toolroll 0.9.90 → 0.9.91

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## 0.9.91 — 2026-11-04
+
+- **A deploy checks your HTTPS console before it changes anything.** If the
+  console you reach Toolroll through (over Tailscale, say) doesn't answer, the
+  deploy now stops before it pauses new work or stops the running service,
+  and says to bring the console back. It used to find out only at the end,
+  with the new version already running and new work paused.
+- **A release finishes a deploy that stopped after the new version started.**
+  If a deploy's last check failed once the new version was already running
+  (an HTTPS console that didn't answer, say), `toolroll release` sent you to
+  `toolroll release --recover-deploy`, which sent you back, and new work
+  stayed paused. Rerunning the release now finishes the deploy: it checks
+  the new service, both consoles and the project workers, then lifts the
+  pause.
+- **A resumed release reads its task with its own build.** It used to call
+  whichever `toolroll` came first on your PATH, which until the release
+  relinks it is still the previous version and can't open a database the
+  deploy just upgraded.
+
 ## 0.9.90 — 2026-11-04
 
 - **Type `toolroll` and you're in.** At your own terminal, bare `toolroll`

package/dist/release-adapters.d.ts

@@ -62,6 +62,8 @@ export type AdapterOptions = {
     formula?: string;
     /** How long the deployment itself may run, in minutes. */
     deployMinutes?: number;
+    /** The Toolroll CLI the release calls, as [program, ...leading args]; by default this runtime's own bin.js. */
+    cli?: readonly string[];
     run?: Exec;
     fetch?: typeof fetch;
     say?: (line: string) => void;

package/dist/release-adapters.js

@@ -10,6 +10,7 @@ import { existsSync, lstatSync, mkdtempSync, readdirSync, readFileSync, realpath
 import { homedir, tmpdir } from "node:os";
 import { basename, delimiter, dirname, join } from "node:path";
 import { createRequire } from "node:module";
+import { fileURLToPath } from "node:url";
 import { parse as parseYaml } from "yaml";
 import { sleep } from "./sleep.js";
 import { callLabel, readOnlyCall, retryCall, retryingExec, writeWithRecheck } from "./release-net.js";
@@ -50,6 +51,13 @@ export const exec = (command, args, options = {}) => new Promise(done => {
         child.stdin?.end();
 });
 /** Without NODE_OPTIONS, which a test runner or debugger may have left for this process. */
+/** This runtime's own CLI (dist/bin.js beside this module) when it has one; from source, `toolroll` as installed. */
+const ownCli = () => {
+    const bin = join(dirname(fileURLToPath(import.meta.url)), "bin.js");
+    return existsSync(bin) ? [process.execPath, bin] : ["toolroll"];
+};
+/** Journal phases the deployment's finish accepts (scripts/deploy-phases.mjs finish): the new service runs, unproven. */
+const FINISHES_FORWARD = Object.freeze(["started", "healthy"]);
 const cleanEnv = (extra = {}) => {
     const env = { ...process.env, ...extra };
     delete env["NODE_OPTIONS"];
@@ -244,8 +252,11 @@ export function releaseAdapters(options) {
     /** A write by gh, never retried by itself. */
     const ghWrite = (remainingMs, ...args) => run(tools.gh, args, { cwd: "/", env: gitEnv, timeoutMs: Math.min(120_000, remainingMs) });
     const ghJson = async (what, ...args) => JSON.parse(await must(gh(...args), what));
+    // The build running this release, never a PATH lookup: until the link step, `toolroll` on PATH is still the previous
+    // build, which refuses a database the deployment migrated, so a release resumed after its deploy couldn't read its task.
+    const cli = options.cli ?? ownCli();
     const toolroll = async (...args) => {
-        const result = await run("toolroll", [...args, "--json"], { env: cleanEnv(), timeoutMs: 120_000 });
+        const result = await run(cli[0], [...cli.slice(1), ...args, "--json"], { env: cleanEnv(), timeoutMs: 120_000 });
         try {
             return object(JSON.parse(result.stdout));
         }
@@ -562,6 +573,24 @@ export function releaseAdapters(options) {
                 const running = (options.processes ?? processes)().filter(one => one.command.includes("deploy-browser.mjs") && one.command.includes(stage));
                 if (running.length > 0)
                     return { ok: false, message: `the deployment is still running (process ${running.map(one => one.pid).join(", ")}); let it finish, then rerun` };
+                // The new service started (deploy-rescue.ts FORWARD_ONLY): recovery refuses to roll it back, so the release
+                // resumes it forward with the deployment's own finish (health, both consoles, leases, then the pause lifted).
+                // Finishing deploys, so the candidate is proven first, as for a deploy.
+                const phase = (() => { try {
+                    return object(JSON.parse(readFileSync(join(stage, "deployment.json"), "utf8")))["phase"];
+                }
+                catch {
+                    return undefined;
+                } })();
+                if (FINISHES_FORWARD.includes(String(phase))) {
+                    const proven = proveCandidate(runId);
+                    if (!proven.ok)
+                        return stopped(stage, proven.message);
+                    const finished = await deployScript(worktree, stage, runId, proven, ["--yes", "--phase", "finish"]);
+                    if (finished.code === 0)
+                        return { ok: true };
+                    return stopped(stage, `${tail(finished)} (the deployment journal is at ${String(phase)}; finishing it forward stopped; ${join(stage, "deployment.json")})`);
+                }
                 // Recovery needs no approval, but it runs only the recorded commit's own script, extracted by this runtime.
                 const recorded = recordedCommit(runId);
                 if (recorded === null)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolroll",
-  "version": "0.9.90",
+  "version": "0.9.91",
   "description": "A control plane for unattended coding agents — queue tasks, walk away, come back to pull requests. Agents build in leased worktrees, never touch your default branch, and interrupt you only for decisions that need a human.",
   "directories": {
     "doc": "docs"