@worca/app 1.4.0 → 1.5.0-rc.2

package/src/core/claude-runner.mjs

@@ -52,6 +52,8 @@ import { writeFile, mkdir, appendFile, readFile, access, readdir } from 'node:fs
 import { constants as FS, mkdtempSync, writeFileSync, rmSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { tmpdir } from 'node:os';
+import { stripGithubCredentials } from './github-credentials.mjs';
+import { agentIdentity, agentSpawn, killAgentGroup, shareWithAgent } from './agent-user.mjs';
 
 const DEFAULT_BIN = process.env.WORCA_CLAUDE_BIN || process.env.ORCH_CLAUDE_BIN || 'claude';
 
@@ -395,6 +397,9 @@ export async function runClaude(o = {}) {
     appendSubagentSystemPrompt,
     addDirs,
     argvInlineLimit,
+    // A pipeline agent (phases.mjs): runs as WORCA_AGENT_USER when the container set one
+    // up (agent-user.mjs). Server-side helpers and Ask Worca leave it unset.
+    asAgent,
     bin = DEFAULT_BIN,
   } = o;
 
@@ -441,6 +446,7 @@ export async function runClaude(o = {}) {
     appendSubagentSystemPrompt,
     addDirs,
     argvInlineLimit,
+    asAgent,
   });
 }
 
@@ -505,7 +511,7 @@ export function buildClaudeArgs({
   if (tools.length) {
     args.push('--allowedTools', tools.join(','));
   }
-  // Model bridge (model-bridge-design.md §5.3): a translated (openai-chat)
+  // Model bridge (model-bridge-design.md §5.3): a translated (openai-chat / openai-responses)
   // model has no server-side web tools, so the runner withholds them outright —
   // a deny outranks any allow, frontmatter grant included. Absent/empty ⇒
   // nothing emitted, so every other argv stays byte-identical.
@@ -595,7 +601,7 @@ export function stageClaudeInvocation(opts, { bin = DEFAULT_BIN, limit = ARGV_IN
   return { ...plan, dir };
 }
 
-function runReal({ cwd, systemPrompt, prompt, allowedTools, permissionMode, model, effort, onEvent, signal, bin, resumeSessionId, mcpConfigPath, mcpServerGrants, permissionRules, envScrub, envAllowlist, modelEnv, disallowedTools, tools, strictMcpConfig, settingSources, disableSlashCommands, includePartialMessages, maxTurns, maxBudgetUsd, appendSubagentSystemPrompt, addDirs, argvInlineLimit }) {
+function runReal({ cwd, systemPrompt, prompt, allowedTools, permissionMode, model, effort, onEvent, signal, bin, resumeSessionId, mcpConfigPath, mcpServerGrants, permissionRules, envScrub, envAllowlist, modelEnv, disallowedTools, tools, strictMcpConfig, settingSources, disableSlashCommands, includePartialMessages, maxTurns, maxBudgetUsd, appendSubagentSystemPrompt, addDirs, argvInlineLimit, asAgent }) {
   return new Promise((resolveP, rejectP) => {
     // Per-model routing env (design §4.4), prepared BEFORE argv: reserved keys
     // are re-dropped here defensively — the write path already rejects them, so
@@ -704,6 +710,10 @@ function runReal({ cwd, systemPrompt, prompt, allowedTools, permissionMode, mode
     // drop it — WORCA_ is not an allowlisted prefix — so it is added AFTER).
     if (guardOn) spawnEnv = { ...(spawnEnv ?? process.env), WORCA_HOST_PID: String(process.pid) };
 
+    // No GitHub credential reaches claude, in any guardrail tier, from a per-project allowlist or a
+    // model env alike (src/core/github-credentials.mjs): pushes and PRs are worca's own calls.
+    spawnEnv = stripGithubCredentials(spawnEnv ?? process.env);
+
     // Opt-in spawn diagnostics (WORCA_DEBUG_SPAWN, default off — byte-identical spawn
     // path when unset). Everything here is derived from values already computed above
     // (safeModelEnv is null or non-empty, so the routing field is either the described
@@ -723,10 +733,20 @@ function runReal({ cwd, systemPrompt, prompt, allowedTools, permissionMode, mode
       safeEmit(onEvent, { type: 'stderr', stream: 'err', text: summary });
     }
 
+    // Agent isolation (agent-user.mjs): the same command under the agent's uid, via sudo, in its
+    // own process group so a stuck agent can still be SIGKILLed through sudo.
+    const agentId = asAgent ? agentIdentity() : null;
     let child;
     try {
-      child = spawn(resolved.bin, args, {
+      let file = resolved.bin;
+      let argv = args;
+      if (agentId) {
+        if (plan.dir) shareWithAgent(plan.dir, agentId);
+        ({ file, args: argv, env: spawnEnv } = agentSpawn(resolved.bin, args, spawnEnv, agentId));
+      }
+      child = spawn(file, argv, {
         cwd, stdio: [plan.stdin != null ? 'pipe' : 'ignore', 'pipe', 'pipe'], ...(spawnEnv ? { env: spawnEnv } : {}),
+        ...(agentId ? { detached: true } : {}),
       });
     } catch (err) {
       cleanupStaged();
@@ -761,11 +781,14 @@ function runReal({ cwd, systemPrompt, prompt, allowedTools, permissionMode, mode
       }
       // Escalate if it ignores SIGTERM.
       setTimeout(() => {
+        // Only a sudo still running holds the group: after it exits the pid may be reused.
+        const stuck = child.exitCode === null && child.signalCode === null;
         try {
           child.kill('SIGKILL');
         } catch {
           /* ignore */
         }
+        if (agentId && stuck) killAgentGroup(child.pid, agentId);
       }, sigkillGraceMs()).unref?.();
     };
     if (signal) {

package/src/core/clone-project.mjs

@@ -0,0 +1,139 @@
+// Add a project by cloning a repository into the projects folder (docs/deploy-railway.md).
+// On a hosted worca this replaces a `railway ssh` session: the clone runs in the server,
+// as the server's user, with the read credential for that one command
+// (github-credentials.mjs#githubEnv), and lands in a NEW folder directly under the
+// projects root. Registration is the ordinary add-project step.
+//
+//   URLs     https only; no credentials inside the URL (use the token variables)
+//   allow    WORCA_CLONE_ALLOW, e.g. "github.com/acme/*,github.com/you/app"; unset = any
+//   where    <projects root>/<name>; name defaults to the repository name, is sanitised,
+//            and an existing folder is refused, never overwritten
+//   size     --filter=blob:none (partial clone), a timeout (default 10 minutes), and a
+//            failed clone removes its folder
+import { spawn } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { rm } from 'node:fs/promises';
+import { join, resolve, sep } from 'node:path';
+import { githubEnv, stripGithubCredentials } from './github-credentials.mjs';
+
+export const CLONE_TIMEOUT_MS = 10 * 60_000;
+const NAME_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/;
+const SEG_RE = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+const BRANCH_RE = /^(?!-)(?!.*\.\.)(?!.*\/\/)(?!.*@\{)[A-Za-z0-9._\/-]{1,200}(?<![./])$/;
+
+/** A clone refusal: `code` is one of invalid | not-allowed | exists | auth-failed | not-found | timeout | failed. */
+export class CloneError extends Error {
+  constructor(code, message) { super(message); this.code = code; }
+}
+
+/** WORCA_CLONE_ALLOW -> ["github.com/acme/*", "github.com/you/app"] (lowercased). */
+export function parseCloneAllow(value) {
+  return String(value || '').split(',').map((s) => s.trim().toLowerCase().replace(/\/+$/, '')).filter(Boolean);
+}
+
+/** True when host/owner/repo matches an allow entry ("host/owner/*" or "host/owner/repo"). Empty list = any. */
+export function cloneAllowed(allow, { host, owner, repo }) {
+  if (!allow.length) return true;
+  const full = `${host}/${owner}/${repo}`.toLowerCase();
+  return allow.some((p) => (p.endsWith('/*') ? full.startsWith(p.slice(0, -1)) : full === p));
+}
+
+/**
+ * Validate a clone request. Pure (besides existsSync on the target). Returns
+ * { url, host, owner, repo, name, dir, branch } or throws CloneError('invalid'|'not-allowed'|'exists').
+ */
+export function planClone({ url, branch = null, name = null } = {}, { projectsRoot, env = process.env, exists = existsSync } = {}) {
+  if (typeof url !== 'string' || !url.trim()) throw new CloneError('invalid', 'a repository URL is required');
+  let u;
+  try { u = new URL(url.trim()); } catch { throw new CloneError('invalid', 'not a valid URL'); }
+  if (u.protocol !== 'https:') throw new CloneError('invalid', 'only https:// repository URLs are supported');
+  if (u.username || u.password) {
+    throw new CloneError('invalid', 'the URL contains credentials; remove them and set the GitHub token or App variables where worca is deployed');
+  }
+  if (u.search || u.hash) throw new CloneError('invalid', 'the URL must not have a query or fragment');
+  if (u.port) throw new CloneError('invalid', 'the URL must not name a port');
+  const host = u.hostname.toLowerCase();
+  const segs = u.pathname.replace(/\/+$/, '').replace(/\.git$/i, '').split('/').filter(Boolean);
+  if (segs.length !== 2 || !segs.every((s) => SEG_RE.test(s))) {
+    throw new CloneError('invalid', 'the URL must name one repository, like https://github.com/owner/repo');
+  }
+  const [owner, repo] = segs;
+  if (!cloneAllowed(parseCloneAllow(env.WORCA_CLONE_ALLOW), { host, owner, repo })) {
+    throw new CloneError('not-allowed', `${host}/${owner}/${repo} is not in WORCA_CLONE_ALLOW`);
+  }
+  if (branch != null && branch !== '' && (typeof branch !== 'string' || !BRANCH_RE.test(branch.trim()))) {
+    throw new CloneError('invalid', 'not a valid branch name');
+  }
+  const folder = name == null || name === '' ? repo : String(name).trim();
+  if (!NAME_RE.test(folder) || folder === '.' || folder === '..') {
+    throw new CloneError('invalid', 'the folder name may use letters, digits, ".", "_" and "-" (up to 100)');
+  }
+  if (!projectsRoot) throw new CloneError('invalid', 'no projects folder is configured');
+  const root = resolve(projectsRoot);
+  const dir = join(root, folder);
+  if (!dir.startsWith(root + sep)) throw new CloneError('invalid', 'the folder must be directly under the projects folder');
+  if (exists(dir)) throw new CloneError('exists', `${dir} already exists; pick another folder name`);
+  return {
+    url: `https://${host}/${owner}/${repo}.git`, host, owner, repo, name: folder, dir,
+    branch: branch ? branch.trim() : null,
+  };
+}
+
+function classify(stderr) {
+  const s = String(stderr || '');
+  if (/Authentication failed|could not read Username|terminal prompts disabled|403/i.test(s)) {
+    return new CloneError('auth-failed', 'GitHub refused the credential: check the token or that the App is installed on this repository');
+  }
+  if (/Remote branch .* not found/i.test(s)) return new CloneError('not-found', 'that branch does not exist');
+  if (/Repository not found|not found|404/i.test(s)) {
+    return new CloneError('not-found', 'repository not found, or the credential cannot see it');
+  }
+  const last = s.trim().split('\n').filter(Boolean).pop() || 'git clone failed';
+  return new CloneError('failed', last.replace(/https:\/\/[^@\s]+@/g, 'https://'));
+}
+
+/** Run `git clone` for a plan. Resolves the plan; rejects with CloneError after removing the folder. */
+export async function runClone(plan, { timeoutMs = CLONE_TIMEOUT_MS, credential = githubEnv, spawnImpl = spawn } = {}) {
+  // GitHub gets the read credential for this one command; any other host gets no GitHub credential.
+  const cred = plan.host === 'github.com'
+    ? await credential('read', { repo: `${plan.owner}/${plan.repo}` })
+    : { env: stripGithubCredentials(process.env), error: null };
+  if (cred.error) throw new CloneError('auth-failed', cred.error);
+  const args = ['clone', '--filter=blob:none', ...(plan.branch ? ['--branch', plan.branch] : []), '--', plan.url, plan.dir];
+  const env = { ...cred.env, GIT_TERMINAL_PROMPT: '0', GIT_ASKPASS: '', SSH_ASKPASS: '', LC_ALL: 'C' };
+  const { code, stderr, timedOut } = await new Promise((done) => {
+    let err = '';
+    let child;
+    try { child = spawnImpl('git', args, { env, stdio: ['ignore', 'ignore', 'pipe'] }); }
+    catch (e) { done({ code: -1, stderr: e.message, timedOut: false }); return; }
+    const timer = setTimeout(() => { try { child.kill('SIGKILL'); } catch { /* gone */ } done({ code: -1, stderr: err, timedOut: true }); }, timeoutMs);
+    child.stderr?.on('data', (b) => { if (err.length < 64_000) err += b.toString(); });
+    child.on('error', (e) => { clearTimeout(timer); done({ code: -1, stderr: err || e.message, timedOut: false }); });
+    child.on('close', (c) => { clearTimeout(timer); done({ code: c ?? -1, stderr: err, timedOut: false }); });
+  });
+  if (code === 0) return plan;
+  await rm(plan.dir, { recursive: true, force: true }).catch(() => {});
+  if (timedOut) throw new CloneError('timeout', `the clone took longer than ${Math.round(timeoutMs / 60_000)} minutes`);
+  throw classify(stderr);
+}
+
+/**
+ * Plan, clone, register: the one path the API, the CLI and Ask Worca's card share. The
+ * project name (= folder name) is checked against registered projects BEFORE cloning, so
+ * a clash never leaves a stray folder. Resolves { project, plan }; rejects with CloneError.
+ */
+export async function cloneProject(req, { projectsRoot, env = process.env, listProjects, addProject, run = runClone } = {}) {
+  const plan = planClone(req, { projectsRoot, env });
+  const existing = await listProjects();
+  if (existing.some((p) => p && typeof p.name === 'string' && p.name.toLowerCase() === plan.name.toLowerCase())) {
+    throw new CloneError('exists', `a project named "${plan.name}" already exists; pick another folder name`);
+  }
+  await run(plan);
+  try {
+    const projects = await addProject({ name: plan.name, path: plan.dir });
+    return { project: projects.find((p) => p.path === plan.dir) || { name: plan.name, path: plan.dir }, plan };
+  } catch (e) {
+    await rm(plan.dir, { recursive: true, force: true }).catch(() => {});
+    throw new CloneError('failed', e.message);
+  }
+}

package/src/core/config.mjs

@@ -16,7 +16,7 @@ import { getDb, prepare, tx } from './db.mjs';
 import { projectKey } from './store.mjs';
 import { AUTO_WORKFLOW_ID } from './graph/builtin-workflows.mjs';
 import { loadAgentRegistry, registryToSteps } from './agent-registry.mjs';
-import { EFFORTS, prepareModelEnv, withTierModelEnv, isSubagentModelValue, subagentModelIssue, BRIDGE_ROUTING_KEYS, bridgeExcludedTools } from './model-env.mjs';
+import { EFFORTS, prepareModelEnv, withTierModelEnv, withProviderModesOff, PROVIDER_MODE_ENV_KEYS, isSubagentModelValue, subagentModelIssue, BRIDGE_ROUTING_KEYS, bridgeExcludedTools, isTranslatedApi } from './model-env.mjs';
 import { findBridgedEntry, providerReadiness } from './bridge/registry.mjs';
 import { bridgeBaseUrl, bridgeSecret } from './bridge/server.mjs';
 import { listGlobalModels, addGlobalModel, removeGlobalModel, hideBuiltinModels, readSettings, memoryDefragModel, setMemoryDefragModel } from './settings.mjs';
@@ -70,11 +70,13 @@ export { EFFORTS };
  * stored pin on the retired id to the successor, so nothing keeps it here. Opus 5.5
  * (`claude-opus-5-5`) and Sonnet 5 (`claude-sonnet-5`) are likewise 1M-only and
  * carry no `[1m]` twin. Opus 5.5 replaced Opus 5 (`claude-opus-5`) on 2026-09-22
- * (verified to resolve via `claude --model`, CLI 2.1.280); db.mjs V35 moves the
- * stored pins the same way.
+ * (verified to resolve via `claude --model`, CLI 2.1.280); db.mjs V35 moved the
+ * stored pins the same way. Opus 5 came back beside it on 2026-09-23 so both can
+ * be picked; V35 is shipped and stays, so pins it already moved stay on Opus 5.5.
  */
 export const PREDEFINED_MODELS = [
   { id: 'claude-opus-5-5',        label: 'Opus 5.5',        efforts: ['medium', 'high', 'xhigh', 'max'] },
+  { id: 'claude-opus-5',          label: 'Opus 5',          efforts: ['medium', 'high', 'xhigh', 'max'] },
   { id: 'claude-fable-5-1',       label: 'Fable 5.1 (1M)',  efforts: ['medium', 'high', 'xhigh', 'max'] },
   { id: 'claude-opus-4-8',        label: 'Opus 4.8',        efforts: ['medium', 'high', 'xhigh', 'max'] },
   { id: 'claude-opus-4-8[1m]',    label: 'Opus 4.8 (1M)',   efforts: ['medium', 'high', 'xhigh', 'max'] },
@@ -291,7 +293,7 @@ export function modelHasBaseUrlRouting(modelId) {
  * The bridge facts for a model id (model-bridge-design.md §4.2/§8.5), or null
  * when it is not a bridged entry: `{id, provider, api, upstreamModel,
  * excludeTools, ready, reason?, message?}`. `excludeTools` are the CLI built-ins
- * the runner must withhold (web tools have no chat/completions equivalent);
+ * the runner must withhold (web tools have no chat/completions or Responses API equivalent);
  * `ready` is the provider's sign-in state — a spawn fails fast on it instead
  * of with an opaque 401 mid-run. Synchronous; never throws.
  */
@@ -498,6 +500,7 @@ export function resolveModelCost(modelId, cliCostUsd, usage, costCfg = undefined
 export const PREDEFINED_LIST_PRICES = Object.freeze({
   'claude-fable-5-1':  { input: 10, output: 50, cacheRead: 0.25, cacheWrite: 12.5, cacheWrite1h: 20 },
   'claude-opus-5-5':   { input: 4,  output: 20, cacheRead: 0.2,  cacheWrite: 5,    cacheWrite1h: 8 },
+  'claude-opus-5':     { input: 5,  output: 25, cacheRead: 0.5,  cacheWrite: 6.25, cacheWrite1h: 10 },
   'claude-opus-4-8':   { input: 5,  output: 25, cacheRead: 0.5,  cacheWrite: 6.25, cacheWrite1h: 10 },
   'claude-opus-4-7':   { input: 5,  output: 25, cacheRead: 0.5,  cacheWrite: 6.25, cacheWrite1h: 10 },
   'claude-opus-4-6':   { input: 5,  output: 25, cacheRead: 0.5,  cacheWrite: 6.25, cacheWrite1h: 10 },
@@ -582,7 +585,9 @@ export function resolveModelEnv(modelId, { tag } = {}) {
     for (const k of dropped) {
       console.warn(`[worca] model ${JSON.stringify(bridged.id)}: dropping env key ${JSON.stringify(k)} (reserved or unresolvable \${VAR} ref)`);
     }
-    for (const k of BRIDGE_ROUTING_KEYS) delete extra[k];
+    // The bridge owns the CLI's transport too: an entry-level cloud switch would
+    // send the CLI past the loopback bridge, so it is dropped and forced off below.
+    for (const k of [...BRIDGE_ROUTING_KEYS, ...PROVIDER_MODE_ENV_KEYS]) delete extra[k];
     const env = {
       ...extra,
       ANTHROPIC_BASE_URL: bridgeBaseUrl(bridged.id, { tag }),
@@ -595,7 +600,7 @@ export function resolveModelEnv(modelId, { tag } = {}) {
     // fails its first call). Its ToolSearch is client-side (schemas come back
     // as tool_result text), so it works through the translation layer; the
     // entry's own env may still turn it off.
-    if (bridged.upstream.api === 'openai-chat' && !('ENABLE_TOOL_SEARCH' in env)) env.ENABLE_TOOL_SEARCH = 'true';
+    if (isTranslatedApi(bridged.upstream.api) && !('ENABLE_TOOL_SEARCH' in env)) env.ENABLE_TOOL_SEARCH = 'true';
     // A bridged id is never a model name the CLI knows, so it assumes a 200k
     // window and compacts only once the upstream rejects a request — on a 32k
     // local model that means turns whose reply is cut to a few hundred tokens
@@ -603,7 +608,7 @@ export function resolveModelEnv(modelId, { tag } = {}) {
     const caps = bridged.upstream.capabilities || {};
     if (caps.maxPromptTokens && !('CLAUDE_CODE_MAX_CONTEXT_TOKENS' in env)) env.CLAUDE_CODE_MAX_CONTEXT_TOKENS = String(caps.maxPromptTokens);
     if (caps.maxOutputTokens && !('CLAUDE_CODE_MAX_OUTPUT_TOKENS' in env)) env.CLAUDE_CODE_MAX_OUTPUT_TOKENS = String(caps.maxOutputTokens);
-    return withTierModelEnv(env, bridged.id);
+    return withProviderModesOff(withTierModelEnv(env, bridged.id));
   }
   if (entry && entry.env) {
     rawEnv = entry.env;
@@ -639,8 +644,10 @@ export function resolveModelEnv(modelId, { tag } = {}) {
   // Endpoint-routed entries also carry the CLI's internal tier keys, pointed at
   // this entry's own wire id (#422, model-env.mjs#withTierModelEnv) — so the
   // CLI's session-title / alias / probe calls never fall back to a first-party
-  // id the endpoint has never heard of. Keys the entry sets itself win.
-  return withTierModelEnv(env, canonicalId);
+  // id the endpoint has never heard of. They also turn the CLI's cloud
+  // transports off (withProviderModesOff), which would bypass the base URL.
+  // Keys the entry sets itself win.
+  return withProviderModesOff(withTierModelEnv(env, canonicalId));
 }
 
 /**

package/src/core/db.mjs

@@ -55,7 +55,7 @@ const OPEN_BACKOFF_MS = 15;
 /** Latest schema version. Bump + append a new migration step when the DDL grows.
  *  Exported so migration tests assert "reached the module's current version"
  *  instead of hardcoding the number — a schema bump then touches no test file. */
-export const SCHEMA_VERSION = 35;
+export const SCHEMA_VERSION = 39;
 
 /** Absolute path to the database file: <worcaHome>/worca-cc.db. */
 export function dbPath() {
@@ -834,7 +834,8 @@ const INCREMENTAL_COLUMNS = {
                             outcome: 'TEXT',
                             scheduled_for: 'TEXT', schedule_id: 'TEXT',   // v31: scheduled-run provenance (NULL = started by hand)
                             policy_state: 'TEXT',     // v32: team-policy run state (JSON: home, sha, overrides, exceeded, deviations, reason)
-                            human_hours: 'REAL NOT NULL DEFAULT 0' },   // v33: Σ pipeline_steps.human_hours (money-saved design §6)
+                            human_hours: 'REAL NOT NULL DEFAULT 0',     // v33: Σ pipeline_steps.human_hours (money-saved design §6)
+                            started_by: 'TEXT' },   // v36: who started the run (identity.mjs; NULL = before attribution)
   pipeline_steps:         { session_id: 'TEXT', skills: 'TEXT', graphify_count: 'INTEGER',
                             execution_id: 'TEXT', exec_kind: 'TEXT', agent_key: 'TEXT', ended_at: 'TEXT',
                             exec_trigger: 'TEXT', exec_result: 'TEXT', exec_meta: 'TEXT',
@@ -848,12 +849,17 @@ const INCREMENTAL_COLUMNS = {
   ask_attachments:        { kind: "TEXT NOT NULL DEFAULT 'text'",  // v27: text | image | binary (#398)
                             mime: 'TEXT' },               // v27: sniffed mime; NULL on pre-v27 rows (= text)
   project_config:         { human_in_loop: 'INTEGER NOT NULL DEFAULT 1' },   // v28: the Auto entry's human-in-the-loop switch
-  diff_comments:          { parent_id: 'TEXT REFERENCES diff_comments(id) ON DELETE CASCADE' },  // v29: reply threads; NULL = thread root
+  diff_comments:          { parent_id: 'TEXT REFERENCES diff_comments(id) ON DELETE CASCADE',  // v29: reply threads; NULL = thread root
+                            author_name: 'TEXT' },   // v37: who wrote it (identity.mjs actor); NULL = before attribution / Ask
+  ask_threads:            { created_by: 'TEXT' },    // v37: the thread's owner (identity.mjs actor); NULL = ownerless (legacy)
+  pipeline_events:        { actor: 'TEXT' },         // v38: who did it (identity.mjs actor); NULL = the run itself / before attribution
   workspaces:             { metrics_project: 'TEXT',    // v30: team-metrics home (member absolute path); NULL = no home
                             policy_project: 'TEXT' },   // v32: team-policy home (member absolute path); NULL = no home
-  schedules:              { ask_thread_id: 'TEXT', ask_card_id: 'TEXT' },  // v31: the Ask Worca card a series came from
+  schedules:              { ask_thread_id: 'TEXT', ask_card_id: 'TEXT',   // v31: the Ask Worca card a series came from
+                            created_by: 'TEXT', updated_by: 'TEXT' },   // v39: who made / last changed it (identity.mjs actor)
   scheduled_runs:         { after_kind: 'TEXT', after_id: 'TEXT', after_policy: "TEXT NOT NULL DEFAULT 'done'",
-                            source_from_previous: 'INTEGER NOT NULL DEFAULT 0' },   // v34: run chains
+                            source_from_previous: 'INTEGER NOT NULL DEFAULT 0',   // v34: run chains
+                            created_by: 'TEXT', updated_by: 'TEXT' },   // v39: who made / last changed it
 };
 
 /** v23: per-loop-wire cycle budgets, the graph-engine twin of
@@ -879,6 +885,17 @@ CREATE TABLE IF NOT EXISTS config_workflow_wires (
  * several tables (ASK_DDL, DIFF_COMMENTS_DDL) is listed under EACH of them, so a
  * DB missing only one is healed; repairSchemaGaps de-duplicates at exec time.
  */
+/** v37: per-person read state of notifications, used only on a shared deployment (a real
+ *  per-person sign-in, identity.mjs#isSharedIdentity); local installs keep notifications.read_at. */
+const NOTIFICATION_READS_DDL = `
+CREATE TABLE IF NOT EXISTS notification_reads (
+  notification_id INTEGER NOT NULL,
+  reader          TEXT NOT NULL,
+  read_at         TEXT NOT NULL,
+  PRIMARY KEY (notification_id, reader)
+);
+`;
+
 const INCREMENTAL_TABLES = {
   config_workflow_wires: CONFIG_WORKFLOW_WIRES_DDL,
   step_questions:    STEP_QUESTIONS_DDL,
@@ -897,6 +914,7 @@ const INCREMENTAL_TABLES = {
   schedules:         SCHEDULED_RUNS_DDL,
   scheduled_runs:    SCHEDULED_RUNS_DDL,
   notifications:     SCHEDULED_RUNS_DDL,
+  notification_reads: NOTIFICATION_READS_DDL,
 };
 
 /**
@@ -1306,6 +1324,39 @@ function applySchemaV35(db) {
   for (const [from, to] of V35_MODEL_RENAMES) renameStoredModelPins(db, from, to);
 }
 
+/** v36 (attribution): pipelines.started_by, a plain additive column declared in
+ *  INCREMENTAL_COLUMNS, applySchemaV30's shape. NULL on every existing row = started
+ *  before attribution existed. */
+function applySchemaV36(db) {
+  repairSchemaGaps(db, schemaGaps(db));
+}
+
+/** v37 (attribution, step 1): diff_comments.author_name, ask_threads.created_by
+ *  (INCREMENTAL_COLUMNS) and notification_reads (INCREMENTAL_TABLES), applySchemaV30's
+ *  shape. NULL / no rows everywhere existing = before attribution. */
+function applySchemaV37(db) {
+  repairSchemaGaps(db, schemaGaps(db));
+}
+
+/** v38 (attribution, step 3): pipeline_events.actor — who did a human action on a run
+ *  (INCREMENTAL_COLUMNS), applySchemaV30's shape. NULL on every existing row. */
+function applySchemaV38(db) {
+  repairSchemaGaps(db, schemaGaps(db));
+}
+
+/** v39 (attribution): schedules/scheduled_runs created_by + updated_by (INCREMENTAL_COLUMNS, the v36
+ *  shape), then a backfill: a series or ticket whose stored request carries internal.startedBy (who
+ *  scheduled it, recorded since attribution) gets that as created_by. Fenced like v33's backfill. */
+function applySchemaV39(db) {
+  repairSchemaGaps(db, schemaGaps(db));
+  for (const t of ['schedules', 'scheduled_runs']) {
+    try {
+      db.exec(`UPDATE ${t} SET created_by = json_extract(request, '$.internal.startedBy')
+        WHERE created_by IS NULL AND json_valid(request) AND json_type(request, '$.internal.startedBy') = 'text'`);
+    } catch { /* a hand-seeded table without request/JSON1: attribution is decoration */ }
+  }
+}
+
 /** Move every stored pin on model id `from` (lower-case) to `to`. Each table
  *  is guarded like V24's: hand-seeded upgrade fixtures (and a DB from before the
  *  fs->db import) reach this step without some of them. */
@@ -1697,6 +1748,10 @@ export function migrate(db) {
     if (current < 33) applySchemaV33(db);            // money saved: human_hours columns
     if (current < 34) applySchemaV34(db);            // run chains: scheduled_runs.after_* + source_from_previous
     if (current < 35) applySchemaV35(db);            // Opus 5 pins -> Opus 5.5 (catalog swap)
+    if (current < 36) applySchemaV36(db);            // attribution: pipelines.started_by
+    if (current < 37) applySchemaV37(db);            // attribution: comment authors, thread owners, per-person reads
+    if (current < 38) applySchemaV38(db);            // attribution: who did each human action on a run
+    if (current < 39) applySchemaV39(db);            // attribution: schedules/tickets created_by + updated_by
     db.exec(`PRAGMA user_version = ${SCHEMA_VERSION}`);
     db.exec('COMMIT');
   } catch (err) {

package/src/core/deployment.mjs

@@ -0,0 +1,33 @@
+// How this worca runs, for Ask Worca's context and rules (docs/deploy-railway.md).
+//
+//   local      a desktop install: the default, and what nothing else says otherwise
+//   container  the worca image (WORCA_CONTAINER=1 from docker/Dockerfile, or
+//              WORCA_DATA_DIR from a single-volume host) without remote access
+//   hosted     remote access is on (WORCA_ALLOWED_HOSTS names a public host):
+//              people reach it through an identity proxy, not from this machine
+//
+// Pure: reads only `env` and the remote-mode flag the server already computed.
+import { readGithubCredentials } from './github-credentials.mjs';
+
+const on = (v) => /^(1|true|yes|on)$/i.test(String(v || '').trim());
+
+/** 'local' | 'container' | 'hosted'. */
+export function detectDeployment(env = process.env, { remoteMode = false } = {}) {
+  if (remoteMode) return 'hosted';
+  if (on(env.WORCA_CONTAINER) || String(env.WORCA_DATA_DIR || '').trim()) return 'container';
+  return 'local';
+}
+
+/** Which GitHub credential worca holds: 'none' | 'single' | 'split' (src/core/github-credentials.mjs).
+ *  Names the mode only; never the token. */
+export function githubMode(env = process.env) {
+  return readGithubCredentials(env).mode;
+}
+
+/** The facts Ask Worca's context header shows about this deployment, or null for a
+ *  local install (whose header stays exactly as before). */
+export function deploymentFacts(env = process.env, { remoteMode = false, projectsRoot = null } = {}) {
+  const deployment = detectDeployment(env, { remoteMode });
+  if (deployment === 'local') return null;
+  return { deployment, projectsRoot: projectsRoot || null, github: githubMode(env) };
+}

package/src/core/diff-comments.mjs

@@ -28,12 +28,21 @@ export class DiffCommentError extends Error {
   constructor(message) { super(message); this.name = 'DiffCommentError'; }
 }
 
+/** A person's name on a 'user' comment only (one line, bounded); Ask comments carry none. */
+function authorNameOf(author, name) {
+  if (author !== 'user' || typeof name !== 'string') return null;
+  const t = name.trim();
+  return t && t.length <= 200 && !/[\u0000-\u001f\u007f-\u009f\u2028\u2029]/.test(t) ? t : null;
+}
+
 function rowToComment(r) {
   return {
     id: r.id, storeKey: r.store_key, pipelineId: r.pipeline_id,
     projectKey: r.project_key ?? null, path: r.path, oldPath: r.old_path ?? null,
     side: r.side, line: r.line_no, lineText: r.line_text ?? '',
     body: r.body, author: r.author,
+    // Who wrote it (identity.mjs actor) for a 'user' comment; null for Ask and pre-v37 rows.
+    authorName: r.author_name ?? null,
     resolved: !!r.resolved, resolvedAt: r.resolved_at ?? null,
     sentRunId: r.sent_run_id ?? null, createdAt: r.created_at,
     parentId: r.parent_id ?? null,
@@ -128,7 +137,7 @@ function cleanBody(body) {
  *   have one error type to map onto 400 / tool-error.
  */
 export function addDiffComment({
-  storeKey, pipelineId, patchText, project = null, path, side, line, body, author,
+  storeKey, pipelineId, patchText, project = null, path, side, line, body, author, authorName = null,
 } = {}) {
   if (patchText == null || String(patchText) === '') {
     throw new DiffCommentError('this run has no stored diff — comments cannot be created on it');
@@ -148,10 +157,10 @@ export function addDiffComment({
   getDb();
   prepare(`INSERT INTO diff_comments
     (id, store_key, pipeline_id, project_key, path, old_path, side, line_no, line_text,
-     body, author, resolved, resolved_at, sent_run_id, source, external_url, created_at)
-    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 0, NULL, NULL, NULL, NULL, ?)`)
+     body, author, resolved, resolved_at, sent_run_id, source, external_url, created_at, author_name)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 0, NULL, NULL, NULL, NULL, ?, ?)`)
     .run(id, String(storeKey), String(pipelineId), anchor.project, anchor.path, anchor.oldPath,
-      anchor.side, anchor.line, anchor.lineText, text, author, ts);
+      anchor.side, anchor.line, anchor.lineText, text, author, ts, authorNameOf(author, authorName));
   notify(String(storeKey), String(pipelineId));
   return getDiffComment(id);
 }
@@ -166,7 +175,7 @@ export function addDiffComment({
  * archiving deletes a run's comments, pipeline-delete.mjs.)
  * @throws {DiffCommentError}
  */
-export function addDiffCommentReply({ parentId, body, author } = {}) {
+export function addDiffCommentReply({ parentId, body, author, authorName = null } = {}) {
   const parent = getDiffComment(parentId);
   if (!parent) throw new DiffCommentError('comment not found');
   if (parent.parentId) throw new DiffCommentError('replies cannot be nested — reply to the thread\'s first comment');
@@ -177,11 +186,11 @@ export function addDiffCommentReply({ parentId, body, author } = {}) {
   getDb();
   prepare(`INSERT INTO diff_comments
     (id, store_key, pipeline_id, project_key, path, old_path, side, line_no, line_text,
-     body, author, resolved, resolved_at, sent_run_id, source, external_url, created_at, parent_id)
-    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, NULL, NULL, NULL, ?, ?)`)
+     body, author, resolved, resolved_at, sent_run_id, source, external_url, created_at, parent_id, author_name)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, NULL, NULL, NULL, ?, ?, ?)`)
     .run(id, parent.storeKey, parent.pipelineId, parent.projectKey, parent.path, parent.oldPath,
       parent.side, parent.line, parent.lineText, text, author,
-      parent.resolved ? 1 : 0, parent.resolvedAt, ts, parent.id);
+      parent.resolved ? 1 : 0, parent.resolvedAt, ts, parent.id, authorNameOf(author, authorName));
   notify(parent.storeKey, parent.pipelineId);
   return getDiffComment(id);
 }

package/src/core/git-info.mjs

@@ -9,13 +9,14 @@ import { spawn } from 'node:child_process';
 import { mkdtemp, writeFile, rm } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
+import { githubEnv, readGithubCredentials } from './github-credentials.mjs';
 
 /** Default runner: spawn `cmd args` in `cwd`, resolve { ok, stdout, stderr, code }. */
-function defaultRun(cmd, args, { cwd, timeout = 0 } = {}) {
+function defaultRun(cmd, args, { cwd, timeout = 0, env = null } = {}) {
   return new Promise((resolve) => {
     let child;
     try {
-      child = spawn(cmd, args, { cwd, stdio: ['ignore', 'pipe', 'pipe'] });
+      child = spawn(cmd, args, { cwd, stdio: ['ignore', 'pipe', 'pipe'], ...(env ? { env } : {}) });
     } catch (err) {
       resolve({ ok: false, stdout: '', stderr: err.message, code: -1 });
       return;
@@ -160,9 +161,26 @@ export async function hasGh() {
   return _ghCache;
 }
 
+/** "owner/name" of `remote` on github.com in App mode (helps the App find its installation), else null. */
+async function githubRepoOf(projectDir, remote) {
+  if (readGithubCredentials().mode !== 'app') return null;
+  const r = await _run('git', ['remote', 'get-url', remote], { cwd: projectDir });
+  const p = r.ok ? parseRemoteUrl(r.stdout.trim()) : null;
+  return p && p.host === 'github.com' ? `${p.owner}/${p.repo}` : null;
+}
+
+/** "owner/name" of a github.com PR URL, or null. */
+const ownerRepoOfPrUrl = (url) => { const m = /^https:\/\/github\.com\/([^/]+\/[^/]+)\/pull\/\d+/.exec(String(url || '')); return m ? m[1] : null; };
+
+/** "owner/name" from gh's `[HOST/]OWNER/REPO`, or null. */
+const ownerRepo = (repo) => (repo ? String(repo).split('/').slice(-2).join('/') : null);
+
 /** Push the branch to `remote` (default origin) and set upstream. Idempotent; surfaces stderr. */
 export async function pushBranch(projectDir, branch, remote = 'origin') {
-  const r = await _run('git', ['push', '-u', remote || 'origin', branch], { cwd: projectDir });
+  const r0 = remote || 'origin';
+  const cred = await githubEnv('write', { repo: await githubRepoOf(projectDir, r0) });
+  if (cred.error) return { ok: false, stderr: cred.error };
+  const r = await _run('git', ['push', '-u', r0, branch], { cwd: projectDir, env: cred.env });
   return { ok: r.ok, stderr: (r.stderr || '').trim() };
 }
 
@@ -182,14 +200,16 @@ export async function createPr({ projectDir, base, head, title, body = '', repo
   const repoArgs = repo ? ['--repo', repo] : [];
   const args = ['pr', 'create', ...repoArgs, '--base', base, '--head', headRef,
     '--title', title || head, '--body', body || title || head];
-  const r = await _run('gh', args, { cwd: projectDir });
+  const cred = await githubEnv('write', { repo: ownerRepo(repo) });
+  if (cred.error) return { ok: false, error: cred.error };
+  const r = await _run('gh', args, { cwd: projectDir, env: cred.env });
   if (r.ok) {
     // gh prints the PR URL as the last stdout line.
     const url = (r.stdout.trim().split(/\r?\n/).pop() || '').trim();
     return { ok: true, url, existed: false };
   }
   if (/already exists/i.test(r.stderr || '')) {
-    const v = await _run('gh', ['pr', 'view', headRef, ...repoArgs, '--json', 'url', '-q', '.url'], { cwd: projectDir });
+    const v = await _run('gh', ['pr', 'view', headRef, ...repoArgs, '--json', 'url', '-q', '.url'], { cwd: projectDir, env: (await githubEnv('read', { repo: ownerRepo(repo) })).env });
     if (v.ok && v.stdout.trim()) return { ok: true, url: v.stdout.trim(), existed: true };
     // gh's message ends with the existing PR's URL ("… already exists:\n<url>");
     // use it when the view selector cannot resolve (e.g. a PR opened from another fork).
@@ -285,7 +305,7 @@ export async function prMergeable({ projectDir, head, repo = null, headOwner = n
   const selector = prUrl || (head ? prHeadRef(head, headOwner) : '');
   if (!selector) return 'UNKNOWN';
   const repoArgs = !prUrl && repo ? ['--repo', repo] : [];
-  const r = await _run('gh', ['pr', 'view', selector, ...repoArgs, '--json', 'mergeable', '-q', '.mergeable'], { cwd: projectDir });
+  const r = await _run('gh', ['pr', 'view', selector, ...repoArgs, '--json', 'mergeable', '-q', '.mergeable'], { cwd: projectDir, env: (await githubEnv('read', { repo: prUrl ? ownerRepoOfPrUrl(prUrl) : ownerRepo(repo) })).env });
   if (!r.ok) return 'UNKNOWN';
   return normalizeMergeable(r.stdout.trim());
 }
@@ -316,7 +336,7 @@ const normalizePr = (pr) => ({
 export async function findPrForBranch({ projectDir, head, prUrl = null } = {}) {
   if (!projectDir || !head) return null;
   if (prUrl) {
-    const v = await _run('gh', ['pr', 'view', prUrl, '--json', 'number,state,url'], { cwd: projectDir });
+    const v = await _run('gh', ['pr', 'view', prUrl, '--json', 'number,state,url'], { cwd: projectDir, env: (await githubEnv('read', { repo: ownerRepoOfPrUrl(prUrl) })).env });
     if (v.ok) {
       let obj = null;
       try { obj = JSON.parse(v.stdout || 'null'); } catch { obj = null; }