toolroll 0.9.49 → 0.9.50

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.9.50 — 2026-10-07
+
+- **One route policy table.** Every route's access rules live in one table,
+  checked before any handler runs. Undeclared routes are refused, approvals
+  are browser-only, and read tokens can't change anything.
+- **Server split by area.** The server code now lives in smaller modules.
+  No behaviour change for users.
+
 ## 0.9.49 — 2026-10-07
 
 - **Tokens keep their limits.** A token's scope and project limits now hold

package/dist/cli-http.js

@@ -1,3 +1,4 @@
+import { adapterPolicy } from "./server/route-policy.js";
 import { contractRow, fileArguments, STEP_UP_MESSAGE } from './remote-command.js';
 import { limitWords } from './request-budget.js';
 /** Inlined file contents, summed as UTF-8 bytes. */
@@ -105,6 +106,8 @@ export async function handleCliHttp(request, response, options) {
         request.resume();
         return true;
     }
+    if (!adapterPolicy({ caller: "bearer", capability: principal.scope, token: true }).ok)
+        return reject(403, "read-only", "Your token reads only. Use an act token for this.");
     let value;
     try {
         value = await body(request);

package/dist/flow-triggers.js

@@ -1,3 +1,4 @@
+import { adapterPolicy } from "./server/route-policy.js";
 /**
  * Flow triggers (v82): what starts cards in a flow without someone adding
  * them by hand.
@@ -944,6 +945,8 @@ export function receiveFlowHook(store, token, delivery, dir, now) {
     const config = trigger === null ? null : triggerConfigOf(trigger);
     if (trigger === null || config === null || !takesDeliveries(config))
         return { status: 404, said: "No such address." };
+    if (!adapterPolicy({ caller: "service", capability: "none" }, undefined, source => source === "flow" && store.getFlow(trigger.flow) !== null).ok)
+        return { status: 403, said: "No access to this flow." };
     if (delivery.body.length > HOOK_BYTES)
         return { status: 413, said: "Too large." };
     const note = (said) => { store.updateFlowTrigger(trigger.id, { lastAt: now.toISOString(), lastOutcome: said }, now); };
@@ -1069,6 +1072,8 @@ export function flowFormPage(store, token, now) {
     const config = trigger === null ? null : triggerConfigOf(trigger);
     if (trigger === null || config?.kind !== "button")
         return { status: 404, html: formHtml("Not found", "<p>This form isn't available. Ask whoever shared it for a new link.</p>") };
+    if (!adapterPolicy({ caller: "anonymous", capability: "none" }, undefined, source => source === "flow" && store.getFlow(trigger.flow) !== null).ok)
+        return { status: 403, html: "" };
     const fields = config.questions.map((question, index) => `<label>${esc(question)}${index === 0 ? `<input name="a${index}" required maxlength="200" autocomplete="off">` : `<textarea name="a${index}" maxlength="3000"></textarea>`}</label>`).join("");
     return { status: 200, html: formHtml(config.label, `<form method="post">${fields}<div class="trap" aria-hidden="true"><label>Leave this empty<input name="website" tabindex="-1" autocomplete="off"></label></div><input type="hidden" name="t" value="${now.getTime()}"><button>Send</button></form>`) };
 }
@@ -1078,6 +1083,8 @@ export function receiveFlowForm(store, token, fields, now) {
     const config = trigger === null ? null : triggerConfigOf(trigger);
     if (trigger === null || config?.kind !== "button")
         return flowFormPage(store, token, now);
+    if (!adapterPolicy({ caller: "anonymous", capability: "none" }, undefined, source => source === "flow" && store.getFlow(trigger.flow) !== null).ok)
+        return { status: 403, html: "" };
     const again = `<p><a href="${esc(FORM_PATH + token)}">Send another</a></p>`;
     const thanks = formHtml(config.label, `<p>Thanks — it's been sent.</p>${again}`);
     // A filled trap, or a page posted faster than a person could, gets thanks and makes nothing.

package/dist/mcp-http.js

@@ -1,14 +1,4 @@
-/**
- * The MCP gateway over streamable HTTP, served at /mcp by the console (serve.ts). Stateless: one JSON-RPC message per
- * POST, answered with one JSON body (a notification gets 202 and no body); there is no session and no event stream.
- * The modern revision carries its version in `_meta` as on stdio; a handshake-era client may initialize, and because
- * nothing is kept between requests its tools work without the stdio lifecycle.
- *
- * Every POST signs in again. The caller is a coordinator credential (the coordinator registry, exactly as on stdio) or
- * a person's own API token `so_…` (mcp-person.ts: their role, project grants and token scope). A password
- * (`name:password`) and cookies sign in nothing here, a request carrying a browser Origin is refused, and the console's
- * Host check runs before this route. A revoked or expired token answers 401 on its next request.
- */
+import { adapterPolicy } from "./server/route-policy.js";
 import { PACKAGE_VERSION } from "./version.js";
 import { parseApiToken, secretMatches, tokenLive, tokenProjects } from "./api-tokens.js";
 import { oauthProjects, oauthTokenAllowed, RESOURCE_PATH } from "./mcp-oauth.js";
@@ -122,6 +112,11 @@ export function createMcpHttp(options) {
                 return send(response, 429, { jsonrpc: "2.0", id: null, error: { code: -32000, message: limitWords(admitted.limit, admitted.retryAfter), data: { limit: admitted.limit, retryAfter: admitted.retryAfter } } }, { "retry-after": String(admitted.retryAfter) });
             }
         }
+        const policy = caller.kind === "coordinator"
+            ? adapterPolicy({ caller: "coordinator", capability: "act" })
+            : adapterPolicy({ caller: oauthProjects(store, caller.person.principal.tokenId) === null ? "bearer" : "oauth", capability: caller.person.principal.scope, token: true });
+        if (!policy.ok)
+            return refuse(response, 403, "this credential cannot call this route");
         if (!/^application\/json\s*(;|$)/i.test(request.headers["content-type"] ?? ""))
             return refuse(response, 415, "send the JSON-RPC message as application/json");
         if (Number(request.headers["content-length"] ?? 0) > MAX_REQUEST)

package/dist/mcp-oauth.js

@@ -1,24 +1,4 @@
-/**
- * MCP sign-in: OAuth 2.1 for /mcp, as the MCP authorization spec describes, so an engineer's MCP client connects
- * without a pasted token. This console is both the authorization server and the protected resource.
- *
- *   /mcp's 401 names /.well-known/oauth-protected-resource/mcp (RFC 9728), which names this console's
- *   /.well-known/oauth-authorization-server (RFC 8414). A client registers itself (RFC 7591, public clients only),
- *   sends the person to /oauth/authorize with a S256 PKCE challenge and resource=<origin>/mcp, and trades the code
- *   at /oauth/token for a short-lived access token and a refresh secret that rotates on every use.
- *
- * The person signs in with the console's own sign-in (password or identity provider, unchanged), then consents on
- * one page: read or act, and which of their projects, confirmed with their password or a fresh provider check, the
- * same step-up as making an API token. Nothing is granted without that form, its session CSRF value and a same-site
- * post.
- *
- * A grant is an ordinary API token (api-tokens.ts): its access token is `so_<id>_<secret>`, it is listed and revoked
- * with every other token (console Sessions & tokens, `toolroll tokens`), and /mcp runs it through the same person
- * path. Its v113 binding (store.oauthGrant) adds what an ordinary token doesn't have: it works only at /mcp, its
- * access secret lasts an hour, it is tied to the account generation that consented, and it reaches only the projects
- * chosen (still intersected with the person's live access on every call). Only hashes are kept: of codes, access
- * secrets and refresh secrets. Approvals, people and policy are never reachable: those have no tool and no scope.
- */
+import { adapterPolicy } from "./server/route-policy.js";
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 import { hashSecret, mintApiToken } from "./api-tokens.js";
 import { limitWords } from "./request-budget.js";
@@ -339,6 +319,8 @@ export function createOAuthHttp(options) {
         // Never named back: a project outside the person's access is refused without saying whether it exists.
         if (!chosen.every(path => mine.includes(path)))
             return again(403, "Choose from your own projects.");
+        if (!adapterPolicy({ caller: "cookie", capability: account.role === "approver" ? "act" : "read", viewer: account.role === "viewer" }, "step-up", source => source === "none" && chosen.every(path => mine.includes(path))).ok)
+            return again(403, "Choose from your own projects.");
         if (!options.confirm(session, form.get("password") ?? ""))
             return again(403, "Enter your Toolroll password to allow access.");
         waiting.delete(id);
@@ -368,6 +350,8 @@ export function createOAuthHttp(options) {
             const unsupported = !("repeated" in read) && read.issues.some(one => one.path === "grant_type");
             return unsupported ? oauthError(response, 400, "unsupported_grant_type", "Use authorization_code or refresh_token.") : oauthError(response, 400, "invalid_request", "The token request isn't complete.");
         }
+        if (!adapterPolicy({ caller: "oauth", capability: "none" }).ok)
+            return oauthError(response, 403, "access_denied", "This credential cannot call this route.");
         const ask = read.value;
         const now = options.clock();
         const resource = `${origin}${RESOURCE_PATH}`;

package/dist/mcp-person.d.ts

@@ -1,12 +1,3 @@
-/**
- * A person's tools on the HTTP gateway. A person signs in with their own API token (api-tokens.ts) and every tool call
- * is the exact `toolroll` command line they could type, run on the server under their principal through
- * `runOperateAs` with source "mcp": the command's own authorization, project grants and attribution apply, and its
- * `--json` envelope is the answer. Nothing here reads data directly — a coordinator handler would skip the person's
- * project grants — and nothing here approves, answers or changes people or policy: those verbs have no tool.
- *
- * tools/list follows the account's role and the token's scope; dispatch checks again, independent of the list.
- */
 import { type PersonToolName } from "./contracts/gateway-tools.js";
 import { type CallOutcome, type Json } from "./mcp-core.js";
 import type { Store } from "./store.js";

package/dist/mcp-person.js

@@ -1,3 +1,4 @@
+import { adapterPolicy } from "./server/route-policy.js";
 /**
  * A person's tools on the HTTP gateway. A person signs in with their own API token (api-tokens.ts) and every tool call
  * is the exact `toolroll` command line they could type, run on the server under their principal through
@@ -67,7 +68,7 @@ export async function callPersonTool(person, store, runAs, params) {
     const read = parseContract(PERSON_TOOL_INPUTS[tool], rawArgs);
     if (!read.ok)
         return { kind: "error", code: -32602, message: read.issues.map(one => one.line).join("; "), fatal: false };
-    if (!mayCall(person, tool)) {
+    if (!adapterPolicy({ caller: "bearer", capability: person.principal.scope, token: true }, TOOLS[tool].acts ? "act" : "read").ok || !mayCall(person, tool)) {
         const why = person.principal.scope === "read" ? "this token reads only — make an act token in the console to file work" : "your account can watch, not act";
         return refused(`${tool}: ${why}`);
     }

package/dist/operate.js

@@ -1,3 +1,4 @@
+import { adapterPolicy } from "./server/route-policy.js";
 import { UNSENT_REPLY_MS } from "./telegram-settings.js";
 import { checkPublicCommand } from "./public-check.js";
 import { leadNameOf } from "./lead-identity.js";
@@ -977,7 +978,7 @@ export async function runOperateAs(argv, opts) {
     // The parser's positionals must spell the same row (a value flag can't hide a subcommand).
     if (remoteRowOf(root, parsed.positional)?.invocation !== row.invocation)
         return refuse("not-remote", REMOTE_MESSAGES.unknown);
-    if (proved.scope === "read" && row.mutation !== "none")
+    if (!adapterPolicy({ caller: "bearer", capability: proved.scope, token: true }, row.mutation !== "none" ? "act" : "read").ok || proved.scope === "read" && row.mutation !== "none")
         return refuse("read-only", REMOTE_MESSAGES.read);
     if ([...parsed.flags.keys()].some(name => REMOTE_REFUSED_FLAGS.has(name)))
         return refuse("usage", REMOTE_MESSAGES.credential);
@@ -985,6 +986,8 @@ export async function runOperateAs(argv, opts) {
     const project = remoteProjectOf(store, { allows }, scope, parsed.positional, parsed.repoList, row.invocation, parsed.flags, opts.files ?? {});
     if (!project.ok)
         return refuse(project.reason, project.message);
+    if (!adapterPolicy({ caller: "bearer", capability: proved.scope, token: true }, undefined, source => source === "adapter" && (project.repo === null || allows(project.repo))).ok)
+        return refuse("forbidden", REMOTE_MESSAGES.no);
     // The local mutation cache has a global key namespace. A token must not use a chosen key to read
     // another person's/project's cached result. Revision keys already bind the actor and result in
     // task-outcome-cli.ts, which also validates their public 32-hex format; leave those intact.