toolroll 0.9.33 → 0.9.34

package/dist/project-admission.js

@@ -0,0 +1,134 @@
+/**
+ * Adding and removing projects: the ONE road for the command line, the lead
+ * and the console's own "Add a project". A project is admitted when its
+ * folder is proved to be a Git repository, canonicalized to its checkout
+ * root, saved in the store's project list, and enrolled in the machine's
+ * locked project registry; a running `up` adopts it from there without a
+ * restart. Each change is one ledger row naming who made it and from where.
+ *
+ * Removing is reversible: the project leaves the lists and the builder, and
+ * its tasks, results and settings stay saved. Deleting everything Toolroll
+ * holds for a project is project-delete.ts, behind its own confirmation.
+ */
+import { statSync } from "node:fs";
+import { userInfo } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { run } from "./exec.js";
+import { canonicalProject, projectName, sameRepo } from "./project.js";
+import { addRepos, loadProjectRegistry, removeRepos, updateRepos } from "./repos.js";
+export const PROJECT_ADDED = "project added";
+export const PROJECT_REMOVED = "project removed";
+/** The checkout root a folder belongs to, canonical; never a shell. */
+export async function proveProjectRoot(path, exec = run) {
+    if (path.trim() === "" || path.length > 4096 || /[\x00-\x1f]/.test(path)) {
+        return { ok: false, reason: "unavailable", message: "Choose a valid project folder." };
+    }
+    const canonical = canonicalProject(path);
+    if (canonical === null)
+        return { ok: false, reason: "unavailable", message: `${path} isn't a folder on this computer.` };
+    const top = await exec("git", ["rev-parse", "--show-toplevel"], { cwd: canonical, timeoutMs: 5_000 });
+    const repo = top.code === 0 ? canonicalProject(top.stdout.trim()) : null;
+    if (repo === null)
+        return { ok: false, reason: "not-git", message: `${path} isn't a Git repository. Run git init there first, or choose a folder inside one.` };
+    return { ok: true, repo };
+}
+/**
+ * Admit one project. Idempotent: adding a saved project again changes
+ * nothing and writes no ledger row. The registry is written first, under
+ * its lock; the project row and its ledger row then commit together, so a
+ * retry after a failure finishes the job and records it exactly once.
+ */
+export async function admitProject(store, input) {
+    const proved = await proveProjectRoot(input.path, input.exec);
+    if (!proved.ok)
+        return proved;
+    const { repo } = proved;
+    let registryHad = true;
+    if (input.registryFile !== null) {
+        const before = await loadProjectRegistry(input.registryFile);
+        const enrolled = await updateRepos(input.registryFile, repos => addRepos(repos, [repo]));
+        if (!enrolled.ok)
+            return { ok: false, reason: enrolled.reason, message: `${projectName(repo)} wasn't added: ${enrolled.message}` };
+        registryHad = !("error" in before) && before.repos.includes(repo);
+    }
+    const added = store.transact(() => {
+        const rowHad = store.listProjects().some(one => one.path === repo);
+        store.upsertProject(repo, projectName(repo), input.now);
+        if (rowHad && registryHad)
+            return false;
+        store.recordAction({ at: input.now.toISOString(), actor: input.actor.label, repo, taskId: null, runId: null, action: PROJECT_ADDED, outcome: "added", source: "access", detail: `from ${input.actor.origin}` });
+        return true;
+    });
+    return { ok: true, repo, name: projectName(repo), added };
+}
+/**
+ * Remove one project from the lists and the builder. Its tasks, results and
+ * settings stay saved; adding it again brings it back. A path that isn't a
+ * saved project changes nothing.
+ */
+export async function releaseProject(store, input) {
+    const asked = canonicalProject(input.path) ?? resolve(input.path);
+    const loaded = input.registryFile === null ? { repos: [] } : await loadProjectRegistry(input.registryFile);
+    if ("error" in loaded)
+        return { ok: false, reason: "registry", message: loaded.error };
+    const entries = loaded.repos.filter(one => one === asked || sameRepo(one, asked));
+    const rows = store.listProjects().filter(one => one.path === asked || sameRepo(one.path, asked)).map(one => one.path);
+    const repo = entries[0] ?? rows[0] ?? asked;
+    if (entries.length === 0 && rows.length === 0)
+        return { ok: true, repo, name: projectName(repo), removed: false };
+    if (entries.length > 0 && input.registryFile !== null) {
+        const written = await updateRepos(input.registryFile, repos => removeRepos(repos, entries));
+        if (!written.ok)
+            return { ok: false, reason: written.reason, message: `${projectName(repo)} wasn't removed: ${written.message}` };
+    }
+    store.transact(() => {
+        for (const path of rows)
+            store.forgetProject(path);
+        store.recordAction({ at: input.now.toISOString(), actor: input.actor.label, repo, taskId: null, runId: null, action: PROJECT_REMOVED, outcome: "removed", source: "access", detail: `from ${input.actor.origin}` });
+    });
+    return { ok: true, repo, name: projectName(repo), removed: true };
+}
+/** The registry `up` watches: beside the database, so an isolated database never enrolls into another's list. */
+export function registryBeside(databaseFile) {
+    return join(dirname(databaseFile), "repos.json");
+}
+/**
+ * Who is adding from the command line. Running it on this computer against
+ * a database this user owns is the owner's authority; a lead token acts as
+ * `lead for <owner>`, and only for an owner who may manage every project.
+ * Any other credential is refused rather than read as the owner.
+ */
+export function commandLineActor(store, input) {
+    if (input.leadToken !== undefined) {
+        const lead = store.leadFor(input.leadToken);
+        if (lead === null)
+            return { ok: false, reason: "failed", message: "That lead token isn't valid (revoked, replaced, or its owner can no longer approve). The owner mints a new one with: toolroll lead token" };
+        if (!store.isInstanceOperator(lead.owner))
+            return { ok: false, reason: "failed", message: `${lead.owner} can't add or remove projects: their account is limited to listed projects.` };
+        return { label: `lead for ${lead.owner}`, origin: "lead" };
+    }
+    const uid = process.getuid?.();
+    if (uid !== undefined) {
+        const owner = statSync(input.databaseFile, { throwIfNoEntry: false })?.uid;
+        if (owner !== undefined && owner !== uid)
+            return { ok: false, reason: "failed", message: "Only the user who owns this Toolroll database, or its lead, can add or remove projects." };
+    }
+    return { label: input.user ?? userInfo().username, origin: "cli" };
+}
+/** Whether a builder is running now (its heartbeat is a minute apart), so an addition is in the console within seconds. */
+export function consoleRunning(store, now) {
+    return store.listRunners().some(one => one.retiredAt === null && now.getTime() - Date.parse(one.heartbeatAt) < 3 * 60_000);
+}
+/** The one plain line after an addition: where the project is now. */
+export function addedWords(name, added, running) {
+    const where = running ? "it is in the console now" : "it will be in the console when Toolroll starts (toolroll up)";
+    return added ? `Added ${name}; ${where}.` : `${name} was already added; ${where}.`;
+}
+/**
+ * Whether a registry entry carries an admission this boundary recorded:
+ * its project row. `up` adopts a project added after it started only with
+ * this record, so a hand-edited registry line is not authority by itself.
+ */
+export function admissionRecorded(store, repo) {
+    return store.listProjects().some(one => one.path === repo);
+}

package/dist/project-delete-ui.js

@@ -14,7 +14,7 @@ export const PROJECT_DELETE_CSS = `.project-settings,.project-delete{max-width:7
     `.project-settings button,.project-delete button{justify-self:start;min-height:36px;white-space:nowrap}.project-delete .actions a{min-height:36px;display:inline-flex;align-items:center}` +
     `.project-settings .builds-at-once{margin-top:20px}.project-settings .builds-at-once h2{font-size:1rem;margin:0 0 4px}.project-settings .builds-at-once form{margin-top:4px;gap:4px}` +
     `.project-settings .builds-at-once .builds-row{display:flex;gap:8px;align-items:stretch}.project-settings .builds-at-once input{width:5.5rem;min-height:44px;margin:0;box-sizing:border-box}.project-settings .builds-at-once button{min-height:44px;margin:0}` +
-    `.project-settings .builds-at-once .meta{margin:0}`;
+    `.project-settings .builds-at-once .meta{margin:0}.project-settings form.remove-project{margin-top:20px;gap:4px}.project-settings form.remove-project button{min-height:44px}.project-settings form.remove-project .meta{margin:0}`;
 /** Builds at once: one number, one Save. The worker's cap is said only when it lowers the number. */
 function buildsHtml(view, csrf) {
     const b = view.builds;
@@ -42,7 +42,10 @@ export function projectSettingsHtml(view, csrf, notice) {
             `<form method="post" action="/settings/project/delete"><input type="hidden" name="csrf" value="${e(csrf)}"><input type="hidden" name="repo" value="${e(view.repo)}">` +
             `<label><span>Type <strong>${e(view.name)}</strong> to continue</span><input name="name" autocomplete="off" autocapitalize="off" spellcheck="false" required></label>` +
             `<button type="submit">Continue</button></form>`;
-    return `${head}<details class="danger-zone"${notice.problem ? " open" : ""}><summary>Delete project</summary>${body}</details></section>`;
+    // Removing is the reversible step: off the lists and the builder, everything kept.
+    const remove = `<form class="remove-project" method="post" action="/projects/remove"><input type="hidden" name="csrf" value="${e(csrf)}"><input type="hidden" name="repo" value="${e(view.repo)}">` +
+        `<button type="submit">Remove from Toolroll</button><p class="meta">Its tasks and results stay saved. Add it again to bring it back.</p></form>`;
+    return `${head}${remove}<details class="danger-zone"${notice.problem ? " open" : ""}><summary>Delete project</summary>${body}</details></section>`;
 }
 /** The second step: exactly what goes, and the password. */
 export function projectDeleteConfirmHtml(view, csrf, problem) {

package/dist/runner.d.ts

@@ -104,6 +104,16 @@ export declare function addRunnerReposAuthed(store: Store, args: {
     token: string;
     repos: readonly string[];
 }, now: Date): AuthResult;
+/**
+ * Narrow a live runner's binding when a project is removed, under the same
+ * credential and transaction as addRunnerReposAuthed. `up` calls it only
+ * after that project's watch has stopped admitting work.
+ */
+export declare function removeRunnerRepoAuthed(store: Store, args: {
+    name: string;
+    token: string;
+    repo: string;
+}, now: Date): AuthResult;
 /**
  * The one runner-name rule (arc 2 finding 13): nonempty, control-free, at
  * most 60 characters — the console form's rule, now shared by every door.

package/dist/runner.js

@@ -142,6 +142,22 @@ export function addRunnerReposAuthed(store, args, now) {
         };
     });
 }
+/**
+ * Narrow a live runner's binding when a project is removed, under the same
+ * credential and transaction as addRunnerReposAuthed. `up` calls it only
+ * after that project's watch has stopped admitting work.
+ */
+export function removeRunnerRepoAuthed(store, args, now) {
+    return store.transact(() => {
+        const auth = authenticate(store, args.name, args.token);
+        if (!auth.ok)
+            return auth;
+        const bound = store.bindRunnerRepos(args.name, auth.runner.repos.filter(one => one !== args.repo), now);
+        if (!bound.ok)
+            return { ok: false, reason: bound.reason };
+        return { ok: true, runner: { ...auth.runner, repos: bound.repos } };
+    });
+}
 /**
  * The one runner-name rule (arc 2 finding 13): nonempty, control-free, at
  * most 60 characters — the console form's rule, now shared by every door.

package/dist/scope.js

@@ -30,6 +30,7 @@ import { claimActor, currentActor, parseLeadToken } from "./actor.js";
  */
 import { createHash, randomBytes, scryptSync, timingSafeEqual } from "node:crypto";
 import { hasForbiddenControls } from "./decision.js";
+import { TEXT_LIMITS } from "./text-limits.js";
 import { NO_READINESS, exactModelId, isRiskLevel, legOf, projectRoute, routeDigestOf, routeFromJson, routeWords, } from "./phase-routing.js";
 /** Same shape as a runner's credential, for the same reasons. */
 function mintToken() {
@@ -399,11 +400,11 @@ export function profileFromJson(json) {
 export const EVIDENCE_KINDS = ["check", "screenshot", "changed-path", "manual-review"];
 export const ACCEPTANCE_LIMITS = {
     criteria: 12,
-    id: 40,
+    id: TEXT_LIMITS.acceptanceIdBytes,
     // A statement is one testable outcome; three hundred bytes forced people to
     // drop the qualifying clause that made it testable.
-    statement: 1000,
-    how: 500,
+    statement: TEXT_LIMITS.acceptanceStatementBytes,
+    how: TEXT_LIMITS.acceptanceHowBytes,
     evidenceKinds: EVIDENCE_KINDS.length,
 };
 function acceptanceDescribe(value) {

package/dist/serve.d.ts

@@ -145,6 +145,10 @@ export type ServeOptions = {
     desktopIdentity?: string;
     /** Trusted native admission callback; enrollment rows alone never supply this authority. */
     additionalProjectRepos?: () => readonly string[];
+    /** The co-located `up`'s exact admitted repositories, read on every request: its startup projects plus those
+     * added since (`repos add`, the lead, the console) and minus those removed. When given it replaces `repos` as
+     * the exact part of the ceiling, so an addition or removal shows without a restart. */
+    admittedRepos?: () => readonly string[];
     connectionProbe?: typeof execRun;
     connectionHome?: string;
     /** Test seam for Chat's first tasks: the `gh` and `git grep` reads. */