toolroll 0.9.74 → 0.9.76

package/dist/server/render-tasks.d.ts

@@ -232,6 +232,11 @@ export declare function agentsStripHtml(view: RouteView | null, taskId: string):
 /** A ceremony nonce as stored: the sha256 hex of the value the form carried. */
 export declare function nonceHashOf(value: string): string;
 /** The approve POST's refusal, in words a person can act on. */
+/** A release task's automatic approval, in words (docs/plans/auto-approve-green.md). */
+export declare function autoReleaseWords(auto: {
+    kind: "checking" | "approved";
+    candidate: string;
+}): string;
 /** " (password remembered from 10:42)" when the approval stood on a remembered password or sign-in; nothing otherwise. */
 export declare function approvalProofWords(proof: {
     method: string;
@@ -523,6 +528,11 @@ export declare function taskBodyParts(data: {
         method: string;
         at: string;
     } | null;
+    /** A release task the plane approved (or is checking) itself (docs/plans/auto-approve-green.md): its candidate. */
+    autoRelease?: {
+        kind: "checking" | "approved";
+        candidate: string;
+    } | null;
     /** One approval per release (release-once.md): the release this task belongs to, and whether this reader may stop it. */
     release?: ReleaseView | null;
     canStopRelease?: boolean;

package/dist/server/render-tasks.js

@@ -746,6 +746,11 @@ export function nonceHashOf(value) {
     return createHash("sha256").update(value).digest("hex");
 }
 /** The approve POST's refusal, in words a person can act on. */
+/** A release task's automatic approval, in words (docs/plans/auto-approve-green.md). */
+export function autoReleaseWords(auto) {
+    return auto.kind === "approved" ? `Approved automatically: CI and release check passed on ${auto.candidate.slice(0, 7)}`
+        : `Checking automatically: approves itself once CI and the release check pass on ${auto.candidate.slice(0, 7)}`;
+}
 /** " (password remembered from 10:42)" when the approval stood on a remembered password or sign-in; nothing otherwise. */
 export function approvalProofWords(proof) {
     if (proof == null)
@@ -1437,6 +1442,11 @@ export function taskBodyParts(data) {
             if (resultStatus.token === "evidence-damaged") {
                 return withReview(box("problem", resultStatus.label, html `<a href="/r/${proof.runId}">Build #${proof.runId}</a> finished. ${resultStatus.detail}${publicationWords}`, "evidence-damaged"), html `<div class="proof-review-actions"><a class="button-link" href="/r/${proof.runId}">Review the evidence problems</a></div>`, proofDetails);
             }
+            // A recorded pass the check read now doesn't stand behind (unreadable, failed since, or not read here) never
+            // reads "passed": the box says what holds now (task-status.ts approvedCheckOf).
+            if (proof.proofVerdict === "verified" && !accepted && !(proof.receipt?.checks !== undefined && ["ready-to-review", "pr-opened", "merge-observed", "pr-closed"].includes(resultStatus.token))) {
+                return withReview(box(resultStatus.tone === "problem" ? "problem" : "ok", resultStatus.label, html `<a href="/r/${proof.runId}">Build #${proof.runId}</a> finished. ${resultStatus.detail}${publicationWords}`, resultStatus.token), proofDetails);
+            }
             if (proof.proofVerdict === "verified" && !accepted) {
                 const recovered = verificationRecovered(proof.proofReasons);
                 return withReview(box("ok", resultStatus.label, recovered
@@ -1492,11 +1502,13 @@ export function taskBodyParts(data) {
             html `<p><strong>Quality</strong> ${qualityModeTitle(scope.qualityMode ?? "default")}</p>`,
             acceptanceCeremonyHtml(scope.acceptance),
             scope.releaseTerms == null ? "" : html `<p><strong>Release</strong></p><p class="recap">${releaseTermsSentence(scope.releaseTerms)}</p>${scope.releaseTerms.policy.carry ? html `<details><summary>What asks again</summary><ul>${joinHtml(releaseAsksAgainWords(scope.releaseTerms).map(line => html `<li>${line}</li>`), "")}</ul></details>` : ""}`,
-            approval.approved && data.release?.kind === "carried"
-                ? html `<p class="meta scope-seal">Carried from ${data.release.approver ?? "a person"}'s release approval · <a href="${taskHref(data.release.anchorTask)}">Release ${data.release.version}</a> · <span class="seal">signs ${shortDigest(scope.digest)}</span></p>`
-                : approval.approved
-                    ? html `<p class="meta scope-seal">Approved by ${approval.by}${approvalProofWords(data.approvalProof)} · ${whenTime(approval.at)} · <span class="seal">signs ${shortDigest(scope.digest)}</span><span class="so-sr-only"> — approval binds to this exact wording</span></p>`
-                    : html `<p class="meta"><span class="seal">signs ${shortDigest(scope.digest)}</span> — approval binds to this exact wording</p><p class="meta">Not approved${approval.reason === "changed" ? " — approved once, then rewritten" : ""}</p>`,
+            approval.approved && data.autoRelease != null
+                ? html `<p class="meta scope-seal">${autoReleaseWords(data.autoRelease)} · <span class="seal">signs ${shortDigest(scope.digest)}</span></p>`
+                : approval.approved && data.release?.kind === "carried"
+                    ? html `<p class="meta scope-seal">Carried from ${data.release.approver ?? "a person"}'s release approval · <a href="${taskHref(data.release.anchorTask)}">Release ${data.release.version}</a> · <span class="seal">signs ${shortDigest(scope.digest)}</span></p>`
+                    : approval.approved
+                        ? html `<p class="meta scope-seal">Approved by ${approval.by}${approvalProofWords(data.approvalProof)} · ${whenTime(approval.at)} · <span class="seal">signs ${shortDigest(scope.digest)}</span><span class="so-sr-only"> — approval binds to this exact wording</span></p>`
+                        : html `<p class="meta"><span class="seal">signs ${shortDigest(scope.digest)}</span> — approval binds to this exact wording</p><p class="meta">Not approved${approval.reason === "changed" ? " — approved once, then rewritten" : ""}</p>`,
             html `</div>`,
         ], "\n");
     // The scout's report (mate arc §10): title, summary, the document inert,
@@ -1787,11 +1799,13 @@ export function taskBodyParts(data) {
         : "";
     const scopeRow = scope === null
         ? prop("scope", "none yet")
-        : approval.approved && data.release?.kind === "carried"
-            ? prop("approved scope", html `<span class="seal">signs ${shortDigest(scope.digest)}</span> · carried from ${data.release.approver ?? "a person"}'s release approval · <a href="${taskHref(data.release.anchorTask)}">Release ${data.release.version}</a>`)
-            : approval.approved
-                ? prop("approved scope", html `<span class="seal">signs ${shortDigest(scope.digest)}</span> · ${qualityModeTitle(scope.qualityMode ?? "default")} · approved by ${approval.by}${approvalProofWords(data.approvalProof)} · ${whenTime(approval.at)}`)
-                : prop("scope", approval.reason === "changed" ? "rewritten since its approval — needs a new yes" : "not approved");
+        : approval.approved && data.autoRelease != null
+            ? prop("approved scope", html `<span class="seal">signs ${shortDigest(scope.digest)}</span> · ${autoReleaseWords(data.autoRelease)}`)
+            : approval.approved && data.release?.kind === "carried"
+                ? prop("approved scope", html `<span class="seal">signs ${shortDigest(scope.digest)}</span> · carried from ${data.release.approver ?? "a person"}'s release approval · <a href="${taskHref(data.release.anchorTask)}">Release ${data.release.version}</a>`)
+                : approval.approved
+                    ? prop("approved scope", html `<span class="seal">signs ${shortDigest(scope.digest)}</span> · ${qualityModeTitle(scope.qualityMode ?? "default")} · approved by ${approval.by}${approvalProofWords(data.approvalProof)} · ${whenTime(approval.at)}`)
+                    : prop("scope", approval.reason === "changed" ? "rewritten since its approval — needs a new yes" : "not approved");
     const strikesRow = data.strikes > 0 ? prop("strikes", `${data.strikes} failed attempt(s)`) : "";
     const propsCard = html `<div class="card props">${workerRow}${queueRow}${scopeRow}${publishesRow}${economics}${strikesRow}</div>`;
     // The same facts for the rebuilt page, row for row.
@@ -1806,9 +1820,10 @@ export function taskBodyParts(data) {
         facts.push({ label: "Queue", parts: [`${data.position.position} of ${data.position.total}${data.position.column === null ? " in the shared queue" : ` in ${data.position.column}'s queue`} · `, { label: "Reorder", href: "/board?view=order" }] });
     }
     facts.push(scope === null ? { label: "Scope", parts: ["none yet"] }
-        : approval.approved && data.release?.kind === "carried" ? { label: "Approved scope", parts: [`Carried from ${data.release.approver ?? "a person"}'s release approval · `, { label: `Release ${data.release.version}`, href: taskHref(data.release.anchorTask) }] }
-            : approval.approved ? { label: "Approved scope", parts: [{ seal: `signs ${scope.digest.length <= 12 ? scope.digest : `${scope.digest.slice(0, 12)}…`}` }, ` · ${qualityModeTitle(scope.qualityMode ?? "default")} · approved by ${approval.by}${approvalProofWords(data.approvalProof)}`, ...(approval.at === null ? [] : [" · ", { at: approval.at }])] }
-                : { label: "Scope", parts: [approval.reason === "changed" ? "rewritten since its approval — needs a new yes" : "not approved"] });
+        : approval.approved && data.autoRelease != null ? { label: "Approved scope", parts: [autoReleaseWords(data.autoRelease)] }
+            : approval.approved && data.release?.kind === "carried" ? { label: "Approved scope", parts: [`Carried from ${data.release.approver ?? "a person"}'s release approval · `, { label: `Release ${data.release.version}`, href: taskHref(data.release.anchorTask) }] }
+                : approval.approved ? { label: "Approved scope", parts: [{ seal: `signs ${scope.digest.length <= 12 ? scope.digest : `${scope.digest.slice(0, 12)}…`}` }, ` · ${qualityModeTitle(scope.qualityMode ?? "default")} · approved by ${approval.by}${approvalProofWords(data.approvalProof)}`, ...(approval.at === null ? [] : [" · ", { at: approval.at }])] }
+                    : { label: "Scope", parts: [approval.reason === "changed" ? "rewritten since its approval — needs a new yes" : "not approved"] });
     if (data.release?.kind === "anchor")
         facts.push({ label: "Release", parts: [`Approved for release ${data.release.version}`, ...(data.release.landed.length === 0 ? [] : [` · later commits: ${data.release.landed.map(one => one.sha.slice(0, 7)).join(", ")}`]), ...(data.release.carrying ? [] : [` · later commits ask again`])] });
     facts.push({ label: "Publishes as", parts: [publishesAs] });
@@ -2364,10 +2379,8 @@ export function taskBodyParts(data) {
         journey: task.state === "cancelled" || data.status === undefined ? null : (() => {
             const planning = data.plan === "requested" && approveForm === "";
             const read = data.assignment != null ? assignmentStageOf(data.assignment, { token: data.status.token }, planning) : stageOfCode(data.status.token, { planning });
-            // The checks fact the status card shows, read as what happened: a "note" is a failure when its words say so.
-            const shown = statusCard?.status.details.find(one => one.key === "checks") ?? null;
-            const checks = shown === null ? null : shown.mark === "ok" ? "passed" : shown.mark === "running" ? "running"
-                : shown.mark === "failed" || /\bfailed\b/i.test(shown.text) ? "failed" : shown.mark === "none" ? "not-run" : "unread";
+            // The one answer the status card's headline and Project checks row read (task-status.ts approvedCheckOf).
+            const checks = statusCard?.status.check ?? null;
             const report = data.deliverable === "report" || data.report != null;
             return taskRoad(read, scope !== null && approvalOf(scope).approved, task.state === "done", { checks, report });
         })(),

package/dist/server/route-table.js

@@ -237,6 +237,10 @@ for (const one of ["close", "remove"])
     post("tasks", `term.${one}`, `^\\/term\\/${TERMINAL}\\/${one}$`, { ...TERM, sample: `/term/${"a".repeat(32)}/${one}` });
 for (const one of ["send", "stop", "resume", "recover", "continue", "ship", "answer"])
     post("tasks", `code.${one}-send`, `^\\/code\\/${SESSION}\\/${one}$`, { ...CODING_ACT, sample: `/code/${"a".repeat(32)}/${one}` });
+// Reading a coding checkout runs git in a folder an agent writes, so it is a POST with the form token, never a page
+// visit (docs/plans/get-side-effects.md): the session's changes, and the review-for-shipping preview.
+post("tasks", "code.changes-read", `^\\/code\\/${SESSION}\\/changes$`, { project: "coding", limited: "self", callers: ["cookie"], sample: `/code/${"a".repeat(32)}/changes` });
+post("tasks", "code.ship-preview", `^\\/code\\/${SESSION}\\/ship\\/preview$`, { project: "coding", limited: "self", callers: ["cookie"], sample: `/code/${"a".repeat(32)}/ship/preview` });
 // Any other coding action answers "not found" after the same access check.
 post("tasks", "code.act-other", "^\\/code(\\/.*)?$", { ...CODING_ACT, sample: "/code/unknown" });
 post("settings", "settings.skills-revise", "/settings/skills/revise", { project: "form", limited: "unscoped", ...approver("Sign in to revise a test.", "/settings/skills") });
@@ -299,6 +303,9 @@ post("tasks", "sweep.cancel-rest", "^\\/sweeps\\/[1-9][0-9]{0,9}\\/cancel-rest$"
 // (the handler proves it as a credential act); turning it off is one click, so the row itself is not a step-up.
 get("settings", "settings.passwordless", "/settings/passwordless", { ...free, ...operator("An instance operator sets Passwordless.", "/settings") });
 post("settings", "settings.passwordless-send", "/settings/passwordless", { callers: ["cookie"], ...operator("An instance operator sets Passwordless.", "/settings") });
+// Release approval (docs/plans/auto-approve-green.md): an approver of the project, from a browser. Approving releases
+// automatically takes a typed password (the handler proves it as a credential act); asking again is one click.
+post("settings", "settings.release-approval-send", "/settings/release-approval", { callers: ["cookie"], ...approver("An approver sets how releases are approved.", "/settings/approval") });
 post("pages", "ledger.checkpoint", "/ledger/checkpoint", operator("An instance operator makes ledger checkpoints.", "/ledger"));
 const SETTINGS_ACT_ROLES = {
     policy: operator("An instance operator sets the policy.", "/settings/policy"),
@@ -308,10 +315,12 @@ const SETTINGS_ACT_ROLES = {
     updates: operator("An instance operator updates Toolroll.", "/settings"),
     "updates/seen": operator("An instance operator updates Toolroll.", "/settings"),
     "updates/cancel": operator("An instance operator updates Toolroll.", "/settings"),
+    "updates/check": operator("An instance operator updates Toolroll.", "/settings"),
     retention: operator("An instance operator sets retention.", "/settings"),
     storage: operator("An instance operator looks after storage.", "/settings"),
     "storage/clean": operator("An instance operator looks after storage.", "/settings"),
     "storage/discard": operator("An instance operator looks after storage.", "/settings"),
+    "storage/check": operator("An instance operator looks after storage.", "/settings"),
     "backups/now": operator("An instance operator looks after backups.", "/settings"),
     backups: operator("An instance operator looks after backups.", "/settings"),
     data: operator("An instance operator exports data.", "/settings"),
@@ -320,7 +329,7 @@ const SETTINGS_ACT_ROLES = {
     "tools/connect": approver("Sign in as an approver to connect tools.", "/settings/tools"),
     "tools/change": approver("Sign in as an approver to manage tools.", "/settings/tools"),
 };
-for (const one of ["policy", "approval", "request-limits", "sessions", "sign-in", "updates", "updates/seen", "updates/cancel", "retention", "storage", "storage/clean", "storage/discard", "pull-requests", "checks", "backups/now", "backups", "data", "integrations/test", "monitoring", "tools/connect", "tools/change", "appearance"]) {
+for (const one of ["policy", "approval", "request-limits", "sessions", "sign-in", "updates", "updates/seen", "updates/cancel", "updates/check", "retention", "storage", "storage/clean", "storage/discard", "storage/check", "pull-requests", "pull-requests/check", "checks", "backups/now", "backups", "data", "integrations/test", "monitoring", "tools/connect", "tools/change", "appearance"]) {
     post(one === "sessions" ? "people" : "settings", `settings.${one.replaceAll("/", "-")}-send`, `/settings/${one}`, { ...(["policy", "approval", "request-limits", "sessions", "sign-in", "updates", "updates/seen", "updates/cancel", "retention", "storage", "storage/clean", "storage/discard", "pull-requests", "checks", "backups", "data", "monitoring", "tools/connect", "tools/change"].includes(one) ? { scope: "step-up" } : {}), ...SETTINGS_ACT_ROLES[one] });
 }
 post("settings", "settings.flows-on", "/settings/flows/on", { limited: "collection", ...approver("An approver switches starter flows on.", "/settings/flows") });
@@ -334,6 +343,9 @@ post("settings", "settings.knowledge-proposal", "/settings/knowledge/proposal",
 post("settings", "settings.knowledge-decision", "/settings/knowledge/decision", { project: "form", ...approver("Sign in as an approver to change project decisions.", "/settings/knowledge") });
 post("settings", "settings.knowledge-change", "/settings/knowledge/change", { project: "form", limited: "unscoped", ...approver("Sign in as an approver to change project knowledge.", "/settings/knowledge") });
 post("settings", "settings.learning-change", "/settings/learning/change", { project: "form", limited: "unscoped" });
+// A page shows the last check; these ask again (docs/plans/get-side-effects.md).
+post("settings", "control.models-refresh", "/control/models-refresh", anyApprover("Project setup requires an approver."));
+post("settings", "settings.connection-check", "/settings/connection/check", anyApprover("An approver checks a sign-in.", "/settings"));
 for (const one of ["setup-preview", "setup-approve", "instructions-preview", "instructions-approve"])
     post("settings", `control.${one}`, `/control/${one}`, { ...(one.endsWith("approve") ? { scope: "step-up" } : {}) });
 for (const [service, name] of [["slack", "Slack"], ["teams", "Teams"], ["discord", "Discord"]]) {
@@ -348,6 +360,7 @@ post("settings", "settings.telegram-unpair", "/settings/telegram/unpair", { limi
 for (const one of ["messaging", "permission-default", "quality-default", "notifications", "notifications/mute", "telegram-digest", "provider-key", "provider-key-clear", "telegram-token", "email", "email-test", "email-read-test", "google", "google/disconnect"]) {
     post("settings", `settings.${one.replaceAll("/", "-")}-send`, `/settings/${one}`);
 }
+post("pages", "projects.github-list", "/projects/github", { callers: ["cookie"], ...anyApprover("your login can watch — adding projects is an approver's act") });
 post("pages", "projects.select", "/projects/select", { project: "form-path", limited: "unscoped", viewer: true });
 post("pages", "projects.remove", "/projects/remove", { project: "form", ...operator("An instance operator removes projects.", "/settings/project") });
 post("pages", "projects.open", "/projects/open", { project: "form-path" });
@@ -397,6 +410,9 @@ post("pages", "projects.onboard-preview", "/projects/onboard-preview", { project
 post("pages", "projects.onboard-confirm", "/projects/onboard-confirm", { scope: "step-up", project: "none" });
 post("chat", "push.subscribe", "/push/subscribe", { scope: "step-up" });
 post("chat", "push.remove", "/push/remove");
+// Ask this computer's agent CLIs again (docs/plans/get-side-effects.md): Chat's first run and Settings → Lead's Check
+// now. GET /lead/status only reads the last answer.
+post("chat", "lead.check", "/lead/check", { callers: ["cookie"] });
 post("chat", "onboarding.phone-dismiss", "/onboarding/phone/dismiss", approver("An approver puts this away.", "/chat"));
 const LEAD_WORDS = { identity: "An approver names their lead.", about: "An approver edits what their lead knows about them.", "promise/cancel": "An approver manages the lead's promises.", on: "An approver turns the lead on." };
 for (const one of ["identity", "about", "promise/cancel", "on"])

package/dist/server/runtime.d.ts

@@ -158,6 +158,8 @@ export interface ServerRuntime {
         source: "environment" | "stored";
     } | null;
     chatCatalog: () => Promise<import("../converse.js").CatalogModel[] | null>;
+    /** The catalog as last fetched: what a page shows. A page never fetches. */
+    chatCatalogKnown: () => import("../converse.js").CatalogModel[] | null;
     leadRecheckedAt: number;
     checkLocalAgents: (fresh?: boolean) => Promise<void>;
     localSignIn: {
@@ -167,7 +169,18 @@ export interface ServerRuntime {
     } | null;
     agentSignInCommand: () => string;
     connectionCheck: (provider: ProviderId, fresh?: boolean) => Promise<ProviderConnection>;
-    modelCatalog: (key: string | null, refresh?: boolean) => Promise<OpenRouterModels>;
+    /** What the last sign-in check said: what a page shows. A page never checks (docs/plans/get-side-effects.md). */
+    connectionKnown: (provider: ProviderId) => ProviderConnection | null;
+    /** The last answer of each other check a page shows; a page only reads it. */
+    lastChecks: import("./last-checks.js").LastChecks;
+    checkRelease: () => Promise<{
+        version: string;
+    } | {
+        problem: string;
+    }>;
+    modelCatalog: ((key: string | null, refresh?: boolean) => Promise<OpenRouterModels>) & {
+        known: (key: string | null) => OpenRouterModels | null;
+    };
     modelSeams: CatalogSeams;
     toolsViewOf: (repo: string, codex: unknown[] | null, kit?: string | null, wanted?: string | null) => ToolsView;
     codexServers: (repo: string) => Promise<unknown[] | null>;
@@ -209,6 +222,8 @@ export interface ServerRuntime {
         provider: OidcProvider;
         at: number;
     } | null;
+    /** The identity provider as last discovered; a page never discovers it. */
+    providerKnown: (issuer: string) => import("../oidc.js").OidcProvider | null;
     providerFor: (issuer: string) => Promise<{
         ok: true;
         provider: OidcProvider;

package/dist/server/settings.js

@@ -39,7 +39,8 @@ import { browserCaller } from "./session.js";
 import { DEFAULT_ACCENT, normalHex } from "../accent-colors.js";
 import { resolvePhaseAgent } from "../agentconfig.js";
 import { parseProtectedPaths } from "../approval-policy.js";
-import { approvalRulesHtml } from "../approval-rules-ui.js";
+import { approvalRulesHtml, releaseApprovalHtml } from "../approval-rules-ui.js";
+import { releaseApprovalSetting, setReleaseApproval } from "../release-auto.js";
 import { backupHtml } from "../backup-ui.js";
 import { BACKUP_EVERY_HOURS, backupFolderOf, backupNow, checkBackupFolder, defaultBackupFolder, MAX_KEEP } from "../backup.js";
 import { projectBatchChecks, setProjectBatchChecks } from '../batch-policy.js';
@@ -122,14 +123,14 @@ import { teamsSettingsHtml } from "../teams-settings.js";
 import { telegramSettingsHtml } from "../telegram-settings.js";
 import { hashPairingCode, loadBotToken, mintPairingCode, PAIRING_TTL_MS, redactToken, saveBotToken } from "../telegram.js";
 import { newerThan, updatesHtml, updatesScript, updateStepsHtml } from "../toolroll-update-ui.js";
-import { abandonRuntimeUpdate, currentRuntime, launchRuntimeUpdate, markWhatsNewSeen, prepareRuntimeUpdate, releaseStalledUpdate, requestRuntimeUpdateCancel, runningWorkWords, runtimeUpdateStatus, runtimeUpdateTerminal } from "../toolroll-update.js";
+import { abandonRuntimeUpdate, currentRuntime, launchRuntimeUpdate, markWhatsNewSeen, prepareRuntimeUpdate, requestRuntimeUpdateCancel, runningWorkWords, runtimeUpdateStatus, runtimeUpdateTerminal } from "../toolroll-update.js";
 import { TOOLS_PROJECT_SCRIPT, toolsHtml, toolsProjectPicker } from "../tools-ui.js";
 import { effectivePrimary, isMessagingChannel, savePrimary } from "../webhooks.js";
 import { personChip, ROLE_TITLES } from "./chrome.js";
 import { chatReturnWithSaid, goOutside } from "./http.js";
-import { latestReleaseFor, leadSettingsHtml, notificationProjects, SETTINGS_AUTOSAVE_SCRIPT, settingsPage, settingsWorkers, telegramDeliveryWords, telegramTrouble } from "./render-settings.js";
+import { leadSettingsHtml, notificationProjects, SETTINGS_AUTOSAVE_SCRIPT, settingsPage, settingsWorkers, telegramDeliveryWords, telegramTrouble } from "./render-settings.js";
 export function createSettingsHandlers(runtime) {
-    const { store, providerHome, managedRepos, consoleProjects, sendScreen, chromeFor, connectionCheck, clock, modelCatalog, modelSeams, toolsViewOf, codexServers, projectViewOf, sessions, restricted, options, integrations, consoleOrigin, evidenceRoot, storagePool, visible, ssoSettings, checkLocalAgents, chatKeyFor, chatCatalog, leadWords, agentSignInCommand, settingsUpdates, phoneSetup, authenticateApprover, authenticateCredential, deletedRepos, projectOf, providerFor, admissionList, toolHome, connectVisits, mintApprovalNonce, consumeApprovalNonce, defaultProject, googleVisits } = runtime;
+    const { store, providerHome, managedRepos, consoleProjects, sendScreen, chromeFor, connectionCheck, connectionKnown, lastChecks, checkRelease, clock, modelCatalog, modelSeams, toolsViewOf, codexServers, projectViewOf, sessions, restricted, options, integrations, consoleOrigin, evidenceRoot, storagePool, visible, ssoSettings, checkLocalAgents, chatKeyFor, chatCatalog, chatCatalogKnown, leadWords, agentSignInCommand, settingsUpdates, phoneSetup, authenticateApprover, authenticateCredential, deletedRepos, projectOf, providerFor, admissionList, toolHome, connectVisits, mintApprovalNonce, consumeApprovalNonce, defaultProject, googleVisits } = runtime;
     // v105: what agent work cost, by month, and the monthly budgets. An instance operator's page.
     async function spendPage(ctx) {
         const { url, who, response, now } = ctx;
@@ -225,10 +226,11 @@ ${hasGrant ? "" : html `<span class="meta">self-merging needs a merge-capable pu
         if (!isProviderId(asked))
             return refuse(response, who, 400, "Choose a known provider.", "/control");
         const task = url.searchParams.get("task") ?? "";
-        const connection = await connectionCheck(asked, url.searchParams.get("check-connection") === "1");
+        // The last sign-in check: Check again posts (docs/plans/get-side-effects.md).
+        const connection = connectionKnown(asked);
         if (view === "connection") {
             const command = asked === "claude" ? "claude auth login" : asked === "codex" ? "codex login" : asked === "gemini" ? "gemini" : null;
-            return sendScreen(response, 200, screen(`${ASSISTANTS[asked].name} connection`, html `<h1>${ASSISTANTS[asked].name} ${connection.state === "connected" ? "is connected" : "connection"}</h1>\
+            return sendScreen(response, 200, screen(`${ASSISTANTS[asked].name} connection`, html `<h1>${ASSISTANTS[asked].name} ${connection?.state === "connected" ? "is connected" : "connection"}</h1>\
 ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On the computer running Toolroll, sign in with:</p><pre class="recap">${command}</pre>`}\
 <p><a href="/settings#providers">Manage API keys and authentication mode</a></p><input type="hidden" name="resume-task" value="${task}">`, { chrome: chromeFor(project, "settings") }));
         }
@@ -241,20 +243,61 @@ ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On
         const models = live.length === 0 ? modelChoices(asked, configured, providerHome)
             : configured && !live.some(one => one.value === configured) ? [{ value: configured, label: `${configured} — current choice` }, ...live] : live;
         const instructions = previewProjectInstructions(project);
-        const catalog = asked === "openrouter" ? await modelCatalog(readProviderKey("openrouter", providerHome), url.searchParams.get("refresh-models") === "1") : null;
+        // The model list as last loaded; Refresh models posts, and the background checks keep it current.
+        const catalog = asked === "openrouter" ? modelCatalog.known(readProviderKey("openrouter", providerHome)) ?? { ok: false, problem: "The model list has not loaded yet." } : null;
         const inputs = { provider: asked, model: saved?.provider === asked ? saved.model ?? "" : models[0]?.value ?? "", command: setup?.command ?? (saved === null ? preparation?.command ?? "" : ""), seconds: String((setup?.timeoutMs ?? 300_000) / 1000) };
         return sendScreen(response, 200, screen("Project setup", controlSetupHtml({ repo: project, csrf: who.via === "cookie" ? who.session.csrf : "", provider: asked, inputs, models, connection, catalog, task, preparation,
             instructions: instructions.ok ? { installed: instructions.installed } : { installed: false, message: instructions.message } }), { chrome: chromeFor(project, "settings"), ...(catalog === null ? {} : { functional: { script: openRouterPickerScript() } }) }));
     };
+    // Settings → Projects → Pull requests → Check setup: git and GitHub, for one project, by an approver who may turn it on.
+    async function pullRequestsCheck(ctx) {
+        const { who, response, posted } = ctx;
+        const repo = readForm(posted, CONSOLE_FORMS.pullRequestsCheck).get("repo") ?? "";
+        const known = [...new Set([...managedRepos(), ...store.knownRepos(), ...store.listProjects().map(one => one.path)])];
+        if (who.via !== "cookie" || !known.includes(repo) || !visible(repo))
+            return refuse(response, who, 404, "No such project.", "/projects");
+        if (who.role !== "approver" || store.isDemo())
+            return refuse(response, who, 403, "An approver can turn on pull requests.", "/projects");
+        await lastChecks.run(`publishing:${repo}`, () => checkPublishing(repo, options.publishExec === undefined ? {} : { exec: options.publishExec }));
+        return redirect(response, `/settings/pull-requests?repo=${encodeURIComponent(repo)}`);
+    }
+    // Settings → Storage → Check now: measure the checkouts again.
+    async function storageCheck(ctx) {
+        const databaseFile = store.databaseFile();
+        if (databaseFile !== null)
+            await measureStorage(databaseFile);
+        return redirect(ctx.response, "/settings/storage");
+    }
+    const measureStorage = (databaseFile) => lastChecks.run("storage", () => checkoutPlan(store, storagePool(databaseFile), clock(), { manual: true }));
+    // Settings → Updates → Check now: ask npm once, whether or not automatic checks are on.
+    async function updatesCheck(ctx) {
+        await checkRelease();
+        return redirect(ctx.response, "/settings/updates");
+    }
+    // Check again (Settings → providers, Project setup): ask this computer's CLI, or test the saved key, now.
+    async function connectionCheckNow(ctx) {
+        const { response, posted } = ctx;
+        const body = readForm(posted, CONSOLE_FORMS.connectionCheck);
+        const provider = body.get("provider") ?? "";
+        const back = safeReturn(body.get("return") ?? "/settings#providers");
+        if (!isProviderId(provider))
+            return redirect(response, back);
+        await connectionCheck(provider, true).catch(() => undefined);
+        return redirect(response, back);
+    }
+    // Refresh models (Project setup, OpenRouter): load the list again, then show the setup page with it.
+    async function modelsRefresh(ctx) {
+        const { response, posted } = ctx;
+        const body = readForm(posted, CONSOLE_FORMS.modelsRefresh);
+        await modelCatalog(readProviderKey("openrouter", providerHome), true);
+        const query = new URLSearchParams({ provider: "openrouter", ...(body.get("task") ? { task: body.get("task") } : {}) });
+        return redirect(response, `/control?${query.toString()}`);
+    }
     async function modelsPage(ctx) {
         const { url, who, response, project } = ctx;
         const now = clock();
-        const watch = watchState(store);
-        // Opening the page refreshes a stale snapshot; the lists are public and
-        // the check sends nothing about the person or their projects.
-        if (who.role === "approver" && (watch.checkedAt === null || now.getTime() - Date.parse(watch.checkedAt) > 3_600_000)) {
-            await checkModels(store, now, modelSeams).catch(() => undefined);
-        }
+        // The page shows the last check and when it ran (docs/plans/get-side-effects.md): Check now, or the watch loop's
+        // automatic checks, fetch the lists and may queue a notice; opening the page never does.
         const view = modelsView(who.role === "approver", who.via === "cookie" ? who.session.csrf : "", now, url.searchParams.get("said"), url.searchParams.get("problem"));
         return sendScreen(response, 200, screen("Models", html `<p><a href="/settings">Settings</a></p><h1>Models</h1>${modelsHtml(view)}`, { chrome: chromeFor(project, "settings"), functional: { script: modelsScript() } }));
     }
@@ -290,7 +333,8 @@ ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On
         if (chosen) {
             try {
                 const approver = who.role === "approver" && who.via === "cookie";
-                const view = toolsViewOf(chosen, approver ? await codexServers(chosen) : null, kit, wanted);
+                // What Codex had configured at the last background check (docs/plans/get-side-effects.md): the page starts no codex.
+                const view = toolsViewOf(chosen, approver ? lastChecks.known(`codex-tools:${chosen}`)?.value ?? null : null, kit, wanted);
                 if (approver)
                     view.others = projects.filter(one => one !== chosen).map(one => ({ repo: one, project: projectName(one), open: connectionsOf(store, one).filter(c => c.state === "open").map(c => c.id) }));
                 content = (toolsHtml(view, who.via === "cookie" ? who.session.csrf : "", approver, { said: url.searchParams.get("said"), problem: url.searchParams.get("problem") }));
@@ -323,7 +367,8 @@ ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On
             return refuse(response, who, 403, "That project is outside your access.", "/settings/approval");
         const selector = projects.length > 1 ? html `<form class="approval-project" method="get" action="/settings/approval"><label>Project<select name="repo">${projects.map(p => html `<option value="${p}"${p === chosen ? " selected" : ""}>${projectName(p)}</option>`)}</select></label><button>Show</button></form>` : "";
         const approvers = chosen === "" ? 0 : store.listApprovers().filter(one => { const account = store.accountOf(one.name); return account !== null && account.revokedAt === null && account.role === "approver" && store.accountCanAccess(one.name, chosen); }).length;
-        const content = chosen === "" ? html `<p>Add a project to set its approval rules.</p>` : (approvalRulesHtml({ repo: chosen, name: projectName(chosen), rules: store.approvalRules(chosen), canChange: who.via === "cookie" && store.isInstanceOperator(who.name), approvers }, { said: url.searchParams.get("said"), problem: url.searchParams.get("problem") }));
+        const release = chosen === "" ? null : releaseApprovalSetting(store, chosen);
+        const content = chosen === "" ? html `<p>Add a project to set its approval rules.</p>` : html `${approvalRulesHtml({ repo: chosen, name: projectName(chosen), rules: store.approvalRules(chosen), canChange: who.via === "cookie" && store.isInstanceOperator(who.name), approvers }, { said: url.searchParams.get("said"), problem: url.searchParams.get("problem") })}${releaseApprovalHtml({ repo: chosen, auto: release.auto, setBy: release.setBy, at: release.at, canChange: who.via === "cookie" && who.role === "approver" && !store.isDemo() && store.accountCanAccess(who.name, chosen) })}`;
         return sendScreen(response, 200, screen("Approval rules", html `<p><a href="/settings">Settings</a></p><h1>Approval rules</h1>${selector}${content}`, { chrome: chromeFor(chosen || project, "settings") }));
     }
     // Sprint 8: Settings → Policy, the organisation policy and its history. Anyone signed in reads it; an instance operator changes it.
@@ -376,19 +421,16 @@ ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On
         const databaseFile = store.databaseFile();
         if (databaseFile === null)
             return refuse(response, who, 403, "An instance operator updates Toolroll.", "/settings");
-        // A record it cannot release is shown as it is; the page never fails over it.
-        try {
-            releaseStalledUpdate(dirname(databaseFile), clock());
-        }
-        catch { /* shown as last saved */ }
+        // A stalled update is released by the background pass, never by opening this page (docs/plans/get-side-effects.md).
         const status = runtimeUpdateStatus(dirname(databaseFile));
         if (url.searchParams.get("fragment") === "steps")
             return respond(response, 200, "text/html; charset=utf-8", status.journal ? updateStepsHtml(status.journal, status.running) : html `<div id="update-live" data-done="1"></div>`);
         const active = status.journal !== null && !runtimeUpdateTerminal(status.journal.phase);
         const current = options.updates?.current ?? PACKAGE_VERSION;
-        // While update checks are off the page asks npm nothing until Check now.
-        const checksOff = updateChecksOff(process.env, options.configDir ?? dirname(databaseFile)).off && url.searchParams.get("check") !== "now";
-        const view = { current, latest: active ? { version: current } : checksOff ? { off: true } : await latestReleaseFor(options.updates?.latest), method: options.updates?.method ?? installMethod(), journal: status.journal, running: status.running, whatsNew: status.whatsNew, rollbackTo: status.lastUpdate?.to === current ? status.lastUpdate.from : null, csrf: who.session.csrf };
+        // The last answer npm gave (the background checks ask while update checks are on; Check now asks once).
+        const checksOff = updateChecksOff(process.env, options.configDir ?? dirname(databaseFile)).off;
+        const known = lastChecks.known("release")?.value ?? null;
+        const view = { current, latest: active ? { version: current } : known ?? (checksOff ? { off: true } : { pending: true }), method: options.updates?.method ?? installMethod(), journal: status.journal, running: status.running, whatsNew: status.whatsNew, rollbackTo: status.lastUpdate?.to === current ? status.lastUpdate.from : null, csrf: who.session.csrf };
         return sendScreen(response, 200, screen("Updates", html `<p><a href="/settings">Settings</a></p><h1>Updates</h1>${(updatesHtml(view, { said: url.searchParams.get("said"), problem: url.searchParams.get("problem") }))}`, { chrome: chromeFor(project, "settings"), ...(active ? { functional: { script: updatesScript(), fetches: true } } : {}) }));
     }
     // v105: Settings → Retention, how long each kind of data is kept. An instance operator's page.
@@ -406,9 +448,16 @@ ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On
         const databaseFile = store.databaseFile();
         if (databaseFile === null)
             return refuse(response, who, 403, "An instance operator looks after storage.", "/settings");
-        const plan = await checkoutPlan(store, storagePool(databaseFile), now, { manual: true });
+        // The last measurement (docs/plans/get-side-effects.md): the background checks measure the checkouts, and so do
+        // Check now and every clean-up; opening the page runs no du or git.
+        const measured = lastChecks.known("storage");
+        const check = postForm("/settings/storage/check", html `<button type="submit" class="secondary">Check now</button>`, { attrs: { class: "inline" } });
+        if (measured === null) {
+            return sendScreen(response, 200, screen("Storage", html `<p><a href="/settings">Settings</a></p><h1>Storage</h1><section class="storage"><div class="card storage-state"><h2>Checkouts not measured yet</h2>${check}</div></section>`, { chrome: chromeFor(project, "settings") }));
+        }
+        const plan = { ...measured.value, cleanup: store.checkoutCleanup() };
         const sweep = { last: lastSweep(store), off: storageSweepOff(), schedule: sweepSchedule(store, now) };
-        return sendScreen(response, 200, screen("Storage", html `<p><a href="/settings">Settings</a></p><h1>Storage</h1>${(storageHtml({ plan, csrf: who.session.csrf, sweep, landed: landedSummary(store) }, { said: url.searchParams.get("said"), problem: url.searchParams.get("problem") }))}`, { chrome: chromeFor(project, "settings") }));
+        return sendScreen(response, 200, screen("Storage", html `<p><a href="/settings">Settings</a></p><h1>Storage</h1>${(storageHtml({ plan, csrf: who.session.csrf, sweep, landed: landedSummary(store), measured: html `<p class="meta">Measured ${new Date(measured.at).toLocaleTimeString("en-US", { hour: "numeric", minute: "2-digit" })} ${check}</p>` }, { said: url.searchParams.get("said"), problem: url.searchParams.get("problem") }))}`, { chrome: chromeFor(project, "settings") }));
     }
     // Settings → Projects → Pull requests: one project's setup. Off, the checks run on open, so the page says
     // exactly what turning on would do, or what to fix first.
@@ -420,7 +469,8 @@ ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On
             return refuse(response, who, 404, "No such project.", "/projects");
         const publishing = publishingOf(store, repo);
         const canChange = who.role === "approver" && !store.isDemo();
-        const check = publishing.on || !canChange ? null : await checkPublishing(repo, options.publishExec === undefined ? {} : { exec: options.publishExec });
+        // The last setup check for this project (Check setup posts); opening the page asks git and GitHub nothing.
+        const check = publishing.on || !canChange ? null : lastChecks.known(`publishing:${repo}`)?.value ?? "unchecked";
         const body = (pullRequestSettingsHtml({ repo, name: projectName(repo), csrf: who.session.csrf, canChange, publishing, check,
             said: url.searchParams.get("said"), problem: url.searchParams.get("problem") }));
         return sendScreen(response, 200, screen("Pull requests", html `<p><a href="/projects">Projects</a></p><h1>Pull requests</h1>${body}`, { chrome: chromeFor(project, "projects") }));
@@ -563,15 +613,13 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
     async function leadPage(ctx) {
         const { url, response, now, project } = ctx;
         const who = browserCaller(ctx.who);
-        if (runtime.localSignIn === null)
-            await Promise.race([checkLocalAgents(), new Promise(done => setTimeout(done, 6_000).unref?.())]);
         const config = store.getChatConfig();
         const facts = {
             keyFacts: ["anthropic-api", "openrouter-api"].map(one => {
                 const found = chatKeyFor(one);
                 return { provider: one, state: found === null ? "none" : found.source, tail: found === null || found.source === "environment" ? null : redactToken(found.key) };
             }),
-            openrouterModels: (await chatCatalog())?.map(one => one.id) ?? null,
+            openrouterModels: chatCatalogKnown()?.map(one => one.id) ?? null,
             liveModels: [...modelOptions(store, "claude", now, providerHome), ...modelOptions(store, "codex", now, providerHome)],
             csrf: who.session.csrf,
             returnTo: "/settings/lead",
@@ -646,7 +694,7 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
                 provider,
                 envName: PROVIDER_KEY_ENV[provider],
                 ...keyStatus(provider, providerHome),
-                connection: await connectionCheck(provider, url.searchParams.get("check-connection") === provider),
+                ...(connectionKnown(provider) === null ? {} : { connection: connectionKnown(provider) }),
                 ambient: (process.env[PROVIDER_KEY_ENV[provider]] ?? "") !== "",
                 mode: readAuthMode(provider, providerHome) === "api-key" ? "api-key" : "subscription",
                 subscriptionCapable: SUBSCRIPTION_CAPABLE[provider],
@@ -1114,7 +1162,9 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
         const databaseFile = store.databaseFile();
         if (databaseFile === null)
             return refuse(response, who, 403, "An instance operator looks after storage.", "/settings");
-        const back = sayTo(response, "/settings/storage");
+        // What the page shows next is measured again after the change.
+        const said = sayTo(response, "/settings/storage");
+        const back = async (kind, words) => { await measureStorage(databaseFile).catch(() => undefined); return said(kind, words); };
         const what = op === "clean" ? "clean up" : op === "discard" ? "discard a checkout" : "change checkout cleanup";
         if (!authenticateApprover(who, body.get("password") ?? "").ok)
             return back("problem", `Enter your Toolroll password to ${what}.`);
@@ -2468,6 +2518,11 @@ ${modeWords(terms)
         "mode": modePage,
         "control": controlPage("setup"),
         "control.connection": controlPage("connection"),
+        "settings.updates-check-send": updatesCheck,
+        "settings.storage-check-send": storageCheck,
+        "settings.pull-requests-check-send": pullRequestsCheck,
+        "settings.connection-check": connectionCheckNow,
+        "control.models-refresh": modelsRefresh,
         "settings.models": modelsPage,
         "settings.tools": toolsPage,
         "settings.project": projectPage,
@@ -2485,6 +2540,7 @@ ${modeWords(terms)
         "settings.sign-in": signInPage,
         "settings.passwordless": passwordlessPage,
         "settings.passwordless-send": passwordlessSave,
+        "settings.release-approval-send": releaseApprovalSave,
         "settings.lead": leadPage,
         "settings.teams": teamsPage,
         "settings.discord": discordPage,
@@ -2672,5 +2728,29 @@ ${modeWords(terms)
             return back("problem", "An approver for this project changes its sandbox. Nothing changed.");
         return back("said", JSON.stringify(changed.before) === JSON.stringify(changed.after) ? "Nothing changed." : "Saved. Tasks scoped from now on use it; tasks already approved keep what they were approved with.");
     }
+    // Release approval (docs/plans/auto-approve-green.md): an approver of the project. Approving automatically is a
+    // credential act (a password typed now, never a session); asking again is one click and takes back automatic seals.
+    async function releaseApprovalSave(ctx) {
+        const { response, now, posted } = ctx;
+        const who = browserCaller(ctx.who);
+        const body = readForm(posted, CONSOLE_FORMS.releaseApproval);
+        const repo = body.get("repo") ?? "";
+        if (!consoleProjects().includes(repo) || !visible(repo))
+            return refuse(response, who, 403, "That project is outside your access.", "/settings/approval");
+        const back = sayTo(response, `/settings/approval?repo=${encodeURIComponent(repo)}`);
+        if (who.role !== "approver" || store.isDemo() || !store.accountCanAccess(who.name, repo))
+            return back("problem", "An approver of this project sets how its releases are approved.");
+        const action = body.get("action");
+        if (action === "ask") {
+            const changed = setReleaseApproval(store, repo, false, who.name, now);
+            return back("said", !changed.changed ? "Saved." : `Releases ask you again.${changed.withdrawn.length === 0 ? "" : ` ${changed.withdrawn.length} automatic approval${changed.withdrawn.length === 1 ? " was" : "s were"} taken back.`}`);
+        }
+        if (action !== "auto")
+            return back("problem", "Choose Ask me or Approve automatically when checks pass.");
+        if (!authenticateCredential(who, body.get("password") ?? "", repo).ok)
+            return back("problem", "Enter your Toolroll password to approve releases automatically.");
+        const changed = setReleaseApproval(store, repo, true, who.name, now);
+        return back("said", changed.changed ? "Releases approve themselves once CI and the release check pass." : "Saved.");
+    }
     return { registrations, modelsView };
 }

package/dist/server/task-views.js

@@ -487,7 +487,6 @@ export function createTaskViews(runtime) {
             coordinatorProposals: (() => {
                 if (ref === null || ref.repo === null || who.role !== "approver")
                     return null;
-                runtime.store.sweepCoordinatorProposals(now);
                 const rows = runtime.store.listCoordinatorProposals({ repos: [ref.repo], taskId });
                 return { rows, decisions: decisionsFor(runtime.store, rows), now };
             })(),
@@ -497,6 +496,7 @@ export function createTaskViews(runtime) {
             steeringRun: ref === null ? null : runtime.store.steeringLiveBuild(ref.id, now),
             release: ref === null ? null : releaseViewOf(runtime.store, ref.externalId, now, authority => releaseObligationsOf(runtime.store, runtime.evidenceRoot, authority)),
             canStopRelease: who.role === "approver" && who.via === "cookie",
+            autoRelease: ref === null ? null : autoReleaseOf(runtime.store.getScope(ref.externalId)),
             approvalProof: (() => {
                 // The proof of the approval shown: its approver, its exact sealed digest (approvedDigest === digest when approved).
                 const scope = ref === null ? null : runtime.store.getScope(ref.externalId);
@@ -1140,3 +1140,10 @@ export function createTaskViews(runtime) {
     }
     return { guided, projectFamilyPeek, familiesInView, familyTasksInView, revisionDestination, earlierLiveVersions, familyHistory, freshAssignment, workRowOf, taskListPane, runIsLive, runIsTaskResult, revisionViewOf, taskViewData, routeViewOf, taskChatFocus, pullRequestTargetOf, taskPullRequestOf, failureOf, explainAttempt, runChecksHere, taskScreen, armTaskResume, planViewOf, planContractViewOf, revisionDocOf, revisionLedgerOf, progressOf, resultDetailOf };
 }
+/** A release task the plane approved (or is checking) itself, for the task page (docs/plans/auto-approve-green.md). */
+function autoReleaseOf(scope) {
+    if (scope === null || scope.approvedDigest !== scope.digest || (scope.candidate ?? null) === null)
+        return null;
+    return scope.approvalBasis === "auto-green" ? { kind: "approved", candidate: scope.candidate }
+        : scope.approvalBasis === "auto-check" ? { kind: "checking", candidate: scope.candidate } : null;
+}

package/dist/server/tasks.js

@@ -12,7 +12,7 @@ import { handlersOf } from './handler-registry.js';
 import { closedQuestionWords } from "../decision.js";
 import { DEPRECATED_PAGE } from "../deprecations.js";
 /** tasks handlers, moved without changing their route bodies. */
-import { html, htmlString, joinHtml, textHtml } from "../html.js";
+import { html, htmlString, joinHtml, postForm, textHtml } from "../html.js";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { lstatSync, realpathSync } from "node:fs";
 import {} from "node:http";
@@ -75,7 +75,9 @@ export function createTasksHandlers(runtime) {
     function noPage(who, response) {
         return refuse(response, who, 404, "There's no page at this address.", "/chat");
     }
-    const showCode = (part) => async (ctx) => {
+    // `posted`: the session page's own POST (form token). A GET of changes or the shipping preview runs no git in the
+    // agent's checkout: changes go back to the session page, the preview asks for one click.
+    const showCode = (part, posted = false) => async (ctx) => {
         const { url, who, response, project } = ctx;
         if (who.via !== 'cookie' || !codingActorAllowed({ name: who.name, generation: who.session.generation }))
             return refuse(response, who, 403, 'Coding sessions require installation-wide operator access. You can manage project tasks in Work.', '/work');
@@ -86,6 +88,11 @@ export function createTasksHandlers(runtime) {
             const selected = sessionId !== null && runtime.coding ? runtime.coding.get(sessionId, actor) : null;
             if (selected && !codingProjectAllowed(selected.repo))
                 return refuse(response, who, 403, 'That project is outside your access.', '/projects');
+            if (!posted && part === 'changes' && selected)
+                return redirect(response, `/code/${selected.id}`);
+            if (!posted && part === 'ship' && selected) {
+                return sendScreen(response, 200, screen('Review for shipping', html `<section class="coding-workspace coding-handoff"><h1>Review for shipping</h1><p>${selected.title}</p>${postForm(`/code/${selected.id}/ship/preview`, html `<button type="submit">Review the committed change</button>`)}<p><a href="/code/${selected.id}">Back to coding</a></p></section>`, { chrome: chromeFor(selected.repo, 'code') }));
+            }
             if (part === 'ship' && selected) {
                 const preview = codingHandoffPreview(store, { sessionId: selected.id, actor: who.name });
                 return sendScreen(response, 200, screen('Review for shipping', codingShippingHtml(preview), { chrome: chromeFor(selected.repo, 'code') }));
@@ -2996,6 +3003,8 @@ export function createTasksHandlers(runtime) {
         "code.state": showCode("state"),
         "code.changes": showCode("changes"),
         "code.ship": showCode("ship"),
+        "code.changes-read": showCode("changes", true),
+        "code.ship-preview": showCode("ship", true),
         "code.other": showCode("unknown"),
         "inbox": showInbox,
         "work": showWork,