@vibe-commit/capture 0.7.0 → 0.8.0

package/dist/pending_revoke.js

@@ -0,0 +1,233 @@
+/**
+ * Pending revokes (slice 2, S4, R3-11): the WRITE-AHEAD record of a credential `g` has made and not yet been told to keep.
+ *
+ * ```
+ *   addPendingRevoke(home, credential, endpoint, now)   at the mint, BEFORE anything else: refuses (never overwrites) when it cannot
+ *   removePendingRevoke(home, token)                    after the revoke, or after the credential is kept: re-reads, removes ONE row
+ *   revokeHeld(home, token, fetch)                      one best-effort revoke (3 s) of a row, to ITS recorded origin
+ *   retryPendingRevokes(home, env, fetch, now)          every user-facing verb, once, at its start: one 3 s bound across all rows
+ *   readPendingRevokes(home)                            how many are waiting (for `status`'s `pending` count)
+ * ```
+ *
+ * ## ⛔ WHY IT IS WRITE-AHEAD
+ *
+ * `g` is the one place a credential is made ahead of consent (exception 3). So the credential lives in MEMORY until the yes:
+ * `credentials.json` does not exist before it, and the row below is written the instant the server hands the token over. A kill, a
+ * second Ctrl+C, a SIGHUP at the y/N or an unexpected throw therefore leaves a ROW (which the next verb revokes), never a live
+ * credential on disk that nothing remembers. The yes commits in this order: the grants, then `credentials.json`, then the row's
+ * deletion; a retry skips and drops any row whose token IS the current credential, so a kill between the last two never revokes what
+ * the user kept.
+ *
+ * ## ⛔ THE FILE HOLDS A BEARER TOKEN — the same exposure class as `credentials.json`, held to the same rules
+ *   - written mode 0600 under the 0700 directory, temp + rename;
+ *   - READ through `readSecretFile`: a file or folder others can read is refused, and an insecure or unreadable file is NEVER
+ *     overwritten (the writer refuses, and `g` fails closed);
+ *   - never printed, logged or returned: `status` counts the rows and shows nothing else, `--json` included;
+ *   - a hook never touches it (only the CLI verbs import this module; `test/connect-account.test.ts` walks the hooks' import graph).
+ *
+ * ## ⛔ A ROW IS NEVER DROPPED UNREVOKED, except by the clock
+ *   - it leaves on a 2xx, a 401 (the server does not accept it: already dead) or a 404 (a server that cannot revoke);
+ *   - or at `minted_at` + 91 days: a token that was never on disk was never used, and an ingest credential ends 90 days unused;
+ *   - there is no row cap that drops one: at the cap `addPendingRevoke` REFUSES, and `g` fails closed.
+ *
+ * ## ⛔ THE ORIGIN IS THE ROW'S
+ *
+ * A row records the issuing server's origin and a retry goes ONLY there (https, or http on loopback: `isAllowedIngestUrl`), never to
+ * wherever `VIBECOMMIT_MCP_URL` points today.
+ */
+import { chmodSync, mkdirSync, readFileSync, unlinkSync } from "node:fs";
+import { writeFileAtomic } from "./atomic_write.js";
+import { IngestCredential, INGEST_TOKEN_PREFIX } from "./credential.js";
+import { LEASE_MS, leased, readPendingRevokes, readQueue } from "./pending_revoke_file.js";
+import { REVOKE_TIMEOUT_MS, selfRevokeOutcome } from "./oauth/retire.js";
+import { credentialsPath, pendingRevokePath, rootDir } from "./paths.js";
+import { isAllowedIngestUrl } from "./post.js";
+export { readPendingRevokes } from "./pending_revoke_file.js";
+/** More rows than `g` can produce in earnest: past it `g` refuses rather than drop one. */
+export const MAX_ROWS = 8;
+/** A token never used ends 90 days after it is made; one day of slack. */
+const MAX_AGE_MS = 91 * 24 * 60 * 60 * 1000;
+/** One best-effort revoke, and the bound on a verb's whole retry. */
+export { REVOKE_TIMEOUT_MS };
+function writeRows(home, rows) {
+    if (rows.length === 0) {
+        try {
+            unlinkSync(pendingRevokePath(home));
+        }
+        catch {
+            /* already gone */
+        }
+        return;
+    }
+    mkdirSync(rootDir(home), { recursive: true, mode: 0o700 });
+    chmodSync(rootDir(home), 0o700);
+    writeFileAtomic(pendingRevokePath(home), `${JSON.stringify({ revokes: rows }, null, 2)}\n`, 0o600);
+}
+/**
+ * Write the row for a credential that has just been made. Never overwrites a file it cannot read, never drops a row.
+ * `lease: true` is `g` holding the credential at its y/N: the row carries `{ pid, lease_until }` (30 minutes) so another verb's retry
+ * leaves it alone while it is kept; every other writer (a test, an orphaned row) has no lease and is retried at once.
+ */
+export function addPendingRevoke(home, credential, endpoint, now, options = {}) {
+    try {
+        const token = credential.expose();
+        if (!token.startsWith(INGEST_TOKEN_PREFIX))
+            return { kind: "failed" };
+        const queue = readQueue(home);
+        if (queue.kind === "refused")
+            return { kind: "refused", read: queue.read };
+        const rows = queue.kind === "ok" ? queue.rows : [];
+        if (rows.some((row) => row.token === token))
+            return { kind: "written" };
+        if (rows.length >= MAX_ROWS)
+            return { kind: "full" };
+        const lease = options.lease === true ? { pid: process.pid, lease_until: new Date(now.getTime() + LEASE_MS).toISOString() } : null;
+        writeRows(home, [...rows, { token, minted_at: now.toISOString(), origin: new URL(endpoint).origin, lease }]);
+        return { kind: "written" };
+    }
+    catch {
+        return { kind: "failed" };
+    }
+}
+/** Remove ONE row, re-reading just before the write so a row queued in between survives. Deletes the file when it is empty. Never throws. */
+export function removePendingRevoke(home, token) {
+    removeRows(home, new Set([token]));
+}
+/** Give the row up to the retry: `g` is no longer holding the credential, so the next verb may revoke it. Re-reads before it writes. */
+export function releaseLease(home, token) {
+    try {
+        const queue = readQueue(home);
+        if (queue.kind !== "ok" || !queue.rows.some((row) => row.token === token && row.lease !== null))
+            return;
+        writeRows(home, queue.rows.map((row) => (row.token === token ? { ...row, lease: null } : row)));
+    }
+    catch {
+        /* the lease runs out by itself */
+    }
+}
+/**
+ * Is the row for `token` still there? `g` asks just before it commits, and the three answers are different things:
+ *   - `held`: the row is in a queue this client can use;
+ *   - `gone`: the queue is readable and the row is not in it — another verb settled (revoked) it;
+ *   - `unusable`: the queue is insecure or unreadable. Nobody revoked anything; this client can neither keep nor settle the record.
+ */
+export function holdsRow(home, token) {
+    const queue = readQueue(home);
+    if (queue.kind === "refused")
+        return "unusable";
+    return queue.kind === "ok" && queue.rows.some((row) => row.token === token) ? "held" : "gone";
+}
+function removeRows(home, tokens) {
+    try {
+        const queue = readQueue(home);
+        if (queue.kind !== "ok")
+            return;
+        const rows = queue.rows.filter((row) => !tokens.has(row.token));
+        if (rows.length !== queue.rows.length)
+            writeRows(home, rows);
+    }
+    catch {
+        /* the row stays; the next verb retries */
+    }
+}
+/** Revoke a token, with itself as the bearer, at `origin` — and only where a credential may be sent at all. */
+async function revokeToken(origin, token, fetchImpl, timeoutMs) {
+    if (!isAllowedIngestUrl(origin))
+        return null;
+    const outcome = await selfRevokeOutcome(origin, new IngestCredential(token, "file"), { fetch: fetchImpl, timeoutMs });
+    return outcome.kind === "retired" || outcome.kind === "gone" ? "revoked" : outcome.kind === "unknown" ? "unrevocable" : null;
+}
+/** The tokens this machine is using right now: `credentials.json`'s, read RAW (a mode problem does not hide it) and the environment's. */
+function currentTokens(home, env) {
+    const out = new Set();
+    try {
+        const token = JSON.parse(readFileSync(credentialsPath(home), "utf8")).token;
+        if (typeof token === "string" && token !== "")
+            out.add(token);
+    }
+    catch {
+        /* no file, or not ours: nothing to protect */
+    }
+    const envToken = env.VIBECOMMIT_TOKEN?.trim();
+    if (envToken !== undefined && envToken !== "")
+        out.add(envToken);
+    return out;
+}
+/**
+ * `g`'s every no-grant exit: one revoke within 3 s. With a readable row it goes to the row's recorded origin and removes the row on a
+ * 2xx, 401 or 404 (a failure gives the lease up so the next verb retries). With NO usable row — missing, or the queue refused — it
+ * revokes with the in-memory credential at the MINTED origin: a missing row is never taken for "already revoked".
+ */
+export async function revokeHeld(home, credential, mintedOrigin, fetchImpl) {
+    const token = credential.expose();
+    let insecure = null;
+    try {
+        const queue = readQueue(home);
+        const row = queue.kind === "ok" ? queue.rows.find((r) => r.token === token) : undefined;
+        if (queue.kind === "refused" && queue.read.kind === "insecure-file")
+            insecure = queue.read;
+        if (row !== undefined) {
+            const ended = await revokeToken(row.origin, token, fetchImpl, REVOKE_TIMEOUT_MS);
+            if (ended !== null) {
+                removePendingRevoke(home, token);
+                return { kind: ended, insecure };
+            }
+            releaseLease(home, token);
+            return { kind: "waiting", insecure };
+        }
+        const ended = await revokeToken(mintedOrigin, token, fetchImpl, REVOKE_TIMEOUT_MS);
+        return { kind: ended ?? "orphan", insecure };
+    }
+    catch {
+        return { kind: "orphan", insecure };
+    }
+}
+/**
+ * Every user-facing verb, once, at its start: one attempt at each row, and ONE 3 s bound across all of them (a row gets what is
+ * left of the bound, and none is attempted once it is spent). Silent, and needs no credential.
+ *
+ * Before EACH request it re-reads the queue and the current credential (a credential committed, or a row settled, after the loop
+ * began is never revoked on a stale view), and it
+ *   - skips and DROPS a row whose token is the current credential (the user kept it; the kill came between the credential's write
+ *     and the row's deletion) — compared on the file's raw token, so a mode problem does not hide a kept credential;
+ *   - skips (and keeps) a LEASED row: `g` is holding it at its y/N in another process;
+ *   - drops a row past `minted_at` + 91 days.
+ * Removes each row it settles as it goes, re-reading just before it writes. Returns how many rows still wait. Never throws.
+ */
+export async function retryPendingRevokes(home, env, fetchImpl, now, deadlineMs = REVOKE_TIMEOUT_MS) {
+    try {
+        const first = readQueue(home);
+        if (first.kind !== "ok")
+            return 0;
+        const started = Date.now();
+        for (const listed of first.rows) {
+            const fresh = readQueue(home);
+            if (fresh.kind !== "ok")
+                break;
+            const row = fresh.rows.find((r) => r.token === listed.token);
+            if (row === undefined)
+                continue;
+            if (currentTokens(home, env).has(row.token)) {
+                removePendingRevoke(home, row.token);
+                continue;
+            }
+            if (leased(row, now))
+                continue;
+            const age = now.getTime() - Date.parse(row.minted_at);
+            if (Number.isFinite(age) && age > MAX_AGE_MS) {
+                removePendingRevoke(home, row.token);
+                continue;
+            }
+            const left = deadlineMs - (Date.now() - started);
+            if (left <= 0)
+                break;
+            if ((await revokeToken(row.origin, row.token, fetchImpl, left)) !== null)
+                removePendingRevoke(home, row.token);
+        }
+        return readPendingRevokes(home).length;
+    }
+    catch {
+        return readPendingRevokes(home).length;
+    }
+}
+//# sourceMappingURL=pending_revoke.js.map

package/dist/pending_revoke.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending_revoke.js","sourceRoot":"","sources":["../src/pending_revoke.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAuB,MAAM,iBAAiB,CAAC;AAC7F,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE,SAAS,EAAkC,MAAM,0BAA0B,CAAC;AAC3H,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,EAAE,kBAAkB,EAAsB,MAAM,0BAA0B,CAAC;AAElF,2FAA2F;AAC3F,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC;AAC1B,0EAA0E;AAC1E,MAAM,UAAU,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC5C,qEAAqE;AACrE,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAE7B,SAAS,SAAS,CAAC,IAAY,EAAE,IAA8B;IAC7D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,UAAU,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB;QACpB,CAAC;QACD,OAAO;IACT,CAAC;IACD,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IAChC,eAAe,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACrG,CAAC;AAWD;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAY,EACZ,UAA4B,EAC5B,QAAgB,EAChB,GAAS,EACT,UAAwC,EAAE;IAE1C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,mBAAmB,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACtE,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;QAC3E,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,KAAK,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACxE,IAAI,IAAI,CAAC,MAAM,IAAI,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAClI,SAAS,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QAC7G,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,6IAA6I;AAC7I,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,KAAa;IAC7D,UAAU,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,wIAAwI;AACxI,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,KAAa;IACtD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,KAAK,KAAK,IAAI,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC;YAAE,OAAO;QACxG,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAClG,CAAC;IAAC,MAAM,CAAC;QACP,kCAAkC;IACpC,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,KAAa;IAClD,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,UAAU,CAAC;IAChD,OAAO,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;AAChG,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,MAA2B;IAC3D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI;YAAE,OAAO;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QAChE,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM;YAAE,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,0CAA0C;IAC5C,CAAC;AACH,CAAC;AAWD,+GAA+G;AAC/G,KAAK,UAAU,WAAW,CAAC,MAAc,EAAE,KAAa,EAAE,SAAuB,EAAE,SAAiB;IAClG,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,IAAI,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;IACtH,OAAO,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/H,CAAC;AAED,0IAA0I;AAC1I,SAAS,aAAa,CAAC,IAAY,EAAE,GAAsB;IACzD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,KAAK,GAAI,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAyB,CAAC,KAAK,CAAC;QACrG,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE;YAAE,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,8CAA8C;IAChD,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC;IAC9C,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE;QAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACjE,OAAO,GAAG,CAAC;AACb,CAAC;AAiBD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,UAA4B,EAAE,YAAoB,EAAE,SAAuB;IACxH,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;IAClC,IAAI,QAAQ,GAA2B,IAAI,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxF,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,eAAe;YAAE,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC;QAC3F,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC;YACjF,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,mBAAmB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBACjC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;YACnC,CAAC;YACD,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC1B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QACvC,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC;QACnF,OAAO,EAAE,IAAI,EAAE,KAAK,IAAI,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACtC,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAY,EACZ,GAAsB,EACtB,SAAuB,EACvB,GAAS,EACT,UAAU,GAAG,iBAAiB;IAE9B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI;YAAE,OAAO,CAAC,CAAC;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI;gBAAE,MAAM;YAC/B,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC;YAC7D,IAAI,GAAG,KAAK,SAAS;gBAAE,SAAS;YAChC,IAAI,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5C,mBAAmB,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;gBACrC,SAAS;YACX,CAAC;YACD,IAAI,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC;gBAAE,SAAS;YAC/B,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACtD,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,UAAU,EAAE,CAAC;gBAC7C,mBAAmB,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;gBACrC,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,UAAU,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC;YACjD,IAAI,IAAI,IAAI,CAAC;gBAAE,MAAM;YACrB,IAAI,CAAC,MAAM,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI;gBAAE,mBAAmB,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QACjH,CAAC;QACD,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;IACzC,CAAC;AACH,CAAC"}

package/dist/pending_revoke_file.d.ts

@@ -0,0 +1,55 @@
+/**
+ * The pending-revoke queue's FILE: its path's format, and reading it (slice 2, S4). Split from `pending_revoke.ts` so that what
+ * `status` needs — a COUNT — does not drag the writer and the network revoke onto every process's load path.
+ *
+ * Read through `readSecretFile` (the same mode checks as `credentials.json`): a file or folder others can read, a file that is not
+ * what this client wrote, or one with a row it cannot read all come back `refused`, and `pending_revoke.ts` never overwrites those.
+ * Nothing here writes, sends or prints a token; the only thing it hands `status` is how many rows wait.
+ */
+import { type SecretFileRead } from "./credential.js";
+export interface PendingRevoke {
+    readonly token: string;
+    /** ISO 8601, when the server made the credential. */
+    readonly minted_at: string;
+    /** The issuing server's origin (`https://api.vibecommit.ai`): the only place a retry sends this token. */
+    readonly origin: string;
+    /**
+     * While `g` is holding the credential (waiting at its y/N) the row carries the holder's lease: a retry run by ANOTHER verb in the
+     * meantime must not revoke a credential that is about to be kept. A row with no lease is an orphan. See `leased`.
+     */
+    readonly lease: {
+        readonly pid: number;
+        readonly lease_until: string;
+    } | null;
+}
+/** How long a holder's lease lasts: a `g` whose question stays open longer may be revoked by another verb, and its commit then refuses. */
+export declare const LEASE_MS: number;
+/**
+ * Is the row leased at `now`? BOTH must hold: the holder's pid is alive (`kill(pid, 0)`: EPERM counts as alive, ESRCH as dead) and
+ * `now` is before the EARLIER of the row's own `lease_until` and `minted_at` + 30 minutes. The lease is capped at its mint: a
+ * `lease_until` written far in the future (a bug, or an edit) does not keep a live pid's row out of the retry for ever. A dead holder or
+ * an expired lease is an orphan, which any verb's retry revokes.
+ */
+export declare function leased(row: PendingRevoke, now: Date): boolean;
+export type Queue = {
+    readonly kind: "ok";
+    readonly rows: PendingRevoke[];
+} | {
+    readonly kind: "absent";
+}
+/** Present but not safe to read or write: never read, never overwritten. */
+ | {
+    readonly kind: "refused";
+    readonly read: Exclude<SecretFileRead, {
+        kind: "ok";
+    } | {
+        kind: "absent";
+    }> | {
+        readonly kind: "unreadable";
+    };
+};
+export declare function readQueue(home: string): Queue;
+/** The rows waiting, for a count. An absent, insecure or unreadable file reads as none (it is never sent from). */
+export declare function readPendingRevokes(home: string): PendingRevoke[];
+/** How many rows wait: all `status` shows of the queue. */
+export declare function countPendingRevokes(home: string): number;

package/dist/pending_revoke_file.js

@@ -0,0 +1,74 @@
+/**
+ * The pending-revoke queue's FILE: its path's format, and reading it (slice 2, S4). Split from `pending_revoke.ts` so that what
+ * `status` needs — a COUNT — does not drag the writer and the network revoke onto every process's load path.
+ *
+ * Read through `readSecretFile` (the same mode checks as `credentials.json`): a file or folder others can read, a file that is not
+ * what this client wrote, or one with a row it cannot read all come back `refused`, and `pending_revoke.ts` never overwrites those.
+ * Nothing here writes, sends or prints a token; the only thing it hands `status` is how many rows wait.
+ */
+import { INGEST_TOKEN_PREFIX, readSecretFile } from "./credential.js";
+import { pendingRevokePath } from "./paths.js";
+/** How long a holder's lease lasts: a `g` whose question stays open longer may be revoked by another verb, and its commit then refuses. */
+export const LEASE_MS = 30 * 60 * 1000;
+/**
+ * Is the row leased at `now`? BOTH must hold: the holder's pid is alive (`kill(pid, 0)`: EPERM counts as alive, ESRCH as dead) and
+ * `now` is before the EARLIER of the row's own `lease_until` and `minted_at` + 30 minutes. The lease is capped at its mint: a
+ * `lease_until` written far in the future (a bug, or an edit) does not keep a live pid's row out of the retry for ever. A dead holder or
+ * an expired lease is an orphan, which any verb's retry revokes.
+ */
+export function leased(row, now) {
+    if (row.lease === null)
+        return false;
+    const until = Math.min(Date.parse(row.lease.lease_until), Date.parse(row.minted_at) + LEASE_MS);
+    if (!(until > now.getTime()))
+        return false;
+    try {
+        process.kill(row.lease.pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code === "EPERM";
+    }
+}
+export function readQueue(home) {
+    const read = readSecretFile(home, pendingRevokePath(home));
+    if (read.kind === "absent")
+        return { kind: "absent" };
+    if (read.kind !== "ok")
+        return { kind: "refused", read };
+    try {
+        const doc = JSON.parse(read.raw);
+        if (doc === null || typeof doc !== "object" || !Array.isArray(doc.revokes))
+            return { kind: "refused", read: { kind: "unreadable" } };
+        const rows = [];
+        for (const row of doc.revokes) {
+            if (row === null || typeof row !== "object")
+                return { kind: "refused", read: { kind: "unreadable" } };
+            const r = row;
+            if (typeof r.token !== "string" || !r.token.startsWith(INGEST_TOKEN_PREFIX) || typeof r.minted_at !== "string" || typeof r.origin !== "string") {
+                // A row this client cannot read is a row it must not lose: refuse the whole file rather than rewrite it without the row.
+                return { kind: "refused", read: { kind: "unreadable" } };
+            }
+            // A lease this client cannot read is NO lease: the row is an orphan, which errs toward revoking.
+            const l = r.lease;
+            const lease = l !== null && l !== undefined && typeof l === "object" && typeof l.pid === "number" && Number.isInteger(l.pid) && typeof l.lease_until === "string"
+                ? { pid: l.pid, lease_until: l.lease_until }
+                : null;
+            rows.push({ token: r.token, minted_at: r.minted_at, origin: r.origin, lease });
+        }
+        return { kind: "ok", rows };
+    }
+    catch {
+        return { kind: "refused", read: { kind: "unreadable" } };
+    }
+}
+/** The rows waiting, for a count. An absent, insecure or unreadable file reads as none (it is never sent from). */
+export function readPendingRevokes(home) {
+    const queue = readQueue(home);
+    return queue.kind === "ok" ? queue.rows : [];
+}
+/** How many rows wait: all `status` shows of the queue. */
+export function countPendingRevokes(home) {
+    return readPendingRevokes(home).length;
+}
+//# sourceMappingURL=pending_revoke_file.js.map

package/dist/pending_revoke_file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending_revoke_file.js","sourceRoot":"","sources":["../src/pending_revoke_file.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAuB,MAAM,iBAAiB,CAAC;AAC3F,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAe/C,2IAA2I;AAC3I,MAAM,CAAC,MAAM,QAAQ,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEvC;;;;;GAKG;AACH,MAAM,UAAU,MAAM,CAAC,GAAkB,EAAE,GAAS;IAClD,IAAI,GAAG,CAAC,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,QAAQ,CAAC,CAAC;IAChG,IAAI,CAAC,CAAC,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAQ,KAA+B,CAAC,IAAI,KAAK,OAAO,CAAC;IAC3D,CAAC;AACH,CAAC;AAQD,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3D,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACtD,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAiC,CAAC;QACjE,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,CAAC;QACrI,MAAM,IAAI,GAAoB,EAAE,CAAC;QACjC,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,OAAoB,EAAE,CAAC;YAC3C,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,CAAC;YACtG,MAAM,CAAC,GAAG,GAAkF,CAAC;YAC7F,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,mBAAmB,CAAC,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC/I,yHAAyH;gBACzH,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,CAAC;YAC3D,CAAC;YACD,iGAAiG;YACjG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAoE,CAAC;YACjF,MAAM,KAAK,GACT,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ;gBACjJ,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE;gBAC5C,CAAC,CAAC,IAAI,CAAC;YACX,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,mHAAmH;AACnH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/C,CAAC;AAGD,2DAA2D;AAC3D,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;AACzC,CAAC"}

package/dist/picker.d.ts

@@ -14,6 +14,8 @@
  *               row (D9: at most 8 repos before `+ N more`).
  *   turned off  slugs in `excluded`. Choosing one is a re-include; the grant block names it on a `turn on` row, inside
  *               the same y/N (D7 · 3A), and only a yes clears the exclusion.
+ *   on your account  (slice 2) what the account grants that this machine has not named. Unticked until chosen, like any
+ *               row: choosing one is an ordinary addition, so it goes through the same disclosure and y/N (R3-8, R3-9).
  *
  * ⛔ **A pre-tick is not a consent** (D34): the working folder's repo starts ticked, and Enter on it leads to the naming
  * y/N, which defaults to N. It is an ADDITION to the diff, never part of the baseline.
@@ -66,9 +68,16 @@ export interface TurnedOffRow {
     /** The working folder's repo, turned off: `connect` inside it pre-selects the `turn on` (D34 + the re-include rule). */
     readonly pre: boolean;
 }
+/** One account grant this machine has not named (slice 2): an owner (`key` without its slash) or a repo (`key` is the slug). */
+export interface AccountRow {
+    readonly kind: "owner" | "repo";
+    readonly key: string;
+}
 export interface PickerModel {
     readonly onNow: readonly OnNowRow[];
     readonly owners: readonly OwnerGroup[];
+    /** What the account grants that this machine has not named. Empty before a sync, or on a machine with no credential. */
+    readonly account: readonly AccountRow[];
     readonly turnedOff: readonly TurnedOffRow[];
     /** The picker's `Not listed here:` lines (no remote, can't be matched, unreadable agents). */
     readonly notListed: readonly string[];
@@ -114,6 +123,8 @@ export interface ModelInput {
     readonly notListed: readonly string[];
     readonly sawNothing: boolean;
     readonly here: HereRepo | null;
+    /** The account's grants this machine has not named, as `accountView` lists them: `owner/` for an owner, the slug for a repo. */
+    readonly accountNotHere?: readonly string[];
 }
 export declare function buildModel(input: ModelInput): PickerModel;
 /** What a number on screen stands for. On-now rows come first, then each owner's repos, then turned-off. */
@@ -123,6 +134,9 @@ export type RowRef = {
 } | {
     readonly kind: "repo";
     readonly repo: PickRepo;
+} | {
+    readonly kind: "account";
+    readonly row: AccountRow;
 } | {
     readonly kind: "off";
     readonly row: TurnedOffRow;
@@ -136,6 +150,10 @@ export type Parsed = {
     readonly kind: "empty";
 } | {
     readonly kind: "more";
+}
+/** `g`, alone, where it was offered (slice 2, exception 3): use the repositories the account already grants. */
+ | {
+    readonly kind: "account";
 } | {
     readonly kind: "change";
     readonly change: PickerChange;
@@ -148,13 +166,19 @@ export type Parsed = {
  * Parse one typed answer (D8 · 4A). ⛔ **Never applies part of an answer:** any token that is not understood returns
  * `error` naming each such token, and nothing is chosen. `owner/` and `owner/repo` are always accepted, a clone here or
  * not, because a new laptop needs them; the grant block flags `(no clone here yet)`.
+ *
+ * ⛔ **`g` STANDS ALONE** (exception 3, R3-12): where `offerAccount` is true, `g` alone is the account's grants, and `g` mixed with
+ * any other token is refused with nothing applied, so the y/N after it always names a single list. Where it was not offered `g` is
+ * an ordinary token nobody understands.
  */
-export declare function parseTyped(input: string, model: PickerModel, showAll: boolean): Parsed;
+export declare function parseTyped(input: string, model: PickerModel, showAll: boolean, offerAccount?: boolean): Parsed;
 export interface RenderOptions {
     readonly colour: boolean;
     readonly nowMs: number;
     /** Show every repo, numbered afresh (the `more` token). */
     readonly showAll: boolean;
+    /** Slice 2: the prompt block's `g` line (screen 1a). Only on a machine with no credential, a terminal and a browser to sign in with. */
+    readonly offerAccount?: boolean;
 }
 /** The `Not listed here:` block, muted, or nothing. */
 export declare function notListedBlock(model: PickerModel, colour: boolean): string[];
@@ -168,13 +192,17 @@ export interface BlockFacts {
     readonly reposHere: ReadonlyMap<string, number>;
     /** Typed `owner/` and `owner/repo` with no clone here. */
     readonly noClone: ReadonlySet<string>;
+    /** `turn on` slugs the ACCOUNT has turned off: the row says so, because the yes re-includes them on every machine. */
+    readonly accountOff?: ReadonlySet<string>;
 }
 /**
  * The `You chose:` block — the thing the y/N is asking about (D7 · 3A), on the §13.5 label gutter. One label per kind of
  * change; an owner row says how many repos are here and that later clones are covered, and a typed name with no clone
  * on this machine says so, so a typo shows BEFORE the question.
  */
-export declare function renderGrantBlock(change: PickerChange, facts: BlockFacts, colour: boolean): string[];
+export declare function renderGrantBlock(change: PickerChange, facts: BlockFacts, colour: boolean, 
+/** `You chose:` for the person's picks; the account's own list (`g`, screen 1b) is headed `Your account grants:`. */
+heading?: string): string[];
 /** The grant y/N: additions (with or without removals) get the upload question, removals alone the stop question. */
 export declare function grantQuestion(change: PickerChange, colour: boolean, answers: string): string;
 export {};

package/dist/picker.js

@@ -14,6 +14,8 @@
  *               row (D9: at most 8 repos before `+ N more`).
  *   turned off  slugs in `excluded`. Choosing one is a re-include; the grant block names it on a `turn on` row, inside
  *               the same y/N (D7 · 3A), and only a yes clears the exclusion.
+ *   on your account  (slice 2) what the account grants that this machine has not named. Unticked until chosen, like any
+ *               row: choosing one is an ordinary addition, so it goes through the same disclosure and y/N (R3-8, R3-9).
  *
  * ⛔ **A pre-tick is not a consent** (D34): the working folder's repo starts ticked, and Enter on it leads to the naming
  * y/N, which defaults to N. It is an ADDITION to the diff, never part of the baseline.
@@ -152,9 +154,19 @@ export function buildModel(input) {
     const turnedOff = [...excluded]
         .sort()
         .map((slug) => ({ slug, counts: countsOf(slug), pre: slug === hereSlug }));
+    // ⛔ THE SCAN ROW WINS: an owner that already has a group above, and a repo already listed under one, are not repeated under "on
+    // your account" — choosing the scan row is the same change, and one row per thing is what a person can read.
+    const shownOwners = new Set(owners.map((group) => group.owner));
+    const shownRepos = new Set(owners.flatMap((group) => group.repos.map((repo) => repo.slug)));
+    const account = (input.accountNotHere ?? [])
+        .map((name) => name.endsWith("/")
+        ? { kind: "owner", key: normalizeOwner(name.slice(0, -1)) }
+        : { kind: "repo", key: normalizeSlug(name) })
+        .filter((row) => (row.kind === "owner" ? !shownOwners.has(row.key) : !shownRepos.has(row.key)));
     return {
         onNow,
         owners,
+        account,
         turnedOff,
         notListed: input.notListed,
         found: input.repos.length,
@@ -172,6 +184,8 @@ export function numberedRows(model, showAll) {
         for (const repo of shown)
             rows.push({ kind: "repo", repo });
     }
+    for (const row of model.account)
+        rows.push({ kind: "account", row });
     for (const row of model.turnedOff)
         rows.push({ kind: "off", row });
     return rows;
@@ -182,13 +196,20 @@ const REPO_TOKEN = /^[^\s/]+(?:\/[^\s/]+)*\/[^\s/]+$/u;
  * Parse one typed answer (D8 · 4A). ⛔ **Never applies part of an answer:** any token that is not understood returns
  * `error` naming each such token, and nothing is chosen. `owner/` and `owner/repo` are always accepted, a clone here or
  * not, because a new laptop needs them; the grant block flags `(no clone here yet)`.
+ *
+ * ⛔ **`g` STANDS ALONE** (exception 3, R3-12): where `offerAccount` is true, `g` alone is the account's grants, and `g` mixed with
+ * any other token is refused with nothing applied, so the y/N after it always names a single list. Where it was not offered `g` is
+ * an ordinary token nobody understands.
  */
-export function parseTyped(input, model, showAll) {
+export function parseTyped(input, model, showAll, offerAccount = false) {
     const tokens = input.split(/[\s,]+/u).filter((t) => t !== "");
     if (tokens.length === 0)
         return { kind: "empty" };
     if (tokens.length === 1 && tokens[0].toLowerCase() === "more")
         return { kind: "more" };
+    if (offerAccount && tokens.some((t) => t.toLowerCase() === "g")) {
+        return tokens.length === 1 ? { kind: "account" } : { kind: "error", tokens: [PICKER.gMixedToken] };
+    }
     const rows = numberedRows(model, showAll);
     const bad = [];
     const addOwners = new Set();
@@ -236,6 +257,12 @@ export function parseTyped(input, model, showAll) {
                 bad.push(PICKER.alreadyOn(token, `-${token}`));
             else if (row.kind === "off")
                 turnOn.add(row.row.slug);
+            else if (row.kind === "account") {
+                if (row.row.kind === "owner")
+                    addOwners.add(row.row.key);
+                else
+                    addSlug(row.row.key, token);
+            }
             else
                 addSlug(row.repo.slug, token);
         }
@@ -377,7 +404,11 @@ export function notListedBlock(model, colour) {
 export function renderTyped(model, options) {
     const { colour, nowMs, showAll } = options;
     const lines = [""];
-    if (model.found === 0 && model.onNow.length === 0 && model.turnedOff.length === 0 && model.owners.length === 0) {
+    if (model.found === 0 &&
+        model.onNow.length === 0 &&
+        model.turnedOff.length === 0 &&
+        model.owners.length === 0 &&
+        model.account.length === 0) {
         return [
             ...lines,
             ...wrap(model.sawNothing ? PICKER.emptyNone : SCAN.noneListable, 2).map((l) => paint(colour, "strong", l)),
@@ -385,6 +416,7 @@ export function renderTyped(model, options) {
             ...notListedBlock(model, colour),
             "",
             ...wrap(model.sawNothing ? PICKER.emptyType : PICKER.emptyListable, 2),
+            ...(options.offerAccount === true ? wrap(PICKER.gLine, 2) : []),
             `  ${PICKER.enterNothing}`,
         ];
     }
@@ -392,12 +424,17 @@ export function renderTyped(model, options) {
     const onNow = model.onNow.map((row) => onNowDisplay(row, nowMs));
     const shown = (g) => (showAll ? g.repos : g.repos.slice(0, GROUP_CAP));
     const repoRows = model.owners.flatMap((g) => shown(g).map((r) => repoDisplay(r, nowMs)));
+    const account = model.account.map((row) => ({
+        name: row.kind === "owner" ? `${row.key}/` : row.key,
+        meta: PICKER.onAccountHint,
+        agents: "",
+    }));
     const off = model.turnedOff.map((row) => ({
         name: row.slug,
         meta: PICKER.turnOnHint,
         agents: "",
     }));
-    const { cut, column, withAgents } = layout([...onNow, ...repoRows, ...off]);
+    const { cut, column, withAgents } = layout([...onNow, ...repoRows, ...account, ...off]);
     const row = (n, display) => `${String(n).padStart(6)}  ${paint(colour, "text", cut(display.name).padEnd(column))}${" ".repeat(GAP)}${paint(colour, "muted", withAgents(display))}`;
     let n = 0;
     if (model.onNow.length > 0) {
@@ -414,6 +451,11 @@ export function renderTyped(model, options) {
             lines.push(paint(colour, "muted", `     +  ${PICKER.moreTyped(hidden, group.owner)}`));
         }
     }
+    if (account.length > 0) {
+        lines.push(paint(colour, "muted", `  ${PICKER.onAccount}`));
+        for (const d of account)
+            lines.push(row(++n, d));
+    }
     if (model.turnedOff.length > 0) {
         lines.push(paint(colour, "muted", `  ${PICKER.turnedOff}`));
         for (const d of off)
@@ -421,6 +463,8 @@ export function renderTyped(model, options) {
     }
     lines.push(...notListedBlock(model, colour), "");
     lines.push(`  ${paint(colour, "text", PICKER.choose(model.owners.length > 0))}`);
+    if (options.offerAccount === true)
+        lines.push(...wrap(PICKER.gLine, 2).map((l) => paint(colour, "text", l)));
     if (model.onNow.length > 0)
         lines.push(`  ${paint(colour, "text", PICKER.removeHint)}`);
     const pre = preChange(model);
@@ -437,8 +481,10 @@ export function notUnderstoodLines(tokens) {
  * change; an owner row says how many repos are here and that later clones are covered, and a typed name with no clone
  * on this machine says so, so a typo shows BEFORE the question.
  */
-export function renderGrantBlock(change, facts, colour) {
-    const lines = [`  ${paint(colour, "strong", PICKER.chose)}`];
+export function renderGrantBlock(change, facts, colour, 
+/** `You chose:` for the person's picks; the account's own list (`g`, screen 1b) is headed `Your account grants:`. */
+heading = PICKER.chose) {
+    const lines = [`  ${paint(colour, "strong", heading)}`];
     const rows = [
         [
             PICKER.labelOwners,
@@ -451,7 +497,10 @@ export function renderGrantBlock(change, facts, colour) {
             PICKER.labelRepos,
             change.addRepos.map((r) => (facts.noClone.has(r) ? `${r}  ${PICKER.noCloneHere}` : r)),
         ],
-        [PICKER.labelTurnOn, [...change.turnOn]],
+        [
+            PICKER.labelTurnOn,
+            change.turnOn.map((slug) => (facts.accountOff?.has(slug) === true ? `${slug}  ${PICKER.turnedOffOnAccount}` : slug)),
+        ],
         [
             PICKER.labelStop,
             [