toolroll 0.9.39 → 0.9.41

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 0.9.41 — 2026-10-06
+
+- **A read-only PostHog connection works for research.** PostHog adds
+  `introspection` to every connection it grants, asked for or not; it only
+  lets a connection be checked and reaches no data. Toolroll counted it as
+  write access, so research skipped PostHog even after **Reconnect read-only**.
+  It now counts as read-only alongside the reads it came with. Nothing is
+  requested differently, and a connection that already reconnected read-only
+  works without signing in again.
+
+## 0.9.40 — 2026-10-06
+
+- **Confirming a proposal checks the same things the card does, everywhere.**
+  The console, a direct request, Telegram and the CLI all ask one check: you
+  can act on this chat (with the current provider, model and price), and no
+  reply is still running. If the terms changed, the card says to turn chat on
+  again and every other way of confirming refuses too, with the same reason.
+  A teammate reply that stalls before it starts stops blocking confirms after
+  a short limit instead of until a restart.
+
 ## 0.9.39 — 2026-10-06
 
 - **Chat is the conversation.** The Chat tab is your conversation with the

package/dist/desktop-update.d.ts

@@ -125,6 +125,7 @@ export declare function prepareDesktopUpdate(stateDir: string, installed: string
 export declare function sqliteLock(file: string, busyTimeoutMs?: number): DatabaseSync | null;
 export declare const installationLock: (j: UpdateJournal) => DatabaseSync | null;
 export declare function desktopUpdateStatus(stateDir: string): {
+    version?: never;
     active: boolean;
     phase: string;
     detail: string;
@@ -138,7 +139,6 @@ export declare function desktopUpdateStatus(stateDir: string): {
     wasRunning?: never;
     backupPath?: never;
     updateId?: never;
-    version?: never;
     buildId?: never;
     workDir?: never;
 } | {

package/dist/mate-cli.js

@@ -316,7 +316,10 @@ export async function runMateCli(input) {
                 say(done ? `dismissed ${act[2]}` : "that proposal was already acted on");
             }
             else {
-                const outcome = confirmMateProposal(store, who, proposal.id, now, { confirm: act[3] !== undefined, via: "cli", ...(input.evidenceRoot === undefined ? {} : { evidenceRoot: input.evidenceRoot }) });
+                const outcome = confirmMateProposal(store, who, proposal.id, now, { confirm: act[3] !== undefined, via: "cli", chatProvider: () => {
+                        const current = store.getChatConfig();
+                        return current === null ? null : { config: current, key: isDirectChatProvider(current.provider) ? keyFor(current, input.databaseFile, env) : null };
+                    }, ...(input.evidenceRoot === undefined ? {} : { evidenceRoot: input.evidenceRoot }) });
                 emit({ ok: outcome.ok, act: "confirm", proposal: proposal.id, ...(outcome.ok ? { said: outcome.said, taskId: outcome.taskId } : { reason: outcome.reason, said: outcome.said }) });
                 say(outcome.ok ? outcome.said : outcome.reason === "needs-confirm" ? `${outcome.said}: confirm ${act[2]} yes` : `refused: ${outcome.said}`);
                 if (outcome.ok && outcome.kind === "scope" && outcome.taskId !== null)

package/dist/mate-doors.d.ts

@@ -1,6 +1,7 @@
 import { type SharedActionOptions } from './chat-actions.js';
 import { type CoordinatorProposal, type MateProposal, type Store } from "./store.js";
 import type { VerifiedApprover } from "./principal.js";
+import { type TeamChatProviderResolver } from './team-chat-authorization.js';
 export type ProposalKind = MateProposal["kind"];
 export type DoorOutcome = {
     ok: true;
@@ -14,8 +15,10 @@ export type DoorOutcome = {
     reason: DoorRefusal;
     said: string;
 };
-export type DoorRefusal = "standing" | "not-yours" | "ceiling-changed" | "not-pending" | "session-ended" | "turn-not-answered" | "not-confirmable" | "needs-confirm" | "stale" | "claimed" | "not-queued" | "contest-open" | "unknown-task" | "unknown-decision" | "already-answered" | "expired" | "outside-ceiling" | "refused";
+export type DoorRefusal = "standing" | "not-yours" | "ceiling-changed" | "not-pending" | "session-ended" | "turn-not-answered" | "turn-running" | "not-confirmable" | "needs-confirm" | "stale" | "claimed" | "not-queued" | "contest-open" | "unknown-task" | "unknown-decision" | "already-answered" | "expired" | "outside-ceiling" | "refused";
 export type DoorOptions = {
+    /** Resolved inside the transaction. Without it, only current subscription terms are available. */
+    chatProvider?: TeamChatProviderResolver;
     evidenceRoot?: string;
     /** Only the secure human review endpoint supplies this; never saved or model-authored. */
     actionReview?: SharedActionOptions["review"];
@@ -36,6 +39,32 @@ export type DoorOptions = {
 };
 /** A coordinator proposal lives seven days (§9); the door refuses an older one whatever the sweep did (v3 review, finding 3). */
 export declare const COORDINATOR_PROPOSAL_TTL_MS: number;
+/** The plain reasons a card shows instead of its controls; the door refuses with the same words. */
+export declare const PROPOSAL_CONTRIBUTOR_REASON = "An authorized contributor can act on this proposal.";
+export declare const PROPOSAL_CHAT_REASON = "Enable chat in this conversation before acting on a proposal.";
+export declare const PROPOSAL_WAIT_REASON = "Available when the current reply finishes.";
+/** Unbound claims get the same wall-clock allowance as a provider turn. */
+export declare const TEAM_UNBOUND_CLAIM_MS = 120000;
+export type ProposalGate = {
+    ok: true;
+} | {
+    ok: false;
+    reason: Extract<DoorRefusal, "not-yours" | "session-ended" | "turn-running">;
+    said: string;
+};
+/**
+ * Whether `who` may act on a card in `thread` right now: the one gate the
+ * cards and the confirm door share. Re-proved from saved state and live provider facts, so
+ * every caller (console, CLI, Telegram) reaches the same answer: the thread
+ * is theirs (or they contribute to its team conversation), chat is enabled
+ * for it under their current generation, and no turn in that thread is
+ * live. A team message still marked running after its turn finished is not
+ * live; the delivery sweep settles it.
+ */
+export declare function proposalActGate(store: Store, who: {
+    name: string;
+    generation: number;
+}, thread: number, now: Date, provider?: TeamChatProviderResolver): ProposalGate;
 export declare function confirmMateProposal(store: Store, who: VerifiedApprover, proposalId: number, now: Date, options: DoorOptions): DoorOutcome;
 /** The operator declines the mate's card: `pending → dismissed`. */
 export declare function dismissMateProposal(store: Store, who: VerifiedApprover, proposalId: number, now: Date): boolean;

package/dist/mate-doors.js

@@ -17,6 +17,9 @@ import { executeSharedAction, sharedActionPayload, sharedActionAllowsChallenge,
 import { isCheckLevel, setTaskCheckLevel } from "./check-levels.js";
 import { mateTurnKeepsProposals, verifiedAuthor } from "./store.js";
 import { isVerifiedApprover, reproveApprover } from "./principal.js";
+import { TURN_WALL_CLOCK_MS } from './converse.js';
+import { teamChatAuthorization, subscriptionTeamChatProvider } from './team-chat-authorization.js';
+import { readProjectAccess } from "./project-access.js";
 import { TeamLeads } from './team-leads.js';
 import { fileTaskProposal } from "./proposal.js";
 import { proposeGuarded } from "./scope.js";
@@ -74,6 +77,38 @@ function recordInTaskChat(store, who, proposal, outcome, via, now) {
     const thread = store.openMateThread(who.name, who.ceilingDigest, now, { kind: "task", key: root }).thread;
     store.appendMateMessage({ thread: thread.id, turn: null, role: "assistant", text: `${where} — ${label}: ${said}` }, now);
 }
+/** The plain reasons a card shows instead of its controls; the door refuses with the same words. */
+export const PROPOSAL_CONTRIBUTOR_REASON = "An authorized contributor can act on this proposal.";
+export const PROPOSAL_CHAT_REASON = "Enable chat in this conversation before acting on a proposal.";
+export const PROPOSAL_WAIT_REASON = "Available when the current reply finishes.";
+/** Unbound claims get the same wall-clock allowance as a provider turn. */
+export const TEAM_UNBOUND_CLAIM_MS = TURN_WALL_CLOCK_MS;
+/**
+ * Whether `who` may act on a card in `thread` right now: the one gate the
+ * cards and the confirm door share. Re-proved from saved state and live provider facts, so
+ * every caller (console, CLI, Telegram) reaches the same answer: the thread
+ * is theirs (or they contribute to its team conversation), chat is enabled
+ * for it under their current generation, and no turn in that thread is
+ * live. A team message still marked running after its turn finished is not
+ * live; the delivery sweep settles it.
+ */
+export function proposalActGate(store, who, thread, now, provider = () => subscriptionTeamChatProvider(store)) {
+    const row = store.getMateThread(thread);
+    const shared = row === null ? undefined : store.handle.prepare("SELECT id,projects_json FROM team_conversation WHERE thread=?").get(thread);
+    if (row === null || (shared ? !store.canUseTeamMateThread(who.name, who.generation, thread) : row.approver !== who.name))
+        return { ok: false, reason: "not-yours", said: PROPOSAL_CONTRIBUTOR_REASON };
+    const session = shared ? store.teamMateSession(who.name, thread) : store.activeMateSession(who.name);
+    const authorized = shared
+        ? teamChatAuthorization(store, who, { id: String(shared['id']), threadId: thread, projects: [...(readProjectAccess(shared['projects_json']) ?? [])] }, provider()).enabled
+        : session !== null && session.endedAt === null && session.approverGeneration === who.generation;
+    if (!authorized) {
+        return { ok: false, reason: "session-ended", said: PROPOSAL_CHAT_REASON };
+    }
+    const live = store.handle.prepare(`SELECT 1 FROM mate_turn WHERE thread=? AND state IN ('queued','running')
+    UNION ALL SELECT 1 FROM team_message q JOIN team_conversation c ON c.id=q.conversation LEFT JOIN mate_turn t ON t.id=q.turn_id
+      WHERE c.thread=? AND q.status='running' AND ((q.turn_id IS NULL AND q.claimed_at>?) OR t.state IN ('queued','running')) LIMIT 1`).get(thread, thread, new Date(now.getTime() - TEAM_UNBOUND_CLAIM_MS).toISOString());
+    return live === undefined ? { ok: true } : { ok: false, reason: "turn-running", said: PROPOSAL_WAIT_REASON };
+}
 export function confirmMateProposal(store, who, proposalId, now, options) {
     if (!isVerifiedApprover(who))
         return { ok: false, kind: null, reason: "standing", said: "your approver standing changed — sign in again" };
@@ -89,10 +124,11 @@ export function confirmMateProposal(store, who, proposalId, now, options) {
         const shared = thread !== null && store.handle.prepare("SELECT id,lead FROM team_conversation WHERE thread=?").get(thread.id);
         if (thread === null || (shared ? !store.canUseTeamMateThread(who.name, who.generation, thread.id) : thread.approver !== who.name))
             return { ok: false, kind: null, reason: "not-yours", said: "no such proposal" };
-        const session = shared ? store.teamMateSession(who.name, thread.id) : store.activeMateSession(who.name);
-        if (session === null || session.approverGeneration !== who.generation) {
-            return { ok: false, kind: proposal.kind, reason: "session-ended", said: "the mate session this was proposed in has ended — its cards cannot be confirmed" };
-        }
+        // The card's own gate: chat enabled for this thread and no live turn in it.
+        const gate = proposalActGate(store, who, thread.id, now, options.chatProvider);
+        if (!gate.ok)
+            return { ok: false, kind: proposal.kind, reason: gate.reason, said: gate.said };
+        const session = (shared ? store.teamMateSession(who.name, thread.id) : store.activeMateSession(who.name));
         if (proposal.ceilingDigest !== who.ceilingDigest || session.ceilingDigest !== who.ceilingDigest) {
             return { ok: false, kind: proposal.kind, reason: "ceiling-changed", said: "the admitted projects changed since this was proposed — it cannot be confirmed" };
         }

package/dist/mcp-connect.d.ts

@@ -64,7 +64,6 @@ export declare function connectionsOf(store: Store, repo: string, home?: string)
  */
 export declare function readsOnly(action: string, subjects: readonly string[]): boolean;
 export declare const readScope: (scope: string) => boolean;
-/** Whether a saved grant only reads: it names at least one scope and every one is a read or identity scope. Unknown (null) never is. */
 export declare const readOnlyGrant: (grant: readonly string[] | null) => boolean;
 /** An OAuth `scope` value as scope tokens (RFC 6749), sorted and deduplicated; null when absent, empty or malformed. */
 export declare function scopeList(value: unknown): string[] | null;

package/dist/mcp-connect.js

@@ -133,7 +133,10 @@ const IDENTITY_SCOPES = new Set(["openid", "profile", "email"]);
 const READ_SCOPE = /^[a-z][a-z0-9_]{0,63}:read$/;
 export const readScope = (scope) => IDENTITY_SCOPES.has(scope) || READ_SCOPE.test(scope);
 /** Whether a saved grant only reads: it names at least one scope and every one is a read or identity scope. Unknown (null) never is. */
-export const readOnlyGrant = (grant) => grant !== null && grant.length > 0 && grant.every(readScope);
+// A scope a server adds to every token without being asked, that grants no access to data. PostHog adds
+// `introspection` (its ALWAYS_ALLOWED_SCOPES): it lets the token be checked, and has no write form. Never requested.
+const GRANTED_ANYWAY = new Set(["introspection"]);
+export const readOnlyGrant = (grant) => grant !== null && grant.some(readScope) && grant.every(scope => readScope(scope) || GRANTED_ANYWAY.has(scope));
 /** An OAuth `scope` value as scope tokens (RFC 6749), sorted and deduplicated; null when absent, empty or malformed. */
 export function scopeList(value) {
     if (typeof value !== "string")

package/dist/serve.js

@@ -272,7 +272,7 @@ import { checkTeamsCredentials, clearTeamsCredentials, loadTeamsCredentials, sav
 import { verifyApproverByPassword, verifyApproverStanding } from "./principal.js";
 import { runMateTurn, MATE_MESSAGE_MAX_CHARS } from "./mate.js";
 import { replyHtmlInline, shapeReply } from "./reply-shape.js";
-import { confirmCoordinatorProposal, confirmMateProposal, dismissCoordinatorProposal, dismissMateProposal } from "./mate-doors.js";
+import { confirmCoordinatorProposal, confirmMateProposal, dismissCoordinatorProposal, dismissMateProposal, proposalActGate, PROPOSAL_WAIT_REASON } from "./mate-doors.js";
 import { envValue } from "./names.js";
 import { cachedRelease, isNewer, runnerVersions, setUpdateChecks, updateChecksOff } from "./releases.js";
 import { installMethod } from "./install-method.js";
@@ -739,13 +739,14 @@ export function createDecisionServer(options) {
     const connectVisits = new Map();
     /** Flows open in a browser (v88): who's here, and a nudge when one changes. */
     const flowRooms = createFlowRooms(flow => flowFingerprint(store, flow));
+    const teamChatProvider = () => { const enabled = chatEnablement(); return enabled.ok ? { config: enabled.config, key: enabled.key } : null; };
     const team = createTeamRuntime({ store, repos: codingProjects, evidenceRoot, clock, workspaceRevision,
         ...(options.chatFetcher ? { fetcher: options.chatFetcher } : {}),
-        provider: () => { const enabled = chatEnablement(); return enabled.ok ? { config: enabled.config, key: enabled.key } : null; },
+        provider: teamChatProvider,
         ...(options.subscriptionChatRunner ? { subscriptionRunner: options.subscriptionChatRunner } : {}),
     });
     // Only browser sessions receive HTML cards. The CLI keeps its summary contract.
-    const teamBrowserReply = (reply, csrf) => {
+    const teamBrowserReply = (reply, actor, csrf) => {
         const snapshot = reply.snapshot;
         if (!snapshot?.selected || !snapshot.proposals)
             return reply;
@@ -754,7 +755,7 @@ export function createDecisionServer(options) {
                     if (!proposal || proposal.thread !== snapshot.selected.threadId)
                         return summary;
                     const decision = proposal.kind === 'answer' && typeof proposal.payload['decision'] === 'number' ? store.getDecision(proposal.payload['decision']) : null;
-                    return { ...summary, card: teamProposalCardParts(proposal, snapshot, csrf, decision).card };
+                    return { ...summary, card: teamProposalCardParts(store, actor, proposal, snapshot, csrf, decision, clock(), teamChatProvider).card };
                 }) } };
     };
     const teamEndpoint = (request, response) => handleTeamHttp(request, response, {
@@ -789,7 +790,7 @@ export function createDecisionServer(options) {
         execute: async (actor, input) => {
             const reply = await team.execute(actor, input);
             const who = identify(request, false);
-            return who?.via === 'cookie' ? teamBrowserReply(reply, who.session.csrf) : reply;
+            return who?.via === 'cookie' ? teamBrowserReply(reply, actor, who.session.csrf) : reply;
         }, cursor: team.cursor, streams: teamStreams,
     });
     const sessionEndpoint = createSessionEndpoint({ store, workspace: coding, projects: codingProjects, projectAllowed: repo => rowVisible(liveCeiling(), repo) });
@@ -3606,7 +3607,7 @@ export function createDecisionServer(options) {
                     operation: url.searchParams.has('conversation') ? 'show' : 'list',
                     args: { ...(url.searchParams.has('conversation') ? { conversationId: url.searchParams.get('conversation') } : {}),
                         ...(url.searchParams.has('lead') ? { leadId: url.searchParams.get('lead') } : {}) },
-                }), who.session.csrf);
+                }), { name: who.name, generation: who.session.generation }, who.session.csrf);
                 if (!reply.ok || !reply.snapshot)
                     return refuse(response, who, 403, reply.message, '/chat?private=1');
                 if (url.searchParams.has('proposal')) {
@@ -3616,7 +3617,7 @@ export function createDecisionServer(options) {
                         return refuse(response, who, 404, 'This proposal is unavailable.', '/chat');
                     const back = '/chat?conversation=' + encodeURIComponent(selected.id);
                     const decision = proposal.kind === 'answer' && typeof proposal.payload['decision'] === 'number' ? store.getDecision(proposal.payload['decision']) : null;
-                    const card = teamProposalCardParts(proposal, reply.snapshot, who.session.csrf, decision).html;
+                    const card = teamProposalCardParts(store, { name: who.name, generation: who.session.generation }, proposal, reply.snapshot, who.session.csrf, decision, clock(), teamChatProvider).html;
                     return sendScreen(response, 200, screen('Review action', `<p><a href="${escape(back)}">Back to conversation</a></p>` + card, { chrome: chromeFor(null, 'chat', undefined, 'all') }));
                 }
                 if (reply.snapshot.leads.length > 0 || url.searchParams.has('conversation') || url.searchParams.get('team') === '1') {
@@ -9645,7 +9646,7 @@ export function createDecisionServer(options) {
                     noteMate(who.session.csrf, null, "that proposal was already acted on");
                 return redirect(response, chatReturnWithLatest(back));
             }
-            const outcome = confirmMateProposal(store, principal, id, now, { confirm: body.get("confirm") === "yes", via: "web", evidenceRoot, held: options.attended?.coordinator, ...(body.has("nonce") ? { actionReview: { nonce: body.get("nonce") ?? "", password: body.get("token") ?? "" } } : {}) });
+            const outcome = confirmMateProposal(store, principal, id, now, { chatProvider: teamChatProvider, confirm: body.get("confirm") === "yes", via: "web", evidenceRoot, held: options.attended?.coordinator, ...(body.has("nonce") ? { actionReview: { nonce: body.get("nonce") ?? "", password: body.get("token") ?? "" } } : {}) });
             if (cardJson) {
                 if (!outcome.ok)
                     return cardAnswer(outcome.reason === "standing" ? 403 : outcome.reason === "not-yours" ? 404 : 409, false, outcome.said);
@@ -18276,7 +18277,7 @@ function proposalCardParts(view, csrf, inert, decision, returnTo = null) {
                             `</div>`;
     }
     else if (view.state === "pending") {
-        acts = `<p class="meta proposal-wait">Available when the current turn finishes.</p>`;
+        acts = `<p class="meta proposal-wait">${escape(PROPOSAL_WAIT_REASON)}</p>`;
     }
     else if (view.state === "confirmed") {
         const filed = outcome !== null && typeof outcome.taskId === "string" ? outcome.taskId : null;
@@ -18325,7 +18326,7 @@ function proposalCardParts(view, csrf, inert, decision, returnTo = null) {
         ],
         primary,
         dismissable: pending && view.kind !== "control",
-        note: view.state === "pending" && inert ? "Available when the current reply finishes."
+        note: view.state === "pending" && inert ? PROPOSAL_WAIT_REASON
             : pending && view.kind === "cancel" ? "Cancelling is confirmed on the task itself."
                 : view.state === "dismissed" ? "Dismissed." : view.state === "expired" ? "Expired — this conversation moved on." : null,
     };
@@ -18338,14 +18339,13 @@ function mateProposalCardParts(proposal, csrf, inert, decision, returnTo = null)
     return proposalCardParts({ id: proposal.id, kind: proposal.kind, payload: proposal.payload, state: proposal.state, outcome: proposal.outcome, by: { mate: true }, actionBase: "/chat/proposal" }, csrf, inert, decision, returnTo);
 }
 /** Review and inline team cards share the same server-decided controls and reasons. */
-function teamProposalCardParts(proposal, snapshot, csrf, decision) {
-    const canAct = snapshot.canSend && snapshot.chatAuthorization?.enabled === true;
-    const active = snapshot.messages.some(message => message.status === 'running');
+function teamProposalCardParts(store, actor, proposal, snapshot, csrf, decision, now, provider) {
+    const gate = proposalActGate(store, actor, proposal.thread, now, provider);
+    const reason = !gate.ok ? gate.said : null;
     const back = '/chat?conversation=' + encodeURIComponent(snapshot.selected.id);
-    const parts = mateProposalCardParts(proposal, csrf, !canAct || active, decision, back);
-    if (!canAct && proposal.state === 'pending') {
-        const reason = snapshot.canSend ? 'Enable chat in this conversation before acting on a proposal.' : 'An authorized contributor can act on this proposal.';
-        parts.html = parts.html.replace('Available when the current turn finishes.', reason);
+    const parts = mateProposalCardParts(proposal, csrf, reason !== null, decision, back);
+    if (reason !== null && reason !== PROPOSAL_WAIT_REASON && proposal.state === 'pending') {
+        parts.html = parts.html.replace(PROPOSAL_WAIT_REASON, reason);
         parts.card = { ...parts.card, note: reason };
     }
     return parts;

package/dist/team-chat-authorization.d.ts

@@ -0,0 +1,11 @@
+import type { Store, ChatConfig } from './store.js';
+import type { TeamActor, TeamChatAuthorization, TeamSnapshot } from './team-contract.js';
+export type TeamChatProvider = {
+    config: ChatConfig;
+    key: string | null;
+};
+export type TeamChatProviderResolver = () => TeamChatProvider | null;
+/** Subscription-only surfaces can resolve current terms from saved settings.
+ * Direct API callers must supply their live key; a stored grant is never proof of it. */
+export declare function subscriptionTeamChatProvider(store: Store): TeamChatProvider | null;
+export declare function teamChatAuthorization(store: Store, actor: TeamActor, conversation: Pick<NonNullable<TeamSnapshot['selected']>, 'id' | 'threadId' | 'projects'> | null, live: TeamChatProvider | null): TeamChatAuthorization;

package/dist/team-chat-authorization.js

@@ -0,0 +1,33 @@
+/** The live grant shared by team execution, proposal cards and confirmation doors. */
+import { createHash } from 'node:crypto';
+import { ceilingDigestOf } from './principal.js';
+import { credentialKeyOf, isDirectChatProvider, priceForConfig, subscriptionCredentialKey } from './converse.js';
+const hash = (value) => createHash('sha256').update(JSON.stringify(value)).digest('hex');
+/** Subscription-only surfaces can resolve current terms from saved settings.
+ * Direct API callers must supply their live key; a stored grant is never proof of it. */
+export function subscriptionTeamChatProvider(store) {
+    const config = store.getChatConfig();
+    return config && !isDirectChatProvider(config.provider) ? { config, key: null } : null;
+}
+export function teamChatAuthorization(store, actor, conversation, live) {
+    const config = live?.config;
+    const empty = { enabled: false, provider: config?.provider ?? null, model: config?.model ?? null,
+        dailyTurns: config?.dailyTurns ?? 0, weeklyCeilingUsd: null, conversationCeilingUsd: null, termsDigest: '' };
+    if (!conversation)
+        return empty;
+    if (!live || !config)
+        return { ...empty, waitingReason: 'Choose a chat provider in Settings.' };
+    const direct = isDirectChatProvider(config.provider);
+    if (direct && (live.key === null || priceForConfig(config) === null))
+        return { ...empty, waitingReason: 'The configured chat connection is unavailable. Open Settings.' };
+    const credential = direct ? credentialKeyOf(config.provider, live.key) : subscriptionCredentialKey(config.provider);
+    const session = store.teamMateSession(actor.name, conversation.threadId);
+    const ceiling = direct ? (session ? session.ceilingMicrousd / 1_000_000 : Math.min(5, config.weeklyCeilingMicrousd / 1_000_000)) : null;
+    const termsDigest = hash({ version: 1, actor: actor.name, generation: actor.generation, conversation: conversation.id,
+        projects: conversation.projects, credential, provider: config.provider, model: config.model,
+        daily: config.dailyTurns, weekly: config.weeklyCeilingMicrousd, priceIn: config.priceInMicrousd, priceOut: config.priceOutMicrousd, ceiling });
+    const enabled = session !== null && session.approverGeneration === actor.generation && session.endedAt === null
+        && session.credentialKey === credential && session.ceilingDigest === ceilingDigestOf(conversation.projects) && session.termsDigest === termsDigest;
+    return { enabled, provider: config.provider, model: config.model, dailyTurns: config.dailyTurns,
+        weeklyCeilingUsd: direct ? config.weeklyCeilingMicrousd / 1_000_000 : null, conversationCeilingUsd: ceiling, termsDigest };
+}

package/dist/team-runtime.d.ts

@@ -1,16 +1,14 @@
-import type { Store, ChatConfig } from './store.js';
+import type { Store } from './store.js';
 import type { WorkspaceRevision } from './workspace-revision.js';
 import { TeamLeads } from './team-leads.js';
 import type { TeamActor, TeamExecute } from './team-contract.js';
 import { type MateTurnInput } from './mate.js';
+import { type TeamChatProviderResolver } from './team-chat-authorization.js';
 export type TeamRuntimeOptions = {
     store: Store;
     repos: () => readonly string[];
     evidenceRoot: string;
-    provider: () => {
-        config: ChatConfig;
-        key: string | null;
-    } | null;
+    provider: TeamChatProviderResolver;
     subscriptionRunner?: MateTurnInput['subscriptionRunner'];
     fetcher?: typeof fetch;
     clock?: () => Date;

package/dist/team-runtime.js

@@ -4,9 +4,10 @@ import { createHash, randomUUID } from 'node:crypto';
 import { deliverTeamUpdates, startTeamUpdates } from './team-updates.js';
 import { workIndexPage } from './work-index.js';
 import { TeamLeads } from './team-leads.js';
-import { ceilingDigestOf, verifyApproverStanding } from './principal.js';
+import { verifyApproverStanding } from './principal.js';
 import { credentialKeyOf, isDirectChatProvider, priceForConfig, subscriptionCredentialKey, mateWorstCaseForPrice } from './converse.js';
 import { runMateTurn } from './mate.js';
+import { teamChatAuthorization } from './team-chat-authorization.js';
 import { updateAdmissionPaused } from './desktop-update-gate.js';
 const hash = (value) => createHash('sha256').update(JSON.stringify(value)).digest('hex');
 const response = (ok, code, message) => ({ version: 1, ok, code, message });
@@ -20,28 +21,7 @@ export function createTeamRuntime(options) {
     const waiting = new Map();
     const pages = new Map();
     let timer = null, closed = false, passing = false, lastDelivery = 0;
-    function authorization(actor, snapshot) {
-        const live = options.provider(), config = live?.config, conversation = snapshot.selected;
-        const empty = { enabled: false, provider: config?.provider ?? null, model: config?.model ?? null,
-            dailyTurns: config?.dailyTurns ?? 0, weeklyCeilingUsd: null, conversationCeilingUsd: null, termsDigest: '' };
-        if (!conversation)
-            return empty;
-        if (!live || !config)
-            return { ...empty, waitingReason: 'Choose a chat provider in Settings.' };
-        const direct = isDirectChatProvider(config.provider);
-        if (direct && (live.key === null || priceForConfig(config) === null))
-            return { ...empty, waitingReason: 'The configured chat connection is unavailable. Open Settings.' };
-        const credential = direct ? credentialKeyOf(config.provider, live.key) : subscriptionCredentialKey(config.provider);
-        const session = store.teamMateSession(actor.name, conversation.threadId);
-        const ceiling = direct ? (session ? session.ceilingMicrousd / 1_000_000 : Math.min(5, config.weeklyCeilingMicrousd / 1_000_000)) : null;
-        const termsDigest = hash({ version: 1, actor: actor.name, generation: actor.generation, conversation: conversation.id,
-            projects: conversation.projects, credential, provider: config.provider, model: config.model,
-            daily: config.dailyTurns, weekly: config.weeklyCeilingMicrousd, priceIn: config.priceInMicrousd, priceOut: config.priceOutMicrousd, ceiling });
-        const enabled = session !== null && session.approverGeneration === actor.generation && session.endedAt === null
-            && session.credentialKey === credential && session.ceilingDigest === ceilingDigestOf(conversation.projects) && session.termsDigest === termsDigest;
-        return { enabled, provider: config.provider, model: config.model, dailyTurns: config.dailyTurns,
-            weeklyCeilingUsd: direct ? config.weeklyCeilingMicrousd / 1_000_000 : null, conversationCeilingUsd: ceiling, termsDigest };
-    }
+    const authorization = (actor, snapshot) => teamChatAuthorization(store, actor, snapshot.selected, options.provider());
     function admission(actor, id) {
         const conversation = domain.access(actor, id, 'contributor').conversation;
         const grant = authorization(actor, { selected: conversation }), live = options.provider();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolroll",
-  "version": "0.9.39",
+  "version": "0.9.41",
   "description": "A control plane for unattended coding agents — queue tasks, walk away, come back to pull requests. Agents build in leased worktrees, never touch your default branch, and interrupt you only for decisions that need a human.",
   "directories": {
     "doc": "docs"