toolroll 0.9.74 → 0.9.75

package/dist/browser-workspace.d.ts

@@ -276,7 +276,7 @@ export type BrowserSettingsView = {
         connection: {
             words: string;
             facts: string;
-            checkHref: string;
+            checkAction: string;
         } | null;
         usage: string;
         envName: string;

package/dist/chat-acceptance.d.ts

@@ -4,12 +4,15 @@
 import type { Store } from "./store.js";
 import type { VerifiedApprover } from "./principal.js";
 import { type CriterionMatrixRow } from "./proof.js";
+import { type ApprovedCheckState } from "./task-status.js";
 export declare const ACCEPTANCE_PAGE_SIZE = 3;
+/** `check`: the approved check read now (task-status.ts approvedCheckOf); undefined when this read had no saved files,
+ * and then a verified result claims nothing about its check. */
 export declare function acceptanceStatus(proof: {
     verdict: string;
     reasons: readonly string[];
     matrix: readonly CriterionMatrixRow[];
-} | null, accepted: boolean): string;
+} | null, accepted: boolean, check?: ApprovedCheckState | null): string;
 export declare function readAcceptanceEvidence(store: Store, who: VerifiedApprover, root: string | undefined, task: string, runId?: number, offset?: number): {
     ok: false;
     message: string;

package/dist/chat-acceptance.js

@@ -1,12 +1,19 @@
 import { readVerifiedArtifact, readVerifiedProofForRun, scanForSecrets } from "./evidence.js";
 import { verificationEvidence } from "./verification-evidence.js";
 import { manualReviewOnly } from "./proof.js";
+import { assignmentChecksForRun } from "./assignment.js";
+import { approvedCheckOf, approvedCheckStateOf, checksFactOf } from "./task-status.js";
 export const ACCEPTANCE_PAGE_SIZE = 3;
-export function acceptanceStatus(proof, accepted) {
+/** `check`: the approved check read now (task-status.ts approvedCheckOf); undefined when this read had no saved files,
+ * and then a verified result claims nothing about its check. */
+export function acceptanceStatus(proof, accepted, check) {
     if (accepted)
         return manualReviewOnly(proof) ? "Accepted by a person" : "Accepted with an exception";
     if (manualReviewOnly(proof))
         return "You check the remaining requirements";
+    if (proof?.verdict === "verified" && check !== "passed") {
+        return check === undefined ? "Open the result to see its checks" : check === "failed" ? "Checks failed" : check === "running" ? "Checks running" : "The check result couldn't be read";
+    }
     return proof === null ? "No checks recorded" : ({ verified: "Checks passed", attested: "Checks reported by the agent", short: "Some required material is missing", refuted: "Saved result conflicts with the approved scope" }[proof.verdict] ?? "Some required material is missing");
 }
 export function readAcceptanceEvidence(store, who, root, task, runId, offset = 0) {
@@ -48,6 +55,9 @@ export function readAcceptanceEvidence(store, who, root, task, runId, offset = 0
     else if (!proof.ok)
         problems.push("The saved proof is unavailable or cannot be read.");
     const verification = root === undefined ? null : verificationEvidence(store, root, run.id);
+    // The one answer to "did the approved check pass" (task-status.ts), with follow-ups on the same commit.
+    const checkNow = root === undefined || run.role === "scout" ? undefined
+        : approvedCheckStateOf(approvedCheckOf(recorded?.verdict ?? null, recorded?.reasons ?? [], checksFactOf(assignmentChecksForRun(store, root, run.id, new Date()), run.headRevision)));
     let gate = { status: "No machine verification receipt available" };
     if (verification !== null && !verification.ok) {
         problems.push(verification.problem);
@@ -55,7 +65,7 @@ export function readAcceptanceEvidence(store, who, root, task, runId, offset = 0
     }
     else if (verification?.ok && verification.bytes !== null) {
         const receipt = JSON.parse(verification.bytes);
-        gate = { status: receipt.result.ran ? (receipt.result.exitCode === 0 ? "Passed" : "Failed") : "Did not run", exitCode: receipt.result.exitCode ?? null, command: "The approved project verification command", logShortened: receipt.log.truncated };
+        gate = { status: receipt.result.ran ? (receipt.result.exitCode === 0 ? checkNow === undefined || checkNow === "passed" ? "Passed" : "Passed when it ran; not counted now" : "Failed") : "Did not run", exitCode: receipt.result.exitCode ?? null, command: "The approved project verification command", logShortened: receipt.log.truncated };
     }
     // These are summaries for conversation, not substitute approval terms.
     // Full statements, caveats and references remain on the authenticated screen.
@@ -71,7 +81,7 @@ export function readAcceptanceEvidence(store, who, root, task, runId, offset = 0
     return { ok: true, body: {
             task, run: run.id, title: store.getTask(task)?.title ?? task, currentExecution: family.current.id,
             isCurrent: family.current.id === task && store.runsFor(ref.id).find(one => one.finishedAt !== null && ["builder", "repair", "scout"].includes(one.role))?.id === run.id,
-            status: acceptanceStatus(recorded, acceptance !== null), recordedVerdict: recorded?.verdict ?? null,
+            status: acceptanceStatus(recorded, acceptance !== null, checkNow), recordedVerdict: recorded?.verdict ?? null,
             accepted: acceptance !== null, acceptance: acceptance === null ? null : { at: acceptance.acceptedAt, note: brief(acceptance.note) },
             reasons: (recorded?.reasons ?? []).map(one => brief(one)), gate,
             criteriaTotal: matrix.length, nextCriterionOffset: offset + page.length < matrix.length ? offset + page.length : null,

package/dist/cli.js

@@ -1301,7 +1301,7 @@ async function runDemoCommand(argv, write) {
     const now = new Date();
     const { sandbox, store, seed, evidenceRoot, passwordFile, lead } = createDemoSandbox(now);
     const server = createDecisionServer({
-        store, evidenceRoot, clock: () => new Date(), repos: seed.repos, demoLead: lead,
+        store, evidenceRoot, clock: () => new Date(), repos: seed.repos, demoLead: lead, backgroundChecks: true,
         ...(allowedHosts.length === 0 ? {} : { allowedHosts }),
     });
     await new Promise((ready, failed) => {

package/dist/coding-handoff.js

@@ -1,4 +1,5 @@
 /** A committed native session enters the existing review flow, never another executor. */
+import { checkoutGitSync } from './teardown-git.js';
 import { execFileSync } from 'node:child_process';
 import { lstatSync, realpathSync } from 'node:fs';
 import { sqliteRuntime } from './sqlite-runtime.js';
@@ -52,11 +53,11 @@ function catalog(store, readOnly) {
         throw error;
     }
 }
+// The coding checkout is written by an agent (its config, hooks, filters): every read goes through the hardened
+// checkout git, which the code page's GET preview also uses (docs/plans/get-side-effects.md).
 function git(repo, args) {
     try {
-        return execFileSync('git', ['--no-optional-locks', '--no-replace-objects', '--no-lazy-fetch', '-c', 'core.hooksPath=/dev/null', '-C', repo, ...args], {
-            encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 60_000, maxBuffer: 1_048_576,
-        }).trimEnd();
+        return checkoutGitSync(repo, ['--no-replace-objects', '--no-lazy-fetch', ...args]).trimEnd();
     }
     catch {
         throw Error('The committed coding result could not be verified in Git. Check the project and try again.');

package/dist/coding-ui.js

@@ -76,7 +76,7 @@ export function codingWorkspaceHtml(input) {
         const blocked = !s.nativeThreadId || !['ready', 'working', 'failed', 'interrupted'].includes(s.status);
         const messages = selected.items.filter(item => item.type !== 'reasoning').map(itemHtml);
         const composer = postForm(`${sessionUrl(s.id)}/send`, html `<label for="coding-prompt">Message Codex</label><textarea id="coding-prompt" name="prompt" rows="2" maxlength="24000" required placeholder="Describe a change or ask about the result…">${input.draft ?? ''}</textarea><div class="coding-actions"><button type="submit"${blocked ? html ` disabled` : ''}>${s.status === 'working' ? 'Send update' : 'Send message'}</button></div>`, { attrs: { 'data-coding-form': 'send', class: 'coding-composer', hidden: s.status === 'closed' }, hidden: { requestId: randomUUID() } });
-        main = html `<header class="coding-header"><div><h1>${s.title}</h1><p class="coding-meta">${projectName(s.repo)} · Codex${s.model ? html ` · ${s.model}` : ''}</p></div><details class="coding-session-detail"><summary aria-label="Session details">Details</summary><dl><dt>Branch</dt><dd>${s.branch}</dd><dt>Worktree</dt><dd>${s.worktree}</dd><dt>Native session</dt><dd>${s.nativeThreadId ?? 'Not established'}</dd>${s.initialRequest ? html `<dt>Initial request</dt><dd class="coding-text">${s.initialRequest.prompt}</dd>` : ''}</dl></details></header><div class="coding-state-row"><p id="coding-state" role="status">${stateLabel(s, selected.requests)}</p><div id="coding-controls">${controlsHtml(s)}</div></div><div id="coding-requests">${selected.requests.map(r => requestHtml(r, s.id))}</div><div id="coding-conversation" class="coding-conversation" tabindex="0" aria-label="Conversation"${s.status === 'closed' && messages.length === 0 ? html ` hidden` : ''}>${messages.length ? messages : html `<p class="coding-meta coding-no-messages">No messages yet.</p>`}</div><button type="button" id="coding-latest" class="coding-secondary" hidden>Latest update ↓</button>${composer}<details id="coding-changes" class="coding-changes"><summary>Changes</summary><div id="coding-change-content"><p class="coding-meta">Open to load the current changes.</p></div><button type="button" id="coding-refresh-changes" class="coding-secondary">Refresh changes</button><noscript><a href="${sessionUrl(s.id)}/changes">View changes</a></noscript><p id="coding-shipping"${['closed', 'uncertain'].includes(s.status) ? html ` hidden` : ''}><a class="coding-link-button" href="${sessionUrl(s.id)}/ship">Review for shipping</a></p></details>`;
+        main = html `<header class="coding-header"><div><h1>${s.title}</h1><p class="coding-meta">${projectName(s.repo)} · Codex${s.model ? html ` · ${s.model}` : ''}</p></div><details class="coding-session-detail"><summary aria-label="Session details">Details</summary><dl><dt>Branch</dt><dd>${s.branch}</dd><dt>Worktree</dt><dd>${s.worktree}</dd><dt>Native session</dt><dd>${s.nativeThreadId ?? 'Not established'}</dd>${s.initialRequest ? html `<dt>Initial request</dt><dd class="coding-text">${s.initialRequest.prompt}</dd>` : ''}</dl></details></header><div class="coding-state-row"><p id="coding-state" role="status">${stateLabel(s, selected.requests)}</p><div id="coding-controls">${controlsHtml(s)}</div></div><div id="coding-requests">${selected.requests.map(r => requestHtml(r, s.id))}</div><div id="coding-conversation" class="coding-conversation" tabindex="0" aria-label="Conversation"${s.status === 'closed' && messages.length === 0 ? html ` hidden` : ''}>${messages.length ? messages : html `<p class="coding-meta coding-no-messages">No messages yet.</p>`}</div><button type="button" id="coding-latest" class="coding-secondary" hidden>Latest update ↓</button>${composer}<details id="coding-changes" class="coding-changes"><summary>Changes</summary><div id="coding-change-content"><p class="coding-meta">Open to load the current changes.</p></div><button type="button" id="coding-refresh-changes" class="coding-secondary">Refresh changes</button><noscript>${postForm(`${sessionUrl(s.id)}/changes`, html `<button type="submit" class="coding-secondary">View changes</button>`)}</noscript><p id="coding-shipping"${['closed', 'uncertain'].includes(s.status) ? html ` hidden` : ''}>${postForm(`${sessionUrl(s.id)}/ship/preview`, html `<button type="submit" class="coding-link-button">Review for shipping</button>`)}</p></details>`;
     }
     return html `<section class="coding-workspace" data-coding-session="${selected?.session.id ?? ''}" data-coding-owner="${selected?.session.owner ?? input.owner ?? ''}" data-coding-project="${selectedRepo ?? input.projects[0]?.path ?? ''}" data-coding-status="${selected?.session.status ?? ''}" data-coding-native-thread="${String(Boolean(selected?.session.nativeThreadId))}" data-coding-revision="${selected?.revision ?? -1}" data-coding-csrf="${csrf}">${sidebar}<div class="coding-main"><div id="coding-error" class="coding-notice" role="alert"${error ? '' : html ` hidden`}>${noticeHtml(error)}</div><p id="coding-connection" class="coding-meta" role="status" hidden></p>${main}</div></section>`;
 }
@@ -276,7 +276,7 @@ export function codingWorkspaceScript() {
     const area = root.querySelector('#coding-change-content');
     const button = root.querySelector('#coding-refresh-changes'); button.disabled = true;
     try {
-      const response = await fetch(base + '/changes', {headers:{accept:'application/json'},credentials:'same-origin',cache:'no-store',signal:requestSignal()});
+      const response = await fetch(base + '/changes', {method:'POST',headers:{accept:'application/json'},body:new URLSearchParams({csrf}),credentials:'same-origin',cache:'no-store',signal:requestSignal()});
       if (response.status === 401 || response.redirected) { signedOut(); return; }
       if (!response.ok) throw new Error('Could not load changes. Try Refresh changes.');
       const changes = await response.json();

package/dist/coding-workspace.js

@@ -1,3 +1,4 @@
+import { checkoutGit } from './teardown-git.js';
 import { createHash, randomUUID } from 'node:crypto';
 import { mkdirSync, chmodSync, realpathSync } from 'node:fs';
 import { dirname, join } from 'node:path';
@@ -729,10 +730,21 @@ export class CodingWorkspace {
     }
     async changes(id, actor) {
         const session = this.get(id, actor);
+        // The code page reads this on a GET (docs/plans/get-side-effects.md), from a checkout the agent writes: every git
+        // here is the hardened checkout git, which refuses a config that could run a command and reads no global config.
+        // Read mode: the read flags, and the checkout's config and info/attributes as read once (teardown-git.ts readView),
+        // hold even if the agent changes them after checkoutGit read them: no hook, pager, filter or network.
+        const safe = checkoutGit(run, 'read');
+        const read = async (args) => {
+            const result = await safe('git', args, { cwd: session.worktree, timeoutMs: 60_000, maxBuffer: 1_048_576 });
+            if (result.code !== 0)
+                throw Error('Git could not complete this workspace operation. Check the repository and try again.');
+            return result.stdout;
+        };
         const [head, status, tracked, untracked] = await Promise.all([
-            this.git(session.worktree, ['rev-parse', 'HEAD']), this.git(session.worktree, ['status', '--short']),
-            run('git', ['--no-optional-locks', 'diff', '--no-ext-diff', '--no-textconv', session.base, '--'], { cwd: session.worktree, timeoutMs: 60_000, maxBuffer: 1_048_576 }),
-            this.git(session.worktree, ['ls-files', '--others', '--exclude-standard', '-z']),
+            read(['rev-parse', 'HEAD']), read(['status', '--short']),
+            safe('git', ['diff', '--no-ext-diff', '--no-textconv', session.base, '--'], { cwd: session.worktree, timeoutMs: 60_000, maxBuffer: 1_048_576 }),
+            read(['ls-files', '--others', '--exclude-standard', '-z']),
         ]);
         let diff = tracked.stdout, truncated = tracked.code !== 0;
         // git's no-index diff describes symlinks themselves; it does not follow a
@@ -743,7 +755,7 @@ export class CodingWorkspace {
                 truncated = true;
                 break;
             }
-            const part = await run('git', ['--no-optional-locks', 'diff', '--no-index', '--no-ext-diff', '--no-textconv', '--', '/dev/null', paths[index]], { cwd: session.worktree, timeoutMs: 60_000, maxBuffer: 131_072 });
+            const part = await safe('git', ['diff', '--no-index', '--no-ext-diff', '--no-textconv', '--', '/dev/null', paths[index]], { cwd: session.worktree, timeoutMs: 60_000, maxBuffer: 131_072 });
             diff += part.stdout;
             if (part.code !== 0 && part.code !== 1)
                 truncated = true;

package/dist/contracts/console-api.d.ts

@@ -123,6 +123,9 @@ export declare const CONSOLE_FORMS: {
     readonly notifications: FormContract<"digest" | "mode" | "screenshots">;
     readonly notificationsMute: FormContract<"pings" | "repo">;
     readonly telegramDigest: FormContract<"every">;
+    readonly pullRequestsCheck: FormContract<"repo">;
+    readonly connectionCheck: FormContract<"auth-mode" | "provider" | "return" | "value">;
+    readonly modelsRefresh: FormContract<"command" | "fingerprint" | "model" | "nonce" | "provider" | "repo" | "seconds" | "task" | "token">;
     readonly providerKey: FormContract<"auth-mode" | "provider" | "value">;
     readonly telegramToken: FormContract<"token">;
     readonly email: FormContract<"from" | "host" | "imapHost" | "imapPort" | "password" | "port" | "secure" | "user">;
@@ -149,6 +152,7 @@ export declare const CONSOLE_FORMS: {
     readonly leadIdentity: FormContract<"name" | "persona">;
     readonly leadAbout: FormContract<"about">;
     readonly leadPromiseCancel: FormContract<"promise">;
+    readonly leadCheck: FormContract<"return">;
     readonly chatConfig: FormContract<"daily-turns" | "forget-key" | "key" | "model" | "off" | "provider" | "return" | "token" | "weekly-usd">;
     readonly leadMint: FormContract<"ceiling-usd" | "follow" | "return" | "token">;
     readonly leadFollow: FormContract<"enabled" | "return">;
@@ -190,7 +194,7 @@ export declare const CONSOLE_FORMS: {
 };
 export type ConsoleFormName = keyof typeof CONSOLE_FORMS;
 /** The console POSTs whose handlers read no field (sign-out not even the shared guard): their contract is the empty form. */
-export declare const BODILESS_POSTS: readonly ["POST /settings/models/<unknown action>", "POST /settings/lead/on", "POST /r/<run>/draft-repair", "POST /ledger/checkpoint", "POST /settings/backups/now", "POST /mode/revoke", "POST /settings/telegram/retry", "POST /providers/<provider>/resume", "POST /logout", "POST /t/<task>/unhold", "POST /t/<task>/stop-carrying", "POST /t/<task>/plan", "POST /t/<task>/retry-review"];
+export declare const BODILESS_POSTS: readonly ["POST /settings/models/<unknown action>", "POST /settings/lead/on", "POST /r/<run>/draft-repair", "POST /ledger/checkpoint", "POST /settings/backups/now", "POST /mode/revoke", "POST /settings/telegram/retry", "POST /providers/<provider>/resume", "POST /logout", "POST /t/<task>/unhold", "POST /t/<task>/stop-carrying", "POST /t/<task>/plan", "POST /t/<task>/retry-review", "POST /settings/updates/check", "POST /settings/storage/check", "POST /projects/github", "POST /code/<session>/ship/preview"];
 /** The field names a console form's handler may read. */
 export type FormFieldOf<N extends ConsoleFormName> = (typeof CONSOLE_FORMS)[N] extends FormContract<infer K> ? K : never;
 /** `GET /ledger?format=json`: the chain's state, a page of entries (newest first) and the cursor for the next. */

package/dist/contracts/console-api.js

@@ -132,6 +132,10 @@ export const CONSOLE_FORMS = {
     notifications: formContract("POST /settings/notifications", ["mode", "digest", "screenshots"]),
     notificationsMute: formContract("POST /settings/notifications/mute", ["repo", "pings"]),
     telegramDigest: formContract("POST /settings/telegram-digest", ["every"]),
+    // Check again sits in the provider-key form and the setup card; Refresh models in the setup form.
+    pullRequestsCheck: formContract("POST /settings/pull-requests/check", ["repo"]),
+    connectionCheck: formContract("POST /settings/connection/check", ["provider", "auth-mode", "value", "return"]),
+    modelsRefresh: formContract("POST /control/models-refresh", ["repo", "nonce", "fingerprint", "token", "provider", "model", "command", "seconds", "task"]),
     providerKey: formContract("POST /settings/provider-key, /settings/provider-key-clear", ["provider", "auth-mode", "value"]),
     telegramToken: formContract("POST /settings/telegram-token", ["token"]),
     email: formContract("POST /settings/email, /settings/email-test, /settings/email-read-test", ["host", "port", "secure", "user", "from", "password", "imapHost", "imapPort"]),
@@ -158,6 +162,7 @@ export const CONSOLE_FORMS = {
     leadIdentity: formContract("POST /settings/lead/identity", ["name", "persona"]),
     leadAbout: formContract("POST /settings/lead/about", ["about"]),
     leadPromiseCancel: formContract("POST /settings/lead/promise/cancel", ["promise"]),
+    leadCheck: formContract("POST /lead/check", ["return"]),
     chatConfig: formContract("POST /chat/config", ["return", "token", "off", "forget-key", "provider", "model", "weekly-usd", "daily-turns", "key"]),
     leadMint: formContract("POST /chat/mate/mint", ["return", "ceiling-usd", "token", "follow"]),
     leadFollow: formContract("POST /chat/mate/follow", ["enabled", "return"]),
@@ -216,6 +221,11 @@ export const BODILESS_POSTS = [
     "POST /t/<task>/stop-carrying",
     "POST /t/<task>/plan",
     "POST /t/<task>/retry-review",
+    // Check now and its kin (docs/plans/get-side-effects.md): the form token only, no fields read.
+    "POST /settings/updates/check",
+    "POST /settings/storage/check",
+    "POST /projects/github",
+    "POST /code/<session>/ship/preview",
 ];
 // ---- the JSON API ------------------------------------------------------------------------------------------------
 const ledgerEntrySchema = z.looseObject({

package/dist/control-ui.d.ts

@@ -6,14 +6,15 @@ import { type ModelChoice } from "./setup-guide.js";
 import type { SetupInputs } from "./control-setup.js";
 import { type OpenRouterModels } from "./openrouter-models.js";
 export declare function connectionWords(connection: ProviderConnection): string;
-export declare function connectionHtml(provider: ProviderId, connection: ProviderConnection, task?: string): Html;
+/** The last sign-in check (null: none yet). Check again posts: a page never runs a check (docs/plans/get-side-effects.md). */
+export declare function connectionHtml(provider: ProviderId, connection: ProviderConnection | null, task?: string): Html;
 export declare function controlSetupHtml(data: {
     repo: string;
     csrf: string;
     provider: ProviderId;
     inputs: SetupInputs;
     models: ModelChoice[];
-    connection: ProviderConnection;
+    connection: ProviderConnection | null;
     catalog: OpenRouterModels | null;
     task?: string;
     preparation: {

package/dist/control-ui.js

@@ -8,15 +8,20 @@ export function connectionWords(connection) {
         unverified: "Not verified", "key-present": "API key saved · not verified", "key-works": "API key works", "key-refused": "API key refused", "missing-key": "API key needed",
     }[connection.state];
 }
+/** The last sign-in check (null: none yet). Check again posts: a page never runs a check (docs/plans/get-side-effects.md). */
 export function connectionHtml(provider, connection, task = "") {
     const query = new URLSearchParams({ provider, ...(task ? { task } : {}) });
-    return html `<div class="card assistant-account"><p><strong>${ASSISTANTS[provider].name} · ${connectionWords(connection)}</strong></p><p class="meta">${[connection.email, connection.plan, connection.method].filter(Boolean).join(" · ")}</p><p class="meta">Checked ${new Date(connection.checkedAt).toLocaleTimeString("en-US", { hour: "numeric", minute: "2-digit", timeZoneName: "short" })} on the computer running this console. Sign-in does not prove model access or remaining quota.</p><a class="button-link" href="/control/connection?${query.toString()}">${connection.state === "connected" ? "Manage connection" : "Connect account"}</a> · <a href="/control?${query.toString()}&amp;check-connection=1">Check again</a></div>`;
+    const back = `/control?${query.toString()}`;
+    const check = postForm("/settings/connection/check", html `<button type="submit" class="secondary">${connection === null ? "Check now" : "Check again"}</button>`, { attrs: { class: "inline" }, returnTo: back, hidden: { provider } });
+    if (connection === null)
+        return html `<div class="card assistant-account"><p><strong>${ASSISTANTS[provider].name} · Not checked yet</strong></p>${check}</div>`;
+    return html `<div class="card assistant-account"><p><strong>${ASSISTANTS[provider].name} · ${connectionWords(connection)}</strong></p><p class="meta">${[connection.email, connection.plan, connection.method].filter(Boolean).join(" · ")}</p><p class="meta">Checked ${new Date(connection.checkedAt).toLocaleTimeString("en-US", { hour: "numeric", minute: "2-digit", timeZoneName: "short" })} on the computer running this console. Sign-in does not prove model access or remaining quota.</p><a class="button-link" href="/control/connection?${query.toString()}">${connection.state === "connected" ? "Manage connection" : "Connect account"}</a> ${check}</div>`;
 }
 export function controlSetupHtml(data) {
     const { provider, inputs, task = "" } = data;
     const query = new URLSearchParams({ provider, ...(task ? { task } : {}) });
     const model = data.catalog !== null
-        ? openRouterPicker(data.catalog, inputs.model || null, `/control?${query}&refresh-models=1`)
+        ? openRouterPicker(data.catalog, inputs.model || null, "/control/models-refresh")
         : html `<label>Model<input type="text" name="model" value="${inputs.model}" list="setup-models" required autocomplete="off" placeholder="Exact model id or supported alias"></label><datalist id="setup-models">${data.models.map(one => html `<option value="${one.value}">${one.label}</option>`)}</datalist>`;
     return html `<h1>Project setup</h1><p>${data.repo}</p><p class="meta">Choose the default builder for new tasks and the preparation command for this project.</p><nav class="assistant-picker row" aria-label="Choose provider">${joinHtml(Object.keys(ASSISTANTS).map(id => html `<a class="button-link" href="/control?${new URLSearchParams({ provider: id, ...(task ? { task } : {}) }).toString()}"${id === provider ? html ` aria-current="page"` : ""}>${ASSISTANTS[id].name}</a>`), " ")}</nav>${connectionHtml(provider, data.connection, task)}${postForm("/control/setup-preview", html `${model}<details class="setup-advanced"><summary>Project preparation</summary>${data.preparation === null ? "" : html `<p class="meta">Suggested from ${data.preparation.evidence}: ${data.preparation.label} — <code>${data.preparation.command}</code>. Review before approving.</p>`}<label>Preparation command<textarea name="command" rows="2" maxlength="2000">${inputs.command}</textarea></label><label>Preparation timeout in seconds<input name="seconds" type="number" min="1" max="3600" value="${inputs.seconds}" required></label><p class="meta">Preparation applies to subsequent runs, including already approved tasks. Saving setup does not execute it.</p></details><button type="submit">Review project setup</button>`, { attrs: { class: "card" }, hidden: { repo: data.repo, provider, task } })}<section class="card"><h2>Agent instructions</h2>${data.instructions.message ? html `<p>${data.instructions.message}</p>` : data.instructions.installed ? html `<p>Toolroll instructions are installed.</p>` :
         html `<p>Give the agent the project's Toolroll handoff instructions.</p>${postForm("/control/instructions-preview", html `<button>Review instructions</button>`, { hidden: { repo: data.repo } })}`}</section><p><a href="/fleet">Configure planning, repair, and review agents</a> · <a href="/tasks/new">Describe a task</a></p>`;

package/dist/demo.js

@@ -1481,7 +1481,7 @@ export function createDemoLead(input) {
                 try {
                     advance(clock());
                 }
-                catch { /* the next read advances it again */ }
+                catch { /* the next beat or background pass advances it again */ }
             }, beat * stepMs + 20);
             timer.unref();
             timers.add(timer);
@@ -1489,8 +1489,10 @@ export function createDemoLead(input) {
         void exchange;
     };
     return {
-        exchanges: () => { advance(clock()); return list; },
-        version: () => { advance(clock()); return changes; },
+        // Reads only (docs/plans/get-side-effects.md): the beat timers, the console's background pass and the person's own
+        // acts move the story on, never a page visit.
+        exchanges: () => list,
+        version: () => changes,
         ask(text, now) {
             advance(now);
             const asked = said(text);

package/dist/desktop-update.d.ts

@@ -92,6 +92,9 @@ export declare function previewDesktopUpdate(stateDir: string, installed: string
 }>;
 export declare function prepareDesktopUpdate(stateDir: string, installed: string, candidate: string, label: string, expected: string, hooks?: UpdateHooks): Promise<UpdateJournal>;
 export declare function sqliteLock(file: string, busyTimeoutMs?: number): DatabaseSync | null;
+/** Whether another process holds the lock in `file`, without making the file or changing it: a status read (a page
+ * shows it, docs/plans/get-side-effects.md). A file that isn't there yet is held by nobody. */
+export declare function lockHeld(file: string): boolean;
 export declare const installationLock: (j: UpdateJournal) => DatabaseSync | null;
 export declare function desktopUpdateStatus(stateDir: string): {
     version?: never;

package/dist/desktop-update.js

@@ -1,3 +1,4 @@
+import { inReadOnlyRequest } from "./read-only-request.js";
 import { createHash, randomUUID } from "node:crypto";
 import { closeSync, chmodSync, copyFileSync, cpSync, existsSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
@@ -261,11 +262,14 @@ export function desktopUpdateWaitingOf(databaseFile, inTheWay, stateDirs = [dirn
         }
         if (!j || resolve(j.databaseFile) !== resolve(databaseFile))
             continue;
-        try {
-            if (releaseStalledDesktopUpdate(stateDir))
-                j = readUpdateJournal(stateDir);
+        // A page visit only reads (docs/plans/get-side-effects.md): the console's background pass releases it.
+        if (!inReadOnlyRequest()) {
+            try {
+                if (releaseStalledDesktopUpdate(stateDir))
+                    j = readUpdateJournal(stateDir);
+            }
+            catch { /* shown as last saved */ }
         }
-        catch { /* shown as last saved */ }
         const version = j.next.version;
         if (j.phase === "draining")
             return updateWaitingWords({ app: true, version, stopped: false, lingering: j.waiting ?? null });
@@ -394,14 +398,46 @@ export function sqliteLock(file, busyTimeoutMs = 0) {
         throw error;
     }
 }
+/** Whether another process holds the lock in `file`, without making the file or changing it: a status read (a page
+ * shows it, docs/plans/get-side-effects.md). A file that isn't there yet is held by nobody. */
+export function lockHeld(file) {
+    let st;
+    try {
+        st = lstatSync(file);
+    }
+    catch {
+        return false;
+    }
+    // Not a plain file of ours (a link, or one someone else made): treated as held, so nothing goes ahead on it.
+    if (!st.isFile() || (typeof process.getuid === "function" && st.uid !== process.getuid()))
+        return true;
+    let db;
+    // Read-only: it never makes the file. The holder's exclusive lock stops even a read.
+    try {
+        db = new (sqlite().DatabaseSync)(file, { readOnly: true });
+    }
+    catch {
+        return true;
+    }
+    try {
+        db.exec("PRAGMA busy_timeout=0");
+        db.prepare("SELECT COUNT(*) FROM sqlite_master").get();
+        return false;
+    }
+    catch (error) {
+        return String(error).includes("locked") || String(error).includes("busy") || [5, 6].includes(error.errcode ?? 0);
+    }
+    finally {
+        db.close();
+    }
+}
 const workerLock = (j, busyTimeoutMs = 0) => sqliteLock(join(j.workDir, "worker.sqlite"), busyTimeoutMs);
 export const installationLock = (j) => sqliteLock(join(dirname(j.workDir), `installation-${digest(j.old.path).slice(0, 24)}.sqlite`));
 export function desktopUpdateStatus(stateDir) {
     const j = readUpdateJournal(stateDir);
     if (!j)
         return { active: false, phase: "none", detail: "No update is in progress.", running: false, canResume: false, canCancel: false };
-    const lock = workerLock(j), running = lock === null;
-    lock?.close();
+    const running = lockHeld(join(j.workDir, "worker.sqlite"));
     let recovery = null;
     try {
         privateFile(join(j.workDir, "recovery.json"));
@@ -409,9 +445,7 @@ export function desktopUpdateStatus(stateDir) {
     }
     catch { /* A legacy/manual update has no guardian. */ }
     const wantsAutomatic = recovery?.id === j.id && ["armed", "running", "backoff"].includes(recovery.state ?? "") && !terminal(j.phase);
-    const guardianLock = wantsAutomatic ? sqliteLock(join(j.workDir, "guardian.sqlite")) : undefined;
-    const automatic = wantsAutomatic && (guardianLock === null || Date.now() - Date.parse(recovery?.updatedAt ?? "") < 45_000);
-    guardianLock?.close();
+    const automatic = wantsAutomatic && (lockHeld(join(j.workDir, "guardian.sqlite")) || Date.now() - Date.parse(recovery?.updatedAt ?? "") < 45_000);
     const detail = wantsAutomatic && !automatic ? "Automatic recovery has not restarted. Work remains paused; use Retry safely in Update status." : recovery?.state === "attention" || (automatic && (!running || j.phase === "needs-attention")) ? recovery?.detail ?? j.detail : j.detail;
     return { active: !terminal(j.phase), phase: j.phase, detail, error: j.error ?? null, running, automaticRecovery: automatic, recoveryAttempts: recovery?.attempts ?? 0, recoveryRepairs: recovery?.repairs ?? 0, canResume: !running && !automatic && !terminal(j.phase), canCancel: !terminal(j.phase), wasRunning: j.wasRunning && !updateStopRequested(j), backupPath: j.backupPath ?? null, updateId: j.id, version: j.next.version, buildId: j.next.buildId, workDir: j.workDir };
 }

package/dist/first-run.d.ts

@@ -94,14 +94,17 @@ export declare function firstTaskJourney(read: {
     stage: "queued" | "planning" | "needs-you" | "waiting" | "building" | "checking" | "reviewing" | "finished" | "complete" | "failed" | "stopped";
     need?: string | undefined;
 }, approved: boolean, built?: boolean): JourneyStep[];
-/** What a task's checks recorded, for its road: `null` when nothing says (the step is then shown skipped, never done). */
-export type RoadChecks = "passed" | "running" | "failed" | "not-run" | "unread" | null;
+/** The approved check as the task's status reads it (task-status.ts `approvedCheckStateOf`), for its road: `null` when
+ * nothing says (the step is then shown skipped, never done). The road reads this one answer, never a row's words. */
+export type RoadChecks = "passed" | "running" | "failed" | "not-run" | "off" | "unreadable" | null;
 /**
  * Any task's road (the read-only stepper on its page, after ReUI's Stepper): the first task's five steps, told only
  * from recorded facts. You approve is done only when the plan was approved (a rewritten plan waiting on approval
- * stands there again); a task that never needed one shows it skipped. Checks is done only when a check passed; a
- * running, failed, missing or unread check says so, and with no checks fact it is skipped. A research report has
- * no Checks step: a report stopped there stops at Ready. The step that waits on a person carries `needsYou`.
+ * stands there again); a task that never needed one shows it skipped. Checks is done only when the approved check
+ * passed; a running, missing or Off check says so, and with no checks fact it is skipped. A failed check, or one that
+ * can't be read, stops the road at Checks: Ready isn't done (fail closed), even on a task a person marked complete.
+ * A research report has no Checks step: a report stopped there stops at
+ * Ready. The step that waits on a person carries `needsYou`.
  */
 export declare function taskRoad(read: Parameters<typeof firstTaskJourney>[0], approved: boolean, built: boolean, facts: {
     report?: boolean;

package/dist/first-run.js

@@ -144,31 +144,64 @@ export function firstTaskJourney(read, approved, built = false) {
 /**
  * Any task's road (the read-only stepper on its page, after ReUI's Stepper): the first task's five steps, told only
  * from recorded facts. You approve is done only when the plan was approved (a rewritten plan waiting on approval
- * stands there again); a task that never needed one shows it skipped. Checks is done only when a check passed; a
- * running, failed, missing or unread check says so, and with no checks fact it is skipped. A research report has
- * no Checks step: a report stopped there stops at Ready. The step that waits on a person carries `needsYou`.
+ * stands there again); a task that never needed one shows it skipped. Checks is done only when the approved check
+ * passed; a running, missing or Off check says so, and with no checks fact it is skipped. A failed check, or one that
+ * can't be read, stops the road at Checks: Ready isn't done (fail closed), even on a task a person marked complete.
+ * A research report has no Checks step: a report stopped there stops at
+ * Ready. The step that waits on a person carries `needsYou`.
  */
 export function taskRoad(read, approved, built, facts) {
     const replan = read.stage === "needs-you" && read.need === "replan";
     const plainApproved = approved && !replan;
     let steps = firstTaskJourney(replan ? { stage: "needs-you", need: "approval" } : read, plainApproved, built);
+    const complete = read.stage === "complete";
+    // A finished build that waits on something other than its check (a hold, a decision) stops after Checks, at Ready,
+    // when its check passed, didn't run or is Off: the road never calls a passing check stuck.
+    let waitsAtReady = false;
     steps = steps.map(step => {
         if (step.key === "approve" && step.state === "done" && !plainApproved)
             return { ...step, state: "skipped" };
+        if (step.key === "checks" && step.state === "stuck" && built) {
+            switch (facts.checks ?? null) {
+                case "passed":
+                    waitsAtReady = true;
+                    return { ...step, state: "done" };
+                case "not-run":
+                    waitsAtReady = true;
+                    return { ...step, state: "skipped", label: "Checks not run" };
+                case "off":
+                    waitsAtReady = true;
+                    return { ...step, state: "skipped", label: "Checks at release" };
+                case "running": return { ...step, state: "current", label: "Checks running" };
+                case "failed": return { ...step, label: "Checks failed" };
+                case "unreadable": return { ...step, label: "Checks unreadable" };
+                default: return step;
+            }
+        }
         if (step.key !== "checks" || (step.state !== "done" && step.state !== "current"))
             return step;
-        // At Checks now: only a recorded failure or a running check changes how it reads.
+        // At Checks now: only a recorded failure, an unreadable check or a running check changes how it reads.
         if (step.state === "current")
-            return facts.checks === "failed" ? { ...step, state: "stuck", label: "Checks failed" } : facts.checks === "running" ? { ...step, label: "Checks running" } : step;
+            return facts.checks === "failed" ? { ...step, state: "stuck", label: "Checks failed" }
+                : facts.checks === "unreadable" ? { ...step, state: "stuck", label: "Checks unreadable" }
+                    : facts.checks === "running" ? { ...step, label: "Checks running" } : step;
         switch (facts.checks ?? null) {
             case "passed": return step;
             case "running": return { ...step, state: "current", label: "Checks running" };
             case "failed": return { ...step, state: "stuck", label: "Checks failed" };
             case "not-run": return { ...step, state: "skipped", label: "Checks not run" };
-            case "unread": return { ...step, state: "skipped", label: "Checks unread" };
+            case "off": return { ...step, state: "skipped", label: "Checks at release" };
+            case "unreadable": return { ...step, state: "stuck", label: "Checks unreadable", ...(complete ? {} : { needsYou: true }) };
             default: return { ...step, state: "skipped" };
         }
     });
+    if (waitsAtReady)
+        steps = steps.map(step => step.key === "ready" ? { ...step, state: "stuck" } : step);
+    // A road stopped at Checks (failed, or unreadable) has not reached Ready.
+    const at = steps.find(step => step.key === "checks");
+    if (facts.report !== true && at !== undefined && at.state === "stuck") {
+        steps = steps.map(step => step.key === "ready" && step.state === "done" ? { ...step, state: "todo" } : step);
+    }
     if (facts.report === true) {
         const checks = steps.find(step => step.key === "checks");
         if (checks !== undefined && (checks.state === "current" || checks.state === "stuck")) {

package/dist/flow-card-task.js

@@ -32,8 +32,9 @@ export function flowCardTaskLine(store, taskId, repo, now, secrets = []) {
     // The canvas reads no evidence files. Keep the machine's recorded check visible
     // when the full receipt has no artifact root from which to read its check.
     const check = assignment.receipt === null ? null : store.runCheckFor(assignment.receipt.runId);
-    if (facts.checks?.status === "unavailable" && check !== null)
-        facts.checks = { ...facts.checks, status: check.status, exitCode: check.exitCode };
+    // With neither, nothing about the check was read here: the line says nothing about it, never a pass and never an ask.
+    if (facts.checks?.status === "unavailable")
+        facts.checks = check === null ? null : { ...facts.checks, status: check.status, exitCode: check.exitCode };
     const status = taskStatusOf(facts);
     if (status.headline === "Needs you") {
         const fallback = status.need?.action.label ?? "Open the task";

package/dist/flow-unattended.d.ts

@@ -99,6 +99,8 @@ export declare function endUnattendedGrants(store: Store, filter: {
 /** The live grant for a flow, or null. One past its expiry is closed here, durably (like activeMode). A grant whose
  * signer is no longer an active approver, or whose flow moved on, covers nothing. */
 export declare function activeUnattendedGrant(store: Store, flowId: number, now: Date): UnattendedGrant | null;
+/** Close every grant past its expiry (the console's background pass). Returns how many ended. */
+export declare function closeExpiredUnattendedGrants(store: Store, now: Date): number;
 /** sha256 over a trigger's identity and canonical settings: what a grant freezes for each schedule it covers. */
 export declare function triggerDigestOf(trigger: Pick<FlowTriggerRow, "id" | "flow" | "kind" | "configJson">): string | null;
 /** Asynchronous preparation, never called from filing transactions or page rendering. */

package/dist/flow-unattended.js

@@ -24,6 +24,7 @@
  * This module owns the terms, digest, words and transactions; the flow engine
  * asks for coverage inside its filing transaction, and plan-auto.ts seals.
  */
+import { inReadOnlyRequest } from "./read-only-request.js";
 import { spawn } from "node:child_process";
 import { createHash } from "node:crypto";
 import { lstat, readFile, realpath, stat } from "node:fs/promises";
@@ -231,11 +232,21 @@ export function activeUnattendedGrant(store, flowId, now) {
     if (row === undefined)
         return null;
     if (Date.parse(String(row["absolute_expiry"])) <= now.getTime()) {
-        store.transact(() => closeGrant(store, row, "the-clock", "expired", now));
+        // A page visit only reads (docs/plans/get-side-effects.md): the background pass or the next path that acts closes it.
+        if (!inReadOnlyRequest())
+            store.transact(() => closeGrant(store, row, "the-clock", "expired", now));
         return null;
     }
     return readGrant(row);
 }
+/** Close every grant past its expiry (the console's background pass). Returns how many ended. */
+export function closeExpiredUnattendedGrants(store, now) {
+    const rows = store.handle.prepare("SELECT * FROM flow_unattended_grant WHERE revoked_at IS NULL").all()
+        .filter(row => Date.parse(String(row["absolute_expiry"])) <= now.getTime());
+    for (const row of rows)
+        store.transact(() => closeGrant(store, row, "the-clock", "expired", now));
+    return rows.length;
+}
 /** Why the grant can't cover this flow right now (the same checks signing makes), or null. */
 function coverageProblem(store, flow, owner, workRepos) {
     if (flow.state !== "active")

package/dist/integrations.d.ts

@@ -114,14 +114,15 @@ export declare function secretsNote(list: readonly Integration[], secrets: Secre
  * files only, or why they can't be used (secretsNote). */
 export declare function renderIntegrations(list: readonly Integration[], secrets?: SecretsKept | null): string[];
 export type IntegrationMonitor = {
-    /** The list now, without waiting; starts a background check when the last one is older than the cache. */
+    /** The list now, from the last answers saved. It only reads: a page calls it on every render (docs/plans/get-side-effects.md). */
     list(): Integration[];
-    /** Check now and wait (Send test, or the first answer in a test). */
+    /** Check now and wait (Send test, Check now, or the first answer in a test). */
     check(keys?: readonly string[]): Promise<Integration[]>;
+    /** The background pass: start a check when the last one is older than the cache. Never called from a page. */
+    refreshIfDue(): void;
     /** Whether a background check is running. */
     readonly checking: boolean;
 };
-/** Checks in the background with a short cache, as the first-run suggestions are: a render never waits on a check. */
 export declare function createIntegrationMonitor(io: () => IntegrationIo, options?: {
     cacheMs?: number;
     now?: () => number;