toolroll 0.9.86 → 0.9.88

package/dist/store.js

@@ -96,6 +96,7 @@ import { LEDGER_COLUMNS, LEDGER_SCHEMA, LEDGER_TABLE, LEDGER_V99_TABLE, installL
 import { PLAN_AUTO_SCHEMA } from "./plan-auto.js";
 import { CONSOLE_INSTANCE_SCHEMA } from "./console-instance.js";
 import { endUnattendedGrants, FLOW_UNATTENDED_SCHEMA, grantStandsSql } from "./flow-unattended.js";
+import { flowChanged } from "./flow-changed.js";
 import { FLOW_BROWSER_SCHEMA } from "./flow-browser.js";
 import { RECIPE_SCHEMA } from "./recipes.js";
 import { POLICY_SCHEMA, agentRefusal, approvalRefusal, policyParts, readPolicy, underCeiling, sessionCeilingRefusal } from "./policy.js";
@@ -1101,7 +1102,9 @@ const REGISTERED_AT_FILING = "again, as it was filed";
 // version; no row is every saved task: not archived), the completed workflow runs on a watched branch the checks
 // trigger saw (branch_check_run), and the reservations that hold work back from being put away (merge_in_flight,
 // deploy_in_flight, flow_step_task; V145_SCHEMA, new tables only).
-export const SCHEMA_VERSION = 145;
+// v146 adds, and changes no saved row: each pull request check's own timing as GitHub last reported it for the head the
+// plane observed (ci_check), and each release step's start, end and outcome (release_step; V146_SCHEMA, new tables only).
+export const SCHEMA_VERSION = 146;
 /** v118: the tables merged into `credential`, in the order they move (a person's API tokens keep their ids first). */
 export const V118_MERGED_TABLES = Object.freeze({ api_token: "person", coordinator_credential: "coordinator", lead_credential: "lead" });
 /** The foreign keys that named a merged table, exactly as their DDL wrote them; each names `credential(id)` instead. */
@@ -1234,7 +1237,7 @@ const V115_DROPPED_REFERENCES = /\s+REFERENCES (?:contestant|contest|tournament_
  * unchanged), and adds the nullable column in V125_ADDED_COLUMNS, checked the same way. v126 only adds a new table
  * (task_source) and the columns in V126_ADDED_COLUMNS (null or 0), checked the same way.
  */
-export const UPDATE_SAFE_MIGRATIONS = Object.freeze([108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145]);
+export const UPDATE_SAFE_MIGRATIONS = Object.freeze([108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145, 146]);
 /** v119: the columns it adds, by table, with the value every row saved before it reads (toolroll-update's HISTORY_RULES). */
 export const V119_ADDED_COLUMNS = Object.freeze({
     task_ref: { planning_generation: { definition: "INTEGER NOT NULL DEFAULT 0", saved: "0" } },
@@ -1423,6 +1426,43 @@ CREATE TABLE IF NOT EXISTS flow_step_task (
   PRIMARY KEY (card, entry, task_id)
 );
 `;
+/** v146: `ci_check` is one pull request check (a GitHub check run or commit status) as the plane's winning observation of
+ * that head read it: written only with the observation that won its generation, replacing that head's rows wholesale.
+ * `release_step` is one step of a release (release.ts RELEASE_STEPS) as `toolroll release` moved through it: when it
+ * started, when it ended and how; recording it never changes the release. Both are read-only history for the Ship and
+ * Release views and their CLI twins. */
+export const V146_SCHEMA = `
+CREATE TABLE IF NOT EXISTS ci_check (
+  github_repo  TEXT NOT NULL,
+  pr_number    INTEGER NOT NULL,
+  head_sha     TEXT NOT NULL,
+  -- A check's identity: its kind (check run or commit status), its workflow and its name, so two workflows' checks
+  -- with the same name stay two rows (a failing one never hides behind a passing namesake).
+  ident        TEXT NOT NULL,
+  name         TEXT NOT NULL,
+  workflow     TEXT,
+  state        TEXT NOT NULL CHECK (state IN ('queued','running','passed','failed','skipped','cancelled','neutral')),
+  started_at   TEXT,
+  completed_at TEXT,
+  url          TEXT,
+  observed_at  TEXT NOT NULL,
+  PRIMARY KEY (github_repo, pr_number, head_sha, ident)
+);
+CREATE TABLE IF NOT EXISTS release_step (
+  task_id    TEXT NOT NULL,
+  tag        TEXT NOT NULL,
+  version    TEXT NOT NULL,
+  pr         INTEGER,
+  step       TEXT NOT NULL,
+  state      TEXT NOT NULL CHECK (state IN ('running','done','failed','waiting')),
+  started_at TEXT NOT NULL,
+  ended_at   TEXT,
+  detail     TEXT,
+  updated_at TEXT NOT NULL,
+  PRIMARY KEY (task_id, tag, step)
+);
+CREATE INDEX IF NOT EXISTS release_step_by_task ON release_step (task_id, updated_at);
+`;
 /**
  * v135: one approval per release (docs/plans/release-once.md). `release_authority` is the single source of truth for a
  * release a person approved: one row per generation, changed only by compare-and-swap on `rev`, with a lease whose
@@ -4684,6 +4724,8 @@ CREATE INDEX IF NOT EXISTS run_checkpoint_by_task ON run_checkpoint (task_ref, i
     db.exec(FLOW_BROWSER_SCHEMA);
     // v145: put-away tasks, green checks per branch and the reservations that hold work back (new tables only).
     db.exec(V145_SCHEMA);
+    // v146: pull request checks' own timing and release steps (new tables only).
+    db.exec(V146_SCHEMA);
     // Keep the epoch until reclamation succeeds, including a retry after compaction already committed. A new file has
     // nothing to reclaim.
     if (!fresh)
@@ -16127,9 +16169,12 @@ export class Store {
     }
     /** Save a new drawing of the flow only over the revision the editor saw (two editors never overwrite each other silently). */
     saveFlow(id, change, now) {
-        const { changes } = this.db.prepare("UPDATE flow SET name = ?, definition_json = ?, revision = revision + 1, updated_by = ?, updated_at = ? WHERE id = ? AND revision = ? AND state = 'active'")
-            .run(change.name, flowDefinitionForStore(change.definitionJson), change.by, now.toISOString(), id, change.sawRevision);
-        return Number(changes) === 1;
+        // The one road for a changed flow (flow-changed.ts): what a person approved for the flow as it was ends with it.
+        return flowChanged(this, { flow: id }, change.by, now, () => {
+            const { changes } = this.db.prepare("UPDATE flow SET name = ?, definition_json = ?, revision = revision + 1, updated_by = ?, updated_at = ? WHERE id = ? AND revision = ? AND state = 'active'")
+                .run(change.name, flowDefinitionForStore(change.definitionJson), change.by, now.toISOString(), id, change.sawRevision);
+            return Number(changes) === 1;
+        });
     }
     archiveFlow(id, by, now) {
         const { changes } = this.db.prepare("UPDATE flow SET state = 'archived', updated_by = ?, updated_at = ? WHERE id = ? AND state = 'active'").run(by, now.toISOString(), id);
@@ -16552,26 +16597,35 @@ export class Store {
         return this.transact(() => {
             const current = this.flowScript(script.repo, script.name);
             const version = (current?.version ?? Number(this.db.prepare("SELECT COALESCE(MAX(version), 0) AS v FROM flow_script WHERE repo = ? AND name = ?").get(script.repo, script.name)?.["v"] ?? 0)) + 1;
-            if (current !== null)
-                this.db.prepare("UPDATE flow_script SET state = 'removed' WHERE id = ?").run(current.id);
-            // A "runs on its own" grant signed this script's code: a new version ends it (flow-unattended.ts).
-            endUnattendedGrants(this, { script: { repo: script.repo, name: script.name } }, script.by, "script changed", now);
-            this.db.prepare(`INSERT INTO flow_script (repo, name, about, body, timeout_minutes, version, digest, saved_by, saved_at, state, language, file, held)
-        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 'active', ?, ?, ?)`).run(script.repo, script.name, script.about, script.body, script.timeoutMinutes, version, script.digest, script.by, now.toISOString(), script.language ?? "shell", script.file ?? null, script.held ?? null);
-            return version;
+            // A new version ends what was approved for the flows that run this script (flow-changed.ts): "runs on its own"
+            // grants that signed its code, and browser use that sealed it.
+            return flowChanged(this, { script: { repo: script.repo, name: script.name } }, script.by, now, () => {
+                if (current !== null)
+                    this.db.prepare("UPDATE flow_script SET state = 'removed' WHERE id = ?").run(current.id);
+                this.db.prepare(`INSERT INTO flow_script (repo, name, about, body, timeout_minutes, version, digest, saved_by, saved_at, state, language, file, held)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 'active', ?, ?, ?)`).run(script.repo, script.name, script.about, script.body, script.timeoutMinutes, version, script.digest, script.by, now.toISOString(), script.language ?? "shell", script.file ?? null, script.held ?? null);
+                return version;
+            }, () => true);
         });
     }
-    /** A person approves a held script (one an imported flow brought): from now on it runs. False when it wasn't held. */
-    approveFlowScript(repo, name) {
-        const { changes } = this.db.prepare("UPDATE flow_script SET held = NULL WHERE repo = ? AND name = ? AND state = 'active' AND held IS NOT NULL").run(repo, name);
-        return Number(changes) === 1;
+    /** A person approves a held script (one an imported flow brought): from now on it runs. The approval covers exactly
+     * the version and content the person read (`seen`): the check and the release of the hold are one statement in one
+     * transaction, so a script removed and brought back under the same name is never approved unseen. */
+    approveFlowScript(repo, name, seen) {
+        return this.transact(() => {
+            const current = this.flowScript(repo, name);
+            if (current === null || current.held === null)
+                return "not-held";
+            if (current.version !== seen.version || current.digest !== seen.digest)
+                return "changed";
+            const { changes } = this.db.prepare("UPDATE flow_script SET held = NULL WHERE id = ? AND version = ? AND digest = ? AND state = 'active' AND held IS NOT NULL").run(current.id, seen.version, seen.digest);
+            return Number(changes) === 1 ? "approved" : "changed";
+        });
     }
     removeFlowScript(repo, name, by = "flow", now = new Date()) {
-        return this.transact(() => {
+        // A grant that signed this script's code covers nothing without it: it ends, as does browser use that sealed it (flow-changed.ts).
+        return flowChanged(this, { script: { repo, name } }, by, now, () => {
             const { changes } = this.db.prepare("UPDATE flow_script SET state = 'removed' WHERE repo = ? AND name = ? AND state = 'active'").run(repo, name);
-            // A grant that signed this script's code covers nothing without it: it ends (flow-unattended.ts).
-            if (Number(changes) === 1)
-                endUnattendedGrants(this, { script: { repo, name } }, by, "script changed", now);
             return Number(changes) === 1;
         });
     }
@@ -21871,3 +21925,221 @@ export function restoreTaskFamily(store, taskId, by, now, guard) {
         return { ok: true, refs };
     });
 }
+/**
+ * What a LIVE invite grants, for its own join page (Wave E, "Your access"): the role, who invited, the projects and
+ * when it expires. Read without spending an attempt and under exactly inviteIsLive's predicate, so every dead shape
+ * reads as null and still gets the one indistinguishable page (D6). Only a holder of the live token sees it.
+ */
+export function liveInviteTerms(store, tokenValue, now) {
+    const row = store.handle
+        .prepare("SELECT role, minted_by, expires_at, projects_json FROM invite WHERE token_hash = ? AND revoked_at IS NULL AND consumed_at IS NULL AND expires_at > ? AND attempts < 10")
+        .get(createHash("sha256").update(tokenValue, "utf8").digest("hex"), now.toISOString());
+    if (row === undefined)
+        return null;
+    return { role: String(row["role"]) === "approver" ? "approver" : "viewer", mintedBy: String(row["minted_by"]), expiresAt: String(row["expires_at"]), projects: readProjectAccess(row["projects_json"]) };
+}
+/** At most this many checks are kept for one head; GitHub's rollup is far smaller in practice. */
+export const CI_CHECKS_MAX = 200;
+const CI_CHECK_TEXT_MAX = 200;
+const CI_CHECK_URL_MAX = 2048;
+const CI_FAILED_CONCLUSIONS = new Set(["FAILURE", "ERROR", "TIMED_OUT", "ACTION_REQUIRED", "STARTUP_FAILURE"]);
+const CI_PENDING = new Set(["QUEUED", "WAITING", "PENDING", "REQUESTED"]);
+const ISO_INSTANT = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?(?:Z|[+-]\d{2}:\d{2})$/;
+/** A timestamp GitHub gave, as an exact ISO instant, or null (GitHub's zero time "0001-01-01T00:00:00Z" is no time). */
+function ciInstant(value) {
+    if (typeof value !== "string" || value.length > 40 || !ISO_INSTANT.test(value))
+        return null;
+    const at = Date.parse(value);
+    if (!Number.isFinite(at) || at < Date.UTC(2000, 0, 1))
+        return null;
+    return new Date(at).toISOString();
+}
+/** The same ordering in SQL, for a column holding a check state. */
+const CI_SEVERITY_SQL = (column) => `CASE ${column} ${Object.entries({ failed: 6, cancelled: 5, running: 4, queued: 3, neutral: 2, skipped: 1, passed: 0 }).map(([state, n]) => `WHEN '${state}' THEN ${n}`).join(" ")} ELSE 0 END`;
+/** How bad a check state is: when one check identity appears twice, the worse stands. */
+const CI_SEVERITY = { failed: 6, cancelled: 5, running: 4, queued: 3, neutral: 2, skipped: 1, passed: 0 };
+/** A check's identity: its kind, its workflow and its name. */
+function ciCheckIdent(kind, row) {
+    // Unit separators, never NUL (SQLite text ends at one): names and workflows had every control character removed.
+    return `${kind}\u001f${row.workflow ?? ""}\u001f${row.name}`;
+}
+/** Short, printable text, or null. Every control (C0, DEL, C1) and format character (bidi overrides and isolates,
+ * zero-width marks) is removed, so a check name can't move the terminal's cursor or reorder what `task ship` prints.
+ * Check names never need a zero-width joiner, so emoji sequences lose theirs: that is the accepted cost. */
+function ciText(value) {
+    if (typeof value !== "string")
+        return null;
+    const text = value.replace(/[\p{Cc}\p{Cf}]/gu, "").trim();
+    return text === "" || text.length > CI_CHECK_TEXT_MAX ? null : text;
+}
+/** Only an https link to GitHub itself is kept; anything else reads null. */
+function ciUrl(value) {
+    if (typeof value !== "string" || value.length > CI_CHECK_URL_MAX)
+        return null;
+    try {
+        const url = new URL(value);
+        return url.protocol === "https:" && url.username === "" && url.password === "" && url.port === "" && url.hostname === "github.com" ? url.toString() : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * GitHub's statusCheckRollup (gh pr view --json statusCheckRollup) as check rows: CheckRun items (name, workflowName,
+ * status, conclusion, startedAt, completedAt, detailsUrl) and StatusContext items (context, state, startedAt, targetUrl).
+ * Strict: an item that is not one of those shapes, has no usable name, or names a state it doesn't know is dropped; one
+ * row per identity (kind, workflow and name), and when one identity appears twice (a re-run) the worse state stands;
+ * at most CI_CHECKS_MAX.
+ */
+export function parseCiRollup(rollup) {
+    if (!Array.isArray(rollup))
+        return [];
+    const rows = [];
+    const seen = new Map();
+    for (const item of rollup.slice(0, CI_CHECKS_MAX * 2)) {
+        if (rows.length >= CI_CHECKS_MAX)
+            break;
+        if (typeof item !== "object" || item === null || Array.isArray(item))
+            continue;
+        const raw = item;
+        const kind = raw["__typename"];
+        let row = null;
+        if (kind === "CheckRun" || (kind === undefined && typeof raw["status"] === "string" && raw["context"] === undefined)) {
+            const name = ciText(raw["name"]);
+            const status = typeof raw["status"] === "string" ? raw["status"].toUpperCase() : "";
+            const conclusion = typeof raw["conclusion"] === "string" ? raw["conclusion"].toUpperCase() : "";
+            const state = status === "IN_PROGRESS" ? "running"
+                : CI_PENDING.has(status) ? "queued"
+                    : status !== "COMPLETED" ? null
+                        : conclusion === "SUCCESS" ? "passed"
+                            : CI_FAILED_CONCLUSIONS.has(conclusion) ? "failed"
+                                : conclusion === "CANCELLED" ? "cancelled"
+                                    : conclusion === "SKIPPED" ? "skipped"
+                                        : conclusion === "NEUTRAL" || conclusion === "STALE" ? "neutral"
+                                            : null;
+            if (name === null || state === null)
+                continue;
+            const completedAt = state === "running" || state === "queued" ? null : ciInstant(raw["completedAt"]);
+            row = { name, workflow: ciText(raw["workflowName"]), state, startedAt: state === "queued" ? null : ciInstant(raw["startedAt"]), completedAt, url: ciUrl(raw["detailsUrl"]), kind: "run" };
+        }
+        else if (kind === "StatusContext" || (kind === undefined && typeof raw["context"] === "string")) {
+            const name = ciText(raw["context"]);
+            const value = typeof raw["state"] === "string" ? raw["state"].toUpperCase() : "";
+            const state = value === "SUCCESS" ? "passed" : value === "FAILURE" || value === "ERROR" ? "failed"
+                : value === "PENDING" || value === "EXPECTED" ? "running" : null;
+            if (name === null || state === null)
+                continue;
+            row = { name, workflow: null, state, startedAt: ciInstant(raw["startedAt"] ?? raw["createdAt"]), completedAt: null, url: ciUrl(raw["targetUrl"]), kind: "status" };
+        }
+        if (row === null)
+            continue;
+        // A completion before its start is GitHub's clock disagreeing with itself: keep the state, drop the end.
+        if (row.startedAt !== null && row.completedAt !== null && row.completedAt < row.startedAt)
+            row = { ...row, completedAt: null };
+        const ident = ciCheckIdent(row.kind ?? "run", row);
+        const at = seen.get(ident);
+        if (at !== undefined) {
+            if (CI_SEVERITY[row.state] > CI_SEVERITY[rows[at].state])
+                rows[at] = row;
+            continue;
+        }
+        seen.set(ident, rows.length);
+        rows.push(row);
+    }
+    return rows;
+}
+/**
+ * Replace one head's checks wholesale (v146). Call ONLY with an observation that won its generation (publish.ts settles
+ * and records in one transaction): a losing, stale answer never writes here.
+ */
+export function recordCiChecks(store, githubRepo, prNumber, headSha, rows, now) {
+    store.transact(() => {
+        // One head per pull request is kept: an older head's rows go with the new observation.
+        store.handle.prepare("DELETE FROM ci_check WHERE github_repo = ? AND pr_number = ?").run(githubRepo, prNumber);
+        const insert = store.handle.prepare(`INSERT INTO ci_check (github_repo, pr_number, head_sha, ident, name, workflow, state, started_at, completed_at, url, observed_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT (github_repo, pr_number, head_sha, ident) DO UPDATE SET state = excluded.state, started_at = excluded.started_at,
+        completed_at = excluded.completed_at, url = excluded.url WHERE ${CI_SEVERITY_SQL("excluded.state")} > ${CI_SEVERITY_SQL("ci_check.state")}`);
+        const at = now.toISOString();
+        // Rows a caller built itself carry no kind: a row with a workflow is a check run, one without may be a status; the
+        // identity keeps the two apart either way.
+        for (const row of rows.slice(0, CI_CHECKS_MAX))
+            insert.run(githubRepo, prNumber, headSha, ciCheckIdent(row.kind ?? (row.workflow === null ? "status" : "run"), row), row.name, row.workflow, row.state, row.startedAt, row.completedAt, row.url, at);
+    });
+}
+/** A pull request's checks for the head the plane's last winning observation recorded, or null when none was. */
+export function ciChecksFor(store, githubRepo, prNumber) {
+    const observation = store.handle.prepare("SELECT head_sha, state, observed_at FROM ci_observation WHERE github_repo = ? AND pr_number = ?").get(githubRepo, prNumber);
+    if (observation === undefined || String(observation["head_sha"]) === "" || String(observation["observed_at"]) === "")
+        return null;
+    const headSha = String(observation["head_sha"]);
+    const rows = store.handle.prepare(`SELECT ident, name, workflow, state, started_at, completed_at, url, observed_at FROM ci_check
+      WHERE github_repo = ? AND pr_number = ? AND head_sha = ? ORDER BY COALESCE(started_at, '9999'), name`).all(githubRepo, prNumber, headSha);
+    const text = (value) => value === null || value === undefined ? null : String(value);
+    return {
+        githubRepo, prNumber, headSha, observedAt: String(observation["observed_at"]),
+        observed: ["passing", "failing", "running"].find(one => one === String(observation["state"])) ?? "none",
+        checks: rows.map(row => ({ name: String(row["name"]), workflow: text(row["workflow"]), state: String(row["state"]),
+            startedAt: text(row["started_at"]), completedAt: text(row["completed_at"]), url: text(row["url"]),
+            kind: String(row["ident"]).startsWith("status\u001f") ? "status" : "run" })),
+    };
+}
+/** A task's pull request checks: its family's newest publication that has a pull request number, and that pull
+ * request's checks (ciChecksFor). Null: no pull request, or none observed yet. */
+export function shipChecksForTask(store, taskId) {
+    const refs = taskFamilyRefs(store, taskId).map(one => one.id);
+    if (refs.length === 0)
+        return null;
+    const row = store.handle.prepare(`SELECT github_repo, pr_number FROM publication WHERE task_ref IN (SELECT value FROM json_each(?))
+      AND pr_number IS NOT NULL ORDER BY id DESC LIMIT 1`).get(JSON.stringify(refs));
+    return row === undefined ? null : ciChecksFor(store, String(row["github_repo"]), Number(row["pr_number"]));
+}
+const RELEASE_STEP_NAMES = new Set(["gate", "approval", "check", "complete", "quiet", "deploy", "link", "ci", "merge", "tree", "tag", "publish", "homebrew"]);
+/**
+ * Record a release step (v146): `running` or `waiting` opens it (its first start is kept), `done` or `failed` ends it.
+ * A step that runs again after a stop starts its row again. A failed write throws here; the release's adapter swallows
+ * it, so recording never changes a release.
+ */
+export function recordReleaseStep(store, entry) {
+    if (!RELEASE_STEP_NAMES.has(entry.step) || entry.taskId === "" || entry.tag === "")
+        return;
+    const at = entry.at.toISOString();
+    // A stop message can carry a remote tool's words: no control or format character reaches `release status`.
+    const detail = entry.detail == null ? null : entry.detail.replace(/[\p{Cc}\p{Cf}]+/gu, " ").trim().slice(0, 1000);
+    const ended = entry.state === "done" || entry.state === "failed";
+    store.handle.prepare(`INSERT INTO release_step (task_id, tag, version, pr, step, state, started_at, ended_at, detail, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT (task_id, tag, step) DO UPDATE SET
+        state = excluded.state, version = excluded.version, pr = excluded.pr, updated_at = excluded.updated_at,
+        started_at = CASE WHEN release_step.ended_at IS NOT NULL AND excluded.ended_at IS NULL THEN excluded.started_at ELSE release_step.started_at END,
+        ended_at = excluded.ended_at,
+        detail = CASE WHEN excluded.detail IS NOT NULL OR excluded.ended_at IS NULL THEN excluded.detail ELSE release_step.detail END`)
+        .run(entry.taskId, entry.tag, entry.version, entry.pr, entry.step, entry.state, at, ended ? at : null, detail, at);
+}
+/** A release's steps, for the release task: the newest tag recorded for it, its steps in the order they ran, and the
+ * step it stopped at when the last thing recorded was a failure. Null: no step recorded. */
+export function releaseProgressFor(store, taskId) {
+    const newest = store.handle.prepare("SELECT tag FROM release_step WHERE task_id = ? ORDER BY updated_at DESC, rowid DESC LIMIT 1").get(taskId);
+    if (newest === undefined)
+        return null;
+    const tag = String(newest["tag"]);
+    const rows = store.handle.prepare("SELECT * FROM release_step WHERE task_id = ? AND tag = ? ORDER BY started_at, rowid").all(taskId, tag);
+    const steps = rows.map(row => ({ step: String(row["step"]), state: String(row["state"]), startedAt: String(row["started_at"]),
+        endedAt: row["ended_at"] === null ? null : String(row["ended_at"]), detail: row["detail"] === null ? null : String(row["detail"]) }));
+    const last = [...rows].sort((a, b) => String(a["updated_at"]).localeCompare(String(b["updated_at"]))).at(-1);
+    const stopped = String(last["state"]) === "failed" ? { step: String(last["step"]), message: last["detail"] === null ? "" : String(last["detail"]), at: String(last["updated_at"]) } : null;
+    const pr = last["pr"] === null ? null : Number(last["pr"]);
+    return { tag, version: String(last["version"]), pr, startedAt: steps[0].startedAt, updatedAt: String(last["updated_at"]), steps, stopped };
+}
+/** The release task whose steps were recorded most recently (v146), or null when none was. */
+export function latestReleaseStepTask(store) {
+    const row = store.handle.prepare("SELECT task_id FROM release_step ORDER BY updated_at DESC, rowid DESC LIMIT 1").get();
+    return row === undefined ? null : String(row["task_id"]);
+}
+/** Seconds a step or check took (to its end, or to `now` while it runs); null without a start. */
+export function elapsedSeconds(startedAt, endedAt, now) {
+    if (startedAt === null)
+        return null;
+    const start = Date.parse(startedAt), end = endedAt === null ? now.getTime() : Date.parse(endedAt);
+    return Number.isFinite(start) && Number.isFinite(end) ? Math.max(0, Math.round((end - start) / 1000)) : null;
+}

package/dist/surface.js

@@ -165,6 +165,10 @@ const GUIDE_ROWS = [
         positionals: [{ name: "task", required: true, meaning: "any version of the task" }],
         flags: [jsonFlag, dbFlag, { name: "level", takesValue: true, meaning: "quick (default) or full" }],
         notableReasons: ["no-result", "no-check", "checks-failed"] },
+    { invocation: "task ship", synopsis: "the task's pull request checks as last observed for its head: each check's state and how long it took",
+        audience: "agent", agentMayInvoke: true, mutation: "none",
+        positionals: [{ name: "task", required: true, meaning: "any version of the task" }], flags: [jsonFlag, dbFlag],
+        notableReasons: ["unknown-task", "no-pull-request"] },
     { invocation: "task add-tests", synopsis: "file a small task to write tests for the task's latest change; it waits for approval like any task",
         audience: "agent", agentMayInvoke: true, mutation: "identity-idempotent",
         positionals: [{ name: "task", required: true, meaning: "any version of the task" }], flags: [jsonFlag, dbFlag],
@@ -473,7 +477,7 @@ const REMOTE_STEP_UP = [
 ];
 const REMOTE_YES = [
     "status", "integrations", "ready", "gaps", "grants", "sync", "audit",
-    "task add", "task ask", "task checks", "task add-tests", "task list", "task show", "check-progress", "task wait", "task complete", "task revise",
+    "task add", "task ask", "task checks", "task ship", "task add-tests", "task list", "task show", "check-progress", "task wait", "task complete", "task revise",
     "task state", "task block", "task unblock", "task next", "task steer", "task pause", "task continue", "task assign", "task scope", "task plan", "task hold", "task unhold", "task require",
     "task requeue", "task review", "task repair", "task route", "task reopen", "task stop", "task resume",
     "runner list", "coordinator list", "cap list", "cap add", "outbox list", "incident list", "incident resolve",

package/dist/teams-settings.d.ts

@@ -1,7 +1,8 @@
 /** Settings → Teams: connect the Entra app once (operator), then each
  * teammate pairs their own Teams account. The messaging endpoint the bot
  * registration must point at is shown here; it has to be reachable from the
- * internet, which a tailnet-only address is not. */
+ * internet, which a tailnet-only address is not. One page with Slack and
+ * Discord (chat-settings-page.ts). */
 import type { Store } from "./store.js";
 import { type Html } from "./html.js";
 export declare function teamsSettingsHtml(store: Store, dir: string, options?: {

package/dist/teams-settings.js

@@ -1,46 +1,29 @@
-import { html, joinHtml, postForm } from "./html.js";
-import { ChatState } from "./chat-delivery-state.js";
+import { html, joinHtml } from "./html.js";
 import { loadTeamsCredentials } from "./teams-api.js";
-import { loadPrimary } from "./webhooks.js";
 import { TEAMS_MESSAGES_PATH } from "./teams.js";
+import { formRow, input } from "./server/kit.js";
+import { chatSecretRow, chatSettingsHtml } from "./chat-settings-page.js";
 export function teamsSettingsHtml(store, dir, options = {}) {
-    const credentials = loadTeamsCredentials(dir), state = new ChatState(store, "teams");
-    const bindings = credentials ? state.bindings(credentials.installation).filter(one => state.live(one)) : [];
-    const binding = options.who === undefined ? null : bindings.find(one => one.approver === options.who) ?? null;
-    const others = bindings.length - (binding === null ? 0 : 1);
-    const runtime = credentials ? state.runtime(credentials.installation) : null;
-    const now = options.now ?? new Date();
-    const live = runtime && runtime.leaseUntil !== null && runtime.leaseUntil > now.toISOString() && runtime.connected;
-    const password = html `<label>Your Toolroll password<input style="min-height:44px" type="password" name="password" autocomplete="current-password" required></label>`;
-    const post = (action, content) => postForm(`/settings/teams/${action}`, content, { attrs: { class: "card" } });
     const endpoint = options.publicUrl ? `${options.publicUrl.replace(/\/$/, "")}${TEAMS_MESSAGES_PATH}` : null;
-    const parts = [];
-    if (!credentials) {
-        parts.push(html `<p>Manage projects and review results in a Teams chat, and let a channel follow a team conversation.</p>`, html `<details open><summary>Register the bot</summary><ol><li>In <a href="https://portal.azure.com" target="_blank" rel="noopener noreferrer">Azure</a>, create an <em>Azure Bot</em> with a new single-tenant app registration; note the app (client) id and the directory (tenant) id, and create a client secret.</li>`, html `<li>Set its messaging endpoint to <code>${endpoint === null ? "https://your-public-address" + TEAMS_MESSAGES_PATH : endpoint}</code>. Microsoft must reach it from the internet: a tailnet-only address needs Tailscale Funnel (or another public tunnel) on that path.</li>`, html `<li>Enable the Microsoft Teams channel on the bot, then add the app to Teams (personal scope; team scope for channels).</li></ol></details>`, post("connect", joinHtml([
-            html `<label>App (client) id<input style="min-height:44px" type="text" name="app-id" autocomplete="off" required></label>`,
-            html `<label>Directory (tenant) id<input style="min-height:44px" type="text" name="tenant" autocomplete="off" required></label>`,
-            html `<label>Client secret<input style="min-height:44px" type="password" name="secret" autocomplete="off" required></label>`,
-            html `${password}<p class="meta">The secret stays on this installation. Next, pair your own Teams account.</p><button type="submit">Connect Teams</button>`
-        ])));
-    }
-    else {
-        parts.push(html `<p><strong>Microsoft Teams</strong> · ${live ? "Signed in" : "Waiting for sign-in"}</p>`);
-        if (endpoint !== null)
-            parts.push(html `<p class="meta">Messaging endpoint: <code>${endpoint}</code> — must be reachable from the internet.</p>`);
-        if (runtime?.problem)
-            parts.push(html `<p role="status">${String(runtime.problem)}</p>`);
-        if (!live && !runtime?.problem)
-            parts.push(html `<p>Keep the Toolroll worker running to answer Teams messages.</p>`);
-        if (options.code) {
-            parts.push(html `<h2>Pair your account</h2><p>Send this to the Toolroll bot in a personal Teams chat. It expires in 10 minutes.</p>`, html `<label>Pairing message<input type="text" readonly value="pair ${options.code}" autocomplete="off" style="width:100%;max-width:100%;font-size:14px;min-height:44px"></label>`, html `<a class="button-link" style="min-height:44px;white-space:nowrap" href="/settings/teams">Check connection</a>`);
-        }
-        else if (binding && state.live(binding)) {
-            parts.push(html `<p>Your Teams account is paired.${others ? ` ${others} teammate${others === 1 ? " is" : "s are"} paired too.` : ""}</p>`, html `<p>Try “What needs my attention?” or send <code>status</code>. In a channel, mention the bot with <code>team</code> to follow a conversation.</p>`, html `<p><a href="/chat">Open saved chat</a></p>`, loadPrimary(process.env, dir) === "teams" ? html `<p>Task updates are sent here.</p>` : post("alerts", html `<button type="submit">Send task updates here</button>`), post("unpair", html `${password}<p class="meta">Unpairing ends every open button in your chat. Teammates are unaffected.</p><button type="submit">Unpair my account</button>`));
-        }
-        else {
-            parts.push(post("pair", html `<h2>Pair your account</h2><p>Your paired Teams account can read your connected projects and confirm proposed changes. Password approvals still open in Toolroll.${others ? ` ${others} teammate${others === 1 ? " is" : "s are"} already paired.` : ""}</p>${password}<button type="submit">Create pairing code</button>`));
-        }
-        parts.push(html `<details><summary>Connection settings</summary>${post("disconnect", html `${password}<button type="submit">Disconnect Teams</button>`)}</details>`);
-    }
-    return html `<section style="max-width:42rem;overflow-wrap:anywhere"><p><a href="/settings">Settings</a></p><h1>Teams</h1>${options.problem ? html `<p class="problem" role="alert">${options.problem}</p>` : ""}${parts}</section>`;
+    const text = (id, name, label) => formRow(label, null, input({ id, name, attrs: { autocomplete: "off", spellcheck: "false", required: true, "aria-label": label } }));
+    const { code, problem, now, who } = options;
+    return chatSettingsHtml(store, dir, { ...(code === undefined ? {} : { code }), ...(problem === undefined ? {} : { problem }), ...(now === undefined ? {} : { now }), ...(who === undefined ? {} : { who }) }, {
+        provider: "teams",
+        label: "Teams",
+        credentials: loadTeamsCredentials(dir),
+        intro: "Manage projects and review results in a Teams chat, and let a channel follow a team conversation.",
+        steps: html `<ol class="k-note"><li>In <a class="k-link" href="https://portal.azure.com" target="_blank" rel="noopener noreferrer">Azure</a>, create an <em>Azure Bot</em> with a new single-tenant app registration; note the app (client) id and the directory (tenant) id, and create a client secret.</li>\
+<li>Set its messaging endpoint to <code class="k-mono">${endpoint === null ? "https://your-public-address" + TEAMS_MESSAGES_PATH : endpoint}</code>. Microsoft must reach it from the internet: a tailnet-only address needs Tailscale Funnel (or another public tunnel) on that path.</li>\
+<li>Enable the Microsoft Teams channel on the bot, then add the app to Teams (personal scope; team scope for channels).</li></ol>`,
+        fields: joinHtml([
+            text("teams-app-id", "app-id", "App (client) id"),
+            text("teams-tenant", "tenant", "Directory (tenant) id"),
+            chatSecretRow({ id: "teams-secret", name: "secret", label: "Client secret" }),
+        ]),
+        fieldsNote: "The secret stays on this installation. Next, pair your own Teams account.",
+        pairWhere: "to the Toolroll bot in a personal Teams chat",
+        tryLine: html `Try “What needs my attention?” or send <code class="k-mono">status</code>. In a channel, mention the bot with <code class="k-mono">team</code> to follow a conversation.`,
+        liveWords: ["Signed in", "Waiting for sign-in"],
+        ...(endpoint === null ? {} : { connection: html `<p class="k-note">Messaging endpoint, reachable from the internet: <code class="k-mono">${endpoint}</code></p>` }),
+    });
 }

package/dist/telegram-settings.d.ts

@@ -1,7 +1,3 @@
-/** The person's own Telegram pairing, from the console: one private chat per
- * teammate with the installation's bot (v72). The bot token itself stays on
- * the settings page; this card only mints or revokes the signed-in person's
- * pairing, never anyone else's. */
 import type { Store } from "./store.js";
 import { type Html } from "./html.js";
 /** How long a written reply may wait to be sent before it shows here with a Retry. */

package/dist/telegram-settings.js

@@ -1,36 +1,63 @@
+/** The person's own Telegram pairing, from the console: one private chat per
+ * teammate with the installation's bot (v72). The bot token itself stays on
+ * Chat apps and alerts; this page only mints or revokes the signed-in person's
+ * pairing, never anyone else's. Laid out as three steps: token, pair, check. */
+import { settingsSubPage } from "./settings-groups-ui.js";
 import { html, joinHtml, postForm } from "./html.js";
+import { acts, btn, codeLine, note, notice, settingsRecord, settingsSection } from "./server/kit.js";
+import { kitSectionForm } from "./settings-kit.js";
 /** How long a written reply may wait to be sent before it shows here with a Retry. */
 export const UNSENT_REPLY_MS = 2 * 60_000;
 export function telegramSettingsHtml(store, botId, who, options = {}) {
-    const password = html `<label>Your Toolroll password<input style="min-height:44px" type="password" name="password" autocomplete="current-password" required></label>`;
-    const post = (action, content) => postForm(`/settings/telegram/${action}`, content, { attrs: { class: "card" } });
-    let content;
+    const problem = options.problem === undefined ? "" : notice(options.problem);
+    const group = note(html `Each teammate pairs their own private chat. To connect a group, a conversation manager sends <code class="k-mono">/team</code> there and chooses a conversation. Everyone in the group can read its replies.`);
     if (botId === null) {
-        content = html `<p>No Telegram bot is connected yet. An installation approver saves the bot token on the <a href="/settings">settings page</a> first.</p>`;
+        return settingsSubPage("alerts", "Telegram", joinHtml([
+            problem,
+            settingsSection({ id: "telegram-bot", title: "1. Bot token", state: " · Not saved",
+                lead: "No Telegram bot is connected yet. An approver saves the bot token first.",
+                body: acts(btn("Open Chat apps and alerts", { sm: true, href: "/settings/alerts#telegram-token" })) }),
+            settingsSection({ id: "telegram-pair", title: "2. Pair your phone", body: note("Once the bot token is saved, pair your phone here.") }),
+            group,
+        ]));
+    }
+    const bindings = store.liveTelegramBindings(botId);
+    const mine = bindings.filter(binding => binding.approver === who);
+    const others = bindings.length - mine.length;
+    const paired = mine.length > 0;
+    const teammates = others === 0 ? "No teammates are paired yet." : `${others} teammate${others === 1 ? " is" : "s are"} paired.`;
+    const bot = settingsSection({ id: "telegram-bot", title: "1. Bot token", state: " · Saved",
+        body: note(html `Saved on <a class="k-link" href="/settings/alerts#telegram-token">Chat apps and alerts</a>.`) });
+    let pair;
+    let check;
+    if (options.code !== undefined) {
+        // The code shows once, on this page only: selectable text, never in a link or an address.
+        pair = settingsSection({ id: "telegram-pair", title: "2. Pair your phone", state: " · Code ready",
+            lead: "Send this to the bot in a private Telegram chat within 10 minutes:",
+            body: joinHtml([codeLine(`/pair ${options.code}`), note("The code works once. That chat then answers as you, so treat it like your sign-in.")]) });
+        check = settingsSection({ id: "telegram-check", title: "3. Check it works",
+            lead: "Once you've sent it, this page says your phone is paired.",
+            body: acts(btn("Check connection", { sm: true, href: "/settings/telegram" })) });
     }
     else {
-        const bindings = store.liveTelegramBindings(botId);
-        const mine = bindings.filter(binding => binding.approver === who);
-        const others = bindings.length - mine.length;
-        const parts = [html `<p><strong>${mine.length > 0 ? "Your phone is paired." : "Your phone is not paired."}</strong> ${others === 0 ? "No teammates are paired yet." : `${others} teammate${others === 1 ? " is" : "s are"} paired.`}</p>`];
+        pair = settingsSection({ id: "telegram-pair", title: "2. Pair your phone", state: paired ? " · Paired" : " · Not paired",
+            lead: `${paired ? "Your phone is paired." : "Your phone is not paired."} ${teammates}`,
+            body: paired
+                ? kitSectionForm({ proof: "telegram-unpair", action: "/settings/telegram/unpair", id: "telegram-unpair-form", save: { label: "Unpair my phone", variant: "danger" },
+                    confirm: "Unpair your phone from Telegram", body: note("This phone will lose access. Its existing Telegram buttons will stop working.") })
+                : kitSectionForm({ proof: "telegram-pair", action: "/settings/telegram/pair", id: "telegram-pair-form", native: true, save: { label: "Pair my phone" },
+                    confirm: "Pair your phone with Telegram", body: note("You get a one-time code to send to the bot.") }) });
         // A reply the assistant wrote that has not reached this person's phone for two minutes.
         const unsent = store.unsentTelegramReplies(botId, who, new Date((options.now ?? new Date()).getTime() - UNSENT_REPLY_MS));
-        if (unsent.length > 0) {
-            const oldest = unsent[0];
-            parts.push(html `<div class="card" role="status" data-unsent-replies><p><strong>${unsent.length === 1 ? html `A reply hasn't reached your phone` : html `${unsent.length} replies haven't reached your phone`}</strong></p><p class="meta">Trying since ${oldest.since.slice(11, 16)} UTC${oldest.error === null ? "" : `: ${oldest.error}`}</p>${postForm("/settings/telegram/retry", html `<button type="submit">Retry</button>`)}</div>`);
-        }
-        if (options.code !== undefined) {
-            parts.push(html `<h2>Pair your phone</h2><p>Send this to the bot in a private Telegram chat within 10 minutes:</p><pre class="pairing-code">/pair ${options.code}</pre><p class="meta">The code works once. That chat then answers as you, so treat it like your sign-in.</p>`);
-        }
-        else if (mine.length === 0) {
-            parts.push(post("pair", html `${password}<button type="submit">Pair my phone</button>`));
-        }
-        else {
-            parts.push(post("unpair", html `${password}<p class="meta">This phone will lose access. Its existing Telegram buttons will stop working.</p><button type="submit" class="danger">Unpair my phone</button>`));
-        }
-        content = joinHtml(parts);
+        const oldest = unsent[0];
+        check = settingsSection({ id: "telegram-check", title: "3. Check it works",
+            lead: paired ? html `In your private chat with the bot, send <code class="k-mono">/status</code>. It answers without an AI model.` : "Pair your phone first.",
+            body: oldest === undefined ? "" : settingsRecord({
+                title: unsent.length === 1 ? html `A reply hasn't reached your phone` : html `${unsent.length} replies haven't reached your phone`,
+                sub: `Trying since ${oldest.since.slice(11, 16)} UTC${oldest.error === null ? "" : `: ${oldest.error}`}`,
+                action: postForm("/settings/telegram/retry", btn("Retry", { sm: true, type: "submit" })),
+                attrs: { role: "status", "data-unsent-replies": true },
+            }) });
     }
-    if (options.problem !== undefined)
-        content = html `<p role="status">${options.problem}</p>${content}`;
-    return html `<h1>Telegram</h1>${content}<p class="meta">Each teammate pairs their own private chat. To connect a group, a conversation manager sends <code>/team</code> there and chooses a conversation. Everyone in the group can read its replies.</p>`;
+    return settingsSubPage("alerts", "Telegram", joinHtml([problem, bot, pair, check, group]));
 }