toolroll 0.9.51 → 0.9.53

package/dist/server/pages-assets.js

@@ -36,7 +36,7 @@ const PWA_MANIFEST = JSON.stringify({
 // paths — the payload URL is data, revalidated, never handed raw to the
 // browser (arc 3 finding 5).
 const PWA_WORKER = `// Toolroll — push only; deliberately NO fetch handler (no offline cache of an authenticated console).
-const SHAPES = [/^\\/next$/, /^\\/review$/, /^\\/system$/, /^\\/routines$/, /^\\/routines\\/[0-9]+$/, /^\\/d\\/[0-9]+$/, /^\\/contest\\/[0-9]+$/, /^\\/r\\/[0-9]+$/];
+const SHAPES = [/^\\/next$/, /^\\/review$/, /^\\/system$/, /^\\/routines$/, /^\\/routines\\/[0-9]+$/, /^\\/d\\/[0-9]+$/, /^\\/r\\/[0-9]+$/];
 self.addEventListener("push", function (event) {
   var data = {};
   try { data = event.data ? event.data.json() : {}; } catch (e) {}

package/dist/server/pages.js

@@ -320,7 +320,6 @@ export function createPagesHandlers(runtime) {
                 settings: options.telegramTokenFile !== undefined,
                 building: store.liveClaims(project, now),
                 runners: store.listRunners(),
-                heldSessions: new Map(store.openHeldSessions().reduce((by, one) => by.set(one.runner, (by.get(one.runner) ?? 0) + 1), new Map())),
                 worktrees: store
                     .listWorktrees()
                     .filter(one => project === null || sameRepo(one.repo, project)),
@@ -346,7 +345,6 @@ export function createPagesHandlers(runtime) {
                 }),
                 building: store.liveClaims(project, now),
                 runners: store.listRunners(),
-                heldSessions: new Map(store.openHeldSessions().reduce((by, one) => by.set(one.runner, (by.get(one.runner) ?? 0) + 1), new Map())),
                 worktrees: store.listWorktrees().filter(one => project === null || sameRepo(one.repo, project)),
                 episode: project === null ? null : store.latestWatchEpisode(project),
                 outboxPending: store.pendingForAttention().length,

package/dist/server/people-tokens.js

@@ -73,7 +73,6 @@ export function createPeopleHandlers(runtime) {
                 `<p class="meta">Operators with all-project access also manage the instance.</p><fieldset><legend>Projects</legend>${projectChoices.length === 0 ? `<p class="meta">Add a project before granting selected access.</p>` : projectChoices.map(repo => `<label class="row"><input type="checkbox" name="projects" value="${escape(repo)}"${selected?.includes(repo) ? " checked" : ""}>${escape(projectName(repo))}</label>`).join("")}</fieldset>`;
             const cards = accounts.map(one => {
                 const seen = lastSeenOf(one.name);
-                const attended = store.openAttendedOf(one.name);
                 const acts = store.recentActsOf(one.name);
                 const standing = one.revokedAt !== null
                     ? `revoked ${escape(one.revokedAt.slice(0, 16).replace("T", " "))} by ${personChip(one.revokedBy ?? "?")}`
@@ -87,9 +86,6 @@ export function createPeopleHandlers(runtime) {
                     approverView && one.revokedAt === null ? `<details><summary>Edit project access</summary><form method="post" action="/people/projects">${hiddenFields({ csrf, name: one.name })}${accessFields(one.projects)}<label>Your password<input type="password" name="token" autocomplete="current-password" required></label><p class="meta">Changing access signs this person out and ends their derived sessions and modes. Previously approved work stays recorded.</p><button type="submit">Save project access</button></form></details>` : "",
                     `<p class="meta">${seen === null ? "not signed in right now" : `signed in \u2014 active ${escape(new Date(seen).toISOString().slice(11, 16))} UTC`} \u00b7 joined ${escape(one.addedAt.slice(0, 10))}</p>`,
                     `<p><a href="${escape(personHref(one.name))}">Tokens and remote activity</a></p>`,
-                    attended.length === 0
-                        ? ""
-                        : `<p class="row">watching now: ${attended.map(session => `<a href="/t/${escape(session.taskId)}">${escape(session.taskId)}</a>`).join(", ")}</p>`,
                     acts.length === 0
                         ? `<p class="meta">No recorded acts yet</p>`
                         : acts.map(act => `<p class="row meta">${escape(act.kind)} ${escape(act.subject)} \u00b7 ${escape(act.at.slice(0, 16).replace("T", " "))}</p>`).join("\n"),

package/dist/server/route-table.d.ts

@@ -17,7 +17,7 @@ export type Caller = "anonymous" | "service" | "cookie" | "bearer" | "oauth" | "
 /** What the caller must hold: nothing, read, act (an approver or an `act` token), or a fresh password/provider check on top. */
 export type RouteScope = "none" | "read" | "act" | "step-up";
 /** Where the request's project comes from. */
-export type ProjectResolver = "none" | "session" | "form" | "form-path" | "task" | "run" | "decision" | "incident" | "routine" | "flow" | "proposal" | "conversation" | "coding" | "adapter";
+export type ProjectResolver = "none" | "session" | "form" | "form-path" | "task" | "run" | "decision" | "incident" | "flow" | "proposal" | "conversation" | "coding" | "adapter";
 /**
  * What a project-limited account may do here:
  * - `deny`: instance access only.

package/dist/server/route-table.js

@@ -120,7 +120,6 @@ get("tasks", "runs", "/runs", { limited: "collection" });
 get("pages", "menu", "/menu", { limited: "collection", ...free });
 get("tasks", "run.page", `^\\/r\\/${ID}$`, { project: "run", limited: "resource", ...free, sample: "/r/1" });
 get("tasks", "run.evidence", `^\\/r\\/${ID}\\/evidence\\/${ID}$`, { project: "run", limited: "resource", ...free, sample: "/r/1/evidence/2" });
-get("tasks", "contest.page", `^\\/contest\\/${ID}$`, { ...free, sample: "/contest/1" });
 get("pages", "caps", "/caps");
 get("flows", "flows.new", "/flows/new", { limited: "resource", ...free });
 get("flows", "flows.gallery", "^\\/flows\\/new\\/[a-z-]{1,40}$", { limited: "resource", ...free, sample: "/flows/new/triage" });
@@ -139,13 +138,14 @@ for (const one of ["run", "start", "new", "edit", "from-task", "preview", "expor
     get("flows", `recipes.${one}`, `/recipes/${one}`, { limited: "collection" });
 // Any other recipe screen answers the recipe area's own refusal.
 get("flows", "recipes.other", "^\\/recipes\\/.*$", { sample: "/recipes/unknown" });
+// v115: routines became scheduled flows; old links to them land on the flows page.
 get("tasks", "routines", "/routines", { limited: "collection" });
 get("chat", "chat.stream", "/chat/stream", free);
 get("chat", "chat.mate-status", "/chat/mate/status", free);
 get("chat", "chat.demo-live", "/chat/demo/live", free);
 get("chat", "chat.page", "/chat", { project: "conversation", limited: "conversation", ...free });
 get("chat", "chat.ack", `^\\/chat\\/ack\\/${ID}$`, { sample: "/chat/ack/1" });
-get("tasks", "routine.page", `^\\/routines\\/${ID}$`, { project: "routine", limited: "resource", sample: "/routines/1" });
+get("tasks", "routine.page", `^\\/routines\\/${ID}$`, { limited: "resource", sample: "/routines/1" });
 get("settings", "control", "/control");
 get("settings", "control.connection", "/control/connection");
 get("chat", "chat.action", `^\\/chat\\/action\\/${ID}$`, { project: "proposal", limited: "proposal", ...free, sample: "/chat/action/1" });
@@ -166,8 +166,6 @@ get("chat", "lead.status", "/lead/status", free);
 get("chat", "chat.task-status", "/chat/task-status", free);
 get("tasks", "decision.evidence", `^\\/d\\/${ID}\\/evidence\\/${ID}$`, { project: "decision", limited: "resource", ...free, sample: "/d/1/evidence/2" });
 // ---- console actions -------------------------------------------------------------------------------------------
-// The attended beat guards itself (cookie, form type, Sec-Fetch-Site) before the shared mutation guard.
-post("tasks", "session.attended-beats", "/session/attended-beats", { callers: ["cookie"], scopeRefusal: "your login can watch, not keep sessions alive", callerRefusal: { status: 403, type: "text/plain; charset=utf-8", body: "watching is a browser session's act" } });
 // The scripted demo: the handler answers a non-browser caller "no page here".
 post("chat", "chat.demo", "^\\/chat\\/demo\\/(ask|[0-9]{1,9}\\/(approve|change|revise|complete))$", { sample: "/chat/demo/ask" });
 post("settings", "provider.resume", "^\\/providers\\/[a-z]+\\/resume$", { sample: "/providers/codex/resume" });
@@ -243,12 +241,6 @@ post("people", "people.revoke", "/people/revoke", { scope: "step-up" });
 post("pages", "fleet.retire", "/fleet/runner/retire", { scope: "step-up" });
 // Answering a parked decision needs act access and irreversible-choice confirmation, not password step-up.
 post("tasks", "decision.answer", `^\\/d\\/${ID}\\/answer$`, { project: "decision", limited: "resource", scope: "act", sample: "/d/1/answer" });
-post("tasks", "contest.act.arm", `^\\/contest\\/${ID}\\/arm$`, { sample: "/contest/1/arm" });
-post("tasks", "contest.act.pick", `^\\/contest\\/${ID}\\/pick$`, { scope: "step-up", sample: "/contest/1/pick" });
-post("tasks", "contest.act.abandon", `^\\/contest\\/${ID}\\/abandon$`, { scope: "step-up", sample: "/contest/1/abandon" });
-post("tasks", "task.attend.attend-preview", `^\\/t\\/${TASK}\\/attend-preview$`, { callers: ["cookie"], project: "task", sample: "/t/one/attend-preview" });
-post("tasks", "task.attend.attend", `^\\/t\\/${TASK}\\/attend$`, { scope: "step-up", project: "task", sample: "/t/one/attend" });
-post("tasks", "task.attend.attend-revoke", `^\\/t\\/${TASK}\\/attend-revoke$`, { callers: ["cookie"], project: "task", sample: "/t/one/attend-revoke" });
 post("tasks", "task.act.hold", `^\\/t\\/${TASK}\\/hold$`, { project: "task", limited: "resource", sample: "/t/one/hold" });
 post("tasks", "task.act.unhold", `^\\/t\\/${TASK}\\/unhold$`, { project: "task", limited: "resource", sample: "/t/one/unhold" });
 post("tasks", "task.act.requeue", `^\\/t\\/${TASK}\\/requeue$`, { project: "task", limited: "resource", sample: "/t/one/requeue" });
@@ -291,15 +283,8 @@ post("chat", "chat.ack-send", `^\\/chat\\/ack\\/${ID}$`, { scope: "step-up", sam
 for (const one of ["prepare", "preview", "import", "save"])
     post("flows", `recipes.${one}-send`, `/recipes/${one}`, { limited: "collection" });
 post("flows", "recipes.launch-send", "/recipes/launch", { limited: "collection" });
-post("tasks", "routines.add", "/routines/add", { project: "form", limited: "collection" });
-post("tasks", "routine.act.approve", `^\\/routines\\/${ID}\\/approve$`, { scope: "step-up", project: "routine", limited: "resource", sample: "/routines/1/approve" });
-post("tasks", "routine.act.refresh", `^\\/routines\\/${ID}\\/refresh$`, { project: "routine", limited: "resource", sample: "/routines/1/refresh" });
-post("tasks", "routine.act.pause", `^\\/routines\\/${ID}\\/pause$`, { project: "routine", limited: "resource", sample: "/routines/1/pause" });
-post("tasks", "routine.act.resume", `^\\/routines\\/${ID}\\/resume$`, { project: "routine", limited: "resource", sample: "/routines/1/resume" });
-post("tasks", "routine.act.run-now", `^\\/routines\\/${ID}\\/run-now$`, { scope: "step-up", project: "routine", limited: "resource", sample: "/routines/1/run-now" });
 post("tasks", "run.act", `^\\/r\\/${ID}\\/(note|comment|revise|draft-repair|checks|add-tests)$`, { project: "run", limited: "resource", sample: "/r/1/note" });
 post("tasks", "session.editor-links", "/session/editor-links", { viewer: true });
-post("tasks", "run.turn", `^\\/r\\/${ID}\\/turn$`, { project: "run", sample: "/r/1/turn" });
 post("tasks", "incident.resolve", `^\\/i\\/${ID}\\/resolve$`, { project: "incident", sample: "/i/1/resolve" });
 /** The sole route table, in match order. */
 export const ROUTES = Object.freeze(rows.map(one => Object.freeze(one)));

package/dist/server/settings.js

@@ -200,10 +200,6 @@ export function createSettingsHandlers(runtime) {
                         `<option value="">approve plans and merges here, with my password (the default)</option>` +
                         `<option value="1">approve plans and merge ready pull requests from my paired chat, two taps each</option>` +
                         `</select><span class="meta">Plans that widen permissions, exceed the attempt cap or touch protected paths still open Toolroll.</span></label>`,
-                    `<label>If a subscription runs out<select name="allow-paid-fallback">` +
-                        `<option value="">never switch to a paid API key on its own (the default, every preset)</option>` +
-                        `<option value="1">allow the approved fallback — spend moves to that account</option>` +
-                        `</select></label>`,
                     `<button type="submit">Read the full terms</button>`,
                     `</form>`,
                     `</div>`,
@@ -1111,6 +1107,8 @@ export function createSettingsHandlers(runtime) {
             if (who.via !== "cookie" || !store.isInstanceOperator(who.name) || databaseFile === null)
                 return refuse(response, who, 403, "An instance operator looks after backups.", "/settings");
             const made = await backupNow(store, databaseFile, "manual", clock);
+            if (made.ok && made.checkpoint !== null && "problem" in made.checkpoint)
+                return redirect(response, `/settings/backups?problem=${encodeURIComponent(`Backed up. The activity log failed its tamper check, so it was not anchored: ${made.checkpoint.problem}`)}`);
             return redirect(response, made.ok ? `/settings/backups?said=${encodeURIComponent("Backed up.")}` : `/settings/backups?problem=${encodeURIComponent(`The backup failed: ${made.error}`)}`);
         }
         // Sprint 8: change the backup schedule. A step-up; the ledger keeps before → after.
@@ -1978,7 +1976,7 @@ export function createSettingsHandlers(runtime) {
                 const existing = loadBotToken({}, options.telegramTokenFile);
                 const hasEnv = (envValue(process.env, "TELEGRAM_TOKEN") ?? "") !== "";
                 const csrf = who.via === "cookie" ? who.session.csrf : "";
-                return sendScreen(response, 400, settingsPage(chromeFor(who.via === "cookie" ? who.session.project : defaultProject, "settings"), existing, hasEnv, csrf, saved.message, null, null, null, null, {
+                return sendScreen(response, 400, settingsPage(chromeFor(who.via === "cookie" ? who.session.project : defaultProject, "settings"), existing, hasEnv, csrf, saved.message, options.configDir === undefined ? null : effectivePrimary(process.env, options.configDir, loadBotToken(process.env, options.telegramTokenFile) !== null), null, null, null, {
                     ...store.permissionDefault(),
                     canManage: who.role === "approver",
                 }));
@@ -2047,9 +2045,6 @@ export function createSettingsHandlers(runtime) {
                 planAuto: body.get("plan-auto") === "1",
                 reviewAuto: false,
                 reviewRetryAuto: false,
-                // The paid-fallback grant is NEVER a preset default (R8): unchecked
-                // stays false on every preset — only the explicit box grants it.
-                allowPaidFallback: body.get("allow-paid-fallback") === "1",
                 // The repair-auto grant is the SAME rule (v40): unchecked stays
                 // false on every preset — only the explicit box grants it, and the
                 // attempt cap it carries is meaningless without it.
@@ -2078,7 +2073,7 @@ export function createSettingsHandlers(runtime) {
                     `<input type="hidden" name="csrf" value="${escape(who.session.csrf)}">` +
                     `<input type="hidden" name="nonce" value="${escape(nonce)}">` +
                     `<input type="hidden" name="digest" value="${escape(digest)}">` +
-                    ["name", "days", "publication", "auto-approve", "plan-auto", "chat-approve", "allow-paid-fallback"]
+                    ["name", "days", "publication", "auto-approve", "plan-auto", "chat-approve"]
                         .map(field => `<input type="hidden" name="${field}" value="${escape(body.get(field) ?? "")}">`)
                         .join("") +
                     `<input type="hidden" name="expiry" value="${escape(expiry)}">` +