toolroll 0.9.57 → 0.9.58

package/dist/team-cli.js

@@ -5,11 +5,11 @@ import { randomBytes } from 'node:crypto';
 import { createInterface } from 'node:readline/promises';
 import { setTimeout as delay } from 'node:timers/promises';
 import { envelopeJson } from './envelope.js';
-import { sessionServiceOrigin } from './session-cli.js';
 import { databasePath } from './store.js';
 import { configBase, namedPath } from './names.js';
 import { parseApiToken } from './api-tokens.js';
 import { deprecationWarning } from './deprecations.js';
+import { PASSWORD_PROFILE_WARNING } from './password-bearer.js';
 /** The central service's own lead verbs; every other `lead …` (token, say, or none) is the local lead's. */
 const CENTRAL_LEAD_ACTIONS = ['list', 'create', 'update', 'member', 'transfer'];
 /** D5: deprecated (deprecations.ts). Each still runs this release, hidden from help and the contract, with one warning on stderr. */
@@ -45,6 +45,22 @@ existing local commands. Credentials stay in a private file, never in URLs or ar
 Reads and attachment do not start model work. Server permissions remain authoritative.`;
 export class UsageError extends Error {
 }
+/** Credentials are never sent to a URL with embedded authority, an API path, query, fragment or an insecure remote
+ * host. Fetch cannot follow redirects. */
+export function serviceOrigin(raw) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        throw new UsageError('The service origin must be HTTPS or loopback HTTP.');
+    }
+    if (url.username || url.password || url.search || url.hash || url.pathname !== '/')
+        throw new UsageError('The service origin must contain only the origin, with no credentials, path, query or fragment.');
+    if (url.protocol !== 'https:' && !(url.protocol === 'http:' && ['127.0.0.1', '[::1]', 'localhost'].includes(url.hostname)))
+        throw new UsageError('The service origin requires HTTPS except for loopback HTTP.');
+    return url.origin;
+}
 /** Transport metadata stays local to the CLI; only an actual HTTP 429 permits a follower read retry. */
 const RETRY_AFTER_MS = Symbol('retry-after-ms');
 function retryDelay(header) {
@@ -104,7 +120,7 @@ function profiles(options) {
         if (!record(parsed) || parsed.version !== 1 || typeof parsed.active !== 'string' || !record(parsed.profiles))
             throw new Error();
         for (const [name, one] of Object.entries(parsed.profiles)) {
-            if (!/^[A-Za-z0-9_-]{1,64}$/.test(name) || !record(one) || typeof one.origin !== 'string' || sessionServiceOrigin(one.origin) !== one.origin || typeof one.account !== 'string' || !accountValid(one.account) || typeof one.token !== 'string' || !tokenValid(one.token))
+            if (!/^[A-Za-z0-9_-]{1,64}$/.test(name) || !record(one) || typeof one.origin !== 'string' || serviceOrigin(one.origin) !== one.origin || typeof one.account !== 'string' || !accountValid(one.account) || typeof one.token !== 'string' || !tokenValid(one.token))
                 throw new Error();
         }
         if (!Object.hasOwn(parsed.profiles, parsed.active))
@@ -387,7 +403,7 @@ export async function maybeRunTeamCommand(argv, write, options = {}) {
         if (command === 'connect') {
             let origin;
             try {
-                origin = sessionServiceOrigin(parsed.positions[0]);
+                origin = serviceOrigin(parsed.positions[0]);
             }
             catch {
                 throw new UsageError('Use an HTTPS service origin (loopback HTTP is allowed), without credentials, paths, query or fragment.');
@@ -408,6 +424,8 @@ export async function maybeRunTeamCommand(argv, write, options = {}) {
                 secret = (flags['token-file'] ? privateFile(value(flags, 'token-file'), 8192) : await (options.readStdin ?? stdinSecret)()).trim();
             if (!accountValid(account) || !tokenValid(secret))
                 throw new UsageError('Provide an account name and a valid sign-in secret from your selected source.');
+            if (parseApiToken(secret) === null)
+                stderr(PASSWORD_PROFILE_WARNING);
             const profile = { origin, account, token: secret }, checked = await perform(profile, { operation: 'list', args: {} }, options);
             if (!checked.ok) {
                 emit(checked);
@@ -421,6 +439,8 @@ export async function maybeRunTeamCommand(argv, write, options = {}) {
         if (!profile || !Object.hasOwn(saved.profiles, profileName))
             throw new UsageError('No saved connection. Use connect with your individual sign-in first.');
         secret = profile.token;
+        if (parseApiToken(secret) === null)
+            stderr(PASSWORD_PROFILE_WARNING);
         const call = (operation, args, signal) => perform(profile, { operation, args }, { ...options, ...(signal === undefined ? {} : { signal }) });
         if (command === 'chat' || command === 'brief')
             return await chat(command, flags, profile.account, call, emit, options, stderr);

package/dist/toolroll-update.js

@@ -35,7 +35,7 @@ import { processMayBeAlive } from "./process-liveness.js";
 import { assertCodingUpdateStopped, backupCodingCatalog, codingCatalogExists, releaseStaleCodingOwner, removeCodingUpdateGate } from "./coding-update.js";
 import { installLaunchdService, launchdPlist, stopLaunchdService, writeFileDurably } from "./daemon.js";
 import { NAME } from "./names.js";
-import { orphanKey, updateSafeSchema, V117_RENAMED_COLUMNS, V117_RENAMED_TABLES } from "./store.js";
+import { orphanKey, updateSafeSchema, V117_RENAMED_COLUMNS, V117_RENAMED_TABLES, V118_MERGED_TABLES } from "./store.js";
 import { isNewer, REGISTRY } from "./releases.js";
 import { markNeverIndex } from "./never-index.js";
 import { readRuntimeUpdateJournal, RUNTIME_PHASES, RUNTIME_UPDATE_STEPS, stagedStartedAt, updaterStartingOf } from "./contracts/update-journal.js";
@@ -382,6 +382,8 @@ const HISTORY_RULES = {
     // subagent*); a column renamed in a table that keeps its name keeps its values under the new one.
     ...Object.fromEntries(Object.entries(V117_RENAMED_TABLES).map(([old, now]) => [old, { moved: { into: now, where: "1" } }])),
     ...Object.fromEntries(V117_RENAMED_COLUMNS.filter(([table]) => !Object.values(V117_RENAMED_TABLES).includes(table)).map(([table, from, to]) => [table, { renamed: { [from]: to } }])),
+    // v118 (D7): every API token, coordinator and lead token arrives in the one credential table under its kind.
+    ...Object.fromEntries(Object.entries(V118_MERGED_TABLES).map(([table, kind]) => [table, { moved: { into: "credential", where: `kind = '${kind}'` } }])),
 };
 /** The tables a migration may remove whole (v115's removed features). */
 export const RETIRED_TABLES = Object.freeze(Object.keys(HISTORY_RULES).filter(name => HISTORY_RULES[name].retired));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolroll",
-  "version": "0.9.57",
+  "version": "0.9.58",
   "description": "A control plane for unattended coding agents — queue tasks, walk away, come back to pull requests. Agents build in leased worktrees, never touch your default branch, and interrupt you only for decisions that need a human.",
   "directories": {
     "doc": "docs"

package/dist/session-http.d.ts

@@ -1,24 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http';
-import { type SessionOperation, type SessionRequests, type SessionResponse } from './session-contract.js';
-import { type Admission } from './request-budget.js';
-export type SessionHttpActor = {
-    name: string;
-    generation: number;
-};
-export type SessionHttpExecute = <O extends SessionOperation>(actor: SessionHttpActor, operation: O, request: SessionRequests[O]) => Promise<SessionResponse>;
-export type SessionHttpOptions = {
-    /** Verify the bearer against the current account and installation-wide
-     * operator role. Derive both fields here, never from the JSON request.
-     * Host, TLS and other server admission checks remain with the caller. */
-    authenticate: (request: IncomingMessage) => SessionHttpActor | null | Promise<SessionHttpActor | null>;
-    /** The existing live owner's operation. Null means no owner is ready.
-     * The service rechecks actor generation and project access at execution. */
-    execute: SessionHttpExecute | null;
-    /** The bearer request's budget by source (request-budget.ts): charged once, before the credential is checked or a body read. */
-    admit?: (request: IncomingMessage) => Admission;
-    /** Account admission after successful authentication, before any body read or owner call. */
-    admitAuthenticated?: (request: IncomingMessage, actor: SessionHttpActor) => Admission;
-};
-/** Handle this API family before the browser's form parser or login redirects.
- * This adapter dispatches at most once. It owns no catalog, database or provider. */
-export declare function handleSessionHttp(request: IncomingMessage, response: ServerResponse, options: SessionHttpOptions): Promise<boolean>;

package/dist/session-http.js

@@ -1,170 +0,0 @@
-import { adapterPolicy } from "./server/route-policy.js";
-import { SESSION_REQUEST_BYTES, SESSION_RESPONSE_BYTES, isSessionResponse, sessionDescriptor, validateSessionRequest, } from './session-contract.js';
-import { limitWords } from './request-budget.js';
-function readBody(request) {
-    return new Promise(resolve => {
-        let size = 0;
-        let chunks = [];
-        let settled = false;
-        const finish = (result) => {
-            if (settled)
-                return;
-            settled = true;
-            chunks = [];
-            resolve(result);
-        };
-        const cleanup = () => {
-            request.off('data', onData);
-            request.off('end', onEnd);
-            request.off('aborted', onAborted);
-            request.off('error', onError);
-            request.off('close', onClose);
-        };
-        const onData = (chunk) => {
-            // After rejecting an oversized request, drain without retaining it.
-            if (settled)
-                return;
-            const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-            size += bytes.length;
-            if (size > SESSION_REQUEST_BYTES)
-                finish({ ok: false, status: 413, reason: 'request-too-large', message: 'The session request is too large.' });
-            else
-                chunks.push(bytes);
-        };
-        const onEnd = () => {
-            cleanup();
-            if (settled)
-                return;
-            try {
-                const value = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(Buffer.concat(chunks)));
-                finish({ ok: true, value });
-            }
-            catch {
-                finish({ ok: false, status: 400, reason: 'invalid-json', message: 'Send a valid UTF-8 JSON request.' });
-            }
-        };
-        const onAborted = () => {
-            finish({ ok: false, status: 400, reason: 'incomplete-request', message: 'The session request did not finish arriving.' });
-        };
-        const onError = () => { onAborted(); cleanup(); };
-        const onClose = () => { onAborted(); cleanup(); };
-        request.on('data', onData);
-        request.once('end', onEnd);
-        request.once('aborted', onAborted);
-        request.once('error', onError);
-        request.once('close', onClose);
-        if (request.aborted)
-            onAborted();
-    });
-}
-/** Handle this API family before the browser's form parser or login redirects.
- * This adapter dispatches at most once. It owns no catalog, database or provider. */
-export async function handleSessionHttp(request, response, options) {
-    const path = (request.url ?? '').split('?')[0] ?? '';
-    if (path !== '/api/sessions' && !path.startsWith('/api/sessions/'))
-        return false;
-    const match = /^\/api\/sessions\/([a-z]+)$/.exec(request.url ?? '');
-    const spec = match?.[1] === undefined ? undefined : sessionDescriptor(match[1]);
-    const operation = spec?.operation;
-    const write = (status, body, notSent = false) => {
-        if (response.destroyed || response.writableEnded)
-            return;
-        response.statusCode = status;
-        response.setHeader('content-type', 'application/json; charset=utf-8');
-        response.setHeader('content-length', Buffer.byteLength(body));
-        response.setHeader('cache-control', 'no-store');
-        response.setHeader('x-content-type-options', 'nosniff');
-        if (notSent)
-            response.setHeader('x-standing-orders-session-delivery', 'not-sent');
-        else
-            response.removeHeader('x-standing-orders-session-delivery');
-        response.end(body);
-    };
-    const reject = (status, reason, message) => {
-        // No owner call has occurred. This marker is never inferred from an
-        // exception, a lost response, or a response too large to deliver.
-        const reply = { version: 1, ...(operation === undefined ? {} : { operation }), ok: false,
-            status: 'rejected', delivery: 'not-sent', retry: spec?.mutation === false ? 'safe-read' : 'never', reason, message, nextActions: [] };
-        write(status, JSON.stringify(reply), true);
-        request.resume();
-        return true;
-    };
-    if (!spec || operation === undefined)
-        return reject(404, 'unsupported-operation', 'This session operation is not supported.');
-    if (request.method !== 'POST') {
-        response.setHeader('allow', 'POST');
-        return reject(405, 'method-not-allowed', 'Session operations require POST.');
-    }
-    if (request.headers.origin !== undefined)
-        return reject(403, 'browser-request', 'Use the authenticated session client for this operation.');
-    const authorizationCount = request.rawHeaders.filter((_, index) => index % 2 === 0 && request.rawHeaders[index]?.toLowerCase() === 'authorization').length;
-    if (authorizationCount !== 1 || !/^Bearer (.+):(.+)$/.test(request.headers.authorization ?? '')) {
-        return reject(401, 'unauthenticated', 'Current operator bearer credentials are required.');
-    }
-    const refuseAdmission = (admitted) => {
-        if (admitted.ok)
-            return false;
-        if (admitted.status === 503)
-            return reject(503, 'limits-unavailable', 'Request limits could not be checked; nothing ran. Try again shortly.');
-        response.setHeader('retry-after', String(admitted.retryAfter));
-        return reject(429, 'rate-limited', limitWords(admitted.limit, admitted.retryAfter));
-    };
-    if (options.admit && refuseAdmission(options.admit(request)))
-        return true;
-    let actor;
-    try {
-        actor = await options.authenticate(request);
-    }
-    catch {
-        return reject(503, 'authentication-unavailable', 'Operator access could not be checked. Try again after the service is ready.');
-    }
-    if (actor === null || typeof actor.name !== 'string' || !actor.name.trim() || !Number.isSafeInteger(actor.generation) || actor.generation < 1) {
-        return reject(401, 'unauthenticated', 'Current operator bearer credentials are required.');
-    }
-    if (options.admitAuthenticated && refuseAdmission(options.admitAuthenticated(request, actor)))
-        return true;
-    if (!adapterPolicy({ caller: "bearer", capability: "act" }, spec.mutation ? "act" : "read").ok)
-        return reject(403, "forbidden", "Current operator access is required.");
-    const media = request.headers['content-type']?.split(';')[0]?.trim().toLowerCase();
-    if (media !== 'application/json')
-        return reject(415, 'unsupported-media-type', 'Send the session request as application/json.');
-    const length = request.headers['content-length'];
-    if (length !== undefined && Number(length) > SESSION_REQUEST_BYTES)
-        return reject(413, 'request-too-large', 'The session request is too large.');
-    if (options.execute === null)
-        return reject(503, 'session-unavailable', 'The session owner is not ready.');
-    const body = await readBody(request);
-    if (!body.ok)
-        return reject(body.status, body.reason, body.message);
-    const validated = validateSessionRequest(operation, body.value);
-    if (!validated.ok)
-        return reject(400, 'invalid-request', validated.message);
-    if (request.aborted || response.destroyed)
-        return true;
-    const uncertain = (reason, message) => {
-        const sessionId = 'sessionId' in validated.request ? validated.request.sessionId : undefined;
-        return { version: 1, operation, ok: false, status: 'uncertain', delivery: 'unknown', retry: 'inspect-first', reason, message,
-            nextActions: [{ operation: sessionId ? 'show' : 'list', label: sessionId ? 'Inspect session' : 'Inspect saved sessions', ...(sessionId ? { sessionId } : {}) }] };
-    };
-    let reply;
-    let encoded;
-    let status;
-    try {
-        reply = await options.execute(actor, operation, validated.request);
-        if (!isSessionResponse(reply, operation))
-            throw new Error('Invalid owner response');
-        encoded = JSON.stringify(reply);
-        if (Buffer.byteLength(encoded) > SESSION_RESPONSE_BYTES) {
-            reply = uncertain('response-too-large', 'The owner response is too large to deliver. Inspect saved activity before continuing; this request was not retried.');
-            encoded = JSON.stringify(reply);
-        }
-        status = reply.status === 'rejected' ? 409 : reply.status === 'uncertain' ? 502 : reply.status === 'pending' ? 202 : 200;
-    }
-    catch {
-        reply = uncertain('unconfirmed-response', 'The owner response could not be confirmed. Inspect saved activity before continuing; this request was not retried.');
-        encoded = JSON.stringify(reply);
-        status = 502;
-    }
-    write(status, encoded);
-    return true;
-}

package/dist/session-server.d.ts

@@ -1,17 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http';
-import type { Store } from './store.js';
-import type { CodingWorkspace } from './coding-workspace.js';
-import { type SessionHttpActor } from './session-http.js';
-import type { Admission } from './request-budget.js';
-/** Bind the transport to createDecisionServer's existing catalog owner and
- * live project admission. No cookie, coordinator token or caller-supplied actor
- * can acquire installation-wide native coding authority through this adapter. */
-export declare function createSessionEndpoint(options: {
-    store: Store;
-    workspace: CodingWorkspace | null;
-    projects: () => readonly string[];
-    projectAllowed: (repo: string) => boolean;
-    /** The request's source budget (request-budget.ts), charged once before the password is checked. */
-    admit?: (request: IncomingMessage) => Admission;
-    admitAuthenticated?: (request: IncomingMessage, actor: SessionHttpActor) => Admission;
-}): (request: IncomingMessage, response: ServerResponse) => Promise<boolean>;

package/dist/session-server.js

@@ -1,39 +0,0 @@
-import { realpathSync } from 'node:fs';
-import { authenticateAccount } from './scope.js';
-import { handleSessionHttp } from './session-http.js';
-import { SessionService } from './session-service.js';
-/** Bind the transport to createDecisionServer's existing catalog owner and
- * live project admission. No cookie, coordinator token or caller-supplied actor
- * can acquire installation-wide native coding authority through this adapter. */
-export function createSessionEndpoint(options) {
-    const { store } = options;
-    const authorized = (actor, repo) => {
-        const account = store.accountOf(actor.name);
-        return account !== null && account.revokedAt === null && account.generation === actor.generation && store.isInstanceOperator(actor.name)
-            && (repo === undefined || (options.projectAllowed(repo) && options.projects().includes(repo)));
-    };
-    const service = options.workspace === null || store.isDemo() ? null : new SessionService({ workspace: options.workspace, authorized,
-        project: (actor, input) => {
-            const path = realpathSync(input);
-            if (!authorized(actor, path) || !options.projects().includes(path))
-                throw Error('Choose a project already admitted to this installation.');
-            return path;
-        },
-    });
-    return (request, response) => handleSessionHttp(request, response, {
-        ...(options.admit === undefined ? {} : { admit: options.admit }),
-        ...(options.admitAuthenticated === undefined ? {} : { admitAuthenticated: options.admitAuthenticated }),
-        authenticate: request => {
-            const bearer = /^Bearer (.+):(.+)$/.exec(request.headers.authorization ?? '');
-            if (!bearer)
-                return null;
-            const name = bearer[1];
-            const authentication = authenticateAccount(store, name, bearer[2]);
-            if (!authentication.ok)
-                return null;
-            const actor = { name, generation: authentication.generation };
-            return authorized(actor) ? actor : null;
-        },
-        execute: service === null ? null : (actor, operation, request) => service.execute(actor, operation, request),
-    });
-}