toolroll 0.9.76 → 0.9.78

package/CHANGELOG.md

@@ -1,5 +1,278 @@
 # Changelog
 
+## 0.9.78 — 2026-10-29
+
+- **Toolroll says when it is restarting.** The worker and console now record
+  when they start, keep a heartbeat every 15 seconds, and record when they
+  begin stopping and when they have stopped. While one is stopping it takes no
+  new work, `/healthz` answers "draining" at once, pages say "Toolroll is
+  restarting", and a new start waits only until the old one has finished
+  stopping instead of a fixed window. A worker that stopped cleanly never
+  holds its projects. A second live `up` is still refused.
+- **The database is copied every few minutes.** Besides scheduled backups,
+  the worker copies the database online every 5 minutes (change it, or the
+  folder, in Settings → Backups), checks each copy and keeps the newest 24
+  and one a day for a week. It never holds up the console or the worker. A
+  deploy uses the latest copy when it is recent and matches the database
+  exactly, instead of making a new one. Restoring stays a manual
+  `toolroll restore`.
+- **See where the time went.** A task's page has a "Where the time went"
+  section under Details: when each part of its release check started and
+  ended, and each step of its deploys, including what a deploy waited for.
+  Console pages that take over a second keep a short record of where the
+  time went, which an instance operator reads on `/health`. Only page names,
+  step names and reasons are kept, never addresses or form contents.
+- **A crashed worker is noticed in a minute, not three.** Workers check in
+  every 15 seconds and are treated as gone after a minute of silence. A
+  project lease is never taken for longer than a minute.
+- **A release's version bump alone no longer owes the upgrade path.** Toolroll
+  now decides from both commits' verified files that package.json and
+  package-lock.json changed only in the project's own version (the check's
+  own rule); any other change to them still owes it.
+- **The macOS suite runs on the candidate before it merges.** Pull requests
+  and main pushes now run the unit suite on hosted macOS with Node 22 and 24,
+  in four shards each, joined into `node 22 · macos-latest` and
+  `node 24 · macos-latest` exactly like the Linux checks. `toolroll release`
+  waits for them; main's protection not requiring them yet is reported, not
+  refused. After the merge, publication waits only for the tag's publish job,
+  no longer for main's own CI run on the merge commit. The nightly and tag
+  macOS jobs are renamed so no other workflow shares a required name.
+- **A release is published without waiting for Homebrew.** `toolroll release`
+  ends with "Published; Homebrew pending" once npm and the GitHub release are
+  verified, instead of waiting up to 45 minutes for the tap's checks. Homebrew
+  is its own state in the release journal (pending, failed or current), and
+  running the same command again finishes it: it waits for the tap change's
+  checks, then merges exactly that change, with the checksum still taken from
+  npm's tarball. A tap already on a newer version is never moved back, checked
+  again right before the merge.
+- **A release whose checks run outside the sandbox now reruns its own check
+  after Toolroll's machine fails.** Such a release can't carry later commits,
+  so it used to file without release terms, and a check stopped by Toolroll's
+  own shutdown, a lost build or a command that never started waited for a
+  person. Its approval now seals a release check purpose instead: the check
+  is held to the release's rules (a complete report, no CI standing in for
+  its units), and only a failure Toolroll itself confirmed as its own
+  infrastructure reruns, on the same commit under the same approval, at most
+  twice. Another commit, a changed scope, release check or check access, or
+  an approval that no longer stands never reruns. It never carries a later
+  commit. (Schema v138 adds the column; saved scopes are unchanged.)
+- **A deploy no longer gets stuck behind an `up` that won't stop.** When the
+  old service's processes outlive their stop (a supervisor that exited while
+  its `up` ignored SIGTERM), the deployment stops them itself, but only
+  processes proved, by exact runtime path and arguments, to be that service's
+  supervisor, `up` or console and worker. Anything it can't prove refuses and
+  nothing is signalled.
+- **A killed `up` no longer blocks the next start for three minutes.** `up`
+  records each process it gives its worker credential to. A new start that
+  proves every one of them has exited signs the old worker off and takes over
+  at once; a second live `up` is still refused.
+- **`up` signs off however it is stopped.** SIGTERM, Ctrl-C, its supervisor
+  dying or its channel closing all end with the worker retired. A stop that
+  hangs past the worker's grace stops the console and worker outright
+  instead of waiting for launchd to kill it.
+- **Deployments wait long enough, and say why.** Restoring the previous
+  service, starting the new one and waiting for its project leases now allow
+  two minutes (past a stale worker heartbeat's one) and name what they are
+  waiting for. "Current work must finish first" now says what is running and
+  what to do.
+- **One command puts back a deployment that stopped half way.**
+  `toolroll release --recover-deploy` shows what recovery will do for the
+  unfinished deployment; `--yes` does it: stops only that service's proved
+  leftovers, starts the previous service again and lifts the update pause.
+  It is safe to run again.
+
+## 0.9.77 — 2026-10-29
+
+- **CI finishes in about a third of the time.** The unit suite runs in four
+  shards per Node version instead of one 14–21 minute job. The required
+  checks keep their names ("node 22 · ubuntu-latest", "node 24 ·
+  ubuntu-latest") and pass only when every shard passed on the tested commit
+  and the shards together ran every test file once, so main's branch
+  protection needs no change. A flaky shard reruns in minutes, not twenty.
+- **The release check's real-model journeys start sooner.** They run in the
+  browser lanes as soon as the scripted journeys end, instead of also waiting
+  for the unit suite; the check's load budget is unchanged.
+- **An automatic release checks while CI runs.** With "Approve automatically
+  when checks pass" on, the release files its task and runs its check beside
+  CI instead of after it. Toolroll approves it only once every pull request
+  check passed on the commit.
+- **A release asks for your approval while CI runs.** `toolroll release` files
+  the release task and asks you right away instead of waiting for GitHub's
+  checks; after you approve, the release check runs beside CI. The approval
+  says "GitHub's checks are still running; nothing deploys until they pass."
+  Nothing is deployed, merged, tagged or published until every required check
+  passed on the exact commit, read again right before the deploy; if one
+  fails, the release stops before the deploy. A check that already failed
+  still stops the release before anyone is asked.
+- **The console stays responsive while builds and checks run.** `toolroll up`
+  now runs two processes: the console (pages, sign-in and approvals) and the
+  worker (builds, checks, follow-ups and housekeeping). On a copy of a real
+  database, the slowest console answer during a heavy check fell from about
+  5–6 seconds to under 0.3 seconds. A worker that crashes is started again
+  and recovers its interrupted work as a restarted `up` does; a stop still
+  lets running builds finish first. A running check's progress is saved at
+  most once a second, and its final result at once. `--single-process` keeps
+  the old one-process layout.
+- **Console pages open faster and stay quick while work runs.** The sidebar,
+  the Tasks count and the crew list are read once per database change for each
+  person instead of up to four times per page, and before a page is drawn they
+  are read on a background thread so the console keeps answering meanwhile.
+  The chat landing's lists are kept the same way, and the task page reuses its
+  "behind main" line for 15 seconds instead of asking Git twice per view. On a
+  copy of a real database: /board 348 → 26 ms, /agents 320 → 4 ms, /chat 905 →
+  19 ms, a task page 1.5 s → 0.2 s; with the database changing 40 times a
+  second, pages take 0.27–0.47 s and the console answers other requests in
+  about 1 ms (before: 0.35 s typical, up to 1.4 s). A page that re-reads after
+  a live update gets "unchanged" when nothing it shows changed.
+- **Fixes from the first review of the above.** CI's required checks now
+  judge the shards with the verifier from the base branch, run none of the
+  change's code, and fail when a shard executed no tests, its counts don't
+  add up, or it skips tests the base always ran; a required check counts only
+  from the CI workflow, never a same-named job elsewhere. A release filed
+  while CI runs can't be approved by anyone until Toolroll itself saw CI pass,
+  and you're asked only then. A worker that crashes while a removed project is
+  still finishing recovers that project's work before anything new starts. A
+  deploy waits until the console and the worker have both exited. A worker or
+  console that refuses to start again stops `toolroll up` instead of
+  restarting forever. A check's final progress is kept until it's saved.
+
+
+- **Sandboxed commands no longer hang on macOS 26.5.** The fence denies most
+  macOS system services and, by default, asked macOS to report each denial; on
+  macOS 26.5.2 about one denied lookup in 70 never returned while that report
+  was made, so a sandboxed `npm ci`, `npm pack` or any Node program setting up
+  DNS could hang forever (a release carry until its 20-minute timeout). Denials
+  are now made without the report; nothing the fence allows or denies changed.
+- **The console is fast again.** 0.9.76's release-approval setting was read by
+  walking a project's whole action ledger once per task row, and every page's
+  sidebar runs that list four times, so each page blocked the console for about
+  3 seconds (more with tabs open while anything builds). It now reads the
+  setting rows through an existing index: pages went from about 2 s to about
+  0.4 s on a real database. Sizing build checkouts every half hour no longer
+  freezes the console either.
+- **A release check's result is always saved.** The release check's streamed
+  part lines now carry a tag no Toolroll version misreads as a journey's own
+  line; an older console counted them twice, built a progress snapshot it then
+  refused, and the refusal stopped the check's log and result from being saved
+  (the check read as "unavailable"). A progress update that fails to save can
+  no longer stop sealing, and a result that can't be saved says so on the run.
+- **A renamed or dropped CI job no longer hides its failure.** Every failed
+  attempt on a commit is judged before newer runs replace older ones, so a
+  job a newer run renamed or dropped can't erase a test failure from an
+  automatic approval. The Windows containment repeat job keeps one name
+  whatever its count.
+- **Toolroll decides what a Full release check owes.** Before the check runs,
+  Toolroll works out from its own record of the last release which parts it
+  owes (units, scripted and real-model journeys, upgrades), seals that, and
+  tells the check, which runs at least those. Every owed part needs a result,
+  whatever the check's report says it selected. CI never stands in for a
+  release's unit suite, and a journey or upgrade run that listed nothing it
+  ran is no result.
+- **Missing evidence is unknown, not clean.** What passed only on a retry is
+  sealed in the check's receipt. If a check's report is lost or damaged, its
+  retries are unknown and nothing approves itself; the receipt's report and
+  inventory files are checked byte for byte. A check that passed only when
+  rerun after the approved setup counts as a retry, and the setup rerun only
+  happens when the check never started.
+- **Merging checks main on GitHub itself.** A release reads main's head and
+  compares the branch through GitHub's API, never a local ref, and reads
+  main again right before merging. Releases approve themselves only while
+  main's branch protection requires branches to be up to date before
+  merging; without it, a person's release says which setting to turn on.
+  Toolroll only reads that setting.
+- **No lazy fetch on any supported git.** Protected Git reads (the release's
+  object reader and extraction, project knowledge and learning, the task
+  base, release coverage, review screenshots, grants) run through a frozen
+  copy of the repository's config on every git version, refuse every
+  network transport and are time-bounded, so an include, a partial clone or
+  a planted filter can't fetch, run or hang anything. The deployment script
+  reads a commit's files with no filter or attribute applied. CI's oldest-git
+  lane now tests git 2.41.0 exactly.
+- **Main's protection must actually hold.** A release now reads main's whole
+  branch protection and rulesets and counts them only when they require
+  branches to be up to date, require the release's CI checks, and can't be
+  bypassed by the account that merges ("Do not allow bypassing the above
+  settings"; no ruleset bypass for a role, team, app or organization admin).
+  A person's release names exactly what is missing, and says which new CI
+  checks main's protection doesn't require yet.
+- **Deployment reads only verified objects, with none of the repository's
+  config.** The deployment script hashes the commit and every tree as well
+  as every file against their ids, and runs git on a copy of the
+  repository's layout with a config of its own, so a corrupted tree, a
+  config change mid-read or a custom transport helper can't substitute files
+  or fetch anything.
+- **An unreadable last release never shrinks a check.** When the last
+  release Toolroll recorded can't be verified, the release check doesn't
+  run and says so, and the release card's change list reads "couldn't be
+  read", instead of acting as if there were no previous release.
+- **Setup recovery needs proof the check never started.** The approved setup
+  reruns a check only when Toolroll itself found the check's program missing
+  before starting it and the shell said exactly that and nothing else. Any
+  other failure is the check's own result for a person to judge, and a
+  release after a setup rerun says why the first attempt failed.
+- **Dispatch and coding handoffs can't be held up by a project's Git
+  config.** The worktree binding reads Git's registry as plain files, and the
+  handoff's branch read is bounded and runs outside its database
+  transactions.
+- **A release check that's cut short still leaves its evidence.** Every
+  part of the release check (typecheck, build, units, journeys, upgrades)
+  now prints its output as it runs, each line tagged with its part (and
+  upgrade version), instead of only at the very end. Each part's end is
+  recorded with its start time, exit code, signal, timeout and whether it
+  was stopped, and a failing upgrade version's own log is printed the moment
+  it fails. Release check 3261 was stored as "exit 1" with nothing but its
+  header: a signal had ended it, the plane recorded the signal as a plain
+  exit 1, and the parts' output was still waiting to be printed. A command
+  ended by a signal, or by Toolroll's own shutdown, now says so.
+- **No complete result, no pass.** A release's Full check counts only with
+  its valid report (carrying that run's secret), a result for every part,
+  unit file, journey group and upgrade version it owed, and a successful
+  exit. A missing, malformed, cut-short or incomplete report is an error
+  ("no result"), never a pass.
+- **Failures are classed, and only Toolroll's own infrastructure is rerun.**
+  The flat "two flakes" allowance is gone. A failing test, typecheck, build,
+  attack test or upgrade is never rerun to pass: fix the branch. A failure
+  Toolroll itself confirms as infrastructure (the check never started, the
+  worker lost the build, Toolroll's shutdown stopped it, or a GitHub job
+  whose runner failed before any of its steps ran) is checked again on the
+  same commit under the same approval, at most once per incident and twice
+  per commit, with no new approval. An unexplained failure blocks: a
+  diagnostic rerun may run, but its pass doesn't erase the failure, so you
+  decide. Real-model journeys are counted, never rerun until they pass, and
+  one that passed only on a retry is now reported (an automatic approval
+  won't approve it). `toolroll release` says which of these happened and
+  what to do next, instead of always asking for `--new`.
+- **A password that starts with "--" works on the command line.** About one
+  minted password in 4096 began with "--", and `toolroll release publish-ok`
+  (and other commands) read it as a missing value. A `--token` or
+  `--password` value is now always the next argument, `--token=<value>`
+  works everywhere, and new passwords, invites and tokens never start with
+  "-".
+- **CI tests the commit a release trusts.** Every pull-request job now checks
+  out the pull request's own head commit, not the merge commit GitHub makes,
+  and proves it before building.
+- **Git 2.41 or newer is required, and tested.** Toolroll's hardened git reads
+  need `git --attr-source`, which arrived in git 2.41. `toolroll up`, `serve`
+  and `watch` won't start on an older git, and `toolroll doctor` names it,
+  each with the installed and the required version. Git 2.41 to 2.44 has no
+  `--no-lazy-fetch`: there Toolroll leaves it out and instead refuses a
+  project that is a partial clone for protected reads ("this project is a
+  partial clone; protected reads need git 2.45 or newer"), judged from the
+  frozen copy of the config git then runs with (never checked, then run),
+  and every read still refuses all network protocols.
+  Two CI jobs run the git attack and worktree tests on git 2.41 and 2.47, as
+  an unprivileged user, fail if any test is skipped, and are now required
+  for a release.
+- **A release branch must contain main.** CI tests the pull request's own
+  commit, so `toolroll release` refuses a branch that doesn't contain main's
+  head ("the branch is behind main; update it and push"), at the gate before
+  anything is filed and again right before the merge.
+- **Tests can't lean on a guessed git identity.** Each test's home tells git
+  never to guess a name and email from the host, so a test that commits
+  without setting one fails on a Mac just as it would on Linux CI.
+- **Two timing-sensitive tests now wait for events.** The read-worker test and
+  the watch recovery test no longer fail when a busy machine runs slowly.
+
 ## 0.9.76 — 2026-10-28
 
 - **Releases can approve themselves when they're green.** A new per-project

package/README.md

@@ -34,7 +34,7 @@ npx toolroll up
 ```
 
 That starts the app and a builder for your projects, then opens the console
-at http://127.0.0.1:4180. Runs on macOS or Linux with Node.js 22.13+ and git.
+at http://127.0.0.1:4180. Runs on macOS or Linux with Node.js 22.13+ and git 2.41+.
 Try the sandbox first with `npx toolroll demo`: ask its scripted lead for a
 change in Chat, approve the plan, and watch it land Ready. It never calls a
 model, spends or reaches outside.
@@ -275,9 +275,16 @@ npx toolroll up --project-root ~/Projects    # or: bunx toolroll up
 
 That is the install and the setup. It needs Node 22.13 or newer on the
 machine (Bun's runtime has no `node:sqlite`; `bunx` hands the shebang to
-Node, so it works too). `npm install -g toolroll` gives you the
-bare `toolroll` command for later (`standing-orders`, the older name, still
-works).
+Node, so it works too), and git 2.41 or newer: Toolroll reads agent-written
+checkouts with `git --attr-source`, which older git refuses, and `toolroll
+up`, `serve`, `watch` and `doctor` say so when the installed git is older.
+Ubuntu 24.04 ships 2.43, which works; Debian 12 ships 2.39: install a newer
+one there. On git older than 2.45 (no `git --no-lazy-fetch`), a project that
+is a partial clone (`git clone --filter=…`) is refused for Toolroll's
+protected reads: use git 2.45 or newer for those, or a full clone. CI runs
+the git tests on 2.41 and on 2.47.
+`npm install -g toolroll` gives you the bare `toolroll` command for later
+(`standing-orders`, the older name, still works).
 
 `up` prints your login once (and saves it beside the database as
 `up-login.txt`), opens the app in your browser, and connects this machine as

package/THIRD_PARTY_NOTICES.md

@@ -247,14 +247,14 @@ limitations under the License.
 
 ## shadcn/ui — MIT
 
-Button and Dialog composition in `src/browser/ui/primitives.tsx` adapts:
+Dialog composition in `src/browser/ui/primitives.tsx` adapts:
 https://github.com/shadcn-ui/ui/tree/a87a63b2ca25143d26c8bd0903e4e9bc77b3f824/apps/v4/registry/new-york-v4/ui
 
 Source inspected 20 September 2026, revision
-`a87a63b2ca25143d26c8bd0903e4e9bc77b3f824`, files `button.tsx` and
-`dialog.tsx`. Adaptations replace Tailwind/CVA with local class variants, use
-individual Radix packages, default buttons to type=button, and leave dialog
-close controls to the calling surface. Radix supplies focus and dismissal behavior.
+`a87a63b2ca25143d26c8bd0903e4e9bc77b3f824`, file `dialog.tsx`. Adaptations
+replace Tailwind/CVA with local class variants, use individual Radix packages,
+and leave dialog close controls to the calling surface. Radix supplies focus
+and dismissal behavior.
 
 The rebuilt views (23 September 2026) add `src/browser/components/ui/`:
 button, badge, card, tabs, radio-group, select, switch, label, input,

package/dist/agent-fence.js

@@ -25,7 +25,7 @@ import { INSTANCE_DIR } from "./console-instance.js";
 import { ACP_AGENTS, ACP_PROVIDER_IDS } from "./acp-agents.js";
 import { spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
-import { existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, realpathSync, statSync, writeFileSync } from "node:fs";
+import { closeSync, constants as fsConstants, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readdirSync, readFileSync, realpathSync, statSync, writeFileSync } from "node:fs";
 import { createRequire } from "node:module";
 import { fileURLToPath } from "node:url";
 import { homedir, tmpdir } from "node:os";
@@ -33,6 +33,7 @@ import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "nod
 import { readMonitoring } from "./monitoring-settings.js";
 import { existingFolders } from "./names.js";
 import { ensureGitViewsRoot, gitViewsRoot } from "./git-views.js";
+import { ensureRunnerProcessFolder, RUNNER_PROCESS_DIR } from "./runner-process.js";
 import { DEPS_FOLDER, linkedKey, readyCopy, sharedCopies } from "./shared-deps.js";
 import { SEATBELT_PROBE, sandboxRuntimeProblem, srtSpawn } from "./sandbox-runtime.js";
 import { protectedStorageDenies, protectedStorageNames } from "./protected-storage.js";
@@ -53,6 +54,22 @@ function inside(child, parent) {
 }
 export class CheckoutBindingError extends Error {
 }
+/** One small file read only as the regular file it is: never through a link, never blocking on a FIFO; null otherwise. */
+function regularText(path) {
+    let fd = null;
+    try {
+        fd = openSync(path, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW | fsConstants.O_NONBLOCK);
+        const held = fstatSync(fd);
+        return held.isFile() && held.size <= 64 * 1024 ? readFileSync(fd, "utf8") : null;
+    }
+    catch {
+        return null;
+    }
+    finally {
+        if (fd !== null)
+            closeSync(fd);
+    }
+}
 export const HARDENED_GIT_ARGS = ["--no-optional-locks", "-c", "core.fsmonitor=false", "-c", "core.hooksPath=/dev/null"];
 const GIT_ENV_NAMES = ["PATH", "HOME", "TMPDIR", "TMP", "TEMP", "SystemRoot", "LANG", "LC_ALL", "CODEX_HOME"];
 export function checkoutGitEnv(base = process.env) {
@@ -86,18 +103,20 @@ export function trustedWorktreeBinding(repository, worktree, poolRoots = []) {
         }
         if (!lstatSync(join(main, ".git")).isDirectory() || !lstatSync(registry).isDirectory())
             throw fail();
-        // Query the trusted checkout, never the candidate's configurable Git pointer.
-        const listed = spawnSync("git", [...HARDENED_GIT_ARGS, "worktree", "list", "--porcelain", "-z"], { cwd: main, env: checkoutGitEnv(), encoding: "utf8" });
-        if (listed.status !== 0 || !listed.stdout.split("\0").includes(`worktree ${checkout}`))
-            throw fail();
+        // The trusted checkout's own worktree registry, never the candidate's configurable Git pointer — read as files, with
+        // no git at all (eval-harness review 2, finding 6): the repository's config is shared with every build, so an
+        // include naming a FIFO could hold a git read (and dispatch) up; a FIFO or link planted as a registry file is never
+        // opened as one (regularText).
         for (const entry of readdirSync(registry)) {
             const path = join(registry, entry);
             if (!lstatSync(path).isDirectory() || !inside(real(path), real(registry)))
                 continue;
-            if (real(readFileSync(join(path, "gitdir"), "utf8").trim()) !== join(checkout, ".git"))
+            const pointer = regularText(join(path, "gitdir"));
+            if (pointer === null || real(pointer.trim()) !== join(checkout, ".git"))
                 continue;
             const gitdir = real(path);
-            if (worktreeGitDir(checkout) !== gitdir || real(join(gitdir, readFileSync(join(gitdir, "commondir"), "utf8").trim())) !== real(join(main, ".git")))
+            const common = regularText(join(gitdir, "commondir"));
+            if (common === null || worktreeGitDir(checkout) !== gitdir || real(join(gitdir, common.trim())) !== real(join(main, ".git")))
                 throw fail();
             return { main, gitdir };
         }
@@ -149,6 +168,21 @@ export function agentFence(options) {
             catch { /* fenced below either way */ }
         }
         fence.add(runFolder);
+        const runnerFolder = join(state, RUNNER_PROCESS_DIR);
+        try {
+            ensureRunnerProcessFolder(runnerFolder);
+        }
+        catch { /* both the name and its target stay denied */ }
+        fence.add(runnerFolder);
+        fence.add(real(runnerFolder));
+        // A copy may first appear after launch. Fence its permanent namespace even when empty.
+        const backups = join(state, "backups");
+        try {
+            mkdirSync(backups, { mode: 0o700 });
+        }
+        catch { /* name and target remain denied */ }
+        fence.add(backups);
+        fence.add(real(backups));
         // Only a folder that is Toolroll's own (~/.config/toolroll or an older name,
         // the desktop app's "Toolroll") is fenced whole: a database kept
         // in a shared folder (a projects folder, a test's temp folder) must not
@@ -196,7 +230,7 @@ export function agentFence(options) {
     // Secret, state, database, explicit-extra and home-config denies are never exemptible.
     for (const path of options.boundary?.protectedShell ?? [])
         fence.add(real(path));
-    const protectedPaths = new Set([...fence].flatMap(path => path === runFolder ? [path, real(path)] : [real(path)]));
+    const protectedPaths = new Set([...fence].flatMap(path => path === runFolder || [RUNNER_PROCESS_DIR, "backups"].includes(basename(path)) ? [path, real(path)] : [real(path)]));
     // Protected storage (chat apps, browser profiles, password managers): every launch, every policy, never exemptible,
     // kept by the name it was resolved under as well as where it leads.
     const storage = options.protectedStorage ?? protectedStorageDenies(home);
@@ -208,7 +242,7 @@ export function agentFence(options) {
         fence.add(path);
     const binding = options.binding;
     const needed = binding === undefined || binding === null ? [] : [binding.gitdir, real(join(binding.main, ".git"))];
-    return [...new Set([...[...fence].flatMap(path => path === runFolder ? [path, real(path)] : [real(path)]), ...storage.flatMap(path => [path, real(path)])])].filter(path => {
+    return [...new Set([...[...fence].flatMap(path => path === runFolder || [RUNNER_PROCESS_DIR, "backups"].includes(basename(path)) ? [path, real(path)] : [real(path)]), ...storage.flatMap(path => [path, real(path)])])].filter(path => {
         if (protectedPaths.has(path) || !needed.some(target => target === path || inside(target, path)))
             return true;
         console.warn(`Dropped build fence entry covering this checkout's own Git data: ${path}`);
@@ -670,7 +704,9 @@ export function fencedGitEnv(base = process.env) {
 /** The repository a git worktree belongs to (its `.git` file names the main repository's git folder). */
 function worktreeGitDir(worktree) {
     try {
-        const pointer = /^gitdir:\s*(.+)$/m.exec(readFileSync(join(worktree, ".git"), "utf8"))?.[1]?.trim();
+        // The candidate's own pointer file: a FIFO or link there is never opened (review 2, finding 6).
+        const text = regularText(join(worktree, ".git"));
+        const pointer = text === null ? undefined : /^gitdir:\s*(.+)$/m.exec(text)?.[1]?.trim();
         return pointer === undefined ? null : real(isAbsolute(pointer) ? pointer : join(worktree, pointer));
     }
     catch {

package/dist/assignment.js

@@ -140,6 +140,9 @@ function buildChecks(store, root, runId) {
         if (receipt.result.failure === "coverage-incomplete")
             return { status: "failed", exitCode: null, command: receipt.command.command, logArtifactId: receipt.log.artifactId, level,
                 detail: "Checks didn't cover everything this release owed, or a required test went missing." };
+        if (receipt.result.failure === "no-result")
+            return { status: "failed", exitCode: null, command: receipt.command.command, logArtifactId: receipt.log.artifactId, level,
+                detail: "Checks gave no complete result, so they can't count as a pass." };
         // The sealed receipt names the grant that ran: the quick one, or the full one.
         const sealedLevel = typeof receipt.command?.repo === "string" && receipt.command.repo.startsWith("quick:") ? "quick" : "full";
         const words = sealedLevel === "quick" ? "Quick checks" : "Checks";

package/dist/backup-ui.d.ts

@@ -4,9 +4,11 @@
  * disclosures.
  */
 import { type Html } from "./html.js";
-import type { BackupRun, BackupSettings } from "./store.js";
+import type { BackupRun, BackupSettings, LiveBackupState } from "./store.js";
 /** The schedules on offer and the most copies kept. Here rather than in backup.ts so the page never loads `node:sqlite`. */
 export declare const BACKUP_EVERY_HOURS: readonly [1, 6, 12, 24];
+/** The continuous copy's choices, in minutes (live-backup.ts LIVE_EVERY_MINUTES; here so the page never loads it). */
+export declare const LIVE_EVERY: readonly [1, 5, 15, 30];
 export declare const MAX_KEEP = 100;
 export declare const BACKUP_CSS: string;
 export type BackupView = {
@@ -16,6 +18,12 @@ export type BackupView = {
     runs: BackupRun[];
     csrf: string;
     now: Date;
+    /** The continuous copy (live-backup.ts): its settings, latest verified copy and folder. */
+    live?: {
+        state: LiveBackupState;
+        folder: string;
+        defaultFolder: string;
+    };
 };
 export declare function backupHtml(view: BackupView, notice: {
     said?: string | null;

package/dist/backup-ui.js

@@ -8,6 +8,8 @@ import { bytesWords } from "./storage.js";
 import { whenUtc } from "./when-html.js";
 /** The schedules on offer and the most copies kept. Here rather than in backup.ts so the page never loads `node:sqlite`. */
 export const BACKUP_EVERY_HOURS = [1, 6, 12, 24];
+/** The continuous copy's choices, in minutes (live-backup.ts LIVE_EVERY_MINUTES; here so the page never loads it). */
+export const LIVE_EVERY = [1, 5, 15, 30];
 export const MAX_KEEP = 100;
 const when = (at) => whenUtc(at);
 const whenWords = (at) => `${at.slice(0, 16).replace("T", " ")} UTC`;
@@ -23,6 +25,19 @@ export const BACKUP_CSS = `.backups{max-width:720px;min-width:0;overflow-wrap:an
     `.backups li{display:flex;gap:8px 12px;flex-wrap:wrap;padding:8px 0;border-top:1px solid var(--line, rgba(0,0,0,.08));font-size:.875rem}` +
     `.backups li .failed{color:var(--danger)}.backups code{white-space:nowrap}.backups pre{overflow-x:auto;margin:8px 0}` +
     `@media (max-width:900px){.backups .backup-state form,.backups .backup-state button{width:100%}.backups .pair{grid-template-columns:1fr}}`;
+/** The continuous copy in one line: its latest verified copy, or why there is none. */
+function liveLine(view) {
+    const live = view.live;
+    if (live === undefined)
+        return "";
+    if (!live.state.settings.enabled)
+        return html `<p class="meta">Continuous copy is off.</p>`;
+    if (live.state.problem !== null)
+        return html `<p class="problem" role="alert">The continuous copy failed: ${live.state.problem}</p>`;
+    if (live.state.latest === null)
+        return html `<p class="meta">The first continuous copy is made within a few minutes of Toolroll starting.</p>`;
+    return html `<p class="meta" data-live-copy>Continuous copy checked ${when(live.state.latest.madeAt)}, every ${live.state.settings.everyMinutes === 1 ? "minute" : `${live.state.settings.everyMinutes} minutes`}.</p>`;
+}
 /** The state in one line, and the next backup (if any), for the top of the page. */
 function state(view) {
     const last = view.runs[0];
@@ -31,13 +46,13 @@ function state(view) {
         : good === undefined ? "The first scheduled backup runs within a minute or two of the console starting."
             : `Next one about ${whenWords(new Date(Date.parse(good.startedAt) + view.settings.everyHours * 3_600_000).toISOString())}.`;
     if (last === undefined)
-        return html `<h2>No backups yet</h2><p class="meta">${next}</p>`;
+        return html `<h2>No backups yet</h2><p class="meta">${next}</p>${liveLine(view)}`;
     if (last.ok === null)
         return html `<h2>Backing up</h2><p class="meta">Started ${when(last.startedAt)}.</p>`;
     if (last.ok === false) {
         return html `<h2 data-backup-state="failed">Last backup failed</h2><p class="problem" role="alert">${when(last.startedAt)}: ${last.error ?? "no reason was recorded"}</p><p class="meta">${good === undefined ? "No backup has succeeded yet." : html `Last good backup ${when(good.startedAt)}.`} ${next}</p>`;
     }
-    return html `<h2 data-backup-state="ok">Backed up ${when(last.startedAt)}</h2><p class="meta">${last.bytes === null ? "" : `${bytesWords(last.bytes)} · `}${next}</p>`;
+    return html `<h2 data-backup-state="ok">Backed up ${when(last.startedAt)}</h2><p class="meta">${last.bytes === null ? "" : `${bytesWords(last.bytes)} · `}${next}</p>${liveLine(view)}`;
 }
 export function backupHtml(view, notice) {
     const s = view.settings;
@@ -46,5 +61,15 @@ export function backupHtml(view, notice) {
         ...BACKUP_EVERY_HOURS.map(hours => html `<option value="${hours}"${s.enabled && s.everyHours === hours ? html ` selected` : ""}>${everyWords(hours)}</option>`)];
     const runs = view.runs.map(run => html `<li data-backup-run="${run.id}"><span>${when(run.startedAt)}</span>${run.ok === true ? html `<span>Succeeded${run.bytes === null ? "" : ` · ${bytesWords(run.bytes)}`}</span>${run.file === null ? "" : html `<span class="mono meta">${fileName(run.file)}</span>`}`
         : run.ok === false ? html `<span class="failed">Failed: ${run.error ?? "no reason recorded"}</span>` : html `<span>Running</span>`}<span class="meta">${run.trigger === "manual" ? "by hand" : "scheduled"}</span></li>`);
-    return html `<section class="backups">${note}<div class="card backup-state"><div>${state(view)}</div>${postForm("/settings/backups/now", html `<button type="submit">Back up now</button>`)}</div><h2>Schedule</h2>${postForm("/settings/backups", html `<fieldset><div class="pair"><label>Back up<select name="every">${choices}</select></label><label>Keep the newest<input type="number" name="keep" min="1" max="${MAX_KEEP}" step="1" value="${s.keep}" required></label></div><label>Folder<input type="text" name="folder" value="${s.folder ?? ""}" placeholder="${view.defaultFolder}" spellcheck="false"></label>${reauth(html `<label>Your Toolroll password<input type="password" name="password" autocomplete="current-password"></label>`)}</fieldset><button type="submit">Save</button>`)}<details><summary>Recent backups${view.runs.length === 0 ? "" : ` (${view.runs.length})`}</summary>${runs.length === 0 ? html `<p class="meta">None yet.</p>` : html `<ol>${runs}</ol>`}<p class="meta">In <span class="mono">${view.folder}</span>. Only the database is copied: provider keys and sign-in files stay out.</p></details><details><summary>Restore a backup</summary><p>Stop Toolroll, then run:</p><pre><code>toolroll restore &lt;file&gt; --dry-run</code></pre><p class="meta">The dry run checks the backup (its version and ledger chain) and changes nothing. Run it again without <code>--dry-run</code> to restore; the current database is kept as a copy first.</p></details></section>`;
+    return html `<section class="backups">${note}<div class="card backup-state"><div>${state(view)}</div>${postForm("/settings/backups/now", html `<button type="submit">Back up now</button>`)}</div><h2>Schedule</h2>${postForm("/settings/backups", html `<fieldset><div class="pair"><label>Back up<select name="every">${choices}</select></label><label>Keep the newest<input type="number" name="keep" min="1" max="${MAX_KEEP}" step="1" value="${s.keep}" required></label></div><label>Folder<input type="text" name="folder" value="${s.folder ?? ""}" placeholder="${view.defaultFolder}" spellcheck="false"></label>${liveFields(view)}${reauth(html `<label>Your Toolroll password<input type="password" name="password" autocomplete="current-password"></label>`)}</fieldset><button type="submit">Save</button>`)}<details><summary>Recent backups${view.runs.length === 0 ? "" : ` (${view.runs.length})`}</summary>${runs.length === 0 ? html `<p class="meta">None yet.</p>` : html `<ol>${runs}</ol>`}<p class="meta">In <span class="mono">${view.folder}</span>. Only the database is copied: provider keys and sign-in files stay out.</p></details><details><summary>Restore a backup</summary><p>Stop Toolroll, then run:</p><pre><code>toolroll restore &lt;file&gt; --dry-run</code></pre><p class="meta">The dry run checks the backup (its version and ledger chain) and changes nothing. Run it again without <code>--dry-run</code> to restore; the current database is kept as a copy first.</p>${view.live === undefined ? "" : html `<p class="meta">Continuous copies are in <span class="mono">${view.live.folder}</span>; restore one the same way.</p>`}</details></section>`;
+}
+/** The continuous copy's two choices, beside the schedule's: how often, and where (blank: beside the database). */
+function liveFields(view) {
+    const live = view.live;
+    if (live === undefined)
+        return "";
+    const on = live.state.settings;
+    const choices = [html `<option value="off"${on.enabled ? "" : html ` selected`}>Off</option>`,
+        ...LIVE_EVERY.map(minutes => html `<option value="${minutes}"${on.enabled && on.everyMinutes === minutes ? html ` selected` : ""}>${minutes === 1 ? "Every minute" : `Every ${minutes} minutes`}</option>`)];
+    return html `<div class="pair"><label>Copy continuously<select name="live_every">${choices}</select></label><label>Copy folder<input type="text" name="live_folder" value="${on.folder ?? ""}" placeholder="${live.defaultFolder}" spellcheck="false"></label></div>`;
 }

package/dist/backup.js

@@ -19,6 +19,7 @@ import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { createRequire } from "node:module";
 import { BACKUP_EVERY_HOURS, MAX_KEEP } from "./backup-ui.js";
 import { verifyLedgerChain } from "./ledger-chain.js";
+import { DEFAULT_LIVENESS_MS } from "./runner.js";
 import { openStore, readSchemaVersion, SCHEMA_VERSION } from "./store.js";
 /** A scheduled backup's name: the database it came from (see `databaseTag`), then when it was made. Backups made
  * before the tag was added have none. Retention only ever removes files named like this. */
@@ -28,8 +29,8 @@ export const OLDEST_RESTORABLE = 103;
 export { BACKUP_EVERY_HOURS, MAX_KEEP };
 /** How long the console's lease lasts without a renewal: a console that stopped holds it no longer than this. */
 const LEASE_MS = 3 * 60_000;
-/** A worker that heartbeat this recently is taken to be running. */
-const RUNNER_FRESH_MS = 3 * 60_000;
+/** A worker that heartbeat this recently is taken to be running (runner.ts DEFAULT_LIVENESS_MS). */
+const RUNNER_FRESH_MS = DEFAULT_LIVENESS_MS;
 export const defaultBackupFolder = (databaseFile) => join(dirname(databaseFile), "backups");
 export const backupFolderOf = (settings, databaseFile) => settings.folder ?? defaultBackupFolder(databaseFile);
 /** 2026-09-28T05:34:39.123Z → 2026-09-28-053439 (UTC). */
@@ -287,7 +288,7 @@ export async function restoreDatabase(options) {
         try {
             const running = runningNow(store, now);
             if (running.length > 0)
-                refuse("running", `Toolroll is running (${running.join(" and ")}). Stop it first, then restore. If it has just stopped, wait a few minutes.`);
+                refuse("running", `Toolroll is running (${running.join(" and ")}). Stop it first, then restore. If it has just stopped, wait a minute.`);
             folder = backupFolderOf(store.backupSettings(), databaseFile);
         }
         finally {

package/dist/browser/THIRD_PARTY_NOTICES.txt

@@ -247,14 +247,14 @@ limitations under the License.
 
 ## shadcn/ui — MIT
 
-Button and Dialog composition in `src/browser/ui/primitives.tsx` adapts:
+Dialog composition in `src/browser/ui/primitives.tsx` adapts:
 https://github.com/shadcn-ui/ui/tree/a87a63b2ca25143d26c8bd0903e4e9bc77b3f824/apps/v4/registry/new-york-v4/ui
 
 Source inspected 20 September 2026, revision
-`a87a63b2ca25143d26c8bd0903e4e9bc77b3f824`, files `button.tsx` and
-`dialog.tsx`. Adaptations replace Tailwind/CVA with local class variants, use
-individual Radix packages, default buttons to type=button, and leave dialog
-close controls to the calling surface. Radix supplies focus and dismissal behavior.
+`a87a63b2ca25143d26c8bd0903e4e9bc77b3f824`, file `dialog.tsx`. Adaptations
+replace Tailwind/CVA with local class variants, use individual Radix packages,
+and leave dialog close controls to the calling surface. Radix supplies focus
+and dismissal behavior.
 
 The rebuilt views (23 September 2026) add `src/browser/components/ui/`:
 button, badge, card, tabs, radio-group, select, switch, label, input,