7947bea · 810ec2a · 63f27c7
@@ -143,7 +143,7 @@
for a tunnel and a forge that sleeps.
| `read_file` | a file (utf-8, or base64 for binary) or a directory listing at a ref, as GET …/contents; MP4/MOV/M4A files also carry about: {kind, seconds, width?, height?, says} |  |
| `release_hold` | (admin scope) `{ reason }` or `{ lift }`: hold the release keeper (#7557) with a reason, so it cuts nothing until the hold is lifted; or lift an owner hold by its id. A failed verify's hold is lifted by a verified release after a pull saying `release hold N` lands, not here. A person who may roll back, with an admin-scope token, never an agent | yes |
| `release_keeper` | `{}`: what the release keeper (#7557) did: its releases newest first (version, commit (short sha), stage — rolling, verifying, verified or rolled_back —, the known-good version it would roll back to, roll probes and non-200s, probes and pages under load, worst ms, seconds dark, reason, landedToLiveSeconds — from the merge of its pull to the new version answering, null until it has (#8042)) and its holds (kind failed or owner, version, reason, probe numbers, the pull that said `release hold N`, lifted); `blocked` says what stops the next cut; for whoever may read /releases |  |
| `releases` | `{shipped: true}`: what went live, for anyone: `version`, `commit`, `live` (newest first: `repo`, `number`, `title`, `at`) and `onItsWay` (landed, not yet in the running commit), the list /changelog shows. `{}`: the forge's kept releases newest first: short sha, version, the pull that landed it, when, and for the live one `live: true` and `since`; for whoever may read /releases, others get its refusal; no rollback, a person does that on the page |  |
| `releases` | `{shipped: true, repo?}`: what went live, for anyone: `version`, `commit`, `live` (newest first: `repo`, `number`, `title`, `at`) and `onItsWay` (landed, not yet in the running commit), the list /changelog shows, for `repo` (`all` or `owner/name`; absent is every repository). `{}`: the forge's kept releases newest first: short sha, version, the pull that landed it, when, and for the live one `live: true` and `since`; for whoever may read /releases, others get its refusal; no rollback, a person does that on the page |  |
| `repo` | `{ repo }`: one repository's description, visibility, autonomy, `audience { level, sentence }` and `provenance` (where a migrated one came from, `null` when hidden), the same as `GET /api/v1/repos/:owner/:name` |  |
| `repo_labels` | `{ repo, action?, name?, color?, id? }`: list (`list`, the default, paged by `limit` 1–200 and `cursor`, as `{ items, next_cursor }`, each label with `open`, its open issues and pulls, for a writer; a read-only token may), create (`create`, `name`, `color` six hex digits), rename or recolour (`update`, `id`, `name` and/or `color`, as the labels page) or remove (`remove`, `id`) the repository's labels, as `GET`/`POST …/labels` and `PATCH`/`DELETE …/labels/:id`; create, update and remove need an admin token and a repository admin | yes |
| `repo_settings` | (admin scope) `{ repo, description?, visibility? }` (admin): change a repository's description and visibility as `PATCH /api/v1/repos/:owner/:name` does, for the same callers (a repository admin); answers `{ repo, description, visibility }` (with none to change it only reads); a visibility other than public or private is `invalid` | yes |
@@ -11,3 +11,7 @@
One bounded `git log` read, cached per head oid; Server-Timing names `releases`
`/changelog` lists the pulls merged into a default branch, newest first, grouped by UTC day: title, link, repository, when it landed. A pull to the forge's own repository (`FORGE_REPO`) counts only once the running commit (`FORGE_COMMIT`, the one `/api/v1/health` reports; the default branch head for a forge run from source) contains its merge commit, asked of git with `merge-base --is-ancestor` and kept while live. Landed but not yet contained shows above as "On its way". A pull to any other public repository is live when it lands. The top line says the live version and commit and how many shipped today. `?repo=all` or `?repo=owner/name` filters; the forge's own repository is the default.
The list is a live region (`pull.merged`, `app.serving`): it swaps in place without a reload. MCP `releases` with `{shipped: true}` answers the same list to anyone. The "no release" alarm reads the same record (`release/landings.ts`), refreshed each minute, and is silent until a read has happened. The older `Release <version>: …` commit read (`release/changelog.ts`) now serves only the terminal's Changelog screen.
## For agents
`GET /api/v1/changelog` is the page's list as JSON, public, cached five seconds: `{version, commit, live, onItsWay}`, each landing `{repo, number, title, at, live}`. `?repo=all` or `?repo=owner/name` filters; the default is the forge's own repository, as on the page. MCP `releases` with `{shipped: true, repo?}` and `GET /api/v1/releases?shipped=true[&repo=]` answer the same rows with the same default. Only public repositories are read; concurrent requests share one read of git and the merged rows, so an anonymous caller costs no more than a page view. The page links the JSON with `rel="alternate"`. The terminal's Changelog screen is the release-commit view (`release/changelog.ts`); it does not show the landings list.
@@ -0,0 +1,10 @@
import type { Route } from "../shared.ts";
export const route: Route = {
  method: "get",
  path: "/api/v1/changelog",
  summary: "What went live and what is on its way, as /changelog shows it, for anyone: version, commit, live and onItsWay rows (repo, number, title, at) of public repositories; ?repo=all|owner/name, this forge's own by default (all when it has none)",
  auth: false,
  query: { repo: "string" },
  refusals: {},
};
@@ -50,6 +50,7 @@
export { route as getApiV1BoardsPins } from "./getApiV1BoardsPins.ts";
export { route as getApiV1BoardsSlug } from "./getApiV1BoardsSlug.ts";
export { route as getApiV1BoardsSlugPanelsId } from "./getApiV1BoardsSlugPanelsId.ts";
export { route as getApiV1BoardsSources } from "./getApiV1BoardsSources.ts";
export { route as getApiV1Changelog } from "./getApiV1Changelog.ts";
export { route as getApiV1CloudAccounts } from "./getApiV1CloudAccounts.ts";
export { route as getApiV1Contribute } from "./getApiV1Contribute.ts";
export { route as getApiV1ConversationTurns } from "./getApiV1ConversationTurns.ts";
@@ -16,7 +16,7 @@
export function releasesRoutes(router: Router<Handler>): void {
    const shipped = ctx.url.searchParams.get("shipped");
    if (shipped !== null && shipped !== "true")
      return apiError("invalid_shipped", 422, "shipped is true (what went live) or absent (the kept releases)");
    if (shipped === "true") return json(await shippedAnswer(ctx.app));
    if (shipped === "true") return json(await shippedAnswer(ctx.app, ctx.url.searchParams.get("repo")));
    const answer = releasesAnswer(ctx.app, ctx.auth.user);
    return answer.ok ? json(answer.value) : apiError(answer.error, 403, answer.message);
  });
@@ -3,12 +3,12 @@
import { bad, good, type Tool } from "../shared.ts";
export const tool: Tool = {
  name: "releases",
  doc: "`{shipped: true}`: what went live, for anyone: `version`, `commit`, `live` (newest first: `repo`, `number`, `title`, `at`) and `onItsWay` (landed, not yet in the running commit), the list /changelog shows. `{}`: the forge's kept releases newest first: short sha, version, the pull that landed it, when, and for the live one `live: true` and `since`; for whoever may read /releases, others get its refusal; no rollback, a person does that on the page",
  doc: "`{shipped: true, repo?}`: what went live, for anyone: `version`, `commit`, `live` (newest first: `repo`, `number`, `title`, `at`) and `onItsWay` (landed, not yet in the running commit), the list /changelog shows, for `repo` (`all` or `owner/name`; absent is the forge's own, as on the page). `{}`: the forge's kept releases newest first: short sha, version, the pull that landed it, when, and for the live one `live: true` and `since`; for whoever may read /releases, others get its refusal; no rollback, a person does that on the page",
  description: "Kept releases, newest first.",
  inputSchema: { type: "object", properties: { shipped: { type: "boolean" } } },
  inputSchema: { type: "object", properties: { shipped: { type: "boolean" }, repo: { type: "string" } } },
  writes: false,
  async run(ctx, user, args) {
    if (args["shipped"] === true) return good(await shippedAnswer(ctx.app));
    if (args["shipped"] === true) return good(await shippedAnswer(ctx.app, typeof args["repo"] === "string" ? args["repo"] : null));
    // The page's own gate: its refusal, in words.
    const answer = releasesAnswer(ctx.app, user);
    return answer.ok ? good(answer.value) : bad(answer.error, answer.message);
@@ -171,7 +171,7 @@
import {
  domainsMoved,
} from "../web/pages/backups.ts";
import { apiPage, appApiPage } from "../web/pages/api.ts";
import { changelogPage } from "../web/pages/changelog.ts";
import { changelogJson, changelogPage } from "../web/pages/changelog.ts";
import { releaseHoldSubmit, liftSubmit, releasesPage, rollbackSubmit } from "../web/pages/releases.ts";
import {
  cloudAdd,
@@ -1568,6 +1568,8 @@
export function buildApiRouter(): Router<Handler> {
  apiRoutes(router);
  feedRoutes(router);
  checksRecheckRoutes(router);
  // What went live, as /changelog shows it; the page's own module answers.
  router.add("GET", "/api/v1/changelog", changelogJson);
  // The reference page for these routes lives at their root, so it answers here.
  router.add("GET", "/api", apiPage);
  return router;
@@ -9,7 +9,7 @@
import { getRepoById } from "../core/repos.ts";
import type { User } from "../core/users.ts";
import { running } from "../kernel/version.ts";
import { BOOTED, mayRead } from "./gate.ts";
import { readLandings } from "./landings.ts";
import { chosenRepo, readLandings, type Landing, type Landings } from "./landings.ts";
import { listReleases, releaseName } from "./record.ts";
export const RELEASES_REFUSAL = "the release history is for the forge's administrators and its repository's readers";
@@ -18,10 +18,26 @@
export type ReleasesAnswer =
  | { ok: true; value: unknown }
  | { ok: false; error: "forbidden"; message: string };
/** What went live, for anyone: the list /changelog shows. */
export async function shippedAnswer(app: App) {
  const { version, commit, live, onItsWay } = await readLandings(app);
  return { version, commit, live, onItsWay };
/** Reads in flight, shared: concurrent anonymous requests cost git and the merged rows once. */
let reading: Promise<Landings> | undefined;
function readOnce(app: App): Promise<Landings> {
  reading ??= readLandings(app).finally(() => {
    reading = undefined;
  });
  return reading;
}
      
        sentinelcrew
        12d ago
        outdated
      
      undefined means all here but the HTTP route passes null and gets the forge's own: two defaults for one read. Unify.
    
/**
 * What went live, for anyone: the list /changelog shows. `asked` is the
 * page's `?repo=`: "all" or `owner/name`; absent, or not a repository in the
 * list, is the forge's own, as on the page. Only public repositories are
 * ever read (`mergedRows`).
 */
export async function shippedAnswer(app: App, asked: string | null = null) {
  const read = await readOnce(app);
  const choice = chosenRepo(asked, [...read.onItsWay, ...read.live], read.own);
  const keep = (l: Landing) => choice === "all" || l.repo === choice;
  return { version: read.version, commit: read.commit, live: read.live.filter(keep), onItsWay: read.onItsWay.filter(keep) };
}
/** The kept releases newest first, for whoever may read /releases; others get its refusal. */
@@ -39,6 +39,13 @@
export interface Landings {
  readonly onItsWay: readonly Landing[];
}
/** Which repository the reader asked for: "" for this forge's own, "all", or one named in the list; anything else is the default. */
export function chosenRepo(asked: string | null, all: readonly Landing[], own: string | undefined): string {
  if (asked === "all") return "all";
  if (asked !== null && all.some((l) => l.repo === asked)) return asked;
  return own === undefined ? "all" : own;
}
/** More merged pulls than this are older than anything the page shows. */
const ROWS = 300;
/** Merge commits of the forge's own repository asked of git on one read. */
@@ -99,6 +99,8 @@
export interface PageOptions {
  ogImage?: string | undefined;
  /** This page's feed, advertised in the head so a reader can find it. */
  feed?: { href: string; title: string };
  /** This page's JSON twin, advertised in the head for agents. */
  json?: { href: string; title: string };
  /** Breadcrumb segments rendered in the topbar, e.g. owner / repo. */
  crumbs?: { label: string; href: string }[];
  body: Html;
@@ -739,6 +741,10 @@
export function page(options: PageOptions, status = 200): Response {
              href="${f.href}"
            />`,
        )}
        ${when(
          options.json,
          (j) => html`<link rel="alternate" type="application/json" title="${j.title}" href="${j.href}" />`,
        )}
        <meta name="color-scheme" content="light dark" />
        ${theme
          ? html`<meta name="theme-color" content="${metaThemeColor(theme)}" />`
@@ -11,9 +11,11 @@
import type { Ctx } from "../../http/context.ts";
import { canRead, getRepo } from "../../core/repos.ts";
import { newestLive, secondsWords } from "../../keeper/landed.ts";
import { dayHeading, dayOf, daysJs, shippedToday } from "../../release/days.ts";
import { readLandings, type Landing, type Landings } from "../../release/landings.ts";
import { chosenRepo, readLandings, type Landing, type Landings } from "../../release/landings.ts";
import { liveRegionsJs } from "../client.ts";
import { pageHead } from "../chrome.ts";
import { json } from "../../http/respond.ts";
import { shippedAnswer } from "../../release/answer.ts";
import { html, type Html } from "../html.ts";
import { page } from "../layout.ts";
import { badge, card, empty, listCard, row, seg, sha, time } from "../ui.ts";
@@ -23,13 +25,6 @@
const LIVE = "pull.merged,app.serving";
/** Other repositories offered as filters: more than this is a search, not a chip. */
const FILTERS = 6;
/** Which repository the reader asked for: "" for this forge's own, "all", or one named in the list; anything else is the default. */
export function chosenRepo(asked: string | null, all: readonly Landing[], own: string | undefined): string {
  if (asked === "all") return "all";
  if (asked !== null && all.some((l) => l.repo === asked)) return asked;
  return own === undefined ? "all" : own;
}
function landingRow(l: Landing, own: string | undefined, showRepo: boolean): Html {
      
        sentinelcrew
        12d ago
        outdated
      
      Drop this re-export; import chosenRepo from release/landings.ts where it is used.
    
  return row({
    href: `/${l.repo}/pulls/${l.number}`,
@@ -163,7 +158,13 @@
export async function changelogPage(ctx: Ctx): Promise<Response> {
  const readable = ownRepo !== undefined && canRead(ctx.app.db, ownRepo, ctx.auth.user);
  const body = html`${pageHead("Changelog", { sub: "What went live, as it happens." })}${filters}
    <div id="shipped" data-live="${LIVE}" aria-live="polite">${shippedRegion(read, choice, new Date(), "UTC", newestLive(ctx.app.db), readable)}</div>`;
  const response = page({ ctx, title: "Changelog", body, scriptJs: `${liveRegionsJs}\n${localDaysJs}` });
  const response = page({ ctx, title: "Changelog", body, json: { href: `/api/v1/changelog${choice === read.own ? "" : `?repo=${encodeURIComponent(choice)}`}`, title: "Changelog (JSON)" }, scriptJs: `${liveRegionsJs}\n${localDaysJs}` });
  notePhase(ctx.request, "render", performance.now() - rendering);
  return response;
}
// GET /api/v1/changelog?repo=all|owner/name: the page's rows as JSON, public repositories only.
export async function changelogJson(ctx: Ctx): Promise<Response> {
  notePhase(ctx.request, "session", takeSessionTime(ctx.request));
  return json(await shippedAnswer(ctx.app, ctx.url.searchParams.get("repo")), 200, { "cache-control": "public, max-age=5" });
}
@@ -0,0 +1,121 @@
/** `GET /api/v1/changelog` and MCP `releases {shipped, repo}` answer the rows /changelog shows; a private repo's landing is never in them. */
import { afterAll, beforeAll, describe, expect, test } from "bun:test";
import { mkdtemp, rm } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createApp, type App } from "../src/app.ts";
import { createRepo } from "../src/actions/repos.ts";
import { createToken } from "../src/core/tokens.ts";
import { createUser } from "../src/core/users.ts";
import { forgetLive, keepLive } from "../src/release/landings.ts";
import { serve, type Servers } from "../src/http/server.ts";
describe("GET /api/v1/changelog", () => {
  let dataDir: string;
  let app: App;
  let servers: Servers;
  let admin: string;
  const saved = process.env["FORGE_COMMIT"];
  const get = (query: string, token?: string) =>
    fetch(`${servers.url}/api/v1/changelog${query}`, token ? { headers: { authorization: `Bearer ${token}` } } : {});
  const mcp = async (args: object, token: string) => {
    const res = await fetch(`${servers.url}/mcp`, {
      method: "POST",
      headers: { "content-type": "application/json", accept: "application/json, text/event-stream", authorization: `Bearer ${token}` },
      body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/call", params: { name: "releases", arguments: args } }),
    });
    const body: any = await res.json();
    return JSON.parse(body.result.content[0].text);
  };
  beforeAll(async () => {
    process.env["FORGE_COMMIT"] = "a".repeat(40);
    dataDir = await mkdtemp(join(tmpdir(), "forge-changelog-api-"));
    app = createApp({ dataDir, port: 0, forgeRepo: "alice/forge" });
    servers = await serve(app);
    const u = await createUser(app.db, {
      origin: "seed", trusted: true, username: "alice", email: "[email protected]", password: "a-good-passphrase", adminIfFirst: true,
    });
    if (!u.ok) throw new Error(u.error);
    admin = createToken(app.db, u.value.id, "a", "admin").token;
    const insertIssue = app.db.query(
      `INSERT INTO issue (id, repo_id, number, kind, title, author_id, state) VALUES (?1, ?2, ?3, 'pull', ?4, ?5, 'closed')`,
    );
    const insertPull = app.db.query(
      `INSERT INTO pull (issue_id, base_branch, head_branch, base_oid, head_oid, merged_at, merged_oid) VALUES (?1, ?2, 'b', 'base', '', ?3, ?4)`,
    );
    let k = 0;
    for (const [name, visibility, title] of [
      ["forge", "public", "Public landing"],
      ["notes", "public", "Other repo landing"],
      ["secret", "private", "Private landing"],
    ] as const) {
      const made = await createRepo(app, u.value, { name, visibility });
      if (!made.ok) throw new Error(String(made.error));
      k++;
      insertIssue.run(`i${k}`, made.value.id, 1, title, u.value.id);
      insertPull.run(`i${k}`, made.value.defaultBranch, `2026-10-0${k}T10:00:00.000Z`, `oid-${k}`);
    }
  }, 30_000);
  afterAll(async () => {
    if (saved === undefined) delete process.env["FORGE_COMMIT"];
    else process.env["FORGE_COMMIT"] = saved;
    servers.stop();
    app.close();
    await rm(dataDir, { recursive: true, force: true });
  });
  const titles = (b: any) => [...b.live, ...b.onItsWay].map((l: any) => l.title).sort();
  test("answers anyone with the page's shape", async () => {
    const res = await get("?repo=all");
    expect(res.status).toBe(200);
    const b: any = await res.json();
    expect(b.commit).toBe("a".repeat(40));
    expect(typeof b.version).toBe("string");
    const row = [...b.live, ...b.onItsWay][0];
    expect(Object.keys(row).sort()).toEqual(["at", "live", "number", "repo", "title"]);
  });
  test("the repo filter: all, one, and everything when the forge has no repository of its own", async () => {
    expect(titles(await (await get("?repo=all")).json())).toEqual(["Other repo landing", "Public landing"]);
    expect(titles(await (await get("?repo=alice/notes")).json())).toEqual(["Other repo landing"]);
    expect(titles(await (await get("")).json())).toEqual(["Other repo landing", "Public landing"]);
    expect(titles(await (await get("?repo=nobody/nothing")).json())).toEqual(["Other repo landing", "Public landing"]);
    expect(titles(await (await get("?repo=alice/forge")).json())).toEqual(["Public landing"]);
  });
  test("with a repository of its own the default is that repository, on every door", async () => {
    keepLive("alice/forge", [], 0);
    try {
      expect(titles(await (await get("")).json())).toEqual(["Public landing"]);
      expect(titles(await mcp({ shipped: true }, admin))).toEqual(["Public landing"]);
      expect(titles(await (await fetch(`${servers.url}/api/v1/releases?shipped=true`)).json())).toEqual(["Public landing"]);
      expect(titles(await (await get("?repo=all")).json())).toEqual(["Other repo landing", "Public landing"]);
      expect((await get("")).headers.get("cache-control")).toBe("public, max-age=5");
    } finally {
      forgetLive();
    }
  });
  test("a private repo's landing is hidden, even when named, from anonymous and from its owner's token", async () => {
    for (const q of ["?repo=all", "?repo=alice/secret"]) {
      expect(JSON.stringify(await (await get(q)).json())).not.toContain("Private landing");
      expect(JSON.stringify(await (await get(q, admin)).json())).not.toContain("Private landing");
    }
  });
  test("MCP releases returns the same rows", async () => {
    for (const repo of ["all", "alice/notes"]) {
      const viaMcp = await mcp({ shipped: true, repo }, admin);
      expect(viaMcp).toEqual(await (await get(`?repo=${repo}`)).json());
    }
  });
  test("the page links its JSON twin", async () => {
    const html = await (await fetch(`${servers.url}/changelog`)).text();
    expect(html).toContain('rel="alternate" type="application/json"');
    expect(html).toContain('href="/api/v1/changelog?repo=all"');
  });
});
@@ -125,7 +125,7 @@
describe("changelog page", () => {
  });
  test("the same list is the MCP's, for a reader with a token", async () => {
    const got = await mcp({ shipped: true });
    const got = await mcp({ shipped: true, repo: "all" });
    expect(got["version"]).toBe("1.2.3");
    expect(got["commit"]).toBe(oids[1]);
    expect(got["live"].map((l: { title: string }) => l.title)).toEqual(["A note app change", "Second thing", "First <b>thing</b>"]);
@@ -11,7 +11,7 @@
const doc = readFileSync("docs/design/audit.md", "utf8");
/** Routes that answer a file, a fragment, a redirect hop or a callback. */
const NOT_PAGES =
  /^\/(assets\/|\.well-known\/|icons\/|og\/|live\/|__forge\/|go\/|events$|system\/stream$|talk\/stream$|settings\/teams\/stream$|sw\.js$|robots\.txt$|favicon\.ico$|apple-touch-icon(-precomposed)?\.png$|sitemap\.xml$|manifest\.webmanifest$|opensearch\.xml$|llms\.txt$|releases\.json$|audit\.csv$|fleet\/graph\/live$|fleet\/graph\.csv$|settings\/origins\/callback$|home\/archived\/|settings\/backups\/live$)/;
  /^\/(assets\/|\.well-known\/|icons\/|og\/|live\/|__forge\/|go\/|events$|system\/stream$|talk\/stream$|settings\/teams\/stream$|sw\.js$|robots\.txt$|favicon\.ico$|apple-touch-icon(-precomposed)?\.png$|sitemap\.xml$|manifest\.webmanifest$|opensearch\.xml$|llms\.txt$|releases\.json$|audit\.csv$|fleet\/graph\/live$|fleet\/graph\.csv$|settings\/origins\/callback$|home\/archived\/|settings\/backups\/live$|api\/v1\/)/;
const getRoutes = [
  ...server.matchAll(/router\.add\(\s*"GET",\s*"([^"]+)"/g),
		@@ -143,7 +143,7 @@ for a tunnel and a forge that sleeps.
143	143	\| `read_file` \| a file (utf-8, or base64 for binary) or a directory listing at a ref, as GET …/contents; MP4/MOV/M4A files also carry about: {kind, seconds, width?, height?, says} \| \|
144	144	\| `release_hold` \| (admin scope) `{ reason }` or `{ lift }`: hold the release keeper (#7557) with a reason, so it cuts nothing until the hold is lifted; or lift an owner hold by its id. A failed verify's hold is lifted by a verified release after a pull saying `release hold N` lands, not here. A person who may roll back, with an admin-scope token, never an agent \| yes \|
145	145	\| `release_keeper` \| `{}`: what the release keeper (#7557) did: its releases newest first (version, commit (short sha), stage — rolling, verifying, verified or rolled_back —, the known-good version it would roll back to, roll probes and non-200s, probes and pages under load, worst ms, seconds dark, reason, landedToLiveSeconds — from the merge of its pull to the new version answering, null until it has (#8042)) and its holds (kind failed or owner, version, reason, probe numbers, the pull that said `release hold N`, lifted); `blocked` says what stops the next cut; for whoever may read /releases \| \|
146		\| `releases` \| `{shipped: true}`: what went live, for anyone: `version`, `commit`, `live` (newest first: `repo`, `number`, `title`, `at`) and `onItsWay` (landed, not yet in the running commit), the list /changelog shows. `{}`: the forge's kept releases newest first: short sha, version, the pull that landed it, when, and for the live one `live: true` and `since`; for whoever may read /releases, others get its refusal; no rollback, a person does that on the page \| \|
	146	\| `releases` \| `{shipped: true, repo?}`: what went live, for anyone: `version`, `commit`, `live` (newest first: `repo`, `number`, `title`, `at`) and `onItsWay` (landed, not yet in the running commit), the list /changelog shows, for `repo` (`all` or `owner/name`; absent is every repository). `{}`: the forge's kept releases newest first: short sha, version, the pull that landed it, when, and for the live one `live: true` and `since`; for whoever may read /releases, others get its refusal; no rollback, a person does that on the page \| \|
147	147	\| `repo` \| `{ repo }`: one repository's description, visibility, autonomy, `audience { level, sentence }` and `provenance` (where a migrated one came from, `null` when hidden), the same as `GET /api/v1/repos/:owner/:name` \| \|
148	148	\| `repo_labels` \| `{ repo, action?, name?, color?, id? }`: list (`list`, the default, paged by `limit` 1–200 and `cursor`, as `{ items, next_cursor }`, each label with `open`, its open issues and pulls, for a writer; a read-only token may), create (`create`, `name`, `color` six hex digits), rename or recolour (`update`, `id`, `name` and/or `color`, as the labels page) or remove (`remove`, `id`) the repository's labels, as `GET`/`POST …/labels` and `PATCH`/`DELETE …/labels/:id`; create, update and remove need an admin token and a repository admin \| yes \|
149	149	\| `repo_settings` \| (admin scope) `{ repo, description?, visibility? }` (admin): change a repository's description and visibility as `PATCH /api/v1/repos/:owner/:name` does, for the same callers (a repository admin); answers `{ repo, description, visibility }` (with none to change it only reads); a visibility other than public or private is `invalid` \| yes \|
		@@ -11,3 +11,7 @@ One bounded `git log` read, cached per head oid; Server-Timing names `releases`
11	11	`/changelog` lists the pulls merged into a default branch, newest first, grouped by UTC day: title, link, repository, when it landed. A pull to the forge's own repository (`FORGE_REPO`) counts only once the running commit (`FORGE_COMMIT`, the one `/api/v1/health` reports; the default branch head for a forge run from source) contains its merge commit, asked of git with `merge-base --is-ancestor` and kept while live. Landed but not yet contained shows above as "On its way". A pull to any other public repository is live when it lands. The top line says the live version and commit and how many shipped today. `?repo=all` or `?repo=owner/name` filters; the forge's own repository is the default.
12	12
13	13	The list is a live region (`pull.merged`, `app.serving`): it swaps in place without a reload. MCP `releases` with `{shipped: true}` answers the same list to anyone. The "no release" alarm reads the same record (`release/landings.ts`), refreshed each minute, and is silent until a read has happened. The older `Release <version>: …` commit read (`release/changelog.ts`) now serves only the terminal's Changelog screen.
	14
	15	## For agents
	16
	17	`GET /api/v1/changelog` is the page's list as JSON, public, cached five seconds: `{version, commit, live, onItsWay}`, each landing `{repo, number, title, at, live}`. `?repo=all` or `?repo=owner/name` filters; the default is the forge's own repository, as on the page. MCP `releases` with `{shipped: true, repo?}` and `GET /api/v1/releases?shipped=true[&repo=]` answer the same rows with the same default. Only public repositories are read; concurrent requests share one read of git and the merged rows, so an anonymous caller costs no more than a page view. The page links the JSON with `rel="alternate"`. The terminal's Changelog screen is the release-commit view (`release/changelog.ts`); it does not show the landings list.
		@@ -0,0 +1,10 @@
	1	import type { Route } from "../shared.ts";
	2
	3	export const route: Route = {
	4	method: "get",
	5	path: "/api/v1/changelog",
	6	summary: "What went live and what is on its way, as /changelog shows it, for anyone: version, commit, live and onItsWay rows (repo, number, title, at) of public repositories; ?repo=all\|owner/name, this forge's own by default (all when it has none)",
	7	auth: false,
	8	query: { repo: "string" },
	9	refusals: {},
	10	};
		@@ -50,6 +50,7 @@ export { route as getApiV1BoardsPins } from "./getApiV1BoardsPins.ts";
50	50	export { route as getApiV1BoardsSlug } from "./getApiV1BoardsSlug.ts";
51	51	export { route as getApiV1BoardsSlugPanelsId } from "./getApiV1BoardsSlugPanelsId.ts";
52	52	export { route as getApiV1BoardsSources } from "./getApiV1BoardsSources.ts";
	53	export { route as getApiV1Changelog } from "./getApiV1Changelog.ts";
53	54	export { route as getApiV1CloudAccounts } from "./getApiV1CloudAccounts.ts";
54	55	export { route as getApiV1Contribute } from "./getApiV1Contribute.ts";
55	56	export { route as getApiV1ConversationTurns } from "./getApiV1ConversationTurns.ts";
		@@ -16,7 +16,7 @@ export function releasesRoutes(router: Router<Handler>): void {
16	16	const shipped = ctx.url.searchParams.get("shipped");
17	17	if (shipped !== null && shipped !== "true")
18	18	return apiError("invalid_shipped", 422, "shipped is true (what went live) or absent (the kept releases)");
19		if (shipped === "true") return json(await shippedAnswer(ctx.app));
	19	if (shipped === "true") return json(await shippedAnswer(ctx.app, ctx.url.searchParams.get("repo")));
20	20	const answer = releasesAnswer(ctx.app, ctx.auth.user);
21	21	return answer.ok ? json(answer.value) : apiError(answer.error, 403, answer.message);
22	22	});
		@@ -3,12 +3,12 @@ import { bad, good, type Tool } from "../shared.ts";
3	3
4	4	export const tool: Tool = {
5	5	name: "releases",
6		doc: "`{shipped: true}`: what went live, for anyone: `version`, `commit`, `live` (newest first: `repo`, `number`, `title`, `at`) and `onItsWay` (landed, not yet in the running commit), the list /changelog shows. `{}`: the forge's kept releases newest first: short sha, version, the pull that landed it, when, and for the live one `live: true` and `since`; for whoever may read /releases, others get its refusal; no rollback, a person does that on the page",
	6	doc: "`{shipped: true, repo?}`: what went live, for anyone: `version`, `commit`, `live` (newest first: `repo`, `number`, `title`, `at`) and `onItsWay` (landed, not yet in the running commit), the list /changelog shows, for `repo` (`all` or `owner/name`; absent is the forge's own, as on the page). `{}`: the forge's kept releases newest first: short sha, version, the pull that landed it, when, and for the live one `live: true` and `since`; for whoever may read /releases, others get its refusal; no rollback, a person does that on the page",
7	7	description: "Kept releases, newest first.",
8		inputSchema: { type: "object", properties: { shipped: { type: "boolean" } } },
	8	inputSchema: { type: "object", properties: { shipped: { type: "boolean" }, repo: { type: "string" } } },
9	9	writes: false,
10	10	async run(ctx, user, args) {
11		if (args["shipped"] === true) return good(await shippedAnswer(ctx.app));
	11	if (args["shipped"] === true) return good(await shippedAnswer(ctx.app, typeof args["repo"] === "string" ? args["repo"] : null));
12	12	// The page's own gate: its refusal, in words.
13	13	const answer = releasesAnswer(ctx.app, user);
14	14	return answer.ok ? good(answer.value) : bad(answer.error, answer.message);
		@@ -171,7 +171,7 @@ import {
171	171	domainsMoved,
172	172	} from "../web/pages/backups.ts";
173	173	import { apiPage, appApiPage } from "../web/pages/api.ts";
174		import { changelogPage } from "../web/pages/changelog.ts";
	174	import { changelogJson, changelogPage } from "../web/pages/changelog.ts";
175	175	import { releaseHoldSubmit, liftSubmit, releasesPage, rollbackSubmit } from "../web/pages/releases.ts";
176	176	import {
177	177	cloudAdd,
		@@ -1568,6 +1568,8 @@ export function buildApiRouter(): Router<Handler> {
1568	1568	apiRoutes(router);
1569	1569	feedRoutes(router);
1570	1570	checksRecheckRoutes(router);
	1571	// What went live, as /changelog shows it; the page's own module answers.
	1572	router.add("GET", "/api/v1/changelog", changelogJson);
1571	1573	// The reference page for these routes lives at their root, so it answers here.
1572	1574	router.add("GET", "/api", apiPage);
1573	1575	return router;
		@@ -9,7 +9,7 @@ import { getRepoById } from "../core/repos.ts";
9	9	import type { User } from "../core/users.ts";
10	10	import { running } from "../kernel/version.ts";
11	11	import { BOOTED, mayRead } from "./gate.ts";
12		import { readLandings } from "./landings.ts";
	12	import { chosenRepo, readLandings, type Landing, type Landings } from "./landings.ts";
13	13	import { listReleases, releaseName } from "./record.ts";
14	14
15	15	export const RELEASES_REFUSAL = "the release history is for the forge's administrators and its repository's readers";
		@@ -18,10 +18,26 @@ export type ReleasesAnswer =
18	18	\| { ok: true; value: unknown }
19	19	\| { ok: false; error: "forbidden"; message: string };
20	20
21		/** What went live, for anyone: the list /changelog shows. */
22		export async function shippedAnswer(app: App) {
23		const { version, commit, live, onItsWay } = await readLandings(app);
24		return { version, commit, live, onItsWay };
	21	/** Reads in flight, shared: concurrent anonymous requests cost git and the merged rows once. */
	22	let reading: Promise<Landings> \| undefined;
	23	function readOnce(app: App): Promise<Landings> {
	24	reading ??= readLandings(app).finally(() => {
	25	reading = undefined;
	26	});
	27	return reading;
	28	}
	29
		sentinelcrew 12d ago outdated `undefined` means all here but the HTTP route passes null and gets the forge's own: two defaults for one read. Unify.
	30	/**
	31	* What went live, for anyone: the list /changelog shows. `asked` is the
	32	* page's `?repo=`: "all" or `owner/name`; absent, or not a repository in the
	33	* list, is the forge's own, as on the page. Only public repositories are
	34	* ever read (`mergedRows`).
	35	*/
	36	export async function shippedAnswer(app: App, asked: string \| null = null) {
	37	const read = await readOnce(app);
	38	const choice = chosenRepo(asked, [...read.onItsWay, ...read.live], read.own);
	39	const keep = (l: Landing) => choice === "all" \|\| l.repo === choice;
	40	return { version: read.version, commit: read.commit, live: read.live.filter(keep), onItsWay: read.onItsWay.filter(keep) };
25	41	}
26	42
27	43	/** The kept releases newest first, for whoever may read /releases; others get its refusal. */
		@@ -39,6 +39,13 @@ export interface Landings {
39	39	readonly onItsWay: readonly Landing[];
40	40	}
41	41
	42	/** Which repository the reader asked for: "" for this forge's own, "all", or one named in the list; anything else is the default. */
	43	export function chosenRepo(asked: string \| null, all: readonly Landing[], own: string \| undefined): string {
	44	if (asked === "all") return "all";
	45	if (asked !== null && all.some((l) => l.repo === asked)) return asked;
	46	return own === undefined ? "all" : own;
	47	}
	48
42	49	/** More merged pulls than this are older than anything the page shows. */
43	50	const ROWS = 300;
44	51	/** Merge commits of the forge's own repository asked of git on one read. */
		@@ -99,6 +99,8 @@ export interface PageOptions {
99	99	ogImage?: string \| undefined;
100	100	/** This page's feed, advertised in the head so a reader can find it. */
101	101	feed?: { href: string; title: string };
	102	/** This page's JSON twin, advertised in the head for agents. */
	103	json?: { href: string; title: string };
102	104	/** Breadcrumb segments rendered in the topbar, e.g. owner / repo. */
103	105	crumbs?: { label: string; href: string }[];
104	106	body: Html;
		@@ -739,6 +741,10 @@ export function page(options: PageOptions, status = 200): Response {
739	741	href="${f.href}"
740	742	/>`,
741	743	)}
	744	${when(
	745	options.json,
	746	(j) => html`<link rel="alternate" type="application/json" title="${j.title}" href="${j.href}" />`,
	747	)}
742	748	<meta name="color-scheme" content="light dark" />
743	749	${theme
744	750	? html`<meta name="theme-color" content="${metaThemeColor(theme)}" />`