toolroll 0.9.47 → 0.9.49

package/dist/task-live.d.ts

@@ -1,17 +1,8 @@
-import type { ServerResponse } from "node:http";
+import { type LiveRoomOptions, type LiveRooms, type LiveViewer } from "./live-bus.js";
 import { type Store } from "./store.js";
-export type TaskViewer = {
-    name: string;
-    response: ServerResponse;
-    valid: () => boolean;
-};
+export type TaskViewer = LiveViewer;
 /** What changes when anything on the task page changes: one read over the family, kept short and opaque. */
 export declare function taskFingerprint(store: Store, root: string, now: Date, livenessMs?: number): string | null;
-export type TaskRooms = {
-    /** Keep this page's stream on the task family until it closes; the first events say where it stands and who's here. */
-    join: (root: string, viewer: TaskViewer) => void;
-    /** Every stream, ended (the server is closing). */
-    close: () => void;
-    size: () => number;
-};
-export declare function createTaskRooms(fingerprint: (root: string) => string | null, tickMs?: number): TaskRooms;
+export type TaskRooms = LiveRooms<string, TaskViewer>;
+/** Rooms keyed by the task family's root. With a bus, a write reaches every open page at once; without one, only the safety net. */
+export declare function createTaskRooms(fingerprint: (root: string) => string | null, options?: LiveRoomOptions): TaskRooms;

package/dist/task-live.js

@@ -3,12 +3,14 @@
  * same in all of them, and each shows who else has it open. The same design
  * as the live canvas (flow-live.ts):
  *
- * - A change nudge. While anyone has a task open, one indexed read a second,
- *   keyed by the task family's root, takes the family's fingerprint (its
- *   versions' states, runs, decisions, progress checkpoints, what the agent
- *   did last, and whether each live run's worker still answers); when it
- *   changes, every open page hears "change" and reads the task again the
- *   usual way. The nudge carries no task data.
+ * - A change nudge. When the live bus says the workspace was written
+ *   (live-bus.ts), one indexed read keyed by the task family's root takes
+ *   the family's fingerprint (its versions' states, runs, decisions,
+ *   progress checkpoints, what the agent did last, and whether each live
+ *   run's worker still answers); when it changed, every open page hears
+ *   "change" and reads the task again the usual way. The nudge carries no
+ *   task data. With nothing written, an open page costs no reads; a
+ *   30-second check heals a missed signal (and notices a lapsed worker).
  * - Who's here. Everyone else with the task open, by name, one line per
  *   person however many pages they have. Memory only; it goes when the page
  *   closes or hides.
@@ -17,12 +19,9 @@
  * keep one open reads itself on its usual beat.
  */
 import { createHash } from "node:crypto";
+import { createLiveRooms } from "./live-bus.js";
 import { DEFAULT_LIVENESS_MS } from "./runner.js";
 import { BUILT_IN } from "./store.js";
-const TICK_MS = 1_000;
-const CHECK_EVERY = 15;
-const HEARTBEAT_EVERY = 15;
-const PRESENCE_SETTLE_MS = 150;
 /** What changes when anything on the task page changes: one read over the family, kept short and opaque. */
 export function taskFingerprint(store, root, now, livenessMs = DEFAULT_LIVENESS_MS) {
     const row = store.handle.prepare(`WITH RECURSIVE family(ref, ext, depth) AS (
@@ -41,104 +40,8 @@ export function taskFingerprint(store, root, now, livenessMs = DEFAULT_LIVENESS_
     WHERE EXISTS (SELECT 1 FROM family)`).get(root, new Date(now.getTime() - livenessMs).toISOString(), BUILT_IN);
     return row === undefined ? null : createHash("sha256").update(Object.values(row).map(String).join("|")).digest("hex").slice(0, 16);
 }
-export function createTaskRooms(fingerprint, tickMs = TICK_MS) {
-    const rooms = new Map();
-    const write = (viewer, event, data) => {
-        if (viewer.response.writableEnded || viewer.response.destroyed)
-            return;
-        viewer.response.write(`event: ${event}\ndata: ${JSON.stringify(data)}\n\n`);
-    };
-    /** Everyone on the task but you, once each, by name. */
-    const others = (room, me) => [...new Set([...room.viewers].map(one => one.name).filter(name => name !== me))].sort((a, b) => a.localeCompare(b));
-    const announce = (room) => {
-        if (room.settling !== null)
-            clearTimeout(room.settling);
-        room.settling = setTimeout(() => {
-            room.settling = null;
-            for (const viewer of room.viewers)
-                write(viewer, "here", { people: others(room, viewer.name) });
-        }, PRESENCE_SETTLE_MS);
-        room.settling.unref();
-    };
-    const leave = (root, viewer) => {
-        const room = rooms.get(root);
-        if (room === undefined || !room.viewers.delete(viewer))
-            return;
-        if (!viewer.response.writableEnded)
-            viewer.response.end();
-        if (room.viewers.size > 0) {
-            announce(room);
-            return;
-        }
-        if (room.timer !== null)
-            clearInterval(room.timer);
-        if (room.settling !== null)
-            clearTimeout(room.settling);
-        rooms.delete(root);
-    };
-    const tick = (root, room) => {
-        room.ticks += 1;
-        if (room.ticks % CHECK_EVERY === 0) {
-            // A signed-out or narrowed account stops hearing about the task.
-            for (const viewer of [...room.viewers])
-                if (!viewer.valid()) {
-                    write(viewer, "gone", {});
-                    leave(root, viewer);
-                }
-            if (!rooms.has(root))
-                return;
-        }
-        let now;
-        try {
-            now = fingerprint(root);
-        }
-        catch {
-            return; /* a busy database: the next tick reads again */
-        }
-        if (now === null) {
-            for (const viewer of [...room.viewers]) {
-                write(viewer, "gone", {});
-                leave(root, viewer);
-            }
-            return;
-        }
-        if (now !== room.last) {
-            room.last = now;
-            for (const viewer of room.viewers)
-                write(viewer, "change", { at: now });
-        }
-        else if (room.ticks % HEARTBEAT_EVERY === 0) {
-            for (const viewer of room.viewers)
-                if (!viewer.response.writableEnded)
-                    viewer.response.write(": keep-alive\n\n");
-        }
-    };
-    return {
-        join(root, viewer) {
-            let room = rooms.get(root);
-            if (room === undefined) {
-                let last = null;
-                try {
-                    last = fingerprint(root);
-                }
-                catch { /* the first tick reads it */ }
-                room = { viewers: new Set(), last, timer: null, ticks: 0, settling: null };
-                const created = room;
-                room.timer = setInterval(() => tick(root, created), tickMs);
-                room.timer.unref();
-                rooms.set(root, room);
-            }
-            room.viewers.add(viewer);
-            write(viewer, "change", { at: room.last });
-            write(viewer, "here", { people: others(room, viewer.name) });
-            announce(room);
-            viewer.response.once("close", () => leave(root, viewer));
-        },
-        close() {
-            for (const [root, room] of [...rooms])
-                for (const viewer of [...room.viewers])
-                    leave(root, viewer);
-        },
-        size: () => [...rooms.values()].reduce((sum, room) => sum + room.viewers.size, 0),
-    };
+/** Rooms keyed by the task family's root. With a bus, a write reaches every open page at once; without one, only the safety net. */
+export function createTaskRooms(fingerprint, options = {}) {
+    // Everyone on the task but you, once each, by name.
+    return createLiveRooms(fingerprint, (viewers, me) => [...new Set(viewers.map(one => one.name).filter(name => name !== me))].sort((a, b) => a.localeCompare(b)), options);
 }

package/dist/team-cli.js

@@ -41,6 +41,14 @@ existing local commands. Credentials stay in a private file, never in URLs or ar
 Reads and attachment do not start model work. Server permissions remain authoritative.`;
 export class UsageError extends Error {
 }
+/** Transport metadata stays local to the CLI; only an actual HTTP 429 permits a follower read retry. */
+const RETRY_AFTER_MS = Symbol('retry-after-ms');
+function retryDelay(header) {
+    const raw = header?.trim() ?? '';
+    const delay = /^\d+$/.test(raw) ? Number(raw) * 1000
+        : /^(Mon|Tue|Wed|Thu|Fri|Sat|Sun), /.test(raw) ? Date.parse(raw) - Date.now() : NaN;
+    return Number.isFinite(delay) && delay >= 0 ? Math.max(1000, Math.min(300_000, delay)) : 5000;
+}
 const value = (flags, name) => typeof flags[name] === 'string' ? flags[name] : '';
 const required = (flags, name) => { const result = value(flags, name); if (!result)
     throw new UsageError(`--${name} is required.`); return result; };
@@ -244,13 +252,18 @@ async function responseBody(response) {
 function failure(code, message, result) { return { version: 1, ok: false, code, message, ...(result === undefined ? {} : { result }) }; }
 async function perform(profile, request, options) {
     const reading = ['list', 'show'].includes(request.operation);
-    const unconfirmed = () => failure(reading ? 'service-unavailable' : 'delivery-unconfirmed', reading ? 'The service response could not be read.' : 'The response could not be confirmed. Inspect saved messages before continuing; this request was not retried.', { operation: request.operation, ...(request.args.conversationId ? { conversationId: request.args.conversationId } : {}), ...(request.args.requestId ? { requestId: request.args.requestId } : {}) });
+    const receipt = { operation: request.operation, ...(request.args.conversationId ? { conversationId: request.args.conversationId } : {}), ...(request.args.requestId ? { requestId: request.args.requestId } : {}) };
+    const unconfirmed = () => failure(reading ? 'service-unavailable' : 'delivery-unconfirmed', reading ? 'The service response could not be read.' : 'The response could not be confirmed. Inspect saved messages before continuing; this request was not retried.', receipt);
     try {
         const response = await (options.fetch ?? fetch)(`${profile.origin}/api/team`, { method: 'POST', redirect: 'manual', credentials: 'omit', signal: options.signal ? AbortSignal.any([options.signal, AbortSignal.timeout(30_000)]) : AbortSignal.timeout(30_000), headers: { authorization: bearerOf(profile), 'content-type': 'application/json', accept: 'application/json' }, body: JSON.stringify(request) });
         if (response.status >= 300 && response.status < 400) {
             await response.body?.cancel();
             return unconfirmed();
         }
+        if (response.status === 429) {
+            await response.body?.cancel();
+            return { ...failure('rate-limited', reading ? 'Request limit reached. Try again shortly.' : 'Request limit reached. Inspect saved messages before continuing; this request was not retried.', receipt), [RETRY_AFTER_MS]: retryDelay(response.headers.get('retry-after')) };
+        }
         const payload = await responseBody(response);
         if (!record(payload) || payload.version !== 1 || typeof payload.ok !== 'boolean' || typeof payload.code !== 'string' || typeof payload.message !== 'string' || payload.snapshot !== undefined && !isSnapshot(payload.snapshot) || payload.ok && !response.ok)
             return unconfirmed();
@@ -396,7 +409,7 @@ export async function maybeRunTeamCommand(argv, write, options = {}) {
         if (!profile || !Object.hasOwn(saved.profiles, profileName))
             throw new UsageError('No saved connection. Use connect with your individual sign-in first.');
         secret = profile.token;
-        const call = (operation, args) => perform(profile, { operation, args }, options);
+        const call = (operation, args, signal) => perform(profile, { operation, args }, { ...options, ...(signal === undefined ? {} : { signal }) });
         if (command === 'chat' || command === 'brief')
             return await chat(command, flags, profile.account, call, emit, options, stderr);
         let operation, args = {};
@@ -476,8 +489,8 @@ async function chat(command, flags, account, call, emit, options, stderr) {
         throw new UsageError('--terms-digest requires --authorize.');
     if (command === 'chat' && requestId && !flags.say)
         throw new UsageError('Use brief --request-id to inspect a previous message.');
-    const show = async () => {
-        const reply = await call('show', { conversationId });
+    const show = async (signal) => {
+        const reply = await call('show', { conversationId }, signal);
         if (reply.ok && (!reply.snapshot || reply.snapshot.selected?.id !== conversationId || leadId && reply.snapshot.selected.leadId !== leadId))
             return failure('conversation-mismatch', 'The service returned a different conversation or lead. Nothing was sent.');
         return reply;
@@ -577,22 +590,31 @@ async function chat(command, flags, account, call, emit, options, stderr) {
     };
     let pollResult = 0;
     const poll = async () => {
+        let waitMs = 2_000;
         while (!signal.aborted) {
             try {
-                await (options.sleep ?? ((ms, abort) => delay(ms, undefined, { signal: abort })))(2_000, signal);
+                await (options.sleep ?? ((ms, abort) => delay(ms, undefined, { signal: abort })))(waitMs, signal);
             }
             catch {
                 break;
             }
             if (signal.aborted)
                 break;
-            const next = await show();
+            const next = await show(signal);
+            if (signal.aborted)
+                break;
+            // Only this follower's read poll retries. Sends, authorizations and uncertain deliveries are never replayed.
+            if (!next.ok && next[RETRY_AFTER_MS] !== undefined) {
+                waitMs = next[RETRY_AFTER_MS];
+                continue;
+            }
             if (!next.ok) {
                 emit(next);
                 pollResult = 1;
                 controller.abort();
                 break;
             }
+            waitMs = 2_000;
             current = next;
             updated(next);
         }

package/dist/team-contract.d.ts

@@ -1,9 +1,12 @@
 import type { WorkIndexPage } from './work-index.js';
 import type { BrowserActionCard } from './browser-workspace.js';
+import type { Principal } from './operate-remote.js';
 /** Shared central-team transport contract. Requests never establish actor identity. */
 export type TeamActor = {
     name: string;
     generation: number;
+    /** Set when an `so_` API token signed in: its scope and project limit narrow every check, never widen one. */
+    principal?: Principal;
 };
 export type TeamRole = 'viewer' | 'contributor' | 'manager';
 export type TeamLead = {
@@ -81,6 +84,10 @@ export type TeamSnapshot = {
 };
 export declare const TEAM_OPERATIONS: readonly ['list', 'show', 'create-lead', 'update-lead', 'create-conversation', 'member', 'send', 'edit', 'withdraw', 'read', 'authorize', 'follow', 'stop', 'transfer'];
 export type TeamOperation = typeof TEAM_OPERATIONS[number];
+/** Whether each operation writes anything (a read receipt included). Exhaustive, so a new operation can't default to read. */
+export declare const TEAM_MUTATIONS: Readonly<Record<TeamOperation, boolean>>;
+/** Whether this actor may run `operation`: a read-scope token never writes. */
+export declare const teamScopeAllows: (actor: TeamActor, operation: TeamOperation) => boolean;
 export type TeamRequest = {
     operation: TeamOperation;
     args: Record<string, unknown>;

package/dist/team-contract.js

@@ -1 +1,8 @@
 export const TEAM_OPERATIONS = ['list', 'show', 'create-lead', 'update-lead', 'create-conversation', 'member', 'send', 'edit', 'withdraw', 'read', 'authorize', 'follow', 'stop', 'transfer'];
+/** Whether each operation writes anything (a read receipt included). Exhaustive, so a new operation can't default to read. */
+export const TEAM_MUTATIONS = {
+    list: false, show: false, 'create-lead': true, 'update-lead': true, 'create-conversation': true, member: true, send: true, edit: true,
+    withdraw: true, read: true, authorize: true, follow: true, stop: true, transfer: true,
+};
+/** Whether this actor may run `operation`: a read-scope token never writes. */
+export const teamScopeAllows = (actor, operation) => !TEAM_MUTATIONS[operation] || actor.principal === undefined || actor.principal.scope === 'act';

package/dist/team-http.d.ts

@@ -1,5 +1,6 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import { type TeamActor, type TeamExecute } from './team-contract.js';
+import { type Admission } from './request-budget.js';
 export declare const TEAM_REQUEST_BYTES: number;
 export type TeamHttpOptions = {
     authenticate: (request: IncomingMessage) => TeamActor | null | Promise<TeamActor | null>;
@@ -9,6 +10,10 @@ export type TeamHttpOptions = {
     execute: TeamExecute;
     /** Current, authorized event cursor. null means the audience is no longer available. */
     cursor?: (actor: TeamActor, conversationId?: string) => number | null;
+    /** Source admission before credential verification. Streams are charged once when opened. */
+    admit?: (request: IncomingMessage) => Admission;
+    /** Proved account/token admission, before reading the body or executing any operation. */
+    admitAuthenticated?: (request: IncomingMessage, actor: TeamActor) => Admission;
     streamIntervalMs?: number;
     streams?: Set<ServerResponse>;
 };

package/dist/team-http.js

@@ -1,10 +1,11 @@
-import { TEAM_OPERATIONS } from './team-contract.js';
+import { TEAM_OPERATIONS, teamScopeAllows } from './team-contract.js';
+import { limitWords } from './request-budget.js';
 export const TEAM_REQUEST_BYTES = 64 * 1024;
 const failure = (code, message) => ({ version: 1, ok: false, code, message });
-function send(response, status, value) {
+function send(response, status, value, headers = {}) {
     if (response.destroyed || response.writableEnded)
         return;
-    response.writeHead(status, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store', 'x-content-type-options': 'nosniff' });
+    response.writeHead(status, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store', 'x-content-type-options': 'nosniff', ...headers });
     response.end(JSON.stringify(value));
 }
 async function body(request) {
@@ -40,6 +41,17 @@ export async function handleTeamHttp(request, response, options) {
     const count = request.rawHeaders.filter((value, index) => index % 2 === 0 && value.toLowerCase() === 'authorization').length;
     if (count > 1)
         return reject(400, 'ambiguous-credentials', 'Send one authorization header.');
+    const refuseAdmission = (admitted) => {
+        if (admitted.ok)
+            return false;
+        if (admitted.status === 503)
+            return reject(503, 'limits-unavailable', 'Request limits could not be checked; nothing ran. Try again shortly.');
+        send(response, 429, failure('rate-limited', limitWords(admitted.limit, admitted.retryAfter)), { 'retry-after': String(admitted.retryAfter) });
+        request.resume();
+        return true;
+    };
+    if (options.admit && refuseAdmission(options.admit(request)))
+        return true;
     let actor;
     try {
         actor = await options.authenticate(request);
@@ -49,6 +61,8 @@ export async function handleTeamHttp(request, response, options) {
     }
     if (!actor)
         return reject(401, 'unauthenticated', 'Sign in to continue.');
+    if (options.admitAuthenticated && refuseAdmission(options.admitAuthenticated(request, actor)))
+        return true;
     const conversationId = url.searchParams.get('conversation') ?? undefined;
     if (url.pathname === '/api/team/events') {
         if (request.method !== 'GET')
@@ -133,6 +147,8 @@ export async function handleTeamHttp(request, response, options) {
         return reject(405, 'method-not-allowed', 'Use GET or POST.');
     if (!options.revalidate(request, actor))
         return reject(401, 'unauthenticated', 'Sign in to continue.');
+    if (!teamScopeAllows(actor, input.operation))
+        return reject(403, 'read-only', 'Your token reads only. Use an act token for this.');
     try {
         const result = await options.execute(actor, input);
         send(response, result.ok ? 200 : /forbidden|access|unauthor|member/.test(result.code) ? 403 : 409, result);

package/dist/team-leads.d.ts

@@ -1,5 +1,5 @@
 import type { Store } from './store.js';
-import type { TeamActor, TeamConversation, TeamLead, TeamRequest, TeamResponse, TeamRole, TeamSnapshot } from './team-contract.js';
+import { type TeamActor, type TeamConversation, type TeamLead, type TeamRequest, type TeamResponse, type TeamRole, type TeamSnapshot } from './team-contract.js';
 export type TeamAccess = {
     conversation: TeamConversation;
     lead: TeamLead;
@@ -25,7 +25,11 @@ export declare class TeamLeads {
     readonly enrolled: () => readonly string[];
     constructor(store: Store, enrolled: () => readonly string[]);
     private get db();
+    /** The account as this actor may use it now. An API token's principal narrows it: a read token acts as a viewer, and a
+     * project-limited token sees only its projects. Every role and project check below reads this, never the raw row. */
     private account;
+    /** Whether the actor may use `repo` now: their account's access, narrowed by any token limit. */
+    private reaches;
     private leadRow;
     private leadProjects;
     private leadOf;

package/dist/team-leads.js

@@ -2,6 +2,8 @@ import { createHash, randomUUID } from 'node:crypto';
 import { scanForSecrets } from './evidence.js';
 import { ceilingDigestOf } from './principal.js';
 import { normalizeProjectAccess, projectAccessAllows, readProjectAccess } from './project-access.js';
+import { tokenProjects } from './api-tokens.js';
+import { teamScopeAllows } from './team-contract.js';
 class TeamRefusal extends Error {
     code;
     constructor(code, message) {
@@ -53,11 +55,22 @@ export class TeamLeads {
         this.enrolled = enrolled;
     }
     get db() { return this.store.handle; }
+    /** The account as this actor may use it now. An API token's principal narrows it: a read token acts as a viewer, and a
+     * project-limited token sees only its projects. Every role and project check below reads this, never the raw row. */
     account(actor) {
         const account = this.store.accountOf(actor.name);
         if (account === null || account.revokedAt !== null || account.generation !== actor.generation)
             refuse('signed-out', 'Sign in again to use this conversation.');
-        return account;
+        const principal = actor.principal;
+        if (principal === undefined)
+            return account;
+        if (principal.account !== actor.name || principal.generation !== actor.generation)
+            refuse('signed-out', 'Sign in again to use this conversation.');
+        return { ...account, role: principal.scope === 'act' ? account.role : 'viewer', projects: tokenProjects(account.projects, principal.projects) };
+    }
+    /** Whether the actor may use `repo` now: their account's access, narrowed by any token limit. */
+    reaches(actor, repo) {
+        return this.store.accountCanAccess(actor.name, repo) && projectAccessAllows(this.account(actor).projects, repo);
     }
     leadRow(id) {
         const row = this.db.prepare('SELECT * FROM team_lead WHERE id=?').get(id);
@@ -124,6 +137,28 @@ export class TeamLeads {
                 const { lead } = this.access(actor, conversationId);
                 return Number(this.db.prepare('SELECT COALESCE(MAX(id),0) AS n FROM team_event WHERE (conversation=? OR (conversation IS NULL AND lead=?))').get(conversationId, lead.id)?.['n'] ?? 0);
             }
+            // A project-limited token hears only of the leads and conversations it can open, never activity beyond its projects.
+            if (actor.principal?.projects != null) {
+                const account = this.account(actor);
+                const leads = this.db.prepare('SELECT l.id FROM team_lead l JOIN team_lead_member m ON m.lead=l.id WHERE m.account=? AND m.active=1').all(actor.name).map(r => String(r['id']))
+                    .filter(id => this.leadProjects(id).every(p => projectAccessAllows(account.projects, p) && this.enrolled().includes(p)));
+                const conversations = this.db.prepare('SELECT conversation FROM team_participant WHERE account=? AND active=1').all(actor.name).map(r => String(r['conversation']))
+                    .filter(id => { try {
+                    this.access(actor, id);
+                    return true;
+                }
+                catch (e) {
+                    if (e instanceof TeamRefusal)
+                        return false;
+                    throw e;
+                } });
+                let n = 0;
+                for (const id of leads)
+                    n = Math.max(n, Number(this.db.prepare('SELECT COALESCE(MAX(id),0) AS n FROM team_event WHERE lead=? AND conversation IS NULL').get(id)?.['n'] ?? 0));
+                for (const id of conversations)
+                    n = Math.max(n, Number(this.db.prepare('SELECT COALESCE(MAX(id),0) AS n FROM team_event WHERE conversation=?').get(id)?.['n'] ?? 0));
+                return n;
+            }
             return Number(this.db.prepare(`SELECT COALESCE(MAX(e.id),0) AS n FROM team_event e JOIN team_lead_member m ON m.lead=e.lead AND m.account=? AND m.active=1
         WHERE e.conversation IS NULL OR EXISTS(SELECT 1 FROM team_participant p JOIN team_conversation c ON c.id=p.conversation WHERE p.conversation=e.conversation AND p.account=? AND p.active=1 AND (c.visibility='team' OR c.created_by=?))`).get(actor.name, actor.name, actor.name)?.['n'] ?? 0);
         }
@@ -159,9 +194,12 @@ export class TeamLeads {
         try {
             const result = this.store.transact(() => {
                 this.account(actor);
+                if (!teamScopeAllows(actor, request.operation))
+                    refuse('read-only', 'Your token reads only. Use an act token for this.');
                 const requestId = request.args['requestId'];
                 const key = requestId === undefined ? null : str(requestId, 'Request ID', 128);
-                const digest = hash(stable(request));
+                // A token's scope and project limit are part of what was asked: a narrower token never replays a wider one's receipt.
+                const digest = hash(stable(actor.principal === undefined ? request : { request, scope: actor.principal.scope, projects: actor.principal.projects }));
                 if (key) {
                     const seen = this.db.prepare('SELECT payload_hash,response_json FROM team_request WHERE account=? AND generation=? AND request_id=?').get(actor.name, actor.generation, key);
                     if (seen) {
@@ -527,7 +565,7 @@ export class TeamLeads {
             if (ancestry.problem !== null)
                 return false;
             const ref = this.store.lookupRef(ancestry.chain[ancestry.chain.length - 1] ?? taskId);
-            if (!ref || ref.repo === null || !lead.projects.includes(ref.repo) || !this.store.accountCanAccess(actor.name, ref.repo))
+            if (!ref || ref.repo === null || !lead.projects.includes(ref.repo) || !this.reaches(actor, ref.repo))
                 return false;
             if (conversationId) {
                 const access = this.access(actor, conversationId, 'contributor');
@@ -546,7 +584,7 @@ export class TeamLeads {
         if (ancestry.problem !== null)
             refuse('invalid-task', 'Task history needs inspection before ownership can change.');
         const ref = this.store.lookupRef(ancestry.chain[ancestry.chain.length - 1] ?? taskId);
-        if (!ref || ref.repo === null || !target.projects.includes(ref.repo) || !this.store.accountCanAccess(actor.name, ref.repo))
+        if (!ref || ref.repo === null || !target.projects.includes(ref.repo) || !this.reaches(actor, ref.repo))
             refuse('forbidden', 'The receiving lead must have access to this task’s project.');
         const old = this.taskOwner(taskId), expected = integer(a['expectedRevision']);
         if ((old?.revision ?? 0) !== expected)

package/dist/team-runtime.d.ts

@@ -1,7 +1,7 @@
 import type { Store } from './store.js';
 import type { WorkspaceRevision } from './workspace-revision.js';
 import { TeamLeads } from './team-leads.js';
-import type { TeamActor, TeamExecute } from './team-contract.js';
+import { type TeamActor, type TeamExecute } from './team-contract.js';
 import { type MateTurnInput } from './mate.js';
 import { type TeamChatProviderResolver } from './team-chat-authorization.js';
 export type TeamRuntimeOptions = {

package/dist/team-runtime.js

@@ -4,6 +4,7 @@ import { createHash, randomUUID } from 'node:crypto';
 import { deliverTeamUpdates, startTeamUpdates } from './team-updates.js';
 import { workIndexPage } from './work-index.js';
 import { TeamLeads } from './team-leads.js';
+import { teamScopeAllows } from './team-contract.js';
 import { verifyApproverStanding } from './principal.js';
 import { credentialKeyOf, isDirectChatProvider, priceForConfig, subscriptionCredentialKey, mateWorstCaseForPrice } from './converse.js';
 import { runMateTurn } from './mate.js';
@@ -188,6 +189,8 @@ export function createTeamRuntime(options) {
     }
     const execute = async (actor, request) => {
         try {
+            if (!teamScopeAllows(actor, request.operation))
+                return response(false, 'read-only', 'Your token reads only. Use an act token for this.');
             if (request.operation === 'authorize')
                 return authorize(actor, request.args);
             if (request.operation === 'send' || request.operation === 'follow' && request.args['enabled'] === true) {

package/dist/teams.d.ts

@@ -2,6 +2,7 @@ import type { IncomingMessage, ServerResponse } from "node:http";
 import { chatObject as object } from "./chat-delivery.js";
 import { type TeamsChatOptions } from "./teams-chat.js";
 import type { Store } from "./store.js";
+import { type Admission } from "./request-budget.js";
 export declare const TEAMS_ACTIVITY_BYTES: number;
 export declare const TEAMS_MESSAGES_PATH = "/teams/messages";
 /** The receiver: prove the Bot Framework token for this app, save the activity, acknowledge. Nothing runs here. */
@@ -10,6 +11,8 @@ export declare function handleTeamsHttp(request: IncomingMessage, response: Serv
     dir: string;
     fetcher?: typeof fetch;
     clock?: () => Date;
+    admitSource: (request: IncomingMessage) => Admission;
+    admitTenant: (tenant: string) => Admission;
 }): Promise<boolean>;
 /** The worker-side loop: a lease per installation, one pass a second. */
 export declare function followTeams(options: Omit<TeamsChatOptions, "identity" | "api" | "owner" | "current"> & {

package/dist/teams.js

@@ -8,6 +8,7 @@ import { ChatState } from "./chat-delivery-state.js";
 import { chatObject as object } from "./chat-delivery.js";
 import { loadTeamsCredentials, teamsAccessToken, teamsApi, verifyTeamsToken, TeamsError } from "./teams-api.js";
 import { deliverTeamsPart, planTeamsNotifications, planTeamsRooms, processTeamsEvent, receiveTeams } from "./teams-chat.js";
+import { limitWords } from "./request-budget.js";
 export const TEAMS_ACTIVITY_BYTES = 64 * 1024;
 export const TEAMS_MESSAGES_PATH = "/teams/messages";
 /** The receiver: prove the Bot Framework token for this app, save the activity, acknowledge. Nothing runs here. */
@@ -18,12 +19,26 @@ export async function handleTeamsHttp(request, response, options) {
     const reply = (status, body = "{}") => { response.writeHead(status, { "content-type": "application/json; charset=utf-8", "cache-control": "no-store" }); response.end(body); request.resume(); return true; };
     if (request.method !== "POST")
         return reply(405);
+    const refuseAdmission = (admitted) => {
+        if (admitted.ok)
+            return false;
+        if (admitted.status === 429)
+            response.setHeader("retry-after", String(admitted.retryAfter));
+        return reply(admitted.status, JSON.stringify({ error: admitted.status === 429 ? "rate-limited" : "limits-unavailable",
+            message: admitted.status === 429 ? limitWords(admitted.limit, admitted.retryAfter) : "Request limits could not be checked; nothing was saved." }));
+    };
+    // Source admission precedes JWT verification (including key fetches). Only proved app credentials consume
+    // the configured tenant's allowance; an untrusted activity cannot select or evade that allowance.
+    if (refuseAdmission(options.admitSource(request)))
+        return true;
     const credentials = loadTeamsCredentials(options.dir);
     if (credentials === null)
         return reply(404);
     const claims = await verifyTeamsToken(request.headers.authorization, credentials.app, options.fetcher ?? fetch);
     if (claims === null)
         return reply(401);
+    if (refuseAdmission(options.admitTenant(credentials.tenant)))
+        return true;
     if (Number(request.headers["content-length"] ?? 0) > TEAMS_ACTIVITY_BYTES)
         return reply(413);
     let raw = "";

package/dist/work-index.js

@@ -242,6 +242,17 @@ const PROJECTION = `WITH RECURSIVE admitted AS MATERIALIZED (
   FROM claimed c LEFT JOIN action_ledger completed ON completed.id=c.checked_id WHERE ($state IS NULL OR c.state=$state) AND ($leadId IS NULL OR EXISTS(SELECT 1 FROM team_task_owner own WHERE own.task_ref=c.root_ref AND own.lead=$leadId))
 )`;
 const registered = new WeakMap();
+const statements = new WeakMap();
+/** The page query is long and has one text per view filter: compile each once per connection. */
+function prepared(store, sql) {
+    let cache = statements.get(store.handle);
+    if (cache === undefined)
+        statements.set(store.handle, cache = new Map());
+    let statement = cache.get(sql);
+    if (statement === undefined)
+        cache.set(sql, statement = store.handle.prepare(sql));
+    return statement;
+}
 /** Connection-local pure parsing, with exactly the authoritative stored-scope
  * validator. The callback cannot query, inspect files or grant authority. */
 function registerValidators(store) {
@@ -358,7 +369,7 @@ export function workIndexPage(store, now, access, options = {}) {
     const limit = Number.isFinite(options.limit) ? Math.max(1, Math.min(WORK_INDEX_MAX_LIMIT, Math.floor(options.limit))) : WORK_INDEX_PAGE_LIMIT;
     const scope = cursorScope(access, options, view), cursor = readCursor(options.cursor, scope);
     const filter = view === 'needs-you' ? 'needs=1' : view === 'running' ? 'family_running=1' : view === 'completed' ? "code='complete'" : '1';
-    const rows = store.handle.prepare(`${projection}, selected_page AS MATERIALIZED (
+    const rows = prepared(store, `${projection}, selected_page AS MATERIALIZED (
     SELECT * FROM ranked WHERE ${filter} AND ($cursorRoot=0 OR
       ${ORDER}>$cursorRank OR (${ORDER}=$cursorRank AND (sort_at<$cursorAt OR (sort_at=$cursorAt AND root_ref<$cursorRoot))))
     ORDER BY ${ORDER},sort_at DESC,root_ref DESC LIMIT $limit

package/dist/workspace-revision.d.ts

@@ -1,4 +1,6 @@
 import type { Store } from './store.js';
+/** The service_cursor row the revision triggers move (live-bus.ts listens for it). */
+export declare const WORKSPACE_REVISION_KEY = "workspace-content:v1";
 export type WorkspaceRevision = {
     current(): string;
     expiresAt(now: Date): number;

package/dist/workspace-revision.js

@@ -2,7 +2,9 @@
  * metadata only: it never grants access or certifies task/process state. */
 import { createHash } from 'node:crypto';
 import { DEFAULT_LIVENESS_MS } from './runner.js';
-const KEY = 'workspace-content:v1';
+/** The service_cursor row the revision triggers move (live-bus.ts listens for it). */
+export const WORKSPACE_REVISION_KEY = 'workspace-content:v1';
+const KEY = WORKSPACE_REVISION_KEY;
 const PREFIX = 'workspace_revision_v1_';
 const MAX_AGE_MS = 60_000;
 const OMIT = new Set(['schema_version', 'service_cursor', 'wake', 'notification_delivery',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolroll",
-  "version": "0.9.47",
+  "version": "0.9.49",
   "description": "A control plane for unattended coding agents — queue tasks, walk away, come back to pull requests. Agents build in leased worktrees, never touch your default branch, and interrupt you only for decisions that need a human.",
   "directories": {
     "doc": "docs"