@edgehero/pi-dispatch-admin 4.3.0 → 4.3.1

package/README.md

@@ -129,7 +129,7 @@ Four things to know before you build on it:
 One command puts a live terminal view over the whole deployment:
 
 <p align="center">
-  <img src="https://raw.githubusercontent.com/edgehero/pi-dispatch/main/docs/images/dispatch-dashboard.png?v=2026-10-13" alt="The /dispatch panel: status, spend meters, dollar windows, triggers with a portfolio trigger, pause windows, scoped limits with their dollar caps, held and failed jobs, runs with their projects and the u hosts key, and settings" width="820">
+  <img src="https://raw.githubusercontent.com/edgehero/pi-dispatch/main/docs/images/dispatch-dashboard.png?v=2026-10-14" alt="The /dispatch panel: status, spend meters, dollar windows, triggers with a portfolio trigger, pause windows, scoped limits with their dollar caps, held and failed jobs, runs with their projects and the u hosts key, and settings" width="820">
 </p>
 
 - **MCP servers, read-only.** A trigger that names MCP servers says so on its row (`[mcp ...]`), and its
@@ -146,7 +146,7 @@ One command puts a live terminal view over the whole deployment:
   always marked as one ([`docs/insights.md`](https://github.com/edgehero/pi-dispatch/blob/main/docs/insights.md)).
 
 <p align="center">
-  <img src="https://raw.githubusercontent.com/edgehero/pi-dispatch/main/docs/images/insights-view.png?v=2026-10-13" alt="The insights page: KPI tiles, budget dials, the budget split, a plan verdict, spend charts, the five breakdowns, how busy each host was, and the topology with spend badges" width="820">
+  <img src="https://raw.githubusercontent.com/edgehero/pi-dispatch/main/docs/images/insights-view.png?v=2026-10-14" alt="The insights page: KPI tiles, budget dials, the budget split, a plan verdict, spend charts, the five breakdowns, how busy each host was, and the topology with spend badges" width="820">
 </p>
 
 - **Triggers, editable live.** Add, edit and delete triggers without a restart. Drill-ins show what
@@ -184,7 +184,7 @@ One command puts a live terminal view over the whole deployment:
   It counts jobs only: a machine busy with other work reads as idle.
 
 <p align="center">
-  <img src="https://raw.githubusercontent.com/edgehero/pi-dispatch/main/docs/images/dispatch-hosts.png?v=2026-10-09" alt="The panel's hosts view: three machines, each with its slots in use, the memory and CPU its budget has promised, its running jobs with project, size and age, a stale host with an orphaned container, and the last 7 days as busy share, jobs at once, time full, the wait and the top projects" width="820">
+  <img src="https://raw.githubusercontent.com/edgehero/pi-dispatch/main/docs/images/dispatch-hosts.png?v=2026-10-14" alt="The panel's hosts view: three machines, each with its slots in use, the memory and CPU its budget has promised, its running jobs with project, size and age, a stale host with an orphaned container, and the last 7 days as busy share, jobs at once, time full, the wait and the top projects" width="820">
 </p>
 
 - **The budget split.** With an allocation envelope (a dollar total per window and a floor per project), `b`
@@ -198,7 +198,7 @@ One command puts a live terminal view over the whole deployment:
   plan. A run's detail names the plan a portfolio run wrote and the dollars it settled.
 
 <p align="center">
-  <img src="https://raw.githubusercontent.com/edgehero/pi-dispatch/main/docs/images/dispatch-allocation.png?v=2026-10-05" alt="The panel's budget split view: the weekly envelope, each project's floor, weight, share and spend, the headroom, the applied plan clamped by the step with its reasons, and the history across two hosts with a revert" width="820">
+  <img src="https://raw.githubusercontent.com/edgehero/pi-dispatch/main/docs/images/dispatch-allocation.png?v=2026-10-14" alt="The panel's budget split view: the weekly envelope, each project's floor, weight, share and spend, the headroom, the applied plan with its reasons, and the history across two hosts with a revert and a refused plan" width="820">
 </p>
 
 - **The portfolio manager.** A weekly flow you own reads the budget and writes a plan of weights. The

package/dist/index.mjs

@@ -8810,7 +8810,7 @@ function isForgeKind(kind) {
 function forgeSpec(kind) {
   return isForgeKind(kind) ? FORGES[kind] : void 0;
 }
-var FORGES, FORGE_KINDS, RUN_KINDS, MINTED_TOKEN_VARS, FORGE_HOST_VARS;
+var FORGES, FORGE_KINDS, RUN_KINDS, MINTED_TOKEN_VARS, FORGE_HOST_VARS, RECEIVER_ONLY_VARS;
 var init_forges = __esm({
   "../worker/src/forges.mjs"() {
     FORGES = {
@@ -8819,7 +8819,8 @@ var init_forges = __esm({
         deliveryIdName: "X-GitHub-Delivery GUID",
         pullRequestSep: "#",
         tokenVars: ["GITHUB_TOKEN", "GH_TOKEN"],
-        hostVar: null,
+        hostVars: [],
+        receiverOnlyVars: [],
         prLabelAction: "labeled"
       },
       gitlab: {
@@ -8827,7 +8828,8 @@ var init_forges = __esm({
         deliveryIdName: "webhook-id / Idempotency-Key",
         pullRequestSep: "!",
         tokenVars: ["GITLAB_TOKEN", "GL_TOKEN"],
-        hostVar: "GITLAB_HOST",
+        hostVars: ["GITLAB_HOST"],
+        receiverOnlyVars: [],
         // A label added to a merge request arrives as a plain `update`, indistinguishable from any other
         // edit, so there is no action for a positive-selector rule to attach to. (Separately, a GitLab label
         // is not an approval at all -- a Guest can set one at issue creation -- which is why every gitlab
@@ -8844,9 +8846,23 @@ var init_forges = __esm({
         // Forgejo numbers issues and pull requests from ONE per-repository sequence, exactly as GitHub does
         // -- an issue and a PR cannot share an index. So `#` names one thing and no discriminator is needed.
         pullRequestSep: "#",
-        // `tea` reads GITEA_SERVER_TOKEN; the unprefixed name is what the API examples and most scripts use.
-        tokenVars: ["FORGEJO_TOKEN", "GITEA_SERVER_TOKEN"],
-        hostVar: "FORGEJO_HOST",
+        // `tea` logs in from the environment ONLY through GITEA_TOKEN plus GITEA_INSTANCE_URL. Measured on the
+        // pinned tea 0.15.0 in the 4.3.0 job image against a live Forgejo 14.0.5: that pair lists issues, while
+        // GITEA_SERVER_URL + GITEA_SERVER_TOKEN (with or without GITEA_LOGIN_VIA_ENV=1), FORGEJO_HOST +
+        // GITEA_SERVER_TOKEN, and GITEA_TOKEN alone inside a clone all fail "Error: no available login". So
+        // from be1cc42e until this row changed, every `tea` command the forgejo envelope tells the agent to run
+        // failed. GITEA_SERVER_TOKEN stays: it is the default of `tea login add --token` (its --help says
+        // `[$GITEA_SERVER_TOKEN]`), so an agent that adds a login explicitly still gets the job's token, and it
+        // stays reserved. FORGEJO_TOKEN is what the API examples and most scripts use.
+        // worker/test/forges.test.mjs pins these names to the tea version image/Dockerfile installs.
+        tokenVars: ["FORGEJO_TOKEN", "GITEA_TOKEN", "GITEA_SERVER_TOKEN"],
+        // GITEA_INSTANCE_URL is tea's, and must be the full URL with its scheme (FORGEJO_URL is). FORGEJO_HOST
+        // is read by no CLI; it is kept because it has been in every forgejo job since #61 and a skill may use it.
+        hostVars: ["GITEA_INSTANCE_URL", "FORGEJO_HOST"],
+        // The author gate's own lookup token (OQ-043): Forgejo answers a lookup of another user's permission only to a
+        // repository admin, so this is a read:repository token of an account that is one, and the job's FORGEJO_TOKEN
+        // can stay a write collaborator's. A job holding it would hold an admin's token, which is the whole point lost.
+        receiverOnlyVars: ["FORGEJO_PERMISSION_TOKEN"],
         // Forgejo names the action, so the positive-selector rule applies exactly as it does on GitHub.
         // Note this is HYGIENE, not the gate: unlike GitHub, every forgejo trigger is additionally gated on
         // the actor's resolved repository permission -- see filter-forgejo.mjs for why that is not
@@ -8867,7 +8883,8 @@ var init_forges = __esm({
         pullRequestSep: "!",
         // `az repos` reads AZURE_DEVOPS_EXT_PAT; SYSTEM_ACCESSTOKEN is what a pipeline-shaped script expects.
         tokenVars: ["AZURE_DEVOPS_EXT_PAT", "SYSTEM_ACCESSTOKEN"],
-        hostVar: "AZURE_DEVOPS_ORG_URL",
+        hostVars: ["AZURE_DEVOPS_ORG_URL"],
+        receiverOnlyVars: [],
         // Azure attaches no labels to a pull request at all, so there is no action to attach the rule to and
         // a predicated PR rule could never match. The loader refuses one rather than letting it load dead.
         prLabelAction: null
@@ -8876,7 +8893,8 @@ var init_forges = __esm({
     FORGE_KINDS = Object.freeze(Object.keys(FORGES));
     RUN_KINDS = Object.freeze(["local", ...FORGE_KINDS]);
     MINTED_TOKEN_VARS = new Set(FORGE_KINDS.flatMap((kind) => FORGES[kind].tokenVars));
-    FORGE_HOST_VARS = new Set(FORGE_KINDS.map((kind) => FORGES[kind].hostVar).filter((name) => typeof name === "string"));
+    FORGE_HOST_VARS = new Set(FORGE_KINDS.flatMap((kind) => FORGES[kind].hostVars));
+    RECEIVER_ONLY_VARS = new Set(FORGE_KINDS.flatMap((kind) => FORGES[kind].receiverOnlyVars));
   }
 });
 
@@ -9473,6 +9491,12 @@ function forwardEnvList(raw, egressArmed2 = false) {
       `PI_FORWARD_ENV must not forward ${minted.join(", ")} -- the worker mints a per-job token (CONST-TOKEN-SCOPED-PER-JOB) and a forwarded operator token would silently override it`
     );
   }
+  const receiverOnly = names.filter((n) => RECEIVER_ONLY_VARS.has(n));
+  if (receiverOnly.length > 0) {
+    throw configError4(
+      `PI_FORWARD_ENV must not forward ${receiverOnly.join(", ")} -- only the receiver reads it, for the author gate's permission lookup, and it belongs to an account that is an admin of the repositories, which is exactly what a job must not hold (OQ-043)`
+    );
+  }
   const workerOnly = names.filter((n) => WORKER_ONLY_SECRET_VARS.has(n));
   if (workerOnly.length > 0) {
     throw configError4(
@@ -17363,7 +17387,7 @@ var init_triggers = __esm({
     REPLICAS_MAX = 3;
     SECRETS_MAX = 16;
     ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
-    RESERVED_ENV_NAMES = /* @__PURE__ */ new Set([...MINTED_TOKEN_VARS, ...FORGE_HOST_VARS, ...WORKER_ONLY_SECRET_VARS, ...EGRESS_ENV_VARS, ...CONTAINER_ENV_NAMES, ...RUNNER_ENV_NAMES, ...PROVIDER_STEERING_VARS]);
+    RESERVED_ENV_NAMES = /* @__PURE__ */ new Set([...MINTED_TOKEN_VARS, ...FORGE_HOST_VARS, ...RECEIVER_ONLY_VARS, ...WORKER_ONLY_SECRET_VARS, ...EGRESS_ENV_VARS, ...CONTAINER_ENV_NAMES, ...RUNNER_ENV_NAMES, ...PROVIDER_STEERING_VARS]);
     INSTRUCTIONS_MAX = 2e3;
     RUN_MODEL_NEAR_MISS_TARGETS = Object.freeze({
       provider: "run.provider",
@@ -131864,8 +131888,8 @@ function runRow(row, sel, inner, styler) {
   return fitLine(`${cursor} ${tree}${rep}${cells.join(sep4)}`, inner, styler);
 }
 function outcomeColored(outcome, reason, styler) {
-  if (outcome === "completed") return styler.fg("success", "\u2714 done");
   const shown2 = (v) => scrubControl(String(v));
+  if (outcome === "completed") return reason ? styler.fg("warning", `\u2714 ${shown2(reason)}`) : styler.fg("success", "\u2714 done");
   if (outcome === "policy") return styler.fg("warning", `\u26A0 ${shown2(reason ?? "policy")}`);
   return styler.fg("error", `\u2718 ${shown2(reason ?? outcome ?? "failed")}`);
 }
@@ -133219,8 +133243,8 @@ var init_setup_wizard = __esm({
     init_connection();
     init_service_env();
     init_index();
-    RUNTIME_VERSION = "4.3.0";
-    RECEIVER_VERSION = "4.3.0";
+    RUNTIME_VERSION = "4.3.1";
+    RECEIVER_VERSION = "4.3.1";
     RUNTIME_PKG = "@edgehero/pi-dispatch";
     RECEIVER_PKG = "@edgehero/pi-dispatch-receiver";
     NUDGE_MARKER_BASENAME = "pi-dispatch-setup.nudged";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@edgehero/pi-dispatch-admin",
-  "version": "4.3.0",
+  "version": "4.3.1",
   "description": "Operator console for pi-dispatch, as a pi extension: a /dispatch panel over the queue, spend caps, scoped limits, run history and insights, editable cron and GitHub, GitLab, Forgejo and Azure DevOps triggers, pause windows, and human-confirmed tools your AI can operate.",
   "keywords": [
     "pi-package",