toolroll 0.9.33 → 0.9.34

package/dist/serve.js

@@ -178,12 +178,13 @@ import { parseReport } from "./scout-report.js";
 import { buildDataDocument, composeRequest, credentialKeyOf, isDirectChatProvider, isSubscriptionChatProvider, parseAssistantEnvelope, performChatRequest, priceOf, priceForConfig, worstCaseForPrice, settleForPrice, subscriptionCredentialKey, fetchOpenRouterCatalog, plausibleChatKey, PRICED_MODELS, settleMicrousd, worstCaseMicrousd, CHAT_KEY_ENV, TURN_WALL_CLOCK_MS, } from "./converse.js";
 import { fileTaskProposal, fileRoutineProposal } from "./proposal.js";
 import { TASK_TEXT_LIMITS, validateTaskText } from "./task-text.js";
+import { TEXT_LIMITS } from "./text-limits.js";
 import {} from "./store.js";
 import { attendedLivenessState } from "./liveness.js";
 import { approvalOf, approve as approveScope, attendedDigestOf, attendedTermsJson, authenticateApprover as checkApproverPassword, canonicalProfileJson, chainFromJson, profileDigestOf, proposeGuarded, scopeAuthorityOf, acceptanceLinesToInput, acceptanceToLines, acceptanceWords, parseAcceptanceCriteria, } from "./scope.js";
 import { isQualityMode, qualityModeTitle } from "./quality.js";
 import { LIMITS, hasForbiddenControls, validateNote } from "./decision.js";
-import { parseExecutionPlanDocument, PLAN_LIMITS, milestonesOf } from "./plan.js";
+import { parseExecutionPlanDocument, milestonesOf } from "./plan.js";
 import { contractChangesOf, decodePlanContractRecord, describeContractChanges } from "./planner-source.js";
 import { observeWorktree, parseBaseTreeSnapshot, aggregateNewNames, PEEK_LIMITS } from "./peek.js";
 import { readLiveWindow } from "./live.js";
@@ -194,7 +195,8 @@ import { parseGithubRepo, previewGithubRepo, cloneGithubRepo, listGithubRepos, i
 import { verifiedAuthor, LEAD_THREAD, isDigestTime, RESULT_SCREENSHOTS, MATE_ASK_OTHER } from "./store.js";
 import { RESULT_SHOT_CHOICES } from "./result-shots.js";
 import { digestTimes } from "./digest-times.js";
-import { updateRepos, addRepos, removeRepos } from "./repos.js";
+import { updateRepos, removeRepos } from "./repos.js";
+import { admitProject, releaseProject } from "./project-admission.js";
 import { run as execRun } from "./exec.js";
 import { findFirstTasks, firstResultWords, firstRunSteps, firstTaskJourney, firstTaskSuggestions, HOW_IT_WORKS, SANDBOX_COMMAND, signInCommandFor, START_COMMAND } from "./first-run.js";
 /** A user agent, reduced to safe display words — never echoed raw. */
@@ -276,6 +278,8 @@ import { PACKAGE_VERSION } from "./version.js";
 import { updateNoticeWords } from "./update-notice.js";
 import { whenHtml } from "./when-html.js";
 const SESSION_COOKIE = "standing-orders_session";
+/** Stands in for "no project" in a ceiling: no folder resolves to it, so it admits nothing. */
+const NO_PROJECT = "/\0no-project";
 /** Where `up`'s one-time sign-in link points, and how long it works. */
 export const SIGN_IN_LINK_PATH = "/login/once/";
 export const SIGN_IN_LINK_MS = 10 * 60_000;
@@ -632,7 +636,13 @@ export function createDecisionServer(options) {
     /** No ceiling configured at all: the legacy trust-everything mode, named. */
     const unscopedMode = ceiling.repos.length === 0 && ceiling.roots.length === 0;
     /** Per-row visibility under the ceiling — the authorization question for reads. */
-    const liveCeiling = () => ({ repos: [...ceiling.repos, ...(options.additionalProjectRepos?.() ?? [])], roots: ceiling.roots });
+    /** The exact repositories this console serves now: `up`'s live admitted set when it supplies one, else startup's. */
+    const exactRepos = () => options.admittedRepos?.() ?? ceiling.repos;
+    const liveCeiling = () => {
+        const repos = [...exactRepos(), ...(options.additionalProjectRepos?.() ?? [])];
+        // An admitted set that is empty for now is an empty ceiling, never the legacy unscoped mode.
+        return { repos: repos.length === 0 && ceiling.roots.length === 0 && !unscopedMode ? [NO_PROJECT] : repos, roots: ceiling.roots };
+    };
     // Native tools share the installation's login and can read beyond a project.
     // Account project membership cannot provide an OS read boundary.
     function codingActorAllowed(actor) {
@@ -651,12 +661,21 @@ export function createDecisionServer(options) {
      * ceiling; this server still filters every row through its own ceiling. */
     /** Projects deleted while this console runs: gone from its lists though a builder started with them still watches. */
     const deletedRepos = new Set();
+    /** Those still gone: a project added again (from here, `repos add`, or the lead) has its row back and shows again. */
+    const goneRepos = () => {
+        if (deletedRepos.size === 0)
+            return deletedRepos;
+        for (const one of store.listProjects())
+            deletedRepos.delete(one.path);
+        return deletedRepos;
+    };
     const managedRepos = () => {
         const seen = new Set();
         const repos = [];
-        for (const path of [...ceiling.repos, ...(options.currentRepos?.() ?? [])]) {
+        const gone = goneRepos();
+        for (const path of [...exactRepos(), ...(options.currentRepos?.() ?? [])]) {
             const canonical = canonicalProject(path) ?? path;
-            if (seen.has(canonical) || !visible(canonical) || deletedRepos.has(canonical))
+            if (seen.has(canonical) || !visible(canonical) || gone.has(canonical))
                 continue;
             seen.add(canonical);
             repos.push(canonical);
@@ -761,6 +780,13 @@ export function createDecisionServer(options) {
     const admissionList = () => restricted() ? [...(store.accountOf(requestContext.getStore().actor)?.projects ?? [])].filter(visible) : unscopedMode
         ? null
         : [...new Set([...managedRepos(), ...(ceiling.roots.length === 0 ? [] : store.knownRepos().filter(visible))])];
+    /** Every project this person may pick in the console — the switcher, Projects, Settings, Tools and Flows read this
+     * one list: the live admitted set (taskless projects included) and every project with saved work, each through
+     * the ceiling and this account's project grants. A project removed or deleted here is gone from it. */
+    const consoleProjects = () => {
+        const gone = goneRepos();
+        return [...new Set([...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()])].filter(one => visible(one) && !gone.has(one));
+    };
     /** The task behind a resource, for the ceiling check; null = no ref (visible). */
     const taskRepoOf = (taskRef) => store.refForId(taskRef)?.repo ?? null;
     const server = createServer((request, response) => {
@@ -2519,7 +2545,7 @@ export function createDecisionServer(options) {
                 return void response.end(spendCsv(items, teammateNames));
             }
             const shift = (by) => { const at = new Date(`${month.name}-01T00:00:00.000Z`); at.setUTCMonth(at.getUTCMonth() + by); return at.toISOString().slice(0, 7); };
-            const projects = [...new Set([...managedRepos(), ...store.knownRepos()])].filter(visible);
+            const projects = consoleProjects();
             const people = store.accountFacts().filter(one => one.revokedAt === null).map(one => one.name);
             const view = {
                 month: month.name, previous: shift(-1), next: month.name === current.name ? null : shift(1),
@@ -2535,7 +2561,7 @@ export function createDecisionServer(options) {
         }
         if (url.pathname === "/ledger") {
             const admitted = admissionList();
-            const projects = admitted ?? [...new Set([...managedRepos(), ...store.knownRepos()])].filter(visible);
+            const projects = admitted ?? consoleProjects();
             const chosen = url.searchParams.get("project") ?? "";
             if (chosen !== "" && !projects.includes(chosen))
                 return refuse(response, who, 403, "That project is outside your access.", "/ledger");
@@ -2694,7 +2720,7 @@ export function createDecisionServer(options) {
                 return seen;
             };
             const csrf = who.via === "cookie" ? who.session.csrf : "";
-            const projectChoices = [...new Set([...managedRepos(), ...store.knownRepos()])].filter(visible);
+            const projectChoices = consoleProjects();
             const accessFields = (selected) => `<label>Project access<select name="access"><option value="selected"${selected !== null ? " selected" : ""}>Selected projects</option><option value="all"${selected === null ? " selected" : ""}>All projects</option></select></label>` +
                 `<p class="meta">Operators with all-project access also manage the instance.</p><fieldset><legend>Projects</legend>${projectChoices.length === 0 ? `<p class="meta">Add a project before granting selected access.</p>` : projectChoices.map(repo => `<label class="row"><input type="checkbox" name="projects" value="${escape(repo)}"${selected?.includes(repo) ? " checked" : ""}>${escape(projectName(repo))}</label>`).join("")}</fieldset>`;
             const cards = accounts.map(one => {
@@ -3192,7 +3218,7 @@ export function createDecisionServer(options) {
         }
         // Flows → New: the gallery, and each template's page.
         if (url.pathname === "/flows/new") {
-            const projects = [...new Set([...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()])].filter(visible);
+            const projects = consoleProjects();
             const canUse = who.via === "cookie" && who.role === "approver" && projects.length > 0;
             // The chosen project, else the one being looked at: its tools are what each card says is connected.
             const asked = url.searchParams.get("repo");
@@ -3202,7 +3228,7 @@ export function createDecisionServer(options) {
         const galleryRead = /^\/flows\/new\/([a-z-]{1,40})$/.exec(url.pathname);
         if (galleryRead !== null) {
             const template = galleryTemplateOf(galleryRead[1]);
-            const projects = [...new Set([...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()])].filter(visible);
+            const projects = consoleProjects();
             if (template === null)
                 return refuse(response, who, 404, "There's no template by that name.", "/flows/new");
             if (who.via !== "cookie" || who.role !== "approver")
@@ -3216,13 +3242,13 @@ export function createDecisionServer(options) {
             return sendGalleryUse(response, who, template, projects, repo, null, template.name, problem === null ? null : problem.slice(0, 400), said === null ? null : said.slice(0, 400));
         }
         if (url.pathname === "/flows") {
-            const projects = [...new Set([...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()])].filter(visible);
+            const projects = consoleProjects();
             const flows = store.listFlows(projects);
             return sendScreen(response, 200, screen("Flows", `<h1>Flows</h1>${flowsListHtml(store, flows, projects, who.via === "cookie" ? who.session.csrf : "", who.via === "cookie" && who.role === "approver", url.searchParams.get("problem"))}`, { chrome: chromeFor(project, "flows"), functional: { script: FLOW_IMPORT_SCRIPT } }));
         }
         // starter kits — the gallery, and each kit's checklist in a project.
         if (url.pathname === "/kits" || /^\/kits\/[a-z-]{1,40}$/.test(url.pathname)) {
-            const projects = [...new Set([...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()])].filter(visible);
+            const projects = consoleProjects();
             const csrf = who.via === "cookie" ? who.session.csrf : "", canSetUp = who.via === "cookie" && who.role === "approver";
             if (url.pathname === "/kits") {
                 return sendScreen(response, 200, screen("Starter kits", `<h1>Starter kits</h1>${kitsGalleryHtml(store, projects, projectName, csrf, canSetUp, { problem: url.searchParams.get("problem") })}`, { chrome: chromeFor(project, "flows") }));
@@ -3235,7 +3261,7 @@ export function createDecisionServer(options) {
         }
         // v92: AI teammates — the team, and one page per teammate.
         if (url.pathname === "/teammates") {
-            const projects = [...new Set([...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()])].filter(visible);
+            const projects = consoleProjects();
             return sendScreen(response, 200, screen("Teammates", `<h1>Teammates</h1>${teammatesListHtml(store, store.teammates(projects), projects, projectName, who.via === "cookie" ? who.session.csrf : "", who.via === "cookie" && who.role === "approver", { said: url.searchParams.get("said"), problem: url.searchParams.get("problem") })}`, { chrome: chromeFor(project, "flows") }));
         }
         const teammateRead = /^\/teammates\/([1-9][0-9]{0,9})(\/soul\.md)?$/.exec(url.pathname);
@@ -3307,7 +3333,7 @@ export function createDecisionServer(options) {
             if (flow === null || flow.state !== "active" || !visible(flow.repo))
                 return refuse(response, who, 404, "No such flow in your projects.", "/flows");
             const selected = Number(url.searchParams.get("card")), start = Number(url.searchParams.get("start"));
-            const view = flowView(store, flow, { name: who.name, approver: who.via === "cookie" && who.role === "approver" }, Number.isSafeInteger(selected) && selected > 0 ? selected : null, { dir: options.configDir ?? null, repos: [...new Set([...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()])].filter(visible), startTrigger: Number.isSafeInteger(start) && start > 0 ? start : null,
+            const view = flowView(store, flow, { name: who.name, approver: who.via === "cookie" && who.role === "approver" }, Number.isSafeInteger(selected) && selected > 0 ? selected : null, { dir: options.configDir ?? null, repos: consoleProjects(), startTrigger: Number.isSafeInteger(start) && start > 0 ? start : null,
                 sortReady: keyStatus("openrouter", providerHome).set, toolHome });
             if (url.searchParams.get("format") === "json")
                 return respond(response, 200, "application/json; charset=utf-8", JSON.stringify(view));
@@ -3886,7 +3912,7 @@ export function createDecisionServer(options) {
             return sendScreen(response, 200, screen("Models", `<p><a href="/settings">Settings</a></p><h1>Models</h1>${modelsHtml(view)}`, { chrome: chromeFor(project, "settings"), functional: { script: modelsScript() } }));
         }
         if (url.pathname === "/settings/skills") {
-            const projects = [...new Set([...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()])].filter(visible);
+            const projects = consoleProjects();
             const chosen = url.searchParams.get("repo") ?? project ?? projects[0] ?? "";
             if (chosen && !projects.includes(chosen))
                 return refuse(response, who, 403, "That project is outside your access.", "/projects");
@@ -3904,7 +3930,7 @@ export function createDecisionServer(options) {
             return sendScreen(response, 200, screen('Skills', `<p><a href="/settings">Settings</a></p><h1>Skills</h1>${url.searchParams.get('saved') === '1' ? '<p role="status">Saved.</p>' : ''}${selector}${content}`, { chrome: chromeFor(chosen || project, 'settings'), functional: { script: skillsScript() } }));
         }
         if (url.pathname === "/settings/tools") {
-            const projects = [...new Set([...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()])].filter(visible);
+            const projects = consoleProjects();
             const chosen = url.searchParams.get("repo") ?? project ?? projects[0] ?? "";
             if (chosen && !projects.includes(chosen))
                 return refuse(response, who, 403, "That project is outside your access.", "/projects");
@@ -3928,7 +3954,7 @@ export function createDecisionServer(options) {
         }
         // Settings → Project: what Toolroll holds for a project; an instance operator deletes it here.
         if (url.pathname === "/settings/project") {
-            const projects = [...new Set([...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()])].filter(visible).filter(one => !deletedRepos.has(one));
+            const projects = consoleProjects();
             const asked = url.searchParams.get("repo");
             const chosen = asked ?? (project != null && projects.includes(project) ? project : projects[0] ?? "");
             if (chosen && !projects.includes(chosen))
@@ -3940,7 +3966,7 @@ export function createDecisionServer(options) {
         }
         // v102: Settings → Approval rules, a project's separation of duties. Anyone who sees the project reads them; an instance operator sets them.
         if (url.pathname === "/settings/approval") {
-            const projects = [...new Set([...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()])].filter(visible);
+            const projects = consoleProjects();
             const chosen = url.searchParams.get("repo") ?? project ?? projects[0] ?? "";
             if (chosen && !projects.includes(chosen))
                 return refuse(response, who, 403, "That project is outside your access.", "/settings/approval");
@@ -3951,7 +3977,7 @@ export function createDecisionServer(options) {
         }
         // Sprint 8: Settings → Policy, the organisation policy and its history. Anyone signed in reads it; an instance operator changes it.
         if (url.pathname === "/settings/policy") {
-            const repos = [...new Set([...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()])].filter(visible);
+            const repos = consoleProjects();
             const toolNames = [...new Set(repos.flatMap(repo => store.projectTools(repo).map(one => one.name)))].sort();
             const view = { policy: store.orgPolicy(), history: store.policyHistory(50), canChange: who.via === "cookie" && store.isInstanceOperator(who.name), toolNames };
             return sendScreen(response, 200, screen("Policy", `<p><a href="/settings">Settings</a></p><h1>Policy</h1>${policyHtml(view, who.via === "cookie" ? who.session.csrf : "", { said: url.searchParams.get("said"), problem: url.searchParams.get("problem") })}`, { chrome: chromeFor(project, "settings") }));
@@ -3969,7 +3995,7 @@ export function createDecisionServer(options) {
         // Settings → Flows: the starter flows, each switched on with one yes. ?starter= marks the one a task's
         // "Do this every time…" asked about.
         if (url.pathname === "/settings/flows") {
-            const projects = [...new Set([...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()])].filter(visible);
+            const projects = consoleProjects();
             const chosen = url.searchParams.get("repo") ?? project ?? projects[0] ?? "";
             if (chosen && !projects.includes(chosen))
                 return refuse(response, who, 403, "That project is outside your access.", "/settings");
@@ -4093,13 +4119,13 @@ export function createDecisionServer(options) {
             if (who.via !== "cookie" || !store.isInstanceOperator(who.name) || !options.configDir)
                 return refuse(response, who, 403, "An instance operator sets up sign-in.", "/settings");
             const origin = consoleOrigin(request.headers.host);
-            const projects = [...new Set([...managedRepos(), ...store.knownRepos()])].filter(visible).map(path => ({ path, name: projectName(path) }));
+            const projects = consoleProjects().map(path => ({ path, name: projectName(path) }));
             const settings = ssoSettings();
             const html = ssoSettingsHtml({ settings, redirect: origin === null ? null : `${origin}${SSO_CALLBACK}`, projects, linked: settings !== null && store.ssoIdentitiesOf(who.name).some(one => one.issuer.replace(/\/+$/, "") === settings.issuer) }, who.session.csrf, { said: url.searchParams.get("said"), problem: url.searchParams.get("problem") });
             return sendScreen(response, 200, screen("Sign-in", `<p><a href="/settings">Settings</a></p><h1>Sign-in</h1>${html}`, { chrome: chromeFor(project, "settings") }));
         }
         if (url.pathname === "/settings/knowledge") {
-            const projects = [...new Set([...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()])].filter(visible);
+            const projects = consoleProjects();
             const chosen = url.searchParams.get("repo") ?? project ?? projects[0] ?? "";
             if (chosen && (!projects.includes(chosen) || !visible(chosen)))
                 return refuse(response, who, 403, "That project is outside your access.", "/settings/knowledge");
@@ -4137,7 +4163,7 @@ export function createDecisionServer(options) {
             return sendScreen(response, 200, screen('Knowledge', `<p><a href="/settings">Settings</a></p><h1>Knowledge</h1>${url.searchParams.get('saved') === '1' ? '<p role="status">Saved for future tasks.</p>' : ''}${selector}${content}`, { chrome: chromeFor(chosen || project, 'settings') }));
         }
         if (url.pathname === "/settings/learning") {
-            const projects = [...new Set([...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()])].filter(visible);
+            const projects = consoleProjects();
             const chosen = url.searchParams.get("repo") ?? project ?? projects[0] ?? "";
             if (chosen && (!projects.includes(chosen) || !visible(chosen)))
                 return refuse(response, who, 403, "That project is outside your access.", "/settings/learning");
@@ -5231,7 +5257,7 @@ export function createDecisionServer(options) {
                     ...store.listProjects().map(one => ({ path: one.path, name: one.name })),
                     ...managedRepos().map(path => ({ path, name: projectName(path) })),
                 ]) {
-                    if (seen.has(one.path) || !visible(one.path))
+                    if (seen.has(one.path) || !visible(one.path) || goneRepos().has(one.path))
                         continue;
                     seen.add(one.path);
                     rows.push(one);
@@ -5475,7 +5501,7 @@ export function createDecisionServer(options) {
         const recent = store.listProjects().filter(one => visible(one.path));
         const recentPaths = new Set(recent.map(one => one.path));
         const candidates = new Set();
-        for (const path of [...managedRepos(), ...store.knownRepos()]) {
+        for (const path of consoleProjects()) {
             const canonical = canonicalProject(path) ?? path;
             if (!recentPaths.has(canonical) && visible(canonical))
                 candidates.add(canonical);
@@ -6765,7 +6791,7 @@ export function createDecisionServer(options) {
             if (who.via !== 'cookie' || who.role !== 'approver')
                 return refuse(response, who, 403, 'Sign in as an approver to manage skills.', '/settings/skills');
             const repo = body.get('repo') ?? '', back = `/settings/skills?repo=${encodeURIComponent(repo)}`;
-            if (!visible(repo) || ![...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()].includes(repo))
+            if (!visible(repo) || !consoleProjects().includes(repo))
                 return refuse(response, who, 403, 'That project is outside your access.', '/projects');
             if ([...new Set(body.keys())].some(k => body.getAll(k).length !== 1))
                 return refuse(response, who, 400, 'Invalid skills form.', back);
@@ -6821,7 +6847,7 @@ export function createDecisionServer(options) {
             if (who.via !== "cookie" || who.role !== "approver")
                 return refuse(response, who, 403, "Sign in as an approver to set kits up.", "/kits");
             const kit = kitOf(kitPost[1]);
-            const projects = [...new Set([...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()])].filter(visible);
+            const projects = consoleProjects();
             const repo = body.get("repo") ?? "";
             if (kit === null || !projects.includes(repo) || !store.accountCanAccess(who.name, repo))
                 return redirect(response, `/kits?problem=${encodeURIComponent("Choose one of your projects.")}`);
@@ -6866,7 +6892,7 @@ export function createDecisionServer(options) {
             if (who.role !== "approver")
                 return refuse(response, who, 403, "Sign in as an approver to look after teammates.", "/teammates");
             if (teammatePost[2] === "new") {
-                const projects = [...new Set([...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()])].filter(visible);
+                const projects = consoleProjects();
                 const repo = body.get("repo") ?? "";
                 if (!projects.includes(repo))
                     return redirect(response, `/teammates?problem=${encodeURIComponent("Choose one of your projects.")}`);
@@ -6938,7 +6964,7 @@ export function createDecisionServer(options) {
         const galleryPost = /^\/flows\/new\/([a-z-]{1,40})$/.exec(url.pathname);
         if (galleryPost !== null) {
             const template = galleryTemplateOf(galleryPost[1]);
-            const projects = [...new Set([...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()])].filter(visible);
+            const projects = consoleProjects();
             if (template === null)
                 return refuse(response, who, 404, "There's no template by that name.", "/flows/new");
             if (who.via !== "cookie" || who.role !== "approver" || store.isDemo())
@@ -6970,7 +6996,7 @@ export function createDecisionServer(options) {
         if (url.pathname === "/flows/new" || url.pathname === "/flows/example" || url.pathname === "/flows/import" || flowPost !== null || triggerPost !== null) {
             const now = clock();
             const answer = (status, payload) => respond(response, status, "application/json; charset=utf-8", JSON.stringify(payload));
-            const projects = [...new Set([...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()])].filter(visible);
+            const projects = consoleProjects();
             if (who.via !== "cookie" || who.role !== "approver")
                 return url.pathname === "/flows/new" || url.pathname === "/flows/example" || url.pathname === "/flows/import" ? refuse(response, who, 403, "Sign in as an approver to create flows.", "/flows") : answer(403, { ok: false, said: "Sign in as an approver to change flows." });
             if (url.pathname === "/flows/example") {
@@ -7244,7 +7270,7 @@ export function createDecisionServer(options) {
                 return back("problem", "Choose what the budget is for.");
             const scope = target[1], key = target[2];
             const known = scope === "installation" ? key === "*"
-                : scope === "project" ? [...new Set([...managedRepos(), ...store.knownRepos()])].filter(visible).includes(key)
+                : scope === "project" ? consoleProjects().includes(key)
                     : scope === "person" ? store.accountFacts().some(one => one.name === key && one.revokedAt === null)
                         : store.teammates([...new Set([...managedRepos(), ...store.knownRepos()])]).some(one => String(one.id) === key);
             if (!known)
@@ -7266,7 +7292,7 @@ export function createDecisionServer(options) {
         // Settings → Project → Builds at once: an approver for the project sets it; the ledger keeps before → after.
         if (url.pathname === "/settings/project/concurrency") {
             const repo = body.get("repo") ?? "";
-            const known = [...new Set([...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()])].filter(visible);
+            const known = consoleProjects();
             if (!known.includes(repo))
                 return refuse(response, who, 403, "That project is outside your access.", "/settings/project");
             if (who.via !== "cookie" || who.role !== "approver" || !store.accountCanAccess(who.name, repo))
@@ -7287,7 +7313,7 @@ export function createDecisionServer(options) {
             if (who.via !== "cookie" || !store.isInstanceOperator(who.name))
                 return refuse(response, who, 403, "An instance operator deletes projects.", "/settings/project");
             const repo = body.get("repo") ?? "";
-            const known = [...new Set([...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()])].filter(visible);
+            const known = consoleProjects();
             if (!known.includes(repo))
                 return refuse(response, who, 403, "That project is outside your access.", "/settings/project");
             const back = (key, words, to = repo) => redirect(response, `/settings/project?${to === "" ? "" : `repo=${encodeURIComponent(to)}&`}${key}=${encodeURIComponent(words)}`);
@@ -7343,7 +7369,7 @@ export function createDecisionServer(options) {
             if (who.via !== "cookie" || !store.isInstanceOperator(who.name))
                 return refuse(response, who, 403, "An instance operator sets approval rules.", "/settings/approval");
             const repo = body.get("repo") ?? "";
-            const known = [...new Set([...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()])].filter(visible);
+            const known = consoleProjects();
             if (!known.includes(repo))
                 return refuse(response, who, 403, "That project is outside your access.", "/settings/approval");
             const back = (key, words) => redirect(response, `/settings/approval?repo=${encodeURIComponent(repo)}&${key}=${encodeURIComponent(words)}`);
@@ -7744,7 +7770,7 @@ export function createDecisionServer(options) {
             if (who.via !== "cookie" || who.role !== "approver")
                 return refuse(response, who, 403, "Sign in as an approver to connect tools.", "/settings/tools");
             const repo = body.get("repo") ?? "";
-            const reachable = (one) => visible(one) && [...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()].includes(one);
+            const reachable = (one) => visible(one) && consoleProjects().includes(one);
             if (!reachable(repo))
                 return refuse(response, who, 403, "That project is outside your access.", "/projects");
             // "Also connect to …": a service connected on the shown project, signed in again for another project.
@@ -7817,13 +7843,13 @@ export function createDecisionServer(options) {
             if (who.via !== "cookie" || who.role !== "approver")
                 return refuse(response, who, 403, "Sign in as an approver to manage tools.", "/settings/tools");
             const repo = body.get("repo") ?? "";
-            if (!visible(repo) || ![...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()].includes(repo))
+            if (!visible(repo) || !consoleProjects().includes(repo))
                 return refuse(response, who, 403, "That project is outside your access.", "/projects");
             const back = (key, words, anchor = "") => redirect(response, `/settings/tools?repo=${encodeURIComponent(repo)}&${key}=${encodeURIComponent(words)}${anchor}`);
             // As for Connect: a post from a page that showed another project is refused, never applied here.
             const shown = body.get("shown") ?? "";
             if (shown !== repo) {
-                const page = visible(shown) && [...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()].includes(shown) ? shown : repo;
+                const page = visible(shown) && consoleProjects().includes(shown) ? shown : repo;
                 return redirect(response, `/settings/tools?repo=${encodeURIComponent(page)}&problem=${encodeURIComponent("The project changed; try again.")}`);
             }
             const action = body.get("action") ?? "";
@@ -7986,7 +8012,7 @@ export function createDecisionServer(options) {
             if (who.via !== 'cookie' || who.role !== 'approver')
                 return refuse(response, who, 403, 'Sign in as an approver to refresh project context.', '/settings/knowledge');
             const repo = body.get('repo') ?? '';
-            if (!visible(repo) || !store.accountCanAccess(who.name, repo) || ![...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()].includes(repo))
+            if (!visible(repo) || !store.accountCanAccess(who.name, repo) || !consoleProjects().includes(repo))
                 return refuse(response, who, 403, 'That project is outside your access.', '/settings/knowledge');
             const refreshed = await repositoryContext({ repo, query: '', refresh: true, cacheRoot: join(dirname(evidenceRoot), 'repository-context') });
             return sendScreen(response, refreshed.index.status === 'ready' ? 200 : 503, screen('Project context', `<h1>Project context</h1><p>${refreshed.index.status === 'ready' ? 'Code index refreshed.' : 'The index is unavailable. Source search still works.'}</p><a class="button-link" href="/settings/knowledge?repo=${encodeURIComponent(repo)}">Open knowledge</a>`, { chrome: chromeFor(repo, 'settings') }));
@@ -7995,7 +8021,7 @@ export function createDecisionServer(options) {
             if (who.via !== 'cookie' || who.role !== 'approver')
                 return refuse(response, who, 403, 'Sign in as an approver to decide memory proposals.', '/settings/knowledge');
             const repo = body.get('repo') ?? '', decision = body.get('decision') ?? '';
-            if (!visible(repo) || ![...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()].includes(repo))
+            if (!visible(repo) || !consoleProjects().includes(repo))
                 return refuse(response, who, 403, 'That project is outside your access.', '/settings/knowledge');
             if (!['accept', 'reject'].includes(decision) || !/^[0-9]{1,12}$/.test(body.get('proposal') ?? ''))
                 return refuse(response, who, 400, 'Choose accept or reject for one proposal.', '/settings/knowledge');
@@ -8011,7 +8037,7 @@ export function createDecisionServer(options) {
             if (who.via !== 'cookie' || who.role !== 'approver')
                 return refuse(response, who, 403, 'Sign in as an approver to change project decisions.', '/settings/knowledge');
             const repo = body.get('repo') ?? '', action = body.get('action') ?? '';
-            if (!visible(repo) || ![...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()].includes(repo))
+            if (!visible(repo) || !consoleProjects().includes(repo))
                 return refuse(response, who, 403, 'That project is outside your access.', '/settings/knowledge');
             if (['repo', 'action', 'claim', 'why', 'decision', 'reason'].some(k => body.getAll(k).length > 1) || !['record', 'retire'].includes(action))
                 return refuse(response, who, 400, 'Choose record or retire.', '/settings/knowledge');
@@ -8063,7 +8089,7 @@ export function createDecisionServer(options) {
             if (who.via !== "cookie")
                 return refuse(response, who, 403, "Sign in to change learning.", "/settings/learning");
             const repo = body.get("repo") ?? "", action = body.get("action") ?? "";
-            if (!visible(repo) || ![...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()].includes(repo))
+            if (!visible(repo) || !consoleProjects().includes(repo))
                 return refuse(response, who, 403, "That project is outside your access.", "/settings/learning");
             if (["repo", "action", "identity", "revision", "lesson", "version", "sha"].some(k => body.getAll(k).length > 1) || !["adopt", "disable", "reset", "enable", "pause"].includes(action) || !/^[0-9]+$/.test(body.get("revision") ?? ""))
                 return refuse(response, who, 400, "Invalid learning form.", "/settings/learning");
@@ -8505,6 +8531,25 @@ export function createDecisionServer(options) {
             sessions.persist(who.session);
             return redirect(response, safeReturn(body.get("return")));
         }
+        if (url.pathname === "/projects/remove") {
+            // The reversible remove: off every list and the builder; tasks, results and settings stay. Deleting is
+            // Settings → Project → Delete project. The same admission code as `repos remove` (project-admission.ts).
+            if (who.via !== "cookie" || !store.isInstanceOperator(who.name))
+                return refuse(response, who, 403, "An instance operator removes projects.", "/settings/project");
+            const repo = body.get("repo") ?? "";
+            if (!consoleProjects().includes(repo))
+                return refuse(response, who, 403, "That project is outside your access.", "/settings/project");
+            const released = await releaseProject(store, { registryFile: options.registryPath ?? null, path: repo, actor: { label: who.name, origin: "console" }, now });
+            if (!released.ok)
+                return redirect(response, `/settings/project?repo=${encodeURIComponent(repo)}&problem=${encodeURIComponent(`${projectName(repo)} wasn't removed: ${released.message}`)}`);
+            deletedRepos.add(repo);
+            if (who.session.project === repo) {
+                who.session.project = null;
+                who.session.projectRevision += 1;
+                sessions.persist(who.session);
+            }
+            return redirect(response, `/settings/project?said=${encodeURIComponent(`Removed ${projectName(repo)}. Its tasks and results stay saved.`)}`);
+        }
         if (url.pathname === "/projects/open") {
             // Sessions only: a bearer caller names its project per request and has
             // no session to mutate — refusing here keeps that boundary legible.
@@ -8526,18 +8571,19 @@ export function createDecisionServer(options) {
             if (!(await isGitRepo(canonical))) {
                 return void projectsScreen(response, who, "that path is not a git repository", 400, safeReturn(body.get("return")));
             }
-            // Opening an allowed repository enrolls it in this machine's durable
-            // project list. A co-located `up` notices that list and connects its
-            // builder; there is no separate restart or runner-binding step.
-            if (options.registryPath !== undefined) {
-                const enrolled = await updateRepos(options.registryPath, repos => addRepos(repos, [canonical]));
-                deletedRepos.delete(canonical);
-                if (!enrolled.ok) {
-                    return void projectsScreen(response, who, `that project is valid, but it could not be added — ${enrolled.message}`, 400, safeReturn(body.get("return")));
-                }
+            // An account limited to listed projects never widens its own list.
+            if (!visible(canonical)) {
+                return void projectsScreen(response, who, "That project is outside your access.", 403, safeReturn(body.get("return")));
             }
-            store.upsertProject(canonical, projectName(canonical), now);
-            who.session.project = canonical;
+            // Opening an allowed repository admits it the same way `repos add` does
+            // (project-admission.ts). A co-located `up` notices the durable list and
+            // connects its builder; there is no separate restart or binding step.
+            const admitted = await admitProject(store, { registryFile: options.registryPath ?? null, path: canonical, actor: { label: who.name, origin: "console" }, now });
+            if (!admitted.ok) {
+                return void projectsScreen(response, who, admitted.reason === "not-git" ? "that path is not a git repository" : `that project is valid, but it could not be added — ${admitted.message}`, 400, safeReturn(body.get("return")));
+            }
+            deletedRepos.delete(admitted.repo);
+            who.session.project = admitted.repo;
             who.session.projectRevision++;
             // The switcher (board pass) opens a project from any screen and
             // returns there — a same-site path only, never an off-site road.
@@ -9270,14 +9316,11 @@ export function createDecisionServer(options) {
             if (admitted === null) {
                 return projectsScreen(response, who, `the clone landed at ${cloned.target} but did not prove under the ceiling — it was left in place; enroll it by hand`, 400);
             }
-            if (options.registryPath !== undefined) {
-                const enrolled = await updateRepos(options.registryPath, (repos) => addRepos(repos, [admitted]));
-                deletedRepos.delete(admitted);
-                if (!enrolled.ok) {
-                    return projectsScreen(response, who, `${cloned.target} is cloned but not enrolled — ${enrolled.message}`, 400);
-                }
+            const joined = await admitProject(store, { registryFile: options.registryPath ?? null, path: admitted, actor: { label: who.name, origin: "console" }, now });
+            if (!joined.ok) {
+                return projectsScreen(response, who, `${cloned.target} is cloned but not added — ${joined.message}`, 400);
             }
-            store.upsertProject(admitted, projectName(admitted), now);
+            deletedRepos.delete(admitted);
             who.session.project = admitted;
             who.session.projectRevision += 1;
             return projectsScreen(response, who, options.upConsole === true
@@ -10853,8 +10896,8 @@ export function createDecisionServer(options) {
                 if (document === current.document.trim())
                     return redirect(response, taskHref(taskId));
                 const content = Buffer.from(`${document}\n`, "utf8");
-                if (content.length > PLAN_LIMITS.document) {
-                    return taskScreen(response, who, taskId, `plan not saved: it is over ${PLAN_LIMITS.document} bytes`, 400);
+                if (content.length > TEXT_LIMITS.planDocumentBytes) {
+                    return taskScreen(response, who, taskId, `plan not saved: it is over ${TEXT_LIMITS.planDocumentBytes} bytes`, 400);
                 }
                 try {
                     const name = `plan-edit-${randomUUID().replace(/-/g, "")}.md`;

package/dist/store.d.ts

@@ -6980,6 +6980,8 @@ export declare class Store {
     /** Remember a project was opened. Upsert keeps added_at; recency always moves.
      * A project added for the first time starts on Quick checks. */
     upsertProject(path: string, name: string, now: Date): void;
+    /** A project removed from the lists (project-admission.ts): only its row goes; its tasks, results and settings stay. */
+    forgetProject(path: string): void;
     /** Most recently opened first — the opener page's order. */
     listProjects(): {
         path: string;

package/dist/store.js

@@ -20463,6 +20463,10 @@ export class Store {
                 stampNewProjectLevel(this, path, now);
         });
     }
+    /** A project removed from the lists (project-admission.ts): only its row goes; its tasks, results and settings stay. */
+    forgetProject(path) {
+        this.db.prepare("DELETE FROM project WHERE path = ?").run(path);
+    }
     /** Most recently opened first — the opener page's order. */
     listProjects() {
         return this.db

package/dist/surface.js

@@ -81,8 +81,14 @@ export const COMMAND_GUIDE = [
     operator('conversation read', 'explicitly record your read position at --message within --conversation'),
     operator('conversation follow', 'enable or pause automatic lead summaries with --conversation and --enabled true|false, within the existing paid chat authorization; passive chat --follow only reads updates'),
     operator('conversation stop', 'request stopping the exact --message in --conversation; retain uncertain work until its owner settles it'),
-    operator("repos add", "connect a repository to the installation"),
-    operator("repos remove", "disconnect a repository"),
+    { invocation: "repos add", synopsis: "add a project: a Git repository, in the console at once; the lead adds with its token", audience: "agent", agentMayInvoke: true, mutation: "identity-idempotent",
+        positionals: [{ name: "path", required: false, meaning: "the repository (default: the one you are in)" }],
+        flags: [jsonFlag, { name: "token", takesValue: true, meaning: "the lead token (or TOOLROLL_LEAD_TOKEN)" }],
+        notableReasons: ["not-git", "unavailable", "refused", "locked"] },
+    { invocation: "repos remove", synopsis: "remove a project from the console and the builder; its tasks and results stay saved", audience: "agent", agentMayInvoke: true, mutation: "identity-idempotent",
+        positionals: [{ name: "path", required: true, meaning: "the repository" }],
+        flags: [jsonFlag, { name: "token", takesValue: true, meaning: "the lead token (or TOOLROLL_LEAD_TOKEN)" }],
+        notableReasons: ["refused", "locked"] },
     operator("repos add-from-github", "preview, clone from GitHub, and connect - the console onboarding ceremony as a CLI verb"),
     { invocation: "contract", synopsis: "the machine contract: envelope version + capability tokens; --commands dumps this guide", audience: "agent", agentMayInvoke: true, mutation: "none",
         flags: [jsonFlag, { name: "commands", takesValue: false, meaning: "dump the declared command guide" }] },

package/dist/text-limits.d.ts

@@ -20,7 +20,24 @@ export declare const TEXT_LIMITS: {
     readonly reportSummary: 2500;
     /** What one flow step passes on to the steps after it. */
     readonly stageOutput: 12000;
+    /** The planner's whole handoff file, in UTF-8 bytes. */
+    readonly planPayloadBytes: number;
+    /** The plan document (markdown), in UTF-8 bytes. */
+    readonly planDocumentBytes: number;
+    /** The plan document's Approach section. */
+    readonly planApproach: 2000;
+    /** One Milestones, Dependencies, Risks or Proof item in the plan document. */
+    readonly planItem: 600;
+    /** One path a plan expects to touch. */
+    readonly planTouch: 200;
+    /** A planner's amendment note: why the filed contract must change. */
+    readonly planAmendment: 1000;
+    /** An acceptance criterion's id, statement and advisory how, in UTF-8 bytes. */
+    readonly acceptanceIdBytes: 40;
+    readonly acceptanceStatementBytes: 1000;
+    readonly acceptanceHowBytes: 500;
 };
+export type TextLimitKey = keyof typeof TEXT_LIMITS;
 /** One chat message on each platform. Longer text is split across messages, never cut. Teams: the text one Adaptive Card
  * holds, well inside its 28 KB message. */
 export declare const PLATFORM_LIMITS: {

package/dist/text-limits.js

@@ -20,6 +20,22 @@ export const TEXT_LIMITS = {
     reportSummary: 2_500,
     /** What one flow step passes on to the steps after it. */
     stageOutput: 12_000,
+    /** The planner's whole handoff file, in UTF-8 bytes. */
+    planPayloadBytes: 64 * 1024,
+    /** The plan document (markdown), in UTF-8 bytes. */
+    planDocumentBytes: 16 * 1024,
+    /** The plan document's Approach section. */
+    planApproach: 2_000,
+    /** One Milestones, Dependencies, Risks or Proof item in the plan document. */
+    planItem: 600,
+    /** One path a plan expects to touch. */
+    planTouch: 200,
+    /** A planner's amendment note: why the filed contract must change. */
+    planAmendment: 1_000,
+    /** An acceptance criterion's id, statement and advisory how, in UTF-8 bytes. */
+    acceptanceIdBytes: 40,
+    acceptanceStatementBytes: 1_000,
+    acceptanceHowBytes: 500,
 };
 /** One chat message on each platform. Longer text is split across messages, never cut. Teams: the text one Adaptive Card
  * holds, well inside its 28 KB message. */

package/dist/when-html.d.ts

@@ -10,6 +10,8 @@ export declare function deadlineWords(deadline: {
     at: string;
     label: string;
 }, now?: Date, zone?: string): string;
+/** How long ago, in one short mark: "now", "4m", "2h", "3d". A future stamp reads "now"; an unreadable one, "". */
+export declare function shortAge(iso: string, now?: Date): string;
 /** The exact minute in `zone` ("2026-09-30 16:39", with " UTC" when it is UTC): a time's title, one hover away. */
 export declare function fullWhen(iso: string, zone?: string): string;
 /** Every server-rendered stamp (`whenHtml`'s `<time data-when>`) inside `root`, reworded by the one formatter in the