toolroll 0.9.50 → 0.9.52

package/dist/operate.js

@@ -1,3 +1,4 @@
+import { notificationClaimHeld, claimNotifications, finalizeNotification, notificationDestination } from "./notification-delivery.js";
 import { adapterPolicy } from "./server/route-policy.js";
 import { UNSENT_REPLY_MS } from "./telegram-settings.js";
 import { checkPublicCommand } from "./public-check.js";
@@ -47,8 +48,6 @@ import { runRequestedUndos, sendTeammateWeeklies } from "./teammate-week.js";
 import { refreshConnections } from "./mcp-connect.js";
 import { followDiscord } from "./discord.js";
 import { followTeams } from "./teams.js";
-import { loadDiscordCredentials } from "./discord-api.js";
-import { loadSlackCredentials } from "./slack-api.js";
 import { followSlack } from "./slack.js";
 import { validateScopeText } from "./task-text.js";
 import { runMemoryCommand } from "./memory-cli.js";
@@ -98,6 +97,7 @@ import { pushPass } from "./push.js";
 import { chmodSync, closeSync, constants as fsConstants, existsSync, fstatSync, fsyncSync, openSync, readFileSync, readSync, realpathSync, renameSync, unlinkSync, writeSync, writeFileSync, mkdirSync } from "node:fs";
 import { BRANCH_PREFIX, envTwins, envValue, existingOrFirst, namedPath, taskBranches } from "./names.js";
 import { claimActor, currentActor, parseLeadToken, withActor } from "./actor.js";
+import { CLI_PASSWORD_SOURCE, withPasswordSource } from "./sign-in-guard.js";
 import { admissionRecorded, admitProject, commandLineActor } from "./project-admission.js";
 import { leadClaim, leadSay, noteLeadWork } from "./lead-voice.js";
 import { createServer as createNetServer } from "node:net";
@@ -196,7 +196,7 @@ import { isRiskLevel, isTaskSize, legOf, projectRoute, riskConsequence, routeDig
 import { observeProviderReadiness, reportProviderReadinessAuthed } from "./runner.js";
 import { parseDemoUrl, projectDemoUrl, saveProjectDemo } from "./project-demo.js";
 import { effectiveConcurrency, maySlotTake, parseProjectConcurrency, PROJECT_CONCURRENCY_DEFAULT, ProjectPasses, projectConcurrency, saveProjectConcurrency, savedProjectConcurrency } from "./project-concurrency.js";
-import { clearWebhook, effectivePrimary, isMessagingChannel, loadConsoleUrl, loadPrimary, loadWebhookTargets, phoneOrigin, saveConsoleUrl, savePrimary, saveWebhook, webhookPass, SLACK_ENV, DISCORD_ENV } from "./webhooks.js";
+import { activeWebhookTargets, webhookPass, LEGACY_WEBHOOK_WARNING, loadWebhookTargets, effectivePrimary, isMessagingChannel, loadConsoleUrl, phoneOrigin, saveConsoleUrl, savePrimary } from "./webhooks.js";
 import { auditOf, inspectionOf, isProviderId, MONEY_CAPABILITIES, PROVIDER_IDS, validModelId, validateSpec, ALL_CREDENTIAL_ENV } from "./provider.js";
 import { attestProvider, attestationOf, versionInRange } from "./attest.js";
 import { recognizesEligible } from "./exhaustion.js";
@@ -574,21 +574,14 @@ Agents — which provider and model each phase runs on
                                         says REVIEW was not read)
 
 The outbox — facts that want a person, durably
-  toolroll webhook set slack|discord <url>
-                                        UI-only chat mirrors: every page a
-                                        message with a console link; acting
-                                        stays in the console. Delivers when
-                                        Telegram is not configured.
   toolroll webhook set console-url <http://host:port>
   toolroll webhook primary telegram|slack|discord
                                         which service receives alerts when
                                         several are connected (asked once,
                                         the first time you add a second)
-  toolroll webhook status | test | clear slack|discord
-  toolroll outbox list [--all]
-  toolroll outbox deliver --cmd <c>  runs once per pending row, reading
-                                        $TOOLROLL_KIND / _SUBJECT / _BODY;
-                                        exit 0 delivered receipts, 1 any fail
+  toolroll webhook status
+  toolroll outbox list [--all]          pending facts (--all: resolved too)
+  toolroll outbox deliver --cmd <cmd>   deliver through an operator command
 
 Runners — the machines that may be given work
   toolroll runner register <name> [--capacity <n>] [--token-file <path>]
@@ -760,8 +753,11 @@ export function parseOperateArgs(argv, ownValues = new Set()) {
     }
     return { positional, flags, repoList };
 }
-/** Route an `operate` command. Returns the process exit code. */
+/** Route a native command and return its exit code. Its password source cannot be selected by an HTTP request. */
 export async function runOperate(command, argv, write, options = {}) {
+    return withPasswordSource(CLI_PASSWORD_SOURCE, () => runOperateLocal(command, argv, write, options));
+}
+async function runOperateLocal(command, argv, write, options = {}) {
     const parsed = parseOperateArgs(argv, command === "flows" ? FLOWS_VALUE_FLAGS : undefined);
     // A parse error precedes the flags map, so JSON mode is read from the raw
     // argv — the envelope contract holds even for the earliest refusal.
@@ -1059,8 +1055,8 @@ function telegramConversation(context, options = {}) {
         evidenceRoot: context.evidenceRoot,
         ...(context.mateSeams?.subscriptionRunner === undefined ? {} : { subscriptionRunner: context.mateSeams.subscriptionRunner }),
         ...(context.heldCoordinator === undefined ? {} : { held: context.heldCoordinator }),
-        // Re-read on every card and every `/task`: the same console-url the
-        // mirrors use, held to an https origin, and — inside `up`, where this
+        // Re-read on every card and every `/task`: the same console-url chat
+        // links use, held to an https origin, and — inside `up`, where this
         // process also serves the console — equal to that console's own
         // `--public-url`, or no link at all.
         phoneOrigin: () => phoneOrigin(process.env, dirname(context.databaseFile), { serverOrigin: options.serverOrigin ?? null }),
@@ -4918,7 +4914,7 @@ async function briefCommand(flags, context) {
             lines.push(`      #${pull.number}  ${pull.title}`);
     }
     if (pending.length > 0) {
-        lines.push(`  ▸ OUTBOX     ${pending.length} undelivered — toolroll outbox deliver --cmd …`);
+        lines.push(`  ▸ OUTBOX     ${pending.length} undelivered — toolroll outbox list`);
     }
     if (decisions.length > 0) {
         const overdue = decisions.filter(one => one.state === "expired").length;
@@ -5425,18 +5421,16 @@ async function incidentCommand(positional, flags, context) {
     ]);
 }
 /**
- * `toolroll webhook …` — Slack and Discord as UI-ONLY mirrors: every
- * page is a message with a console link; acting stays in the console
- * behind its own authentication. The URL is a credential: 0600 file
- * beside the database, or the environment, never anywhere else.
+ * `toolroll webhook status|primary|set console-url` — messaging settings:
+ * which connected chat service receives alerts, and the console address
+ * chat links open.
  */
-async function webhookCommand(positional, flags, context) {
-    const { store, write, json, clock } = context;
+async function webhookCommand(positional, _flags, context) {
+    const { write, json } = context;
     const dir = dirname(context.databaseFile);
     const [action, which, value] = positional;
     const telegramConfigured = loadBotToken(process.env, context.telegramTokenFile) !== null;
     if (action === undefined || action === "status") {
-        const targets = loadWebhookTargets(process.env, dir);
         const consoleUrl = loadConsoleUrl(process.env, dir);
         const primary = effectivePrimary(process.env, dir, telegramConfigured);
         if (json) {
@@ -5452,29 +5446,8 @@ async function webhookCommand(positional, flags, context) {
             write(`    Choose: toolroll webhook primary telegram|slack|discord`);
         }
         write(`  links    ${consoleUrl ?? "NOT SET — messages will carry no console link; toolroll webhook set console-url http://host:port"}`);
-        if (targets.length === 0) {
-            write("");
-            write("  toolroll webhook set slack https://hooks.slack.com/services/…");
-            write("  toolroll webhook set discord https://discord.com/api/webhooks/…");
-            write(`  (or export ${SLACK_ENV} / ${DISCORD_ENV})`);
-        }
-        write("");
-        write("  Mirrors deliver when Telegram is not configured; with a paired Telegram");
-        write("  chat, Telegram carries the page (it can hold buttons) and mirrors stay quiet.");
         return EXIT.ok;
     }
-    if (action === "test") {
-        const targets = loadWebhookTargets(process.env, dir);
-        if (targets.length === 0) {
-            return fail(write, json, "webhook test", "unconfigured", "no webhook configured — `toolroll webhook set slack|discord <url>`", EXIT.refused);
-        }
-        store.enqueueNotification({ source: { installation: true }, dedupeKey: `webhook-test:${clock().getTime()}`, kind: "test", subject: "toolroll webhook test", body: "If you can read this, the mirror works. Acting happens in the console." }, clock());
-        const report = await webhookPass(store, { targets, consoleUrl: loadConsoleUrl(process.env, dir), clock });
-        if (report.problems.length > 0) {
-            return fail(write, json, "webhook test", "delivery", report.problems.join("; "), EXIT.failed);
-        }
-        return succeed(write, json, "webhook test", { sent: report.sent }, () => [`Sent ${report.sent} message(s). Check the channel.`]);
-    }
     if (action === "primary") {
         if (which === undefined || !isMessagingChannel(which)) {
             return fail(write, json, "webhook primary", "usage", "primary is one of telegram, slack, discord", EXIT.usage);
@@ -5488,46 +5461,13 @@ async function webhookCommand(positional, flags, context) {
             `Alerts now go to ${which}. ${which === "telegram" ? "Buttons and replies work there as always." : "Telegram (if configured) still accepts taps and replies — it just stops sending alerts."}`,
         ]);
     }
-    if (action === "clear" && (which === "slack" || which === "discord")) {
-        clearWebhook(dir, which);
-        return succeed(write, json, "webhook clear", { which }, () => [`${which} mirror cleared.`]);
-    }
-    if (action !== "set" || which === undefined || value === undefined) {
-        return fail(write, json, "webhook", "usage", "`toolroll webhook [status|test|set slack|discord|console-url <value>|clear slack|discord]`", EXIT.usage);
-    }
-    if (which === "console-url") {
-        const saved = saveConsoleUrl(dir, value);
-        if (!saved.ok)
-            return fail(write, json, "webhook set", "invalid", saved.message, EXIT.usage);
-        return succeed(write, json, "webhook set", { which }, () => [`Console links will open ${value.replace(/\/+$/, "")}.`]);
-    }
-    if (which !== "slack" && which !== "discord") {
-        return fail(write, json, "webhook set", "usage", "set what? slack, discord, or console-url", EXIT.usage);
+    if (action !== "set" || which !== "console-url" || value === undefined) {
+        return fail(write, json, "webhook", "usage", "`toolroll webhook [status|primary <service>|set console-url <url>]`", EXIT.usage);
     }
-    const saved = saveWebhook(dir, which, value);
+    const saved = saveConsoleUrl(dir, value);
     if (!saved.ok)
         return fail(write, json, "webhook set", "invalid", saved.message, EXIT.usage);
-    // The first moment more than one service exists is the moment to ask
-    // which one pages — once, right here, not at 3am when both fire.
-    const after = effectivePrimary(process.env, dir, telegramConfigured);
-    let chosen = null;
-    if (after.implicit && loadPrimary(process.env, dir) === null && after.configured.length > 1 && interactive() && !json) {
-        write(`You now have ${after.configured.join(" and ")} connected.`);
-        const answer = (await ask(`Which service should receive alerts? [${after.configured.join("/")}] `)).trim().toLowerCase();
-        if (isMessagingChannel(answer) && after.configured.includes(answer)) {
-            savePrimary(dir, answer);
-            chosen = answer;
-        }
-        else {
-            write(`Left unchosen — ${after.channel} receives alerts by default. Decide any time: toolroll webhook primary <service>`);
-        }
-    }
-    return succeed(write, json, "webhook set", { which, ...(chosen === null ? {} : { primary: chosen }) }, () => [
-        `${which} mirror configured — the URL lives in a private file beside the database.`,
-        ...(chosen === null ? [] : [`${chosen} carries the pages.`]),
-        ...(after.implicit && chosen === null && !interactive() ? [`Several services are configured — choose the pager: toolroll webhook primary <service>`] : []),
-        `Send yourself a proof: toolroll webhook test`,
-    ]);
+    return succeed(write, json, "webhook set", { which }, () => [`Console links will open ${value.replace(/\/+$/, "")}.`]);
 }
 /**
  * `toolroll providers resume <provider>` — a person says the sign-in works
@@ -7861,6 +7801,7 @@ async function runWatchLoop(args) {
     let lastTick = 0;
     let lastBridge = 0;
     let lastPush = 0;
+    let lastWebhook = 0;
     let ticks = 0;
     let built = 0;
     let brokeCount = 0;
@@ -8156,6 +8097,14 @@ async function runWatchLoop(args) {
                     // Push is additive; a broken pass never stops the watch.
                 }
             }
+            if (now - lastWebhook >= bridgeEveryMs) {
+                lastWebhook = now;
+                const dir = dirname(context.databaseFile);
+                const primary = effectivePrimary(process.env, dir, loadBotToken(process.env, context.telegramTokenFile) !== null);
+                const targets = activeWebhookTargets(process.env, dir, primary.channel);
+                if (targets.length > 0)
+                    await webhookPass(store, { targets, consoleUrl: loadConsoleUrl(process.env, dir), clock: context.clock });
+            }
             // The embedded follower owns the wire while it lives; the timer-driven
             // pass is the fallback shape for a watch started before a token existed.
             if (follower === null && now - lastBridge >= bridgeEveryMs) {
@@ -8171,12 +8120,6 @@ async function runWatchLoop(args) {
                     quiet.length = 0;
                     await bridgeCommand(["telegram"], passFlags(primary.channel === "telegram" ? {} : { "inbound-only": "1" }), quietContext);
                 }
-                if (primary.channel !== null && primary.channel !== "telegram") {
-                    const targets = loadWebhookTargets(process.env, dir).filter(one => one.kind === primary.channel && (one.kind !== "slack" || loadSlackCredentials(dir) === null) && (one.kind !== "discord" || loadDiscordCredentials(dir) === null));
-                    if (targets.length > 0) {
-                        await webhookPass(store, { targets, consoleUrl: loadConsoleUrl(process.env, dir), clock: context.clock });
-                    }
-                }
             }
             // Work-conserving: if the world moved while we worked — or we just
             // finished something that may have freed a dependent — go again now.
@@ -8190,7 +8133,7 @@ async function runWatchLoop(args) {
             // due, a signal lands, or the trial window (--for) ends. Reading one
             // integer from SQLite twice a second is the entire idle cost — no
             // token has anywhere to be spent from here.
-            const idleUntil = Math.min(lastTick + tickEveryMs, lastBridge + bridgeEveryMs, deadline ?? Number.MAX_SAFE_INTEGER) - Date.now();
+            const idleUntil = Math.min(lastTick + tickEveryMs, lastBridge + bridgeEveryMs, lastWebhook + bridgeEveryMs, deadline ?? Number.MAX_SAFE_INTEGER) - Date.now();
             // Doze for the WHOLE idle window, waking early only for a signal or a
             // sequence move — not for one 500ms step and then another pass
             // (2026-09-05: that read as two ticks a second, all night, with
@@ -9800,18 +9743,6 @@ async function publishCommand(positional, flags, context) {
     return succeed(write, json, "publish", { report }, lines);
 }
 // ---- the outbox -----------------------------------------------------------
-/**
- * `toolroll outbox list|deliver` — reading and draining the durable
- * outbox. Delivery runs an operator-supplied command once per pending row;
- * the notification's text reaches it as environment variables, never
- * substituted into the command line, because subjects and bodies quote
- * things agents and repositories said and a shell must not meet those.
- *
- *   toolroll outbox deliver --cmd 'curl -d "$TOOLROLL_SUBJECT" ntfy.sh/mine'
- *
- * Exit 0 when everything pending delivered (or nothing was pending);
- * 1 when any delivery failed — a broken channel is breakage, not a "no".
- */
 /**
  * `toolroll peek [<run>] [--tmux] [--lines <n>]` — watch live agents
  * in the terminal: one pane per open run with its stage and transcript
@@ -9861,6 +9792,11 @@ async function peekCommand(positional, flags, context) {
     }
     return runPeek(store, context.evidenceRoot, { ...(runId === undefined ? {} : { runId }), io: { stdout: process.stdout, stdin: process.stdin }, clock });
 }
+/**
+ * `toolroll outbox list [--all]` — read the durable outbox: the facts that
+ * want a person, pending until resolved. An operator command can also deliver
+ * them with its own destination receipts.
+ */
 async function outboxCommand(positional, flags, context) {
     const { store, write, json, clock } = context;
     const [action] = positional;
@@ -9872,17 +9808,12 @@ async function outboxCommand(positional, flags, context) {
             return EXIT.ok;
         }
         if (notifications.length === 0) {
-            write(wanted === "pending" ? "Nothing waiting to be delivered." : "The outbox is empty.");
+            write(wanted === "pending" ? "Nothing pending." : "The outbox is empty.");
             return EXIT.ok;
         }
         for (const one of notifications) {
-            const state = one.deliveredAt !== null
-                ? `delivered ${one.deliveredAt}`
-                : one.attempts > 0
-                    ? `pending, ${one.attempts} failed attempt(s): ${one.lastError ?? ""}`
-                    : "pending";
             write(`  #${one.id} ${one.kind.padEnd(18)} ${one.subject}`);
-            write(`      ${state}`);
+            write(`      ${one.resolvedAt === null ? "pending" : `resolved ${one.resolvedAt}`}`);
         }
         return EXIT.ok;
     }
@@ -9894,14 +9825,9 @@ async function outboxCommand(positional, flags, context) {
         if (command === undefined) {
             return fail(write, json, "outbox deliver", "usage", "--cmd says how: it runs once per notification, reading $TOOLROLL_KIND, $TOOLROLL_SUBJECT, $TOOLROLL_BODY", EXIT.usage);
         }
-        // Claimed, not merely listed: the Telegram bridge drains this same
-        // outbox, and select-then-send-then-record from two deliverers pages a
-        // person twice. The claim is a short lease on the act of sending; a
-        // deliverer that dies mid-send leaves rows that unclaim by expiry.
+        // The exact command owns a leased destination receipt, including across concurrent CLI invocations.
         const owner = `outbox-${randomUUID()}`;
-        // Push first, independently (arc 3 finding 8): its pair ledger does not
-        // depend on globally-undelivered notifications — Telegram or a webhook
-        // may already have stamped delivered_at.
+        // Push delivery has independent receipts and must keep working if this command fails.
         let pushed = 0;
         try {
             pushed = (await pushPass(store, { configDir: dirname(context.databaseFile), clock })).accepted;
@@ -9909,7 +9835,7 @@ async function outboxCommand(positional, flags, context) {
         catch {
             // additive; the shell delivery below still runs
         }
-        const pending = store.claimDeliveries(owner, 2 * 60_000, clock());
+        const pending = claimNotifications(store, notificationDestination("command", command), owner, clock());
         if (pending.length === 0) {
             return succeed(write, json, "outbox deliver", { delivered: 0, failed: 0, pushed }, () => [
                 pushed > 0 ? `Nothing for the shell command; ${pushed} push(es) accepted.` : "Nothing waiting to be delivered.",
@@ -9918,6 +9844,10 @@ async function outboxCommand(positional, flags, context) {
         let delivered = 0;
         let failed = 0;
         for (const one of pending) {
+            if (!notificationClaimHeld(store, one, owner, clock())) {
+                failed++;
+                continue;
+            }
             const sent = await run("sh", ["-lc", command], {
                 timeoutMs: 30_000,
                 env: {
@@ -9929,14 +9859,16 @@ async function outboxCommand(positional, flags, context) {
             });
             if (sent.code === 0) {
                 const receipt = sent.stdout.split("\n")[0]?.trim() ?? "";
-                store.finalizeDelivery(one.id, owner, { ok: true, receipt: receipt === "" ? null : receipt }, clock());
-                delivered++;
+                if (finalizeNotification(store, one, owner, { ok: true, receipt: receipt === "" ? null : receipt }, clock()))
+                    delivered++;
+                else
+                    failed++;
             }
             else {
                 const error = sent.timedOut
                     ? "timed out"
                     : sent.stderr.split("\n")[0]?.trim() || `exit ${sent.code}`;
-                store.finalizeDelivery(one.id, owner, { ok: false, error }, clock());
+                finalizeNotification(store, one, owner, { ok: false, error }, clock());
                 failed++;
             }
         }
@@ -10167,6 +10099,7 @@ async function statusCommand(positional, flags, context) {
     // An update waiting, on what, and the action: before anything else, as it holds up new work.
     const waiting = waitingUpdate(context.databaseFile, run => context.store.stopQuiescenceProblem(run) !== null, context.clock());
     const updateWaiting = waiting === null ? {} : { updateWaiting: { app: waiting.app, version: waiting.version, stopped: waiting.stopped, run: waiting.run, on: waiting.on, action: waiting.action } };
+    const legacyWebhookWarning = loadWebhookTargets(process.env, dirname(context.databaseFile)).length > 0 ? LEGACY_WEBHOOK_WARNING : null;
     const projects = projectBuildsStatus(context);
     const projectsLine = projects.length === 0 ? null
         : `Builds by project: ${projects.slice(0, 8).map(one => `${one.name} ${one.running} of ${one.limit}`).join(", ")}${projects.length > 8 ? ", …" : ""}`;
@@ -10174,7 +10107,7 @@ async function statusCommand(positional, flags, context) {
     const unsent = context.store.unsentTelegramReplies(null, null, new Date(context.clock().getTime() - UNSENT_REPLY_MS));
     const unsentLine = unsentRepliesLine(unsent);
     const unsentReplies = unsent.length === 0 ? {} : { unsentReplies: unsent.map(one => ({ ...one, retry: "toolroll bridge telegram retry" })) };
-    return succeed(context.write, context.json, command, { ...status, projects, ...update, ...integrations, ...updateWaiting, ...unsentReplies }, () => [...(waiting === null ? [] : [waiting.words]), ...(unsentLine === null ? [] : [unsentLine]), ...renderInstallationStatus(status), ...(projectsLine === null ? [] : [projectsLine]), ...(line === null ? [] : [line]), ...(brokenLine === null ? [] : [brokenLine])]);
+    return succeed(context.write, context.json, command, { ...status, projects, ...update, ...integrations, ...updateWaiting, ...unsentReplies, ...(legacyWebhookWarning === null ? {} : { legacyWebhookWarning }) }, () => [...(waiting === null ? [] : [waiting.words]), ...(unsentLine === null ? [] : [unsentLine]), ...renderInstallationStatus(status), ...(projectsLine === null ? [] : [projectsLine]), ...(line === null ? [] : [line]), ...(brokenLine === null ? [] : [brokenLine]), ...(legacyWebhookWarning === null ? [] : [legacyWebhookWarning])]);
 }
 function unsentRepliesLine(unsent) {
     if (unsent.length === 0)
@@ -12825,6 +12758,7 @@ async function backupCommand(positional, flags, context) {
             return fail(context.write, context.json, command, "failed", `The backup failed: ${made.error}`, EXIT.failed, { backup: made.id });
         return succeed(context.write, context.json, command, { backup: made }, () => [
             `Backed up to ${made.file} (${bytesWords(made.bytes)}).${made.removed === 0 ? "" : ` Removed ${made.removed} older ${made.removed === 1 ? "backup" : "backups"}.`}`,
+            ...(made.checkpoint !== null && "problem" in made.checkpoint ? [`The activity log failed its tamper check, so it was not anchored: ${made.checkpoint.problem}`] : []),
         ]);
     }
     const settings = store.backupSettings();

package/dist/process-recovery-settlement.js

@@ -123,6 +123,7 @@ export async function recoverPreparedObserverGap(store, input) {
             const actionId = store.recordAction({ at: new Date().toISOString(), actor: "system", repo: current.binding.run.repo,
                 taskId: current.binding.run.taskId, runId: receipt.targetRun, action: "process absence recovered",
                 outcome: digest, source: "work" });
+            store.compactRunProcesses(new Date(), receipt.targetRun);
             return { ok: true, recorded: true, ...result, actionId, certificatePath };
         }));
     }

package/dist/request-budget.d.ts

@@ -107,18 +107,21 @@ export declare const SOURCE_BUDGET_DEFAULTS: Readonly<{
 /**
  * A sliding minute per source or proved account, with bounded in-memory LRU history. Expired entries are
  * pruned first; at capacity the least recently used entry is evicted so new callers are never globally locked out.
- * Unverified account names must never be keys. Person API tokens use the persisted RequestBudget above.
+ * Unverified account names must never be keys. Person API tokens use the persisted RequestBudget above. An address
+ * key counts by sourceKey (a native IPv6 caller by its /64). Verified identities must explicitly use exact keys.
  */
 export declare class SourceAdmission {
     private readonly perMinute;
     private readonly clock;
     private readonly tracked;
     private readonly usage;
+    private readonly keyMode;
     constructor(options: {
         perMinute: number;
         clock?: () => number;
         tracked?: number;
+        keyMode?: "source" | "exact";
     });
     get size(): number;
-    admit(source: string): Admission;
+    admit(key: string): Admission;
 }

package/dist/request-budget.js

@@ -1,3 +1,4 @@
+import { sourceKey } from "./source-key.js";
 export const REQUEST_BUDGET_SCHEMA = `
 CREATE TABLE IF NOT EXISTS request_budget_limit (
   target          TEXT PRIMARY KEY CHECK (target = '*' OR (length(target) = 12 AND target NOT GLOB '*[^0-9a-f]*')),
@@ -237,21 +238,24 @@ export const SOURCE_BUDGET_DEFAULTS = Object.freeze({ password: 120, oauthToken:
 /**
  * A sliding minute per source or proved account, with bounded in-memory LRU history. Expired entries are
  * pruned first; at capacity the least recently used entry is evicted so new callers are never globally locked out.
- * Unverified account names must never be keys. Person API tokens use the persisted RequestBudget above.
+ * Unverified account names must never be keys. Person API tokens use the persisted RequestBudget above. An address
+ * key counts by sourceKey (a native IPv6 caller by its /64). Verified identities must explicitly use exact keys.
  */
 export class SourceAdmission {
     perMinute;
     clock;
     tracked;
     usage = new Map();
+    keyMode;
     constructor(options) {
+        this.keyMode = options.keyMode ?? "source";
         this.perMinute = Math.max(1, Math.min(PER_MINUTE_MAX, options.perMinute));
         this.clock = options.clock ?? Date.now;
         this.tracked = Math.max(1, options.tracked ?? TRACKED_TOKENS);
     }
     get size() { return this.usage.size; }
-    admit(source) {
-        const now = this.clock();
+    admit(key) {
+        const now = this.clock(), source = this.keyMode === "exact" ? key : sourceKey(key);
         let times = this.usage.get(source);
         if (times === undefined) {
             if (this.usage.size >= this.tracked) {

package/dist/retention.js

@@ -1,3 +1,4 @@
+import { reclaimDatabase } from "./database-reclaim.js";
 /**
  * Retention (v105): how long Toolroll keeps run evidence and logs,
  * finished checkouts' records, chat messages and notifications. Until an
@@ -56,7 +57,7 @@ export const RETENTION_KINDS = [
     { kind: "evidence", label: "Run evidence and logs", detail: "Diffs, check logs, screenshots and reports saved for each run" },
     { kind: "checkouts", label: "Finished checkout records", detail: "Records of build checkouts that were let go and are no longer on disk" },
     { kind: "chat", label: "Chat messages", detail: "Messages in lead and team chats" },
-    { kind: "notifications", label: "Notifications", detail: "Delivered or dismissed notifications" },
+    { kind: "notifications", label: "Notifications", detail: "Resolved notifications" },
 ];
 /** The periods the page offers for each kind; the command line takes any number of days from 1 to 3650. */
 const LONG_CHOICES = [30, 90, 180, 365, 730, null];
@@ -183,12 +184,11 @@ export function retentionPlan(store, evidenceRoot, now, periods = store.retentio
         items.chat = rows.slice(0, SWEEP_BATCH).map(row => ({ id: Number(row["id"]), bytes: Number(row["bytes"]) }));
     }
     if (periods.notifications !== null) {
-        const rows = db.prepare(`SELECT n.id AS id, length(n.subject) + length(n.body) + COALESCE(length(n.receipt), 0) + COALESCE(length(n.last_error), 0) + 64 AS bytes FROM notification n
-      WHERE n.created_at < ? AND (n.resolved_at IS NOT NULL OR n.delivered_at IS NOT NULL)
-        AND NOT (n.claim_owner IS NOT NULL AND n.claim_expires_at > ?)
+        const rows = db.prepare(`SELECT n.id AS id, length(n.subject) + length(n.body) + 64 AS bytes FROM notification n
+      WHERE n.created_at < ? AND n.resolved_at IS NOT NULL
         AND NOT EXISTS (SELECT 1 FROM notification_delivery d WHERE d.notification = n.id AND d.claim_owner IS NOT NULL AND d.claim_expires_at > ?)
         AND NOT (n.resolved_at IS NULL AND n.task_ref IS NOT NULL AND NOT EXISTS (SELECT 1 FROM task_ref r WHERE r.id = n.task_ref AND ${finishedTask("r")}))
-      ORDER BY n.id LIMIT ?`).all(cutoff(now, periods.notifications), now.toISOString(), now.toISOString(), SWEEP_BATCH + 1);
+      ORDER BY n.id LIMIT ?`).all(cutoff(now, periods.notifications), now.toISOString(), SWEEP_BATCH + 1);
         more.notifications = rows.length > SWEEP_BATCH;
         items.notifications = rows.slice(0, SWEEP_BATCH).map(row => ({ id: Number(row["id"]), bytes: Number(row["bytes"]) }));
     }
@@ -297,6 +297,7 @@ export function sweepRetention(store, evidenceRoot, now, actor = "worker") {
     const counts = plan.counts.map(one => ({ ...one, count: done[one.kind].count, bytes: done[one.kind].bytes }));
     const freed = counts.reduce((sum, one) => sum + one.bytes, 0);
     const ledgerId = store.recordAction({ at: now.toISOString(), actor, repo: null, taskId: null, runId: null, action: "retention sweep", outcome: freed > 0 || counts.some(one => one.count > 0) ? "removed" : "nothing due", source: "policy", detail: sweepWords(counts, freed) });
+    reclaimDatabase(store.handle, "retention");
     return { at: now.toISOString(), counts, freed, ledgerId };
 }
 /** Whether a day has passed since the last sweep. */

package/dist/scope.d.ts

@@ -498,6 +498,7 @@ export declare function authenticateAccount(store: Store, by: string, secret: st
 } | {
     ok: false;
     reason: "no-approvers" | "unknown" | "revoked" | "locked";
+    retryAfterMs?: number;
 };
 /**
  * v100: someone who signed in with the identity provider moments ago has no

package/dist/scope.js

@@ -1,6 +1,6 @@
 // The rubric's vocabulary loads before anything that reaches the plan contract (see contracts/acceptance-terms.ts).
 export { ACCEPTANCE_LIMITS, EVIDENCE_KINDS } from "./contracts/acceptance-terms.js";
-import { passwordGuardOf } from "./sign-in-guard.js";
+import { currentPasswordSource, passwordGuardOf, provenPasswordAccount } from "./sign-in-guard.js";
 import { validateScopeText } from "./task-text.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { projectAuthority } from "./project-access.js";
@@ -725,16 +725,26 @@ export function authenticateAccount(store, by, secret) {
             return { ok: false, reason: "unknown" };
         return { ok: true, role: account.role, generation: account.generation };
     }
-    // v99: wrong passwords in a row lock the name for a while, whatever road they came by.
-    const guard = passwordGuardOf(store), now = Date.now();
-    if (guard.lockedFor(by, now) > 0)
-        return { ok: false, reason: "locked" };
-    const account = store.accountOf(by);
-    if (account === null || !verifyCredential(account.credentialHash, secret)) {
-        guard.failed(by, now);
+    // v99: wrong passwords in a row lock the name for a while from where they came, whatever road they came by. A
+    // locked or held-back source is refused before the password is checked.
+    const guard = passwordGuardOf(store), now = Date.now(), source = currentPasswordSource();
+    const account = store.accountOf(by), proof = provenPasswordAccount.getStore();
+    const proven = proof?.name === by && account !== null && account.revokedAt === null && proof.generation === account.generation;
+    const wait = guard.preflight(by, now, source, proven);
+    if (wait > 0)
+        return { ok: false, reason: "locked", retryAfterMs: wait };
+    // Unknown names and legacy minted-token/SSO accounts do the same one KDF as a password account. Throttled
+    // attempts above do none, for either name class; never disclose account existence through password work.
+    const dummy = `scrypt$${"0".repeat(32)}$${"0".repeat(64)}`;
+    const hash = account?.credentialHash ?? dummy;
+    if (!hash.startsWith("scrypt$"))
+        verifyCredential(dummy, secret);
+    const matches = verifyCredential(hash, secret);
+    if (account === null || !matches) {
+        guard.failed(by, now, source, account !== null);
         return { ok: false, reason: "unknown" };
     }
-    guard.succeeded(by);
+    guard.succeeded(by, source);
     if (account.revokedAt !== null)
         return { ok: false, reason: "revoked" };
     // Inside a command, the person who signed in is who acted (their own acts never ping them).

package/dist/serve.js

@@ -117,7 +117,8 @@ import { createPeopleHandlers } from './server/people-tokens.js';
 import { createSettingsHandlers } from './server/settings.js';
 import { beatScript, BODY_CAP, chromeScript, decisionsFor, DEMO_BANNER, DEMO_BANNER_SHORT, escape, focusDocument, form, KBD_HELP, LEAD_BY_DEFAULT_FACT, loginHref, matchTaskPath, mateBrowserMessages, mateChatVersion, NO_PROJECT, NO_TOUCH_FRAGMENTS, NONCE_CAP, NONCE_TTL_MS, page, PersistentSessions, pinnedTheme, projectChatHref, QUEUE_VIEW, redactedPath, redirect, refuse, requestContext, respond, safeReturn, screen, SENSITIVE_INPUT, SESSION_ABSOLUTE_MS, SESSION_IDLE_MS, shell, SHUTDOWN_WAIT_MS, sidebarScript, SIGN_IN_LINK_MS, SIGN_IN_LINK_PATH, ssoStepUps, TASK_FORM_BODY_CAP, taskChatHref, teamProposalCardParts, wrongHostPage } from "./server/shared.js";
 import { createTasksHandlers } from './server/tasks.js';
-import { DEFAULT_GUARD_POLICY, passwordGuardOf, SourceBudget } from "./sign-in-guard.js";
+import { DEFAULT_GUARD_POLICY, passwordGuardOf, provenPasswordAccount, SourceBudget, withPasswordSource } from "./sign-in-guard.js";
+import { sourceKey } from "./source-key.js";
 import { readSsoSettings } from "./sso-settings.js";
 import { LEAD_THREAD } from "./store.js";
 import { waitingUpdate } from "./toolroll-update.js";
@@ -247,7 +248,7 @@ export function createDecisionServer(options) {
     // Sessions from before a restart that ran out, or whose account changed since, go now.
     store.sweepWebSessions(Date.now(), SESSION_IDLE_MS, SESSION_ABSOLUTE_MS);
     /** Where a new session signs in from: the browser (its user agent, short) and the address. */
-    const arrival = (request) => ({ agent: (request.headers["user-agent"] ?? "").slice(0, 300) || null, address: joinSourceOf(request).replace(/^fwd:/, "") });
+    const arrival = (request) => ({ agent: (request.headers["user-agent"] ?? "").slice(0, 300) || null, address: forwardedSourceOf(request).replace(/^fwd:/, "") });
     /** Wrong setup codes left before the first-account road closes. */
     let setupAttemptsLeft = 5;
     // The /join road's limiter (D6; Codex people round 1, finding 4):
@@ -262,7 +263,7 @@ export function createDecisionServer(options) {
      * share the proxy's one bucket. A LOOPBACK peer is that proxy, and only
      * then is the forwarded chain believed, taking the LAST hop (the one
      * the trusted proxy itself appended; earlier entries are client-typed). */
-    function joinSourceOf(request) {
+    function forwardedSourceOf(request) {
         const peer = request.socket.remoteAddress ?? "unknown";
         const loopback = LOOPBACK_PEERS.has(peer);
         if (!loopback)
@@ -272,6 +273,8 @@ export function createDecisionServer(options) {
         const lastHop = chain.split(",").pop()?.trim() ?? "";
         return lastHop === "" ? peer : `fwd:${lastHop.slice(0, 64)}`;
     }
+    /** That source as every per-source budget counts it: a native IPv6 caller by its /64 (source-key.ts). */
+    function joinSourceOf(request) { return sourceKey(forwardedSourceOf(request)); }
     const signInBudget = new SourceBudget();
     const ssoVisits = new Map();
     const ssoHandoffs = new Map();
@@ -426,7 +429,7 @@ export function createDecisionServer(options) {
     /** One-click connections on their way: the service's sign-in page and back, 15 minutes at most. */
     const connectVisits = new Map();
     /** Flows open in a browser (v88): who's here, and a nudge when one changes. */
-    // Live views push on write (live-bus.ts): the revision triggers move, the rooms hear it.
+    // Live views push on write (live-bus.ts): each commit moves the workspace revision, the rooms hear it.
     const liveBus = createLiveBus();
     const liveFollower = followWorkspace(store, () => workspaceRevision.current(), liveBus, { file: store.databaseFile() });
     const flowRooms = createFlowRooms(flow => flowFingerprint(store, flow), { bus: liveBus });
@@ -455,7 +458,7 @@ export function createDecisionServer(options) {
     // Unproved password attempts share a source budget. Only successful proof spends an account budget.
     const sourceClock = options.requestBudgetClock === undefined ? {} : { clock: options.requestBudgetClock };
     const passwordSourceBudget = new SourceAdmission({ perMinute: SOURCE_BUDGET_DEFAULTS.password, ...sourceClock });
-    const passwordAccountBudget = new SourceAdmission({ perMinute: SOURCE_BUDGET_DEFAULTS.password, ...sourceClock });
+    const passwordAccountBudget = new SourceAdmission({ perMinute: SOURCE_BUDGET_DEFAULTS.password, keyMode: "exact", ...sourceClock });
     const teamsSourceBudget = new SourceAdmission({ perMinute: SOURCE_BUDGET_DEFAULTS.teamsSource, ...sourceClock });
     const teamsTenantBudget = new SourceAdmission({ perMinute: SOURCE_BUDGET_DEFAULTS.teamsTenant, ...sourceClock });
     const oauthTokenBudget = new SourceAdmission({ perMinute: SOURCE_BUDGET_DEFAULTS.oauthToken, ...sourceClock });
@@ -476,7 +479,8 @@ export function createDecisionServer(options) {
     };
     const server = createServer((request, response) => {
         instrumentRequest(store.telemetry, request, response);
-        void handle(request, response).catch(error => {
+        // Every password checked while answering counts against where this request came from (sign-in-guard.ts).
+        void withPasswordSource(joinSourceOf(request), () => handle(request, response)).catch(error => {
             // Every unhandled error is logged (v99): the path and the message, never the request's body or query.
             logEvent("error", "serve.error", { method: request.method, path: redactedPath(new URL(request.url ?? "/", "http://placeholder").pathname), error: error instanceof Error ? error.message : String(error) });
             if (envValue(process.env, "SERVE_DEBUG") === "1")
@@ -604,7 +608,7 @@ export function createDecisionServer(options) {
         }
         // A real domain (public-access.ts): HSTS for the public https host reached over HTTPS, and no API token over
         // plain HTTP from outside this computer and the tailnet — refused before anything reads or checks it.
-        const transport = transportOf({ peer: request.socket.remoteAddress, joinSource: joinSourceOf(request), forwardedProto: request.headers["x-forwarded-proto"], forwarded: request.headers["forwarded"] });
+        const transport = transportOf({ peer: request.socket.remoteAddress, joinSource: forwardedSourceOf(request), forwardedProto: request.headers["x-forwarded-proto"], forwarded: request.headers["forwarded"] });
         const hsts = hstsFor(publicOrigin?.host ?? null, request.headers.host, transport);
         if (hsts !== null)
             response.setHeader("Strict-Transport-Security", hsts);
@@ -651,8 +655,9 @@ export function createDecisionServer(options) {
         }
         if (who?.via === "bearer" && refuseBudget(admitBearer(request, who)))
             return;
+        const passwordProof = who?.via === 'cookie' ? { name: who.name, generation: who.session.generation } : null;
         if (edgeRoute?.domain === 'people')
-            return dispatchEdge(edgeRoute, { url, who, request, response, method });
+            return provenPasswordAccount.run(passwordProof, () => dispatchEdge(edgeRoute, { url, who, request, response, method }));
         if (who === null) {
             // A GET to an exact task or result (a phone's deep link) signs in and
             // comes back to it — the destination is a same-site path only.
@@ -679,7 +684,7 @@ export function createDecisionServer(options) {
         };
         // An empty password stands for a fresh identity-provider sign-in, for this person only (v100).
         if (method === "GET" || method === "POST")
-            return freshIdentitySignIn.run({ actor: requestFacts.sso?.fresh === true ? who.name : null }, () => requestContext.run(requestFacts, async () => {
+            return freshIdentitySignIn.run({ actor: requestFacts.sso?.fresh === true ? who.name : null }, () => provenPasswordAccount.run(passwordProof, () => requestContext.run(requestFacts, async () => {
                 const taskTextForm = url.pathname === "/tasks/add" || /^\/t\/[^/]+\/scope$/.test(url.pathname);
                 const body = method === "POST" ? await form(request, url.pathname === "/settings/skills/import" ? 2 * 1024 * 1024 : url.pathname === "/flows/import" ? 1024 * 1024 : taskTextForm ? TASK_FORM_BODY_CAP : BODY_CAP) : null;
                 const target = actionTarget(url, who, request, body === null ? null : readForm(body, CONSOLE_FORMS.ledgerTarget));
@@ -749,7 +754,7 @@ export function createDecisionServer(options) {
                     store.recordAction({ ...entry, at: clock().toISOString(), outcome: "error" });
                     throw error;
                 }
-            }));
+            })));
         return respond(response, 405, "text/plain; charset=utf-8", "no such method here");
     }
     function actionTarget(url, who, request, body = null) {