toolroll 0.9.42 → 0.9.44

package/dist/remote-exec.js

@@ -0,0 +1,241 @@
+/**
+ * Remote CLI, the client half (Phase 1). With an API token saved by `toolroll connect`, a command whose contract row
+ * says `remote: "yes"` is sent to the central server's `POST /api/cli` and runs there as you; its stdout, stderr and
+ * exit code come back byte for byte. `remote: "no"` runs on this computer exactly as before, and `remote: "step-up"`
+ * (approvals, people and policy) is refused here: those stay in the console or chat.
+ *
+ * Nothing here opens the local database or reads a saved owner login; it never prompts, and an uncertain answer to
+ * a mutation is never retried.
+ */
+import { readFileSync, statSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { setTimeout as delay } from 'node:timers/promises';
+import { envelopeJson } from './envelope.js';
+import { COMMAND_GUIDE } from './surface.js';
+import { centralProfile, UsageError } from './team-cli.js';
+import { CLI_FILES_BYTES, CLI_WAIT_SECONDS } from './cli-http.js';
+import { contractRow, fileArguments, STEP_UP_MESSAGE } from './remote-command.js';
+export { contractRow, STEP_UP_MESSAGE } from './remote-command.js';
+const EXIT = { ok: 0, failed: 1, usage: 2, refused: 3 };
+/** Team commands own their own central path (team-cli.ts). */
+const TEAM_COMMANDS = new Set(['connect', 'lead', 'conversation', 'chat', 'brief']);
+const RESPONSE_BYTES = 16 * 1024 * 1024;
+const REQUEST_TIMEOUT_MS = (CLI_WAIT_SECONDS + 35) * 1_000;
+async function bounded(response) {
+    if (!response.body)
+        throw new Error('empty');
+    const reader = response.body.getReader(), chunks = [];
+    let size = 0;
+    try {
+        while (true) {
+            const chunk = await reader.read();
+            if (chunk.done)
+                break;
+            size += chunk.value.byteLength;
+            if (size > RESPONSE_BYTES) {
+                await reader.cancel();
+                throw new Error('too-large');
+            }
+            chunks.push(chunk.value);
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    return JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(Buffer.concat(chunks)));
+}
+/** One request, never retried. */
+async function post(origin, token, request, options) {
+    try {
+        const timeout = AbortSignal.timeout(REQUEST_TIMEOUT_MS);
+        const response = await (options.fetch ?? fetch)(`${origin}/api/cli`, {
+            method: 'POST', redirect: 'manual', credentials: 'omit', signal: options.signal ? AbortSignal.any([options.signal, timeout]) : timeout,
+            headers: { authorization: `Bearer ${token}`, 'content-type': 'application/json', accept: 'application/json' }, body: JSON.stringify(request),
+        });
+        if (response.status >= 300 && response.status < 400) {
+            await response.body?.cancel();
+            return { kind: 'unconfirmed' };
+        }
+        const payload = await bounded(response);
+        if (payload === null || typeof payload !== 'object' || Array.isArray(payload))
+            return { kind: 'unconfirmed' };
+        if (response.status === 200 && Number.isInteger(payload.exitCode) && Number(payload.exitCode) >= 0 && Number(payload.exitCode) <= 255 && typeof payload.stdout === 'string' && typeof payload.stderr === 'string') {
+            return { kind: 'answer', answer: { exitCode: Number(payload.exitCode), stdout: payload.stdout, stderr: payload.stderr } };
+        }
+        if (response.status >= 400 && payload.ok === false && typeof payload.code === 'string' && typeof payload.message === 'string') {
+            return { kind: 'refused', status: response.status, code: payload.code, message: payload.message.replace(/[\x00-\x08\x0b-\x1f\x7f]/g, '') };
+        }
+        return { kind: 'unconfirmed' };
+    }
+    catch {
+        return { kind: 'unconfirmed' };
+    }
+}
+/** The declared file arguments' contents, keyed by the argument exactly as typed. argv is never rewritten. */
+function inlineFiles(argv, row, cwd) {
+    const paths = fileArguments(argv, row);
+    if ('problem' in paths)
+        throw new UsageError(paths.problem);
+    const files = Object.create(null);
+    let size = 0;
+    for (const value of paths) {
+        if (Object.hasOwn(files, value))
+            continue;
+        const path = resolve(cwd, value);
+        let isFile = false;
+        try {
+            isFile = statSync(path).isFile();
+        }
+        catch {
+            isFile = false;
+        }
+        if (!isFile)
+            throw new UsageError('A remote input must be a readable file.');
+        let content;
+        try {
+            content = new TextDecoder('utf-8', { fatal: true }).decode(readFileSync(path));
+        }
+        catch {
+            throw new UsageError('A remote input must be a readable UTF-8 file.');
+        }
+        size += Buffer.byteLength(content);
+        if (size > CLI_FILES_BYTES)
+            throw new UsageError('Files sent with a remote command are limited to 256 KiB in total. Use --local to run it here.');
+        files[value] = content;
+    }
+    return files;
+}
+/**
+ * null: run locally with argv unchanged. `{ local }`: run locally with this argv (`--local` removed).
+ * A number: the command ran remotely (or was refused before sending) and this is its exit code.
+ */
+export async function maybeRunRemoteCommand(argv, options = {}) {
+    const first = argv[0];
+    if (first === undefined || first.startsWith('-') || TEAM_COMMANDS.has(first) || first === 'help')
+        return null;
+    const out = options.stdout ?? (chunk => { process.stdout.write(chunk); });
+    const err = options.stderr ?? (chunk => { process.stderr.write(chunk); });
+    const json = argv.includes('--json');
+    const lookup = options.modeOf ?? contractRow;
+    const row = lookup(argv);
+    const command = row?.invocation ?? first;
+    const refuse = (reason, message, code) => {
+        if (json)
+            out(`${envelopeJson({ ok: false, command, reason, message })}\n`);
+        else
+            err(`${message}\n`);
+        return code;
+    };
+    const profileAt = argv.indexOf('--profile');
+    const mode = row?.mode ?? 'no';
+    const explicit = profileAt >= 0;
+    // Local commands never read the profile, and their own flags (the scan's --local) stay exactly as typed.
+    if (mode === 'no' && !explicit)
+        return null;
+    if (argv.includes('--local')) {
+        if (explicit)
+            return refuse('usage', '--local cannot be combined with --profile.', EXIT.usage);
+        // A row declaring --local keeps its own meaning; elsewhere it only means "run here".
+        const declared = COMMAND_GUIDE.find(one => one.invocation === row?.invocation)?.flags?.some(flag => flag.name === 'local') ?? false;
+        return { local: declared ? [...argv] : argv.filter(one => one !== '--local') };
+    }
+    let profile;
+    try {
+        if (profileAt >= 0 && (argv.filter(one => one === '--profile').length > 1 || !argv[profileAt + 1] || argv[profileAt + 1].startsWith('-')))
+            throw new UsageError('Use --profile <name> once.');
+        profile = centralProfile(options, profileAt >= 0 ? argv[profileAt + 1] : undefined);
+    }
+    catch (error) {
+        return refuse('usage', error instanceof UsageError ? error.message : 'The remote profile cannot be read.', EXIT.usage);
+    }
+    // No saved token: today's local behaviour. A profile saved with a password serves chat only.
+    if (profile === null || !profile.apiToken) {
+        if (!explicit)
+            return null;
+        return refuse('usage', 'This profile has no API token. Connect again with your so_ token (toolroll connect <origin> --token-stdin).', EXIT.usage);
+    }
+    if (row === null || mode === 'no') {
+        return refuse('usage', `${command} runs only on this computer. Drop --profile to run it here.`, EXIT.usage);
+    }
+    if (mode === 'step-up')
+        return refuse('step-up', STEP_UP_MESSAGE, EXIT.refused);
+    const sent = explicit ? argv.filter((_one, index) => index !== profileAt && index !== profileAt + 1) : [...argv];
+    let files;
+    try {
+        files = inlineFiles(sent, row, options.cwd ?? process.cwd());
+    }
+    catch (error) {
+        return refuse('usage', error instanceof UsageError ? error.message : 'A file could not be read.', EXIT.usage);
+    }
+    const deliver = (outcome) => {
+        if (outcome.kind === 'answer') {
+            // Byte for byte. --json answers are also captured so -o writes the same envelope a local run would.
+            if (json) {
+                try {
+                    const parsed = JSON.parse(outcome.answer.stdout);
+                    if (parsed && typeof parsed === 'object' && !Array.isArray(parsed))
+                        envelopeJson(parsed);
+                }
+                catch { /* not one envelope */ }
+            }
+            if (outcome.answer.stdout)
+                out(outcome.answer.stdout);
+            if (outcome.answer.stderr)
+                err(outcome.answer.stderr);
+            return outcome.answer.exitCode;
+        }
+        if (outcome.kind === 'refused')
+            return refuse(outcome.code, outcome.message, outcome.status === 401 || outcome.status === 403 || outcome.status === 501 ? EXIT.refused : outcome.status < 500 ? EXIT.usage : EXIT.failed);
+        return refuse('unconfirmed', row?.mutation === 'none'
+            ? `${profile.origin} could not be reached or answered unexpectedly.`
+            : `The answer from ${profile.origin} could not be confirmed. Check the task's state before running this again; it was not retried.`, EXIT.failed);
+    };
+    if (row?.invocation === 'task wait')
+        return waitRemotely(sent, files, profile, options, deliver);
+    return deliver(await post(profile.origin, profile.token, { argv: sent, files }, options));
+}
+/**
+ * `task wait` holds the server for at most CLI_WAIT_SECONDS per request; the client keeps asking within the caller's
+ * own --timeout (none: until the task settles or the wait is interrupted). The final answer is the server's own.
+ */
+async function waitRemotely(argv, files, profile, options, deliver) {
+    const at = argv.indexOf('--timeout');
+    const given = at < 0 ? null : Number(argv[at + 1]);
+    const base = at < 0 ? argv : argv.filter((_one, index) => index !== at && index !== at + 1);
+    if (given !== null && (!Number.isFinite(given) || given < 0))
+        return deliver(await post(profile.origin, profile.token, { argv, files }, options));
+    const json = base.includes('--json');
+    const probe = json ? base : [...base, '--json'];
+    const started = Date.now();
+    const sleep = options.sleep ?? ((ms, signal) => delay(ms, undefined, { signal }));
+    const signal = options.signal ?? new AbortController().signal;
+    while (true) {
+        const remaining = given === null ? CLI_WAIT_SECONDS : Math.max(0, given - (Date.now() - started) / 1_000);
+        const slice = Math.min(CLI_WAIT_SECONDS, Math.floor(remaining * 1_000) / 1_000);
+        const outcome = await post(profile.origin, profile.token, { argv: [...probe, '--timeout', String(slice)], files }, options);
+        if (outcome.kind !== 'answer')
+            return deliver(outcome);
+        let reason;
+        try {
+            reason = JSON.parse(outcome.answer.stdout).reason;
+        }
+        catch {
+            return deliver(outcome);
+        }
+        const timedOut = reason === 'timeout';
+        if (!timedOut || slice <= 0 || given !== null && remaining - slice <= 0) {
+            if (json)
+                return deliver(outcome);
+            // Settled (or out of time): the server renders the final answer in the person's own format.
+            return deliver(await post(profile.origin, profile.token, { argv: [...base, '--timeout', '0'], files }, options));
+        }
+        if (signal.aborted)
+            return deliver(outcome);
+        try {
+            await sleep(250, signal);
+        }
+        catch {
+            return deliver(outcome);
+        }
+    }
+}

package/dist/remote-run.d.ts

@@ -0,0 +1,16 @@
+/** A principal re-proved against the store for one remote run. */
+export type RemoteRun = {
+    readonly account: string;
+    readonly scope: "read" | "act";
+    readonly tokenName: string;
+    readonly source: "api" | "mcp";
+    /** What credential lookups hand back for this person in place of a password: unguessable, this run only. */
+    readonly secret: string;
+    /** Whether the person may use `repo` now (their token's projects and their account's current access). */
+    readonly allows: (repo: string | null) => boolean;
+    /** Files the caller sent, keyed by the argument that names them. Nothing else is read for input. */
+    readonly files: Readonly<Record<string, string>>;
+};
+/** The remote run this code is inside, or null for every local command. */
+export declare function activeRemote(): RemoteRun | null;
+export declare function withRemote<T>(run: RemoteRun, fn: () => T): T;

package/dist/remote-run.js

@@ -0,0 +1,13 @@
+/**
+ * The remote run this code is inside (runOperateAs in operate.ts), if any. A leaf module so the credential
+ * checks every command reaches (scope.ts) can honour it without importing the command table.
+ */
+import { AsyncLocalStorage } from "node:async_hooks";
+const running = new AsyncLocalStorage();
+/** The remote run this code is inside, or null for every local command. */
+export function activeRemote() {
+    return running.getStore() ?? null;
+}
+export function withRemote(run, fn) {
+    return running.run(run, fn);
+}

package/dist/scope.d.ts

@@ -263,8 +263,10 @@ export type Scope = SavedScopeTerms & {
     /** The digest that was actually agreed to, which may now be stale. */
     approvedDigest: string | null;
     /** How the approval happened (v29): 'password' = the ceremony;
-     * 'mode' = sealed by the signer's live mode (modeDigest names it). */
-    approvalBasis?: "password" | "mode" | null;
+     * 'mode' = sealed by the signer's live mode (modeDigest names it);
+     * 'chat' = the owner's own two taps in their paired chat, under their chat-approval setting or a signed term
+     * (modeDigest names that authority; the yes is the person's and doesn't lapse with it). */
+    approvalBasis?: "password" | "mode" | "chat" | null;
     modeDigest?: string | null;
     /** v24 (optional so hand-built scopes in tests stay valid): the working
      * execution profile, its resolution state, and the immutable snapshot

package/dist/scope.js

@@ -4,6 +4,7 @@ import { passwordGuardOf } from "./sign-in-guard.js";
 import { validateScopeText } from "./task-text.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { projectAuthority } from "./project-access.js";
+import { activeRemote } from "./remote-run.js";
 import { claimActor, currentActor, parseLeadToken } from "./actor.js";
 /**
  * What a task is allowed to become, agreed before anything builds it.
@@ -707,6 +708,15 @@ password) {
 export function authenticateAccount(store, by, secret) {
     if (store.listApprovers().length === 0)
         return { ok: false, reason: "no-approvers" };
+    // A remote run (runOperateAs) is its token's person: only that run's own credential names them, no password is
+    // checked or counted, and a read token stands as a viewer.
+    const remote = activeRemote();
+    if (remote !== null) {
+        const account = by === remote.account && secret === remote.secret ? store.accountOf(by) : null;
+        if (account === null || account.revokedAt !== null)
+            return { ok: false, reason: "unknown" };
+        return { ok: true, role: remote.scope === "act" ? account.role : "viewer", generation: account.generation };
+    }
     // A lead token signs in as its owner, only inside a command the lead runs with it (never a console sign-in).
     const acting = currentActor();
     if (acting?.lead === true && parseLeadToken(secret) !== null) {

package/dist/serve.d.ts

@@ -3,6 +3,7 @@ import { CodingWorkspace } from './coding-workspace.js';
 import { type FetchLike } from "./flow-share.js";
 import { type MailSender } from "./flow-actions.js";
 import { type TriggerIo } from "./flow-triggers.js";
+import { type CliHttpOptions, type RunOperateAs } from './cli-http.js';
 import { type AssignmentSnapshot } from './assignment.js';
 import type { PublishExec } from './publish.js';
 import { type TaskStatus } from './task-status.js';
@@ -24,6 +25,8 @@ import type { RevisionLineage } from "./store.js";
 import type { SubscriptionMateRunner } from "./subscription-chat.js";
 import { type InstallMethod } from "./install-method.js";
 export type ServeOptions = {
+    /** Tests: runs a person's command for the HTTP MCP gateway instead of operate.ts's. */
+    runOperateAs?: import("./mcp-person.js").RunOperateAs;
     /** `toolroll demo`: the scripted lead that answers Chat instead of a model. */
     demoLead?: import("./demo.js").DemoLead;
     /** Tests: the bin whose real path says how Toolroll was installed (Settings → Updates' command). */
@@ -41,6 +44,10 @@ export type ServeOptions = {
      * install/push cards light up. X-Forwarded-* is never consulted.
      */
     publicUrl?: string;
+    /** Tests: the shared command boundary `POST /api/cli` runs (default: operate.ts's runOperateAs). */
+    cliRunner?: RunOperateAs;
+    /** Tests: remote command metadata until the shared contract declares it. */
+    cliModeOf?: CliHttpOptions['modeOf'];
     /** Where repos.json lives — every enrollment locks exactly this file. */
     registryPath?: string;
     /** This console fronts an `up` process: onboarding copy says how to watch. */

package/dist/serve.js

@@ -67,6 +67,7 @@ import { learningHtml } from "./workspace-ui.js";
 import { acceptWithChecksOf, resultActsOf } from "./result-acts.js";
 import { createSessionEndpoint } from './session-server.js';
 import { handleTeamHttp } from './team-http.js';
+import { handleCliHttp } from './cli-http.js';
 import { teamWorkspaceHtml } from './team-ui.js';
 import { createTeamRuntime } from './team-runtime.js';
 import { prepareWorkspaceRevision, WorkspaceValidatorCache } from "./workspace-revision.js";
@@ -154,6 +155,7 @@ import { MODELS_CSS, modelsHtml, modelsScript } from "./models-ui.js";
 import { ASSISTANTS, modelChoices, detectPreparation, previewProjectInstructions, addProjectInstructions } from "./setup-guide.js";
 import { previewSetup, approveSetup } from "./control-setup.js";
 import { controlSetupHtml, setupPreviewHtml, connectionHtml, connectionWords, hiddenFields } from "./control-ui.js";
+import { ALL_PROJECTS as CHAT_APPROVAL_ALL, chatApprovalWords, setChatApproval } from "./chat-approval.js";
 import { composerSchedule, scheduleEditorHtml, scheduleEditorScript } from "./task-composer.js";
 import { listCoordinators } from "./coordinator.js";
 import { diagnoseTaskDispatch, withDispatchDiagnoses } from "./dispatch.js";
@@ -261,6 +263,7 @@ import { budgetHoldWords, budgetLabel, budgetStates, monthNamed, monthOf, spendI
 import { targetOf } from "./monitoring.js";
 import { SSO_CSS, ssoSettingsHtml } from "./sso-ui.js";
 import { mintApiToken, parseApiToken, secretMatches, TOKEN_DAYS } from "./api-tokens.js";
+import { createMcpHttp } from "./mcp-http.js";
 import { CREDENTIALS_CSS, credentialsHtml, tokenShownHtml } from "./credentials-ui.js";
 import { logEvent } from "./log.js";
 import { modeTermsFromJson, modeWords, presetTerms, modeTermsJson, modeDigestOf, MODE_MAX_DAYS } from "./modes.js";
@@ -794,6 +797,21 @@ export function createDecisionServer(options) {
             return who?.via === 'cookie' ? teamBrowserReply(reply, actor, who.session.csrf) : reply;
         }, cursor: team.cursor, streams: teamStreams,
     });
+    // Remote CLI: one live API token names the person; the shared command boundary decides everything else.
+    const cliEndpoint = (request, response) => handleCliHttp(request, response, {
+        authenticate: request => {
+            const who = identify(request, false);
+            const id = parseApiToken(/^Bearer (so_\S+)$/.exec(request.headers.authorization ?? "")?.[1] ?? "")?.id;
+            const row = id === undefined ? undefined : store.apiTokenSecret(id)?.row;
+            const account = who === null ? null : store.accountOf(who.name);
+            if (who?.via !== "bearer" || who.token === undefined || row === undefined || row.account !== who.name || account === null || account.revokedAt !== null)
+                return null;
+            return { kind: "person", account: who.name, generation: account.generation, scope: row.access, tokenId: row.id, projects: account.projects === null ? null : [...account.projects] };
+        },
+        run: async () => options.cliRunner ?? (await import("./operate.js")).runOperateAs ?? null,
+        modeOf: options.cliModeOf,
+        store,
+    });
     const sessionEndpoint = createSessionEndpoint({ store, workspace: coding, projects: codingProjects, projectAllowed: repo => rowVisible(liveCeiling(), repo) });
     /** The enumerable admission list for roll-up SQL: repos-only ceilings
      * enumerate themselves; root ceilings enumerate the STORED repos that
@@ -1225,6 +1243,9 @@ export function createDecisionServer(options) {
         if (url.searchParams.has("token")) {
             return respond(response, 400, "text/plain; charset=utf-8", "credentials never travel in URLs");
         }
+        // The MCP gateway over HTTP (mcp-http.ts): coordinators and people's own API tokens, after the Host check.
+        if (url.pathname === "/mcp")
+            return mcpHttp(request, response);
         // Back from Google's consent screen (v89). The session cookie is SameSite=Strict and stays behind on
         // a return from another site: the visit's one-time state (made by a signed-in approver) is the proof.
         if (url.pathname === GOOGLE_CALLBACK && request.method === "GET")
@@ -1236,6 +1257,8 @@ export function createDecisionServer(options) {
             return;
         if (await teamEndpoint(request, response))
             return;
+        if (await cliEndpoint(request, response))
+            return;
         if (options.configDir !== undefined && await handleTeamsHttp(request, response, { store, dir: options.configDir, ...(options.teamsFetcher ? { fetcher: options.teamsFetcher } : {}), clock }))
             return;
         if (serveBrowserAsset(request, response, url.pathname))
@@ -1721,7 +1744,7 @@ export function createDecisionServer(options) {
             const ref = run === null ? null : store.refForId(run.taskRef);
             return { repo: ref?.repo ?? null, taskId: ref?.externalId ?? null, runId, action: `${resource[1] === "d" ? "decision" : resource[1] === "i" ? "incident" : "run"} ${resource[3] ?? "view"}` };
         }
-        const known = new Set(["/recipes/prepare", "/recipes/preview", "/recipes/import", "/recipes/save", "/recipes/launch", "/tasks/add", "/queue/move", "/queue/note", "/routines/add", "/people/invite", "/people/invite-revoke", "/people/revoke", "/people/projects", "/projects/select", "/projects/open", "/mode/confirm", "/mode/sign", "/mode/revoke"]);
+        const known = new Set(["/recipes/prepare", "/recipes/preview", "/recipes/import", "/recipes/save", "/recipes/launch", "/tasks/add", "/queue/move", "/queue/note", "/routines/add", "/people/invite", "/people/invite-revoke", "/people/revoke", "/people/projects", "/projects/select", "/projects/open", "/mode/confirm", "/mode/sign", "/mode/revoke", "/settings/chat-approval/save", "/settings/chat-approval/off"]);
         const placed = ["/tasks/add", "/routines/add"].includes(url.pathname) ? body?.get("repo")?.trim() : null;
         return { repo: url.pathname.startsWith("/people/") ? null : placed ? canonicalProject(placed) ?? placed : projectOf(who, request) ?? null, taskId: null, runId: null,
             action: known.has(url.pathname) ? url.pathname.slice(1).replaceAll("/", " ") : "console request" };
@@ -1749,6 +1772,9 @@ export function createDecisionServer(options) {
         if ((request.method === "GET" && path === "/settings/telegram") ||
             (request.method === "POST" && ["/settings/telegram/pair", "/settings/telegram/unpair", "/settings/telegram/retry"].includes(path)))
             return true;
+        // A person's own chat-approval setting; the route proves each project it names.
+        if (request.method === "POST" && ["/settings/chat-approval/confirm", "/settings/chat-approval/save", "/settings/chat-approval/off"].includes(path))
+            return true;
         // Coding routes require an instance operator, then prove saved ownership and project access.
         if (path === "/code" || path.startsWith("/code/"))
             return true;
@@ -7287,7 +7313,7 @@ export function createDecisionServer(options) {
                 const note = (body.get("note") ?? "").trim() || null;
                 if (note !== null && note.length > LIMITS.note)
                     return answer(400, { ok: false, said: `Keep the note to ${LIMITS.note.toLocaleString("en-US")} characters; this is ${note.length.toLocaleString("en-US")}.` });
-                const decided = decideFlowCard(store, { card: target.id, decision, note, actor: who.name, repos: projects, evidenceRoot, draft: body.get("draft") }, now);
+                const decided = decideFlowCard(store, { card: target.id, decision, note, actor: who.name, repos: projects, evidenceRoot, draft: body.get("draft"), where: "the console" }, now);
                 return decided.ok ? settle(decided.said) : answer(409, { ok: false, said: decided.message });
             }
             if (verb === "choose") {
@@ -8287,6 +8313,51 @@ export function createDecisionServer(options) {
             store.retryTelegramReplies(who.name, now);
             return redirect(response, "/settings/telegram");
         }
+        // Approving from chat, as the person's lasting setting (chat-approval.ts): for all their projects or one. Turning it
+        // on or changing its limits is the mode's ceremony (the exact terms, a single-use nonce bound to them, the password
+        // typed again); turning it off is one step, csrf only. Every change is a ledger line.
+        if (url.pathname === "/settings/chat-approval/confirm" || url.pathname === "/settings/chat-approval/save" || url.pathname === "/settings/chat-approval/off") {
+            const body = readForm(posted, CONSOLE_FORMS.chatApproval);
+            if (who.via !== "cookie" || who.role !== "approver")
+                return refuse(response, who, 403, "An approver turns on approving from their own chat.", "/settings");
+            if (["scope", "full-access", "cap-usd", "nonce", "digest", "token"].some(key => body.getAll(key).length > 1))
+                return refuse(response, who, 400, "Submit one value for each field.", "/settings");
+            const given = (body.get("scope") ?? "all").trim();
+            const scope = given === "all" || given === "" ? CHAT_APPROVAL_ALL : canonicalProject(given) ?? given;
+            if (scope !== CHAT_APPROVAL_ALL && !(visible(scope) && store.accountCanAccess(who.name, scope)))
+                return refuse(response, who, 403, "That isn't one of your projects.", "/settings");
+            const where = scope === CHAT_APPROVAL_ALL ? "all your projects" : projectName(scope);
+            if (url.pathname.endsWith("/off")) {
+                const saved = setChatApproval(store, { approver: who.name, scope, enabled: false, via: "the console" }, now);
+                return saved.ok ? redirect(response, `/settings?said=${encodeURIComponent(saved.said)}`) : refuse(response, who, 400, saved.message, "/settings");
+            }
+            const usd = (body.get("cap-usd") ?? "").trim();
+            const cap = usd === "" ? null : Number(usd);
+            if (cap !== null && !(Number.isFinite(cap) && cap >= 0 && cap <= 10_000))
+                return refuse(response, who, 400, "Give the attempt limit in dollars, like 5.", "/settings");
+            const limits = { fullAccess: body.get("full-access") === "1", capMicrousd: cap === null ? null : Math.round(cap * 1_000_000) };
+            const digest = createHash("sha256").update(JSON.stringify({ scope, ...limits })).digest("hex");
+            if (url.pathname.endsWith("/confirm")) {
+                const nonce = mintApprovalNonce(who.name, "chat-approval", digest);
+                const html = `<h1 style="overflow-wrap:anywhere">Approve from chat in ${escape(where)}</h1>` +
+                    `<form method="post" action="/settings/chat-approval/save" class="card approve-form">` +
+                    hiddenFields({ csrf: who.session.csrf, nonce, digest, scope: scope === CHAT_APPROVAL_ALL ? "all" : scope, "full-access": limits.fullAccess ? "1" : "", "cap-usd": usd }) +
+                    `<p>Your own taps in your paired chat approve plans and merges until you turn this off. It doesn't expire.</p>` +
+                    `<p class="recap">Limits: ${escape(chatApprovalWords(limits))}.</p>` +
+                    `<p class="recap">Plans written for you, protected paths, two-person rules and your organisation's policy still open in Toolroll.</p>` +
+                    `<label>Your password<input type="password" name="token" autocomplete="current-password" required></label>` +
+                    `<div class="sticky-actions"><button type="submit">Turn on</button></div></form>` +
+                    `<p class="meta"><a href="/settings">Back</a></p>`;
+                return sendScreen(response, 200, screen("Approve from chat", html, { chrome: chromeFor(projectOf(who, request) ?? null, "settings") }));
+            }
+            if (!consumeApprovalNonce(body.get("nonce") ?? "", who.name, "chat-approval", body.get("digest") ?? "") || body.get("digest") !== digest)
+                return refuse(response, who, 409, "That form is stale. Read the terms again.", "/settings");
+            const proved = authenticateAccount(store, who.name, body.get("token") ?? "");
+            if (!proved.ok || proved.role !== "approver" || proved.generation !== who.session.generation)
+                return refuse(response, who, 403, "Turning on approving from chat takes your password, typed again.", "/settings");
+            const saved = setChatApproval(store, { approver: who.name, scope, enabled: true, limits, via: "the console" }, now);
+            return saved.ok ? redirect(response, `/settings?said=${encodeURIComponent(saved.said)}`) : refuse(response, who, 400, saved.message, "/settings");
+        }
         if (url.pathname === "/settings/telegram/pair" || url.pathname === "/settings/telegram/unpair") {
             const body = readForm(posted, CONSOLE_FORMS.telegramPair);
             // The person's own pairing, under their password: a code minted for
@@ -11709,6 +11780,8 @@ export function createDecisionServer(options) {
             approved: (() => { const scope = store.getScope(taskId); return scope !== null && approvalOf(scope).approved; })(),
         }));
     }
+    const mcpHttp = createMcpHttp({ store, clock, evidenceRoot, signedIn: request => identify(request) !== null,
+        enrolled: () => [...new Set([...managedRepos(), ...store.listProjects().map(project => project.path)])], ...(options.runOperateAs === undefined ? {} : { runAs: options.runOperateAs }) });
     // ---- identity ------------------------------------------------------------
     function identify(request, touch = true) {
         // v101: an API token. Wrong ones spend the address's tries like a wrong password; expired or revoked ones, and a removed account's, name no one.

package/dist/store.d.ts

@@ -65,6 +65,13 @@ export declare const MATE_ASK_SCHEMA = "\nCREATE TABLE IF NOT EXISTS mate_ask (\
  * per option for one visit of one card, placed on the message it rides. A reply to that message is the note
  * (telegram_flow_prompt, mode send-back). The chat apps keep their buttons beside their messages (chat-delivery-state.ts). */
 export declare const FLOW_SEND_SCHEMA = "\nCREATE TABLE IF NOT EXISTS flow_send (\n  card         INTEGER NOT NULL REFERENCES flow_card(id),\n  entry        INTEGER NOT NULL,\n  stage        TEXT NOT NULL,\n  person       TEXT NOT NULL,\n  content_json TEXT NOT NULL,\n  created_at   TEXT NOT NULL,\n  PRIMARY KEY (card, entry)\n);\nCREATE TABLE IF NOT EXISTS telegram_flow_choice (\n  token       TEXT PRIMARY KEY,\n  binding     INTEGER NOT NULL REFERENCES telegram_binding(id) ON DELETE RESTRICT,\n  card        INTEGER NOT NULL REFERENCES flow_card(id),\n  entry       INTEGER NOT NULL,\n  choice      INTEGER NOT NULL,\n  label       TEXT NOT NULL,\n  chat_id     TEXT NOT NULL,\n  message_id  TEXT,\n  created_at  TEXT NOT NULL,\n  expires_at  TEXT NOT NULL,\n  consumed_at TEXT\n);\nCREATE INDEX IF NOT EXISTS telegram_flow_choice_visit ON telegram_flow_choice (card, entry);\n";
+/** An owner's lasting choice to approve plans and merges from their paired chat (chat-approval.ts), for all their
+ * projects (scope '*') or one (its path), with the limits they agreed to. Off unless a row says on; a project's own row
+ * outranks the all-projects one. `generation` is the account's at the change: a reset password ends it. */
+export declare const CHAT_APPROVAL_SCHEMA = "\nCREATE TABLE IF NOT EXISTS chat_approval_setting (\n  approver             TEXT NOT NULL,\n  scope                TEXT NOT NULL,\n  enabled              INTEGER NOT NULL CHECK (enabled IN (0,1)),\n  full_access          INTEGER NOT NULL DEFAULT 0 CHECK (full_access IN (0,1)),\n  attempt_cap_microusd INTEGER CHECK (attempt_cap_microusd IS NULL OR attempt_cap_microusd >= 0),\n  generation           INTEGER NOT NULL,\n  digest               TEXT NOT NULL,\n  updated_by           TEXT NOT NULL,\n  updated_at           TEXT NOT NULL,\n  PRIMARY KEY (approver, scope)\n);\n";
+/** The second tap on a flow decision in Telegram (telegram-flow.ts): Approve arms Yes and Cancel, bound to the binding,
+ * chat, message and exact visit of the card; Yes decides it once. */
+export declare const TELEGRAM_FLOW_CONFIRM_SCHEMA = "\nCREATE TABLE IF NOT EXISTS telegram_flow_confirm (\n  token       TEXT PRIMARY KEY,\n  binding     INTEGER NOT NULL,\n  chat_id     TEXT NOT NULL,\n  message_id  TEXT NOT NULL,\n  card        INTEGER NOT NULL,\n  entry       INTEGER NOT NULL,\n  phase       TEXT NOT NULL CHECK (phase IN ('yes','cancel')),\n  created_at  TEXT NOT NULL,\n  expires_at  TEXT NOT NULL,\n  consumed_at TEXT\n);\nCREATE INDEX IF NOT EXISTS telegram_flow_confirm_visit ON telegram_flow_confirm (card, entry);\n";
 export declare const CHAT_DECIDE_SCHEMA = "\nCREATE TABLE IF NOT EXISTS chat_decide_action (\n  token       TEXT PRIMARY KEY,\n  channel     TEXT NOT NULL,\n  binding     INTEGER NOT NULL,\n  chat        TEXT NOT NULL,\n  message     TEXT,\n  act         TEXT NOT NULL CHECK (act IN ('accept','changes','retry','approve','not-now','merge')),\n  phase       TEXT NOT NULL CHECK (phase IN ('offer','yes','cancel')),\n  task_id     TEXT NOT NULL,\n  run         INTEGER,\n  digest      TEXT NOT NULL,\n  created_at  TEXT NOT NULL,\n  expires_at  TEXT NOT NULL,\n  consumed_at TEXT\n);\nCREATE INDEX IF NOT EXISTS chat_decide_action_message ON chat_decide_action (channel, chat, message);\nCREATE TABLE IF NOT EXISTS chat_decide_prompt (\n  id          INTEGER PRIMARY KEY AUTOINCREMENT,\n  channel     TEXT NOT NULL,\n  binding     INTEGER NOT NULL,\n  chat        TEXT NOT NULL,\n  task_id     TEXT NOT NULL,\n  run         INTEGER NOT NULL,\n  digest      TEXT NOT NULL,\n  message     TEXT,\n  created_at  TEXT NOT NULL,\n  expires_at  TEXT NOT NULL,\n  consumed_at TEXT\n);\nCREATE INDEX IF NOT EXISTS chat_decide_prompt_open ON chat_decide_prompt (channel, binding, consumed_at);\n";
 export type MateAsk = {
     turn: number;
@@ -138,7 +145,21 @@ export type SealedLedgerEntry = LedgerEntry & {
         hash: string;
     } | null;
 };
-export declare const SCHEMA_VERSION = 109;
+export declare const SCHEMA_VERSION = 110;
+/**
+ * The migrations `toolroll update` may carry a database through in place: each
+ * one only adds (a table, a column, an accepted value) and leaves every saved row
+ * as it was, so the updater's rehearsal on a copy (same history, integrity ok)
+ * proves it and the verified backup undoes it. Any migration not listed here
+ * needs the separate verified migration procedure. The desktop update never
+ * migrates and does not read this list.
+ *
+ * v110 rebuilds action_ledger only to widen its source check ('api', 'mcp'):
+ * every row, id and hash-chain link is copied unchanged.
+ */
+export declare const UPDATE_SAFE_MIGRATIONS: readonly number[];
+/** Whether a database settled at `version` reaches this build's schema through update-safe migrations alone. */
+export declare function updateSafeSchema(version: number | null): boolean;
 export type ApiTokenRow = {
     id: string;
     account: string;
@@ -2274,7 +2295,7 @@ export declare class Store {
      * exactly what the signed digest was bound to. Returns false when the
      * scope vanished mid-ceremony. */
     sealScopeApproval(taskId: string, by: string, now: Date, mutation?: Mutation, basis?: {
-        kind: "mode";
+        kind: "mode" | "chat";
         modeDigest: string;
     }, approverKind?: ApproverKind): boolean;
     /** Whether this task's scope carries a LIVE seal: approved, and the