toolroll 0.5.0

package/dist/process-tree.js

@@ -0,0 +1,264 @@
+import { execFileSync } from "node:child_process";
+import { processMayBeAlive } from "./process-liveness.js";
+const observed = new Map();
+let timer = null;
+/** Read identifiers only: command lines can contain private provider inputs. */
+function snapshot() {
+    return execFileSync("/bin/ps", ["-axo", "pid=,ppid=,pgid="], { encoding: "utf8", timeout: 2000, maxBuffer: 4 * 1024 * 1024 })
+        .trim().split("\n").map(line => {
+        const [pid, parent, group] = line.trim().split(/\s+/).map(Number);
+        if (!pid || !Number.isSafeInteger(pid) || !Number.isSafeInteger(parent) || parent < 0 || !Number.isSafeInteger(group) || group < 0 || line.trim().split(/\s+/).length !== 3)
+            throw Object.assign(new Error("unreadable process ancestry"), { code: "MALFORMED_SNAPSHOT" });
+        return { pid, parent: parent, group: group };
+    });
+}
+function descendants(rows, root) {
+    const ids = new Set([root]);
+    const found = [];
+    for (let changed = true; changed;) {
+        changed = false;
+        for (const row of rows)
+            if (!ids.has(row.pid) && ids.has(row.parent)) {
+                ids.add(row.pid);
+                found.push(row);
+                changed = true;
+            }
+    }
+    return found;
+}
+function live(child) { return child.pid !== undefined && child.exitCode === null && child.signalCode === null; }
+function remember(child, rows, phase) {
+    const tracked = observed.get(child);
+    if (!tracked)
+        return;
+    // Keep the entire observed set before a persistence callback can throw.
+    const fresh = rows.map(row => ({ pid: row.pid, group: row.group === row.pid }))
+        .filter(row => !tracked.seen.has(`${row.pid}:${row.group}`));
+    for (let index = 0; index < fresh.length; index++) {
+        const row = fresh[index];
+        try {
+            tracked.observer.onDescendant?.(row.pid, row.group);
+        }
+        catch (error) {
+            // A stop must not signal from a snapshot made stale by waiting for a
+            // fallback write. Preserve its existing conservative failure path.
+            if (phase === "stop")
+                throw error;
+            const remaining = fresh.slice(index);
+            let preserved = false;
+            try {
+                preserved = tracked.observer.onDescendantWriteFailure?.(remaining) === true;
+            }
+            catch { /* The unknown safeguard remains. */ }
+            if (!preserved)
+                throw error;
+            for (const one of remaining)
+                tracked.seen.set(`${one.pid}:${one.group}`, one);
+            failed(child, phase, "descendant-write", error, true);
+            return;
+        }
+        tracked.seen.set(`${row.pid}:${row.group}`, row);
+    }
+}
+function recordExits(child, rows) {
+    const tracked = observed.get(child);
+    if (!tracked)
+        return;
+    const pids = new Set(rows.map(row => row.pid)), groups = new Set(rows.map(row => row.group));
+    for (const [key, prior] of tracked.seen) {
+        if (pids.has(prior.pid) || (prior.group && groups.has(prior.pid)))
+            continue;
+        // A missing ancestry edge proves nothing. Require both the complete
+        // system snapshot and an ESRCH-only probe; no birth inference or signal.
+        if (processMayBeAlive(prior.pid, prior.group))
+            continue;
+        tracked.observer.onDescendantExit?.(prior.pid, prior.group);
+        tracked.seen.delete(key); // The same number can later identify a NEW child.
+    }
+}
+// Only fixed error codes survive; error messages/output can contain private data.
+const observationCodes = new Set(["EAGAIN", "EMFILE", "ENFILE", "ETIMEDOUT", "ENOBUFS", "ENOENT", "EPERM", "EACCES", "EIO", "ESRCH", "MALFORMED_SNAPSHOT", "SUPERVISOR_DIAGNOSTIC", "SQLITE_BUSY", "SQLITE_LOCKED", "SQLITE_READONLY", "SQLITE_IOERR", "SQLITE_CORRUPT", "SQLITE_FULL", "SQLITE_CONSTRAINT"]);
+/** Private supervisor pipe input. Keep only validated identifier diagnostics. */
+export function readProcessObservationFailure(value) {
+    if (typeof value !== "object" || value === null)
+        return null;
+    const row = value;
+    const { phase, operation, code, rootPid, at, identityUnknown } = row;
+    if (!["sample", "periodic", "final-exit", "stop", "supervisor"].includes(String(phase)) || !["snapshot", "descendant-write", "exit-write", "signal", "diagnostic-read"].includes(String(operation)) || typeof code !== "string" || (code !== "UNKNOWN" && !observationCodes.has(code)) || (rootPid !== null && (!Number.isSafeInteger(rootPid) || Number(rootPid) <= 0)) || typeof at !== "string" || !Number.isFinite(Date.parse(at)) || new Date(at).toISOString() !== at || typeof identityUnknown !== "boolean")
+        return null;
+    return { phase: phase, operation: operation, code, rootPid: rootPid, at, identityUnknown };
+}
+function failed(child, phase, operation, error, identitiesPreserved = false) {
+    const tracked = observed.get(child);
+    if (!tracked)
+        return;
+    const rawCode = typeof error === "object" && error !== null && "code" in error ? error.code : undefined;
+    const sqliteCodes = { 5: "SQLITE_BUSY", 6: "SQLITE_LOCKED", 8: "SQLITE_READONLY", 10: "SQLITE_IOERR", 11: "SQLITE_CORRUPT", 13: "SQLITE_FULL", 19: "SQLITE_CONSTRAINT" };
+    const sqlite = typeof error === "object" && error !== null && "errcode" in error && Number.isSafeInteger(error.errcode)
+        ? sqliteCodes[Number(error.errcode) & 0xff] : undefined;
+    const code = sqlite ?? (typeof rawCode === "string" && observationCodes.has(rawCode) ? rawCode : "UNKNOWN");
+    // Exit-only checks retire already-durable identities; they discover no
+    // children. Any failure leaves those witnesses intact for later OS probes.
+    // Discovery and descendant persistence failures can lose an identity.
+    const identityUnknown = !identitiesPreserved && phase !== "final-exit" && operation !== "exit-write";
+    const key = `${phase}:${operation}:${code}:${identityUnknown}`;
+    if (!tracked.failures.has(key)) {
+        try {
+            tracked.observer.onObservationFailure?.({ phase, operation, code, rootPid: child.pid ?? null, at: new Date().toISOString(), identityUnknown });
+            tracked.failures.add(key);
+        }
+        catch { /* No diagnostic, but no witness was retired by this callback. */ }
+    }
+    if (identityUnknown) {
+        // A failed persistence callback never becomes an uncaught timer error or
+        // permission to release custody. The existing unknown road stays closed.
+        try {
+            tracked.observer.onUnknown?.();
+        }
+        catch { }
+    }
+}
+function observeRows(child, rows, phase) {
+    try {
+        recordExits(child, rows);
+    }
+    catch (error) {
+        failed(child, phase, "exit-write", error);
+    }
+    try {
+        remember(child, descendants(rows, child.pid), phase);
+    }
+    catch (error) {
+        failed(child, phase, "descendant-write", error);
+    }
+}
+/** Capture current descendants before asking an owned process to exit.
+ * A cooperative root may exit before the next periodic observation; even
+ * a killed tool can retain its PID briefly after its process group is gone. */
+export function sampleProcessTree(child) {
+    if (!live(child) || !observed.has(child))
+        return;
+    let rows;
+    try {
+        rows = snapshot();
+    }
+    catch (error) {
+        failed(child, "sample", "snapshot", error);
+        return;
+    }
+    observeRows(child, rows, "sample");
+}
+/** Observe escaped process groups while their ancestry is still provable.
+ * Durable witnesses prevent recovery from mistaking a dead harness for a dead
+ * shell. They never grant permission to send a signal after worker recovery. */
+export function observeProcessTree(child, observer) {
+    if (process.platform === "win32" || observer.onDescendant === undefined)
+        return;
+    observed.set(child, { observer, seen: new Map(), failures: new Set() });
+    child.once("close", () => {
+        if (observed.get(child)?.seen.size) {
+            let rows = null;
+            try {
+                rows = snapshot();
+            }
+            catch (error) {
+                failed(child, "final-exit", "snapshot", error);
+            }
+            if (rows !== null) {
+                try {
+                    recordExits(child, rows);
+                }
+                catch (error) {
+                    failed(child, "final-exit", "exit-write", error);
+                }
+            }
+        }
+        observed.delete(child);
+        if (observed.size === 0 && timer !== null) {
+            clearInterval(timer);
+            timer = null;
+        }
+    });
+    if (timer !== null)
+        return;
+    timer = setInterval(() => {
+        let rows;
+        try {
+            rows = snapshot();
+        }
+        catch (error) {
+            for (const [one] of observed)
+                if (live(one))
+                    failed(one, "periodic", "snapshot", error);
+            return;
+        }
+        for (const [one] of observed)
+            if (live(one))
+                observeRows(one, rows, "periodic");
+    }, 500);
+    timer.unref();
+}
+/** Freeze the owned handle, then its live descendants before killing them.
+ * Claude's tool shells create new process groups, so killing only -rootPid
+ * leaves writers behind. Re-scan after freezing parents to catch a child born
+ * during the previous scan. Every target comes from current ancestry of the
+ * still-owned handle, never from a saved PID. Unknown ancestry stays blocked. */
+export function stopProcessTree(child) {
+    if (process.platform === "win32" || !live(child))
+        return false;
+    const stopped = new Set();
+    let operation = "signal";
+    try {
+        if (!child.kill("SIGSTOP"))
+            return false;
+        for (let pass = 0; pass < 8; pass++) {
+            operation = "snapshot";
+            const rows = descendants(snapshot(), child.pid);
+            operation = "descendant-write";
+            remember(child, rows, "stop");
+            operation = "signal";
+            const fresh = rows.filter(row => !stopped.has(row.pid));
+            if (fresh.length === 0) {
+                // Parents are frozen, so none can fork between this seal and kill.
+                for (const row of rows.reverse()) {
+                    try {
+                        process.kill(row.pid, "SIGKILL");
+                    }
+                    catch (error) {
+                        if (error.code !== "ESRCH")
+                            throw error;
+                    }
+                }
+                child.kill("SIGKILL");
+                return true;
+            }
+            for (const row of fresh) {
+                try {
+                    process.kill(row.pid, "SIGSTOP");
+                    stopped.add(row.pid);
+                }
+                catch (error) {
+                    if (error.code !== "ESRCH")
+                        throw error;
+                }
+            }
+        }
+        throw new Error("process ancestry did not settle");
+    }
+    catch (error) {
+        failed(child, "stop", operation, error);
+        // Do not leave any process frozen after a failed observation. The caller
+        // can still stop its known group; unresolved custody prevents Resume.
+        for (const pid of stopped) {
+            try {
+                process.kill(pid, "SIGCONT");
+            }
+            catch { }
+        }
+        try {
+            child.kill("SIGCONT");
+        }
+        catch { }
+        return false;
+    }
+}

package/dist/project-access.d.ts

@@ -0,0 +1,14 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+/** null explicitly means instance access; [] grants no project access. */
+export type ProjectAccess = readonly string[] | null;
+export declare function normalizeProjectAccess(value: unknown): string[] | null;
+/** Corrupt or missing authority never falls back to instance access. */
+export declare function readProjectAccess(value: unknown): ProjectAccess;
+export declare function projectAccessAllows(access: ProjectAccess, repo: string | null): boolean;
+/** A server-proved resource, never an unchecked header or submitted path.
+ * CLI ceremonies must pass their resource explicitly; global ceremonies
+ * without a project refuse project-scoped credentials. */
+export declare const projectAuthority: AsyncLocalStorage<{
+    actor: string;
+    repo: string | null;
+}>;

package/dist/project-access.js

@@ -0,0 +1,34 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+import { isAbsolute, resolve } from "node:path";
+import { canonicalProject } from "./project.js";
+export function normalizeProjectAccess(value) {
+    if (value === null)
+        return null;
+    if (!Array.isArray(value) || value.length > 100 || value.some(path => typeof path !== "string" || !isAbsolute(path) || path.length > 4096 || /[\x00-\x1f\x7f]/.test(path))) {
+        throw new Error("Project access must name at most 100 absolute project paths.");
+    }
+    return [...new Set(value.map(path => canonicalProject(path) ?? resolve(path)))].sort();
+}
+/** Corrupt or missing authority never falls back to instance access. */
+export function readProjectAccess(value) {
+    if (value === null)
+        return null;
+    try {
+        const parsed = JSON.parse(String(value));
+        if (!Array.isArray(parsed) || parsed.length > 100 || parsed.some(path => typeof path !== "string" || !isAbsolute(path) || resolve(path) !== path || path.length > 4096 || /[\x00-\x1f\x7f]/.test(path)))
+            return [];
+        // Preserve the granted identity. Re-canonicalizing stored grants after
+        // a symlink changes would transfer access to its new target.
+        return parsed;
+    }
+    catch {
+        return [];
+    }
+}
+export function projectAccessAllows(access, repo) {
+    return access === null || (repo !== null && access.includes(canonicalProject(repo) ?? resolve(repo)));
+}
+/** A server-proved resource, never an unchecked header or submitted path.
+ * CLI ceremonies must pass their resource explicitly; global ceremonies
+ * without a project refuse project-scoped credentials. */
+export const projectAuthority = new AsyncLocalStorage();

package/dist/project-cli.d.ts

@@ -0,0 +1,18 @@
+import type { Store } from './store.js';
+export type ProjectProfile = {
+    version: 1;
+    repo: string;
+    tokenFile: string | null;
+};
+export declare const projectProfilePath: (databaseFile: string) => string;
+export declare function readProjectProfile(databaseFile: string): ProjectProfile | null;
+export declare function runProjectCommand(positional: readonly string[], flags: Map<string, string | true>, context: {
+    store: Store;
+    databaseFile: string;
+    write: (line: string) => void;
+    json: boolean;
+    registryFile?: string;
+}): Promise<number>;
+/** Only known credential-aware adapters consume the remembered reference.
+ * Explicit credentials always win; no legacy action gains implicit authority. */
+export declare function applyProjectProfile(command: string, positional: readonly string[], flags: Map<string, string | true>, databaseFile: string): void;

package/dist/project-cli.js

@@ -0,0 +1,104 @@
+/** Local convenience only: a selected project and optional credential reference.
+ * Every action still authenticates against the current database. */
+import { lstatSync, readFileSync, writeFileSync, renameSync, mkdirSync, statSync } from 'node:fs';
+import { dirname, join, resolve, isAbsolute } from 'node:path';
+import { homedir } from 'node:os';
+import { randomBytes } from 'node:crypto';
+import { configPath, loadRepos } from './repos.js';
+import { authenticateCoordinator } from './coordinator.js';
+import { canonicalProject } from './project.js';
+import { envelopeJson } from './envelope.js';
+export const projectProfilePath = (databaseFile) => join(dirname(databaseFile), 'cli-project.json');
+export function readProjectProfile(databaseFile) {
+    const file = projectProfilePath(databaseFile);
+    const stat = lstatSync(file, { throwIfNoEntry: false });
+    if (!stat)
+        return null;
+    if (!stat.isFile() || stat.size > 16_384)
+        throw new Error('The saved CLI project is not a readable profile. Select it again with project use.');
+    const value = JSON.parse(readFileSync(file, 'utf8'));
+    if (!value || typeof value !== 'object')
+        throw new Error('The saved CLI project is invalid. Select it again with project use.');
+    const p = value;
+    if (p['version'] !== 1 || typeof p['repo'] !== 'string' || !isAbsolute(p['repo']) || /[\x00-\x1f]/.test(p['repo']) ||
+        (p['tokenFile'] !== null && (typeof p['tokenFile'] !== 'string' || !isAbsolute(p['tokenFile']) || /[\x00-\x1f]/.test(p['tokenFile']))))
+        throw new Error('The saved CLI project is invalid. Select it again with project use.');
+    return { version: 1, repo: p['repo'], tokenFile: p['tokenFile'] };
+}
+export async function runProjectCommand(positional, flags, context) {
+    const action = positional[0] ?? 'show', command = `project ${action}`;
+    const fail = (reason, message) => { context.write(context.json ? envelopeJson({ ok: false, command, reason, message }) : message); return reason === 'usage' ? 2 : 3; };
+    if (!['use', 'show'].includes(action) || positional.length > (action === 'use' ? 2 : 1))
+        return fail('usage', 'Use project use <saved checkout path> [--token-file PATH], or project show.');
+    const allowed = new Set(['db', 'json', ...(action === 'use' ? ['token-file'] : [])]);
+    for (const name of flags.keys())
+        if (!allowed.has(name))
+            return fail('usage', `--${name} is not a project ${action} option.`);
+    const registry = await loadRepos(context.registryFile ?? configPath(process.env, homedir()));
+    if ('error' in registry)
+        return fail('configuration', registry.error);
+    const repos = [...new Set([...registry.repos, ...context.store.knownRepos()].map(repo => canonicalProject(repo) ?? repo))];
+    let profile;
+    if (action === 'use') {
+        const path = positional[1];
+        if (!path || /[\x00-\x1f]/.test(path))
+            return fail('usage', 'Choose the exact saved checkout path.');
+        const repo = canonicalProject(path) ?? resolve(path);
+        if (!repos.includes(repo))
+            return fail('not-found', 'That checkout is not a saved project. Use repos to see or connect projects.');
+        try {
+            if (!statSync(repo).isDirectory())
+                return fail('not-found', 'That checkout is unavailable.');
+        }
+        catch {
+            return fail('not-found', 'That checkout is unavailable.');
+        }
+        const credential = flags.get('token-file');
+        if (credential !== undefined && (typeof credential !== 'string' || !credential || /[\x00-\x1f]/.test(credential)))
+            return fail('usage', '--token-file requires a path.');
+        const tokenFile = typeof credential === 'string' ? resolve(credential) : null;
+        if (tokenFile !== null) {
+            let token;
+            try {
+                const info = statSync(tokenFile);
+                if (!info.isFile() || info.size > 16_384)
+                    return fail('unauthenticated', 'The scoped credential file is unavailable.');
+                token = readFileSync(tokenFile, 'utf8').trim();
+            }
+            catch {
+                return fail('unauthenticated', 'The scoped credential file is unavailable.');
+            }
+            const auth = authenticateCoordinator(context.store, token);
+            if (!auth.ok)
+                return fail('unauthenticated', 'The scoped credential is invalid or revoked.');
+            if (!auth.who.repos.includes(repo))
+                return fail('not-found', 'That project is unavailable to this credential.');
+        }
+        profile = { version: 1, repo, tokenFile };
+        const file = projectProfilePath(context.databaseFile), temp = `${file}.${randomBytes(6).toString('hex')}.tmp`;
+        mkdirSync(dirname(file), { recursive: true });
+        writeFileSync(temp, `${JSON.stringify(profile, null, 2)}\n`, { mode: 0o600, flag: 'wx' });
+        renameSync(temp, file);
+    }
+    else
+        profile = readProjectProfile(context.databaseFile);
+    const result = { profile, saved: profile !== null && repos.includes(profile.repo) };
+    context.write(context.json ? envelopeJson({ ok: true, command, result }) : profile === null ? 'No project selected. Use project use <saved checkout path>.' : `${profile.repo}${result.saved ? '' : ' (no longer saved)'}\n${profile.tokenFile === null ? 'Uses your existing local sign-in for operator actions.' : `Scoped credential reference: ${profile.tokenFile}`}`);
+    return 0;
+}
+/** Only known credential-aware adapters consume the remembered reference.
+ * Explicit credentials always win; no legacy action gains implicit authority. */
+export function applyProjectProfile(command, positional, flags, databaseFile) {
+    const scoped = command === 'assignment' || command === 'knowledge' || (command === 'brief' && !flags.has('history')) ||
+        (command === 'task' && ['complete', 'revise'].includes(positional[0] ?? ''));
+    const repoDefault = command === 'knowledge' || command === 'brief' || (command === 'assignment' && positional[0] === 'brief');
+    if (!scoped && !repoDefault)
+        return;
+    const profile = readProjectProfile(databaseFile);
+    if (!profile)
+        return;
+    if (repoDefault && !flags.has('repo'))
+        flags.set('repo', profile.repo);
+    if (scoped && profile.tokenFile && !['token-file', 'token-env', 'token', 'as'].some(name => flags.has(name)))
+        flags.set('token-file', profile.tokenFile);
+}

package/dist/project-delete-ui.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Settings → Project: what Toolroll holds for a project, and deleting
+ * it. An instance operator deletes in two steps: type the project's name,
+ * then read exactly what goes and confirm with their password (or a fresh
+ * sign-in with the identity provider). The repository itself stays.
+ */
+import { type ProjectHoldings } from "./project-delete.js";
+export declare const PROJECT_DELETE_CSS: string;
+export type ProjectSettingsView = {
+    repo: string;
+    name: string;
+    holdings: ProjectHoldings;
+    running: string[];
+    canDelete: boolean;
+};
+/** The project's page: its path, what Toolroll holds for it, and (for an instance operator) Delete project. */
+export declare function projectSettingsHtml(view: ProjectSettingsView, csrf: string, notice: {
+    said?: string | null;
+    problem?: string | null;
+}): string;
+/** The second step: exactly what goes, and the password. */
+export declare function projectDeleteConfirmHtml(view: ProjectSettingsView, csrf: string, problem: string | null): string;

package/dist/project-delete-ui.js

@@ -0,0 +1,48 @@
+/**
+ * Settings → Project: what Toolroll holds for a project, and deleting
+ * it. An instance operator deletes in two steps: type the project's name,
+ * then read exactly what goes and confirm with their password (or a fresh
+ * sign-in with the identity provider). The repository itself stays.
+ */
+import { holdingsWords } from "./project-delete.js";
+const e = (value) => String(value ?? "").replace(/[&<>"']/g, c => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
+export const PROJECT_DELETE_CSS = `.project-settings,.project-delete{max-width:720px;min-width:0}.project-settings .path,.project-delete .path{font-family:var(--font-mono);font-size:.8125rem;overflow-wrap:anywhere;word-break:break-all}` +
+    `.project-settings details.danger-zone{margin-top:24px;border:1px solid var(--border);border-radius:10px;padding:0 14px}.project-settings details.danger-zone summary{min-height:44px;display:flex;align-items:center;cursor:pointer;font-weight:500;color:var(--danger)}` +
+    `.project-settings details.danger-zone[open]{padding-bottom:14px}.project-settings form,.project-delete form{display:grid;gap:12px;margin-top:12px}.project-settings label,.project-delete label{display:grid;gap:4px;font-size:.8125rem;font-weight:500}` +
+    `.project-settings input,.project-delete input{max-width:100%;min-height:36px}.project-delete .removes{margin:12px 0;padding-left:20px}.project-delete .removes li{margin:2px 0}` +
+    `.project-delete .actions{display:flex;flex-wrap:wrap;gap:12px;align-items:center}.project-delete button.danger,.project-settings button.danger{background:var(--danger);color:#fff;border-color:var(--danger);white-space:nowrap}` +
+    `.project-settings button,.project-delete button{justify-self:start;min-height:36px;white-space:nowrap}.project-delete .actions a{min-height:36px;display:inline-flex;align-items:center}`;
+const note = (notice) => notice.problem ? `<p class="problem" role="alert">${e(notice.problem)}</p>` : notice.said ? `<p role="status">${e(notice.said)}</p>` : "";
+/** The project's page: its path, what Toolroll holds for it, and (for an instance operator) Delete project. */
+export function projectSettingsHtml(view, csrf, notice) {
+    const held = `<p>Toolroll holds ${e(holdingsWords(view.holdings))} for <strong>${e(view.name)}</strong>.</p>`;
+    const head = `<section class="project-settings">${note(notice)}<p class="path">${e(view.repo)}</p>${held}`;
+    if (!view.canDelete)
+        return `${head}<p class="meta">An instance operator can delete a project.</p></section>`;
+    const body = view.running.length > 0
+        ? `<p class="problem">Its work is running: ${e(view.running.join(", "))}. Stop it before deleting the project.</p>`
+        : `<p>Removes everything Toolroll holds for ${e(view.name)}. The repository and its own branches stay. There's no undo.</p>` +
+            `<form method="post" action="/settings/project/delete"><input type="hidden" name="csrf" value="${e(csrf)}"><input type="hidden" name="repo" value="${e(view.repo)}">` +
+            `<label><span>Type <strong>${e(view.name)}</strong> to continue</span><input name="name" autocomplete="off" autocapitalize="off" spellcheck="false" required></label>` +
+            `<button type="submit">Continue</button></form>`;
+    return `${head}<details class="danger-zone"${notice.problem ? " open" : ""}><summary>Delete project</summary>${body}</details></section>`;
+}
+/** The second step: exactly what goes, and the password. */
+export function projectDeleteConfirmHtml(view, csrf, problem) {
+    const h = view.holdings;
+    const count = (n, one, many = `${one}s`) => `${n} ${n === 1 ? one : many}`;
+    const items = [
+        `${count(h.tasks, "task")}${h.versions > 0 ? ` and ${count(h.versions, "version")}` : ""}, with ${count(h.runs, "run")} and their evidence`,
+        "The checkouts and branches Toolroll made",
+        ...(h.chats > 0 ? [count(h.chats, "chat")] : []),
+        ...(h.flows > 0 ? [`${count(h.flows, "flow")} and ${count(h.cards, "card")}`] : []),
+        ...(h.teammates > 0 ? [count(h.teammates, "teammate")] : []),
+        "Its budgets, settings and knowledge",
+    ];
+    return `<section class="project-delete">${problem === null ? "" : `<p class="problem" role="alert">${e(problem)}</p>`}` +
+        `<p>This removes:</p><ul class="removes">${items.map(one => `<li>${e(one)}</li>`).join("")}</ul>` +
+        `<p>The repository at <span class="path">${e(view.repo)}</span> and its own branches stay. The ledger keeps its history. There's no undo.</p>` +
+        `<form method="post" action="/settings/project/delete"><input type="hidden" name="csrf" value="${e(csrf)}"><input type="hidden" name="repo" value="${e(view.repo)}"><input type="hidden" name="name" value="${e(view.name)}"><input type="hidden" name="step" value="delete">` +
+        `<label>Your Toolroll password<input type="password" name="password" autocomplete="current-password"></label>` +
+        `<div class="actions"><button type="submit" class="danger">Delete project</button><a href="/settings/project?repo=${e(encodeURIComponent(view.repo))}">Cancel</a></div></form></section>`;
+}

package/dist/project-delete.d.ts

@@ -0,0 +1,55 @@
+import { type ExecResult } from "./exec.js";
+import { type Store } from "./store.js";
+/** What Toolroll names the branches it makes: toolroll/…, and standing-orders/… from before the rename. */
+export declare const OWN_BRANCH = "toolroll/";
+export declare const OWN_BRANCHES: readonly string[];
+export type ProjectHoldings = {
+    tasks: number;
+    versions: number;
+    runs: number;
+    evidence: number;
+    checkouts: number;
+    chats: number;
+    flows: number;
+    cards: number;
+    teammates: number;
+    budgets: number;
+    settings: number;
+};
+export type ProjectDeleteResult = {
+    ok: true;
+    repo: string;
+    removed: ProjectHoldings & {
+        branches: number;
+        rows: number;
+    };
+    left: string[];
+    ledgerId: number;
+} | {
+    ok: false;
+    reason: "running" | "failed";
+    said: string;
+    running?: string[];
+};
+/** What Toolroll holds for a project, counted. */
+export declare function projectHoldings(store: Store, repo: string): ProjectHoldings;
+/** What's in it, in words: "12 tasks, 3 versions, 30 runs, …". Empty kinds are left out. */
+export declare function holdingsWords(held: ProjectHoldings & {
+    branches?: number;
+}): string;
+/** The project's work that is running right now, in words; empty when none is. */
+export declare function projectRunning(store: Store, repo: string, now: Date): string[];
+export type GitRunner = (args: readonly string[], cwd: string) => Promise<ExecResult>;
+/**
+ * Delete the project. Refuses while any of its work is running (checked
+ * again inside the deletion). Its tasks are held first so nothing new
+ * starts while the checkouts and branches go.
+ */
+export declare function deleteProject(store: Store, repo: string, options: {
+    actor: string;
+    via: "console" | "command line";
+    now: Date;
+    evidenceRoot: string | null;
+    poolRoot: string | null;
+    git?: GitRunner;
+}): Promise<ProjectDeleteResult>;