toolroll 0.9.103 → 0.9.105

package/dist/project-delete-ui.js

@@ -1,9 +1,4 @@
-/**
- * Settings → Project: what Toolroll holds for a project, and deleting
- * it. An instance operator deletes in two steps: type the project's name,
- * then read exactly what goes and confirm with their password (or a fresh
- * sign-in with the identity provider). The repository itself stays.
- */
+import { advancedShownNow } from "./advanced-view.js";
 import { entryMovesOnWords, entryWords } from "./fallback.js";
 import { sandboxRuntimeWords } from "./sandbox-runtime.js";
 import { CHECK_ACCESS_WARNINGS, signInHostsMissing } from "./check-access.js";
@@ -11,14 +6,12 @@ import { html, joinHtml, postForm } from "./html.js";
 import { holdingsWords } from "./project-delete.js";
 import { acts, btn, codeLine, disclose, formRow, infoLine, input, note, notice, radios, settingsSection, switchInput, textarea } from "./server/kit.js";
 import { kitSectionForm } from "./settings-kit.js";
-/** Check access: a wider level's warning shows only under the option chosen. Everything else on the page is kit markup. */
 export const PROJECT_DELETE_CSS = ".k-opt [data-check-access-warning]{display:none;color:var(--so-ink)}.k-opt:has(input:checked) [data-check-access-warning]{display:block}" +
     ".k-opt:has(input:disabled){cursor:default;opacity:.6}";
 const mono = (text) => html `<span class="k-mono">${text}</span>`;
 const list = (items) => html `<ul class="k-note">${items.map(one => html `<li>${one}</li>`)}</ul>`;
 const SCOPED = "Tasks scoped from now on use this; tasks already approved keep what they were approved with.";
 const APPROVER_CHANGES = note("An approver for this project can change this.");
-/** Where builds may write, said plainly; an approver changes it with their password (always typed: it widens). */
 function writesHtml(view) {
     const writes = view.writes;
     if (writes === undefined)
@@ -36,8 +29,6 @@ function writesHtml(view) {
                 note(SCOPED),
             ]) })) });
 }
-/** Home folder (project-sandbox.ts): what builds and checks can read there, said once; the paths they can't, and the
- * advanced list (macOS services), changed under Change with the approver's password. */
 function sandboxHtml(view) {
     const sandbox = view.sandbox;
     if (sandbox === undefined)
@@ -48,7 +39,6 @@ function sandboxHtml(view) {
         : `Builds and checks can read your home folder except ${readDeny.length === 1 ? readDeny[0] : `${readDeny.length} paths`}.`;
     const head = joinHtml([
         machLookup.length === 0 ? "" : note(`${machLookup.length} macOS ${machLookup.length === 1 ? "service" : "services"} allowed`),
-        // The engine, named where the sandbox is set (sandbox-runtime.ts).
         html `<p class="k-note" data-sandbox-engine>Builds, checks and flows run in ${sandboxRuntimeWords()}.</p>`,
     ]);
     return settingsSection({ id: "sandbox", title: "Home folder", lead: said,
@@ -59,29 +49,22 @@ function sandboxHtml(view) {
                     note(SCOPED),
                 ]) }))]) });
 }
-/** Check access (check-access.ts): how far the project's checks reach, said once. Collapsed: the level, what it means
- * when it isn't the default, and who changed it. Inside Change: a line per level, and each wider level's warning under it
- * only while it is chosen. An instance operator widens it with a password typed now; an approver narrows it. */
 function checkAccessHtml(view) {
     const access = view.checkAccess;
     if (access === undefined)
         return "";
     const saved = access.setting;
-    // Sign-ins aren't available (off for now): a saved sign-ins level runs sandboxed, and the page says so.
     const unavailable = access.signInsUnavailable ?? null;
     const setting = unavailable !== null && saved === "sign-ins" ? "sandboxed" : saved;
     const network = view.network?.setting ?? null;
     const names = { sandboxed: "Sandboxed", "sign-ins": "Sandboxed, with model and GitHub sign-ins", unsandboxed: "Not sandboxed" };
     const meaning = { sandboxed: null, "sign-ins": "Checks can read your Claude, Codex and GitHub sign-ins.", unsandboxed: "Checks run with your full access to this machine and to Toolroll." };
-    // The sign-ins never widen the network: how many hosts they'd still need, and where to add them (a change of its own).
     const missing = setting === "sign-ins" && network !== null ? signInHostsMissing(network) : [];
     const hosts = missing.length === 0 ? "" : joinHtml([
         html `<p class="k-note" data-sign-in-hosts>${missing.length} sign-in ${missing.length === 1 ? "host isn't" : "hosts aren't"} allowed yet · <a class="k-link" href="#network">Add them</a></p>`,
         disclose("Show hosts", html `<p class="k-note k-mono">${missing.join(", ")}</p>`),
     ]);
     const changed = access.changed === null ? "" : note(`Changed by ${access.changed.by}, ${new Date(access.changed.at).toLocaleDateString("en-GB", { day: "numeric", month: "short", timeZone: "UTC" })}`);
-    // No OS sandbox here, and unconfined running allowed: checks run without a sandbox whatever is saved, and that is
-    // what the page says first (never "sandboxed"); the saved level is named under it.
     const unconfinedHere = access.unconfinedHere === true;
     const shown = unconfinedHere ? "unsandboxed" : setting;
     const head = unconfinedHere
@@ -105,13 +88,11 @@ ${option("unsandboxed", "For projects whose checks create sandboxes themselves,
     const confirmOpen = open && unavailable === null
         ? html `<label class="k-opt"><input type="checkbox" name="confirm-open" value="yes"><span><b>The network is open</b><span>With sign-ins, checks could send them to any host.</span></span></label>`
         : "";
-    // A form that offers a wider level asks for an instance operator's password, typed now (the server decides).
     const form = kitSectionForm({ proof: access.canWiden ? "project-check-access-widen" : "project-check-access", action: "/settings/project/check-access", id: "check-access-form", gate: true, hidden: { repo: view.repo },
         body: joinHtml([formRow("How far checks reach", null, choices, "wide"), confirmOpen,
             note(`${access.canWiden ? "" : "Only an instance operator can widen this. "}Flow script steps always run sandboxed. Tasks already approved keep their level.`)]) });
     return section(joinHtml([head, disclose("Change", form)]));
 }
-/** Network: what the project's builds may reach, said plainly; an approver changes it with their password. */
 function networkHtml(view) {
     const network = view.network;
     if (network === undefined)
@@ -149,7 +130,6 @@ function fallbackHtml(view) {
                     note("Tasks scoped from now on use this; tasks already approved keep the chain they were approved with."),
                 ]) }))]) });
 }
-/** Live view: hidden by default; showing commands takes the password, hiding them is one step. */
 function liveViewHtml(view) {
     const live = view.liveView;
     if (live === undefined)
@@ -166,7 +146,6 @@ function liveViewHtml(view) {
     return settingsSection({ id: "live-view", title: "Live view", state: html `<span data-live-view-setting="${live.commands ? "commands" : "base"}"> · ${live.commands ? "Commands shown" : "Commands hidden"}</span>`,
         lead: said, body: change });
 }
-/** Build access: one sentence for what a build gets, the detail on demand, and the way to change it. */
 function accessHtml(view) {
     const access = view.access;
     if (access === undefined)
@@ -188,7 +167,6 @@ function accessHtml(view) {
     const tools = access.tools.map(one => html `${mono(one.name)} · ${one.words}`);
     return settingsSection({ id: "build-access", title: "Build access", lead: outcome, body: joinHtml([disclose("Details", list([...always, ...tools])), manage]) });
 }
-/** Builds at once: one number, one Save. The worker's cap is said only when it lowers the number. */
 function buildsHtml(view) {
     const b = view.builds;
     if (b === undefined)
@@ -201,8 +179,6 @@ function buildsHtml(view) {
         body: postForm("/settings/project/concurrency", formRow("Builds at once", now, html `${input({ id: "builds-at-once-n", name: "concurrency", type: "number", value: String(b.setting),
             attrs: { min: 1, max: 64, step: 1, inputmode: "numeric", "aria-label": "Builds at once" } })}${btn("Save", { sm: true, type: "submit" })}`, "inline"), { hidden: { repo: view.repo } }) });
 }
-/** The project's page: its name and path, what Toolroll holds for it, its build settings, and (for an instance operator)
- * Remove and Delete. */
 function codeMapHtml(view) {
     const map = view.codeMap;
     if (map === undefined)
@@ -222,7 +198,9 @@ export function projectSettingsHtml(view, said) {
             formRow("Recorded remote", view.remoteUrl ? null : "None. Landed work waits for your review.", view.remoteUrl ? mono(view.remoteUrl) : html ``, view.remoteUrl ? "wide" : "inline"),
             disclose("Change remote", joinHtml([note("An owner or instance operator can run:"), codeLine("toolroll repos add <project> --remote <url>")])),
         ]) });
-    const settings = joinHtml([buildsHtml(view), accessHtml(view), networkHtml(view), fallbackHtml(view), writesHtml(view), sandboxHtml(view), checkAccessHtml(view), liveViewHtml(view), codeMapHtml(view)]);
+    const advanced = advancedShownNow();
+    const settings = joinHtml([buildsHtml(view), accessHtml(view), networkHtml(view), advanced || (view.fallback?.setting ?? null) !== null ? fallbackHtml(view) : "",
+        writesHtml(view), sandboxHtml(view), checkAccessHtml(view), advanced || view.liveView?.commands === true ? liveViewHtml(view) : "", advanced ? codeMapHtml(view) : ""]);
     if (!view.canDelete)
         return joinHtml([answer, project, settings, note("An instance operator can remove or delete a project.")]);
     const deleteBody = view.running.length > 0
@@ -232,7 +210,6 @@ export function projectSettingsHtml(view, said) {
                 formRow(`Type ${view.name} to continue`, null, input({ id: "delete-name", name: "name", attrs: { autocomplete: "off", autocapitalize: "off", spellcheck: "false", required: true, "aria-label": `Type ${view.name} to continue` } })),
                 acts(btn("Continue", { sm: true, type: "submit", variant: "danger" })),
             ]), { hidden: { repo: view.repo } })]);
-    // Removing is the reversible step: off the lists and the builder, everything kept.
     const leave = settingsSection({ id: "remove", title: "Remove or delete",
         body: joinHtml([
             formRow("Remove from Toolroll", "Its tasks and results stay saved. Add it again to bring it back.", postForm("/projects/remove", btn("Remove from Toolroll", { sm: true, type: "submit" }), { hidden: { repo: view.repo } }), "inline"),
@@ -240,7 +217,6 @@ export function projectSettingsHtml(view, said) {
         ]) });
     return joinHtml([answer, project, settings, leave]);
 }
-/** The second step: exactly what goes, and the password. */
 export function projectDeleteConfirmHtml(view, problem) {
     const h = view.holdings;
     const count = (n, one, many = `${one}s`) => `${n} ${n === 1 ? one : many}`;
@@ -258,7 +234,6 @@ export function projectDeleteConfirmHtml(view, problem) {
             body: joinHtml([
                 list(items),
                 note(html `The repository at ${mono(view.repo)} and its own branches stay. The ledger keeps its history. There's no undo.`),
-                // The answer is a page of its own (this page again with a refusal, or the project page), so it posts as a navigation.
                 kitSectionForm({ proof: "project-delete", action: "/settings/project/delete", id: "delete-form", native: true, hidden: { repo: view.repo, name: view.name, step: "delete" },
                     save: { label: "Delete project", variant: "danger" }, confirm: `Delete ${view.name}`,
                     body: acts(btn("Cancel", { sm: true, variant: "ghost", href: `/settings/project?repo=${encodeURIComponent(view.repo)}` })) }),

package/dist/project-delete.js

@@ -1,23 +1,8 @@
-/**
- * Deleting a project: everything Toolroll holds for it goes, and
- * nothing else. Its tasks and their versions, runs and their evidence, the
- * checkouts and branches Toolroll made, its chats and threads, flows
- * and cards, subagents, budgets and settings. Never while any of its work is
- * running. The project's own repository, its working copy and every branch
- * Toolroll didn't make stay exactly as they are. The action ledger
- * keeps every entry (its hash chain still verifies) and gains one: who
- * deleted the project and what went.
- *
- * An instance operator does it, with a step-up: Settings → Project (type the
- * project's name, then the password) or `project delete --repo <path> --yes`.
- * There is no undo.
- */
 import { existsSync, lstatSync, rmSync } from "node:fs";
 import { isAbsolute, relative, resolve } from "node:path";
 import { teardownGit, refusal } from "./teardown-git.js";
 import { BUILT_IN, forgetProjectModels, V149_REPO_TABLES } from "./store.js";
 import { BRANCH_PREFIXES, isOwnBranch } from "./names.js";
-/** The tables whose history is the audit record itself: never touched. */
 const KEPT = new Set(["action_ledger", "ledger_seal", "ledger_checkpoint"]);
 export const OWN_BRANCHES = BRANCH_PREFIXES;
 const list = (db, sql, ...params) => db.prepare(sql).all(...params).map(row => Object.values(row)[0]);
@@ -25,15 +10,12 @@ const ids = (db, sql, ...params) => list(db, sql, ...params).map(Number);
 const json = (values) => JSON.stringify(values);
 const tableExists = (db, name) => db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?").get(name) !== undefined;
 const plural = (count, one, many = `${one}s`) => `${count} ${count === 1 ? one : many}`;
-/** The project's rows, by what everything else hangs off. */
 function doomed(db, repo) {
     const refs = ids(db, "SELECT id FROM task_ref WHERE repo = ?", repo);
-    // A built-in task goes when every version of it is this project's.
     const tasks = list(db, `SELECT DISTINCT external_id FROM task_ref WHERE repo = ? AND backend = ?
     AND external_id NOT IN (SELECT external_id FROM task_ref WHERE backend = ? AND (repo IS NULL OR repo <> ?))`, repo, BUILT_IN, BUILT_IN, repo).map(String);
     const runs = ids(db, "SELECT id FROM run WHERE task_ref IN (SELECT value FROM json_each(?))", json(refs));
     const artifacts = ids(db, "SELECT id FROM artifact WHERE run IN (SELECT value FROM json_each(?))", json(runs));
-    // A team conversation's thread is the team's, whatever it talked about.
     const threads = ids(db, `SELECT id FROM lead_thread WHERE ((scope_kind = 'project' AND scope_key = ?) OR (scope_kind = 'task' AND scope_key IN (SELECT value FROM json_each(?))))
     AND id NOT IN (SELECT thread FROM team_conversation WHERE thread IS NOT NULL)`, repo, json(tasks));
     const turns = ids(db, "SELECT id FROM mate_turn WHERE thread IN (SELECT value FROM json_each(?))", json(threads));
@@ -42,22 +24,15 @@ function doomed(db, repo) {
     const subagents = ids(db, "SELECT id FROM subagent WHERE repo = ?", repo);
     return { refs, tasks, runs, artifacts, threads, turns, flows, cards, subagents };
 }
-/** A project's settings: one row per thing someone set for it. Its Models rows (phase_config, phase_tier_config,
- * phase_tier_alternate) are settings too, but go only through store.ts forgetProjectModels, which moves their
- * generations and takes the project's results-routing rows with them (MODEL_SETTINGS). */
 const SETTINGS = [
     ["approval_policy", "repo"], ["verify_command", "repo"], ["worktree_setup", "repo"], ["backend_grant", "repo"], ["publication_grant", "repo"],
     ["intake_grant", "repo"], ["capability", "repo"], ["project_tool", "repo"],
     ["learning_policy", "repo"], ["operating_mode", "repo"], ["project_knowledge", "repo"], ["live_detail_setting", "repo"],
     ["project_decision", "repo"], ["flow_script", "repo"], ["workflow_recipe", "repo"], ["team_lead_project", "project"],
-    // Its fallback agents and, on the same row, its paid fallback grant (fallback.ts).
     ["fallback_setting", "repo"],
 ];
-/** The project's Models rows, counted with its settings and deleted by forgetProjectModels only. */
 export const MODEL_SETTINGS = Object.freeze([["phase_config", "scope"], ["phase_tier_config", "scope"], ["phase_tier_alternate", "scope"]]);
-/** The project's settings tables, for the deletion test's inventory. */
 export const PROJECT_SETTINGS = Object.freeze(SETTINGS.map(one => [...one]));
-/** What Toolroll holds for a project, counted. */
 export function projectHoldings(store, repo) {
     const db = store.handle;
     const d = doomed(db, repo);
@@ -72,7 +47,6 @@ export function projectHoldings(store, repo) {
         settings: [...SETTINGS, ...MODEL_SETTINGS].filter(([table]) => tableExists(db, table)).reduce((sum, [table, column]) => sum + count(`SELECT COUNT(*) AS n FROM ${table} WHERE ${column} = ?`, repo), 0),
     };
 }
-/** What's in it, in words: "12 tasks, 3 versions, 30 runs, …". Empty kinds are left out. */
 export function holdingsWords(held) {
     const parts = [
         plural(held.tasks, "task"), ...(held.versions > 0 ? [plural(held.versions, "version")] : []), plural(held.runs, "run"),
@@ -83,7 +57,6 @@ export function holdingsWords(held) {
     ];
     return parts.join(", ");
 }
-/** The project's work that is running right now, in words; empty when none is. */
 export function projectRunning(store, repo, now) {
     const db = store.handle;
     const d = doomed(db, repo);
@@ -95,7 +68,6 @@ export function projectRunning(store, repo, now) {
     const steps = count("SELECT COUNT(*) AS n FROM flow_step_run WHERE state = 'running' AND card IN (SELECT value FROM json_each(?))", json(d.cards));
     const calls = count("SELECT COUNT(*) AS n FROM subagent_call WHERE state = 'running' AND subagent IN (SELECT value FROM json_each(?))", json(d.subagents));
     const merges = count(`SELECT COUNT(*) AS n FROM merge_intent WHERE state IN ('claimed','firing') AND publication IN (SELECT id FROM publication WHERE task_ref IN (SELECT value FROM json_each(?)))`, json(d.refs))
-        // A person's merge between its last check and GitHub's answer (v145); a row older than 15 minutes is a crash.
         + count("SELECT COUNT(*) AS n FROM merge_in_flight WHERE at > ? AND task_ref IN (SELECT value FROM json_each(?))", new Date(now.getTime() - 15 * 60_000).toISOString(), json(d.refs));
     const checkouts = count("SELECT COUNT(*) AS n FROM worktree WHERE repo = ? AND runner IS NOT NULL AND released_at IS NULL", repo);
     return [
@@ -108,15 +80,7 @@ export function projectRunning(store, repo, now) {
         ...(checkouts > 0 && building === 0 ? [`${plural(checkouts, "checkout")} ${checkouts === 1 ? "is" : "are"} in use`] : []),
     ];
 }
-/** Whether `path` is inside `root` (not the root itself). */
 const inside = (root, path) => { const rel = relative(resolve(root), resolve(path)); return rel !== "" && !rel.startsWith("..") && !isAbsolute(rel); };
-/**
- * Remove the checkouts and branches Toolroll made for the project: only
- * branches named toolroll/… or standing-orders/… that its tasks, runs, checkouts, races or
- * pull requests used, and only checkouts of those branches or ones it
- * recorded. Git itself refuses to delete a branch that is checked out
- * somewhere; that one stays and is said. Nothing else in the repository moves.
- */
 async function removeCheckoutsAndBranches(store, repo, d, git, poolRoot) {
     const db = store.handle;
     const recorded = db.prepare("SELECT path, branch FROM worktree WHERE repo = ?").all(repo).map(row => ({ path: String(row["path"]), branch: String(row["branch"]) }));
@@ -133,7 +97,6 @@ async function removeCheckoutsAndBranches(store, repo, d, git, poolRoot) {
         return { checkouts, branches, left: [refusal(probe)] };
     const isRepo = probe?.code === 0;
     if (!isRepo) {
-        // No repository to ask: only checkouts in Toolroll's own folder go.
         for (const row of recorded) {
             if (poolRoot === null || !inside(poolRoot, row.path) || !existsSync(row.path))
                 continue;
@@ -142,7 +105,6 @@ async function removeCheckoutsAndBranches(store, repo, d, git, poolRoot) {
         }
         return { checkouts, branches, left };
     }
-    // Every checkout of one of our branches, and every one we recorded, wherever git has it.
     const listed = await git(["worktree", "list", "--porcelain"], repo);
     const trees = [];
     if (listed.code === 0) {
@@ -158,8 +120,6 @@ async function removeCheckoutsAndBranches(store, repo, d, git, poolRoot) {
     }
     const main = trees[0]?.path ?? null;
     const targets = new Set();
-    // A checkout goes only while it's on one of our branches, or on no branch at all (a detached checkout Toolroll
-    // made). One we recorded that someone has since switched to a branch of their own is theirs now: it stays, and is said.
     for (const tree of trees.slice(1)) {
         const recordedHere = recorded.some(row => resolve(row.path) === resolve(tree.path));
         if (tree.branch !== null && ours.has(tree.branch))
@@ -178,11 +138,9 @@ async function removeCheckoutsAndBranches(store, repo, d, git, poolRoot) {
         else
             left.push(`checkout ${path}: ${gone.stderr.trim().split("\n")[0] ?? "git refused"}`);
     }
-    // A recorded checkout git no longer knows, still on disk in our folder.
     for (const row of recorded) {
         if (targets.has(row.path) || poolRoot === null || !inside(poolRoot, row.path) || !existsSync(row.path))
             continue;
-        // Only one git has forgotten: a checkout git still lists was either removed above or left alone on purpose.
         if (trees.some(tree => resolve(tree.path) === resolve(row.path)))
             continue;
         rmSync(row.path, { recursive: true, force: true });
@@ -201,7 +159,6 @@ async function removeCheckoutsAndBranches(store, repo, d, git, poolRoot) {
     }
     return { checkouts, branches, left };
 }
-/** Delete the project's rows in one transaction; returns how many rows went. */
 function deleteRows(store, repo, d, now) {
     const db = store.handle;
     let rows = 0;
@@ -217,14 +174,10 @@ function deleteRows(store, repo, d, now) {
     const notifications = json(ids(db, `SELECT id FROM notification WHERE project = ? OR ${IN("task_ref")} OR ${IN("source_run")}`, repo, T, R));
     const questions = json(ids(db, `SELECT id FROM subagent_question WHERE ${IN("subagent")} OR ${IN("card")}`, M, C));
     const proposals = json(ids(db, `SELECT id FROM lead_proposal WHERE ${IN("thread")}`, H));
-    // A chat message about one of the project's tasks (its turn named it), with its reply. Event ids are text ('m123'),
-    // and the same id can be another app's: each is kept whole, as provider:id.
     const conversations = json(list(db, `SELECT provider || ':' || id FROM chat_event WHERE kind = 'message' AND json_extract(payload, '$.about.task') IN (SELECT value FROM json_each(?))`, K));
-    // Every app's planned parts about the project's work: a result screenshot, or a message naming one of its tasks or runs.
     const parts = `SELECT provider || ':' || id FROM chat_part WHERE provider || ':' || event IN (SELECT value FROM json_each(?))
     OR json_extract(payload, '$.image.taskId') IN (SELECT value FROM json_each(?)) OR json_extract(payload, '$.image.run') IN (SELECT value FROM json_each(?))`;
     const doomedParts = `provider || ':' || part IN (${parts})`;
-    // Chats about the project's work, on every app.
     del("chat_progress", IN("run"), R);
     del("chat_action", `${IN("proposal")} OR ${IN("decision")} OR ${doomedParts}`, proposals, decisions, conversations, K, R);
     del("chat_flow_action", `${IN("card")} OR ${doomedParts}`, C, conversations, K, R);
@@ -239,13 +192,9 @@ function deleteRows(store, repo, d, now) {
     del("chat_decide_action", IN("task_id"), K);
     del("chat_decide_prompt", IN("task_id"), K);
     del("chat_message_ref", `${IN("decision")} OR ${IN("task_id")} OR ${IN("run")} OR project = ? OR ${IN("notification")} OR ${IN("task_ref")}`, decisions, K, R, repo, notifications, T);
-    // A typed yes to a Start card (one-step-chat.md C5). Its record goes with its message. Where the message stays (it
-    // named no task of this project) but the card's proposal goes, the record is settled instead and forgets the task: a
-    // yes still waiting is then answered by Toolroll as one that started nothing, never handed to the lead.
     del("chat_typed_start", `provider || ':' || event IN (SELECT value FROM json_each(?))`, conversations);
     if (tableExists(db, "chat_typed_start")) {
         db.prepare(`UPDATE chat_typed_start SET outcome = 'not-counted', task_id = NULL, finished = COALESCE(finished, ?) WHERE ${IN("proposal")}`).run(now.toISOString(), proposals);
-        // A yes that started one of this project's tasks, said in a message that stays: the record forgets the task.
         db.prepare(`UPDATE chat_typed_start SET task_id = NULL WHERE ${IN("task_id")}`).run(K);
     }
     del("chat_part", `provider || ':' || id IN (${parts})`, conversations, K, R);
@@ -267,7 +216,6 @@ function deleteRows(store, repo, d, now) {
     del("lead_proposal", IN("id"), proposals);
     del("lead_message", IN("thread"), H);
     del("lead_thread", IN("id"), H);
-    // Runs and their evidence.
     del("run_decision", `${IN("run")} OR ${IN("decision")}`, R, decisions);
     del("decision_artifact", `${IN("decision")} OR ${IN("artifact")}`, decisions, A);
     del("decision", IN("id"), decisions);
@@ -275,7 +223,6 @@ function deleteRows(store, repo, d, now) {
     del("diff_comment", `${IN("run")} OR ${IN("reviewer_run")} OR ${IN("artifact")}`, R, R, A);
     del("review_request", `${IN("run")} OR ${IN("reviewer_run")}`, R, R);
     del("repair_chain", IN("source_run"), R);
-    // What happens to a result after its agent finishes (fleet-schema.ts): a project's own rows, answers first.
     del("finding_answer", "finding IN (SELECT id FROM finding WHERE repo = ?)", repo);
     for (const table of ["finding", "check_repair", "evidence_pair", "failing_first", "provider_capture"])
         del(table, "repo = ?", repo);
@@ -296,7 +243,6 @@ function deleteRows(store, repo, d, now) {
     del("deploy_in_flight", IN("task_ref"), T);
     del("publication", IN("id"), publications);
     del("artifact", IN("id"), A);
-    // Tasks and their versions.
     del("run", IN("id"), R);
     del("plan_revision", IN("task_ref"), T);
     for (const table of ["claim", "hold", "task_steer"])
@@ -316,7 +262,6 @@ function deleteRows(store, repo, d, now) {
     del("task_scope", IN("task_id"), K);
     del("task_edge", `${IN("blocked")} OR ${IN("blocker")}`, K, K);
     del("task", IN("id"), K);
-    // Flows, cards and subagents.
     del("flow_trigger_event", `${IN("card")} OR trigger IN (SELECT id FROM flow_trigger WHERE ${IN("flow")})`, C, F);
     del("flow_trigger", IN("flow"), F);
     del("flow_unattended_run", `grant_id IN (SELECT id FROM flow_unattended_grant WHERE ${IN("flow")})`, F);
@@ -333,35 +278,24 @@ function deleteRows(store, repo, d, now) {
     del("subagent", IN("id"), M);
     del("flow_card", IN("id"), C);
     del("flow", IN("id"), F);
-    // Settings, knowledge and the project itself.
     del("operating_mode_event", "mode IN (SELECT id FROM operating_mode WHERE repo = ?)", repo);
     del("decision_change", "decision IN (SELECT id FROM project_decision WHERE repo = ?)", repo);
-    // Its learning-loops rows (v149), by repo; a check's results, a note's tallies and a merge of its decisions go with
-    // the rows they hang off (the deleted runs, notes and decisions), below.
     for (const table of V149_REPO_TABLES)
         del(table, "repo = ?", repo);
-    // Its code map: the pointer before the versions it names.
     del("code_map_current", "repo = ?", repo);
     for (const table of ["code_map_version", "code_map_refresh", "code_map_family"])
         del(table, "repo = ?", repo);
     del("memory_sighting", "gap IN (SELECT id FROM memory_gap WHERE repo = ?) OR session IN (SELECT id FROM memory_session WHERE repo = ?)", repo, repo);
     for (const [table, column] of SETTINGS)
         del(table, `${column} = ?`, repo);
-    // Its Models rows and results-routing rows: through the Models counter, so whatever depended on them pauses.
     rows += forgetProjectModels(store, repo, now);
     del("project_mute", "repo = ?", repo);
     for (const table of ["knowledge_change", "project_identity_carry", "project_skill_change", "memory_gap", "memory_proposal", "memory_rejection", "memory_session", "memory_search", "mode_rail", "side_spend", "watch_episode", "worktree", "coordinator_proposal", "lead_commitment"])
         del(table, "repo = ?", repo);
-    // A builder watching the project keeps its lease until it stops; an ended one goes.
     del("watch_lease", "repo = ? AND expires_at <= ?", repo, now.toISOString());
     del("project", "path = ?", repo);
     return rows;
 }
-/**
- * Delete the project. Refuses while any of its work is running (checked
- * again inside the deletion). Its tasks are held first so nothing new
- * starts while the checkouts and branches go.
- */
 export async function deleteProject(store, repo, options) {
     const hardened = teardownGit(options.runner ?? (options.git === undefined ? undefined :
         (_file, args, execOptions) => options.git(args, execOptions.cwd)));
@@ -372,7 +306,6 @@ export async function deleteProject(store, repo, options) {
     const db = store.handle;
     const held = projectHoldings(store, repo);
     let d = doomed(db, repo);
-    // Nothing new starts while the checkouts go.
     store.transact(() => {
         for (const ref of d.refs) {
             db.prepare(`INSERT INTO hold (task_ref, owner_kind, owner_id, reason, until, held_at) VALUES (?, 'operator', ?, 'Its project is being deleted', NULL, ?)
@@ -395,18 +328,14 @@ export async function deleteProject(store, repo, options) {
             if (again.length > 0)
                 throw new RunningError(again);
             d = doomed(db, repo);
-            // Checked when the deletion commits, so the order of the deletes doesn't matter; what's left dangling is below.
             db.exec("PRAGMA defer_foreign_keys = ON");
             const before = new Set(db.prepare("PRAGMA foreign_key_check").all().map(row => `${String(row["table"])}:${String(row["rowid"])}`));
-            // History tables refuse deletes; the project's own history goes with it, and their guards come straight back.
             const guards = db.prepare(`SELECT name, sql FROM sqlite_master WHERE type = 'trigger' AND sql LIKE '%RAISE(ABORT%' AND sql NOT LIKE '%AFTER%'`).all()
                 .map(row => ({ name: String(row["name"]), sql: String(row["sql"]) }))
                 .filter(one => ![...KEPT].some(table => new RegExp(`\\bON\\s+${table}\\b`, "i").test(one.sql)));
             for (const guard of guards)
                 db.exec(`DROP TRIGGER "${guard.name}"`);
             rows = deleteRows(store, repo, d, options.now);
-            // Anything else that pointed at the project's rows: a pointer that may be empty is emptied (another project's
-            // row keeps everything else); a row that can't exist without it goes too. Never the ledger.
             for (let pass = 0; pass < 8; pass++) {
                 const dangling = db.prepare("PRAGMA foreign_key_check").all()
                     .filter(row => !before.has(`${String(row["table"])}:${String(row["rowid"])}`) && row["rowid"] != null && !KEPT.has(String(row["table"])));
@@ -431,7 +360,6 @@ export async function deleteProject(store, repo, options) {
             return { ok: false, reason: "running", said: `Nothing was deleted: ${error.running.join(", ")}. Stop it, then try again.`, running: error.running };
         return { ok: false, reason: "failed", said: `Nothing was deleted from the database: ${error instanceof Error ? error.message : String(error)}.` };
     }
-    // The runs' evidence files, each in its own folder named for the run.
     if (options.evidenceRoot !== null) {
         for (const runId of d.runs) {
             const folder = resolve(options.evidenceRoot, String(runId));
@@ -439,7 +367,7 @@ export async function deleteProject(store, repo, options) {
                 if (lstatSync(folder).isDirectory() && inside(options.evidenceRoot, folder))
                     rmSync(folder, { recursive: true, force: true });
             }
-            catch { /* never written, or already gone */ }
+            catch { }
         }
     }
     return { ok: true, repo, removed: { ...held, checkouts: Math.max(held.checkouts, git_.checkouts), branches: git_.branches, rows }, left: git_.left, ledgerId };

package/dist/project-demo.js

@@ -1,16 +1,7 @@
-/**
- * A project's own demo or dev server (review 827): the one address a scout
- * may reach that is not on the public internet, so it can take screenshots
- * of the project's UI. An approver sets it with
- * `toolroll project demo --repo <p> <url>|off`; it is kept in a small file
- * beside the database, like a project's builds-at-once number, and recorded
- * in the ledger as before → after. A project without one has none.
- */
 import { lstatSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { randomBytes } from "node:crypto";
 import { dirname, join } from "node:path";
 export const projectDemoPath = (databaseFile) => join(dirname(databaseFile), "project-demo.json");
-/** A demo URL as typed: an http(s) address with no sign-in details, at most 500 characters, or null. */
 export function parseDemoUrl(value) {
     const typed = value.trim();
     if (typed === "" || typed.length > 500)
@@ -27,7 +18,6 @@ export function parseDemoUrl(value) {
         return null;
     }
 }
-/** Every saved demo URL, by canonical project path. An unreadable file reads as none saved. */
 export function savedProjectDemos(databaseFile) {
     const saved = new Map();
     const file = projectDemoPath(databaseFile);
@@ -46,15 +36,12 @@ export function savedProjectDemos(databaseFile) {
         }
     }
     catch {
-        // A damaged file never stops a scout: it simply has no demo to open.
     }
     return saved;
 }
-/** The project's demo URL, or null when it has none. */
 export function projectDemoUrl(databaseFile, repo) {
     return savedProjectDemos(databaseFile).get(repo) ?? null;
 }
-/** Save (or, with null, clear) one project's demo URL atomically; returns it before and after. */
 export function saveProjectDemo(databaseFile, repo, url) {
     const saved = savedProjectDemos(databaseFile);
     const before = saved.get(repo) ?? null;

package/dist/project-file.js

@@ -1,7 +1,5 @@
 import { realpathSync, statSync } from "node:fs";
 import { isAbsolute, join, relative } from "node:path";
-/** A project file a script names, if it is one: inside the project, and there. Kept free of the runner's imports so a
- * flow's "runs on its own" grant (flow-unattended.ts) resolves the very file a script would run. */
 export function projectFile(root, path) {
     if (path === "" || isAbsolute(path) || path.split(/[\\/]/).includes(".."))
         return null;

package/dist/project-identity.js

@@ -1,45 +1,18 @@
-/**
- * Project identities as the console uses them, without touching a person's folders on its thread.
- *
- * A project's identity is its real path (project.ts canonicalProject). Resolving one reads the folder, and a folder can
- * stop answering (folder-look.ts), so the console never resolves one on a page or at startup on its own thread, and
- * never waits for one before it answers:
- *
- * - `hot` (display and grouping only): the last answer, else the path as saved. Nothing is started by asking.
- * - `strict` (visibility and authorization): only a resolved identity; an unknown one fails closed until the next
- *   refresh resolves it, so a stored path that leads outside its root never passes on its spelling.
- * - `vouched` (a path a request names): only a path whose identity is known, or one that is exactly a saved identity.
- *   Anything else is refused this time and resolved by the next background pass, never resolved inline.
- * - `resolveNow` (an action that needs a path checked now, a POST): resolved off the thread under the look's deadline.
- * - `refresh` (the console's background pass, the first started right after it listens): resolves what was asked about
- *   and what has gone stale. The console answers before any of it does; until a path answers it fails closed.
- *
- * An embedder or test that passes no identities gets `syncProjectIdentities`: the old synchronous reads, unchanged.
- */
 import { resolve } from "node:path";
 import { insideFolder } from "./folder-gate.js";
 import { lookIdentities } from "./folder-look.js";
 import { canonicalProject } from "./project.js";
-/** How long an answer stands before the background pass resolves the path again. */
 const STALE_MS = 60_000;
-/** How long an answer vouches that its folder answers, for `answering`: past it (the background pass every 30 s
- * renews it each minute), a synchronous read waits for the next look. */
 const ANSWERING_MS = 3 * STALE_MS;
-/** How many folders a pass looks at side by side when they're looked at one by one (within FOLDER_LOOK_CHILDREN). */
 export const IDENTITY_LOOKS = 4;
 export function projectIdentities(look = {}, now = Date.now) {
-    /** Each answer with when the look that answered it started (folder-look.ts `started`, kept across joined looks): an
-     * answer from a look started earlier never overwrites one from a look started later. */
     const answers = new Map();
     const wanted = new Set();
-    /** Paths whose last look didn't answer: looked at only on their own (joining a look still under way), never in a
-     * batch, so one folder that never answers holds one child, not one per differently made-up batch. */
     const suspect = new Set();
     let generation = 0;
     const known = (path) => answers.get(resolve(path))?.real;
     const put = (key, real, at, seq) => {
         const before = answers.get(key);
-        // A known identity that changes (or goes) moves authority: anything decided on the old one is out of date.
         if (before !== undefined && before.real !== real)
             generation++;
         answers.set(key, { real, at, seq });
@@ -48,12 +21,10 @@ export function projectIdentities(look = {}, now = Date.now) {
         const at = now();
         for (const [path, real] of found) {
             const key = resolve(path);
-            // Superseded: a later lookup already answered for this path. Its real path's entry goes with it.
             if ((answers.get(key)?.seq ?? -1) > seq)
                 continue;
             put(key, real, at, seq);
             wanted.delete(key);
-            // A real path is its own identity.
             if (real !== null && (answers.get(real)?.seq ?? -1) <= seq)
                 put(real, real, at, seq);
         }
@@ -66,7 +37,6 @@ export function projectIdentities(look = {}, now = Date.now) {
             return "no-answer";
         }
         suspect.delete(key);
-        // No start known: older than every answer, so it only fills what nothing answered yet.
         store(looked.value, looked.started ?? 0);
         return answers.get(key)?.real ?? null;
     };
@@ -93,8 +63,6 @@ export function projectIdentities(look = {}, now = Date.now) {
             else
                 alone.push(...batched);
         }
-        // One folder that doesn't answer mustn't hold the others: each on its own, a few at a time (inside the looks'
-        // child cap, leaving room for a person's actions), each under its deadline, each stored as soon as it answers.
         let missed = false;
         const worker = async () => {
             for (let one = alone.shift(); one !== undefined; one = alone.shift())
@@ -135,7 +103,6 @@ export function projectIdentities(look = {}, now = Date.now) {
         resolveNow,
         generation: () => generation,
         refresh: paths => {
-            // One pass at a time: a pass asked for while another runs waits for it, then resolves only what is still due.
             const asked = [...paths];
             const pass = passes.then(() => refreshNow(asked));
             passes = pass.then(() => undefined, () => undefined);
@@ -144,8 +111,6 @@ export function projectIdentities(look = {}, now = Date.now) {
         answering: path => {
             const when = now();
             const recent = (at) => when - at < ANSWERING_MS;
-            // Decided on real paths only. First the spelling: a path under an answered spelling (the longest) is read where
-            // that answer says it leads, and only while that answer is recent, since a link can be pointed elsewhere.
             let real = resolve(path);
             let spelled = null;
             for (const [key, answer] of answers) {
@@ -157,11 +122,9 @@ export function projectIdentities(look = {}, now = Date.now) {
                     return false;
                 real = resolve(spelled.real, `.${real.slice(spelled.key.length)}`);
             }
-            // A folder whose last look didn't answer holds back every read inside where it leads, whatever older answer stands.
             for (const key of suspect)
                 if (insideFolder(real, answers.get(key)?.real ?? key))
                     return false;
-            // Otherwise the nearest real folder an answer names decides, by its newest answer; "/" vouches for nothing below it.
             let nearest = null;
             for (const answer of answers.values()) {
                 const folder = answer.real;
@@ -174,7 +137,6 @@ export function projectIdentities(look = {}, now = Date.now) {
         },
     };
 }
-/** The synchronous reads, as before: for embedders and tests that pass no identities. */
 export function syncProjectIdentities() {
     return {
         hot: path => canonicalProject(path) ?? path,
@@ -187,9 +149,6 @@ export function syncProjectIdentities() {
         answering: () => true,
     };
 }
-/** The console's folder gate (folder-gate.ts): its own data folders (the database's, evidence, build checkouts) are read
- * freely when the console names them; a path read from a file a build can write (`pointer`), and anything else, only
- * while `answering` vouches for where it leads. */
 export function consoleFolderGate(identities, own) {
     const folders = [...new Set(own.filter((one) => typeof one === "string" && one !== "").map(one => resolve(one)))];
     return (path, pointer) => (!pointer && folders.some(folder => insideFolder(path, folder))) || identities.answering(path);