toolroll 0.9.50 → 0.9.52

package/dist/browser-workspace.d.ts

@@ -227,6 +227,7 @@ export type BrowserSettingsView = {
         mode: 'subscription' | 'api-key';
         set: boolean;
     }[] | null;
+    legacyWebhookWarning?: string;
     services: {
         configured: string[];
         channel: string | null;

package/dist/database-reclaim.d.ts

@@ -0,0 +1,4 @@
+import type { Database } from "./store.js";
+/** Reclaim whole free pages on databases created without auto_vacuum. Call only after committing writes.
+ * A migration needs at least 1 MiB to justify the I/O; retention reclaims whenever more than 25% is free. */
+export declare function reclaimDatabase(db: Database, reason: "migration" | "retention"): boolean;

package/dist/database-reclaim.js

@@ -0,0 +1,13 @@
+/** Reclaim whole free pages on databases created without auto_vacuum. Call only after committing writes.
+ * A migration needs at least 1 MiB to justify the I/O; retention reclaims whenever more than 25% is free. */
+export function reclaimDatabase(db, reason) {
+    const free = Number(db.prepare("PRAGMA freelist_count").get()["freelist_count"]);
+    const pages = Number(db.prepare("PRAGMA page_count").get()["page_count"]);
+    const size = Number(db.prepare("PRAGMA page_size").get()["page_size"]);
+    if (reason === "migration" ? free * size < 1024 * 1024 : free * 4 <= pages)
+        return false;
+    db.exec("VACUUM");
+    // VACUUM writes through WAL too: checkpoint so the main file (and its backups) shrinks now.
+    db.exec("PRAGMA wal_checkpoint(TRUNCATE)");
+    return true;
+}

package/dist/demo.d.ts

@@ -8,7 +8,7 @@
  *   - The database is stamped `demo` BEFORE any row exists — an append-only
  *     installation fact with no unset API. Every spending or external-effect
  *     command (tick, watch, build, publish, reconcile, daemon, bridge,
- *     outbox deliver, intake) fails closed on the stamp, so a kept sandbox
+ *     intake) fails closed on the stamp, so a kept sandbox
  *     can never be mistaken for real work by a worker pointed at it later.
  *     The console banner is decoration; the fence is enforcement.
  *   - The seeded history is SYNTHETIC and does not pretend otherwise: runs

package/dist/demo.js

@@ -8,7 +8,7 @@
  *   - The database is stamped `demo` BEFORE any row exists — an append-only
  *     installation fact with no unset API. Every spending or external-effect
  *     command (tick, watch, build, publish, reconcile, daemon, bridge,
- *     outbox deliver, intake) fails closed on the stamp, so a kept sandbox
+ *     intake) fails closed on the stamp, so a kept sandbox
  *     can never be mistaken for real work by a worker pointed at it later.
  *     The console banner is decoration; the fence is enforcement.
  *   - The seeded history is SYNTHETIC and does not pretend otherwise: runs

package/dist/desktop-update.d.ts

@@ -94,13 +94,13 @@ export declare function prepareDesktopUpdate(stateDir: string, installed: string
 export declare function sqliteLock(file: string, busyTimeoutMs?: number): DatabaseSync | null;
 export declare const installationLock: (j: UpdateJournal) => DatabaseSync | null;
 export declare function desktopUpdateStatus(stateDir: string): {
-    error?: never;
     active: boolean;
     phase: string;
     detail: string;
     running: boolean;
     canResume: boolean;
     canCancel: boolean;
+    error?: never;
     automaticRecovery?: never;
     recoveryAttempts?: never;
     recoveryRepairs?: never;

package/dist/live-bus.d.ts

@@ -1,8 +1,8 @@
 /**
  * Live views push on write. Nothing here polls once a second.
  *
- * - The bus. The database's own revision triggers (workspace-revision.ts)
- *   move one counter on every meaningful write. After each in-process
+ * - The bus. Every connection's write wrapper (workspace-revision.ts)
+ *   moves one counter per committed meaningful write. After each in-process
  *   transact() COMMIT, and whenever another process (the worker, the CLI)
  *   writes the database's write-ahead log, the revision is read once; when
  *   it moved, every subscriber hears `{ revision }`. A rolled-back or quiet
@@ -20,7 +20,7 @@
  *   gets one `reload` and ends so its EventSource can reconnect.
  *
  * Transport seam: a future WebSocket (live cursors) subscribes to the same
- * LiveBus beside these SSE rooms; nothing in the Store or the triggers changes.
+ * LiveBus beside these SSE rooms; nothing in the Store or its write wrapper changes.
  */
 import { type FSWatcher } from "node:fs";
 import type { ServerResponse } from "node:http";

package/dist/live-bus.js

@@ -1,8 +1,8 @@
 /**
  * Live views push on write. Nothing here polls once a second.
  *
- * - The bus. The database's own revision triggers (workspace-revision.ts)
- *   move one counter on every meaningful write. After each in-process
+ * - The bus. Every connection's write wrapper (workspace-revision.ts)
+ *   moves one counter per committed meaningful write. After each in-process
  *   transact() COMMIT, and whenever another process (the worker, the CLI)
  *   writes the database's write-ahead log, the revision is read once; when
  *   it moved, every subscriber hears `{ revision }`. A rolled-back or quiet
@@ -20,7 +20,7 @@
  *   gets one `reload` and ends so its EventSource can reconnect.
  *
  * Transport seam: a future WebSocket (live cursors) subscribes to the same
- * LiveBus beside these SSE rooms; nothing in the Store or the triggers changes.
+ * LiveBus beside these SSE rooms; nothing in the Store or its write wrapper changes.
  */
 import { watch } from "node:fs";
 import { WORKSPACE_REVISION_KEY } from "./workspace-revision.js";

package/dist/mcp-oauth.d.ts

@@ -62,7 +62,7 @@ export type OAuthHttpOptions = {
     clock: () => Date;
     /** This console's canonical origin for the request (the https public address, or this computer's loopback one); null: no sign-in here. */
     originOf: (request: IncomingMessage) => string | null;
-    /** Trusted direct peer, or the last hop appended by the console's loopback proxy. */
+    /** Trusted direct peer, or the last hop appended by the console's loopback proxy (native IPv6 counted by its /64). */
     requesterKey: (request: IncomingMessage) => string;
     /** The browser session signed in by cookie, or null. A bearer never consents. */
     session: (request: IncomingMessage) => OAuthSession | null;

package/dist/mcp-oauth.js

@@ -2,6 +2,7 @@ import { adapterPolicy } from "./server/route-policy.js";
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 import { hashSecret, mintApiToken } from "./api-tokens.js";
 import { limitWords } from "./request-budget.js";
+import { sourceKey } from "./source-key.js";
 import { PKCE_CHALLENGE, readOAuthRegistration, readOAuthTokenRequest } from "./contracts/mcp-oauth.js";
 /** How long each piece lives. A code is spent at once; a grant ends after 30 days and the person consents again. */
 export const OAUTH_TIMES = { requestMs: 10 * 60_000, codeMs: 60_000, accessSeconds: 3600, grantDays: 30 };
@@ -176,7 +177,7 @@ export function createOAuthHttp(options) {
         const name = clean(read.value.client_name ?? "") || "MCP client";
         const now = options.clock();
         prune(now.getTime());
-        const kept = store.registerOAuthClient({ id: randomBytes(16).toString("hex"), name, redirectUris: redirects, source: sha256(options.requesterKey(request)) }, now, OAUTH_LIMITS.clients, OAUTH_LIMITS.clientsPerSource, [...waiting.values()].map(one => one.client));
+        const kept = store.registerOAuthClient({ id: randomBytes(16).toString("hex"), name, redirectUris: redirects, source: sha256(sourceKey(options.requesterKey(request))) }, now, OAUTH_LIMITS.clients, OAUTH_LIMITS.clientsPerSource, [...waiting.values()].map(one => one.client));
         if (kept === null) {
             response.setHeader("retry-after", "600");
             return oauthError(response, 429, "temporarily_unavailable", "Too many clients are waiting to connect. Try again later.");
@@ -214,7 +215,7 @@ export function createOAuthHttp(options) {
         const scopes = (params.get("scope") ?? "").split(" ").filter(one => one !== "");
         if (!scopes.every(one => OAUTH_SCOPES.includes(one)))
             return fail("The client requested access Toolroll doesn't offer.");
-        const source = sha256(options.requesterKey(request));
+        const source = sha256(sourceKey(options.requesterKey(request)));
         if (waiting.size >= OAUTH_LIMITS.requests || [...waiting.values()].filter(one => one.source === source).length >= OAUTH_LIMITS.requestsPerSource) {
             response.setHeader("retry-after", "600");
             return problemPage(response, 429, "Too many sign-ins waiting", "Try again in ten minutes from your MCP client.");

package/dist/monitoring.js

@@ -24,6 +24,7 @@ export const SIGNATURE_HEADER = "x-standing-orders-signature";
 const BATCH = 200;
 const LEASE_MS = 60_000;
 const TIMEOUT_MS = 10_000;
+const CHECKPOINT_EVERY_MS = 60 * 60_000;
 /** An audit event: the ledger entry and its seal, as the stream sends it. */
 export function auditEvent(entry, instance) {
     return {
@@ -41,15 +42,34 @@ const nanos = (at) => `${BigInt(Date.parse(at)) * 1000000n}`;
 /** One pass over every destination that's set up. Returns what it sent, per destination. */
 export async function monitoringPass(store, settings, deps) {
     const sent = {};
+    const heads = [];
+    const audit = (delivered) => { if (delivered.head !== null)
+        heads.push(delivered.head); return delivered.count; };
     // A new destination gets the whole audit history; traces start from now.
     if (settings.webhook !== null)
-        sent.webhook = await deliver(store, "webhook", targetOf(settings.webhook.url), () => 0, deps, entries => postSigned(settings.webhook, entries, store, deps));
+        sent.webhook = audit(await deliver(store, "webhook", targetOf(settings.webhook.url), () => 0, deps, entries => postSigned(settings.webhook, entries, store, deps)));
     if (settings.folder !== null)
-        sent.folder = await deliver(store, "folder", targetOf(settings.folder.path), () => 0, deps, async (entries) => { appendFolder(settings.folder.path, entries, deps.instance); return entries.length; });
+        sent.folder = audit(await deliver(store, "folder", targetOf(settings.folder.path), () => 0, deps, async (entries) => { appendFolder(settings.folder.path, entries, deps.instance); return entries.length; }));
     if (settings.traces !== null)
-        sent.traces = await deliver(store, "traces", targetOf(settings.traces.endpoint), () => store.ledgerHeadId(), deps, entries => postTraces(settings.traces, entries, store, deps));
+        sent.traces = (await deliver(store, "traces", targetOf(settings.traces.endpoint), () => store.ledgerHeadId(), deps, entries => postTraces(settings.traces, entries, store, deps))).count;
+    checkpointSent(store, heads, (deps.now ?? (() => new Date()))());
     return sent;
 }
+/** The furthest head the audit stream delivered, kept as an automatic checkpoint once the whole chain verifies.
+ * Automatic checkpoints write no ledger entry, so recording one gives the stream nothing new to send (and checkpoint)
+ * next pass. At most one an hour, so a busy stream neither floods the table nor walks the whole chain every pass. */
+function checkpointSent(store, heads, now) {
+    const head = heads.reduce((best, one) => best === null || (one !== null && one.through > best.through) ? one : best, null);
+    if (head === null)
+        return;
+    const newest = store.ledgerCheckpoints(1)[0];
+    if (newest !== undefined && (newest.through >= head.through || now.getTime() - Date.parse(newest.at) < CHECKPOINT_EVERY_MS))
+        return;
+    try {
+        store.ledgerCheckpoint("system", now, { head });
+    }
+    catch { /* a busy database: the next delivery tries again */ }
+}
 /** A destination's name in its status row: a digest of its address (the address itself may carry a key). */
 export const targetOf = (address) => hex(`standing-orders/monitoring/${address}`, 16);
 /** Send what's due to one destination: hold it, start it over if it now points elsewhere, read after its cursor,
@@ -57,26 +77,30 @@ export const targetOf = (address) => hex(`standing-orders/monitoring/${address}`
 async function deliver(store, sink, target, start, deps, send) {
     const now = deps.now ?? (() => new Date());
     const at = now();
+    const none = { count: 0, head: null };
     if (!store.holdMonitoring(sink, deps.holder, at, new Date(at.getTime() + LEASE_MS)))
-        return 0;
+        return none;
     let status = store.monitoringStatus(sink)[0];
     if (status === undefined || status.target !== target) {
         store.resetMonitoring(sink, target, start());
         status = store.monitoringStatus(sink)[0];
     }
     if (status.nextTryAt != null && Date.parse(status.nextTryAt) > at.getTime())
-        return 0;
+        return none;
     const from = status.through;
     const entries = store.sealedAfter(from, BATCH);
     if (entries.length === 0)
-        return 0;
+        return none;
+    const last = entries[entries.length - 1];
     try {
         const count = await send(entries);
-        return store.monitoringDelivered(sink, deps.holder, target, from, entries[entries.length - 1].id, count, now()) ? count : 0;
+        if (!store.monitoringDelivered(sink, deps.holder, target, from, last.id, count, now()))
+            return none;
+        return { count, head: last.seal === null ? null : { through: last.id, hash: last.seal.hash } };
     }
     catch (error) {
         store.monitoringFailed(sink, deps.holder, target, error instanceof Error ? error.message : String(error), now(), new Date(now().getTime() + backoff(status.failures + 1)));
-        return 0;
+        return none;
     }
 }
 async function post(url, body, headers, deps) {

package/dist/notification-delivery.d.ts

@@ -0,0 +1,19 @@
+import type { Notification, Store } from "./store.js";
+type Claim = Notification & {
+    destination: string;
+    generation: number;
+};
+/** URLs and shell commands can contain secrets. Only a destination hash enters saved receipts. */
+export declare function notificationDestination(kind: string, target: string): string;
+/** One-release compatibility for operator-configured, installation-wide senders. Personal notifications never leave here. */
+export declare function claimNotifications(store: Store, destination: string, owner: string, now: Date): Claim[];
+export declare function finalizeNotification(store: Store, row: Claim, owner: string, outcome: {
+    ok: true;
+    receipt: string | null;
+} | {
+    ok: false;
+    error: string;
+}, now: Date): boolean;
+/** Recheck after earlier network sends: expiry or resolution must stop this send, not just its receipt. */
+export declare function notificationClaimHeld(store: Store, row: Claim, owner: string, now: Date): boolean;
+export {};

package/dist/notification-delivery.js

@@ -0,0 +1,37 @@
+import { createHash } from "node:crypto";
+/** URLs and shell commands can contain secrets. Only a destination hash enters saved receipts. */
+export function notificationDestination(kind, target) {
+    return `${kind}:${createHash("sha256").update(target).digest("hex")}`;
+}
+/** One-release compatibility for operator-configured, installation-wide senders. Personal notifications never leave here. */
+export function claimNotifications(store, destination, owner, now) {
+    return store.transact(() => {
+        const db = store.handle, stamp = now.toISOString();
+        db.prepare(`INSERT OR IGNORE INTO notification_delivery(notification, destination)
+      SELECT id, ? FROM notification WHERE resolved_at IS NULL AND recipient IS NULL`).run(destination);
+        const claims = db.prepare(`SELECT d.notification, d.claim_generation FROM notification_delivery d
+      JOIN notification n ON n.id = d.notification WHERE d.destination = ? AND n.resolved_at IS NULL AND n.recipient IS NULL
+      AND d.delivered_at IS NULL AND (d.receipt IS NULL OR d.receipt NOT LIKE 'skipped:%')
+      AND (d.claim_owner IS NULL OR d.claim_expires_at <= ?) ORDER BY n.id`).all(destination, stamp);
+        return claims.map(raw => {
+            const id = Number(raw["notification"]), generation = Number(raw["claim_generation"]) + 1;
+            db.prepare(`UPDATE notification_delivery SET claim_owner = ?, claim_expires_at = ?, claim_generation = ?
+        WHERE notification = ? AND destination = ?`).run(owner, new Date(now.getTime() + 60_000).toISOString(), generation, id, destination);
+            return { ...store.notificationById(id), destination, generation };
+        });
+    });
+}
+export function finalizeNotification(store, row, owner, outcome, now) {
+    const skipped = outcome.ok && outcome.receipt?.startsWith("skipped:");
+    return Number(store.handle.prepare(`UPDATE notification_delivery SET attempts = attempts + 1, last_attempt_at = ?,
+    delivered_at = ?, receipt = ?, last_error = ?, claim_owner = NULL, claim_expires_at = NULL
+    WHERE notification = ? AND destination = ? AND claim_owner = ? AND claim_generation = ?
+      AND claim_expires_at > ? AND delivered_at IS NULL`).run(now.toISOString(), outcome.ok && !skipped ? now.toISOString() : null, outcome.ok ? outcome.receipt : null, outcome.ok ? null : outcome.error, row.id, row.destination, owner, row.generation, now.toISOString()).changes) === 1;
+}
+/** Recheck after earlier network sends: expiry or resolution must stop this send, not just its receipt. */
+export function notificationClaimHeld(store, row, owner, now) {
+    return store.handle.prepare(`SELECT 1 FROM notification_delivery d JOIN notification n ON n.id = d.notification
+    WHERE d.notification = ? AND d.destination = ? AND d.claim_owner = ? AND d.claim_generation = ?
+    AND d.claim_expires_at > ? AND d.delivered_at IS NULL AND n.resolved_at IS NULL AND n.recipient IS NULL`)
+        .get(row.id, row.destination, owner, row.generation, now.toISOString()) !== undefined;
+}

package/dist/operate-remote-arguments.js

@@ -10,7 +10,7 @@ const args = (positionals = '', values = '', references = {}) => ({
  * digest. Neither dereferences a conversation, task or proposal. Creation IDs are never looked up. */
 export const REMOTE_ARGUMENTS = new Map([
     ...['status', 'ready', 'grants', 'gaps', 'sync', 'runner list', 'coordinator list', 'incident list',
-        'routine list', 'intake show', 'intake run', 'template list', 'webhook status', 'webhook test', 'review show',
+        'routine list', 'intake show', 'intake run', 'template list', 'webhook status', 'review show',
         'chat-approval show', 'chat-approval off'].map(row => [row, args()]),
     ['integrations', args('', 'saved')],
     // --person and --token-name are names compared inside the reader's own view; --token stays a refused credential.

package/dist/operate-remote.js

@@ -46,7 +46,7 @@ export const REMOTE_SCOPES = new Map([
     ...["list", "show", "add", "refresh", "pause", "resume", "run-now"].map(action => [`routine ${action}`, installation]),
     ["config show", installation], ["verify show", repo], ["intake show", installation], ["intake run", installation], ["intake preview", installation],
     ["intake pr-comments", installation], ["template list", installation], ["template show", installation], ["contest show", installation],
-    ["contest exclude", installation], ["webhook status", installation], ["webhook test", installation], ["review show", installation],
+    ["contest exclude", installation], ["webhook status", installation], ["review show", installation],
     ["chat-approval show", self], ["chat-approval off", self],
     // The person's own remote actions, or everyone's within their projects for an approver (remote-audit.ts).
     ["audit", self],
@@ -64,7 +64,7 @@ export const REMOTE_SCOPES = new Map([
 export const REMOTE_ALL_PROJECTS_ONLY = new Map([
     // Settings, connections and acts that belong to the installation as a whole, not to any one project.
     ...["integrations", "grants", "sync", "incident resolve", "routine add", "routine refresh", "routine pause", "routine resume", "routine run-now",
-        "config show", "intake run", "contest exclude", "webhook status", "webhook test"].map(row => [row, "installation-wide"]),
+        "config show", "intake run", "contest exclude", "webhook status"].map(row => [row, "installation-wide"]),
     // Cross-project lists and reads a limited person is still refused; scoping them is later work.
     ...["runner list", "coordinator list", "outbox list", "incident list", "routine list", "routine show", "intake show", "intake preview",
         "intake pr-comments", "template list", "template show", "contest show", "review show"].map(row => [row, "not yet scoped"]),

package/dist/operate.d.ts

@@ -124,7 +124,7 @@ export declare const OPERATE_BOOLEAN_FLAGS: ReadonlySet<string>;
 export declare function parseOperateArgs(argv: readonly string[], ownValues?: ReadonlySet<string>): Args | {
     error: string;
 };
-/** Route an `operate` command. Returns the process exit code. */
+/** Route a native command and return its exit code. Its password source cannot be selected by an HTTP request. */
 export declare function runOperate(command: string, argv: readonly string[], write: Write, options?: OperateOptions): Promise<number>;
 export type { Principal };
 /**