>${data.preparation === null ? "" : html `<p class="meta">Suggested from ${data.preparation.evidence}: ${data.preparation.label} — <code>${data.preparation.command}</code>. Review before approving.</p>`}<label>Preparation command<textarea name="command" rows="2" maxlength="2000">${inputs.command}</textarea></label><label>Preparation timeout in seconds<input name="seconds" type="number" min="1" max="3600" value="${inputs.seconds}" required></label><p class="meta">Preparation applies to subsequent runs, including already approved tasks. Saving setup does not execute it.</p></details><button type="submit">Review project setup</button>`, { attrs: { class: "card" }, hidden: { repo: data.repo, provider, task } })}<section class="card"><h2>Agent instructions</h2>${data.instructions.message ? html `<p>${data.instructions.message}</p>` : data.instructions.installed ? html `<p>Toolroll instructions are installed.</p>` :
         html `<p>Give the agent the project's Toolroll handoff instructions.</p>${postForm("/control/instructions-preview", html `<button>Review instructions</button>`, { hidden: { repo: data.repo } })}`}</section><p><a href="/fleet">Configure planning, repair, and review agents</a> · <a href="/tasks/new">Describe a task</a></p>`;

package/dist/demo.js

@@ -1481,7 +1481,7 @@ export function createDemoLead(input) {
                 try {
                     advance(clock());
                 }
-                catch { /* the next read advances it again */ }
+                catch { /* the next beat or background pass advances it again */ }
             }, beat * stepMs + 20);
             timer.unref();
             timers.add(timer);
@@ -1489,8 +1489,10 @@ export function createDemoLead(input) {
         void exchange;
     };
     return {
-        exchanges: () => { advance(clock()); return list; },
-        version: () => { advance(clock()); return changes; },
+        // Reads only (docs/plans/get-side-effects.md): the beat timers, the console's background pass and the person's own
+        // acts move the story on, never a page visit.
+        exchanges: () => list,
+        version: () => changes,
         ask(text, now) {
             advance(now);
             const asked = said(text);

package/dist/deploy-gate.js

@@ -18,8 +18,11 @@ export function deploymentGate(store, input) {
     if (run === null || ref === null || head === null)
         return refuse(`Run ${input.runId} is not a built candidate.`);
     // `task regate` reruns the approved check on the last built commit and records no-change: a candidate only for that commit.
-    const regated = run.outcome === "no-change" && scope?.candidate === head &&
-        store.runsFor(run.taskRef).find(one => one.id < input.runId && one.role === "builder" && one.outcome === "built")?.headRevision === head;
+    // A prepared candidate's build records a commit of its own holding exactly the candidate's tree; its rerun under the same
+    // signed scope is the same check of that commit (the digest is held to the approved one below).
+    const built = store.runsFor(run.taskRef).find(one => one.id < input.runId && one.role === "builder" && one.outcome === "built");
+    const regated = run.outcome === "no-change" && built?.headRevision === head &&
+        (scope?.candidate === head || ((scope?.candidate ?? null) !== null && built.scopeDigest === run.scopeDigest));
     if (run.role !== "builder" || !(run.outcome === "built" || regated))
         return refuse(`Run ${input.runId} is not a built candidate at ${head.slice(0, 7)}.`);
     if (scope === null || scope.approvedDigest !== scope.digest || scope.digest !== run.scopeDigest)

package/dist/desktop-update.d.ts

@@ -92,8 +92,12 @@ export declare function previewDesktopUpdate(stateDir: string, installed: string
 }>;
 export declare function prepareDesktopUpdate(stateDir: string, installed: string, candidate: string, label: string, expected: string, hooks?: UpdateHooks): Promise<UpdateJournal>;
 export declare function sqliteLock(file: string, busyTimeoutMs?: number): DatabaseSync | null;
+/** Whether another process holds the lock in `file`, without making the file or changing it: a status read (a page
+ * shows it, docs/plans/get-side-effects.md). A file that isn't there yet is held by nobody. */
+export declare function lockHeld(file: string): boolean;
 export declare const installationLock: (j: UpdateJournal) => DatabaseSync | null;
 export declare function desktopUpdateStatus(stateDir: string): {
+    version?: never;
     active: boolean;
     phase: string;
     detail: string;
@@ -107,7 +111,6 @@ export declare function desktopUpdateStatus(stateDir: string): {
     wasRunning?: never;
     backupPath?: never;
     updateId?: never;
-    version?: never;
     buildId?: never;
     workDir?: never;
 } | {

package/dist/desktop-update.js

@@ -1,3 +1,4 @@
+import { inReadOnlyRequest } from "./read-only-request.js";
 import { createHash, randomUUID } from "node:crypto";
 import { closeSync, chmodSync, copyFileSync, cpSync, existsSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
@@ -261,11 +262,14 @@ export function desktopUpdateWaitingOf(databaseFile, inTheWay, stateDirs = [dirn
         }
         if (!j || resolve(j.databaseFile) !== resolve(databaseFile))
             continue;
-        try {
-            if (releaseStalledDesktopUpdate(stateDir))
-                j = readUpdateJournal(stateDir);
+        // A page visit only reads (docs/plans/get-side-effects.md): the console's background pass releases it.
+        if (!inReadOnlyRequest()) {
+            try {
+                if (releaseStalledDesktopUpdate(stateDir))
+                    j = readUpdateJournal(stateDir);
+            }
+            catch { /* shown as last saved */ }
         }
-        catch { /* shown as last saved */ }
         const version = j.next.version;
         if (j.phase === "draining")
             return updateWaitingWords({ app: true, version, stopped: false, lingering: j.waiting ?? null });
@@ -394,14 +398,46 @@ export function sqliteLock(file, busyTimeoutMs = 0) {
         throw error;
     }
 }
+/** Whether another process holds the lock in `file`, without making the file or changing it: a status read (a page
+ * shows it, docs/plans/get-side-effects.md). A file that isn't there yet is held by nobody. */
+export function lockHeld(file) {
+    let st;
+    try {
+        st = lstatSync(file);
+    }
+    catch {
+        return false;
+    }
+    // Not a plain file of ours (a link, or one someone else made): treated as held, so nothing goes ahead on it.
+    if (!st.isFile() || (typeof process.getuid === "function" && st.uid !== process.getuid()))
+        return true;
+    let db;
+    // Read-only: it never makes the file. The holder's exclusive lock stops even a read.
+    try {
+        db = new (sqlite().DatabaseSync)(file, { readOnly: true });
+    }
+    catch {
+        return true;
+    }
+    try {
+        db.exec("PRAGMA busy_timeout=0");
+        db.prepare("SELECT COUNT(*) FROM sqlite_master").get();
+        return false;
+    }
+    catch (error) {
+        return String(error).includes("locked") || String(error).includes("busy") || [5, 6].includes(error.errcode ?? 0);
+    }
+    finally {
+        db.close();
+    }
+}
 const workerLock = (j, busyTimeoutMs = 0) => sqliteLock(join(j.workDir, "worker.sqlite"), busyTimeoutMs);
 export const installationLock = (j) => sqliteLock(join(dirname(j.workDir), `installation-${digest(j.old.path).slice(0, 24)}.sqlite`));
 export function desktopUpdateStatus(stateDir) {
     const j = readUpdateJournal(stateDir);
     if (!j)
         return { active: false, phase: "none", detail: "No update is in progress.", running: false, canResume: false, canCancel: false };
-    const lock = workerLock(j), running = lock === null;
-    lock?.close();
+    const running = lockHeld(join(j.workDir, "worker.sqlite"));
     let recovery = null;
     try {
         privateFile(join(j.workDir, "recovery.json"));
@@ -409,9 +445,7 @@ export function desktopUpdateStatus(stateDir) {
     }
     catch { /* A legacy/manual update has no guardian. */ }
     const wantsAutomatic = recovery?.id === j.id && ["armed", "running", "backoff"].includes(recovery.state ?? "") && !terminal(j.phase);
-    const guardianLock = wantsAutomatic ? sqliteLock(join(j.workDir, "guardian.sqlite")) : undefined;
-    const automatic = wantsAutomatic && (guardianLock === null || Date.now() - Date.parse(recovery?.updatedAt ?? "") < 45_000);
-    guardianLock?.close();
+    const automatic = wantsAutomatic && (lockHeld(join(j.workDir, "guardian.sqlite")) || Date.now() - Date.parse(recovery?.updatedAt ?? "") < 45_000);
     const detail = wantsAutomatic && !automatic ? "Automatic recovery has not restarted. Work remains paused; use Retry safely in Update status." : recovery?.state === "attention" || (automatic && (!running || j.phase === "needs-attention")) ? recovery?.detail ?? j.detail : j.detail;
     return { active: !terminal(j.phase), phase: j.phase, detail, error: j.error ?? null, running, automaticRecovery: automatic, recoveryAttempts: recovery?.attempts ?? 0, recoveryRepairs: recovery?.repairs ?? 0, canResume: !running && !automatic && !terminal(j.phase), canCancel: !terminal(j.phase), wasRunning: j.wasRunning && !updateStopRequested(j), backupPath: j.backupPath ?? null, updateId: j.id, version: j.next.version, buildId: j.next.buildId, workDir: j.workDir };
 }

package/dist/dispose.js

@@ -23,7 +23,7 @@ import { nightlyTaskRef, releaseTaskRef } from "./store.js";
 import {} from "./proof.js";
 import { verificationEvidence, failedVerificationEvidence } from "./verification-evidence.js";
 import { classifyGateFailure, describeGateFailure, gateFailureSummary } from "./gate-failure.js";
-import { propose, approve } from "./scope.js";
+import { propose, approve, liveReleaseOf } from "./scope.js";
 import { headWithin } from "./names.js";
 /** The reasons tick classifies as the attempt itself breaking. */
 const TICK_FAILURE_REASONS = new Set([
@@ -456,6 +456,35 @@ export function regateTask(store, taskId, now, approval) {
         return { ok: false, reason: "no-attempt", message: `${taskId} has no scope` };
     const head = last.headRevision;
     const actor = approval.kind === "operator" ? approval.name : `mode ${approval.name}`;
+    // A prepared candidate (a release gate, the nightly check) already names the approved commit, and the builder loads
+    // exactly its tree on every attempt. The rerun keeps that scope and its approval as they are: nothing is proposed or
+    // sealed again, so a regate can never swap the approved commit, its release terms or the person's yes for others
+    // (2026-10-27: a regate rewrote release-0.9.73's candidate to its own build commit and the release refused it).
+    if ((scope.candidate ?? null) !== null || (scope.releaseTerms ?? null) !== null) {
+        const candidate = scope.candidate ?? null;
+        if (candidate === null || scope.approvedDigest !== scope.digest || last.scopeDigest !== scope.digest) {
+            return { ok: false, reason: "not-approved", message: `${taskId}'s approved commit or scope changed since attempt #${last.id}, or its approval no longer stands; approve its scope again instead` };
+        }
+        // A release's task runs again only while its one approval still stands for it (the dispatch would refuse it anyway).
+        const release = liveReleaseOf(store, taskId, "dispatch", now);
+        if (release.applies && !release.ok)
+            return { ok: false, reason: "not-approved", message: `${taskId} can't run again: ${release.why}` };
+        // Any other seal stands only while its authority does (an expired mode, a revoked approver): the queue would never
+        // dispatch it, so the regate says so instead of queueing a rerun that can't start.
+        if (!store.modeApprovalLive(ref.id, now))
+            return { ok: false, reason: "not-approved", message: `${taskId}'s approval no longer stands; approve its scope again instead` };
+        return store.transact(() => {
+            if (store.getTask(taskId)?.state !== "queued") {
+                const queued = store.requeueTask(taskId, actor, now);
+                if (!queued.ok) {
+                    const why = { claimed: "claimed", "accepted-result": "accepted-result", published: "published" };
+                    return { ok: false, reason: why[queued.reason] ?? "not-rejected", message: `${taskId} could not be queued again: ${queued.reason}` };
+                }
+            }
+            store.addRunNote(last.id, "Toolroll", `The check will run again on the approved commit ${candidate.slice(0, 7)}, under the same approval, as a new attempt, ${approval.kind === "operator" ? `on ${approval.name}'s say-so` : "automatically once, because the failure was outside this change"}.`, now);
+            return { ok: true, run: last.id, head: candidate };
+        });
+    }
     return store.transact(() => {
         const proposed = propose(store, {
             taskId, goal: scope.goal, outOfScope: scope.outOfScope, touches: scope.touches, budgetMicrousd: scope.budgetMicrousd,
@@ -520,7 +549,11 @@ export function maybeTriggerRepair(store, repo, evidenceRoot, sourceRunId, verdi
     // to a person. No repair draft, no third pass, on either road.
     {
         const rerunTask = store.refById(run.taskRef)?.externalId ?? "";
-        if (run.headRevision && store.getScope(rerunTask)?.candidate === run.headRevision && store.builderAttemptsAt(run.taskRef, run.headRevision) >= 2) {
+        // A prepared candidate's attempts each record their own commit of the candidate's tree, so a rerun under the same
+        // approved scope is the same commit's check even when its head isn't the candidate itself.
+        const rerunScope = store.getScope(rerunTask);
+        const sameCommit = rerunScope !== null && (rerunScope.candidate === run.headRevision || ((rerunScope.candidate ?? null) !== null && rerunScope.digest === run.scopeDigest));
+        if (run.headRevision && sameCommit && store.builderAttemptsAt(run.taskRef, run.headRevision) >= 2) {
             const contradicted = cause === "review";
             store.enqueueNotification({ source: { run: sourceRunId }, dedupeKey: `regate-failed:${sourceRunId}`, kind: "repair-evidence", pushClass: "attention",
                 subject: contradicted ? "The rerun on the same commit was contradicted by its review" : "The project check failed again on the same commit",