[JacobStephens2]

Summary

0.22.0 adds Fix runs for existing pull requests and unattended Base branch CI repairs (#1804), alongside a scoped Console API using shared CLI handlers and JSON (#1777).

• thirdshift fix <PR URL or number> takes a Trusted account’s ready or draft PR through Delivery against its Base branch, including PRs without linked issues. It supports configured Self-merge and preserves failed work as drafts with Recovery guidance (Add targeted Fix runs for existing pull requests #1799, Spec: Fix run #1804).
• thirdshift fix [base <branch>] [--author <login>] runs an unattended Pass, selecting trusted, ready, same-repository PRs with current-head CI red or a Merge conflict. Passes respect Command limits and reservations; skips exit 0 without Run notifications (Run unattended Fix Passes on eligible pull requests #1805).
• thirdshift console token create/list/revoke manages tokens with expiry, last-use metadata and immediate revocation; tokens default to read. thirdshift console whoami --json reports caller identity, and thirdshift console scopes manages address permissions through the CLI (Console API: tokens, bearer authentication and whoami #1778, Enforce Console account scopes and named-person token requests #1803).
• thirdshift console openapi and GET /api/v1/openapi.json publish the generated API description. Finite log reads gain --json (Publish the Console API's generated OpenAPI description #1779, Console API: serve read views as CLI JSON under /api/v1 #1776).
• /api/v1 serves Console read views and scoped Stop, Dismissal/Undo, Scores, Bug-origin settlement, Eval-task approval and Theme/section actions. Other-account Commands remain read-only. Attempted mutations record caller, endpoint and HTTP outcome; Stop/Dismissal Activity entries identify token/person callers (Console API: serve read views as CLI JSON under /api/v1 #1776, Console API: scoped actions and mutation auditing #1789, Enforce Console account scopes and named-person token requests #1803, Spec: the Console API, /api/v1 behind scoped tokens #1777).
• Bearer authentication requires HTTPS or a direct connection to 127.0.0.1. Sessions follow address permissions; tokens naming a person intersect token and address permissions. Security details and traces require security. Restricted sessions hide unavailable controls and retain browser sign-out; existing addresses keep all five scopes until narrowed (Console API: tokens, bearer authentication and whoami #1778, Console API: scoped actions and mutation auditing #1789, Enforce Console account scopes and named-person token requests #1803, Spec: the Console API, /api/v1 behind scoped tokens #1777).
• Unscoped Fix Passes inspect Base CI before selecting PR work: rerun failed jobs on the first failed push attempt, create repair PRs for persistent or non-rerunnable failures, and skip pending checks or existing repair PRs. Fix Self-merge accepts recorded review or factory-authorship evidence for the acquired head; adopted unreviewed heads stay ready (Monitor and repair Base branch CI in unscoped Fix Passes #1807, Run unattended Fix Passes on eligible pull requests #1805, Spec: Fix run #1804).
• Failed bearer tokens and password sign-ins share a per-client-IP budget: failures 3–7 incur increasing delays; failure 8 returns 429 with a 60-second cooldown. Counts expire after 60 idle seconds and clear on restart; success leaves them intact (Limit failed Console tokens and passwords per client address #1790).
• Inbox waiting rows show hand-off to later Commands on the same issue or PR. Ready rows with CI red or a Merge conflict offer Copy fix command in the Inbox and Command details. Fix runs capture their trust cutoff before Worktree acquisition (Add Inbox pull-request hand-off and Console Copy fix command #1806).

Also: site, manual, glossary and generated-prompt updates (#1777, #1799, #1803, #1805, #1806, #1807).

Version diff

diff --git a/Cargo.lock b/Cargo.lock
index 8a0fb1af..9fd74eb2 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2184,3 +2184,3 @@ dependencies = [
 name = "thirdshift"
-version = "0.20.6"
+version = "0.22.0"
 dependencies = [
diff --git a/Cargo.toml b/Cargo.toml
index 388b7d77..a7e22bed 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -2,3 +2,3 @@
 name = "thirdshift"
-version = "0.20.6"
+version = "0.22.0"
 edition = "2024"

[JacobStephens2]

Closing so release.sh 0.22.0 can re-cut cleanly from a7d76bb (after #1812 merged v0.21.0 into main).