toolroll 0.9.9 → 0.9.11

package/dist/chat-voice.js

@@ -0,0 +1,175 @@
+import { phoneText } from "./telegram-status.js";
+/** The bot's display name in every chat app. */
+export const BOT_NAME = "Toolroll";
+/** Updates for one person landing within this window become one message, edited in place as it grows. */
+export const BATCH_MS = 2 * 60_000;
+export const SHORT_TITLE_MAX = 60;
+/** A token that could be an id: letters and digits joined by `-` or `_`, or with a digit in it (`release-099b`,
+ * `t42`). Words such as `node-20` and `utf-8` look the same, so a token goes only when it names a real task. */
+const ID_SHAPED = /\(?(?<![\p{L}\p{N}._/-])[\p{L}\p{N}]+(?:[-_.][\p{L}\p{N}]+)*(?![\p{L}\p{N}_/-]|\.[\p{L}\p{N}])\)?/gu;
+/** An id that could be mistaken for nothing else (`release-099b`, `fix_tax`, `t42`). A one-word id such as `tidy`
+ * is also a word, and prose keeps its words. */
+const idLike = (id) => /[-_\d]/.test(id);
+const escape = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+/** A short human summary of a task's title, at most 60 characters: no "— revision", and no task ids. Only the
+ * task's own id and tokens `isTaskId` names as real tasks are dropped; `node-20` and `utf-8` stay. */
+export function shortTitle(title, taskId, isTaskId) {
+    let text = phoneText(title ?? "", 400);
+    // "— revision", "- revision 2", "(revision)": a revision is the same work to a person.
+    text = text.replace(/(?:(?:\s*[—–]+|\s+-+)\s*revision\b(?:\s*#?\d+)?|\s*[([]\s*revision(?:\s*#?\d+)?\s*[)\]])/giu, "");
+    text = text.replace(ID_SHAPED, token => {
+        const bare = token.replace(/^\(|\)$/g, "");
+        return idLike(bare) && (bare === taskId || isTaskId?.(bare) === true) ? " " : token;
+    });
+    text = text.replace(/\(\s*\)/g, " ").replace(/\s+/g, " ").replace(/^[\s·:,;—–-]+|[\s·:,;—–-]+$/gu, "").trim();
+    if (text === "") {
+        // A task filed with only its id as a title: the words, never the slug.
+        const words = (taskId ?? "").replace(/[-_]+/g, " ").trim();
+        return words === "" ? "A task" : shortTitle(words[0].toUpperCase() + words.slice(1));
+    }
+    if (text.length <= SHORT_TITLE_MAX)
+        return text;
+    const cut = text.slice(0, SHORT_TITLE_MAX - 1);
+    const space = cut.lastIndexOf(" ");
+    return `${(space > 20 ? cut.slice(0, space) : cut).replace(/[\s·:,;—–-]+$/u, "")}…`;
+}
+/** A task's title as every chat says it: short, with its own id and any other real task's id dropped. */
+export function chatTitle(store, taskId) {
+    return shortTitle(store.getTask(taskId)?.title, taskId, token => token !== taskId && store.getTask(token) !== null);
+}
+/** A title inside a sentence or list: "faster tests", but "API keys" and "iOS" keep their capitals. */
+export function inSentence(summary) {
+    return /^\p{Lu}\p{Ll}/u.test(summary) ? summary[0].toLowerCase() + summary.slice(1) : summary;
+}
+/** The two buttons under a result ready for a person: the real next step, then a look first. */
+export const READY_ACTIONS = { merge: "Merge", complete: "Mark complete", look: "Look first" };
+/** Whether this line asks for the result's next step, so it carries [Merge] or [Mark complete] and [Look first]. */
+export function asksToFinish(fact) {
+    return fact.update == null && fact.headline === "Ready for review" && !fact.report;
+}
+/** One update, said plainly: what happened, then what happens next. The lead says "I" for what it did. */
+export function finishedLine(fact) {
+    if (fact.update != null)
+        return fact.update.words;
+    const name = fact.summary, lower = inSentence(fact.summary);
+    const ready = fact.lead === true ? `I finished ${lower}` : `${name} is ready`;
+    switch (fact.headline) {
+        case "Ready for review":
+            if (fact.report)
+                return fact.lead === true ? `I wrote up ${lower}. The report is ready to read.` : `${name}: the report is ready to read.`;
+            if (fact.checks === "passed")
+                return `${ready}. Your tests passed. ${fact.pullRequest === true ? "Merge it?" : "Mark it complete?"}`;
+            if (fact.checks === "off")
+                return `${ready}. Checks are off for this project, so look it over first.`;
+            return `${ready}, but no tests ran. Look it over first.`;
+        case "Failed":
+            if (fact.checks === "failed")
+                return fact.lead === true
+                    ? `I built ${lower}, but its tests failed. It waits for you: retry or ask for changes.`
+                    : `${name} is built, but its tests failed. It waits for you: retry or ask for changes.`;
+            return fact.lead === true
+                ? `I couldn't finish ${lower}. The work so far is kept; retry when you're ready.`
+                : `${name} stopped before it finished. The work so far is kept; retry when you're ready.`;
+        case "Complete":
+            if (fact.lead === true && fact.completedBy)
+                return `I marked ${lower} complete.`;
+            return fact.completedBy ? `${name} is done. ${fact.completedBy} marked it complete.` : `${name} is done.`;
+        case "Needs you":
+            return fact.lead === true ? `I need your decision on ${lower} before I can go on.` : `${name} needs your decision before it can continue.`;
+        default:
+            return `${name}: ${fact.headline.toLowerCase()}.`;
+    }
+}
+/** One task in a list of updates: "faster tests is ready", "cleanup failed". */
+function phraseOf(fact) {
+    const name = inSentence(fact.summary);
+    if (fact.update != null)
+        return `${name} ${fact.update.phrase}`;
+    switch (fact.headline) {
+        case "Ready for review": return `${name} is ready`;
+        case "Failed": return `${name} failed`;
+        case "Complete": return `${name} is done`;
+        case "Needs you": return `${name} needs you`;
+        default: return `${name}: ${fact.headline.toLowerCase()}`;
+    }
+}
+/** Several updates in one message: "4 tasks finished: faster tests, cleanup, …" (or "3 updates: …" when not all of
+ * them are finished work), then what broke and what happens next. */
+export function batchLine(facts) {
+    if (facts.length === 1)
+        return finishedLine(facts[0]);
+    const finishedOnly = facts.every(one => one.update == null);
+    const names = finishedOnly ? facts.map(one => inSentence(one.summary)) : facts.map(phraseOf);
+    const shown = names.slice(0, 3).join(", ");
+    const first = `${facts.length} ${finishedOnly ? "tasks finished" : "updates"}: ${shown}${names.length > 3 ? ", …" : "."}`;
+    // What happens next: anything that broke or needs a decision waits for the person.
+    const failed = facts.filter(one => one.headline === "Failed");
+    const needs = facts.filter(one => one.headline === "Needs you").length;
+    const broke = failed.length !== 1 ? `${failed.length} failed`
+        : failed[0].checks === "failed" ? `tests failed on ${inSentence(failed[0].summary)}` : `${inSentence(failed[0].summary)} stopped before it finished`;
+    const waits = [
+        ...(failed.length === 0 ? [] : [broke]),
+        ...(needs === 0 ? [] : [needs === facts.length ? "each needs your decision" : `${needs} ${needs === 1 ? "needs" : "need"} your decision`]),
+    ];
+    if (waits.length === 0)
+        return first;
+    const said = waits.join(", and ");
+    return `${first}\n${said[0].toUpperCase()}${said.slice(1)}; ${failed.length + needs === 1 ? "it waits" : "they wait"} for you.`;
+}
+/** The old product name a bot may still wear from before the rename. */
+const OLD_NAME = /standing\s*-?\s*orders/i;
+/**
+ * Name the Telegram bot Toolroll. On pairing it always becomes Toolroll; on upgrade only a bot still called
+ * StandingOrders is renamed, so a name a person chose later is kept. Best effort: a refused or failed call
+ * leaves the old name and never blocks pairing or delivery. Returns whether a rename was sent and accepted.
+ */
+export async function nameTelegramBot(transport, when) {
+    try {
+        const current = await transport("getMyName", {});
+        const name = current.ok ? current.result?.name : undefined;
+        const shown = typeof name === "string" ? name : null;
+        if (shown === BOT_NAME)
+            return false;
+        if (when === "upgrade" && (shown === null || !OLD_NAME.test(shown)))
+            return false;
+        const set = await transport("setMyName", { name: BOT_NAME });
+        return set.ok;
+    }
+    catch {
+        return false;
+    }
+}
+/** The last word on any pushed chat text: a task's own id (bare or in brackets), a "— revision" suffix and a
+ * "Replaced by <id>" never reach a chat, whatever words the fact was recorded with. A bare id reads as the
+ * task's short title when one is given, else "this task". */
+export function chatText(text, tasks = []) {
+    let out = text.replace(/(?:(?:[ \t]*[—–]+|[ \t]+-+)[ \t]*revision\b(?:[ \t]*#?\d+)?|[ \t]*[([][ \t]*revision(?:[ \t]*#?\d+)?[ \t]*[)\]])/giu, "");
+    out = out.replace(/\bReplaced by (?!a newer task)[^\s.,;:!?)]+/gu, "Replaced by a newer task");
+    for (const task of tasks) {
+        const id = typeof task === "string" ? task : task?.id;
+        if (!id || !idLike(id))
+            continue;
+        const title = typeof task === "object" && task !== null ? task.title : undefined;
+        out = out.replace(new RegExp(`[ \\t]*\\(${escape(id)}\\)|(?<![\\p{L}\\p{N}_/=-])${escape(id)}(?![\\p{L}\\p{N}_-])`, "gu"), match => match.trimStart().startsWith("(") ? "" : title ?? "this task");
+    }
+    return out;
+}
+/** The one button a plain fact may carry: its label names where its machine-minted console path goes; nothing in
+ * it comes from the fact's text. */
+export function factLinkLabel(path) {
+    if (/^\/review\?result=[^&]+&run=\d+&tab=checks$/.test(path))
+        return "Inspect result";
+    if (/^\/t\/[^?#]+#merge$/.test(path))
+        return "Merge";
+    if (/^\/chat\?task=[^&]+&result=/.test(path))
+        return "Open result";
+    if (/^\/(?:chat\?task=|t\/)/.test(path))
+        return "Open task";
+    if (/^\/d\//.test(path))
+        return "Open decision";
+    return "Open console";
+}
+/** Whether the words already name this title as a whole phrase (so it need not be said twice). */
+export function mentions(text, title) {
+    return new RegExp(`(?<![\\p{L}\\p{N}_-])${escape(title)}(?![\\p{L}\\p{N}_-])`, "u").test(text);
+}

package/dist/discord-chat.js

@@ -273,6 +273,7 @@ export async function deliverDiscordPart(options) {
                     }))
                     : []),
                 ...link(options.origin(), content.link),
+                ...(content.also ?? []).flatMap(one => link(options.origin(), one)),
             ];
         let target = content.edit ?? row.message;
         if (target && content.image && row.uploaded) {

package/dist/operate.d.ts

@@ -50,6 +50,8 @@ export type OperateOptions = {
     gitRunner?: CommandRunner;
     /** Injected by tests: the Telegram Bot API. Production dials the real one. */
     telegramTransport?: TelegramTransport;
+    /** Injected by tests: the environment checked for a fenced network before Telegram is reached (default: this process's, with the real transport). */
+    telegramEnv?: Record<string, string | undefined>;
     publishExec?: PublishExec;
     /** Injected by tests: the stop fence a watch would set. */
     shouldStop?: () => boolean;

package/dist/operate.js

@@ -1,3 +1,4 @@
+import { UNSENT_REPLY_MS } from "./telegram-settings.js";
 import { maybeTriggerRepair } from "./dispose.js";
 import { CHECK_LEVEL_HINTS, CHECK_LEVEL_WORDS, isCheckLevel, liveQuickCommand, projectCheckLevel, quickVerifyKey, setProjectCheckLevel, setTaskCheckLevel, suggestQuickCommand } from "./check-levels.js";
 import { fileAddTestsTask, followUpChecksOf, requestFollowUpChecks, runFollowUpCheck, runWaitingChecks } from "./result-follow-ups.js";
@@ -138,7 +139,7 @@ import { diagnoseTaskDispatch, diagnosisIsDispatchable, scopeApprovedForDispatch
 import { createDecisionServer } from "./serve.js";
 import { readTailnetNames } from "./tailnet.js";
 import { daemonLaunchCommand, daemonStatus, installReplacingLegacy, installedLegacyDaemon, planDaemon, uninstallDaemon, awaitFreshHeartbeat, } from "./daemon.js";
-import { bridgePass, clearBotToken, createTransport, followBridge, hashPairingCode, loadBotToken, mintPairingCode, redactToken, saveBotToken, PAIRING_TTL_MS, TOKEN_ENV, telegramHookSecret, telegramPushUrl, } from "./telegram.js";
+import { bridgePass, clearBotToken, createTransport, followBridge, hashPairingCode, loadBotToken, mintPairingCode, networkFence, networkFenceLine, redactToken, saveBotToken, PAIRING_TTL_MS, TOKEN_ENV, telegramHookSecret, telegramPushUrl, } from "./telegram.js";
 import { scanRepo } from "./capscan.js";
 import { computeGaps, describeCapability } from "./gaps.js";
 import { ask, askHidden, confirm, interactive, underAgent } from "./prompt.js";
@@ -198,7 +199,7 @@ import { updateAdmissionPaused, UPDATE_PAUSED } from "./desktop-update-gate.js";
 import { beads } from "./beads.js";
 import { githubIssues } from "./issues.js";
 import { installationStatus, renderInstallationStatus, renderTaskWait, repairStaleStatuses, taskWaitSnapshot } from "./lead-status.js";
-import { latestRelease, newerRelease, notifySecurityRelease, recordRunnerVersion, startUpdateChecks, updateLine } from "./releases.js";
+import { latestRelease, newerRelease, notifySecurityRelease, notifyVersionLive, recordRunnerVersion, startUpdateChecks, updateLine } from "./releases.js";
 import { installMethod } from "./install-method.js";
 import { PACKAGE_VERSION } from "./version.js";
 /**
@@ -820,6 +821,7 @@ export async function runOperate(command, argv, write, options = {}) {
             ...(options.agentRunner === undefined ? {} : { agentRunner: options.agentRunner }),
             ...(options.gitRunner === undefined ? {} : { gitRunner: options.gitRunner }),
             ...(options.telegramTransport === undefined ? {} : { telegramTransport: options.telegramTransport }),
+            ...(options.telegramEnv === undefined ? {} : { telegramEnv: options.telegramEnv }),
             ...(options.publishExec === undefined ? {} : { publishExec: options.publishExec }),
             ...(options.dispatchAdapter === undefined ? {} : { dispatchAdapter: options.dispatchAdapter }),
             ...(options.flowTriggerIo === undefined ? {} : { flowTriggerIo: options.flowTriggerIo }),
@@ -7288,6 +7290,50 @@ async function daemonCommand(positional, flags, context) {
 const WATCH_LEASE_MS = 90_000;
 const WATCH_HEARTBEAT_MS = 30_000;
 /** The start repair runs once per process, not once per project loop. */
+/**
+ * The Telegram follower: one actor on the wire that sends notifications and
+ * replies and reads what arrives, all over the same transport. Null when no
+ * bot token is saved, or when this process's network is fenced (it says so
+ * once instead of failing every send).
+ */
+function startTelegramFollower(args) {
+    const { context, progress, label } = args;
+    const source = loadBotToken(process.env, context.telegramTokenFile);
+    if (source === null)
+        return null;
+    const fence = networkFence(context.telegramEnv ?? (context.telegramTransport === undefined ? process.env : {}));
+    if (fence !== null) {
+        progress(networkFenceLine(fence));
+        return null;
+    }
+    const transport = context.telegramTransport ?? createTransport(source.token);
+    // v98: with a public hooks address (Tailscale Funnel covers /hooks), Telegram pushes updates to it instead.
+    const pushUrl = telegramPushUrl(readHooksBase(dirname(context.databaseFile)));
+    return followBridge(context.store, {
+        push: pushUrl === null ? null : { url: pushUrl, secret: telegramHookSecret(dirname(context.databaseFile), true) },
+        readProjects: telegramReadProjects(context),
+        canDeliver: telegramCanDeliver(context, source.token),
+        conversation: telegramConversation(context, args.publicUrl === undefined ? {} : { serverOrigin: args.publicUrl }),
+        botId: source.botId,
+        transport,
+        signal: args.signal,
+        ...(args.owner === undefined ? {} : { owner: args.owner }),
+        onCycle: cycle => {
+            // progress(), not write(): under --json this line went to stdout
+            // BESIDE the final envelope — the one stdout contamination in the
+            // watch (round-4 finding 12).
+            progress(`${label} sent ${cycle.sent}, answered ${cycle.answered}, paired ${cycle.paired}` +
+                ((cycle.statusReplies ?? 0) > 0 ? `, status replies ${cycle.statusReplies}` : "") +
+                ((cycle.chatQueued ?? 0) > 0 ? `, chat received ${cycle.chatQueued}` : "") +
+                ((cycle.chatAnswered ?? 0) > 0 ? `, chat replied ${cycle.chatAnswered}` : "") +
+                ((cycle.chatConfirmed ?? 0) > 0 ? `, chat confirmed ${cycle.chatConfirmed}` : "") +
+                (cycle.problems.length > 0 ? ` — ${cycle.problems.length} problem(s): ${cycle.problems[0].slice(0, 200)}` : ""));
+        },
+    }).catch(error => {
+        progress(`${args.died.prefix}the telegram follower died — ${describe(error)}; ${args.died.then}`);
+        return null;
+    });
+}
 let staleStatusesRepaired = false;
 async function runWatchLoop(args) {
     const { context, flags, runner, token, repo, progress } = args;
@@ -7324,6 +7370,11 @@ async function runWatchLoop(args) {
     // attributes to this episode by runner and window, and `brief
     // --latest-watch` bounds itself to exactly it.
     store.startWatchEpisode({ repo, runner, incarnation }, new Date());
+    // A deploy's one chat line, "Toolroll <version> is live.", when this worker last ran an older version.
+    try {
+        notifyVersionLive(store, dirname(context.databaseFile), PACKAGE_VERSION, new Date());
+    }
+    catch { /* A display fact; never blocks the worker. */ }
     recordRunnerVersion(dirname(context.databaseFile), runner, PACKAGE_VERSION, new Date());
     args.onReady?.();
     // Once per worker start, before any pass: statuses an older build left
@@ -7361,38 +7412,13 @@ async function runWatchLoop(args) {
     // moment they arrive, and answering bumps the wake sequence, so the very
     // loop below wakes and resumes the freed task — phone to build, seconds.
     // The poll lease keeps this the only live poller; a cron `bridge
-    // telegram` overlapping it loses the lease race and reports busy.
-    let follower = null;
-    const followSource = loadBotToken(process.env, context.telegramTokenFile);
-    if (followSource !== null) {
-        const transport = context.telegramTransport ?? createTransport(followSource.token);
-        const publicUrl = text(flags, "public-url");
-        // v98: with a public hooks address (Tailscale Funnel covers /hooks), Telegram pushes updates to it instead.
-        const pushUrl = telegramPushUrl(readHooksBase(dirname(context.databaseFile)));
-        follower = followBridge(store, {
-            push: pushUrl === null ? null : { url: pushUrl, secret: telegramHookSecret(dirname(context.databaseFile), true) },
-            readProjects: telegramReadProjects(context),
-            canDeliver: telegramCanDeliver(context, followSource.token),
-            conversation: telegramConversation(context, publicUrl === undefined ? {} : { serverOrigin: publicUrl }),
-            botId: followSource.botId,
-            transport,
-            signal: followController.signal,
-            onCycle: cycle => {
-                // progress(), not write(): under --json this line went to stdout
-                // BESIDE the final envelope — the one stdout contamination in the
-                // watch (round-4 finding 12).
-                progress(`watch: bridge sent ${cycle.sent}, answered ${cycle.answered}, paired ${cycle.paired}` +
-                    ((cycle.statusReplies ?? 0) > 0 ? `, status replies ${cycle.statusReplies}` : "") +
-                    ((cycle.chatQueued ?? 0) > 0 ? `, chat received ${cycle.chatQueued}` : "") +
-                    ((cycle.chatAnswered ?? 0) > 0 ? `, chat replied ${cycle.chatAnswered}` : "") +
-                    ((cycle.chatConfirmed ?? 0) > 0 ? `, chat confirmed ${cycle.chatConfirmed}` : "") +
-                    (cycle.problems.length > 0 ? ` — ${cycle.problems.length} problem(s): ${cycle.problems[0].slice(0, 200)}` : ""));
-            },
-        }).catch(error => {
-            progress(`watch: the telegram follower died — ${describe(error)}; taps wait for the next watch`);
-            return null;
-        });
-    }
+    // telegram` overlapping it loses the lease race and reports busy. Under
+    // `up` the service runs the one follower itself and project loops leave
+    // Telegram to it.
+    const serviceBridge = args.serviceBridge === true;
+    const follower = serviceBridge
+        ? null
+        : startTelegramFollower({ context, publicUrl: text(flags, "public-url"), signal: followController.signal, progress, label: "watch: bridge", died: { prefix: "watch: ", then: "taps wait for the next watch" } });
     const slackFollower = followSlack({ store, dir: dirname(context.databaseFile), signal: followController.signal,
         readProjects: telegramReadProjects(context), evidenceRoot: context.evidenceRoot,
         ...(context.mateSeams?.subscriptionRunner ? { subscriptionRunner: context.mateSeams.subscriptionRunner } : {}),
@@ -7685,7 +7711,7 @@ async function runWatchLoop(args) {
             // pass is the fallback shape for a watch started before a token existed.
             if (follower === null && now - lastBridge >= bridgeEveryMs) {
                 lastBridge = now;
-                const source = loadBotToken(process.env, context.telegramTokenFile);
+                const source = serviceBridge ? null : loadBotToken(process.env, context.telegramTokenFile);
                 const dir = dirname(context.databaseFile);
                 // Exactly ONE service carries the pages — the chosen primary, or
                 // the sensible implicit one. Telegram keeps draining taps and
@@ -8533,6 +8559,7 @@ async function upCommand(flags, context) {
             onFollowController: controller => followControllers.push(controller),
             containmentLines,
             passes: projectPasses,
+            serviceBridge: true,
             onReady: () => {
                 markReady();
                 if (bind)
@@ -8552,6 +8579,33 @@ async function upCommand(flags, context) {
         await ready;
     };
     await Promise.all(repos.map(repo => launchRepo(repo, false)));
+    // Telegram: one follower for the whole service, never one per project
+    // loop. Replies and notifications go out from it, over the same transport
+    // in the same cycle (Oct 2: a reply sent by a project loop's own follower
+    // failed "fetch failed" while notifications went out). A token saved
+    // while the service runs connects within seconds; a follower that dies
+    // is started again.
+    const telegramController = new AbortController();
+    followControllers.push(telegramController);
+    const telegramSupervisor = (async () => {
+        const pause = (ms) => new Promise(resolvePause => {
+            const timer = setTimeout(done, ms);
+            function done() { clearTimeout(timer); telegramController.signal.removeEventListener("abort", done); resolvePause(); }
+            telegramController.signal.addEventListener("abort", done, { once: true });
+        });
+        while (!stopping && !telegramController.signal.aborted) {
+            const follower = startTelegramFollower({
+                context, publicUrl: text(flags, "public-url"), signal: telegramController.signal, progress, label: "telegram:",
+                died: { prefix: "", then: "starting it again" }, owner: `service-${randomUUID()}`,
+            });
+            if (follower !== null)
+                await follower;
+            // Without a token (or on a fenced network) look again shortly; the fence line is said once.
+            if (follower === null && loadBotToken(process.env, context.telegramTokenFile) !== null)
+                break;
+            await pause(follower === null ? 2_000 : 5_000);
+        }
+    })();
     const dynamicCeiling = resolveCeiling(repos, projectRoots).ceiling;
     const rejected = new Set();
     const registrySupervisor = (async () => {
@@ -8613,6 +8667,10 @@ async function upCommand(flags, context) {
         });
     };
     observeReadiness();
+    try {
+        notifyVersionLive(context.store, dirname(context.databaseFile), PACKAGE_VERSION, clock());
+    }
+    catch { /* A display fact; never blocks the worker. */ }
     recordRunnerVersion(dirname(context.databaseFile), runnerName, PACKAGE_VERSION, clock());
     const runnerHeartbeat = setInterval(() => {
         const beat = heartbeatRunner(store, runnerName, runnerToken, clock());
@@ -8682,6 +8740,7 @@ async function upCommand(flags, context) {
     await stopped;
     await registrySupervisor;
     await Promise.all([...loopResults.values()]);
+    await telegramSupervisor;
     clearInterval(runnerHeartbeat);
     if (runTimer !== undefined)
         clearTimeout(runTimer);
@@ -8729,6 +8788,7 @@ async function upCommand(flags, context) {
  *   bridge telegram token [<bot-token>|--clear]   set the credential file
  *   bridge telegram status
  *   bridge telegram digest [--every 30m|2h|24h | --off]   away mode: routine facts batch, decisions still page
+ *   bridge telegram retry                send unsent assistant replies again now
  *
  * The bot token comes from ${TOKEN_ENV} or the credential file this command
  * writes (0600, beside the database). Cron the pass right after tick; a
@@ -8745,7 +8805,14 @@ async function bridgeCommand(positional, flags, context) {
         return demoFence;
     const [channel, action] = positional;
     if (channel !== "telegram") {
-        return fail(write, json, "bridge", "usage", "`toolroll bridge telegram [pair|unpair|token|status|digest]`", EXIT.usage);
+        return fail(write, json, "bridge", "usage", "`toolroll bridge telegram [pair|unpair|token|status|digest|retry]`", EXIT.usage);
+    }
+    if (action === "retry") {
+        // Replies already written and fenced on the pairing like every send: this only moves their next attempt to now.
+        const retried = store.retryTelegramReplies(null, clock());
+        return succeed(write, json, "bridge retry", { retried }, () => [
+            retried === 0 ? "No unsent Telegram replies." : `Sending ${retried} Telegram ${retried === 1 ? "reply" : "replies"} again on the next bridge pass.`,
+        ]);
     }
     if (action === "token") {
         const value = positional[2];
@@ -8862,6 +8929,9 @@ async function bridgeCommand(positional, flags, context) {
     if (source === null) {
         return fail(write, json, "bridge", "no-token", `no bot token — set ${TOKEN_ENV}, run \`toolroll bridge telegram token <t>\`, or use the serve settings card`, EXIT.refused);
     }
+    const fenced = networkFence(context.telegramEnv ?? (context.telegramTransport === undefined ? process.env : {}));
+    if (fenced !== null)
+        return fail(write, json, "bridge", "network-fenced", networkFenceLine(fenced), EXIT.refused);
     const transport = context.telegramTransport ?? createTransport(source.token);
     // --follow: stay on the wire. One long-poll actor holds the poll lease;
     // an answer tapped on a phone lands in seconds instead of at the next
@@ -9579,7 +9649,18 @@ async function statusCommand(positional, flags, context) {
     const projects = projectBuildsStatus(context);
     const projectsLine = projects.length === 0 ? null
         : `Builds by project: ${projects.slice(0, 8).map(one => `${one.name} ${one.running} of ${one.limit}`).join(", ")}${projects.length > 8 ? ", …" : ""}`;
-    return succeed(context.write, context.json, command, { ...status, projects, ...update, ...integrations, ...updateWaiting }, () => [...(waiting === null ? [] : [waiting.words]), ...renderInstallationStatus(status), ...(projectsLine === null ? [] : [projectsLine]), ...(line === null ? [] : [line]), ...(brokenLine === null ? [] : [brokenLine])]);
+    // A Telegram reply written but still not sent after two minutes, with its Retry.
+    const unsent = context.store.unsentTelegramReplies(null, null, new Date(context.clock().getTime() - UNSENT_REPLY_MS));
+    const unsentLine = unsentRepliesLine(unsent);
+    const unsentReplies = unsent.length === 0 ? {} : { unsentReplies: unsent.map(one => ({ ...one, retry: "toolroll bridge telegram retry" })) };
+    return succeed(context.write, context.json, command, { ...status, projects, ...update, ...integrations, ...updateWaiting, ...unsentReplies }, () => [...(waiting === null ? [] : [waiting.words]), ...(unsentLine === null ? [] : [unsentLine]), ...renderInstallationStatus(status), ...(projectsLine === null ? [] : [projectsLine]), ...(line === null ? [] : [line]), ...(brokenLine === null ? [] : [brokenLine])]);
+}
+function unsentRepliesLine(unsent) {
+    if (unsent.length === 0)
+        return null;
+    const oldest = unsent[0];
+    const what = unsent.length === 1 ? "A Telegram reply hasn't" : `${unsent.length} Telegram replies haven't`;
+    return `${what} been sent since ${oldest.since.slice(11, 16)} UTC${oldest.error === null ? "" : ` (${oldest.error})`}. Retry: toolroll bridge telegram retry`;
 }
 /** Each known project's running builds against its limit: its own number, never past its workers' capacity. */
 function projectBuildsStatus(context) {

package/dist/project-delete.js

@@ -232,6 +232,7 @@ function deleteRows(store, repo, d, now) {
     del("telegram_conversation", IN("id"), conversations);
     del("telegram_outbound_message", `project = ? OR ${IN("notification")} OR ${IN("task_ref")} OR ${IN("source_run")}`, repo, notifications, T, R);
     del("chat_card_task", IN("task_ref"), T);
+    del("chat_batch_item", IN("task_ref"), T);
     del("push_delivery", IN("notification"), notifications);
     del("notification_actor", IN("notification"), notifications);
     del("notification_delivery", IN("notification"), notifications);

package/dist/releases.d.ts

@@ -83,3 +83,12 @@ export declare function latestVersionNow(io?: {
 }): Promise<{
     version: string;
 }>;
+/** What a release says about itself in one line ("Release 0.9.9: lighter tests, cleaner status"), when its notes
+ * have such a line; null otherwise. */
+export declare function releaseSummary(notes: string, version: string): string | null;
+/**
+ * A deploy says one thing in chat: "Toolroll 0.9.9 is live." (with the release's own one-line summary when its
+ * notes have one). Once per version, addressed to each instance operator, and only when a worker on this
+ * computer last ran an older version: a fresh install is not news. Call before recording this runner's version.
+ */
+export declare function notifyVersionLive(store: Store, dir: string, version: string, now: Date): number;

package/dist/releases.js

@@ -236,3 +236,33 @@ export async function latestVersionNow(io = {}) {
         throw new Error("npm did not name a version");
     return { version };
 }
+/** What a release says about itself in one line ("Release 0.9.9: lighter tests, cleaner status"), when its notes
+ * have such a line; null otherwise. */
+export function releaseSummary(notes, version) {
+    const escaped = version.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const line = new RegExp(`^\\s*(?:#{1,6}\\s*)?(?:Toolroll\\s+)?(?:Release\\s+)?v?${escaped}\\s*[:—–-]\\s*(.+?)\\s*$`, "im").exec(notes);
+    const summary = line?.[1]?.replace(/[*_`]/g, "").replace(/\s+/g, " ").replace(/[.\s]+$/, "").trim() ?? "";
+    if (summary === "")
+        return null;
+    return summary.length <= 80 ? summary : `${summary.slice(0, 79).replace(/[\s,;:]+\S*$/, "")}…`;
+}
+/**
+ * A deploy says one thing in chat: "Toolroll 0.9.9 is live." (with the release's own one-line summary when its
+ * notes have one). Once per version, addressed to each instance operator, and only when a worker on this
+ * computer last ran an older version: a fresh install is not news. Call before recording this runner's version.
+ */
+export function notifyVersionLive(store, dir, version, now) {
+    const before = runnerVersions(dir);
+    if (!VERSION.test(version) || !before.some(one => isNewer(version, one.version)) || before.some(one => isNewer(one.version, version)))
+        return 0;
+    const cached = cachedRelease(dir);
+    const summary = cached?.version === version ? releaseSummary(cached.notes, version) : null;
+    const line = summary === null ? `Toolroll ${version} is live.` : `Toolroll ${version} is live: ${summary}.`;
+    let queued = 0;
+    for (const recipient of store.accountFacts().map(one => one.name).filter(name => store.isInstanceOperator(name))) {
+        if (store.enqueueNotification({ dedupeKey: `release:live:${version}:${recipient}`, kind: "version-live", subject: line, body: "",
+            recipient, source: { installation: true } }, now))
+            queued++;
+    }
+    return queued;
+}

package/dist/serve.js

@@ -1674,7 +1674,7 @@ export function createDecisionServer(options) {
         // separately proves cookie, approver standing and password; instance bot
         // settings remain outside this exact allowlist.
         if ((request.method === "GET" && path === "/settings/telegram") ||
-            (request.method === "POST" && ["/settings/telegram/pair", "/settings/telegram/unpair"].includes(path)))
+            (request.method === "POST" && ["/settings/telegram/pair", "/settings/telegram/unpair", "/settings/telegram/retry"].includes(path)))
             return true;
         // Coding routes require an instance operator, then prove saved ownership and project access.
         if (path === "/code" || path.startsWith("/code/"))
@@ -4066,7 +4066,7 @@ export function createDecisionServer(options) {
             // The settings view holds no secret (a pairing code only appears in
             // the response to Pair, which stays script-free), so it joins the
             // workspace like every other settings page.
-            return sendScreen(response, 200, screen("Telegram", telegramSettingsHtml(store, botId, who.name, who.session.csrf), { chrome: chromeFor(project, "settings") }));
+            return sendScreen(response, 200, screen("Telegram", telegramSettingsHtml(store, botId, who.name, who.session.csrf, { now }), { chrome: chromeFor(project, "settings") }));
         }
         if (url.pathname === "/settings/teams") {
             if (who.via !== "cookie" || who.role !== "approver" || restricted() || !options.configDir)
@@ -7885,6 +7885,13 @@ export function createDecisionServer(options) {
             }
             return redirect(response, "/settings/slack");
         }
+        if (url.pathname === "/settings/telegram/retry") {
+            // The signed-in person's own unsent replies only: already written and fenced on the pairing; this sends them again now.
+            if (who.via !== "cookie" || who.role !== "approver")
+                return refuse(response, who, 403, "An approver can retry their own replies.", "/settings");
+            store.retryTelegramReplies(who.name, now);
+            return redirect(response, "/settings/telegram");
+        }
         if (url.pathname === "/settings/telegram/pair" || url.pathname === "/settings/telegram/unpair") {
             // The person's own pairing, under their password: a code minted for
             // them alone, or their own chats revoked. Teammates' pairings are

package/dist/slack-chat.js

@@ -360,6 +360,8 @@ export async function deliverSlackPart(options) {
                     }))
                     : []),
                 ...linkButton(options.origin(), content.link),
+                // [Look first] beside [Merge] or [Mark complete]: each button's own action id.
+                ...(content.also ?? []).flatMap((one, index) => linkButton(options.origin(), one).map(button => ({ ...button, action_id: `toolroll_link_${index + 2}` }))),
             ];
         const target = content.edit ?? row.message;
         const args = {

package/dist/store.d.ts

@@ -990,6 +990,18 @@ export type ChatCard = {
     digest: string | null;
     tasks: number[];
 };
+export type ChatBatch = {
+    id: number;
+    destination: string;
+    openedAt: string;
+    message: string | null;
+    digest: string | null;
+    items: {
+        taskRef: number;
+        run: number | null;
+        notification: number | null;
+    }[];
+};
 /**
  * What one recovery walk over a gone runner's work settled (P0.1a): the run
  * ids it finished as failed/interrupted and the built-in task ids it returned
@@ -4609,6 +4621,7 @@ export declare class Store {
     enqueueEpisode(prefix: string, notification: Omit<NotificationInput, "dedupeKey">, suffix: string, now: Date): boolean;
     /** Close every open episode under a prefix — the fault is provably gone. */
     resolveEpisodes(prefix: string, now: Date): number;
+    notificationById(id: number): Notification | null;
     notificationsAfter(id: number, limit?: number): Notification[];
     listNotifications(only?: "pending" | "all"): Notification[];
     recordDelivery(id: number, outcome: {
@@ -7281,7 +7294,7 @@ export declare class Store {
      * under a claim that lapsed (a crash mid-turn), and not deferred past now.
      * One at a time per bot — the mate runs one turn per approver anyway.
      */
-    claimTelegramConversation(botId: string, owner: string, ttlMs: number, now: Date): TelegramConversation | null;
+    claimTelegramConversation(botId: string, owner: string, ttlMs: number, now: Date, only?: "turns" | "replies"): TelegramConversation | null;
     /** Extend a held claim; false means it lapsed and somebody else may hold the row. */
     renewTelegramConversation(id: number, owner: string, ttlMs: number, now: Date): boolean;
     /**
@@ -7308,6 +7321,20 @@ export declare class Store {
         outcome: string;
         nextAttemptAt: string;
     }, now: Date): boolean;
+    /**
+     * Replies the assistant wrote that still have not reached the person
+     * `since` ago or longer (status and the console show them with a Retry):
+     * the message's row, whose it is, when the oldest unsent part was
+     * written, and the last send error.
+     */
+    unsentTelegramReplies(botId: string | null, approver: string | null, since: Date): {
+        conversation: number;
+        approver: string;
+        since: string;
+        error: string | null;
+    }[];
+    /** Send unsent replies on the next bridge pass instead of waiting out their backoff; returns how many. */
+    retryTelegramReplies(approver: string | null, now: Date): number;
     /**
      * Persist the whole outbound half of a turn — every reply part and every
      * card, with the cards' tokens already minted — in one transaction, BEFORE
@@ -7477,6 +7504,12 @@ export declare class Store {
      * and the evening digest keep every fact either way.
      */
     pingAllowed(row: Pick<Notification, "id" | "kind" | "recipient" | "project" | "taskRef">, account: string): boolean;
+    /** Who last completed or cancelled this task, when that is still its latest act: null otherwise. A revision's
+     * completion is recorded on its root, so an act on a task it revises counts too, but only one made after this
+     * revision was filed: settling older work never silences a newer revision, whose failures still reach people. */
+    settledBy(taskRef: number): string | null;
+    /** A release check, a replaced task, or one a revision superseded: its facts stay in the console. */
+    neverPings(taskRef: number): boolean;
     /** The lead's work, which messages nobody: unless it is a security alert or a failure with nothing left for the lead. */
     leadQuiet(row: Pick<Notification, "id" | "kind" | "taskRef">, actor?: Actor | null): boolean;
     /** A failure with nothing left for the lead to do: its attempts are spent, or the task has failed for good. */
@@ -7492,6 +7525,11 @@ export declare class Store {
     } | null;
     /** Task-bound facts recorded since an instant, newest last (bounded): what an evening digest reads. */
     taskFactsSince(since: string, limit?: number): Notification[];
+    /** The one message this update joins: the destination's batch opened within `windowMs`, or a new one. A task
+     * has one line in it, saying its newest update (`notification`; null for a finished result). */
+    chatBatchFor(destination: string, taskRef: number, run: number | null, now: Date, windowMs: number, notification?: number | null): ChatBatch;
+    chatBatch(id: number): ChatBatch | null;
+    setChatBatchMessage(id: number, message: string, digest: string): void;
     /** The message now showing this card, and what it shows. */
     setChatCardMessage(id: number, message: string, digest: string): void;
     markTelegramDigestSent(now: Date): void;