toolroll 0.9.74 → 0.9.76

package/CHANGELOG.md

@@ -1,5 +1,85 @@
 # Changelog
 
+## 0.9.76 — 2026-10-28
+
+- **Releases can approve themselves when they're green.** A new per-project
+  setting, **Release approval: Ask me / Approve automatically when checks
+  pass**, is off by default. Turning it on takes your typed password;
+  turning it off takes one click and withdraws every automatic approval not
+  yet merged. When it's on, a release task first reads "Checking
+  automatically" (`auto-check`), which lets its release check run and
+  nothing else. Once GitHub CI and the release check both pass on the exact
+  candidate, it approves itself (`auto-green`) and the release continues as
+  after your yes. You're told, not asked.
+- **What an automatic approval must prove.** Up to two failed attempts per
+  CI job, and two failed release-check builds on the same commit, are
+  tolerated as flakes. Past that it asks you. The change must touch only
+  allowed paths: product code and its tests, test files under `test/`,
+  docs, the changelog and a version-only `package.json` bump. Scripts, CI,
+  configuration, dependencies, policy files and test helpers (found from the
+  tests' own imports) need a person. CI is read again before the deploy, the
+  CLI switch, the merge and the tag. Anything not green stops the release,
+  withdraws the approval and tells you.
+- **A red CI after the merge holds publishing.** No tag, npm publish or
+  Homebrew update happens until a person runs
+  `toolroll release publish-ok <task>` with their password.
+- **Stricter CI verdicts on every release, yours too.** Only checks on the
+  exact head count. Required checks must come from GitHub Actions, so
+  another app's same-name success can't hide a failure. A newer run of the
+  same workflow supersedes its older runs on the commit.
+- **Toolroll's own git on agent checkouts runs against a frozen view.**
+  Every git command the plane runs on a checkout an agent wrote (staging,
+  committing, cleanup, pool refresh, scouts, planners, coding sessions, page
+  reads) runs against a private copy of the repository's settings taken
+  once. Changes the agent makes to them afterwards are never read.
+- **Git settings are denied by default.** Only audited config sections and
+  variables pass. Aliases, URL rewrites that reach remote helpers, empty
+  filter names and `hook.*` are refused. Writes allow no network transport.
+  Local git-lfs installs still work.
+- **Writes are bound to the project's recorded repository.** A checkout
+  whose `.git` points anywhere else is refused. Before git writes through a
+  view, every path it could write is walked for links and hard links. Plane
+  git writes on one checkout run one at a time. On git before 2.48, a
+  checkout added through the view is pointed at its repository, not at the
+  view.
+- **A git incident is recorded and you're notified.** A swap seen after git
+  ran is logged and raised as an attention notification. The notification
+  names the project by Toolroll's own record, never by a path the agent
+  chose.
+- **`discover --dirty` reads repositories through the same hardened git.**
+- Database: schema v136 (unchanged).
+
+## 0.9.75 — 2026-10-27
+
+- **Opening a page only shows it.** Pages no longer run checks, tidy up or
+  call out as you open them. Sign-ins, integrations, update checks, storage
+  and Codex's tools are checked in the background, and Models, Updates,
+  Storage, Pull requests, Tools, Project setup and the GitHub listing show
+  their last answer and when it was checked, with a **Check now** button to
+  ask again. On a coding session, **Review for shipping** and the changes
+  view are buttons, so a link preview or prefetch can't run them. Reading a
+  checkout an agent wrote never runs that checkout's own git settings.
+- **Reading an agent's checkout can't be raced into running a filter.** Git
+  reads the checkout through a private copy of its settings taken once, so a
+  filter the agent adds to its git config and `.git/info/attributes` after
+  that copy never runs.
+- **The task card never contradicts itself.** One answer to "did the
+  approved check pass" across the task page, the road, the Tasks list, the
+  result page and chat. A check whose saved log can't be read is never
+  shown as passed, and a check whose command was approved again since it ran
+  says so: "The check command changed since this check; run checks again."
+- **Lead-filed runs nest under the lead on Agents → Live.** Runs your own
+  lead filed sit under its tile. Once its turn has gone, they stay grouped
+  under a quiet "Filed by lead chat" header. The lead's full screen lists
+  every task it filed. Only you see what your lead filed.
+- **The lead passes asks to a helper instead of answering for them.** "Ask
+  Maya to …" now reaches Maya even when she seems to lack a tool or the
+  knowledge for it; she says so herself or asks you first.
+- **A helper's "can't" reaches whoever asked.** When a helper can't do
+  something asked at its desk, its note (or its reason) goes back to the
+  person or agent who asked, instead of waiting in an inbox.
+- Database: schema v136 (unchanged).
+
 ## 0.9.74 — 2026-10-27
 
 - **Agents → Live: every agent and subagent at a glance.** A read-only grid

package/dist/agent-fence.js

@@ -32,6 +32,7 @@ import { homedir, tmpdir } from "node:os";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { readMonitoring } from "./monitoring-settings.js";
 import { existingFolders } from "./names.js";
+import { ensureGitViewsRoot, gitViewsRoot } from "./git-views.js";
 import { DEPS_FOLDER, linkedKey, readyCopy, sharedCopies } from "./shared-deps.js";
 import { SEATBELT_PROBE, sandboxRuntimeProblem, srtSpawn } from "./sandbox-runtime.js";
 import { protectedStorageDenies, protectedStorageNames } from "./protected-storage.js";
@@ -175,6 +176,13 @@ export function agentFence(options) {
                 fence.add(join(state, entry));
         }
     }
+    // The plane's private views of repositories for its own git (git-views.ts): made first, so no build is the one to
+    // create them, and denied by name whether or not that worked (a sandbox that can't cover the path refuses to launch).
+    try {
+        ensureGitViewsRoot(home);
+    }
+    catch { /* fenced by name below either way */ }
+    fence.add(gitViewsRoot(home));
     for (const secrets of existingFolders(home, { dot: true }))
         fence.add(secrets);
     // v104: the folder the audit stream writes to holds the whole instance's history.

package/dist/approval-authority.js

@@ -4,7 +4,9 @@
  *
  * An allowlist, never a deny-list: a person's yes (`password`, `chat`) stands unless a machine made that seal; a mode
  * or a flow grant stands while its signature does; a standing order's firing (`schedule`, or an old firing stored as
- * `password`) stands while its approver can still approve in the project. Everything else — the lead (`lead`, which
+ * `password`) stands while its approver can still approve in the project; an automatic release seal (`auto-check`,
+ * `auto-green`: docs/plans/auto-approve-green.md) stands on its own evidence row while the project's setting is on and
+ * the person who turned it on can still approve there. Everything else — the lead (`lead`, which
  * phase 1 never lets stand), a null basis, a word this code doesn't write — stands on nothing.
  *
  * The seal's origin is read from the acts recorded AT the seal's own instant, exactly as scope.ts sealOriginOf reads
@@ -12,6 +14,7 @@
  */
 import { grantStandsSql } from "./flow-unattended.js";
 import { accountReachesSql } from "./project-access.js";
+import { autoSealSql } from "./release-authority.js";
 /** The proofs a person gives (src/person-proof.ts), as an SQL list. */
 const PERSON_PROOFS = "('password-now', 'sso-now', 'fresh-password', 'fresh-sso', 'session', 'cli-login', 'chat', 'passkey')";
 /** SQL over a `task_scope` alias and a repo expression: whether that row's approval authority stands at `now` (an SQL
@@ -25,7 +28,8 @@ export const authorityStandsSql = (scope, repo, now) => `COALESCE((((COALESCE(${
          WHERE om.repo = ${repo} AND om.revoked_at IS NULL AND om.absolute_expiry > ${now} AND om.digest = ${scope}.mode_digest
            AND signer.revoked_at IS NULL AND signer.role = 'approver' AND ${accountReachesSql("signer", repo)}))
     OR (${scope}.approval_basis = 'grant' AND ${grantStandsSql(`${scope}.mode_digest`, now, repo)})
-    OR (${scope}.approval_basis = 'schedule' AND ${approverStandsSql(scope, repo)}))
+    OR (${scope}.approval_basis = 'schedule' AND ${approverStandsSql(scope, repo)})
+    OR (${scope}.approval_basis IN ('auto-check', 'auto-green') AND ${autoSealSql(scope, repo)} AND ${approverStandsSql(scope, repo)}))
     AND ${releaseStandsSql(scope, now)}), 0)`;
 /** SQL: a `carried` seal stands only on its own carry row — this task, this approved digest, this candidate, and the
  * reference `<authority>:<carry>` the carry transaction wrote (release-once.md). */

package/dist/approval-rules-ui.d.ts

@@ -6,6 +6,8 @@
  */
 import { type Html } from "./html.js";
 import type { ApprovalRules } from "./approval-policy.js";
+/** The rules' style, and the same for the Releases section under its own class (so a page holds one `.approval-rules`
+ * form, not two). */
 export declare const APPROVAL_RULES_CSS: string;
 export type ApprovalRulesView = {
     repo: string;
@@ -20,6 +22,15 @@ export type ApprovalRulesView = {
 };
 /** The rules in plain words, for anyone who can see the project. */
 export declare function rulesSummary(rules: ApprovalRules): string;
+/** Settings → Approval rules → Releases (docs/plans/auto-approve-green.md): who approves this project's releases. */
+export type ReleaseApprovalView = {
+    repo: string;
+    auto: boolean;
+    setBy: string | null;
+    at: string | null;
+    canChange: boolean;
+};
+export declare function releaseApprovalHtml(view: ReleaseApprovalView): Html;
 export declare function approvalRulesHtml(view: ApprovalRulesView, notice: {
     said?: string | null;
     problem?: string | null;

package/dist/approval-rules-ui.js

@@ -5,11 +5,14 @@
  * ledger, before → after.
  */
 import { html, postForm, reauth } from "./html.js";
-export const APPROVAL_RULES_CSS = `.approval-rules{max-width:720px;min-width:0}.approval-rules fieldset{border:0;padding:0;margin:18px 0 0;min-width:0}` +
+const RULES_CSS = `.approval-rules{max-width:720px;min-width:0}.approval-rules fieldset{border:0;padding:0;margin:18px 0 0;min-width:0}` +
     `.approval-rules legend{font-weight:600;font-size:.875rem;margin-bottom:8px}.approval-rules .choice{display:grid;grid-template-columns:auto minmax(0,1fr);gap:10px;align-items:start;margin:0 0 10px;font-weight:400}` +
     `.approval-rules .choice input{margin:.2rem 0 0}.approval-rules .choice strong{display:block;font-size:.875rem;font-weight:500}.approval-rules .choice small{display:block;color:var(--muted-foreground);font-size:.8125rem;margin-top:2px}` +
     `.approval-rules textarea{min-height:88px;font-family:var(--font-mono);font-size:.8125rem}.approval-rules .paths{margin:4px 0 0 26px}` +
     `.approval-rules .current{margin:0 0 4px}.approval-rules .step-up{margin-top:16px}.approval-rules button[type=submit]{margin-top:14px}`;
+/** The rules' style, and the same for the Releases section under its own class (so a page holds one `.approval-rules`
+ * form, not two). */
+export const APPROVAL_RULES_CSS = RULES_CSS + RULES_CSS.replaceAll(".approval-rules", ".release-approval");
 /** The rules in plain words, for anyone who can see the project. */
 export function rulesSummary(rules) {
     const parts = [];
@@ -21,6 +24,15 @@ export function rulesSummary(rules) {
         parts.push(`Work touching ${rules.protectedPaths.join(", ")} is protected: two people approve it, never a subagent or an operating mode.`);
     return parts.length === 0 ? "No approval rules: anyone who can approve on this project can approve its work, including their own." : parts.join(" ");
 }
+export function releaseApprovalHtml(view) {
+    const since = view.setBy === null ? "" : html ` <span class="meta">Changed by ${view.setBy} on ${(view.at ?? "").slice(0, 10)}.</span>`;
+    const current = html `<p class="current">${view.auto ? "Releases approve themselves once the pull request's CI and the release check pass on the exact commit. Anything red still asks you." : "Every release waits for your approval."}${since}</p>`;
+    const heading = html `<h2>Release approval</h2>`;
+    if (!view.canChange)
+        return html `<section class="release-approval">${heading}${current}<p class="meta">An approver of this project sets this.</p></section>`;
+    const choice = (value, title, hint) => html `<label class="choice"><input type="radio" name="action" value="${value}"${(view.auto ? "auto" : "ask") === value ? html ` checked` : ""}><span><strong>${title}</strong><small>${hint}</small></span></label>`;
+    return html `<section class="release-approval">${heading}${current}${postForm("/settings/release-approval", html `<fieldset aria-label="Release approval">${choice("ask", "Ask me", "A release deploys only after you approve it.")}${choice("auto", "Approve automatically when checks pass", "You're told when a release approves itself. A failed check, red CI or a CI failure after the deploy still stops and asks you.")}</fieldset><div class="step-up"><label>Your Toolroll password (to approve automatically)<input type="password" name="password" autocomplete="current-password"></label></div><button type="submit">Save</button>`, { hidden: { repo: view.repo } })}</section>`;
+}
 export function approvalRulesHtml(view, notice) {
     const note = notice.problem ? html `<p class="problem" role="alert">${notice.problem}</p>` : notice.said ? html `<p role="status">${notice.said}</p>` : "";
     const changed = view.rules.updatedBy === null ? "" : html ` <span class="meta">Changed by ${view.rules.updatedBy} on ${(view.rules.updatedAt ?? "").slice(0, 10)}.</span>`;

package/dist/assignment.d.ts

@@ -28,6 +28,9 @@ export type AssignmentChecks = {
     batch?: ChecksBatch | null;
     /** Checks Off: the passing full release check that contains this commit (release-coverage.ts), read now, never sealed. */
     release?: ReleaseCoverage | null;
+    /** Why a saved check can't be read, when it is the project's check command approved again since it ran (its files
+     * are intact; running checks again settles it). Presentation only, never sealed. */
+    cause?: "command-changed" | null;
 };
 export type AssignmentReceipt = {
     digest: string;

package/dist/assignment.js

@@ -21,7 +21,7 @@ import { requiredCheckCommandFor, runCheckLevel } from "./check-levels.js";
 import { followUpChecksOf, withFollowUps } from "./result-follow-ups.js";
 import { buildReviewOf, findingWords } from "./review-switch.js";
 import { NEEDS, WAITS, processNeedOf, resultHoldUpSentence } from "./needs-you.js";
-import { assignmentStageOf, checkBackingOf, completionBlockersOf, requirementWordOf } from "./task-status.js";
+import { assignmentStageOf, checkBackingOf, completionBlockersOf, receiptChecksOf, requirementWordOf } from "./task-status.js";
 import { releaseCoverageOf } from "./release-coverage.js";
 import { leadClaimOf } from "./lead-voice.js";
 /** Status-first handoff for routine reads. Fetch get_assignment only when
@@ -53,7 +53,7 @@ function olderStoreSafe(read, absent) {
     }
 }
 /** A check as the receipt digest seals it: presentation-only fields (check-levels.ts) left out. */
-const sealedChecks = ({ level: _level, running: _running, batch: _batch, release: _release, ...proof }) => proof;
+const sealedChecks = ({ level: _level, running: _running, batch: _batch, release: _release, cause: _cause, ...proof }) => proof;
 const OWNER_ACTION = "assignment claimed";
 const CHECK_ACTION = COMPLETION_ACTION;
 const actorOf = (owner) => `${owner.kind}:${owner.id}`;
@@ -87,7 +87,7 @@ function ownerOf(store, rootId, repo) {
 // Report the recorded check outcome, never turn a model verdict into a check.
 // Follow-up checks on the same commit (Run checks) upgrade a pass and show a failure.
 export function assignmentChecksForRun(store, root, runId, now) {
-    const own = buildChecks(store, root, runId);
+    const own = recordedFailureStands(store, runId, buildChecks(store, root, runId));
     const run = store.getRun(runId);
     const followUps = followUpChecksOf(store, runId, now, root);
     if (followUps.length === 0)
@@ -106,6 +106,18 @@ export function assignmentChecksForRun(store, root, runId, now) {
         ...(changed ? { status: read.status, level: read.level, exitCode: read.exitCode, logArtifactId: latest?.logArtifactId ?? own.logArtifactId,
             detail: read.status === "passed" ? `${words} passed.` : `${words} failed (exit ${read.exitCode}).` } : {}) };
 }
+/** A failure the builder recorded (run_check) stands when its saved receipt can't be read now or says nothing ran:
+ * fail closed, every surface reads the same known failure and its exit code (task-status.ts approvedCheckOf). */
+function recordedFailureStands(store, runId, own) {
+    if (own.status !== "unavailable" && own.status !== "not-run")
+        return own;
+    const recorded = olderStoreSafe(() => store.runCheckFor(runId), null);
+    if (recorded?.status !== "failed")
+        return own;
+    return { ...own, status: "failed", exitCode: recorded.exitCode,
+        detail: `${own.level === "quick" ? "Quick checks" : "Checks"} failed${recorded.exitCode === null ? "" : ` (exit ${recorded.exitCode})`}. ${own.detail}` };
+}
+const COMMAND_MISSING_OR_CHANGED = "The original approved verification command is missing or changed.";
 function buildChecks(store, root, runId) {
     const level = runCheckLevel(store, runId);
     const unavailable = (detail) => ({ status: "unavailable", exitCode: null, command: null, logArtifactId: null, detail, level });
@@ -113,8 +125,13 @@ function buildChecks(store, root, runId) {
         return unavailable("Saved checks are unavailable.");
     try {
         const gate = verificationEvidence(store, root, runId);
-        if (!gate.ok)
-            return unavailable(gate.problem);
+        if (!gate.ok) {
+            // The approved command changed since this check ran: nothing is missing, the check just no longer binds to it.
+            const run = store.getRun(runId), repo = run === null ? null : store.refById(run.taskRef)?.repo ?? null;
+            const live = repo === null ? null : store.liveVerifyCommand(repo);
+            const changed = gate.problem === COMMAND_MISSING_OR_CHANGED && live !== null && run !== null && live.approvedAt > run.startedAt;
+            return changed ? { ...unavailable(gate.problem), cause: "command-changed" } : unavailable(gate.problem);
+        }
         const receipt = gate.bytes === null ? null : JSON.parse(gate.bytes);
         if (receipt === null)
             return { ...unavailable(level === "off" ? "Checks were off for this build." : "No machine check is recorded."), status: "not-run" };
@@ -390,10 +407,12 @@ function readinessOf(store, receipt, repo, review) {
     const high = review === null || review.sentBackAs !== null || review.state !== "reviewed" ? 0 : review.high.length;
     const checkRequired = olderStoreSafe(() => requiredCheckCommandFor(store, repo, receipt.taskId, receipt.checks.level), null) !== null;
     const matrix = receipt.proof?.matrix ?? [];
-    const backing = checkBackingOf(receipt.checks);
-    const verdict = shownVerdictOf(receipt.proof?.verdict ?? null, { checkFailed: !report && receipt.checks.status === "failed", highFindings: high,
+    // The approved check as every surface reads it: a recorded pass the saved receipt can't show doesn't count.
+    const checks = receiptChecksOf(receipt);
+    const backing = checkBackingOf(checks);
+    const verdict = shownVerdictOf(receipt.proof?.verdict ?? null, { checkFailed: !report && checks?.status === "failed", highFindings: high,
         reviewPending: review?.state === "pending", criteriaPassed: matrix.every(row => requirementWordOf(row, null, backing) === "Met") });
-    const blockers = completionBlockersOf({ report, checks: receipt.checks, checkRequired, matrix, verdict: receipt.proof?.verdict ?? null,
+    const blockers = completionBlockersOf({ report, checks, checkRequired, matrix, verdict: receipt.proof?.verdict ?? null,
         accepted: receipt.proofAcceptance !== null, high });
     return { verdict, checksOff: !report && receipt.checks.level === "off", blockers };
 }

package/dist/batch-checks.js

@@ -3,6 +3,7 @@ import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { run as execRun } from "./exec.js";
+import { hardenedGit } from "./teardown-git.js";
 import { approvedCommandShell, SETUP_ENV_ALLOWLIST, SETUP_ENV_DENYLIST } from "./builder.js";
 import { runWithIsolatedDatabase } from "./child-database.js";
 import { boundStreamHeadTail, redactSecretLines, scanForSecrets, storeEvidence } from "./evidence.js";
@@ -86,7 +87,8 @@ function finishOne(store, one, repo, task, status, detail, at) {
 async function checkCohort(store, root, repo, cohort, deps) {
     const now = deps.now ?? (() => new Date());
     const runner = deps.runner ?? execRun;
-    const git = deps.git ?? execRun;
+    // The project's repository and checkouts of builds' commits, both agent-writable: the hardened git (teardown-git.ts).
+    const git = deps.git ?? hardenedGit(execRun);
     const command = store.liveVerifyCommand(repo);
     if (command === null)
         return 0;