toolroll 0.9.52 → 0.9.54

package/dist/server/pages.js

@@ -320,7 +320,6 @@ export function createPagesHandlers(runtime) {
                 settings: options.telegramTokenFile !== undefined,
                 building: store.liveClaims(project, now),
                 runners: store.listRunners(),
-                heldSessions: new Map(store.openHeldSessions().reduce((by, one) => by.set(one.runner, (by.get(one.runner) ?? 0) + 1), new Map())),
                 worktrees: store
                     .listWorktrees()
                     .filter(one => project === null || sameRepo(one.repo, project)),
@@ -346,7 +345,6 @@ export function createPagesHandlers(runtime) {
                 }),
                 building: store.liveClaims(project, now),
                 runners: store.listRunners(),
-                heldSessions: new Map(store.openHeldSessions().reduce((by, one) => by.set(one.runner, (by.get(one.runner) ?? 0) + 1), new Map())),
                 worktrees: store.listWorktrees().filter(one => project === null || sameRepo(one.repo, project)),
                 episode: project === null ? null : store.latestWatchEpisode(project),
                 outboxPending: store.pendingForAttention().length,

package/dist/server/people-tokens.js

@@ -73,7 +73,6 @@ export function createPeopleHandlers(runtime) {
                 `<p class="meta">Operators with all-project access also manage the instance.</p><fieldset><legend>Projects</legend>${projectChoices.length === 0 ? `<p class="meta">Add a project before granting selected access.</p>` : projectChoices.map(repo => `<label class="row"><input type="checkbox" name="projects" value="${escape(repo)}"${selected?.includes(repo) ? " checked" : ""}>${escape(projectName(repo))}</label>`).join("")}</fieldset>`;
             const cards = accounts.map(one => {
                 const seen = lastSeenOf(one.name);
-                const attended = store.openAttendedOf(one.name);
                 const acts = store.recentActsOf(one.name);
                 const standing = one.revokedAt !== null
                     ? `revoked ${escape(one.revokedAt.slice(0, 16).replace("T", " "))} by ${personChip(one.revokedBy ?? "?")}`
@@ -87,9 +86,6 @@ export function createPeopleHandlers(runtime) {
                     approverView && one.revokedAt === null ? `<details><summary>Edit project access</summary><form method="post" action="/people/projects">${hiddenFields({ csrf, name: one.name })}${accessFields(one.projects)}<label>Your password<input type="password" name="token" autocomplete="current-password" required></label><p class="meta">Changing access signs this person out and ends their derived sessions and modes. Previously approved work stays recorded.</p><button type="submit">Save project access</button></form></details>` : "",
                     `<p class="meta">${seen === null ? "not signed in right now" : `signed in \u2014 active ${escape(new Date(seen).toISOString().slice(11, 16))} UTC`} \u00b7 joined ${escape(one.addedAt.slice(0, 10))}</p>`,
                     `<p><a href="${escape(personHref(one.name))}">Tokens and remote activity</a></p>`,
-                    attended.length === 0
-                        ? ""
-                        : `<p class="row">watching now: ${attended.map(session => `<a href="/t/${escape(session.taskId)}">${escape(session.taskId)}</a>`).join(", ")}</p>`,
                     acts.length === 0
                         ? `<p class="meta">No recorded acts yet</p>`
                         : acts.map(act => `<p class="row meta">${escape(act.kind)} ${escape(act.subject)} \u00b7 ${escape(act.at.slice(0, 16).replace("T", " "))}</p>`).join("\n"),

package/dist/server/route-table.d.ts

@@ -17,7 +17,7 @@ export type Caller = "anonymous" | "service" | "cookie" | "bearer" | "oauth" | "
 /** What the caller must hold: nothing, read, act (an approver or an `act` token), or a fresh password/provider check on top. */
 export type RouteScope = "none" | "read" | "act" | "step-up";
 /** Where the request's project comes from. */
-export type ProjectResolver = "none" | "session" | "form" | "form-path" | "task" | "run" | "decision" | "incident" | "routine" | "flow" | "proposal" | "conversation" | "coding" | "adapter";
+export type ProjectResolver = "none" | "session" | "form" | "form-path" | "task" | "run" | "decision" | "incident" | "flow" | "proposal" | "conversation" | "coding" | "adapter";
 /**
  * What a project-limited account may do here:
  * - `deny`: instance access only.

package/dist/server/route-table.js

@@ -120,7 +120,6 @@ get("tasks", "runs", "/runs", { limited: "collection" });
 get("pages", "menu", "/menu", { limited: "collection", ...free });
 get("tasks", "run.page", `^\\/r\\/${ID}$`, { project: "run", limited: "resource", ...free, sample: "/r/1" });
 get("tasks", "run.evidence", `^\\/r\\/${ID}\\/evidence\\/${ID}$`, { project: "run", limited: "resource", ...free, sample: "/r/1/evidence/2" });
-get("tasks", "contest.page", `^\\/contest\\/${ID}$`, { ...free, sample: "/contest/1" });
 get("pages", "caps", "/caps");
 get("flows", "flows.new", "/flows/new", { limited: "resource", ...free });
 get("flows", "flows.gallery", "^\\/flows\\/new\\/[a-z-]{1,40}$", { limited: "resource", ...free, sample: "/flows/new/triage" });
@@ -139,13 +138,14 @@ for (const one of ["run", "start", "new", "edit", "from-task", "preview", "expor
     get("flows", `recipes.${one}`, `/recipes/${one}`, { limited: "collection" });
 // Any other recipe screen answers the recipe area's own refusal.
 get("flows", "recipes.other", "^\\/recipes\\/.*$", { sample: "/recipes/unknown" });
+// v115: routines became scheduled flows; old links to them land on the flows page.
 get("tasks", "routines", "/routines", { limited: "collection" });
 get("chat", "chat.stream", "/chat/stream", free);
 get("chat", "chat.mate-status", "/chat/mate/status", free);
 get("chat", "chat.demo-live", "/chat/demo/live", free);
 get("chat", "chat.page", "/chat", { project: "conversation", limited: "conversation", ...free });
 get("chat", "chat.ack", `^\\/chat\\/ack\\/${ID}$`, { sample: "/chat/ack/1" });
-get("tasks", "routine.page", `^\\/routines\\/${ID}$`, { project: "routine", limited: "resource", sample: "/routines/1" });
+get("tasks", "routine.page", `^\\/routines\\/${ID}$`, { limited: "resource", sample: "/routines/1" });
 get("settings", "control", "/control");
 get("settings", "control.connection", "/control/connection");
 get("chat", "chat.action", `^\\/chat\\/action\\/${ID}$`, { project: "proposal", limited: "proposal", ...free, sample: "/chat/action/1" });
@@ -166,8 +166,6 @@ get("chat", "lead.status", "/lead/status", free);
 get("chat", "chat.task-status", "/chat/task-status", free);
 get("tasks", "decision.evidence", `^\\/d\\/${ID}\\/evidence\\/${ID}$`, { project: "decision", limited: "resource", ...free, sample: "/d/1/evidence/2" });
 // ---- console actions -------------------------------------------------------------------------------------------
-// The attended beat guards itself (cookie, form type, Sec-Fetch-Site) before the shared mutation guard.
-post("tasks", "session.attended-beats", "/session/attended-beats", { callers: ["cookie"], scopeRefusal: "your login can watch, not keep sessions alive", callerRefusal: { status: 403, type: "text/plain; charset=utf-8", body: "watching is a browser session's act" } });
 // The scripted demo: the handler answers a non-browser caller "no page here".
 post("chat", "chat.demo", "^\\/chat\\/demo\\/(ask|[0-9]{1,9}\\/(approve|change|revise|complete))$", { sample: "/chat/demo/ask" });
 post("settings", "provider.resume", "^\\/providers\\/[a-z]+\\/resume$", { sample: "/providers/codex/resume" });
@@ -243,12 +241,6 @@ post("people", "people.revoke", "/people/revoke", { scope: "step-up" });
 post("pages", "fleet.retire", "/fleet/runner/retire", { scope: "step-up" });
 // Answering a parked decision needs act access and irreversible-choice confirmation, not password step-up.
 post("tasks", "decision.answer", `^\\/d\\/${ID}\\/answer$`, { project: "decision", limited: "resource", scope: "act", sample: "/d/1/answer" });
-post("tasks", "contest.act.arm", `^\\/contest\\/${ID}\\/arm$`, { sample: "/contest/1/arm" });
-post("tasks", "contest.act.pick", `^\\/contest\\/${ID}\\/pick$`, { scope: "step-up", sample: "/contest/1/pick" });
-post("tasks", "contest.act.abandon", `^\\/contest\\/${ID}\\/abandon$`, { scope: "step-up", sample: "/contest/1/abandon" });
-post("tasks", "task.attend.attend-preview", `^\\/t\\/${TASK}\\/attend-preview$`, { callers: ["cookie"], project: "task", sample: "/t/one/attend-preview" });
-post("tasks", "task.attend.attend", `^\\/t\\/${TASK}\\/attend$`, { scope: "step-up", project: "task", sample: "/t/one/attend" });
-post("tasks", "task.attend.attend-revoke", `^\\/t\\/${TASK}\\/attend-revoke$`, { callers: ["cookie"], project: "task", sample: "/t/one/attend-revoke" });
 post("tasks", "task.act.hold", `^\\/t\\/${TASK}\\/hold$`, { project: "task", limited: "resource", sample: "/t/one/hold" });
 post("tasks", "task.act.unhold", `^\\/t\\/${TASK}\\/unhold$`, { project: "task", limited: "resource", sample: "/t/one/unhold" });
 post("tasks", "task.act.requeue", `^\\/t\\/${TASK}\\/requeue$`, { project: "task", limited: "resource", sample: "/t/one/requeue" });
@@ -291,15 +283,8 @@ post("chat", "chat.ack-send", `^\\/chat\\/ack\\/${ID}$`, { scope: "step-up", sam
 for (const one of ["prepare", "preview", "import", "save"])
     post("flows", `recipes.${one}-send`, `/recipes/${one}`, { limited: "collection" });
 post("flows", "recipes.launch-send", "/recipes/launch", { limited: "collection" });
-post("tasks", "routines.add", "/routines/add", { project: "form", limited: "collection" });
-post("tasks", "routine.act.approve", `^\\/routines\\/${ID}\\/approve$`, { scope: "step-up", project: "routine", limited: "resource", sample: "/routines/1/approve" });
-post("tasks", "routine.act.refresh", `^\\/routines\\/${ID}\\/refresh$`, { project: "routine", limited: "resource", sample: "/routines/1/refresh" });
-post("tasks", "routine.act.pause", `^\\/routines\\/${ID}\\/pause$`, { project: "routine", limited: "resource", sample: "/routines/1/pause" });
-post("tasks", "routine.act.resume", `^\\/routines\\/${ID}\\/resume$`, { project: "routine", limited: "resource", sample: "/routines/1/resume" });
-post("tasks", "routine.act.run-now", `^\\/routines\\/${ID}\\/run-now$`, { scope: "step-up", project: "routine", limited: "resource", sample: "/routines/1/run-now" });
 post("tasks", "run.act", `^\\/r\\/${ID}\\/(note|comment|revise|draft-repair|checks|add-tests)$`, { project: "run", limited: "resource", sample: "/r/1/note" });
 post("tasks", "session.editor-links", "/session/editor-links", { viewer: true });
-post("tasks", "run.turn", `^\\/r\\/${ID}\\/turn$`, { project: "run", sample: "/r/1/turn" });
 post("tasks", "incident.resolve", `^\\/i\\/${ID}\\/resolve$`, { project: "incident", sample: "/i/1/resolve" });
 /** The sole route table, in match order. */
 export const ROUTES = Object.freeze(rows.map(one => Object.freeze(one)));

package/dist/server/settings.js

@@ -66,7 +66,7 @@ import { startConnect } from "../mcp-connect.js";
 import { decideProposal, listProposals, memoryStatus } from "../memory-pass.js";
 import { checkModels, isNewModel, modelOptions, modelWords, RUNTIME_TOOLS, runtimeStates, seenModels, setWatch, updateRuntime, watchState } from "../model-catalog.js";
 import { modelsHtml, modelsScript } from "../models-ui.js";
-import { MODE_MAX_DAYS, modeDigestOf, modeTermsJson, modeWords, presetTerms } from "../modes.js";
+import { CHAT_APPROVE_ALL, MODE_MAX_DAYS, modeDigestOf, modeTermsJson, modeWords, presetTerms } from "../modes.js";
 import { monitoringChange, readMonitoring, saveMonitoring } from "../monitoring-settings.js";
 import { monitoringHtml, signingSecretHtml } from "../monitoring-ui.js";
 import { openRouterPickerScript } from "../openrouter-models.js";
@@ -96,7 +96,6 @@ import { addProjectInstructions, ASSISTANTS, detectPreparation, modelChoices, pr
 import { skillsHtml, skillsScript } from "../skills-ui.js";
 import { checkSlackCredentials, clearSlackCredentials, loadSlackCredentials, saveSlackCredentials, SLACK_MANIFEST, SlackError } from "../slack-api.js";
 import { slackSettingsHtml } from "../slack-settings.js";
-import { SlackState } from "../slack-state.js";
 import { spendCsv, spendHtml } from "../spend-ui.js";
 import { budgetStates, monthNamed, spendItems, usd as spendUsd, teammateNames as teammateNamesOf } from "../spend.js";
 import { removeSsoSettings, saveSsoSettings, SSO_CALLBACK, ssoChangeWords } from "../sso-settings.js";
@@ -200,10 +199,6 @@ export function createSettingsHandlers(runtime) {
                         `<option value="">approve plans and merges here, with my password (the default)</option>` +
                         `<option value="1">approve plans and merge ready pull requests from my paired chat, two taps each</option>` +
                         `</select><span class="meta">Plans that widen permissions, exceed the attempt cap or touch protected paths still open Toolroll.</span></label>`,
-                    `<label>If a subscription runs out<select name="allow-paid-fallback">` +
-                        `<option value="">never switch to a paid API key on its own (the default, every preset)</option>` +
-                        `<option value="1">allow the approved fallback — spend moves to that account</option>` +
-                        `</select></label>`,
                     `<button type="submit">Read the full terms</button>`,
                     `</form>`,
                     `</div>`,
@@ -1603,7 +1598,7 @@ export function createSettingsHandlers(runtime) {
             const body = readForm(posted, CONSOLE_FORMS.slack);
             if (who.via !== "cookie" || who.role !== "approver" || restricted() || !options.configDir)
                 return refuse(response, who, 403, "An installation approver can connect Slack.", "/settings");
-            const dir = options.configDir, state = new SlackState(store), action = url.pathname.split("/").at(-1);
+            const dir = options.configDir, state = new ChatState(store, "slack"), action = url.pathname.split("/").at(-1);
             const show = (problem, status = 400) => sendScreen(response, status, screen("Slack", slackSettingsHtml(store, dir, who.session.csrf, { problem, who: who.name }), { chrome: chromeFor(projectOf(who, request) ?? null, "settings") }));
             if (["password", "app-token", "bot-token"].some(key => body.getAll(key).length > 1))
                 return show("Submit one value for each field.");
@@ -2049,16 +2044,15 @@ export function createSettingsHandlers(runtime) {
                 planAuto: body.get("plan-auto") === "1",
                 reviewAuto: false,
                 reviewRetryAuto: false,
-                // The paid-fallback grant is NEVER a preset default (R8): unchecked
-                // stays false on every preset — only the explicit box grants it.
-                allowPaidFallback: body.get("allow-paid-fallback") === "1",
                 // The repair-auto grant is the SAME rule (v40): unchecked stays
                 // false on every preset — only the explicit box grants it, and the
                 // attempt cap it carries is meaningless without it.
                 repairAuto: false,
                 repairMaxAttempts: 0,
-                // Approving from the paired chat: only the explicit choice grants it.
+                // Approving from the paired chat: only the explicit choice grants it, naming every chat app it covers (a grant
+                // signed before it named them stays Telegram only).
                 chatApprove: body.get("chat-approve") === "1",
+                ...(body.get("chat-approve") === "1" ? { chatApproveChats: CHAT_APPROVE_ALL } : {}),
                 publication: body.get("publication") === "automerge" ? "automerge" : "notify",
             };
             if (["review-auto", "review-retry-auto", "repair-auto"].some(field => body.get(field) === "1")) {
@@ -2080,7 +2074,7 @@ export function createSettingsHandlers(runtime) {
                     `<input type="hidden" name="csrf" value="${escape(who.session.csrf)}">` +
                     `<input type="hidden" name="nonce" value="${escape(nonce)}">` +
                     `<input type="hidden" name="digest" value="${escape(digest)}">` +
-                    ["name", "days", "publication", "auto-approve", "plan-auto", "chat-approve", "allow-paid-fallback"]
+                    ["name", "days", "publication", "auto-approve", "plan-auto", "chat-approve"]
                         .map(field => `<input type="hidden" name="${field}" value="${escape(body.get(field) ?? "")}">`)
                         .join("") +
                     `<input type="hidden" name="expiry" value="${escape(expiry)}">` +