toolroll 0.9.43 → 0.9.45

package/dist/team-cli.js

@@ -8,9 +8,12 @@ import { envelopeJson } from './envelope.js';
 import { sessionServiceOrigin } from './session-cli.js';
 import { databasePath } from './store.js';
 import { configBase, namedPath } from './names.js';
+import { parseApiToken } from './api-tokens.js';
 export const TEAM_CLI_ACTIONS = ['connect', 'lead list', 'lead create', 'lead update', 'lead member', 'lead transfer', 'conversation list', 'conversation create', 'conversation show', 'conversation member', 'conversation edit', 'conversation withdraw', 'conversation read', 'conversation follow', 'conversation stop'];
 const HELP = `toolroll connect <HTTPS-origin> --as <account> --token-stdin
-  Use --token-file <private-file> or --local-login for your existing local sign-in.
+  Pipe your API token (so_…, from Settings → API tokens) or use --token-file <private-file>;
+  --local-login uses your existing local sign-in for chat only.
+  With an API token saved, other commands run on that server as you (--local runs here).
   Optional: --profile <name> (saved as the active profile).
 toolroll lead list|create|update|member|transfer [--profile <name>] [--json]
   create: --name <name> --instructions <text> --project <server-path> (repeatable)
@@ -36,7 +39,7 @@ toolroll brief --lead <id> --conversation <id> [--json]
 Saved profiles select the central service for chat and brief. Use --local for the
 existing local commands. Credentials stay in a private file, never in URLs or arguments.
 Reads and attachment do not start model work. Server permissions remain authoritative.`;
-class UsageError extends Error {
+export class UsageError extends Error {
 }
 const value = (flags, name) => typeof flags[name] === 'string' ? flags[name] : '';
 const required = (flags, name) => { const result = value(flags, name); if (!result)
@@ -128,6 +131,20 @@ function saveProfile(options, name, profile) {
             unlinkSync(temporary);
     }
 }
+/** An API token (so_…) is sent bare; an older saved sign-in keeps its account:secret form. */
+export const bearerOf = (profile) => parseApiToken(profile.token) !== null ? `Bearer ${profile.token}` : `Bearer ${profile.account}:${profile.token}`;
+/** The saved central profile remote commands use: the named one (or the active one), and whether it holds an API token.
+ * null when nothing is saved. Reads only the private profile file — never a local login or the database. */
+export function centralProfile(options, name) {
+    const saved = profiles(options);
+    if (saved === null)
+        return null;
+    const chosen = name ?? saved.active;
+    if (!/^[A-Za-z0-9_-]{1,64}$/.test(chosen) || !Object.hasOwn(saved.profiles, chosen))
+        throw new UsageError(`No saved connection named ${chosen}. Use connect with your API token first.`);
+    const profile = saved.profiles[chosen];
+    return { name: chosen, ...profile, apiToken: parseApiToken(profile.token) !== null };
+}
 async function stdinSecret() {
     if (process.stdin.isTTY)
         throw new UsageError('Pipe your sign-in secret into --token-stdin, or use --token-file.');
@@ -229,7 +246,7 @@ async function perform(profile, request, options) {
     const reading = ['list', 'show'].includes(request.operation);
     const unconfirmed = () => failure(reading ? 'service-unavailable' : 'delivery-unconfirmed', reading ? 'The service response could not be read.' : 'The response could not be confirmed. Inspect saved messages before continuing; this request was not retried.', { operation: request.operation, ...(request.args.conversationId ? { conversationId: request.args.conversationId } : {}), ...(request.args.requestId ? { requestId: request.args.requestId } : {}) });
     try {
-        const response = await (options.fetch ?? fetch)(`${profile.origin}/api/team`, { method: 'POST', redirect: 'manual', credentials: 'omit', signal: options.signal ? AbortSignal.any([options.signal, AbortSignal.timeout(30_000)]) : AbortSignal.timeout(30_000), headers: { authorization: `Bearer ${profile.account}:${profile.token}`, 'content-type': 'application/json', accept: 'application/json' }, body: JSON.stringify(request) });
+        const response = await (options.fetch ?? fetch)(`${profile.origin}/api/team`, { method: 'POST', redirect: 'manual', credentials: 'omit', signal: options.signal ? AbortSignal.any([options.signal, AbortSignal.timeout(30_000)]) : AbortSignal.timeout(30_000), headers: { authorization: bearerOf(profile), 'content-type': 'application/json', accept: 'application/json' }, body: JSON.stringify(request) });
         if (response.status >= 300 && response.status < 400) {
             await response.body?.cancel();
             return unconfirmed();

package/dist/toolroll-update.js

@@ -35,6 +35,7 @@ import { processMayBeAlive } from "./process-liveness.js";
 import { assertCodingUpdateStopped, backupCodingCatalog, codingCatalogExists, releaseStaleCodingOwner, removeCodingUpdateGate } from "./coding-update.js";
 import { installLaunchdService, launchdPlist, stopLaunchdService, writeFileDurably } from "./daemon.js";
 import { NAME } from "./names.js";
+import { updateSafeSchema } from "./store.js";
 import { isNewer, REGISTRY } from "./releases.js";
 import { markNeverIndex } from "./never-index.js";
 import { readRuntimeUpdateJournal, RUNTIME_PHASES, RUNTIME_UPDATE_STEPS, stagedStartedAt, updaterStartingOf } from "./contracts/update-journal.js";
@@ -911,7 +912,9 @@ async function driveRuntimeUpdate(j, system) {
                 db.close();
             }
             const backup = join(j.stageDir, existsSync(join(j.stageDir, "orders.backup.db")) ? `orders.backup.${randomUUID()}.db` : "orders.backup.db");
-            j.backupHash = await verifiedDatabaseBackup(j.databaseFile, backup, j.id, async () => { await codingBackup(j); });
+            // A database one or more update-safe migrations behind is backed up as it is: the rehearsal below proves the
+            // migration on a copy, and the new runtime runs it. Any other schema needs the separate migration procedure.
+            j.backupHash = await verifiedDatabaseBackup(j.databaseFile, backup, j.id, async () => { await codingBackup(j); }, undefined, updateSafeSchema);
             j.backupPath = backup;
             save(j, "backing-up", "Database and coding catalog backed up.", system.now());
             step("rehearsing", `Rehearsing ${j.to.version} on a copy of the database.`);

package/dist/work-summary.d.ts

@@ -41,7 +41,7 @@ export declare function openWorkDecisionOf(store: Store, taskRef: number, now: D
 export declare function workDecisionAction(taskId: string, decision: NonNullable<WorkFacts["openDecision"]>, principal: WorkPrincipal): WorkAction;
 /** Pure counterpart for callers already holding the same facts. */
 export declare function workSummaryOf(facts: WorkFacts, principal: WorkPrincipal, resultDisplay?: DisplayStatus): WorkSummary;
-export type WorkSummaryAccess = 
+export type WorkSummaryAccess = (
 /** `viewer`: the person reading, whose own lead's claim (lead-voice.ts) a task reads as "<name> is on it". */
 {
     principal: "operator";
@@ -51,6 +51,9 @@ export type WorkSummaryAccess =
 } | {
     principal: "coordinator";
     repos: readonly string[];
+}) & {
+    /** Remote task reads also restrict dependency details; omitted preserves existing local output. */
+    dependencyRepos?: readonly string[] | null;
 };
 /** Admission precedes reading question/proof bodies. Missing and foreign
  * tasks share the same result. The caller must authenticate/revalidate

package/dist/work-summary.js

@@ -94,7 +94,7 @@ export function taskWorkSummaryOf(store, taskId, now, access) {
     const publication = result === null ? null : store.publicationForRun(result.id);
     const facts = {
         id: task.id, title: task.title, repo: ref.repo, state: task.state, updatedAt: task.updatedAt,
-        dispatch: diagnoseTaskDispatch(store, taskId, now), liveRunId: live?.id ?? null,
+        dispatch: diagnoseTaskDispatch(store, taskId, now, access.dependencyRepos ?? null), liveRunId: live?.id ?? null,
         unfinishedRunId: runs.find(one => one.outcome === null && one.role !== "reviewer")?.id ?? null,
         control: taskControlOf(store, ref.id, now), openDecision: openWorkDecisionOf(store, ref.id, now),
         result: result === null ? null : {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolroll",
-  "version": "0.9.43",
+  "version": "0.9.45",
   "description": "A control plane for unattended coding agents — queue tasks, walk away, come back to pull requests. Agents build in leased worktrees, never touch your default branch, and interrupt you only for decisions that need a human.",
   "directories": {
     "doc": "docs"