toolroll 0.9.89 → 0.9.90

package/CHANGELOG.md

@@ -1,5 +1,49 @@
 # Changelog
 
+## 0.9.90 — 2026-11-04
+
+- **Type `toolroll` and you're in.** At your own terminal, bare `toolroll`
+  starts Toolroll on this computer (or opens the one already running) and
+  shows your tasks, what each agent is doing and what needs you, right in the
+  terminal: file a task, read the full plan and approve it, stop, revise,
+  complete, answer a question, or press `w` for the browser. `toolroll --web`
+  opens the browser instead, `toolroll open` gets you back in signed in, and
+  `toolroll welcome` walks the three setup steps. Scripts, agents and
+  `--json` see exactly what they did before.
+- **No password on your own computer.** A new install started with
+  `toolroll` has one owner and no password or login file. You can file
+  tasks, chat with the lead, approve plans for work you start, answer
+  questions, stop, revise and complete work, and add projects. Hands-off
+  modes, merging, releases, people and access, and most settings ask you to
+  set a password first: the page says **Set a password**, or run
+  `toolroll password set`. Agents always run inside the fence while this is
+  on. Existing installs keep their passwords and work as before.
+- **A first result in three steps.** The welcome page (and
+  `toolroll welcome`) asks for your agent (Claude Code or Codex, with the
+  command that signs each in), a project (a folder, one of your GitHub
+  repositories, or a small sample project) and a first task from a few
+  starters.
+- **One-line install opens Toolroll.** `curl … | sh` now opens Toolroll in
+  your terminal when it finishes. Without a terminal it prints the exact
+  command to start it.
+- **Keep it running, or stop it.** Quitting asks once whether Toolroll
+  should keep running in the background. `toolroll background on|off|show`
+  changes that later (a login item on macOS, a user service on Linux), and
+  `toolroll stop` stops it with running work saved.
+- **Browser changes need this browser's key.** On an install that only
+  listens on this computer, a signed-in cookie alone can no longer change
+  anything: a page on another port can read but not act. After Toolroll
+  restarts, an open tab says **Reconnect**: run `toolroll open`, or type
+  your password. The first start of this version asks open tabs to reconnect
+  once.
+- **Port 4180 already taken?** A new install picks the next free port and
+  keeps it, instead of failing to start.
+- **Your saved login stays out of every build.** Builds could never read your
+  saved login, but one saved after a build had already started was missed.
+  Saved logins now live in a private folder next to the database that every
+  build is denied as a whole, on macOS, Linux and with Codex. The next start
+  moves an existing saved login there for you.
+
 ## 0.9.89 — 2026-11-03
 
 - **The app no longer freezes when a drive stops answering.** If an external

package/README.md

@@ -29,24 +29,30 @@ Approve the exact scope once. Get results back Ready with the diff, the passing
 
 ## Quick start
 
-macOS or Linux, Node.js 22.13+, git 2.41+, and a signed-in `claude`, `codex` or
-`gemini` CLI.
+macOS or Linux, Node.js 22.13+, git 2.41+, and Claude Code (`claude`) or
+Codex (`codex`) signed in on this computer.
 
 ```sh
-npm install -g toolroll    # or: brew install ap9000/toolroll/toolroll
-toolroll demo              # optional: a seeded sandbox, no model calls, no spend
-toolroll up                # the app and a builder; opens http://127.0.0.1:4180
+curl -fsSL https://raw.githubusercontent.com/ap9000/toolroll/main/install.sh | sh
 ```
 
-`up` saves your password in `up-login.txt` and prints the command that shows
-it (never the password itself), then keeps running. Then, in a repository:
+or
 
 ```sh
-toolroll onboard --yes     # add it as a project, install the agent skill
+npm install -g toolroll    # or: brew install ap9000/toolroll/toolroll
+toolroll
 ```
 
-Open **Chat**, say what you want, approve the plan. The result comes back
-**Ready**. More: [Getting started](docs/guide/getting-started.md).
+Toolroll opens in your terminal and runs while that window is open. No
+password and no login file: on your own computer you're already in. Pick an
+agent, a project (or the sample one) and a first task; approve the plan, and
+the result comes back **Ready**. Press `w` for the browser, or run
+`toolroll --web`. To look around first, `toolroll demo` opens a seeded
+sandbox with no model calls and no spend.
+
+**Letting agents work on their own.** Approving work you start on this
+computer needs no password. Hands-off modes, merging, releasing and most
+settings ask you to set one first: `toolroll password set`. More: [Getting started](docs/guide/getting-started.md).
 
 ## How it works
 

package/THIRD_PARTY_NOTICES.md

@@ -431,6 +431,43 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 
+## Terminal UI bundle (`dist/tui.js`)
+
+The terminal UI is one esbuild bundle of Ink 6.8.0 (MIT, Vadim Demedes), React 19 and react-reconciler (MIT, Meta),
+yoga-layout 3.2.1 (MIT, Meta; its WebAssembly ships inlined as base64 in the bundle) and their small MIT/ISC helper
+packages (chalk, ansi-styles, wrap-ansi, string-width, emoji-regex, signal-exit and others). They are development
+dependencies only: nothing extra is installed with Toolroll. The build appends each bundled package's own license file
+to `dist/browser/THIRD_PARTY_NOTICES.txt`, next to the browser bundle's, and fails if one is missing.
+
+## yoga-layout 3.2.1 — MIT
+
+This Ink dependency declares MIT in its package metadata but omits its license file from the published npm package.
+The upstream license was preserved from the repository at tag `v3.2.1`, revision
+`042f5013152eb81c1552dec945b88f7b95ca350f`, inspected 3 November 2026:
+https://raw.githubusercontent.com/facebook/yoga/042f5013152eb81c1552dec945b88f7b95ca350f/LICENSE
+
+MIT License
+
+Copyright (c) Facebook, Inc. and its affiliates.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
 ## Geist Sans and Geist Mono (@fontsource/geist-sans, @fontsource/geist-mono 5.3.0) — SIL OFL 1.1
 
 The console embeds the latin woff2 subsets (weights 400, 500 and 600) in

package/dist/agent-board.d.ts

@@ -218,3 +218,12 @@ export declare function watchedPing(store: Store, row: {
 }, account: string, now: Date): {
     hold: string;
 } | "skip" | "send";
+/** A page's own watch id: 24 hex characters the shell makes (never a database row id). */
+export declare const AGENT_VIEW_ID: RegExp;
+/**
+ * POST /agents/watch, hold: this person's page watches a run (renewed on each keep-alive). A view id another person
+ * already holds is never taken over or renewed: only the holder's own row moves. False when nothing was held.
+ */
+export declare function holdOwnAgentView(store: Store, view: string, account: string, run: number, at: Date): boolean;
+/** POST /agents/watch, release: this person's page went away. Only their own view is released (and lapsed ones swept). */
+export declare function releaseOwnAgentView(store: Store, view: string, account: string, at: Date): void;

package/dist/agent-board.js

@@ -472,3 +472,23 @@ export function watchedPing(store, row, account, now) {
     const seen = store.handle.prepare("SELECT 1 AS hit FROM agent_seen WHERE account = ? AND run = ?").get(account, boardRunOf(store, row.run));
     return seen === undefined ? "send" : "skip";
 }
+// ---- easy-start C1 (N1): the watch lease and the seen mark, from keyed POSTs only -------------------------------------
+/** A page's own watch id: 24 hex characters the shell makes (never a database row id). */
+export const AGENT_VIEW_ID = /^[0-9a-f]{24}$/;
+/**
+ * POST /agents/watch, hold: this person's page watches a run (renewed on each keep-alive). A view id another person
+ * already holds is never taken over or renewed: only the holder's own row moves. False when nothing was held.
+ */
+export function holdOwnAgentView(store, view, account, run, at) {
+    if (!AGENT_VIEW_ID.test(view))
+        return false;
+    return Number(store.handle.prepare(`INSERT INTO agent_view (view, account, run, expires_at) VALUES (?, ?, ?, ?)
+    ON CONFLICT (view) DO UPDATE SET expires_at = excluded.expires_at WHERE agent_view.account = excluded.account AND agent_view.run = excluded.run`)
+        .run(view, account, boardRunOf(store, run), new Date(at.getTime() + VIEW_LEASE_MS).toISOString()).changes) > 0;
+}
+/** POST /agents/watch, release: this person's page went away. Only their own view is released (and lapsed ones swept). */
+export function releaseOwnAgentView(store, view, account, at) {
+    if (!AGENT_VIEW_ID.test(view))
+        return;
+    store.handle.prepare("DELETE FROM agent_view WHERE (view = ? AND account = ?) OR expires_at < ?").run(view, account, at.toISOString());
+}

package/dist/agent-fence.js

@@ -37,6 +37,7 @@ import { ensureRunnerProcessFolder, RUNNER_PROCESS_DIR } from "./runner-process.
 import { DEPS_FOLDER, linkedKey, readyCopy, sharedCopies } from "./shared-deps.js";
 import { SEATBELT_PROBE, sandboxRuntimeProblem, srtSpawn } from "./sandbox-runtime.js";
 import { protectedStorageDenies, protectedStorageNames } from "./protected-storage.js";
+import { ensureSecretsDir, legacyLoginFileOf, SECRETS_DIR, secretsDirOf } from "./login-secrets.js";
 import { getDefaultWritePaths } from "@anthropic-ai/sandbox-runtime";
 /** Names that are secrets wherever the database lives (used when its folder is shared with other things). */
 const SENSITIVE_NAME = /(^up-login\.txt$|token|secret|login|password|credential|vapid|keys?\b|\.pem$|\.key$|^backups$|^evidence$|^remote$|^sign-in\.json$|^monitoring\.json$)/i;
@@ -183,6 +184,23 @@ export function agentFence(options) {
         catch { /* name and target remain denied */ }
         fence.add(backups);
         fence.add(real(backups));
+        // Saved credentials (the remembered login, login-secrets.ts) live in a reserved owner-only folder, made here before
+        // any launch and denied whole, so one first written after this launch is behind this fence too: a listing can't
+        // name a file that isn't there yet, and bubblewrap can't deny one. If it can't be made or proven, its name is
+        // denied anyway (and nothing is saved there).
+        const secrets = secretsDirOf(state);
+        try {
+            ensureSecretsDir(state);
+        }
+        catch { /* name and target remain denied */ }
+        fence.add(secrets);
+        fence.add(real(secrets));
+        // An older version's login beside the database: listed below when it is there; by name, there or not, where the
+        // sandbox denies a missing path without making it (Seatbelt; Codex's profile gets the same list). On Linux a
+        // missing path would be stubbed into being for the launch, and nothing writes that name any more.
+        const legacyLogin = legacyLoginFileOf(state);
+        if (process.platform === "darwin" || existsSync(legacyLogin))
+            fence.add(legacyLogin);
         // Only a folder that is Toolroll's own (~/.config/toolroll or an older name,
         // the desktop app's "Toolroll") is fenced whole: a database kept
         // in a shared folder (a projects folder, a test's temp folder) must not
@@ -230,7 +248,7 @@ export function agentFence(options) {
     // Secret, state, database, explicit-extra and home-config denies are never exemptible.
     for (const path of options.boundary?.protectedShell ?? [])
         fence.add(real(path));
-    const protectedPaths = new Set([...fence].flatMap(path => path === runFolder || [RUNNER_PROCESS_DIR, "backups"].includes(basename(path)) ? [path, real(path)] : [real(path)]));
+    const protectedPaths = new Set([...fence].flatMap(path => path === runFolder || [RUNNER_PROCESS_DIR, "backups", SECRETS_DIR].includes(basename(path)) ? [path, real(path)] : [real(path)]));
     // Protected storage (chat apps, browser profiles, password managers): every launch, every policy, never exemptible,
     // kept by the name it was resolved under as well as where it leads.
     const storage = options.protectedStorage ?? protectedStorageDenies(home);
@@ -242,7 +260,7 @@ export function agentFence(options) {
         fence.add(path);
     const binding = options.binding;
     const needed = binding === undefined || binding === null ? [] : [binding.gitdir, real(join(binding.main, ".git"))];
-    return [...new Set([...[...fence].flatMap(path => path === runFolder || [RUNNER_PROCESS_DIR, "backups"].includes(basename(path)) ? [path, real(path)] : [real(path)]), ...storage.flatMap(path => [path, real(path)])])].filter(path => {
+    return [...new Set([...[...fence].flatMap(path => path === runFolder || [RUNNER_PROCESS_DIR, "backups", SECRETS_DIR].includes(basename(path)) ? [path, real(path)] : [real(path)]), ...storage.flatMap(path => [path, real(path)])])].filter(path => {
         if (protectedPaths.has(path) || !needed.some(target => target === path || inside(target, path)))
             return true;
         console.warn(`Dropped build fence entry covering this checkout's own Git data: ${path}`);

package/dist/approval-authority.d.ts

@@ -2,6 +2,13 @@
  * expression, used exactly three times: the mode and grant clauses, and the release's expiry). It never asks whether the row is approved.
  * COALESCE: a NULL basis would make the OR chain NULL, and NOT NULL reads as "not dead"; NULL stands on nothing. */
 export declare const authorityStandsSql: (scope: string, repo: string, now: string) => string;
+/**
+ * SQL, conjunctive with every alternative above (easy-start plan C5): a seal a local owner gave (its proof row at the
+ * seal's instant says `local-owner`) stands only while local mode is on, for that owner, at the local generation its
+ * proof names (approvalProofDetail's " · local <generation> <transport> · "), and while its project's checks aren't
+ * stored as unsandboxed. Turning local mode off, or moving its generation, stops every such seal dispatching.
+ */
+export declare const localSealStandsSql: (scope: string, repo: string) => string;
 /** SQL: a `carried` seal stands only on its own carry row — this task, this approved digest, this candidate, and the
  * reference `<authority>:<carry>` the carry transaction wrote (release-once.md). */
 export declare const carrySealSql: (scope: string) => string;

package/dist/approval-authority.js

@@ -16,7 +16,7 @@ import { grantStandsSql } from "./flow-unattended.js";
 import { accountReachesSql } from "./project-access.js";
 import { autoSealSql } from "./release-authority.js";
 /** The proofs a person gives (src/person-proof.ts), as an SQL list. */
-const PERSON_PROOFS = "('password-now', 'sso-now', 'fresh-password', 'fresh-sso', 'session', 'cli-login', 'chat', 'passkey')";
+const PERSON_PROOFS = "('password-now', 'sso-now', 'fresh-password', 'fresh-sso', 'session', 'cli-login', 'chat', 'passkey', 'local-owner')";
 /** SQL over a `task_scope` alias and a repo expression: whether that row's approval authority stands at `now` (an SQL
  * expression, used exactly three times: the mode and grant clauses, and the release's expiry). It never asks whether the row is approved.
  * COALESCE: a NULL basis would make the OR chain NULL, and NOT NULL reads as "not dead"; NULL stands on nothing. */
@@ -30,7 +30,18 @@ export const authorityStandsSql = (scope, repo, now) => `COALESCE((((COALESCE(${
     OR (${scope}.approval_basis = 'grant' AND ${grantStandsSql(`${scope}.mode_digest`, now, repo)})
     OR (${scope}.approval_basis = 'schedule' AND ${approverStandsSql(scope, repo)})
     OR (${scope}.approval_basis IN ('auto-check', 'auto-green') AND ${autoSealSql(scope, repo)} AND ${approverStandsSql(scope, repo)}))
-    AND ${releaseStandsSql(scope, now)}), 0)`;
+    AND ${releaseStandsSql(scope, now)} AND ${localSealStandsSql(scope, repo)}), 0)`;
+/**
+ * SQL, conjunctive with every alternative above (easy-start plan C5): a seal a local owner gave (its proof row at the
+ * seal's instant says `local-owner`) stands only while local mode is on, for that owner, at the local generation its
+ * proof names (approvalProofDetail's " · local <generation> <transport> · "), and while its project's checks aren't
+ * stored as unsandboxed. Turning local mode off, or moving its generation, stops every such seal dispatching.
+ */
+export const localSealStandsSql = (scope, repo) => `NOT EXISTS (SELECT 1 FROM action_ledger lp WHERE lp.task_id = ${scope}.task_id AND lp.action = 'approval proved'
+      AND lp.actor = ${scope}.approved_by AND lp.at = ${scope}.approved_at AND lp.outcome = 'local-owner'
+      AND NOT (EXISTS (SELECT 1 FROM local_mode lm WHERE lm.id = 1 AND lm.enabled = 1 AND lm.owner = lp.actor
+                   AND lp.detail LIKE '% · local ' || lm.generation || ' %')
+               AND NOT EXISTS (SELECT 1 FROM project_check_access lca WHERE lca.repo = ${repo} AND lca.level = 'unsandboxed')))`;
 /** SQL: a `carried` seal stands only on its own carry row — this task, this approved digest, this candidate, and the
  * reference `<authority>:<carry>` the carry transaction wrote (release-once.md). */
 export const carrySealSql = (scope) => `EXISTS (SELECT 1 FROM release_carry rc2 JOIN release_authority ra2 ON ra2.id = rc2.authority