toolroll 0.9.74 → 0.9.76

package/dist/telegram-progress.js

@@ -7,7 +7,7 @@
 import { assignmentOf } from "./assignment.js";
 import { chatResultHref, chatControlHref } from "./chat-controls.js";
 import { phoneText, projectLabel } from "./telegram-status.js";
-import { assignmentStatusFacts, headlineEmoji, pullRequestFactOf, requirementsOf, statusDetailLines, unverifiedWhenRefuted, taskStatusOf } from "./task-status.js";
+import { approvedCheckOf, assignmentStatusFacts, checksFactOf, headlineEmoji, pullRequestFactOf, requirementsOf, statusDetailLines, unverifiedWhenRefuted, taskStatusOf } from "./task-status.js";
 import { leadClaimOf } from "./lead-voice.js";
 import { leadNameOf } from "./lead-identity.js";
 import { chatTitle } from "./chat-voice.js";
@@ -46,10 +46,10 @@ export function telegramProgressCard(store, run, taskId, project, now = new Date
         const proof = store.proofVerdictFor(run.id);
         const machine = proof?.machineVerdict ?? proof?.verdict ?? null;
         const exit = failedCheckExit(proof?.reasons ?? []);
-        const checks = recorded !== null ? { status: recorded.status, exitCode: recorded.exitCode, head: run.headRevision }
+        // The one answer (task-status.ts approvedCheckOf) when a saved check was read; a verdict alone claims no pass.
+        const checks = recorded !== null ? approvedCheckOf(machine, proof?.reasons ?? [], checksFactOf(recorded, run.headRevision))
             : exit !== null ? { status: "failed", exitCode: exit, head: run.headRevision }
-                : machine === "verified" ? { status: "passed", exitCode: null, head: run.headRevision }
-                    : machine === "attested" ? { status: "not-run", exitCode: null, head: null } : null;
+                : machine === "attested" ? { status: "not-run", exitCode: null, head: null } : null;
         facts = { stage: "finished", report: run.role === "scout", checks, requirements: unverifiedWhenRefuted(requirementsOf(proof?.matrix), proof?.verdict),
             ...(pullRequest === undefined ? {} : { pullRequest }) };
     }

package/dist/telegram-status.js

@@ -4,8 +4,8 @@ import { manualReviewOnly } from "./proof.js";
  * No provider calls, repository access, new workflow state, or inferred success. */
 import { diagnoseTaskDispatch, withDispatchDiagnoses } from "./dispatch.js";
 import { familyCompleted } from "./result-completion.js";
-import { assignmentStatusFacts, plainReasonOf, stageOfDispatch, taskStatusOf } from "./task-status.js";
-import { assignmentOf } from "./assignment.js";
+import { approvedCheckOf, approvedCheckStateOf, assignmentStatusFacts, checksFactOf, plainReasonOf, stageOfDispatch, taskStatusOf } from "./task-status.js";
+import { assignmentChecksForRun, assignmentOf } from "./assignment.js";
 import { CHAT_CONTROLS, chatControlHref, chatResultHref } from "./chat-controls.js";
 export function phoneCommand(text) {
     // Slash forms everywhere; the bare words too, because Slack and Discord
@@ -257,7 +257,12 @@ export function phoneTaskView(store, repos, id, now, root) {
             const proof = store.proofVerdictFor(result.id);
             link = taskLinkFor(id, d, { run: result.id, verdict: proof !== null });
             const accepted = store.proofAcceptance(result.id) !== null;
-            const proofWords = { verified: "Checks passed at completion", attested: "Checks reported by the agent, not run by Toolroll", short: "Required saved material is missing", refuted: "The saved result conflicts with the approved scope" };
+            // Did the approved check pass (task-status.ts approvedCheckOf): read with the saved files, else no claim at all.
+            const checkNow = root === undefined || proof?.verdict !== "verified" ? null
+                : approvedCheckStateOf(approvedCheckOf(proof.verdict, proof.reasons, checksFactOf(assignmentChecksForRun(store, root, result.id, now), result.headRevision)));
+            const verifiedWords = root === undefined ? "Open the result to see its checks" : checkNow === "passed" ? "Checks passed at completion"
+                : checkNow === "failed" ? "Checks failed" : checkNow === "running" ? "Checks running" : "The check result couldn't be read";
+            const proofWords = { verified: verifiedWords, attested: "Checks reported by the agent, not run by Toolroll", short: "Required saved material is missing", refuted: "The saved result conflicts with the approved scope" };
             lines.push(`Checks: ${proof === null ? "No completion record saved" : manualReviewOnly(proof) ? accepted ? "Accepted by a person; the recorded checks are unchanged" : "A person must inspect this result; no recorded check failed" : proofWords[proof.verdict]}.`);
             if (manualReviewOnly(proof) && !accepted)
                 lines.push('Reply “Send the result summary” for the checks, notes and screenshots.');

package/dist/test-infra.d.ts

@@ -0,0 +1,26 @@
+/** The product's entry points: the CLI binary, the processes it starts by file name, and the browser bundles. */
+export declare const PRODUCT_ENTRIES: readonly string[];
+/** A specifier reached from the tests that names no repository file and no known package: `prefix` is the repository
+ * path it might name (a folder or file stem), or null when it might name anything. */
+export type Unresolved = {
+    from: string;
+    specifier: string | null;
+    prefix: string | null;
+};
+export type TestInfrastructure = {
+    infra: Set<string>;
+    unresolved: Unresolved[];
+    /** What the product's entry points reach (trusted product code, by Alex's decision). */
+    product: Set<string>;
+};
+/**
+ * The infrastructure among `files` (path → text: the tree's sources, and its tsconfig.json and package.json): reachable
+ * from a test root — every test file, every file under `test/`, every vitest config and its setup files — not itself a
+ * test, and not reachable from PRODUCT_ENTRIES; plus every specifier reached from a test root that couldn't be resolved.
+ */
+export declare function testInfrastructure(files: ReadonlyMap<string, string>, allPaths?: ReadonlySet<string>): TestInfrastructure;
+/**
+ * Whether a changed path is something an unresolved specifier might name. A computed one (no prefix) might name anything
+ * the other rules don't already trust: any source file that is neither a test nor product code.
+ */
+export declare function mightName(open: Unresolved, path: string, found: TestInfrastructure): boolean;

package/dist/test-infra.js

@@ -0,0 +1,321 @@
+/**
+ * Test infrastructure, found structurally (docs/plans/auto-approve-green.md): every non-test source file that the tests
+ * or the test runner's own setup import, directly or through other files, and that the product's entry points never
+ * reach. Changing one changes how tests check things — an automatic release approval leaves that to a person.
+ *
+ * Imports are read with the TypeScript compiler (typescript-parser, a runtime dependency): `preProcessFile` for static,
+ * dynamic and `require` specifiers (comments never count), and the syntax tree for dynamic imports or requires whose
+ * specifier isn't a plain string. Specifiers resolve as the build resolves them: relative paths (`./x.js` → `./x.ts`),
+ * the project's tsconfig `paths`, and package.json `imports`. Fail closed: a specifier reached from the tests that
+ * resolves to no file and to no known package is "unresolved", with what it might name, and the caller refuses when the
+ * change touches anything it might name.
+ */
+import { createRequire } from "node:module";
+import { builtinModules } from "node:module";
+let compiler;
+const typescript = () => compiler ??= createRequire(import.meta.url)("typescript-parser");
+const SOURCE = /\.(?:[cm]?[jt]sx?)$/;
+const TEST = /\.test\.[cm]?[jt]sx?$/;
+const VITEST_CONFIG = /(^|\/)vitest\.config\.[cm]?[jt]s$/;
+const EXTENSIONS = ["ts", "tsx", "mts", "cts", "js", "mjs", "cjs", "jsx"];
+/** The product's entry points: the CLI binary, the processes it starts by file name, and the browser bundles. */
+export const PRODUCT_ENTRIES = Object.freeze([
+    "src/bin.ts", "src/cli.ts", "src/controller-service.ts", "src/desktop-host.ts", "src/sandbox-launch.ts", "src/tool-launcher.ts",
+    "src/browser/app.tsx", "src/browser/terminal-app.tsx",
+]);
+const join = (dir, spec) => {
+    const parts = dir === "" ? [] : dir.split("/");
+    for (const part of spec.split("/")) {
+        if (part === "." || part === "")
+            continue;
+        if (part === "..") {
+            if (parts.length === 0)
+                return null;
+            parts.pop();
+        }
+        else
+            parts.push(part);
+    }
+    return parts.join("/");
+};
+const dirOf = (path) => path.split("/").slice(0, -1).join("/");
+/** A repository path, tried as the build tries it (with or without its extension, or as a folder's index). */
+function fileAt(target, files) {
+    const stem = target.replace(/\.(?:[cm]?js|jsx)$/, "");
+    const tries = [target, ...EXTENSIONS.map(ext => `${stem}.${ext}`), ...EXTENSIONS.map(ext => `${target}/index.${ext}`)];
+    return tries.find(one => files.has(one)) ?? null;
+}
+/** The project's resolution rules, read from its own tsconfig.json and package.json (as text in the same tree). */
+function resolverFor(files, names, allPaths, aliases) {
+    const tsc = typescript();
+    let paths = {}, baseUrl = "";
+    const config = files.get("tsconfig.json");
+    if (config !== undefined) {
+        const parsed = tsc.parseConfigFileTextToJson("tsconfig.json", config).config;
+        paths = parsed?.compilerOptions?.paths ?? {};
+        baseUrl = join("", parsed?.compilerOptions?.baseUrl ?? ".") ?? "";
+    }
+    let pkg = {};
+    try {
+        pkg = JSON.parse(files.get("package.json") ?? "{}");
+    }
+    catch {
+        pkg = {};
+    }
+    const packages = new Set([pkg.dependencies, pkg.devDependencies, pkg.peerDependencies, pkg.optionalDependencies].flatMap(one => Object.keys(one ?? {})));
+    // The package's own name resolves to itself: never "some installed package".
+    const own = typeof pkg.name === "string" ? pkg.name : null;
+    const builtins = new Set(builtinModules);
+    const pattern = (key, spec) => {
+        if (!key.includes("*"))
+            return key === spec ? "" : null;
+        const [head, tail] = key.split("*");
+        return spec.startsWith(head) && spec.endsWith(tail) && spec.length >= head.length + tail.length ? spec.slice(head.length, spec.length - tail.length) : null;
+    };
+    return (from, spec) => {
+        // vitest's own aliases come first, as vitest applies them.
+        for (const alias of aliases) {
+            if (spec !== alias.find && !spec.startsWith(`${alias.find}/`))
+                continue;
+            const target = join(alias.replacement, spec.slice(alias.find.length).replace(/^\//, ""));
+            const file = target === null ? null : fileAt(target, names);
+            return file !== null ? { file } : { unresolved: target };
+        }
+        if (spec.startsWith("./") || spec.startsWith("../")) {
+            const target = join(dirOf(from), spec);
+            const file = target === null ? null : fileAt(target, names);
+            if (file !== null)
+                return { file };
+            // A file that isn't source (a stylesheet, JSON, an asset) is a leaf: it imports nothing.
+            if (target !== null && allPaths.has(target))
+                return { external: true };
+            return { unresolved: target };
+        }
+        for (const [key, targets] of Object.entries(paths)) {
+            const star = pattern(key, spec);
+            if (star === null)
+                continue;
+            for (const one of targets) {
+                const target = join(baseUrl, one.replace("*", star));
+                const file = target === null ? null : fileAt(target, names);
+                if (file !== null)
+                    return { file };
+            }
+            return { unresolved: join(baseUrl, (targets[0] ?? "").replace("*", star)) };
+        }
+        if (spec.startsWith("#")) {
+            for (const [key, value] of Object.entries(pkg.imports ?? {})) {
+                const star = pattern(key, spec);
+                if (star === null)
+                    continue;
+                const target = typeof value === "string" ? value : typeof value?.default === "string" ? value.default : null;
+                if (target === null)
+                    return { unresolved: null };
+                const path = join("", target.replace("*", star));
+                const file = path === null ? null : fileAt(path, names) ?? fileAt(path.replace(/^dist\//, "src/"), names);
+                return file !== null ? { file } : { unresolved: path };
+            }
+            return { unresolved: null };
+        }
+        const bare = spec.startsWith("node:") ? spec.slice(5) : spec;
+        const name = bare.startsWith("@") ? bare.split("/").slice(0, 2).join("/") : bare.split("/")[0];
+        if (name === own)
+            return { unresolved: null };
+        if (spec.startsWith("node:") || builtins.has(name) || packages.has(name))
+            return { external: true };
+        // A package the manifest doesn't declare: what it names can't be known here.
+        return { unresolved: null };
+    };
+}
+/** The module-loading helpers vitest offers: each takes a specifier first. */
+const VI_LOADERS = new Set(["mock", "doMock", "unmock", "doUnmock", "importActual", "importMock"]);
+/**
+ * Every specifier a file names: string ones (preProcessFile: static, dynamic, `require`; comments don't count); every
+ * call that loads a module from its first argument — `require`, `import()`, `createRequire(…)(…)` and any name bound to
+ * `createRequire(…)`, `vi.*`/`vitest.*` mock and import helpers — whose argument isn't a plain string is computed (`null`,
+ * or the template's literal head); and `soft`: every other relative string literal, an edge when it names a repo file.
+ */
+function specifiersOf(path, text) {
+    const tsc = typescript();
+    const literal = tsc.preProcessFile(text, true, true).importedFiles.map(one => one.fileName);
+    const computed = [], soft = [];
+    const source = tsc.createSourceFile(path, text, tsc.ScriptTarget.Latest, false, /x$/.test(path) ? tsc.ScriptKind.TSX : tsc.ScriptKind.TS);
+    // Names bound to createRequire(…) anywhere in the file (a loader by another name).
+    const requires = new Set(["require"]);
+    const isCreateRequire = (node) => tsc.isCallExpression(node) && ((tsc.isIdentifier(node.expression) && node.expression.text === "createRequire")
+        || (tsc.isPropertyAccessExpression(node.expression) && node.expression.name.text === "createRequire"));
+    const bind = (node) => {
+        if (tsc.isVariableDeclaration(node) && tsc.isIdentifier(node.name) && node.initializer !== undefined && isCreateRequire(node.initializer))
+            requires.add(node.name.text);
+        if (tsc.isBinaryExpression(node) && node.operatorToken.kind === tsc.SyntaxKind.EqualsToken && tsc.isIdentifier(node.left) && isCreateRequire(node.right))
+            requires.add(node.left.text);
+        tsc.forEachChild(node, bind);
+    };
+    bind(source);
+    const loader = (callee) => callee.kind === tsc.SyntaxKind.ImportKeyword
+        || (tsc.isIdentifier(callee) && requires.has(callee.text))
+        || isCreateRequire(callee)
+        || (tsc.isPropertyAccessExpression(callee) && tsc.isIdentifier(callee.expression) && (callee.expression.text === "vi" || callee.expression.text === "vitest") && VI_LOADERS.has(callee.name.text))
+        || (tsc.isPropertyAccessExpression(callee) && callee.name.text === "require");
+    const visit = (node) => {
+        if (tsc.isCallExpression(node)) {
+            const first = node.arguments[0];
+            if (loader(node.expression) && first !== undefined) {
+                if (tsc.isStringLiteral(first) || tsc.isNoSubstitutionTemplateLiteral(first))
+                    literal.push(first.text);
+                else
+                    computed.push(tsc.isTemplateExpression(first) && (first.head.text.startsWith("./") || first.head.text.startsWith("../")) ? first.head.text : null);
+            }
+        }
+        if ((tsc.isStringLiteral(node) || tsc.isNoSubstitutionTemplateLiteral(node)) && (node.text.startsWith("./") || node.text.startsWith("../")))
+            soft.push(node.text);
+        tsc.forEachChild(node, visit);
+    };
+    visit(source);
+    return { literal, computed, soft };
+}
+/**
+ * The vitest configs' `resolve.alias` and `test.alias` (string keys to string paths, as an object or a list of
+ * `{ find, replacement }`), and whether any alias couldn't be read statically.
+ */
+function vitestAliases(files) {
+    const tsc = typescript(), aliases = [], unreadable = [];
+    for (const [path, text] of files) {
+        if (!VITEST_CONFIG.test(path))
+            continue;
+        const source = tsc.createSourceFile(path, text, tsc.ScriptTarget.Latest, false, tsc.ScriptKind.TS);
+        const text_ = (node) => node !== undefined && (tsc.isStringLiteral(node) || tsc.isNoSubstitutionTemplateLiteral(node)) ? node.text : null;
+        const visit = (node) => {
+            if (tsc.isPropertyAssignment(node) && (tsc.isIdentifier(node.name) || tsc.isStringLiteral(node.name)) && node.name.text === "alias") {
+                const value = node.initializer;
+                const add = (find, replacement) => {
+                    if (find === null || replacement === null || !(replacement.startsWith("./") || replacement.startsWith("../"))) {
+                        unreadable.push(path);
+                        return;
+                    }
+                    const target = join(dirOf(path), replacement);
+                    if (target === null)
+                        unreadable.push(path);
+                    else
+                        aliases.push({ find, replacement: target });
+                };
+                if (tsc.isObjectLiteralExpression(value)) {
+                    for (const property of value.properties) {
+                        if (!tsc.isPropertyAssignment(property)) {
+                            unreadable.push(path);
+                            continue;
+                        }
+                        add(tsc.isIdentifier(property.name) || tsc.isStringLiteral(property.name) ? property.name.text : null, text_(property.initializer));
+                    }
+                }
+                else if (tsc.isArrayLiteralExpression(value)) {
+                    for (const element of value.elements) {
+                        if (!tsc.isObjectLiteralExpression(element)) {
+                            unreadable.push(path);
+                            continue;
+                        }
+                        const field = (name) => element.properties.find((one) => tsc.isPropertyAssignment(one) && (tsc.isIdentifier(one.name) || tsc.isStringLiteral(one.name)) && one.name.text === name)?.initializer;
+                        add(text_(field("find")), text_(field("replacement")));
+                    }
+                }
+                else
+                    unreadable.push(path);
+            }
+            tsc.forEachChild(node, visit);
+        };
+        visit(source);
+    }
+    return { aliases, unreadable };
+}
+/** The vitest configs' setupFiles and globalSetup entries (string literals), as repository paths. */
+function setupRoots(files, names) {
+    const tsc = typescript(), roots = [], unresolved = [];
+    for (const [path, text] of files) {
+        if (!VITEST_CONFIG.test(path))
+            continue;
+        const source = tsc.createSourceFile(path, text, tsc.ScriptTarget.Latest, false, tsc.ScriptKind.TS);
+        const visit = (node) => {
+            if (tsc.isPropertyAssignment(node) && (tsc.isIdentifier(node.name) || tsc.isStringLiteral(node.name)) && (node.name.text === "setupFiles" || node.name.text === "globalSetup")) {
+                const values = tsc.isArrayLiteralExpression(node.initializer) ? [...node.initializer.elements] : [node.initializer];
+                for (const value of values) {
+                    if (!tsc.isStringLiteral(value)) {
+                        unresolved.push({ from: path, specifier: null, prefix: null });
+                        continue;
+                    }
+                    // vitest resolves them from its root: the config's own folder, or the repository root a config names.
+                    const found = [dirOf(path), ""].map(dir => { const target = join(dir, value.text); return target === null ? null : fileAt(target, names); }).find(one => one !== null) ?? null;
+                    if (found !== null)
+                        roots.push(found);
+                    else
+                        unresolved.push({ from: path, specifier: value.text, prefix: join("", value.text) });
+                }
+            }
+            tsc.forEachChild(node, visit);
+        };
+        visit(source);
+    }
+    return { roots, unresolved };
+}
+/**
+ * The infrastructure among `files` (path → text: the tree's sources, and its tsconfig.json and package.json): reachable
+ * from a test root — every test file, every file under `test/`, every vitest config and its setup files — not itself a
+ * test, and not reachable from PRODUCT_ENTRIES; plus every specifier reached from a test root that couldn't be resolved.
+ */
+export function testInfrastructure(files, allPaths = new Set(files.keys())) {
+    const names = new Set([...files.keys()].filter(path => SOURCE.test(path)));
+    const vitest = vitestAliases(files);
+    const resolve = resolverFor(files, names, allPaths, vitest.aliases);
+    const edges = new Map(), loose = new Map();
+    for (const path of names) {
+        const { literal, computed, soft } = specifiersOf(path, files.get(path));
+        const targets = new Set(), open = [];
+        for (const spec of literal) {
+            const found = resolve(path, spec);
+            if ("file" in found)
+                targets.add(found.file);
+            else if ("unresolved" in found)
+                open.push({ from: path, specifier: spec, prefix: found.unresolved });
+        }
+        for (const head of computed)
+            open.push({ from: path, specifier: head, prefix: head === null ? null : join(dirOf(path), head) });
+        // Any other relative string that names a repository source file is an edge (a path handed to a loader by any name).
+        for (const spec of soft) {
+            const found = resolve(path, spec);
+            if ("file" in found)
+                targets.add(found.file);
+        }
+        edges.set(path, [...targets]);
+        loose.set(path, open);
+    }
+    const setup = setupRoots(files, names);
+    const testRoots = [...[...names].filter(path => TEST.test(path) || path.startsWith("test/") || VITEST_CONFIG.test(path)), ...setup.roots];
+    const reach = (roots) => {
+        const seen = new Set(), todo = [...roots];
+        while (todo.length > 0) {
+            const at = todo.pop();
+            if (seen.has(at))
+                continue;
+            seen.add(at);
+            for (const next of edges.get(at) ?? [])
+                if (!seen.has(next))
+                    todo.push(next);
+        }
+        return seen;
+    };
+    const product = reach(PRODUCT_ENTRIES.filter(path => names.has(path)));
+    const tested = reach(testRoots);
+    const infra = new Set([...tested].filter(path => !TEST.test(path) && !product.has(path)));
+    const unresolved = [...setup.unresolved, ...vitest.unreadable.map(from => ({ from, specifier: null, prefix: null })), ...[...tested].flatMap(path => loose.get(path) ?? [])];
+    return { infra, unresolved, product };
+}
+/**
+ * Whether a changed path is something an unresolved specifier might name. A computed one (no prefix) might name anything
+ * the other rules don't already trust: any source file that is neither a test nor product code.
+ */
+export function mightName(open, path, found) {
+    if (open.prefix === null)
+        return SOURCE.test(path) && !TEST.test(path) && !found.product.has(path);
+    const prefix = open.prefix.replace(/\/$/, "");
+    const stem = path.replace(/\.[^/.]+$/, "");
+    return path === prefix || stem === prefix.replace(/\.(?:[cm]?js|jsx)$/, "") || path.startsWith(`${prefix}/`) || (open.specifier !== null && open.specifier.endsWith("/") === false && path.startsWith(prefix));
+}

package/dist/tool-secret-store.js

@@ -27,6 +27,7 @@
  * database records which key Toolroll made: a folder, key, link or lock that
  * something else put there first is refused, never used.
  */
+import { inReadOnlyRequest } from "./read-only-request.js";
 import { spawnSync } from "node:child_process";
 import { createCipheriv, createDecipheriv, createHash, randomBytes } from "node:crypto";
 import { closeSync, constants, fstatSync, fsyncSync, linkSync, lstatSync, mkdirSync, openSync, readSync, readdirSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, writeSync } from "node:fs";
@@ -541,6 +542,10 @@ export function secretFolder(state) {
     const known = folders.get(root);
     if (known !== undefined && unchanged(known))
         return known;
+    // A page visit prepares nothing (docs/plans/get-side-effects.md): the console prepares its folder as it starts, and
+    // an action checks a changed one again. Until then the page says secrets can't be read right now.
+    if (inReadOnlyRequest())
+        throw new SecretStoreError(NOT_READY);
     // Changed since it was checked (or never seen): checked against the same record (the database's, for Toolroll's
     // own folder; this process's, for a test's), and refused if it doesn't match.
     const named = pending.get(root);
@@ -797,6 +802,9 @@ export function readHeldSecret(state, name, file) {
     const backend = secretBackend();
     if (backend === null)
         return readOwnFile(path);
+    // A page visit moves nothing and takes no lock (docs/plans/get-side-effects.md): the keychain, else the old file.
+    if (inReadOnlyRequest())
+        return readSealed(backend, folder, heldItem(folder, name)) ?? readOwnFile(path);
     return withSecretLock(folder, `held.${name}`, () => {
         moveHeldIn(backend, folder, name, path);
         return readSealed(backend, folder, heldItem(folder, name));

package/dist/toolroll-update-ui.d.ts

@@ -17,6 +17,8 @@ export type UpdatesView = {
         problem: string;
     } | {
         off: true;
+    } | {
+        pending: true;
     };
     method: InstallMethod;
     journal: RuntimeUpdateJournal | null;

package/dist/toolroll-update-ui.js

@@ -65,9 +65,10 @@ export function updatesHtml(view, notice) {
         : view.method.kind === "source" ? html `<h2>Toolroll ${view.current}</h2><p class="meta">This runs from a source checkout. Update it with git.</p>`
             : newer && view.method.kind === "desktop" ? html `<h2>Toolroll ${latest} is available</h2><p class="meta">You have ${view.current}. Update it from the Toolroll app.</p>`
                 : newer ? html `<h2>Toolroll ${latest} is available</h2><p class="meta">You have ${view.current}. Running work finishes first, and your current version is kept so you can go back.</p>`
-                    : "off" in view.latest ? html `<h2>Toolroll ${view.current}</h2><p class="meta">Update checks are off.</p><form method="get" action="/settings/updates" class="update-actions"><input type="hidden" name="check" value="now"><button type="submit">Check now</button></form>`
-                        : latest === null ? html `<h2>Toolroll ${view.current}</h2><p class="meta">Couldn’t check for a newer release: ${"problem" in view.latest ? view.latest.problem : ""}</p>`
-                            : html `<h2>Toolroll ${view.current} is up to date</h2>`;
+                    : "off" in view.latest ? html `<h2>Toolroll ${view.current}</h2><p class="meta">Update checks are off.</p>${postForm("/settings/updates/check", html `<button type="submit">Check now</button>`, { attrs: { class: "update-actions" } })}`
+                        : "pending" in view.latest ? html `<h2>Toolroll ${view.current}</h2><p class="meta">Not checked for a newer release yet.</p>${postForm("/settings/updates/check", html `<button type="submit">Check now</button>`, { attrs: { class: "update-actions" } })}`
+                            : latest === null ? html `<h2>Toolroll ${view.current}</h2><p class="meta">Couldn’t check for a newer release: ${"problem" in view.latest ? view.latest.problem : ""}</p>`
+                                : html `<h2>Toolroll ${view.current} is up to date</h2>`;
     const form = newer && !["npx", "source", "desktop"].includes(view.method.kind)
         ? postForm("/settings/updates", html `${reauth(html `<label class="step-up">Your Toolroll password<input type="password" name="password" autocomplete="current-password" required></label>`)}<div class="update-actions"><button type="submit" name="when" value="now" class="primary">Update now</button><button type="submit" name="when" value="when-idle">When idle</button><button type="submit" name="when" value="tonight">Tonight (03:00)</button></div>`, { hidden: { version: latest } })
         : "";

package/dist/toolroll-update.js

@@ -22,6 +22,7 @@
  * previous runtime and its backups. Every update, rollback, refusal and
  * failure is a ledger entry.
  */
+import { inReadOnlyRequest } from "./read-only-request.js";
 import { createHash, randomUUID, verify as signatureValid, X509Certificate } from "node:crypto";
 import { spawnSync } from "node:child_process";
 import { accessSync, chmodSync, closeSync, constants, copyFileSync, existsSync, fsyncSync, lstatSync, mkdirSync, openSync, readdirSync, readFileSync, readlinkSync, realpathSync, renameSync, rmSync, statfsSync, statSync, symlinkSync, writeFileSync } from "node:fs";
@@ -29,7 +30,7 @@ import { homedir, userInfo } from "node:os";
 import { basename, dirname, isAbsolute, join, resolve, sep } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { createRequire } from "node:module";
-import { clearWords, durableJson, LINGERING_LIMIT_MS, lingeringRun, lingeringWords, settleLeftoverRecords, sqliteLock, desktopUpdateWaitingOf, stoppedWaitingWords, updateWaitingWords, verifiedDatabaseBackup } from "./desktop-update.js";
+import { clearWords, durableJson, LINGERING_LIMIT_MS, lingeringRun, lingeringWords, settleLeftoverRecords, sqliteLock, lockHeld, desktopUpdateWaitingOf, stoppedWaitingWords, updateWaitingWords, verifiedDatabaseBackup } from "./desktop-update.js";
 import { activeUpdateWork, freezeUpdateGate, installUpdateGate, removeUpdateGate, updateAdmissionPaused, updateGateOwned } from "./desktop-update-gate.js";
 import { processMayBeAlive } from "./process-liveness.js";
 import { removeTerminalUpdateGate } from "./terminal-catalog.js";
@@ -1445,11 +1446,8 @@ export function runtimeUpdateStatus(stateDir) {
         j = null;
     }
     let running = false;
-    if (j && !runtimeUpdateTerminal(j.phase)) {
-        const lock = sqliteLock(join(j.stageDir, "worker.sqlite"));
-        running = lock === null;
-        lock?.close();
-    }
+    if (j && !runtimeUpdateTerminal(j.phase))
+        running = lockHeld(join(j.stageDir, "worker.sqlite"));
     const whatsNew = j && j.kind === "update" && j.phase === "complete" && !j.seen ? { version: j.to.version, notes: j.notes ?? [] } : null;
     let last = null;
     try {
@@ -1525,10 +1523,13 @@ export function releaseStalledUpdate(stateDir, now) {
  * waiting update, `toolroll update`'s or the desktop app's. */
 export function waitingUpdate(databaseFile, inTheWay, now, desktopStates) {
     const stateDir = dirname(databaseFile);
-    try {
-        releaseStalledUpdate(stateDir, now);
+    // A page visit only reads (docs/plans/get-side-effects.md): the console's background pass releases a stalled update.
+    if (!inReadOnlyRequest()) {
+        try {
+            releaseStalledUpdate(stateDir, now);
+        }
+        catch { /* an unreadable record is shown as it is */ }
     }
-    catch { /* an unreadable record is shown as it is */ }
     return updateWaitingOf(stateDir, inTheWay) ?? desktopUpdateWaitingOf(databaseFile, inTheWay, desktopStates);
 }
 export function markWhatsNewSeen(stateDir) {

package/dist/work-index.js

@@ -10,7 +10,7 @@ import { readProjectAccess } from './project-access.js';
 import { pauseOnTaskProviders, providerName, signInReason } from './provider-auth.js';
 import { scopeTermsProblem, stopFactOf } from './store.js';
 import { assignmentChecksForRun } from './assignment.js';
-import { checkBackingOf, completionBlockersOf, leadOnIt, plainReasonOf, replacedWords, requirementsOf, stageOfCode, taskStatusOf, unverifiedWhenRefuted, workToneOf } from './task-status.js';
+import { approvedCheckOf, checkBackingOf, completionBlockersOf, leadOnIt, plainReasonOf, replacedWords, requirementsOf, stageOfCode, taskStatusOf, unverifiedWhenRefuted, workToneOf } from './task-status.js';
 import { releaseCoverageOf } from './release-coverage.js';
 import { buildReviewOf } from './review-switch.js';
 import { shownVerdictOf } from './proof.js';
@@ -429,7 +429,7 @@ function readWorkIndexPage(store, now, access, options, taskId = null) {
     // automatic review and, with checks Off, the release check that covers it.
     const memo = new Map();
     const readiness = (row, checks) => resultReadinessFacts(store, now, options.root, row, checks, memo);
-    return { items: page.map(row => itemOf(row, access.principal, probe, leadName, readiness)), projects, totals: rows[0] === undefined ? { ...EMPTY } : counts(rows[0]),
+    return { items: page.map(row => itemOf(row, access.principal, probe, leadName, readiness, options.root !== undefined)), projects, totals: rows[0] === undefined ? { ...EMPTY } : counts(rows[0]),
         groups: rows[0] === undefined ? { ...NO_GROUPS } : groupCounts(rows[0]), nextCursor, limit, view };
 }
 export function workCountsByProject(store, now, access) {
@@ -489,22 +489,36 @@ function listChecksOf(own, level, follows) {
         return null;
     return { status: read.status, exitCode: null, head: null, level: read.level, running: read.running };
 }
+/** A check as a read without the evidence files may show it: only what never claims a pass it can't prove. */
+function unreadChecksOf(checks) {
+    if (checks === null)
+        return null;
+    return checks.status === 'failed' || (checks.level === 'off' && checks.status !== 'passed' && checks.release == null) ? checks : null;
+}
 /** A ready result's requirements, acceptance and completion blockers from its saved records, as assignmentOf reads them. */
 function resultReadinessFacts(store, now, root, row, recorded, memo) {
     const run = n(row, 'result_id'), repo = s(row, 'repo');
     if (!run)
-        return { checks: recorded };
+        return { checks: root === undefined ? unreadChecksOf(recorded) : recorded };
     const report = s(row, 'result_role') === 'scout';
-    // No recorded check result (a build from before results were recorded, or none ran): read its saved receipt, as the page does.
-    const saved = root !== undefined && (recorded === null || recorded.status === 'not-run') ? assignmentChecksForRun(store, root, run, now) : null;
+    // Read its saved receipt, as the page does: a recorded result (or a verdict alone) is not a check that can still be
+    // read, and the row must never say passed while the task page says the check couldn't be read.
+    const read = root !== undefined && !report ? assignmentChecksForRun(store, root, run, now) : null;
+    // A recorded failure is never lost because its saved files can't be read now (fail closed: negatives stand).
+    const saved = read !== null && recorded?.status === 'failed' && (read.status === 'unavailable' || read.status === 'not-run')
+        ? { ...read, status: 'failed', exitCode: recorded.exitCode } : read;
     const listed = saved === null ? recorded : { status: saved.status, exitCode: saved.exitCode, head: s(row, 'result_head'),
         ...(saved.level == null ? {} : { level: saved.level }), ...(saved.running == null ? {} : { running: saved.running }), ...(saved.batch == null ? {} : { batch: saved.batch }) };
-    const checks = listed?.level === 'off' && listed.status !== 'passed' && listed.status !== 'failed'
+    const covered = listed?.level === 'off' && listed.status !== 'passed' && listed.status !== 'failed'
         ? { ...listed, release: releaseCoverageOf(store, root, repo, s(row, 'result_head'), { memo }) } : listed;
     const proof = store.proofVerdictFor(run), accepted = store.proofAcceptance(run) !== null;
+    // The approved check as the task page reads it (task-status.ts): a recorded pass with no readable check doesn't count.
+    // Without the evidence root nothing can be read, so the row makes no claim about the check at all: a recorded
+    // failure or checks Off still say so; a pass, or a missing check, is the result's own page to say.
+    const checks = report ? covered : root === undefined ? unreadChecksOf(covered) : approvedCheckOf(proof?.verdict ?? null, proof?.reasons ?? [], covered);
     const review = buildReviewOf(store, run);
     const high = review === null || review.sentBackAs !== null || review.state !== 'reviewed' ? 0 : review.high.length;
-    const checkRequired = requiredCheckCommandFor(store, repo, String(row['id']), checks?.level) !== null;
+    const checkRequired = root === undefined && checks === null ? false : requiredCheckCommandFor(store, repo, String(row['id']), checks?.level) !== null;
     const backing = checkBackingOf(checks);
     const requirements = requirementsOf(proof?.matrix, backing);
     const verdict = shownVerdictOf(proof?.verdict ?? null, { checkFailed: !report && checks?.status === 'failed', highFindings: high, reviewPending: review?.state === 'pending',
@@ -512,7 +526,7 @@ function resultReadinessFacts(store, now, root, row, recorded, memo) {
     const blockers = completionBlockersOf({ report, checks, checkRequired, matrix: proof?.matrix, verdict: proof?.verdict ?? null, accepted, high });
     return { checks, requirements: unverifiedWhenRefuted(requirements, verdict), ...(accepted ? { accepted } : {}), ...(blockers.length === 0 ? {} : { blockers }) };
 }
-function itemOf(row, principal, probe, leadName, readiness) {
+function itemOf(row, principal, probe, leadName, readiness, readable = false) {
     const code = String(row['code']), id = String(row['id']);
     const custody = code === 'process-needs-attention' || (code === 'result-needs-attention' && n(row, 'custody_unresolved') === 1);
     const process = custody && probe !== undefined ? processNeedOf(probe(id)) : null;
@@ -624,15 +638,18 @@ function itemOf(row, principal, probe, leadName, readiness) {
             : coded.stage === 'needs-you' && (coded.need === undefined || coded.need === 'other') && INDEX_NEED[code] !== undefined ? { stage: 'needs-you', need: INDEX_NEED[code] } : coded;
     const checkStatus = s(row, 'check_status'), verdict = s(row, 'proof_verdict');
     const finished = reading.stage === 'finished' || reading.stage === 'complete';
-    const own = checkStatus === 'failed' || n(row, 'proof_failed_check') === 1 ? 'failed' : checkStatus === 'passed' || verdict === 'verified' ? 'passed' : null;
-    const listedChecks = !finished ? null : listChecksOf(own, s(row, 'check_level'), row['check_follows']);
-    const ready = reading.stage === 'finished' && readiness !== undefined ? readiness(row, listedChecks) : null;
+    // Only a recorded check is a pass; a verdict alone isn't one (task-status.ts approvedCheckOf reads it with the receipt).
+    const own = checkStatus === 'failed' || n(row, 'proof_failed_check') === 1 ? 'failed' : checkStatus === 'passed' ? 'passed' : null;
+    const recordedChecks = !finished ? null : listChecksOf(own, s(row, 'check_level'), row['check_follows']);
+    // A read without the evidence files claims no pass (unreadChecksOf); the readiness read below says the rest.
+    const listedChecks = readable ? recordedChecks : unreadChecksOf(recordedChecks);
+    const ready = reading.stage === 'finished' && readiness !== undefined ? readiness(row, recordedChecks) : null;
     // Toolroll marked it complete because its work landed: the reason, said once.
     const landed = code === 'complete' ? landedReasonOf(s(row, 'checked_actor'), s(row, 'checked_detail')) : null;
     const shared = taskStatusOf({ stage: reading.stage, ...(reading.need === undefined ? {} : { need: reading.need }), ...(reading.wait === undefined ? {} : { wait: reading.wait }),
         ...(process === null ? {} : { needContext: { build: process.build } }),
         reason: finished ? null : plainReasonOf(reading.stage, code, detail || null), report: s(row, 'result_role') === 'scout',
-        checks: ready?.checks ?? listedChecks,
+        checks: ready !== null ? ready.checks : listedChecks,
         ...(ready === null ? {} : { requirements: ready.requirements ?? null, ...(ready.accepted ? { accepted: true } : {}), ...(ready.blockers === undefined ? {} : { blockers: ready.blockers }) }),
         completedBy: code !== 'complete' || landed !== null ? null : n(row, 'completed_by_lead') === 1 ? 'the lead' : String(row['checked_actor']).replace(/^(?:operator|coordinator|lead):/, ''),
         ...(landed === null ? {} : { landed }),

package/dist/workspace-ui.d.ts

@@ -22,6 +22,7 @@ export { ACCEPT_NEEDS_REASON, cantAcceptYetOf, evidenceProblemOf, type EvidenceP
 import { type ProofVerdict } from "./proof.js";
 import type { ReviewRetryState, TaskState } from "./store.js";
 import type { TaskControlView } from "./task-control.js";
+import { type ChecksFact } from "./task-status.js";
 import { type Html } from "./html.js";
 /** The Work destination's views — shortcuts over the same rows, never a
  * persisted state. All is the default. */
@@ -53,6 +54,10 @@ export type ResultFacts = {
      * per run so an older selected result keeps its own words; undefined
      * when the caller did not read it, null when never requested. */
     review?: ReviewFacts | null;
+    /** The saved approved check as read now (assignmentChecksForRun), for `approvedCheckOf`: the words say the check
+     * passed only when this reading does. Undefined: the caller read no check (a list or dispatch read), so the words
+     * name only what the verdict recorded when the build finished. */
+    checks?: ChecksFact | null;
 };
 /** The result's review facts as `reviewRetryStateOf` records them, plus
  * the one liveness fact the words depend on. */