toolroll 0.9.103 → 0.9.105

package/dist/local-owner.js

@@ -1,26 +1,14 @@
-/**
- * Local mode's restricted principal (docs: easy-start plan C1). A laptop install made by `up --laptop` starts with one
- * owner who has no password: the browser and the terminal UI drive it as the **local owner**, a principal that may do
- * the everyday acts below and nothing that creates or widens a way in. Everything else stays with **full** authority
- * (a password typed now, an identity-provider sign-in, an API token).
- *
- * Types and pure helpers only: enforcement (route marks, the chat confirm gate, the prover's order) reads these.
- */
 import { AsyncLocalStorage } from "node:async_hooks";
+import { currentActor } from "./actor.js";
+import { activeRemote } from "./remote-run.js";
 export const AUTHORITIES = Object.freeze(["full", "local-owner"]);
-/** A runtime string as an authority; anything else is null (never "full" by default). */
 export function authorityOf(value) {
     return value === "full" || value === "local-owner" ? value : null;
 }
-/**
- * The acts a local owner may do (plan C1). Ids only: each surface (a route row, a chat action, a CLI command) names
- * the act it is, and an act not in this list is refused to a local owner.
- */
 export const LOCAL_OWNER_ACTS = Object.freeze([
     "file-task",
     "lead-send",
     "approve-plan",
-    // A fast start: file and approve in one step (fast-start.ts). Everything else this act could reach is refused.
     "build-now",
     "answer-question",
     "stop-run",
@@ -34,30 +22,19 @@ export const LOCAL_OWNER_ACTS = Object.freeze([
     "mark-seen",
     "watch-agent",
     "read",
-    // Results routing (docs/plans/results-routing.md, Authority): lowering only — turning an earned rule off (or
-    // dropping a paused one), and saying Not now to a suggestion (or switching suggestions off). The writer
-    // (route-store.ts proveRuleDoor) checks the in-flight act is exactly the one it needs.
     "routing-turn-off",
     "dismiss-suggestion",
-    // Slice 3: stopping a trial of a cheaper model only lowers (proveRuleDoor checks this exact act).
     "trial-stop",
-    // The code map (docs/plans/code-map.md §5): on or off for one project only, the same kind of setting as the default
-    // agent. Never a refresh, and never the end of a holdout (code-map-acts.ts refuses those by name).
     "code-map-switch",
-    // Learning loops (D3): deciding a lesson note or a clean-up of project memory. The writers (memory-pass.ts decideProposal,
-    // memory-tidy.ts) check this exact act; instruction proposals stay with full authority.
     "memory-review",
+    "request-plan",
+    "retry-build",
+    "view-preference",
 ]);
 const ACT_SET = new Set(LOCAL_OWNER_ACTS);
-/** Whether a runtime string names an act a local owner may do. */
 export function localOwnerAct(value) {
     return typeof value === "string" && ACT_SET.has(value);
 }
-/**
- * Every lead proposal kind, decided for the local owner. A new kind fails to compile here until someone decides it
- * (like METHOD_IS_PERSON in person-proof.ts). `action` and `task_action` are allowed only for an operation that is a
- * LOCAL_OWNER_ACTS act; the confirm gate checks that operation too.
- */
 export const LOCAL_OWNER_PROPOSALS = Object.freeze({
     task: "allow",
     answer: "allow",
@@ -75,12 +52,7 @@ export const LOCAL_OWNER_PROPOSALS = Object.freeze({
     review: "refuse",
     control: "refuse",
 });
-/** Kinds whose allow also needs the operation itself to be a local-owner act. */
 export const OPERATION_KINDS = new Set(["action", "task_action"]);
-/**
- * Whether a local owner may confirm a proposal of this kind. A runtime string: an unknown kind is refused. For
- * `action`/`task_action`, `act` must be the local-owner act the operation is (null or unknown refuses).
- */
 export function localOwnerMayConfirm(kind, act = null) {
     if (typeof kind !== "string" || !Object.prototype.hasOwnProperty.call(LOCAL_OWNER_PROPOSALS, kind))
         return false;
@@ -88,52 +60,30 @@ export function localOwnerMayConfirm(kind, act = null) {
         return false;
     return OPERATION_KINDS.has(kind) ? localOwnerAct(act) : true;
 }
-/**
- * Whether a local-owner session or link still stands against local mode as read now: on, at the generation it was
- * bound to, for the same owner. Pure: the caller reads `mode` in the same transaction as the act.
- */
 export function localBindingStands(mode, binding) {
     return mode !== null && mode.enabled && binding.localGeneration !== null && mode.generation === binding.localGeneration && mode.owner === binding.account;
 }
 const localOwnerScope = new AsyncLocalStorage();
-/** The local owner this async chain acts as, or null (full authority, or nobody). Work that outlived its request still
- * reads it (so it is never mistaken for full authority); `localOwnerInFlight` says whether it may still prove anything. */
 export function currentLocalOwner() {
     return localOwnerScope.getStore() ?? null;
 }
-/** Whether a local owner's act is still in its request (or its terminal command): only then may it prove or write. */
 export function localOwnerInFlight(principal) {
     return principal.request === null || !principal.request.ended;
 }
-/** Run `body` as a local owner (the console's admission and the CLI's dispatch only). */
 export function asLocalOwner(principal, body) {
     return localOwnerScope.run(Object.freeze({ ...principal }), body);
 }
-/**
- * Narrow the current local owner to one act for `body` (a chat card's own act inside the confirm route). Outside a
- * local owner's chain it changes nothing. It can only ever name an allowlisted act: a caller passing null refuses.
- */
 export function withLocalAct(act, body) {
     const current = currentLocalOwner();
     return current === null ? body() : localOwnerScope.run(Object.freeze({ ...current, act }), body);
 }
 const terminalRequest = new AsyncLocalStorage();
-/**
- * The terminal UI's door (plan C3): run CLI commands (`runOperate`) inside `fn` as the local owner. runOperate binds the
- * owner from local mode as it reads it when its database opens, and refuses every command not marked for the local owner
- * (surface.ts LOCAL_ALLOW). Never read from argv or the environment.
- */
 export function runAsLocalOwner(fn) {
     return terminalRequest.run(true, fn);
 }
-/** Whether this chain asked to run commands as the local owner (runOperate reads it; nothing else should). */
 export function localOwnerRequested() {
     return terminalRequest.getStore() === true;
 }
-/**
- * The act each lead proposal kind is when a local owner confirms it (null: refused, as LOCAL_OWNER_PROPOSALS says).
- * `action` and `task_action` take their operation's act instead (CHAT_ACTION_LOCAL_ACTS, CHAT_TASK_ACTION_LOCAL_ACTS).
- */
 export const PROPOSAL_LOCAL_ACTS = Object.freeze({
     task: "file-task",
     answer: "answer-question",
@@ -151,8 +101,6 @@ export const PROPOSAL_LOCAL_ACTS = Object.freeze({
     review: null,
     control: null,
 });
-/** Every chat action (chat-actions.ts CHAT_ACTIONS), decided for the local owner: its act, or null (refused). A new
- * action fails to compile here until someone decides it. */
 export const CHAT_ACTION_LOCAL_ACTS = Object.freeze({
     skill_import: null, skill_enable: null, skill_disable: null, skill_restore: null, skill_test: null,
     knowledge_instructions: null, knowledge_save: null, knowledge_remove: null, knowledge_restore: null,
@@ -165,26 +113,20 @@ export const CHAT_ACTION_LOCAL_ACTS = Object.freeze({
     subagent_create: null, subagent_soul: null, subagent_state: null, subagent_note: null, subagent_ask: null,
     subagent_answer: null, subagent_tools: null, subagent_memory: null, subagent_routine: null, subagent_undo: null,
     kit_setup: null, decision_record: null, decision_retire: null, lead_about_you: null,
-    // Chat and console parity: decided one by one, and none is a local owner's act yet. A password opens them.
     mode_revoke: null, flow_unattended_off: null, flow_archive: null, provider_resume: null, worker_note: null, lead_identity: null,
     task_archive: null, task_restore: null, incident_resolve: null, memory_decide: null,
     finding_send: null, finding_resend: null,
     task_reopen: null, revision_accept: null, revision_reject: null, flow_unattended: null,
-    // Results routing: Not now only lowers (the rule door checks this exact act).
     suggestion_not_now: "dismiss-suggestion",
-    // Stopping a trial only lowers (the rule door checks this exact act).
     trial_stop: "trial-stop",
-    // On or off for one project; never the end of a holdout.
     code_map_switch: "code-map-switch",
     code_map_holdout_end: null,
     scope_approve: "approve-plan",
     result_accept: "complete-task",
     task_cancel: "stop-run",
     task_resume: "resume-run",
-    // A Start card: the fast start's own act (approve() allows it only with a fast marker).
     task_start: "build-now",
 });
-/** Every task card operation (chat-task-actions.ts), decided for the local owner. */
 export const CHAT_TASK_ACTION_LOCAL_ACTS = Object.freeze({
     stop: "stop-run",
     resume: "resume-run",
@@ -196,10 +138,6 @@ export const CHAT_TASK_ACTION_LOCAL_ACTS = Object.freeze({
     run_full_checks: null,
     add_tests: null,
 });
-/**
- * The act a saved proposal is for the local owner, read from its kind and (for operation kinds) its saved operation;
- * null refuses. A runtime read of saved JSON: anything unknown is null.
- */
 export function proposalLocalAct(kind, operation) {
     if (typeof kind !== "string" || !Object.prototype.hasOwnProperty.call(PROPOSAL_LOCAL_ACTS, kind))
         return null;
@@ -207,24 +145,15 @@ export function proposalLocalAct(kind, operation) {
     const act = kind === "action" ? own(CHAT_ACTION_LOCAL_ACTS) : kind === "task_action" ? own(CHAT_TASK_ACTION_LOCAL_ACTS) : PROPOSAL_LOCAL_ACTS[kind];
     return act !== null && localOwnerMayConfirm(kind, act) ? act : null;
 }
-/** The words every local-owner refusal says, and where it leads: set a first password, or sign in with the one set. */
 export function localOwnerRefusal(passwordSet, returnTo) {
     return passwordSet
         ? { message: "Sign in with your password to do this.", action: "Sign in with your password", href: `/login?return=${encodeURIComponent(returnTo)}` }
-        // /password/set continues to the refused page once the password is set (http.ts passwordSetNext re-checks it there).
         : { message: "Set a password to do this.", action: "Set a password", href: returnTo === "/" ? "/password/set" : `/password/set?next=${encodeURIComponent(returnTo)}` };
 }
-/** Whether local mode is on now (absent is off). Read straight from its one row, so the store's own checks can use it. */
 export function localModeOn(store) {
     const row = store.handle.prepare("SELECT enabled FROM local_mode WHERE id = 1").get();
     return row !== undefined && Number(row["enabled"]) === 1;
 }
-/**
- * The write-time re-check (plan C1): a local owner acting now still stands — local mode on, at the generation it was
- * bound to, for the same owner; the owner an active approver at the account generation it was bound to; and (a browser)
- * its session still saved. Read in the caller's transaction: Store.transact runs it inside every write a local owner's
- * chain makes, and the prover runs it inside the approval's own transaction.
- */
 export function localOwnerStandsNow(store, principal) {
     const mode = store.handle.prepare("SELECT owner, generation, enabled FROM local_mode WHERE id = 1").get();
     if (mode === undefined || Number(mode["enabled"]) !== 1 || Number(mode["generation"]) !== principal.localGeneration || String(mode["owner"]) !== principal.account)
@@ -234,8 +163,14 @@ export function localOwnerStandsNow(store, principal) {
         return false;
     return principal.sessionHash === null || store.webSession(principal.sessionHash) !== null;
 }
-/** What a local owner's write hears when it no longer stands (local mode turned off or moved, the owner changed, the
- * session ended). */
-export const LOCAL_OWNER_LAPSED = "This local sign-in no longer stands. Run `toolroll open` to sign in again.";
-/** What widening a launch's confinement hears while local mode is on (plan C5). */
+export const LOCAL_OWNER_LAPSED = "This local sign-in no longer stands. Run `toolroll` to sign in again.";
 export const LOCAL_MODE_CONFINES = "Turn off local mode first.";
+export const LOCAL_OWNER_ELSEWHERE = "This sign-in works only on the computer running Toolroll. To use Toolroll from here, set a password on that computer (run `toolroll password set`) and sign in with it.";
+export function localActNow(store, act) {
+    if (activeRemote() !== null || currentActor()?.lead === true)
+        return null;
+    const local = currentLocalOwner();
+    if (local === null || local.act !== act || !localOwnerInFlight(local) || !localOwnerStandsNow(store, local))
+        return null;
+    return local;
+}

package/dist/log.js

@@ -1,11 +1,3 @@
-/**
- * One line per event on stderr (v99), where the service manager keeps the
- * log. Plain by default ("2026-09-27T17:00:00.000Z error serve.error path=/x
- * error=…"); with TOOLROLL_LOG_FORMAT=json, one JSON object per line
- * for a log shipper. Fields are facts about the event, never a request body,
- * a password or a token; values are cut to 500 characters and key-shaped text
- * is blanked.
- */
 import { scanForSecrets } from "./evidence.js";
 import { envValue } from "./names.js";
 const clean = (value) => {

package/dist/login-secrets.js

@@ -1,30 +1,13 @@
-/**
- * Where Toolroll keeps the saved credentials beside its database: a reserved owner-only folder, `.toolroll-secrets`,
- * that every agent fence denies whole (agent-fence.ts). It is made before any agent launches, so a credential written
- * into it later (the first saved login, written while a build already runs) is behind a fence that was fixed at launch.
- * A file beside the database that appears after launch is not: bubblewrap can't deny a path that isn't there, and a
- * fence built from a listing can't name one either.
- *
- * The saved login moved here from `up-login.txt` directly beside the database. Readers look here first and then at
- * the old place; the next `up` moves an old file in (migrateLegacyLogin), never through a link, never readable by
- * anyone else on the way.
- */
 import { randomBytes } from "node:crypto";
 import { closeSync, constants as fsConstants, fstatSync, fsyncSync, linkSync, lstatSync, mkdirSync, openSync, readFileSync, realpathSync, unlinkSync, writeSync } from "node:fs";
 import { join, resolve } from "node:path";
-/** The reserved folder's name, beside the database. Toolroll's own; nothing else belongs there. */
 export const SECRETS_DIR = ".toolroll-secrets";
-/** The saved login's file name, inside the folder (and, from older versions, directly beside the database). */
 export const LOGIN_FILE_NAME = "up-login.txt";
-/** The largest saved login read. */
 const LOGIN_LIMIT = 8192;
 export class UntrustedSecretsFolder extends Error {
 }
-/** The reserved folder for a state folder (the database's folder), by name. */
 export const secretsDirOf = (stateDir) => join(stateDir, SECRETS_DIR);
-/** Where the saved login lives now. */
 export const loginFileOf = (stateDir) => join(secretsDirOf(stateDir), LOGIN_FILE_NAME);
-/** Where older versions saved it: directly beside the database. */
 export const legacyLoginFileOf = (stateDir) => join(stateDir, LOGIN_FILE_NAME);
 const present = (path) => {
     try {
@@ -35,11 +18,6 @@ const present = (path) => {
         return false;
     }
 };
-/**
- * Make the reserved folder if it isn't there (owner-only), and prove it is a real folder of this user's, owner-only,
- * reached by no link. Returns its path. Throws UntrustedSecretsFolder when something else holds the name: nothing is
- * written there then, and the fence still denies the name.
- */
 export function ensureSecretsDir(stateDir) {
     let base;
     try {
@@ -63,14 +41,10 @@ export function ensureSecretsDir(stateDir) {
     }
     return folder;
 }
-/** The saved-login file to write: inside the reserved folder, made and proven first. Throws when it can't be. */
 export function writableLoginFile(stateDir) {
     ensureSecretsDir(stateDir);
-    // By the name the caller knows the state folder by (it is shown to the person); the folder under it was just proven.
     return loginFileOf(stateDir);
 }
-/** The saved-login file to read: the reserved folder's when anything is there, else the old place's when anything is
- * there, else the reserved folder's (nothing saved yet). */
 export function savedLoginFile(stateDir) {
     const current = loginFileOf(stateDir);
     if (present(current))
@@ -78,8 +52,6 @@ export function savedLoginFile(stateDir) {
     const legacy = legacyLoginFileOf(stateDir);
     return present(legacy) ? legacy : current;
 }
-/** The bytes of a file that is a regular file of this user's, opened without following a link and without blocking on
- * a FIFO, of at most `limit` bytes; null otherwise. */
 function ownRegularBytes(path, limit) {
     let fd = null;
     try {
@@ -104,19 +76,12 @@ const fsyncFolder = (folder) => {
         fd = openSync(folder, fsConstants.O_RDONLY);
         fsyncSync(fd);
     }
-    catch { /* some filesystems refuse a folder fsync */ }
+    catch { }
     finally {
         if (fd !== null)
             closeSync(fd);
     }
 };
-/**
- * Move a saved login from directly beside the database into the reserved folder. The new file is a fresh one (never
- * the old file's inode, so no other name for that file — a hard link — reaches it), created owner-only (0600) inside
- * the owner-only folder and published whole under its name (written to a private temporary name, synced, then
- * hard-linked in, which fails rather than replace anything), and the old one is removed only after. A link or
- * anything other than this user's own regular file at the old name is never followed or moved. Never throws.
- */
 export function migrateLegacyLogin(stateDir) {
     const from = legacyLoginFileOf(stateDir);
     let held;
@@ -142,7 +107,6 @@ export function migrateLegacyLogin(stateDir) {
         return { kind: "refused", from, reason: `${LOGIN_FILE_NAME} beside the database changed, is too large, or is not your own regular file` };
     }
     const removeOld = () => {
-        // Only the file that was read: a replacement since then stays for the person.
         try {
             const now = lstatSync(from);
             if (!now.isFile() || now.dev !== old.dev || now.ino !== old.ino)
@@ -188,7 +152,7 @@ export function migrateLegacyLogin(stateDir) {
         try {
             unlinkSync(temporary);
         }
-        catch { /* already gone */ }
+        catch { }
     }
     removeOld();
     return { kind: "moved", from, to };

package/dist/machine-check.js

@@ -1,4 +1,3 @@
-/** The words for a machine-run check now running on `runId`, or null when an agent builds this task (or nothing runs). */
 export function machineCheckWords(store, taskId, runId, release, now) {
     if (runId === null || store.getScope(taskId)?.candidate == null)
         return null;
@@ -20,7 +19,6 @@ export function machineCheckWords(store, taskId, runId, release, now) {
         : at.step === "check" ? `Running the release check · step ${at.index} of ${at.of}` : `${at.name} · step ${at.index} of ${at.of}`;
     return `${head}${progress === null || progress === "" ? "" : ` · ${progress}`}${elapsed}`;
 }
-/** Whether this task's builds are the machine's own checks (a prepared candidate), where no agent runs. */
 export function machineChecked(store, taskId) {
     return store.getScope(taskId)?.candidate != null;
 }

package/dist/machine-identity.js

@@ -1,39 +1,11 @@
-/**
- * Which computer is "this one" for process custody (process witnesses, workspace notes, quarantine journals, a coding
- * agent's custody, runner records, eval campaigns).
- *
- * The network hostname is not an identity: on a Mac with no HostName set, os.hostname() follows the network
- * ("Studio-A.local" on one network, "studio-a.localdomain" on another). A witness recorded under the
- * old name then read as another computer's forever, and a finished build waited on that computer to confirm it
- * stopped (runs 3312 and 3313).
- *
- * So each witness carries this machine's stable id, read from the OS and hashed with a Toolroll-only prefix (the raw
- * id is never stored):
- *
- *   darwin  IOPlatformUUID (ioreg -rd1 -c IOPlatformExpertDevice): fixed per machine
- *   linux   /etc/machine-id (or /var/lib/dbus/machine-id): fixed per installation; a container reads as unknown, since
- *           containers made from one image can share it
- *   win32   HKLM\SOFTWARE\Microsoft\Cryptography MachineGuid
- *
- * THE RULE (isThisMachine): a witness with an id is this machine's exactly when the id equals ours, and never when ours
- * is unknown. A witness without one (written before v150, or by a process that couldn't read its id) is this
- * machine's when its host string is one of this machine's own names: os.hostname() as it reads now, the names macOS
- * configures for it (scutil HostName, LocalHostName + ".local"), and the hostnames recorded beside this machine's own
- * id (machine_host_alias, written only by a process that read that id here, with the hostname it read here at the
- * same moment). No name ever enters the set from a witness, a note, a runner record or anything another computer
- * wrote, so another computer can only match by holding one of this machine's own names: the same coincidence the
- * plain hostname comparison always accepted, and never for a witness that carries a different id.
- */
 import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import { existsSync, readFileSync } from "node:fs";
 import { hostname } from "node:os";
 const defaultRun = (file, args) => execFileSync(file, args, { encoding: "utf8", timeout: 3000, stdio: ["ignore", "pipe", "ignore"] });
-/** The stored form of a raw OS id: hashed under a Toolroll-only prefix, so the record never holds the raw id. */
 export function hashMachineId(source, raw) {
     return createHash("sha256").update(`toolroll machine identity v1\0${source}\0${raw.trim().toLowerCase()}`).digest("hex").slice(0, 32);
 }
-/** Read this machine's id from the OS, never cached here (machineIdentity() caches it). */
 export function readMachineIdentity(readers = {}) {
     const platform = readers.platform ?? process.platform;
     const readFile = readers.readFile ?? ((path) => readFileSync(path, "utf8"));
@@ -47,8 +19,6 @@ export function readMachineIdentity(readers = {}) {
             return { ok: true, id: hashMachineId("darwin-platform-uuid", raw), source: "darwin-platform-uuid" };
         }
         if (platform === "linux") {
-            // Containers built from one image can carry the same machine-id: there the id proves nothing, and the host
-            // name (the container's own) decides, as it always did.
             if (exists("/.dockerenv") || exists("/run/.containerenv"))
                 return { ok: false, reason: "container", detail: "a container's machine-id can be shared with other containers" };
             let raw = null;
@@ -57,7 +27,7 @@ export function readMachineIdentity(readers = {}) {
                     raw = readFile(path).trim();
                     break;
                 }
-                catch { /* the next place */ }
+                catch { }
             }
             if (raw === null)
                 return { ok: false, reason: "unreadable", detail: "no machine-id could be read" };
@@ -78,8 +48,6 @@ export function readMachineIdentity(readers = {}) {
         return { ok: false, reason: "unreadable", detail: `the machine identity could not be read: ${error instanceof Error ? error.message : String(error)}` };
     }
 }
-/** The names macOS configures for this machine (not the network's): HostName when set, and LocalHostName.local
- * (Bonjour keeps it unique on its network). Empty elsewhere or when scutil can't answer. */
 export function readConfiguredHostNames(readers = {}) {
     if ((readers.platform ?? process.platform) !== "darwin")
         return [];
@@ -104,27 +72,21 @@ export function readConfiguredHostNames(readers = {}) {
 }
 let cachedIdentity = null;
 let cachedConfigured = null;
-/** Hostnames recorded beside this machine's id (machine_host_alias), learned from this process's store. */
 const remembered = new Map();
-/** This machine's identity, read once per process. */
 export function machineIdentity() {
     if (cachedIdentity === null)
         cachedIdentity = readMachineIdentity();
     return cachedIdentity;
 }
-/** The id to stamp on a new witness, or null when this machine's id is unknown. */
 export function currentMachineId() {
     const identity = machineIdentity();
     return identity.ok ? identity.id : null;
 }
-/** Tests only: pin (or clear, with null) this process's machine id and configured names, and forget remembered names. */
 export function injectMachineIdentity(identity, configured = identity === null ? null : []) {
     cachedIdentity = identity;
     cachedConfigured = configured;
     remembered.clear();
 }
-/** Note hostnames recorded beside `id` in this machine's own records. Names for another id are kept apart and never
- * read as this machine's. */
 export function rememberHostAliases(id, hosts) {
     let set = remembered.get(id);
     if (set === undefined)
@@ -133,15 +95,11 @@ export function rememberHostAliases(id, hosts) {
         if (host !== "")
             set.add(host);
 }
-/** The names this machine is known by right now, from this machine alone: its hostname as it reads now and the
- * names macOS configures for it. What a new witness records beside its id. */
 export function liveHostAliases() {
     if (cachedConfigured === null)
         cachedConfigured = readConfiguredHostNames();
     return [...new Set([hostname(), ...cachedConfigured])];
 }
-/** This machine: its id (null when unknown) and every name it is known by: its live names, plus the names recorded
- * beside its id when the id is known. */
 export function thisMachine(extra = []) {
     const id = currentMachineId();
     const hosts = new Set(liveHostAliases());
@@ -153,14 +111,11 @@ export function thisMachine(extra = []) {
     }
     return { id, hosts: [...hosts] };
 }
-/** THE RULE (module comment): whether a witness names this machine. */
 export function isThisMachine(witness, here = thisMachine()) {
     if (witness.machineId !== null && witness.machineId !== undefined)
         return here.id !== null && witness.machineId === here.id;
     return here.hosts.includes(witness.host);
 }
-/** Whether a recorded host is the machine a caller named by `here`: exact, or, when `here` is this machine's hostname
- * as it reads now, any of this machine's names (a caller that passes another host, as a test does, compares exactly). */
 export function sameMachineHost(seen, here = hostname(), machineId) {
     if (machineId !== null && machineId !== undefined)
         return here === hostname() && isThisMachine({ host: seen, machineId });

package/dist/mailbox.js

@@ -1,20 +1,3 @@
-/**
- * Reading mail for Inbox triggers (v89).
- *
- * The mailbox is the same account emails are sent from (Settings → Email):
- * a mail server's IMAP address with the same sign-in, or a connected Google
- * account (IMAP with XOAUTH2). It is only ever read — opened read-only, and
- * nothing is marked, moved or deleted — and only mail that arrives after a
- * trigger is added becomes cards: the first check notes where the mailbox
- * stands, and each later one reads what came after (by IMAP UID, restarting
- * from "now" if the server renumbers the folder).
- *
- * Each message becomes plain words: the sender, the subject, and the body
- * without the quoted history of earlier messages. Automatic replies (out of
- * office, bounces) are left out, so a flow that answers mail can't end up
- * answering machines. The card keeps the message's ID so a Send email step
- * replying to the sender stays in the same thread.
- */
 import { googleAccessToken, googleConnected } from "./google-mail.js";
 import { readEmailSettings } from "./email-settings.js";
 const BODY_CHARS = 4000;
@@ -24,12 +7,9 @@ export function mailCursorOf(text) {
     return match === null ? null : { validity: match[1], uid: Number(match[2]) };
 }
 export const mailCursorText = (at) => `${at.validity}:${at.uid}`;
-// ------------------------------------------------------------- the account
-/** Whether Inbox triggers can read mail: a connected Google account, or a mail server with its IMAP address. */
 export function mailboxReady(dir) {
     return googleConnected(dir) !== null || (readEmailSettings(dir)?.imap ?? null) !== null;
 }
-/** The mailbox to read, signed in: Google when connected, else the mail server's IMAP. */
 export async function mailboxAccess(dir, fetcher) {
     if (googleConnected(dir) !== null) {
         const token = await googleAccessToken(dir, fetcher);
@@ -42,19 +22,15 @@ export async function mailboxAccess(dir, fetcher) {
         return { ok: false, said: "Reading mail isn't set up yet. Add the IMAP address in Settings → Email.", permanent: false };
     return { ok: true, access: { host: server.imap.host, port: server.imap.port, secure: server.imap.secure, user: server.user || server.from, password: server.password }, address: server.from };
 }
-// ------------------------------------------------------------ the words
-/** The new part of a message: no quoted earlier messages, no signature, tidy lines. */
 export function freshText(text) {
     const lines = text.replace(/\r\n?/g, "\n").replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g, "").split("\n");
     const kept = [];
     for (const [index, line] of lines.entries()) {
         const trimmed = line.trim();
-        // Where the history starts: "On <date>, <name> wrote:", an Outlook header block, or a forwarded-message marker.
         if (/^On .{4,200} wrote:$/.test(trimmed) || /^-{2,}\s*(Original Message|Forwarded message)\s*-{2,}$/i.test(trimmed))
             break;
         if (/^From: .+$/.test(trimmed) && (lines[index + 1] ?? "").trim().match(/^(Sent|Date): /) !== null)
             break;
-        // A signature: the "-- " line and everything after it.
         if (line === "-- ")
             break;
         if (trimmed.startsWith(">"))
@@ -68,9 +44,7 @@ const header = (headers, name) => {
     const value = headers.get(name);
     return typeof value === "string" ? value : value !== undefined && value !== null && typeof value === "object" && "value" in value ? String(value.value) : "";
 };
-/** One raw message as plain words, and whether a machine sent it. */
 export async function readMail(uid, source) {
-    // The mail SDKs load when mail is read, not with every command that imports this module.
     const { simpleParser } = await import("mailparser");
     const parsed = await simpleParser(source, { skipImageLinks: true, skipTextToHtml: true, skipTextLinks: true });
     const sender = parsed.from?.value[0];
@@ -88,7 +62,6 @@ export async function readMail(uid, source) {
         subject: (parsed.subject ?? "").replace(/\s+/g, " ").trim().slice(0, 200), text: freshText(parsed.text ?? ""), automatic,
     };
 }
-// ------------------------------------------------------------ the reader
 function problemOf(error) {
     const code = String(error?.code ?? ""), text = String(error?.responseText ?? error?.message ?? "");
     if (error?.authenticationFailed === true || /AUTHENTICATIONFAILED|Invalid credentials|LOGIN failed|authentication failed/i.test(text))
@@ -101,14 +74,12 @@ function problemOf(error) {
         return { said: "Couldn't reach the mail server just now.", permanent: false };
     return { said: `The mail server said: ${text.split("\n")[0]?.slice(0, 160) || "something went wrong"}.`, permanent: false };
 }
-/** The production reader: one read-only IMAP visit. */
 export const readThroughImap = async (access, folder, after, limit) => {
     const { ImapFlow } = await import("imapflow");
     const client = new ImapFlow({
         host: access.host, port: access.port, secure: access.secure, logger: false, disableAutoIdle: true,
         auth: access.accessToken !== undefined ? { user: access.user, accessToken: access.accessToken } : { user: access.user, pass: access.password ?? "" },
         connectionTimeout: 15_000, greetingTimeout: 15_000, socketTimeout: 60_000,
-        // A password never travels unencrypted: without TLS from the start, STARTTLS is required.
         ...(access.secure ? {} : { doSTARTTLS: true }),
     });
     client.on("error", () => { });
@@ -120,7 +91,6 @@ export const readThroughImap = async (access, folder, after, limit) => {
             if (box === false)
                 return { ok: false, said: "That folder couldn't be opened.", permanent: false };
             const validity = String(box.uidValidity), last = Math.max(0, Number(box.uidNext) - 1);
-            // The first look, or a renumbered folder: note where it stands, and start from there.
             if (after === null || after.validity !== validity)
                 return { ok: true, at: { validity, uid: last }, mails: [], renumbered: after !== null, more: false };
             if (last <= after.uid)

package/dist/maintenance.js

@@ -1,5 +1,3 @@
-/** Serialized background maintenance. It schedules no agent work: callers
- * retain dispatch, ownership and recovery policy. Slow passes never overlap. */
 export function startMaintenance(args) {
     if (!Number.isSafeInteger(args.intervalMs) || args.intervalMs < 1 || args.intervalMs > 2_147_483_647) {
         throw new Error("maintenance interval must be an integer from 1 to 2147483647 milliseconds");
@@ -18,7 +16,7 @@ export function startMaintenance(args) {
             try {
                 args.onError(error);
             }
-            catch { /* Reporting cannot create an unhandled timer rejection. */ }
+            catch { }
         }).finally(() => { pending = null; });
         return pending;
     };