toolroll 0.9.74 → 0.9.76

package/dist/scope.d.ts

@@ -418,7 +418,10 @@ export type ScopeAuthor = "mate" | "coordinator" | "scout" | "lead";
 /** The authorities a seal can stand on (approval-policy plan §1.5). Anything else stands on nothing. */
 /** `carried`: a later commit of a release carried under a person's release approval (release-once.md); only the carry
  * transaction ever writes it. */
-export type ApprovalBasis = "password" | "mode" | "chat" | "grant" | "schedule" | "lead" | "carried";
+/** `auto-check` / `auto-green`: a release task the plane approved itself under the project's "Approve automatically when
+ * checks pass" (docs/plans/auto-approve-green.md) — `auto-check` lets its check run, `auto-green` is the release
+ * approval once CI and that check passed. Only release-auto.ts writes them; neither is ever a person's. */
+export type ApprovalBasis = "password" | "mode" | "chat" | "grant" | "schedule" | "lead" | "carried" | "auto-check" | "auto-green";
 export declare const APPROVAL_BASES: readonly ApprovalBasis[];
 export type Approval = {
     approved: true;
@@ -865,7 +868,7 @@ export declare function releaseTermsSentence(terms: ReleaseTerms): string;
 export declare function releaseAsksAgainWords(terms: ReleaseTerms): string[];
 export { personProof } from "./person-proof.js";
 import { type ReleaseTerms } from "./contracts/release-terms.js";
-import { type ReleaseAuthority, type ReleaseCarry } from "./release-authority.js";
+import { type AutoEvidence, type ReleaseAuthority, type ReleaseCarry } from "./release-authority.js";
 /** Whether the command running now is a machine's: the lead (its token) or a remote API run. Trusted context only. */
 export declare const machineActing: () => boolean;
 /** A proof row's detail, either form: the legacy text (`<at> · generation <n> · digest <d>`) or the versioned record
@@ -952,3 +955,29 @@ export declare function mainDebtProblem(store: Store, repo: string, taskId: stri
  * chat it is approved only through the release card.
  */
 export declare function deployGateScope(scope: Pick<Scope, "candidate" | "releaseTerms">): boolean;
+/**
+ * The plane's own automatic approval of a release task (docs/plans/auto-approve-green.md), read the way the dispatch
+ * belts read it (release-authority.ts autoSealSql): sealed `kind` on the current digest, its evidence row naming exactly
+ * this task, kind, digest and candidate, a release task (candidate and terms signed in), the project's setting on now,
+ * and the person who turned it on still an approver there. Never a person's approval.
+ */
+export declare function autoReleaseApprovalOf(store: Store, taskId: string, kind: "auto-check" | "auto-green"): {
+    ok: true;
+    by: string;
+    at: string;
+    evidence: AutoEvidence;
+} | {
+    ok: false;
+    why: string;
+};
+/** A release's approval: a person's (personApprovalOf, unchanged), or the plane's own `auto-green`. Only release
+ * readers ask this (liveReleaseOf, and the deploy gates inside `toolroll release`); everything else asks for a person. */
+export declare function releaseApprovalOf(store: Store, taskId: string, _now?: Date): {
+    ok: true;
+    by: string;
+    at: string;
+    method: string;
+} | {
+    ok: false;
+    why: string;
+};

package/dist/scope.js

@@ -571,7 +571,7 @@ export function canonicalAcceptance(criteria) {
         .sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0))
         .map(c => ({ id: c.id, statement: c.statement.trim(), evidence: [...c.evidence].sort() }));
 }
-export const APPROVAL_BASES = ["password", "mode", "chat", "grant", "schedule", "lead", "carried"];
+export const APPROVAL_BASES = ["password", "mode", "chat", "grant", "schedule", "lead", "carried", "auto-check", "auto-green"];
 /**
  * The exact bytes an operator agreed to.
  *
@@ -1359,7 +1359,7 @@ function describeApproval(approval) {
 export { personProof } from "./person-proof.js";
 import { personProof } from "./person-proof.js";
 import { releaseTermsDigest } from "./contracts/release-terms.js";
-import { CHECK_ACCESS_WIDTH, carriesUnsandboxed, newestReleaseGeneration, releaseAuthorityOfTask, releaseSealProblem } from "./release-authority.js";
+import { CHECK_ACCESS_WIDTH, autoEvidenceOf, carriesUnsandboxed, newestReleaseGeneration, releaseAuthorityOfTask, releaseAutoApproves, releaseSealProblem } from "./release-authority.js";
 /** Whether the command running now is a machine's: the lead (its token) or a remote API run. Trusted context only. */
 export const machineActing = () => currentActor()?.lead === true || activeRemote() !== null;
 /** A proof row's detail, either form: the legacy text (`<at> · generation <n> · digest <d>`) or the versioned record
@@ -1400,6 +1400,8 @@ export function personApprovalOf(store, taskId) {
     const basis = scope.approvalBasis ?? null;
     if (basis === "lead")
         return { ok: false, why: "approved by the lead, not by a person" };
+    if (basis === "auto-check" || basis === "auto-green")
+        return { ok: false, why: "approved automatically, not by a person" };
     if (basis !== "password" && basis !== "chat")
         return { ok: false, why: `approved by ${basis === null ? "an unknown road" : basis === "grant" ? "a flow" : basis}, not by a person` };
     const origin = sealOriginOf(store, taskId, scope.approvedBy, scope.approvedDigest, scope.approvedAt);
@@ -1474,7 +1476,8 @@ export function liveReleaseOf(store, taskId, action, now = new Date()) {
     if (a.tipTask !== taskId)
         return refuse("this is not the release's current commit");
     const anchor = store.getScope(a.anchorTask);
-    const person = personApprovalOf(store, a.anchorTask);
+    // A person's yes, or the plane's own automatic one while the project still approves releases automatically.
+    const person = releaseApprovalOf(store, a.anchorTask, now);
     if (!person.ok)
         return refuse(`the release approval no longer stands: ${person.why}`);
     if (anchor === null || anchor.approvedDigest !== a.anchorDigest || anchor.digest !== a.anchorDigest)
@@ -1539,3 +1542,41 @@ export function mainDebtProblem(store, repo, taskId) {
 export function deployGateScope(scope) {
     return (scope.candidate ?? null) !== null || (scope.releaseTerms ?? null) !== null;
 }
+/**
+ * The plane's own automatic approval of a release task (docs/plans/auto-approve-green.md), read the way the dispatch
+ * belts read it (release-authority.ts autoSealSql): sealed `kind` on the current digest, its evidence row naming exactly
+ * this task, kind, digest and candidate, a release task (candidate and terms signed in), the project's setting on now,
+ * and the person who turned it on still an approver there. Never a person's approval.
+ */
+export function autoReleaseApprovalOf(store, taskId, kind) {
+    const scope = store.getScope(taskId);
+    const ref = store.lookupRef(taskId);
+    if (scope === null || scope.approvedAt === null || scope.approvedBy === null || scope.approvedDigest === null)
+        return { ok: false, why: "not approved yet" };
+    if (scope.approvedDigest !== scope.digest)
+        return { ok: false, why: "the approval is for different scope text" };
+    if (scope.approvalBasis !== kind)
+        return { ok: false, why: kind === "auto-green" ? "not approved automatically" : "not checking automatically" };
+    if ((scope.candidate ?? null) === null || (scope.releaseTerms ?? null) === null || ref === null || ref.repo === null)
+        return { ok: false, why: "only a release task is approved automatically" };
+    const evidence = autoEvidenceOf(store, taskId, scope.modeDigest, kind);
+    if (evidence === null || evidence.digest !== scope.approvedDigest || evidence.candidate !== scope.candidate || evidence.by !== scope.approvedBy)
+        return { ok: false, why: "no record shows what approved it automatically" };
+    if (!releaseAutoApproves(store, ref.repo))
+        return { ok: false, why: "approving releases automatically was turned off" };
+    const account = store.accountOf(scope.approvedBy);
+    if (account === null || account.revokedAt !== null || account.role !== "approver" || !store.accountCanAccess(scope.approvedBy, ref.repo))
+        return { ok: false, why: `${scope.approvedBy}, who turned on automatic release approval, can no longer approve in this project` };
+    return { ok: true, by: scope.approvedBy, at: scope.approvedAt, evidence };
+}
+/** A release's approval: a person's (personApprovalOf, unchanged), or the plane's own `auto-green`. Only release
+ * readers ask this (liveReleaseOf, and the deploy gates inside `toolroll release`); everything else asks for a person. */
+export function releaseApprovalOf(store, taskId, _now = new Date()) {
+    const person = personApprovalOf(store, taskId);
+    if (person.ok)
+        return person;
+    if (store.getScope(taskId)?.approvalBasis !== "auto-green")
+        return person;
+    const auto = autoReleaseApprovalOf(store, taskId, "auto-green");
+    return auto.ok ? { ok: true, by: auto.by, at: auto.at, method: "auto-green" } : auto;
+}

package/dist/scout.js

@@ -18,6 +18,7 @@ import { mkdtempSync, realpathSync, rmSync, unlinkSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import { dirname, join, relative, isAbsolute } from "node:path";
 import { run } from "./exec.js";
+import { checkoutGit } from "./teardown-git.js";
 import { auditOf } from "./provider.js";
 import { currentClaim, heartbeat } from "./claim.js";
 import { heartbeat as runnerHeartbeat } from "./runner.js";
@@ -225,7 +226,10 @@ export async function scout(store, request) {
     }
 }
 async function scoutWith(store, request, outputDir) {
-    const { taskId, taskRef, runner, worktree, branch, now, agent, git = run, timeoutMs = DEFAULT_SCOUT_TIMEOUT_MS, maxTurns = DEFAULT_SCOUT_TURNS, } = request;
+    const { taskId, taskRef, runner, worktree, branch, now, agent, git: givenGit = run, timeoutMs = DEFAULT_SCOUT_TIMEOUT_MS, maxTurns = DEFAULT_SCOUT_TURNS, } = request;
+    // The plane's git on the scout's checkout (agent-written, and its repository shared with every build) runs hardened, against
+    // a frozen view of the repository's config and info (teardown-git.ts checkoutGit); an injected runner is used as given.
+    const git = givenGit === run ? checkoutGit(run, "build", { repo: store.getWorktree(worktree)?.repo ?? null }) : givenGit;
     const claim = currentClaim(store, taskRef, now);
     if (claim === null || claim.runner !== runner || claim.leaseId !== request.leaseId) {
         return { ok: false, kind: "failure", reason: "not-yours", message: `${taskId} is not held under ${request.leaseId}` };

package/dist/serve.js

@@ -1,3 +1,13 @@
+import { secretFolder } from "./tool-secret-store.js";
+import { acceptedIdentities, recoverLearning } from "./project-learning.js";
+import { loadOrCreateVapidKeys } from "./push.js";
+import { checkoutPlan } from "./checkout-cleanup.js";
+import { latestReleaseFor } from "./server/render-settings.js";
+import { LastChecks } from "./server/last-checks.js";
+import { readProviderKey } from "./keys.js";
+import { closeExpiredUnattendedGrants } from "./flow-unattended.js";
+import { isKeyedProvider } from "./acp-agents.js";
+import { PROVIDER_IDS } from "./provider.js";
 import { taskMovedSince } from "./chat-ask.js";
 import { linuxFenceAvailable, macosFenceAvailable } from "./agent-fence.js";
 import { signInsUnavailableWords } from "./check-access.js";
@@ -12,6 +22,10 @@ const RAIL_TASKS = 6;
 const PROXY_HEADER = /^(forwarded|via|x-forwarded-.+|x-real-ip|x-client-ip|x-original-.+|x-cluster-client-ip|true-client-ip|cf-connecting-ip|fastly-client-ip|x-proxyuser-ip)$/i;
 /** Asks a project names for the chime (its count is complete beyond them). */
 const ASKS_PER_PROJECT = 100;
+/** How often the background checks look at what is due (docs/plans/get-side-effects.md), and how often this
+ * computer's agent sign-ins are asked again. */
+const BACKGROUND_CHECKS_MS = 30_000;
+const LOCAL_AGENTS_EVERY_MS = 2 * 60_000;
 import { boundProjectSummary, browserCrewFromIndex, browserCrewOf, browserNavigationOf, browserProjectsOf, needsYouLabelOf } from './browser-workspace.js';
 import { sharedActionPayload } from './chat-actions.js';
 import { prepareCodingContext } from './coding-context.js';
@@ -24,6 +38,7 @@ import { configureLeadFollow, recordLeadFollowFailure, runLeadFollowPass } from
 import { leadNameOf } from "./lead-identity.js";
 import { createLiveBus, followWorkspace } from "./live-bus.js";
 import { startMaintenance } from './maintenance.js';
+import { asReadOnlyRequest } from './read-only-request.js';
 import { connectionsOf, localConnectOf, oneClickOf } from "./mcp-connect.js";
 import { MOBILE_VIEWPORT_SCRIPT } from "./mobile-viewport.js";
 import { projectAuthority } from "./project-access.js";
@@ -99,7 +114,7 @@ import { hasForbiddenControls } from "./decision.js";
 import { UPDATE_PAUSED, updateAdmissionPaused } from "./desktop-update-gate.js";
 import { scanForSecrets } from "./evidence.js";
 import { run as execRun } from "./exec.js";
-import { firstRunSteps, signInCommandFor } from "./first-run.js";
+import { findFirstTasks, firstRunSteps, signInCommandFor } from "./first-run.js";
 import { installMethod } from "./install-method.js";
 import { createIntegrationMonitor } from "./integrations.js";
 import { logEvent } from "./log.js";
@@ -245,8 +260,26 @@ export function createDecisionServer(options) {
     const providerHome = options.connectionHome ?? homedir();
     const checkConnection = createConnectionChecker({ home: providerHome, clock, ...(options.connectionProbe === undefined ? {} : { probe: options.connectionProbe }) });
     // Every sign-in check the console makes also answers a sign-in pause.
+    // Whether this computer can fence agents: asked once as the console starts (a sandbox running /usr/bin/true), so
+    // Settings → Project never starts a process (docs/plans/get-side-effects.md).
+    const fenceHere = options.fenceAvailable === undefined ? macosFenceAvailable() || linuxFenceAvailable() : false;
+    // Phone notifications' signing pair, made once as the console starts so /push/key only reads it.
+    if (options.telegramTokenFile !== undefined) {
+        try {
+            loadOrCreateVapidKeys(dirname(options.telegramTokenFile));
+        }
+        catch { /* /push/key says push is not set up */ }
+    }
+    // The last answer of every other check a page shows (docs/plans/get-side-effects.md).
+    const lastChecks = new LastChecks();
+    /** The newest release, asked of npm (Settings → Updates shows the last answer). */
+    const checkRelease = () => lastChecks.run("release", () => latestReleaseFor(options.updates?.latest));
+    // What each sign-in check said last: what a page shows (docs/plans/get-side-effects.md). A page never checks.
+    const knownConnections = new Map();
+    const connectionKnown = (provider) => knownConnections.get(provider) ?? null;
     const connectionCheck = async (provider, fresh) => {
         const value = await checkConnection(provider, fresh);
+        knownConnections.set(provider, value);
         try {
             noteSignInProbe(store, provider, value.state, clock());
         }
@@ -382,6 +415,17 @@ export function createDecisionServer(options) {
             ssoProvider = { issuer, provider: found.provider, at: Date.now() };
         return found;
     }
+    /** The identity provider as last discovered: what starting a sign-in uses (a GET, so it fetches nothing,
+     * docs/plans/get-side-effects.md). Discovered as the console starts, by the background checks every ten minutes, and
+     * when sign-in settings are saved or tested. */
+    function providerKnown(issuer) {
+        return ssoProvider !== null && ssoProvider.issuer === issuer ? ssoProvider.provider : null;
+    }
+    {
+        const settings = ssoSettings();
+        if (settings !== null)
+            void providerFor(settings.issuer).catch(() => undefined);
+    }
     /** Password sign-in is only for instance operators when the provider says so (a way in if it's down). */
     const passwordAllowed = (name) => { const settings = ssoSettings(); return settings === null || settings.passwords === "everyone" || store.isInstanceOperator(name); };
     const minutesWords = (ms) => { const minutes = Math.max(1, Math.ceil(ms / 60_000)); return minutes >= 120 ? `${Math.round(minutes / 60)} hours` : `${minutes} minute${minutes === 1 ? "" : "s"}`; };
@@ -456,7 +500,7 @@ export function createDecisionServer(options) {
             setting: store.projectCheckAccess(repo), changed: store.projectCheckAccessChange(repo),
             canNarrow: who.via === "cookie" && who.role === "approver" && !store.isDemo() && store.accountCanAccess(who.name, repo),
             canWiden: who.via === "cookie" && !store.isDemo() && store.isInstanceOperator(who.name),
-            unconfinedHere: !(options.fenceAvailable?.() ?? (macosFenceAvailable() || linuxFenceAvailable())) && store.unfencedAgentsAllowed(),
+            unconfinedHere: !(options.fenceAvailable?.() ?? fenceHere) && store.unfencedAgentsAllowed(),
             signInsUnavailable: signInsUnavailableWords(options.platform ?? process.platform),
         },
         liveView: (() => {
@@ -613,7 +657,9 @@ export function createDecisionServer(options) {
     const server = createServer((request, response) => {
         instrumentRequest(store.telemetry, request, response);
         // Every password checked while answering counts against where this request came from (sign-in-guard.ts).
-        void withPasswordSource(joinSourceOf(request), () => handle(request, response)).catch(error => {
+        // A GET or HEAD only reads (docs/plans/get-side-effects.md): store reads that would tidy up as they go don't.
+        const answer = () => handle(request, response);
+        void withPasswordSource(joinSourceOf(request), () => request.method === "GET" || request.method === "HEAD" ? asReadOnlyRequest(answer) : answer()).catch(error => {
             // Every unhandled error is logged (v99): the path and the message, never the request's body or query.
             logEvent("error", "serve.error", { method: request.method, path: redactedPath(new URL(request.url ?? "/", "http://placeholder").pathname), error: error instanceof Error ? error.message : String(error) });
             if (envValue(process.env, "SERVE_DEBUG") === "1")
@@ -1073,9 +1119,9 @@ export function createDecisionServer(options) {
             .finally(() => { localSignInChecking = null; });
         return localSignInChecking;
     }
+    /** The last answer only (docs/plans/get-side-effects.md): this computer is asked again by the background checks or a
+     * person's Check now, never because a page was opened. */
     function localAgentSignedIn() {
-        if (localSignInChecking === null && (localSignIn === null || Date.now() - localSignIn.at > 30_000))
-            void checkLocalAgents();
         return localSignIn?.signedIn ?? null;
     }
     /**
@@ -1305,6 +1351,11 @@ export function createDecisionServer(options) {
      * whole catalog, not a hand-pinned shortlist). null = no key or the
      * catalog is unreachable; callers fall back to the compiled table. */
     let catalogCache = null;
+    /** The catalog as last fetched, for a page to show (docs/plans/get-side-effects.md): a page never fetches it. The
+     * background checks keep it current while an OpenRouter key is saved; saving a choice fetches it (chatCatalog). */
+    function chatCatalogKnown() {
+        return chatKeyFor("openrouter-api") === null ? null : catalogCache?.models ?? null;
+    }
     async function chatCatalog() {
         const key = chatKeyFor("openrouter-api")?.key;
         if (key === undefined)
@@ -1820,6 +1871,106 @@ export function createDecisionServer(options) {
             onError: error => recordLeadFollowFailure(store, error, clock()),
         });
     });
+    // Background checks (docs/plans/get-side-effects.md): what pages show about this computer's agent sign-ins and the
+    // services Toolroll uses is asked here, on a timer, and a page reads the last answer. A page visit never starts a
+    // process or a network call, and never acts on what a check finds: lifting a sign-in pause and the lead-by-default
+    // rule run from this pass (or a person's Check now), not from a GET.
+    let backgroundChecks = null;
+    let agentsCheckedAt = 0;
+    if (options.backgroundChecks === true)
+        server.once('listening', () => {
+            // This Toolroll's folder for secrets, checked once now, so a page can read which are set without preparing it.
+            try {
+                secretFolder();
+            }
+            catch { /* a page says secrets can't be read; the next action reports why */ }
+            backgroundChecks = startMaintenance({ intervalMs: options.backgroundChecksMs ?? BACKGROUND_CHECKS_MS, shouldStop: () => leadClosing,
+                run: async () => {
+                    const now = Date.now();
+                    const waits = [];
+                    if (now - agentsCheckedAt >= (options.backgroundChecksMs ?? LOCAL_AGENTS_EVERY_MS)) {
+                        agentsCheckedAt = now;
+                        waits.push(checkLocalAgents());
+                        // The other agents Settings lists: their last answer is what the page shows.
+                        for (const provider of PROVIDER_IDS.filter(isKeyedProvider).filter(one => one !== "claude" && one !== "codex"))
+                            waits.push(connectionCheck(provider).catch(() => undefined));
+                    }
+                    integrations.refreshIfDue();
+                    const sso = ssoSettings();
+                    if (sso !== null && (ssoProvider === null || ssoProvider.issuer !== sso.issuer || Date.now() - ssoProvider.at >= 10 * 60_000))
+                        waits.push(providerFor(sso.issuer));
+                    if (chatKeyFor("openrouter-api") !== null)
+                        waits.push(chatCatalog());
+                    const openrouter = readProviderKey("openrouter", providerHome);
+                    // The cache answers until its list is due again (ten minutes, or 30 s after a failure), then fetches.
+                    if (openrouter !== null)
+                        waits.push(modelCatalog(openrouter));
+                    // What used to be closed by whichever page read it first: an operating mode or a flow's "runs on its own"
+                    // grant past its expiry, a stalled update, old coordinator proposals. (Lead turns past their deadline are the
+                    // follow pass's, which settles them even while an update drains.)
+                    const at = clock();
+                    store.closeExpiredModes(at);
+                    closeExpiredUnattendedGrants(store, at);
+                    store.sweepCoordinatorProposals(at);
+                    // The demo's scripted story, if a beat timer missed (its pages only read it).
+                    try {
+                        options.demoLead?.advance(at);
+                    }
+                    catch { /* the next pass tries again */ }
+                    const databaseFile = store.databaseFile();
+                    if (databaseFile !== null && !updateChecksOff(process.env, options.configDir ?? dirname(databaseFile)).off) {
+                        const last = lastChecks.known("release");
+                        if (lastChecks.due("release", last !== null && "problem" in last.value ? 60_000 : 15 * 60_000))
+                            waits.push(checkRelease());
+                    }
+                    // Chat's first tasks (issues and TODOs) while the first run is open and nothing is filed yet.
+                    if (firstRunStepsNow(clock()) !== null && !store.hasAnyWork()) {
+                        for (const repo of managedRepos()) {
+                            const entry = firstTasks.get(repo);
+                            if (entry !== undefined && (entry.reading || entry.until > Date.now()))
+                                continue;
+                            const reading = { until: Date.now() + 10 * 60_000, found: entry?.found ?? null, reading: true };
+                            firstTasks.set(repo, reading);
+                            waits.push(findFirstTasks(repo, options.firstTaskRunner ?? execRun).then(found => { reading.found = found; }, () => { }).finally(() => { reading.reading = false; }));
+                        }
+                    }
+                    // Learning recovered from reviewed runs (and a project's saved rows carried to its current identity), which
+                    // Settings → Learning and Knowledge used to do as they opened.
+                    if (lastChecks.due("learning", 10 * 60_000)) {
+                        waits.push(lastChecks.run("learning", async () => {
+                            for (const repo of managedRepos()) {
+                                try {
+                                    acceptedIdentities(store, repo);
+                                }
+                                catch { /* the next pass tries again */ }
+                                try {
+                                    recoverLearning(store, evidenceRoot, repo);
+                                }
+                                catch { /* the next pass tries again */ }
+                            }
+                        }));
+                    }
+                    // What Codex has configured, per project, for Settings → Tools to offer.
+                    for (const repo of managedRepos()) {
+                        if (lastChecks.due(`codex-tools:${repo}`, 10 * 60_000))
+                            waits.push(lastChecks.run(`codex-tools:${repo}`, () => codexServers(repo)));
+                    }
+                    if (databaseFile !== null && lastChecks.due("storage", 30 * 60_000)) {
+                        waits.push(lastChecks.run("storage", () => checkoutPlan(store, storagePool(databaseFile), clock(), { manual: true })));
+                    }
+                    // The same reading the chrome does, outside a page visit, so it releases a stalled `toolroll update` and a stalled
+                    // desktop update in every folder the chrome looks in.
+                    if (databaseFile !== null) {
+                        try {
+                            waitingUpdate(databaseFile, run => store.stopQuiescenceProblem(run) !== null, at);
+                        }
+                        catch { /* shown as last saved */ }
+                    }
+                    await Promise.all(waits);
+                },
+                onError: () => { }, });
+            void backgroundChecks.runNow();
+        });
     // Keep native process custody until shutdown has verified agent/tool exit.
     // Coding custody does not depend on subagents or the lead's follow pass, so
     // it closes at once and never waits behind a model turn: a stop must release
@@ -1848,7 +1999,7 @@ export function createDecisionServer(options) {
         liveHandlers.close();
         detachReads();
         liveFollower.close();
-        void Promise.all([closeCoding(), terminalClosing.close?.().then(problem => { terminalClosing.problem = problem; }), bounded(team.close()), bounded(personalQueue.close()), bounded(leadMaintenance?.stop()), bounded(reads?.close())])
+        void Promise.all([closeCoding(), terminalClosing.close?.().then(problem => { terminalClosing.problem = problem; }), bounded(team.close()), bounded(personalQueue.close()), bounded(leadMaintenance?.stop()), bounded(backgroundChecks?.stop()), bounded(reads?.close())])
             // The server always closes; a terminal whose processes couldn't be proved stopped is the close's error.
             .then(() => closeServer(error => callback?.(error ?? terminalClosing.problem ?? undefined))).catch(error => {
             if (callback)
@@ -1924,6 +2075,7 @@ export function createDecisionServer(options) {
         get liveRefreshSeconds() { return liveRefreshSeconds; },
         get chatKeyFor() { return chatKeyFor; },
         get chatCatalog() { return chatCatalog; },
+        get chatCatalogKnown() { return chatCatalogKnown; },
         get leadRecheckedAt() { return leadRecheckedAt; },
         set leadRecheckedAt(value) { leadRecheckedAt = value; },
         get checkLocalAgents() { return checkLocalAgents; },
@@ -1931,6 +2083,9 @@ export function createDecisionServer(options) {
         set localSignIn(value) { localSignIn = value; },
         get agentSignInCommand() { return agentSignInCommand; },
         get connectionCheck() { return connectionCheck; },
+        get connectionKnown() { return connectionKnown; },
+        get lastChecks() { return lastChecks; },
+        get checkRelease() { return checkRelease; },
         get modelCatalog() { return modelCatalog; },
         get modelSeams() { return modelSeams; },
         get toolsViewOf() { return toolsViewOf; },
@@ -1960,6 +2115,7 @@ export function createDecisionServer(options) {
         get ssoProvider() { return ssoProvider; },
         set ssoProvider(value) { ssoProvider = value; },
         get providerFor() { return providerFor; },
+        get providerKnown() { return providerKnown; },
         get connectVisits() { return connectVisits; },
         get defaultProject() { return defaultProject; },
         get googleVisits() { return googleVisits; },

package/dist/server/agents-live-filed.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Work a lead filed, nested under it on the Live grid (docs/plans/lead-dispatched-tiles.md): which of the viewer's
+ * tiles were filed through the viewer's OWN lead chat, and which chat. Proved from the store only, at request time: the
+ * task's family root was filed through the lead (`filed_via = 'mate'`) by the viewer as a person, and exactly one record
+ * links that root to one of the viewer's own personal lead threads — a confirmed task card the viewer confirmed (its
+ * door-written outcome, never the model's payload) or a sweep the viewer started from a card still kept. Attribution is
+ * to the chat that filed the family's ORIGINAL task: a revision asked for in another chat stays with the family. Anything
+ * short of that is no link:
+ * the tile stays a top-level tile, as it is today. A link only groups tiles the viewer already gets; it never adds one.
+ */
+import type { Store } from "../store.js";
+export type FiledBy = {
+    thread: number;
+    chat: "lead" | "project" | "task";
+};
+/** For each run id given (the tiles already in this viewer's answer), the viewer's lead chat that filed its task. */
+export declare function leadFiledLinks(store: Store, viewer: string, runIds: readonly number[]): Map<number, FiledBy>;

package/dist/server/agents-live-filed.js

@@ -0,0 +1,97 @@
+const BUILT_IN = "built-in";
+/** The family root of a built-in task, or null when its lineage can't be proved: the family's own proof (taskFamilyOf:
+ * every revision in the root's project, each bound by its brief to its parent's own run), and the task one of it. */
+function rootOf(store, taskId) {
+    const family = store.taskFamilyOf(taskId, null, false);
+    return family === null || family.problem !== null || !family.versions.some(version => version.id === taskId) ? null : family.root.id;
+}
+const parse = (text) => {
+    if (typeof text !== "string")
+        return null;
+    try {
+        const value = JSON.parse(text);
+        return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+    }
+    catch {
+        return null;
+    }
+};
+/** For each run id given (the tiles already in this viewer's answer), the viewer's lead chat that filed its task. */
+export function leadFiledLinks(store, viewer, runIds) {
+    const links = new Map();
+    const db = store.handle;
+    // The viewer's own personal threads (never a team conversation's), by id.
+    const threads = new Map();
+    for (const row of db.prepare(`SELECT id, scope_kind FROM lead_thread WHERE approver = ? AND NOT EXISTS (SELECT 1 FROM team_conversation tc WHERE tc.thread = lead_thread.id)`).all(viewer)) {
+        const kind = row["scope_kind"];
+        threads.set(Number(row["id"]), kind === "project" ? "project" : kind === "task" ? "task" : "lead");
+    }
+    if (threads.size === 0)
+        return links;
+    // Each run's family root, proved once per task (attempts of one task share it), and only roots the viewer filed
+    // through the lead as a person go further.
+    const rootOfTask = new Map();
+    const runRoots = new Map();
+    const repos = new Map();
+    const refRow = db.prepare("SELECT repo, filed_via, filed_by, filed_by_kind FROM task_ref WHERE backend = ? AND external_id = ?");
+    for (const runId of runIds) {
+        const row = db.prepare("SELECT r.backend, r.external_id FROM run JOIN task_ref r ON r.id = run.task_ref WHERE run.id = ?").get(runId);
+        if (row === undefined || row["backend"] !== BUILT_IN)
+            continue;
+        const task = String(row["external_id"]);
+        if (!rootOfTask.has(task))
+            rootOfTask.set(task, rootOf(store, task));
+        const root = rootOfTask.get(task);
+        if (root === null || root === undefined)
+            continue;
+        if (!repos.has(root)) {
+            const ref = refRow.get(BUILT_IN, root);
+            // Filed through the lead, by the viewer, as a person.
+            const filed = ref !== undefined && ref["filed_via"] === "mate" && ref["filed_by_kind"] === "person" && ref["filed_by"] === viewer && typeof ref["repo"] === "string";
+            repos.set(root, filed ? String(ref["repo"]) : "");
+        }
+        if (repos.get(root) !== "")
+            runRoots.set(runId, root);
+    }
+    const roots = [...new Set(runRoots.values())];
+    if (roots.length === 0)
+        return links;
+    // Every confirmed task card in the viewer's own threads naming one of these roots: ONE read per request, through the
+    // viewer's threads (lead_thread by approver, lead_proposal by thread and state), never once per family.
+    const found = new Map(roots.map(root => [root, []]));
+    const spoiled = new Set();
+    const cards = db.prepare(`SELECT p.thread, p.resolved_by, p.payload_json, p.outcome_json, json_extract(p.outcome_json, '$.taskId') AS task FROM lead_proposal p
+    JOIN lead_thread t ON t.id = p.thread WHERE t.approver = ? AND p.kind = 'task' AND p.state = 'confirmed' AND json_valid(p.outcome_json)
+    AND json_extract(p.outcome_json, '$.taskId') IN (${roots.map(() => "?").join(",")})`).all(viewer, ...roots);
+    for (const row of cards) {
+        const root = String(row["task"]);
+        const outcome = parse(row["outcome_json"]), payload = parse(row["payload_json"]);
+        // The door's own outcome (the model writes only the payload), confirmed by the viewer, for this project.
+        if (outcome?.["ok"] !== true || outcome["kind"] !== "task" || outcome["taskId"] !== root || row["resolved_by"] !== viewer || payload?.["repo"] !== repos.get(root))
+            spoiled.add(root);
+        else
+            found.get(root)?.push(Number(row["thread"]));
+    }
+    // A sweep links while the card that started it is kept, as a task card does: ending a chat (or revocation) erases its
+    // cards, and with them every link it made — one retention rule for both.
+    const sweeps = db.prepare(`SELECT k.root_task, s.owner, s.thread, s.repo, p.thread AS card_thread, p.state AS card_state, p.resolved_by AS card_by
+    FROM lead_sweep_task k JOIN lead_sweep s ON s.id = k.sweep LEFT JOIN lead_proposal p ON p.id = s.proposal
+    WHERE k.root_task IN (${roots.map(() => "?").join(",")})`).all(...roots);
+    for (const row of sweeps) {
+        const root = String(row["root_task"]);
+        if (row["owner"] !== viewer || row["repo"] !== repos.get(root) || row["thread"] === null || row["card_thread"] !== row["thread"] || row["card_state"] !== "confirmed" || row["card_by"] !== viewer)
+            spoiled.add(root);
+        else
+            found.get(root)?.push(Number(row["thread"]));
+    }
+    for (const [runId, root] of runRoots) {
+        // Exactly one record, nothing amiss beside it, naming one of the viewer's own personal threads.
+        const named = found.get(root) ?? [];
+        if (spoiled.has(root) || named.length !== 1)
+            continue;
+        const chat = threads.get(named[0]);
+        if (chat !== undefined)
+            links.set(runId, { thread: named[0], chat });
+    }
+    return links;
+}

package/dist/server/agents-live-room.js

@@ -11,6 +11,7 @@ import { closeSync } from "node:fs";
 import { agentsLiveOf } from "../agents-live.js";
 import { createLiveRooms } from "../live-bus.js";
 import { openLiveTrusted } from "../live-open.js";
+import { leadFiledLinks } from "./agents-live-filed.js";
 import { requestContext } from "./request-context.js";
 /** How often a viewer's runs and files are looked at again. */
 export const LIVE_POLL_MS = 2_000;
@@ -79,7 +80,9 @@ export function createAgentsLiveRooms(input) {
                 return repo !== null && visible(repo) && store.accountCanAccess(account, repo);
             };
             const kept = new Set(tiles.filter(tile => still(tile.runId)).map(tile => tile.runId));
-            const seen = tiles.filter(tile => kept.has(tile.runId)).map(tile => [tile.runId, tile.state, tile.why, tile.endedAt]);
+            // Which of the viewer's own lead chats filed each run (agents-live-filed.ts): a link made or erased is a change too.
+            const filed = leadFiledLinks(store, account, [...kept]);
+            const seen = tiles.filter(tile => kept.has(tile.runId)).map(tile => [tile.runId, tile.state, tile.why, tile.endedAt, filed.get(tile.runId)?.thread ?? null]);
             const shownMarks = marks.filter(([runId]) => kept.has(runId) && (!tiles.find(tile => tile.runId === runId)?.local || sees(runId)()));
             return createHash("sha256").update(JSON.stringify([seen, shownMarks, input.leads?.(key) ?? null])).digest("base64url");
         });