@bugmole/cli 0.4.0 → 0.6.0

package/src/registry/task-scheduling.ts

@@ -24,8 +24,112 @@ export type SchedulableTask = {
   attempts?: number;
   nextAttemptAt?: string | null;
   leaseExpiresAt?: string | null;
+  taskType?: string;
+  /** Null while the task waits for someone to approve it; absent from registries that predate approval. */
+  approvedAt?: string | null;
+  /** Who approved it: an Aegis id, or `auto:<mode>` when the project's mode approved it on creation. */
+  approvedBy?: string | null;
 };
 
+/**
+ * How much a project lets agents do without a person saying yes first.
+ *
+ * - `manual`: every task waits for someone to press Approve.
+ * - `auto`: explorations and investigations start by themselves; tasks that
+ *   change code (`code`, `ui`) wait for approval.
+ * - `extreme`: everything starts by itself, code changes included.
+ */
+export type ApprovalMode = "manual" | "auto" | "extreme";
+export const APPROVAL_MODES: readonly ApprovalMode[] = ["manual", "auto", "extreme"];
+export const DEFAULT_APPROVAL_MODE: ApprovalMode = "auto";
+const CODE_CHANGING_TASKS = new Set(["code", "ui"]);
+
+export function approvalModeOf(value: unknown): ApprovalMode | null {
+  return typeof value === "string" && (APPROVAL_MODES as readonly string[]).includes(value) ? value as ApprovalMode : null;
+}
+
+/** Whether a task of this type needs a person's approval under this mode. */
+export function needsApproval(mode: ApprovalMode, taskType: string | undefined): boolean {
+  if (mode === "manual") return true;
+  if (mode === "extreme") return false;
+  return CODE_CHANGING_TASKS.has(taskType ?? "code");
+}
+
+/**
+ * A task an AI worker says it finished, waiting for a person to accept it or
+ * send it back. Not claimable, not resumable, not finished.
+ */
+export const IN_REVIEW = "in_review";
+
+/**
+ * Whether a finished task needs a person to review it before it counts as
+ * completed. Same risk model as starting: manual reviews everything, auto
+ * reviews code-changing tasks (`code`, `ui`), extreme reviews nothing.
+ */
+export function needsCompletionReview(mode: ApprovalMode, taskType: string | undefined): boolean {
+  return needsApproval(mode, taskType);
+}
+
+/**
+ * The status a task gets when its worker reports `completed`: `in_review`
+ * when the project's mode wants a person to look first, else `completed`.
+ */
+export function completionStatus(mode: ApprovalMode, taskType: string | undefined): "completed" | "in_review" {
+  return needsCompletionReview(mode, taskType) ? IN_REVIEW : "completed";
+}
+
+/** The message a worker gets back when its `completed` became `in_review`. */
+export function inReviewMessage(mode: ApprovalMode): string {
+  return `This project's approval mode is ${mode}, so a person reviews this task before it counts as completed. `
+    + "It is now in review: someone with project management rights accepts it or sends it back with a note. "
+    + "Don't start dependent work on the assumption it is accepted.";
+}
+
+/** The longest review note kept on a task. */
+export const REVIEW_NOTE_MAX = 2000;
+
+/**
+ * What a task sent back from review becomes: queued again with a fresh retry
+ * budget and no lease, carrying the reviewer's note. Its approval is kept —
+ * the person who sent it back is asking for more of the same work.
+ */
+export function sentBackTaskFields(note: string): {
+  status: "queued";
+  attempts: number;
+  nextAttemptAt: null;
+  leaseExpiresAt: null;
+  workerId: null;
+  reviewNote: string;
+  progressMessage: string;
+} {
+  return { ...resumedTaskFields(), reviewNote: note, progressMessage: `Sent back from review: ${note}` };
+}
+
+/**
+ * This worker's own approval mode, from BUGMOLE_APPROVAL (set by
+ * `bugmole serve --approval`). Unset means "whatever the project allows".
+ */
+export function workerApprovalMode(env: Record<string, string | undefined> = process.env): ApprovalMode | undefined {
+  return approvalModeOf(env.BUGMOLE_APPROVAL?.trim()) ?? undefined;
+}
+
+/** The approver recorded when a project's mode approves a task on creation. */
+export function autoApprover(mode: ApprovalMode): string {
+  return `auto:${mode}`;
+}
+
+/**
+ * Whether a worker running in `workerMode` may take a task. A worker can be
+ * stricter than its project, never looser: a task the project approved
+ * automatically is only taken if the worker's own mode would have approved
+ * it too; otherwise the worker waits for a person's approval.
+ */
+export function workerMayTake(task: SchedulableTask, workerMode: ApprovalMode | undefined): boolean {
+  if (task.approvedAt === null) return false;
+  if (!workerMode || !needsApproval(workerMode, task.taskType)) return true;
+  return Boolean(task.approvedBy && !task.approvedBy.startsWith("auto:"));
+}
+
 /**
  * Whether a human may release a parked task back to the queue.
  *
@@ -43,6 +147,9 @@ export type SchedulableTask = {
  */
 export function isResumableTask(task: SchedulableTask, now = Date.now()): boolean {
   if (task.status === "completed") return false;
+  // A task in review is finished work waiting for a person; sending it back
+  // is how it goes back to the queue.
+  if (task.status === IN_REVIEW) return false;
   const heldByLiveWorker = task.status === "running"
     && Boolean(task.leaseExpiresAt)
     && Date.parse(task.leaseExpiresAt!) > now;
@@ -63,8 +170,98 @@ export function resumedTaskFields(): {
   return { status: "queued", attempts: 0, nextAttemptAt: null, leaseExpiresAt: null, workerId: null };
 }
 
-/** Whether a task should be picked up right now. */
-export function isClaimableTask(task: SchedulableTask, now = Date.now()): boolean {
+/**
+ * What a resumed task's approval becomes. A person's approval stands: they
+ * already said yes to this task. An automatic one (or none) is decided again
+ * by the project's current mode, so resuming never skips an approval step the
+ * project has since switched on, and never holds a task behind a step the
+ * project has since switched off.
+ */
+export function resumedApproval(
+  task: Pick<SchedulableTask, "approvedAt" | "approvedBy" | "taskType">,
+  mode: ApprovalMode,
+): { approvedBy: string | null } {
+  if (task.approvedAt && task.approvedBy && !task.approvedBy.startsWith("auto:")) return { approvedBy: task.approvedBy };
+  return { approvedBy: needsApproval(mode, task.taskType) ? null : autoApprover(mode) };
+}
+
+/**
+ * A worker on someone's machine (`bugmole serve`, or a coding agent using the
+ * Bugmole MCP) lists the project's tasks every few seconds with its API key.
+ * The registry records that at most once a minute, and counts the machine as
+ * connected while its last listing is this recent.
+ */
+export const LOCAL_WORKER_FRESH_MS = 2 * 60_000;
+export const LOCAL_WORKER_SEEN_THROTTLE_MS = 60_000;
+
+export function localWorkerConnected(seenAt: string | null | undefined, now = Date.now()): boolean {
+  if (!seenAt) return false;
+  const seen = Date.parse(seenAt);
+  return Number.isFinite(seen) && now - seen <= LOCAL_WORKER_FRESH_MS;
+}
+
+export type TaskPlacementProject = {
+  storageMode?: string | null;
+  defaultExecutionMode?: string | null;
+  localWorkerSeenAt?: string | null;
+};
+
+/**
+ * A project that runs in Bugmole Cloud: its results live in Bugmole storage,
+ * or its work goes to Bugmole Cloud by default. Nobody on such a project is
+ * expected to keep a machine connected, so a task only a machine can run
+ * would wait there with nothing to pick it up.
+ */
+export function projectRunsInCloud(project: TaskPlacementProject): boolean {
+  return project.storageMode === "managed" || project.defaultExecutionMode === "cloud";
+}
+
+/** Only discovery runs on Bugmole Cloud, and only for a project on Bugmole storage. */
+export function taskCanRunInCloud(task: { taskType?: string }, project: TaskPlacementProject): boolean {
+  return task.taskType === "discovery" && project.storageMode === "managed";
+}
+
+/**
+ * Where a resumed task goes.
+ *
+ * - `cloud`: it runs on Bugmole Cloud, so resuming hands it to the dispatcher.
+ * - `machine`: it runs on a machine, and one is connected (or the project
+ *   keeps its work on a machine anyway, so queuing ahead of `bugmole serve`
+ *   is expected).
+ * - `stranded`: only a machine can run it, the project runs in the cloud and
+ *   no machine is connected. Queuing it would leave it waiting forever, so
+ *   resume refuses and says what to do; `canRunInCloud` says whether it can
+ *   be resumed on Bugmole Cloud instead.
+ */
+export type ResumePlacement =
+  | { kind: "cloud" }
+  | { kind: "machine" }
+  | { kind: "stranded"; canRunInCloud: boolean };
+
+export function resumePlacement(
+  task: { executionMode?: string | null; taskType?: string },
+  project: TaskPlacementProject,
+  now = Date.now(),
+): ResumePlacement {
+  if (task.executionMode === "cloud") return { kind: "cloud" };
+  if (!projectRunsInCloud(project) || localWorkerConnected(project.localWorkerSeenAt, now)) return { kind: "machine" };
+  return { kind: "stranded", canRunInCloud: taskCanRunInCloud(task, project) };
+}
+
+/** The registry's answer when resume refuses a stranded task. */
+export function strandedTaskMessage(canRunInCloud: boolean): string {
+  return "This task runs on your machine, and no machine is connected to this project. "
+    + "Start `npx bugmole serve` in your project, then resume it again."
+    + (canRunInCloud ? " Or resume it on Bugmole Cloud." : "");
+}
+
+/**
+ * Whether a task should be picked up right now. `workerMode` is the worker's
+ * own approval mode (`bugmole serve --approval`), which can only add to what
+ * the project requires.
+ */
+export function isClaimableTask(task: SchedulableTask, now = Date.now(), workerMode?: ApprovalMode): boolean {
+  if (!workerMayTake(task, workerMode)) return false;
   // A worker that dies mid-task leaves it "running" forever. The registry
   // already allows reclaiming such a task once its lease lapses, but the
   // client-side selection never offered it, so one crash could wedge the

package/src/registry/test-case-revisions.test.ts

@@ -0,0 +1,57 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { activeRevision, applyTestCaseChange, type CaseSetDocument } from "./test-case-revisions.js";
+
+const base = (overrides: Record<string, unknown> = {}) => ({
+  caseId: "TC-login",
+  title: "Sign in works",
+  nodeId: "screen:/login",
+  intent: "Prove a person can sign in.",
+  steps: ["Open /login", "Sign in"],
+  expected: ["The dashboard opens"],
+  confidence: "high",
+  basis: ["spec"],
+  ...overrides,
+});
+
+const set = (): CaseSetDocument => ({ caseSetId: "login", journeyId: "j", journeyRevision: 1, cases: [base()] });
+
+test("a change adds revision 2 and makes revision 1 obsolete, keeping it", () => {
+  const result = applyTestCaseChange(set(), { action: "change", caseId: "TC-login", baseRevision: 1, case: base({ title: "Sign in with a password works" }) }, { proposalId: "prop_1", at: "2026-09-29T10:00:00Z" });
+  assert.ok(result.ok);
+  if (!result.ok) return;
+  assert.equal(result.revision, 2);
+  assert.equal(result.caseSet.cases.length, 2);
+  const [old, current] = result.caseSet.cases;
+  assert.deepEqual([old.status, old.supersededBy, old.obsoleteReason, old.obsoletedAt], ["obsolete", 2, "revised", "2026-09-29T10:00:00Z"]);
+  assert.deepEqual([current.revision, current.status, current.title, current.proposalId], [2, "active", "Sign in with a password works", "prop_1"]);
+  assert.equal(activeRevision(result.caseSet, "TC-login")?.revision, 2);
+});
+
+test("a change against a revision that moved on is outdated, not an overwrite", () => {
+  const first = applyTestCaseChange(set(), { action: "change", caseId: "TC-login", baseRevision: 1, case: base({ title: "B" }) });
+  assert.ok(first.ok);
+  if (!first.ok) return;
+  const stale = applyTestCaseChange(first.caseSet, { action: "change", caseId: "TC-login", baseRevision: 1, case: base({ title: "C" }) });
+  assert.deepEqual(stale.ok ? null : stale.reason, "outdated");
+});
+
+test("retiring leaves no current revision; adding it back starts the next revision", () => {
+  const retired = applyTestCaseChange(set(), { action: "retire", caseId: "TC-login", baseRevision: 1 });
+  assert.ok(retired.ok);
+  if (!retired.ok) return;
+  assert.equal(activeRevision(retired.caseSet, "TC-login"), undefined);
+  assert.equal(retired.caseSet.cases[0].obsoleteReason, "retired");
+  const back = applyTestCaseChange(retired.caseSet, { action: "add", case: base() });
+  assert.ok(back.ok);
+  if (back.ok) assert.equal(back.revision, 2, "revision numbers never repeat");
+});
+
+test("proposals can't smuggle in revision bookkeeping, a duplicate or an invalid case", () => {
+  const sneaky = applyTestCaseChange(set(), { action: "change", caseId: "TC-login", baseRevision: 1, case: base({ revision: 99, status: "obsolete" }) });
+  assert.ok(sneaky.ok);
+  if (sneaky.ok) assert.deepEqual([sneaky.caseSet.cases[1].revision, sneaky.caseSet.cases[1].status], [2, "active"]);
+  assert.equal((applyTestCaseChange(set(), { action: "add", case: base() }) as { reason?: string }).reason, "exists");
+  assert.equal((applyTestCaseChange(set(), { action: "change", caseId: "TC-x", baseRevision: 1, case: base({ caseId: "TC-x" }) }) as { reason?: string }).reason, "missing");
+  assert.equal((applyTestCaseChange(set(), { action: "add", case: base({ caseId: "TC-new", steps: [] }) }) as { reason?: string }).reason, "invalid");
+});

package/src/registry/test-case-revisions.ts

@@ -0,0 +1,132 @@
+// Test cases change over time: a flow is reworded, a check is tightened, a
+// case stops making sense. A change never edits a case in place. It adds a
+// new revision and marks the one it replaces obsolete, so past results keep
+// pointing at exactly what they judged, and a new revision counts as untested
+// until a run proves it.
+//
+// Shared by the registry (Bugmole storage), `bugmole serve` and the CLI
+// (a project's own storage), so every place that applies a change agrees.
+
+import { SCENARIO_CATEGORIES, isScenarioCategory } from "../runtime/scenario-matrix.js";
+
+export type CaseStatus = "active" | "obsolete";
+
+export type RevisionedCase = {
+  caseId: string;
+  /** 1 when absent: case sets written before revisions existed. */
+  revision?: number;
+  status?: CaseStatus;
+  /** The revision that replaced this one; absent when it was retired. */
+  supersededBy?: number;
+  obsoletedAt?: string;
+  obsoleteReason?: "revised" | "retired";
+  /** The accepted proposal that created this revision. */
+  proposalId?: string;
+  title?: string;
+  nodeId?: string;
+  steps?: unknown;
+  expected?: unknown;
+  [field: string]: unknown;
+};
+
+export type CaseSetDocument = {
+  caseSetId: string;
+  cases: RevisionedCase[];
+  [field: string]: unknown;
+};
+
+export type TestCaseChange =
+  | { action: "add"; case: RevisionedCase }
+  | { action: "change"; caseId: string; baseRevision: number; case: RevisionedCase }
+  | { action: "retire"; caseId: string; baseRevision: number };
+
+export type ApplyResult =
+  | { ok: true; caseSet: CaseSetDocument; revision: number }
+  | { ok: false; reason: "outdated" | "exists" | "missing" | "invalid"; message: string };
+
+export function revisionOf(testCase: Pick<RevisionedCase, "revision">): number {
+  return Number.isInteger(testCase.revision) && (testCase.revision as number) > 0 ? testCase.revision as number : 1;
+}
+
+export function isObsolete(testCase: Pick<RevisionedCase, "status">): boolean {
+  return testCase.status === "obsolete";
+}
+
+/** The revision of a case that currently runs, or undefined if it was retired or never existed. */
+export function activeRevision(caseSet: Pick<CaseSetDocument, "cases">, caseId: string): RevisionedCase | undefined {
+  return caseSet.cases.find((testCase) => testCase.caseId === caseId && !isObsolete(testCase));
+}
+
+const CASE_ID = /^[a-zA-Z0-9._-]+$/;
+
+/** Why a proposed case can't be stored, or null. Grounding in the journey graph is checked where the graph is. */
+export function caseProblem(testCase: RevisionedCase | undefined): string | null {
+  if (!testCase || typeof testCase !== "object") return "the case must be an object";
+  if (typeof testCase.caseId !== "string" || !CASE_ID.test(testCase.caseId)) return "caseId may contain only letters, numbers, ., _ and -";
+  for (const field of ["title", "nodeId", "intent"] as const) {
+    if (typeof testCase[field] !== "string" || !(testCase[field] as string).trim()) return `${field} is required`;
+  }
+  for (const field of ["steps", "expected"] as const) {
+    const value = testCase[field];
+    if (!Array.isArray(value) || value.length === 0 || value.some((item) => typeof item !== "string" || !item.trim())) {
+      return `${field} must be a non-empty list of text`;
+    }
+  }
+  if (!["high", "medium", "low"].includes(testCase.confidence as string)) return "confidence must be high, medium or low";
+  const category = (testCase as { category?: unknown }).category;
+  if (category !== undefined && !isScenarioCategory(category)) return `category must be one of ${SCENARIO_CATEGORIES.join(", ")}`;
+  return null;
+}
+
+function nextRevision(caseSet: CaseSetDocument, caseId: string): number {
+  return Math.max(0, ...caseSet.cases.filter((testCase) => testCase.caseId === caseId).map(revisionOf)) + 1;
+}
+
+/** Strips the fields this module owns, so a proposal can't set them. */
+function content(testCase: RevisionedCase): RevisionedCase {
+  const { revision: _r, status: _s, supersededBy: _b, obsoletedAt: _o, obsoleteReason: _w, proposalId: _p, ...rest } = testCase;
+  return rest as RevisionedCase;
+}
+
+/**
+ * Applies one change. `change` and `retire` name the revision the proposer
+ * saw: if the case has moved on since, the proposal is outdated rather than
+ * silently overwriting someone else's revision.
+ */
+export function applyTestCaseChange(
+  caseSet: CaseSetDocument,
+  change: TestCaseChange,
+  meta: { proposalId?: string; at?: string } = {},
+): ApplyResult {
+  const at = meta.at ?? new Date().toISOString();
+  const cases = caseSet.cases.map((testCase) => ({ ...testCase }));
+  const caseId = change.action === "add" ? change.case?.caseId : change.caseId;
+  if (typeof caseId !== "string" || !CASE_ID.test(caseId)) return { ok: false, reason: "invalid", message: "caseId may contain only letters, numbers, ., _ and -" };
+  const current = cases.find((testCase) => testCase.caseId === caseId && !isObsolete(testCase));
+
+  if (change.action === "add") {
+    const problem = caseProblem(change.case);
+    if (problem) return { ok: false, reason: "invalid", message: problem };
+    if (current) return { ok: false, reason: "exists", message: `${caseId} already exists at revision ${revisionOf(current)}; propose a change to it instead` };
+    const revision = nextRevision({ ...caseSet, cases }, caseId);
+    cases.push({ ...content(change.case), caseId, revision, status: "active", ...(meta.proposalId ? { proposalId: meta.proposalId } : {}) });
+    return { ok: true, caseSet: { ...caseSet, cases }, revision };
+  }
+
+  if (!current) return { ok: false, reason: "missing", message: `${caseId} has no current revision to ${change.action}` };
+  if (revisionOf(current) !== change.baseRevision) {
+    return { ok: false, reason: "outdated", message: `${caseId} is at revision ${revisionOf(current)}, not ${change.baseRevision}; propose again against the current revision` };
+  }
+
+  if (change.action === "retire") {
+    Object.assign(current, { status: "obsolete", obsoletedAt: at, obsoleteReason: "retired" });
+    return { ok: true, caseSet: { ...caseSet, cases }, revision: revisionOf(current) };
+  }
+
+  const problem = caseProblem({ ...change.case, caseId });
+  if (problem) return { ok: false, reason: "invalid", message: problem };
+  const revision = nextRevision({ ...caseSet, cases }, caseId);
+  Object.assign(current, { status: "obsolete", supersededBy: revision, obsoletedAt: at, obsoleteReason: "revised" });
+  cases.push({ ...content(change.case), caseId, revision, status: "active", ...(meta.proposalId ? { proposalId: meta.proposalId } : {}) });
+  return { ok: true, caseSet: { ...caseSet, cases }, revision };
+}

package/src/registry-worker/ai/routes.ts

@@ -3,7 +3,8 @@
 // connect their own key call their provider directly and never come here.
 import { AI_CREDIT_COST, type AiAction } from "../../billing/plan-catalog.js";
 import { type Env, type Principal, memberOfProject, requestJson, response } from "../core.js";
-import { getEntitlements, workspaceOfProject } from "../billing/entitlements.js";
+import { workspaceOfProject } from "../billing/entitlements.js";
+import { featureEnabled } from "../feature-access.js";
 import { canSpend, recordUsage } from "../billing/ledger.js";
 import { checkUsageThresholds } from "../billing/thresholds.js";
 import { type AuthedRouteContext, registerRoutes } from "../routes/index.js";
@@ -41,8 +42,7 @@ async function complete({ env, principal, request, ctx }: AuthedRouteContext): P
   }
   const workspaceId = await workspaceOfProject(env, projectId);
   if (!workspaceId) return response({ error: "This project isn't in a workspace" }, 422);
-  const entitlements = await getEntitlements(env, workspaceId);
-  if (purpose === "repair" && !entitlements.features.aiFixes) {
+  if (purpose === "repair" && !(await featureEnabled(env, workspaceId, "ai_fixes"))) {
     return response({ error: "AI test repair is available on Team and Business plans.", code: "plan_feature", feature: "aiFixes", upgradeUrl: "/billing" }, 402);
   }
 

package/src/registry-worker/artifacts.ts

@@ -17,9 +17,20 @@ export type ArtifactBucket = {
     truncated: boolean;
     cursor?: string;
   }>;
-  get(key: string): Promise<{ body: ReadableStream; size: number; httpMetadata?: { contentType?: string } } | null>;
+  get(key: string): Promise<{ body: ReadableStream; size: number; uploaded?: Date; httpMetadata?: { contentType?: string } } | null>;
 };
 
+/** Hides objects past the plan's history (see billing/enforcement.ts historyCutoffFor). */
+export type ArtifactVisibility = (key: string, uploaded: Date | undefined) => Promise<boolean>;
+
+/** The run a key belongs to: `projects/<id>/runs/<runId>/...`. */
+export function runIdOfArtifactKey(projectId: string, key: string): string | null {
+  const prefix = `${artifactProjectPrefix(projectId)}runs/`;
+  if (!key.startsWith(prefix)) return null;
+  const segment = key.slice(prefix.length).split("/")[0];
+  return segment ? decodeURIComponent(segment) : null;
+}
+
 export const ARTIFACT_STORAGE_UNCONFIGURED = "Artifact storage is not configured";
 const LIST_LIMIT = 1000;
 
@@ -48,7 +59,7 @@ export function isRunManifestKey(projectId: string, runId: string, key: unknown)
   return typeof key === "string" && key === `${artifactProjectPrefix(projectId)}runs/${encodeURIComponent(runId)}/manifest.json`;
 }
 
-export async function listProjectArtifacts(bucket: ArtifactBucket | undefined, projectId: string, url: URL): Promise<Response> {
+export async function listProjectArtifacts(bucket: ArtifactBucket | undefined, projectId: string, url: URL, visible?: ArtifactVisibility): Promise<Response> {
   if (!bucket) return json({ error: ARTIFACT_STORAGE_UNCONFIGURED }, 503);
   const prefix = normalizeArtifactPrefix(projectId, url.searchParams.get("prefix"));
   if (!prefix) return json({ error: "prefix must stay under this project's artifacts" }, 400);
@@ -58,8 +69,12 @@ export async function listProjectArtifacts(bucket: ArtifactBucket | undefined, p
     limit: LIST_LIMIT,
     include: ["httpMetadata"],
   });
+  const objects = [];
+  for (const object of listed.objects) {
+    if (!visible || (await visible(object.key, object.uploaded))) objects.push(object);
+  }
   return json({
-    objects: listed.objects.map((object) => ({
+    objects: objects.map((object) => ({
       key: object.key,
       size: object.size,
       modifiedAt: object.uploaded.toISOString(),
@@ -69,12 +84,16 @@ export async function listProjectArtifacts(bucket: ArtifactBucket | undefined, p
   });
 }
 
-export async function getProjectArtifact(bucket: ArtifactBucket | undefined, projectId: string, url: URL): Promise<Response> {
+export async function getProjectArtifact(bucket: ArtifactBucket | undefined, projectId: string, url: URL, visible?: ArtifactVisibility): Promise<Response> {
   if (!bucket) return json({ error: ARTIFACT_STORAGE_UNCONFIGURED }, 503);
   const key = url.searchParams.get("key") ?? "";
   if (!isProjectArtifactKey(projectId, key)) return json({ error: "key must stay under this project's artifacts" }, 400);
   const object = await bucket.get(key);
   if (!object) return json({ error: "Artifact not found" }, 404);
+  if (visible && !(await visible(key, object.uploaded))) {
+    await object.body.cancel().catch(() => undefined);
+    return json({ error: "This evidence is older than your plan's history", code: "history_expired" }, 404);
+  }
   return new Response(object.body, {
     headers: {
       "content-type": object.httpMetadata?.contentType || "application/octet-stream",

package/src/registry-worker/billing/billing-core.test.ts

@@ -171,5 +171,5 @@ test("expired run history and its evidence are deleted daily", async () => {
   assert.ok(audit.json.entries.some((entry: { action: string }) => entry.action === "runs.expired"));
 
   db.db.prepare("INSERT INTO workspace_plans (workspace_id, plan) VALUES (?, 'business')").run(workspaceId);
-  assert.deepEqual(await enforceRetention(env), { runs: 0, objects: 0 });
+  assert.deepEqual(await enforceRetention(env), { runs: 0, objects: 0, wouldDelete: 0 });
 });

package/src/registry-worker/billing/checkout-routes.ts

@@ -3,20 +3,22 @@
 import { PLANS, type BillingInterval } from "../../billing/plan-catalog.js";
 import type { Env } from "../core.js";
 import { memberOfWorkspace, requestJson, response } from "../core.js";
-import { flagOn } from "../flags.js";
+import { featureEnabled } from "../feature-access.js";
 import { registerJob } from "../jobs/index.js";
 import { actorOf, recordAudit } from "../org/audit.js";
 import { matchPath, registerPublicRoutes, registerRoutes, type AuthedRouteContext } from "../routes/index.js";
-import { defaultBillingProvider } from "./provider.js";
+import { billingProvider, defaultBillingProvider } from "./provider.js";
 import {
   BillingError,
   cancelAtPeriodEnd,
+  chooseActiveProjects,
   chaseOverdueInvoices,
   closeUsagePeriods,
   completeCheckout,
   handleProviderWebhook,
   isPaidPlan,
   periodPriceCents,
+  resumeSubscription,
   startCheckout,
   syncAllBilling,
 } from "./subscriptions.js";
@@ -41,14 +43,14 @@ async function mayManage(context: AuthedRouteContext, workspaceId: string): Prom
 }
 
 async function billingEnabled(env: Env, workspaceId: string): Promise<boolean> {
-  return flagOn(env, workspaceId, "billing");
+  return featureEnabled(env, workspaceId, "billing");
 }
 
 async function overview({ env, principal }: AuthedRouteContext, workspaceId: string): Promise<Response> {
   if (!(await memberOfWorkspace(env, principal, workspaceId))) return response({ error: "Workspace scope is not allowed" }, 403);
   const canManage = await memberOfWorkspace(env, principal, workspaceId, "billing.manage");
   const row = await env.DB.prepare(`
-    SELECT plan, billing_interval AS interval, status, current_period_end AS periodEnd, cancel_at_period_end AS cancelAtPeriodEnd,
+    SELECT plan, billing_interval AS interval, status, current_period_end AS periodEnd, cancel_at_period_end AS cancelAtPeriodEnd, provider,
            pending_plan AS pendingPlan, billing_email AS email, billing_name AS name, billing_address AS address, tax_id AS taxId
     FROM workspace_plans WHERE workspace_id = ?
   `).bind(workspaceId).first<Record<string, string | number | null>>();
@@ -70,8 +72,16 @@ async function overview({ env, principal }: AuthedRouteContext, workspaceId: str
     priceCents: periodPriceCents(plan, interval),
     available: enabled && provider.canSell(env, plan, interval),
   })));
+  // Where the subscriber changes the card or bank: the provider of their subscription, else the one new checkouts use.
+  let manageUrl: string | null = null;
+  try {
+    manageUrl = (row?.provider ? billingProvider(String(row.provider)) : provider).manageUrl(env);
+  } catch {
+    manageUrl = null;
+  }
   return response({
     canManage,
+    paymentProvider: { id: row?.provider ?? provider.id, manageUrl },
     subscription: row && row.status !== "canceled" && isPaidPlan(row.plan)
       ? {
         plan: row.plan,
@@ -129,6 +139,41 @@ async function cancel(context: AuthedRouteContext, workspaceId: string): Promise
   }
 }
 
+async function resume(context: AuthedRouteContext, workspaceId: string): Promise<Response> {
+  const denied = await mayManage(context, workspaceId);
+  if (denied) return denied;
+  try {
+    const result = await resumeSubscription(context.env, context.principal, workspaceId, context.request);
+    if (result.status === "resumed") {
+      return response({ status: "resumed", plan: { id: result.plan.plan, interval: result.plan.interval, periodEnd: result.plan.periodEnd } });
+    }
+    // PayPal can't restart a cancelled subscription: start the same plan again from the end of the period.
+    if (!(await billingEnabled(context.env, workspaceId))) {
+      return response({ error: `${result.message} Online checkout isn't open yet; contact us to keep your plan.`, code: "billing_unavailable" }, 503);
+    }
+    const started = await startCheckout(context.env, context.principal, workspaceId, result.plan, result.interval, context.request);
+    return response({ status: "checkout_required", message: result.message, plan: result.plan, interval: result.interval, ...started });
+  } catch (error) {
+    return billingError(error);
+  }
+}
+
+async function chooseProjects(context: AuthedRouteContext, workspaceId: string): Promise<Response> {
+  if (!(await memberOfWorkspace(context.env, context.principal, workspaceId, "workspace.manage"))) {
+    return response({ error: "Only workspace owners and admins can choose which projects stay active" }, 403);
+  }
+  const body = await requestJson(context.request);
+  const projectIds = body?.projectIds;
+  if (!Array.isArray(projectIds) || projectIds.some((id) => typeof id !== "string") || projectIds.length > 500) {
+    return response({ error: "projectIds must be a list of project ids" }, 422);
+  }
+  try {
+    return response(await chooseActiveProjects(context.env, context.principal, workspaceId, projectIds as string[], context.request));
+  } catch (error) {
+    return billingError(error);
+  }
+}
+
 const CONTACT_LIMITS = { name: 120, email: 254, address: 500, taxId: 64 } as const;
 
 async function updateContact(context: AuthedRouteContext, workspaceId: string): Promise<Response> {
@@ -186,6 +231,10 @@ registerRoutes(async (context) => {
   if (params && request.method === "POST") return complete(context, params.workspaceId, params.checkoutId);
   params = matchPath(url.pathname, "/api/workspaces/:workspaceId/billing/cancel");
   if (params && request.method === "POST") return cancel(context, params.workspaceId);
+  params = matchPath(url.pathname, "/api/workspaces/:workspaceId/billing/resume");
+  if (params && request.method === "POST") return resume(context, params.workspaceId);
+  params = matchPath(url.pathname, "/api/workspaces/:workspaceId/projects/active");
+  if (params && request.method === "PUT") return chooseProjects(context, params.workspaceId);
   params = matchPath(url.pathname, "/api/workspaces/:workspaceId/billing/contact");
   if (params && request.method === "PUT") return updateContact(context, params.workspaceId);
   params = matchPath(url.pathname, "/api/workspaces/:workspaceId/invoices/:invoiceId");