toolroll 0.9.74 → 0.9.75

package/dist/server/settings.js

@@ -122,14 +122,14 @@ import { teamsSettingsHtml } from "../teams-settings.js";
 import { telegramSettingsHtml } from "../telegram-settings.js";
 import { hashPairingCode, loadBotToken, mintPairingCode, PAIRING_TTL_MS, redactToken, saveBotToken } from "../telegram.js";
 import { newerThan, updatesHtml, updatesScript, updateStepsHtml } from "../toolroll-update-ui.js";
-import { abandonRuntimeUpdate, currentRuntime, launchRuntimeUpdate, markWhatsNewSeen, prepareRuntimeUpdate, releaseStalledUpdate, requestRuntimeUpdateCancel, runningWorkWords, runtimeUpdateStatus, runtimeUpdateTerminal } from "../toolroll-update.js";
+import { abandonRuntimeUpdate, currentRuntime, launchRuntimeUpdate, markWhatsNewSeen, prepareRuntimeUpdate, requestRuntimeUpdateCancel, runningWorkWords, runtimeUpdateStatus, runtimeUpdateTerminal } from "../toolroll-update.js";
 import { TOOLS_PROJECT_SCRIPT, toolsHtml, toolsProjectPicker } from "../tools-ui.js";
 import { effectivePrimary, isMessagingChannel, savePrimary } from "../webhooks.js";
 import { personChip, ROLE_TITLES } from "./chrome.js";
 import { chatReturnWithSaid, goOutside } from "./http.js";
-import { latestReleaseFor, leadSettingsHtml, notificationProjects, SETTINGS_AUTOSAVE_SCRIPT, settingsPage, settingsWorkers, telegramDeliveryWords, telegramTrouble } from "./render-settings.js";
+import { leadSettingsHtml, notificationProjects, SETTINGS_AUTOSAVE_SCRIPT, settingsPage, settingsWorkers, telegramDeliveryWords, telegramTrouble } from "./render-settings.js";
 export function createSettingsHandlers(runtime) {
-    const { store, providerHome, managedRepos, consoleProjects, sendScreen, chromeFor, connectionCheck, clock, modelCatalog, modelSeams, toolsViewOf, codexServers, projectViewOf, sessions, restricted, options, integrations, consoleOrigin, evidenceRoot, storagePool, visible, ssoSettings, checkLocalAgents, chatKeyFor, chatCatalog, leadWords, agentSignInCommand, settingsUpdates, phoneSetup, authenticateApprover, authenticateCredential, deletedRepos, projectOf, providerFor, admissionList, toolHome, connectVisits, mintApprovalNonce, consumeApprovalNonce, defaultProject, googleVisits } = runtime;
+    const { store, providerHome, managedRepos, consoleProjects, sendScreen, chromeFor, connectionCheck, connectionKnown, lastChecks, checkRelease, clock, modelCatalog, modelSeams, toolsViewOf, codexServers, projectViewOf, sessions, restricted, options, integrations, consoleOrigin, evidenceRoot, storagePool, visible, ssoSettings, checkLocalAgents, chatKeyFor, chatCatalog, chatCatalogKnown, leadWords, agentSignInCommand, settingsUpdates, phoneSetup, authenticateApprover, authenticateCredential, deletedRepos, projectOf, providerFor, admissionList, toolHome, connectVisits, mintApprovalNonce, consumeApprovalNonce, defaultProject, googleVisits } = runtime;
     // v105: what agent work cost, by month, and the monthly budgets. An instance operator's page.
     async function spendPage(ctx) {
         const { url, who, response, now } = ctx;
@@ -225,10 +225,11 @@ ${hasGrant ? "" : html `<span class="meta">self-merging needs a merge-capable pu
         if (!isProviderId(asked))
             return refuse(response, who, 400, "Choose a known provider.", "/control");
         const task = url.searchParams.get("task") ?? "";
-        const connection = await connectionCheck(asked, url.searchParams.get("check-connection") === "1");
+        // The last sign-in check: Check again posts (docs/plans/get-side-effects.md).
+        const connection = connectionKnown(asked);
         if (view === "connection") {
             const command = asked === "claude" ? "claude auth login" : asked === "codex" ? "codex login" : asked === "gemini" ? "gemini" : null;
-            return sendScreen(response, 200, screen(`${ASSISTANTS[asked].name} connection`, html `<h1>${ASSISTANTS[asked].name} ${connection.state === "connected" ? "is connected" : "connection"}</h1>\
+            return sendScreen(response, 200, screen(`${ASSISTANTS[asked].name} connection`, html `<h1>${ASSISTANTS[asked].name} ${connection?.state === "connected" ? "is connected" : "connection"}</h1>\
 ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On the computer running Toolroll, sign in with:</p><pre class="recap">${command}</pre>`}\
 <p><a href="/settings#providers">Manage API keys and authentication mode</a></p><input type="hidden" name="resume-task" value="${task}">`, { chrome: chromeFor(project, "settings") }));
         }
@@ -241,20 +242,61 @@ ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On
         const models = live.length === 0 ? modelChoices(asked, configured, providerHome)
             : configured && !live.some(one => one.value === configured) ? [{ value: configured, label: `${configured} — current choice` }, ...live] : live;
         const instructions = previewProjectInstructions(project);
-        const catalog = asked === "openrouter" ? await modelCatalog(readProviderKey("openrouter", providerHome), url.searchParams.get("refresh-models") === "1") : null;
+        // The model list as last loaded; Refresh models posts, and the background checks keep it current.
+        const catalog = asked === "openrouter" ? modelCatalog.known(readProviderKey("openrouter", providerHome)) ?? { ok: false, problem: "The model list has not loaded yet." } : null;
         const inputs = { provider: asked, model: saved?.provider === asked ? saved.model ?? "" : models[0]?.value ?? "", command: setup?.command ?? (saved === null ? preparation?.command ?? "" : ""), seconds: String((setup?.timeoutMs ?? 300_000) / 1000) };
         return sendScreen(response, 200, screen("Project setup", controlSetupHtml({ repo: project, csrf: who.via === "cookie" ? who.session.csrf : "", provider: asked, inputs, models, connection, catalog, task, preparation,
             instructions: instructions.ok ? { installed: instructions.installed } : { installed: false, message: instructions.message } }), { chrome: chromeFor(project, "settings"), ...(catalog === null ? {} : { functional: { script: openRouterPickerScript() } }) }));
     };
+    // Settings → Projects → Pull requests → Check setup: git and GitHub, for one project, by an approver who may turn it on.
+    async function pullRequestsCheck(ctx) {
+        const { who, response, posted } = ctx;
+        const repo = readForm(posted, CONSOLE_FORMS.pullRequestsCheck).get("repo") ?? "";
+        const known = [...new Set([...managedRepos(), ...store.knownRepos(), ...store.listProjects().map(one => one.path)])];
+        if (who.via !== "cookie" || !known.includes(repo) || !visible(repo))
+            return refuse(response, who, 404, "No such project.", "/projects");
+        if (who.role !== "approver" || store.isDemo())
+            return refuse(response, who, 403, "An approver can turn on pull requests.", "/projects");
+        await lastChecks.run(`publishing:${repo}`, () => checkPublishing(repo, options.publishExec === undefined ? {} : { exec: options.publishExec }));
+        return redirect(response, `/settings/pull-requests?repo=${encodeURIComponent(repo)}`);
+    }
+    // Settings → Storage → Check now: measure the checkouts again.
+    async function storageCheck(ctx) {
+        const databaseFile = store.databaseFile();
+        if (databaseFile !== null)
+            await measureStorage(databaseFile);
+        return redirect(ctx.response, "/settings/storage");
+    }
+    const measureStorage = (databaseFile) => lastChecks.run("storage", () => checkoutPlan(store, storagePool(databaseFile), clock(), { manual: true }));
+    // Settings → Updates → Check now: ask npm once, whether or not automatic checks are on.
+    async function updatesCheck(ctx) {
+        await checkRelease();
+        return redirect(ctx.response, "/settings/updates");
+    }
+    // Check again (Settings → providers, Project setup): ask this computer's CLI, or test the saved key, now.
+    async function connectionCheckNow(ctx) {
+        const { response, posted } = ctx;
+        const body = readForm(posted, CONSOLE_FORMS.connectionCheck);
+        const provider = body.get("provider") ?? "";
+        const back = safeReturn(body.get("return") ?? "/settings#providers");
+        if (!isProviderId(provider))
+            return redirect(response, back);
+        await connectionCheck(provider, true).catch(() => undefined);
+        return redirect(response, back);
+    }
+    // Refresh models (Project setup, OpenRouter): load the list again, then show the setup page with it.
+    async function modelsRefresh(ctx) {
+        const { response, posted } = ctx;
+        const body = readForm(posted, CONSOLE_FORMS.modelsRefresh);
+        await modelCatalog(readProviderKey("openrouter", providerHome), true);
+        const query = new URLSearchParams({ provider: "openrouter", ...(body.get("task") ? { task: body.get("task") } : {}) });
+        return redirect(response, `/control?${query.toString()}`);
+    }
     async function modelsPage(ctx) {
         const { url, who, response, project } = ctx;
         const now = clock();
-        const watch = watchState(store);
-        // Opening the page refreshes a stale snapshot; the lists are public and
-        // the check sends nothing about the person or their projects.
-        if (who.role === "approver" && (watch.checkedAt === null || now.getTime() - Date.parse(watch.checkedAt) > 3_600_000)) {
-            await checkModels(store, now, modelSeams).catch(() => undefined);
-        }
+        // The page shows the last check and when it ran (docs/plans/get-side-effects.md): Check now, or the watch loop's
+        // automatic checks, fetch the lists and may queue a notice; opening the page never does.
         const view = modelsView(who.role === "approver", who.via === "cookie" ? who.session.csrf : "", now, url.searchParams.get("said"), url.searchParams.get("problem"));
         return sendScreen(response, 200, screen("Models", html `<p><a href="/settings">Settings</a></p><h1>Models</h1>${modelsHtml(view)}`, { chrome: chromeFor(project, "settings"), functional: { script: modelsScript() } }));
     }
@@ -290,7 +332,8 @@ ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On
         if (chosen) {
             try {
                 const approver = who.role === "approver" && who.via === "cookie";
-                const view = toolsViewOf(chosen, approver ? await codexServers(chosen) : null, kit, wanted);
+                // What Codex had configured at the last background check (docs/plans/get-side-effects.md): the page starts no codex.
+                const view = toolsViewOf(chosen, approver ? lastChecks.known(`codex-tools:${chosen}`)?.value ?? null : null, kit, wanted);
                 if (approver)
                     view.others = projects.filter(one => one !== chosen).map(one => ({ repo: one, project: projectName(one), open: connectionsOf(store, one).filter(c => c.state === "open").map(c => c.id) }));
                 content = (toolsHtml(view, who.via === "cookie" ? who.session.csrf : "", approver, { said: url.searchParams.get("said"), problem: url.searchParams.get("problem") }));
@@ -376,19 +419,16 @@ ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On
         const databaseFile = store.databaseFile();
         if (databaseFile === null)
             return refuse(response, who, 403, "An instance operator updates Toolroll.", "/settings");
-        // A record it cannot release is shown as it is; the page never fails over it.
-        try {
-            releaseStalledUpdate(dirname(databaseFile), clock());
-        }
-        catch { /* shown as last saved */ }
+        // A stalled update is released by the background pass, never by opening this page (docs/plans/get-side-effects.md).
         const status = runtimeUpdateStatus(dirname(databaseFile));
         if (url.searchParams.get("fragment") === "steps")
             return respond(response, 200, "text/html; charset=utf-8", status.journal ? updateStepsHtml(status.journal, status.running) : html `<div id="update-live" data-done="1"></div>`);
         const active = status.journal !== null && !runtimeUpdateTerminal(status.journal.phase);
         const current = options.updates?.current ?? PACKAGE_VERSION;
-        // While update checks are off the page asks npm nothing until Check now.
-        const checksOff = updateChecksOff(process.env, options.configDir ?? dirname(databaseFile)).off && url.searchParams.get("check") !== "now";
-        const view = { current, latest: active ? { version: current } : checksOff ? { off: true } : await latestReleaseFor(options.updates?.latest), method: options.updates?.method ?? installMethod(), journal: status.journal, running: status.running, whatsNew: status.whatsNew, rollbackTo: status.lastUpdate?.to === current ? status.lastUpdate.from : null, csrf: who.session.csrf };
+        // The last answer npm gave (the background checks ask while update checks are on; Check now asks once).
+        const checksOff = updateChecksOff(process.env, options.configDir ?? dirname(databaseFile)).off;
+        const known = lastChecks.known("release")?.value ?? null;
+        const view = { current, latest: active ? { version: current } : known ?? (checksOff ? { off: true } : { pending: true }), method: options.updates?.method ?? installMethod(), journal: status.journal, running: status.running, whatsNew: status.whatsNew, rollbackTo: status.lastUpdate?.to === current ? status.lastUpdate.from : null, csrf: who.session.csrf };
         return sendScreen(response, 200, screen("Updates", html `<p><a href="/settings">Settings</a></p><h1>Updates</h1>${(updatesHtml(view, { said: url.searchParams.get("said"), problem: url.searchParams.get("problem") }))}`, { chrome: chromeFor(project, "settings"), ...(active ? { functional: { script: updatesScript(), fetches: true } } : {}) }));
     }
     // v105: Settings → Retention, how long each kind of data is kept. An instance operator's page.
@@ -406,9 +446,16 @@ ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On
         const databaseFile = store.databaseFile();
         if (databaseFile === null)
             return refuse(response, who, 403, "An instance operator looks after storage.", "/settings");
-        const plan = await checkoutPlan(store, storagePool(databaseFile), now, { manual: true });
+        // The last measurement (docs/plans/get-side-effects.md): the background checks measure the checkouts, and so do
+        // Check now and every clean-up; opening the page runs no du or git.
+        const measured = lastChecks.known("storage");
+        const check = postForm("/settings/storage/check", html `<button type="submit" class="secondary">Check now</button>`, { attrs: { class: "inline" } });
+        if (measured === null) {
+            return sendScreen(response, 200, screen("Storage", html `<p><a href="/settings">Settings</a></p><h1>Storage</h1><section class="storage"><div class="card storage-state"><h2>Checkouts not measured yet</h2>${check}</div></section>`, { chrome: chromeFor(project, "settings") }));
+        }
+        const plan = { ...measured.value, cleanup: store.checkoutCleanup() };
         const sweep = { last: lastSweep(store), off: storageSweepOff(), schedule: sweepSchedule(store, now) };
-        return sendScreen(response, 200, screen("Storage", html `<p><a href="/settings">Settings</a></p><h1>Storage</h1>${(storageHtml({ plan, csrf: who.session.csrf, sweep, landed: landedSummary(store) }, { said: url.searchParams.get("said"), problem: url.searchParams.get("problem") }))}`, { chrome: chromeFor(project, "settings") }));
+        return sendScreen(response, 200, screen("Storage", html `<p><a href="/settings">Settings</a></p><h1>Storage</h1>${(storageHtml({ plan, csrf: who.session.csrf, sweep, landed: landedSummary(store), measured: html `<p class="meta">Measured ${new Date(measured.at).toLocaleTimeString("en-US", { hour: "numeric", minute: "2-digit" })} ${check}</p>` }, { said: url.searchParams.get("said"), problem: url.searchParams.get("problem") }))}`, { chrome: chromeFor(project, "settings") }));
     }
     // Settings → Projects → Pull requests: one project's setup. Off, the checks run on open, so the page says
     // exactly what turning on would do, or what to fix first.
@@ -420,7 +467,8 @@ ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On
             return refuse(response, who, 404, "No such project.", "/projects");
         const publishing = publishingOf(store, repo);
         const canChange = who.role === "approver" && !store.isDemo();
-        const check = publishing.on || !canChange ? null : await checkPublishing(repo, options.publishExec === undefined ? {} : { exec: options.publishExec });
+        // The last setup check for this project (Check setup posts); opening the page asks git and GitHub nothing.
+        const check = publishing.on || !canChange ? null : lastChecks.known(`publishing:${repo}`)?.value ?? "unchecked";
         const body = (pullRequestSettingsHtml({ repo, name: projectName(repo), csrf: who.session.csrf, canChange, publishing, check,
             said: url.searchParams.get("said"), problem: url.searchParams.get("problem") }));
         return sendScreen(response, 200, screen("Pull requests", html `<p><a href="/projects">Projects</a></p><h1>Pull requests</h1>${body}`, { chrome: chromeFor(project, "projects") }));
@@ -563,15 +611,13 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
     async function leadPage(ctx) {
         const { url, response, now, project } = ctx;
         const who = browserCaller(ctx.who);
-        if (runtime.localSignIn === null)
-            await Promise.race([checkLocalAgents(), new Promise(done => setTimeout(done, 6_000).unref?.())]);
         const config = store.getChatConfig();
         const facts = {
             keyFacts: ["anthropic-api", "openrouter-api"].map(one => {
                 const found = chatKeyFor(one);
                 return { provider: one, state: found === null ? "none" : found.source, tail: found === null || found.source === "environment" ? null : redactToken(found.key) };
             }),
-            openrouterModels: (await chatCatalog())?.map(one => one.id) ?? null,
+            openrouterModels: chatCatalogKnown()?.map(one => one.id) ?? null,
             liveModels: [...modelOptions(store, "claude", now, providerHome), ...modelOptions(store, "codex", now, providerHome)],
             csrf: who.session.csrf,
             returnTo: "/settings/lead",
@@ -646,7 +692,7 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
                 provider,
                 envName: PROVIDER_KEY_ENV[provider],
                 ...keyStatus(provider, providerHome),
-                connection: await connectionCheck(provider, url.searchParams.get("check-connection") === provider),
+                ...(connectionKnown(provider) === null ? {} : { connection: connectionKnown(provider) }),
                 ambient: (process.env[PROVIDER_KEY_ENV[provider]] ?? "") !== "",
                 mode: readAuthMode(provider, providerHome) === "api-key" ? "api-key" : "subscription",
                 subscriptionCapable: SUBSCRIPTION_CAPABLE[provider],
@@ -1114,7 +1160,9 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
         const databaseFile = store.databaseFile();
         if (databaseFile === null)
             return refuse(response, who, 403, "An instance operator looks after storage.", "/settings");
-        const back = sayTo(response, "/settings/storage");
+        // What the page shows next is measured again after the change.
+        const said = sayTo(response, "/settings/storage");
+        const back = async (kind, words) => { await measureStorage(databaseFile).catch(() => undefined); return said(kind, words); };
         const what = op === "clean" ? "clean up" : op === "discard" ? "discard a checkout" : "change checkout cleanup";
         if (!authenticateApprover(who, body.get("password") ?? "").ok)
             return back("problem", `Enter your Toolroll password to ${what}.`);
@@ -2468,6 +2516,11 @@ ${modeWords(terms)
         "mode": modePage,
         "control": controlPage("setup"),
         "control.connection": controlPage("connection"),
+        "settings.updates-check-send": updatesCheck,
+        "settings.storage-check-send": storageCheck,
+        "settings.pull-requests-check-send": pullRequestsCheck,
+        "settings.connection-check": connectionCheckNow,
+        "control.models-refresh": modelsRefresh,
         "settings.models": modelsPage,
         "settings.tools": toolsPage,
         "settings.project": projectPage,

package/dist/server/task-views.js

@@ -487,7 +487,6 @@ export function createTaskViews(runtime) {
             coordinatorProposals: (() => {
                 if (ref === null || ref.repo === null || who.role !== "approver")
                     return null;
-                runtime.store.sweepCoordinatorProposals(now);
                 const rows = runtime.store.listCoordinatorProposals({ repos: [ref.repo], taskId });
                 return { rows, decisions: decisionsFor(runtime.store, rows), now };
             })(),

package/dist/server/tasks.js

@@ -12,7 +12,7 @@ import { handlersOf } from './handler-registry.js';
 import { closedQuestionWords } from "../decision.js";
 import { DEPRECATED_PAGE } from "../deprecations.js";
 /** tasks handlers, moved without changing their route bodies. */
-import { html, htmlString, joinHtml, textHtml } from "../html.js";
+import { html, htmlString, joinHtml, postForm, textHtml } from "../html.js";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { lstatSync, realpathSync } from "node:fs";
 import {} from "node:http";
@@ -75,7 +75,9 @@ export function createTasksHandlers(runtime) {
     function noPage(who, response) {
         return refuse(response, who, 404, "There's no page at this address.", "/chat");
     }
-    const showCode = (part) => async (ctx) => {
+    // `posted`: the session page's own POST (form token). A GET of changes or the shipping preview runs no git in the
+    // agent's checkout: changes go back to the session page, the preview asks for one click.
+    const showCode = (part, posted = false) => async (ctx) => {
         const { url, who, response, project } = ctx;
         if (who.via !== 'cookie' || !codingActorAllowed({ name: who.name, generation: who.session.generation }))
             return refuse(response, who, 403, 'Coding sessions require installation-wide operator access. You can manage project tasks in Work.', '/work');
@@ -86,6 +88,11 @@ export function createTasksHandlers(runtime) {
             const selected = sessionId !== null && runtime.coding ? runtime.coding.get(sessionId, actor) : null;
             if (selected && !codingProjectAllowed(selected.repo))
                 return refuse(response, who, 403, 'That project is outside your access.', '/projects');
+            if (!posted && part === 'changes' && selected)
+                return redirect(response, `/code/${selected.id}`);
+            if (!posted && part === 'ship' && selected) {
+                return sendScreen(response, 200, screen('Review for shipping', html `<section class="coding-workspace coding-handoff"><h1>Review for shipping</h1><p>${selected.title}</p>${postForm(`/code/${selected.id}/ship/preview`, html `<button type="submit">Review the committed change</button>`)}<p><a href="/code/${selected.id}">Back to coding</a></p></section>`, { chrome: chromeFor(selected.repo, 'code') }));
+            }
             if (part === 'ship' && selected) {
                 const preview = codingHandoffPreview(store, { sessionId: selected.id, actor: who.name });
                 return sendScreen(response, 200, screen('Review for shipping', codingShippingHtml(preview), { chrome: chromeFor(selected.repo, 'code') }));
@@ -2996,6 +3003,8 @@ export function createTasksHandlers(runtime) {
         "code.state": showCode("state"),
         "code.changes": showCode("changes"),
         "code.ship": showCode("ship"),
+        "code.changes-read": showCode("changes", true),
+        "code.ship-preview": showCode("ship", true),
         "code.other": showCode("unknown"),
         "inbox": showInbox,
         "work": showWork,

package/dist/storage-ui.d.ts

@@ -13,6 +13,8 @@ export type StorageView = {
         schedule?: SweepSchedule;
     };
     landed?: LandedSummary;
+    /** When the checkouts were last measured, and its Check now (docs/plans/get-side-effects.md). */
+    measured?: Html;
 };
 export declare function storageHtml(view: StorageView, notice: {
     said?: string | null;

package/dist/storage-ui.js

@@ -85,5 +85,5 @@ export function storageHtml(view, notice) {
     const preview = html `<details class="clean-up" data-clean-up${notice.problem?.startsWith("Enter your Toolroll password to clean") ? html ` open` : ""}><summary>Clean up</summary><div class="preview">${plan.go.length === 0 ? html `<p>Nothing to remove now.</p>` :
         html `<h3>Removes ${plural(plan.go.length, "checkout")}, about ${bytesWords(plan.freeBytes)}</h3><p class="meta">Their branches stay, so nothing committed is lost.</p><ul class="checkouts" data-goes>${plan.go.map(one => item(one))}</ul>`}${plan.stay.length === 0 ? "" : html `<h3>Stays (${plan.stay.length})</h3><ul class="checkouts" data-stays>${plan.stay.map(one => item(one))}</ul>`}${remove}</div></details>`;
     const options = CLEANUP_CHOICES.map(one => html `<option value="${one.value}"${one.value === plan.cleanup ? html ` selected` : ""}>${one.label}</option>`);
-    return html `<section class="storage">${note}<div class="card storage-state"><h2 data-checkout-bytes="${plan.totalBytes}">Checkouts use ${bytesWords(plan.totalBytes)}</h2><p class="meta">${facts}</p><p data-clean-bytes="${plan.freeBytes}">${frees}</p>${view.sweep === undefined ? "" : sweepHtml(view.sweep)}${view.landed === undefined ? "" : landedHtml(view.landed)}${preview}</div><h2>Automatic cleanup</h2>${postForm("/settings/storage", html `<label>Remove a finished task's clean checkout<select name="cleanup">${options}</select></label><p class="meta">Its branch stays. Checkouts with changes, commits on no branch, in use, or waiting for review are kept. When a task's work is already in main, Toolroll marks it complete and removes its checkout and local branches.</p>${reauth(html `<label>Your Toolroll password<input type="password" name="password" autocomplete="current-password" required></label>`)}<button type="submit">Save</button>`, { attrs: { class: "setting" } })}</section>`;
+    return html `<section class="storage">${note}<div class="card storage-state"><h2 data-checkout-bytes="${plan.totalBytes}">Checkouts use ${bytesWords(plan.totalBytes)}</h2><p class="meta">${facts}</p>${view.measured ?? ""}<p data-clean-bytes="${plan.freeBytes}">${frees}</p>${view.sweep === undefined ? "" : sweepHtml(view.sweep)}${view.landed === undefined ? "" : landedHtml(view.landed)}${preview}</div><h2>Automatic cleanup</h2>${postForm("/settings/storage", html `<label>Remove a finished task's clean checkout<select name="cleanup">${options}</select></label><p class="meta">Its branch stays. Checkouts with changes, commits on no branch, in use, or waiting for review are kept. When a task's work is already in main, Toolroll marks it complete and removes its checkout and local branches.</p>${reauth(html `<label>Your Toolroll password<input type="password" name="password" autocomplete="current-password" required></label>`)}<button type="submit">Save</button>`, { attrs: { class: "setting" } })}</section>`;
 }

package/dist/storage.js

@@ -101,7 +101,8 @@ export function diskBytes(paths) {
     if (process.platform !== "win32") {
         for (let at = 0; at < paths.length; at += 200) {
             const batch = paths.slice(at, at + 200);
-            const du = spawnSync("du", ["-sk", ...batch], { encoding: "utf8", maxBuffer: 16 * 1024 * 1024 });
+            // Bounded: a slow disk leaves the rest unmeasured rather than holding everything up.
+            const du = spawnSync("du", ["-sk", ...batch], { encoding: "utf8", maxBuffer: 16 * 1024 * 1024, timeout: 60_000 });
             for (const line of (du.stdout ?? "").split("\n")) {
                 const match = /^(\d+)\t(.+)$/.exec(line);
                 if (match !== null && batch.includes(match[2]))

package/dist/store.d.ts

@@ -2397,6 +2397,9 @@ export declare class Store {
         signedBy: string;
         absoluteExpiry: string;
     } | null;
+    /** Close every operating mode past its expiry (the background pass). Returns how many were closed. */
+    closeExpiredModes(now: Date): number;
+    private closeExpiredMode;
     /** Sign (or renew) a mode: closes any predecessor with a typed event and
      * ATOMICALLY reconciles the repo's nonterminal merge intents to the new
      * posture (F2). The caller has already run the password ceremony. */

package/dist/store.js

@@ -97,6 +97,7 @@ import { REVIEW_SCHEMA, reviewSwitchWords } from "./review-switch.js";
 import { SPEND_SCHEMA, billingOf, budgetStates, canPrice, claudeMachineBilling, countsToward, filersOf, monthOf, priceWork, seenBilling as seenBillingOf, spendItems, subagentFilers, usd } from "./spend.js";
 import { DEFAULT_PERIODS, RETENTION_SCHEMA, periodWords, widenRetentionSchema } from "./retention.js";
 import { CHECKOUT_CLEANUP_SCHEMA, LANDED_CLEANUP_SCHEMA, STORAGE_SWEEP_SCHEMA, DEFAULT_CLEANUP, cleanupWords } from "./storage.js";
+import { inReadOnlyRequest } from "./read-only-request.js";
 import { IN_RANGE, LEDGER_CHAIN_SCHEMA, safeWhole, sealLedger, verifyLedgerChain } from "./ledger-chain.js";
 import { NO_RULES, filerFor, isProtectedWork, protectedChanges, rulesWords } from "./approval-policy.js";
 import { configBase, envValue, namedPath } from "./names.js";
@@ -7163,15 +7164,10 @@ export class Store {
         if (row === undefined)
             return null;
         if (Date.parse(String(row["absolute_expiry"])) <= now.getTime()) {
-            this.transact(() => {
-                this.db
-                    .prepare("UPDATE operating_mode SET revoked_at = ?, revoked_by = ?, revoke_reason = 'expired' WHERE id = ? AND revoked_at IS NULL")
-                    .run(now.toISOString(), "the-clock", Number(row["id"]));
-                this.db
-                    .prepare("INSERT INTO operating_mode_event (mode, kind, actor, at) VALUES (?, 'expired-closed', 'the-clock', ?)")
-                    .run(Number(row["id"]), now.toISOString());
-                this.reconcileIntentsForMode(String(row["repo"]), null, now);
-            });
+            // A page visit only reads (docs/plans/get-side-effects.md): it sees no mode, and the background pass or the
+            // next path that acts closes it.
+            if (!inReadOnlyRequest())
+                this.closeExpiredMode(Number(row["id"]), String(row["repo"]), now);
             return null;
         }
         return {
@@ -7183,6 +7179,34 @@ export class Store {
             absoluteExpiry: String(row["absolute_expiry"]),
         };
     }
+    /** Close every operating mode past its expiry (the background pass). Returns how many were closed. */
+    closeExpiredModes(now) {
+        // The same rows activeMode would close: unrevoked, signed by a standing approver, past their expiry.
+        const rows = this.db.prepare(`SELECT operating_mode.id, operating_mode.repo, operating_mode.absolute_expiry FROM operating_mode
+      JOIN approver ON approver.name = operating_mode.signed_by AND approver.revoked_at IS NULL AND approver.role = 'approver'
+     WHERE operating_mode.revoked_at IS NULL`).all();
+        let closed = 0;
+        for (const row of rows) {
+            if (Date.parse(String(row["absolute_expiry"])) > now.getTime())
+                continue;
+            this.closeExpiredMode(Number(row["id"]), String(row["repo"]), now);
+            closed++;
+        }
+        return closed;
+    }
+    closeExpiredMode(id, repo, now) {
+        this.transact(() => {
+            const closed = this.db
+                .prepare("UPDATE operating_mode SET revoked_at = ?, revoked_by = ?, revoke_reason = 'expired' WHERE id = ? AND revoked_at IS NULL")
+                .run(now.toISOString(), "the-clock", id);
+            if (Number(closed.changes) !== 1)
+                return;
+            this.db
+                .prepare("INSERT INTO operating_mode_event (mode, kind, actor, at) VALUES (?, 'expired-closed', 'the-clock', ?)")
+                .run(id, now.toISOString());
+            this.reconcileIntentsForMode(repo, null, now);
+        });
+    }
     /** Sign (or renew) a mode: closes any predecessor with a typed event and
      * ATOMICALLY reconciles the repo's nonterminal merge intents to the new
      * posture (F2). The caller has already run the password ceremony. */

package/dist/subagent-work.js

@@ -235,6 +235,9 @@ function carryOut(store, flow, definition, stage, card, mate, context, answer, n
     }
     if (answer.action === "cant") {
         event("handled", `Couldn't handle “${card.title}”: ${answer.note}`);
+        // A zone that answers whoever asked tells them it couldn't, in its own words when it gave some: they always hear back.
+        if (stage.reply === true)
+            replyToAsker(store, flow, card, mate, answer.note || (answer.reason === "" ? `${context.name} couldn't handle this.` : `${context.name} couldn't handle this: ${answer.reason}`), now);
         if (stage.onFail !== null)
             store.moveFlowCard(card.id, { to: stage.onFail, outcome: "fail", actor, note: answer.note === "" ? null : note(answer.note), expectEntry: card.entry }, now);
         else

package/dist/task-status.d.ts

@@ -43,6 +43,8 @@ export type TaskStatus = {
         key: NeedKey;
         action: NeedAction;
     } | null;
+    /** The approved check as the Checks row shows it (`approvedCheckStateOf`): the road reads this, never the row's words. */
+    check?: ApprovedCheckState | null;
 };
 /** `reviewing`: the one automatic review (build-review.ts) is reading a finished build; it reads Building, not a headline of its own. */
 export type TaskStage = "queued" | "planning" | "needs-you" | "waiting" | "building" | "checking" | "reviewing" | "finished" | "complete" | "failed" | "stopped";
@@ -61,6 +63,8 @@ export type ChecksFact = {
         run: number;
         head: string;
     } | null;
+    /** Why it can't be read, when that is the project's check command approved again since it ran. */
+    cause?: "command-changed" | null;
 };
 /** What checks Off leaves for a release: `pending` until a passing full release check contains the commit, then
  * `covered`. `running`: a check is waiting for its batch or running on this commit. */
@@ -70,6 +74,25 @@ export declare function releaseStateOf(checks: Pick<ChecksFact, "status" | "leve
 /** How the project check stands for requirements that rest on it, read now: `covered` once a check passed on this
  * commit (its own, a follow-up, or a release check containing it), `pending` while checks Off wait for a release. */
 export declare function checkBackingOf(checks: Pick<ChecksFact, "status" | "level" | "release" | "running" | "batch"> | null | undefined): ReleaseState | undefined;
+/**
+ * Did the approved check pass for this result? The ONE answer the status headline and sentence, the Project checks
+ * row, the road's Checks step and the result page all read, so none of them can say "passed" while another says the
+ * check couldn't be read. Two records speak to it: the machine verdict sealed when the build finished, and the saved
+ * check receipt read now (with any follow-up check on the same commit). Fail closed: the check passed only when the
+ * receipt read now says so. A verdict that recorded a pass whose receipt is missing, says nothing ran, or can't be
+ * read is unreadable; a verdict that recorded a failure stays failed unless a later check on the same commit passed.
+ * `checks` undefined or null: nothing was read. Returns the check as every surface shows it (null: nothing to show).
+ */
+export declare function approvedCheckOf(verdict: string | null | undefined, reasons: readonly string[], checks: ChecksFact | null | undefined): ChecksFact | null;
+/** How the approved check reads, in one word every surface shares (from `approvedCheckOf`'s answer): `running` while a
+ * check is underway on the commit, else what it recorded. `unreadable`: it couldn't be read or the records disagree. */
+export type ApprovedCheckState = "passed" | "failed" | "running" | "not-run" | "off" | "unreadable";
+export declare function approvedCheckStateOf(checks: Pick<ChecksFact, "status" | "level" | "release" | "running" | "batch"> | null | undefined): ApprovedCheckState | null;
+/** A saved check that can't be read, in the words every surface uses. */
+export declare const CHECK_UNREADABLE = "The check result couldn't be read.";
+export declare const CHECK_UNREADABLE_ASK = "The check result couldn't be read. Run checks on it, or open the result to see why.";
+/** A saved check whose files are intact but whose command was approved again since it ran. */
+export declare const CHECK_COMMAND_CHANGED = "The check command changed since this check; run checks again.";
 /** What stands between a finished result and Complete (`completionBlockersOf`): each with the exact next step. */
 export type CompletionBlocker = {
     key: "check-failed" | "check-missing" | "criteria" | "high";
@@ -224,7 +247,7 @@ export declare function requirementsOf(matrix: readonly RequirementRow[] | null
  * the rest); an unresolved HIGH review finding. A release check that covers the commit counts as passed. */
 export declare function completionBlockersOf(f: {
     report: boolean;
-    checks: Pick<ChecksFact, "status" | "exitCode" | "level" | "release" | "running" | "batch"> | null;
+    checks: Pick<ChecksFact, "status" | "exitCode" | "level" | "release" | "running" | "batch" | "cause"> | null;
     checkRequired: boolean;
     matrix: readonly RequirementRow[] | null | undefined;
     verdict: string | null | undefined;
@@ -235,6 +258,10 @@ export declare function completionBlockersOf(f: {
 export declare function unverifiedWhenRefuted(requirements: NonNullable<TaskStatusFacts["requirements"]> | null, verdict: string | null | undefined): NonNullable<TaskStatusFacts["requirements"]> | null;
 /** Saved evidence health from the receipt's artifact list and its caveats. */
 export declare function evidenceOf(receipt: AssignmentSnapshot["receipt"], problems?: readonly string[]): NonNullable<TaskStatusFacts["evidence"]> | null;
+/** A saved check reading as the shared fact (head, level, a follow-up running, a batch, release coverage). */
+export declare function checksFactOf(checks: NonNullable<AssignmentSnapshot["receipt"]>["checks"], head: string | null): ChecksFact;
+/** A receipt's approved check, as every surface reads it (`approvedCheckOf` over its verdict and its saved check). */
+export declare function receiptChecksOf(receipt: NonNullable<AssignmentSnapshot["receipt"]>): ChecksFact | null;
 /** The status facts of one assignment, as every surface reads them. */
 export declare function assignmentStatusFacts(assignment: AssignmentSnapshot, options?: {
     work?: {